1# Magic data for file(1) command. 2# Format is described in magic(files), where: 3# files is 5 on V7 and BSD, 4 on SV, and ?? on SVID. 4# Don't edit this file, edit /etc/magic or send your magic improvements 5# to the maintainers, at file@astron.com 6 7#------------------------------------------------------------------------------ 8# Localstuff: file(1) magic for locally observed files 9# 10# $File: Localstuff,v 1.5 2007/01/12 17:38:27 christos Exp $ 11# Add any locally observed files here. Remember: 12# text if readable, executable if runnable binary, data if unreadable. 13 14#------------------------------------------------------------------------------ 15# $File: acorn,v 1.7 2019/04/19 00:42:27 christos Exp $ 16# acorn: file(1) magic for files found on Acorn systems 17# 18 19# RISC OS Chunk File Format 20# From RISC OS Programmer's Reference Manual, Appendix D 21# We guess the file type from the type of the first chunk. 220 lelong 0xc3cbc6c5 RISC OS Chunk data 23>12 string OBJ_ \b, AOF object 24>12 string LIB_ \b, ALF library 25 26# RISC OS AIF, contains "SWI OS_Exit" at offset 16. 2716 lelong 0xef000011 RISC OS AIF executable 28 29# RISC OS Draw files 30# From RISC OS Programmer's Reference Manual, Appendix E 310 string Draw RISC OS Draw file data 32 33# RISC OS new format font files 34# From RISC OS Programmer's Reference Manual, Appendix E 350 string FONT\0 RISC OS outline font data, 36>5 byte x version %d 370 string FONT\1 RISC OS 1bpp font data, 38>5 byte x version %d 390 string FONT\4 RISC OS 4bpp font data 40>5 byte x version %d 41 42# RISC OS Music files 43# From RISC OS Programmer's Reference Manual, Appendix E 440 string Maestro\r RISC OS music file 45>8 byte x version %d 46 47>8 byte x type %d 48 49# Digital Symphony data files 50# From: Bernard Jungen (bern8817@euphonynet.be) 510 string \x02\x01\x13\x13\x13\x01\x0d\x10 Digital Symphony sound sample (RISC OS), 52>8 byte x version %d, 53>9 pstring x named "%s", 54>(9.b+19) byte =0 8-bit logarithmic 55>(9.b+19) byte =1 LZW-compressed linear 56>(9.b+19) byte =2 8-bit linear signed 57>(9.b+19) byte =3 16-bit linear signed 58>(9.b+19) byte =4 SigmaDelta-compressed linear 59>(9.b+19) byte =5 SigmaDelta-compressed logarithmic 60>(9.b+19) byte >5 unknown format 61 620 string \x02\x01\x13\x13\x14\x12\x01\x0b Digital Symphony song (RISC OS), 63>8 byte x version %d, 64>9 byte =1 1 voice, 65>9 byte !1 %d voices, 66>10 leshort =1 1 track, 67>10 leshort !1 %d tracks, 68>12 leshort =1 1 pattern 69>12 leshort !1 %d patterns 70 710 string \x02\x01\x13\x13\x10\x14\x12\x0e 72>9 byte =0 Digital Symphony sequence (RISC OS), 73>>8 byte x version %d, 74>>10 byte =1 1 line, 75>>10 byte !1 %d lines, 76>>11 leshort =1 1 position 77>>11 leshort !1 %d positions 78>9 byte =1 Digital Symphony pattern data (RISC OS), 79>>8 byte x version %d, 80>>10 leshort =1 1 pattern 81>>10 leshort !1 %d patterns 82 83# From: Joerg Jenderek 84# URL: https://www.kyzer.me.uk/pack/xad/#PackDir 85# reference: https://www.kyzer.me.uk/pack/xad/xad_PackDir.lha/PackDir.c 86# GRR: line below is too general as it matches also "Git pack" in ./revision 870 string PACK\0 88# check for valid compression method 0-4 89>5 ulelong <5 90# https://www.riscosopen.org/wiki/documentation/show/Introduction%20To%20Filing%20Systems 91# To skip "Git pack" version 0 test for root directory object like 92# ADFS::RPC.$.websitezip.FONTFIX 93>>9 string >ADFS\ PackDir archive (RISC OS) 94# TrID labels above as "Acorn PackDir compressed Archive" 95# compression mode y (0 - 4) for GIF LZW with a maximum n bits 96# (y~n,0~12,1~13,2~14,3~15,4~16) 97>>>5 ulelong+12 x \b, LZW %u-bits compression 98# https://www.filebase.org.uk/filetypes 99# !Packdir compressed archive has three hexadecimal digits code 68E 100!:mime application/x-acorn-68E 101!:ext pkd/bin 102# null terminated root directory object like IDEFS::IDE-4.$.Apps.GRAPHICS.!XFMPdemo 103>>>9 string x \b, root "%s" 104# load address 0xFFFtttdd, ttt is the object filetype and dddddddddd is time 105>>>>&1 ulelong x \b, load address 0x%x 106# execution address 0xdddddddd dddddddddd is 40 bit unsigned centiseconds since 1.1.1900 UTC 107>>>>&5 ulelong x \b, exec address 0x%x 108# attributes (bits: 0~owner read,1~owner write,3~no delete,4~public read,5~public write) 109>>>>&9 ulelong x \b, attributes 0x%x 110# number of entries in this directory. for root dir 0 111#>>>&13 ulelong x \b, entries 0x%x 112# the entries start here with object name 113>>>>&17 string x \b, 1st object "%s" 114 115 116#------------------------------------------------------------------------------ 117# $File: adi,v 1.4 2009/09/19 16:28:07 christos Exp $ 118# adi: file(1) magic for ADi's objects 119# From Gregory McGarry <g.mcgarry@ieee.org> 120# 1210 leshort 0x521c COFF DSP21k 122>18 lelong &02 executable, 123>18 lelong ^02 124>>18 lelong &01 static object, 125>>18 lelong ^01 relocatable object, 126>18 lelong &010 stripped 127>18 lelong ^010 not stripped 128 129#------------------------------------------------------------------------------ 130# $File: adventure,v 1.18 2019/04/19 00:42:27 christos Exp $ 131# adventure: file(1) magic for Adventure game files 132# 133# from Allen Garvin <earendil@faeryland.tamu-commerce.edu> 134# Edited by Dave Chapeskie <dchapes@ddm.on.ca> Jun 28, 1998 135# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002 136# 137# ALAN 138# I assume there are other, lower versions, but these are the only ones I 139# saw in the archive. 1400 beshort 0x0206 ALAN game data 141>2 byte <10 version 2.6%d 142 143 144# Infocom (see z-machine) 145#------------------------------------------------------------------------------ 146# Z-machine: file(1) magic for Z-machine binaries. 147# Sanity checks by David Griffith <dave@661.org> 148# Updated by Adam Buchbinder <adam.buchbinder@gmail.com> 149# 150#http://www.gnelson.demon.co.uk/zspec/sect11.html 151#https://www.jczorkmid.net/~jpenney/ZSpec11-latest.txt 152#https://en.wikipedia.org/wiki/Z-machine 153# The first byte is the Z-machine revision; it is always between 1 and 8. We 154# had false matches (for instance, inbig5.ocp from the Omega TeX extension as 155# well as an occasional MP3 file), so we sanity-check the version number. 156# 157# It might be possible to sanity-check the release number as well, as it seems 158# (at least in classic Infocom games) to always be a relatively small number, 159# always under 150 or so, but as this isn't rigorous, we'll wait on that until 160# it becomes clear that it's needed. 161# 1620 ubyte >0 163>0 ubyte <9 164>>16 belong&0xfe00f0f0 0x3030 165>>>0 ubyte < 10 166>>>>2 ubeshort x 167>>>>>18 regex [0-9][0-9][0-9][0-9][0-9][0-9] 168>>>>>>0 ubyte < 10 Infocom (Z-machine %d 169>>>>>>>2 ubeshort x \b, Release %d 170>>>>>>>>18 string >\0 \b, Serial %.6s 171>>>>>>>>18 string x \b) 172!:strength + 40 173!:mime application/x-zmachine 174 175#------------------------------------------------------------------------------ 176# Glulx: file(1) magic for Glulx binaries. 177# 178# David Griffith <dave@661.org> 179# I haven't checked for false matches yet. 180# 1810 string Glul Glulx game data 182>4 beshort x (Version %d 183>>6 byte x \b.%d 184>>8 byte x \b.%d) 185>36 string Info Compiled by Inform 186!:mime application/x-glulx 187 188 189# For Quetzal and blorb magic see iff 190 191 192# TADS (Text Adventure Development System) version 2 193# All files are machine-independent (games compile to byte-code) and are tagged 194# with a version string of the form "V2.<digit>.<digit>\0". 195# Game files start with "TADS2 bin\n\r\032\0" then the compiler version. 1960 string TADS2\ bin TADS 197>9 belong !0x0A0D1A00 game data, CORRUPTED 198>9 belong 0x0A0D1A00 199>>13 string >\0 %s game data 200!:mime application/x-tads 201# Resource files start with "TADS2 rsc\n\r\032\0" then the compiler version. 2020 string TADS2\ rsc TADS 203>9 belong !0x0A0D1A00 resource data, CORRUPTED 204>9 belong 0x0A0D1A00 205>>13 string >\0 %s resource data 206!:mime application/x-tads 207# Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian 208# 2-byte length N, the N-char name of the game file *without* a NUL (darn!), 209# "TADS2 save\n\r\032\0" and the interpreter version. 2100 string TADS2\ save/g TADS 211>12 belong !0x0A0D1A00 saved game data, CORRUPTED 212>12 belong 0x0A0D1A00 213>>(16.s+32) string >\0 %s saved game data 214!:mime application/x-tads 215# Other saved game files start with "TADS2 save\n\r\032\0" and the interpreter 216# version. 2170 string TADS2\ save TADS 218>10 belong !0x0A0D1A00 saved game data, CORRUPTED 219>10 belong 0x0A0D1A00 220>>14 string >\0 %s saved game data 221!:mime application/x-tads 222 223# TADS (Text Adventure Development System) version 3 224# Game files start with "T3-image\015\012\032" 2250 string T3-image\015\012\032 226>11 leshort x TADS 3 game data (format version %d) 227# Saved game files start with "T3-state-v####\015\012\032" 228# where #### is a format version number 2290 string T3-state-v 230>14 string \015\012\032 TADS 3 saved game data (format version 231>>10 byte x %c 232>>11 byte x \b%c 233>>12 byte x \b%c 234>>13 byte x \b%c) 235!:mime application/x-t3vm-image 236 237# edited by David Griffith <dave@661.org> 238# Danny Milosavljevic <danny.milo@gmx.net> 239# These are ADRIFT (adventure game standard) game files, extension .taf 240# Checked from source at (http://www.adrift.co/) and various taf files 241# found at the Interactive Fiction Archive (https://ifarchive.org/) 2420 belong 0x3C423FC9 243>4 belong 0x6A87C2CF Adrift game file version 244>>8 belong 0x94453661 3.80 245>>8 belong 0x94453761 3.90 246>>8 belong 0x93453E61 4.0 247>>8 belong 0x92453E61 5.0 248>>8 default x unknown 249!:mime application/x-adrift 250 251#------------------------------------------------------------------------------ 252# $File: algol68,v 1.3 2018/10/19 01:04:21 christos Exp $ 253# algol68: file(1) magic for Algol 68 source 254# 2550 search/8192 (input, Algol 68 source text 256!:mime text/x-Algol68 2570 regex/1024 \^PROC Algol 68 source text 258!:mime text/x-Algol68 2590 regex/1024 \bMODE[\t\ ] Algol 68 source text 260!:mime text/x-Algol68 2610 regex/1024 \bREF[\t\ ] Algol 68 source text 262!:mime text/x-Algol68 2630 regex/1024 \bFLEX[\t\ ]\*\\[ Algol 68 source text 264!:mime text/x-Algol68 265#0 regex [\t\ ]OD Algol 68 source text 266#!:mime text/x-Algol68 267#0 regex [\t\ ]FI Algol 68 source text 268#!:mime text/x-Algol68 269 270#------------------------------------------------------------------------------ 271# $File: allegro,v 1.4 2009/09/19 16:28:07 christos Exp $ 272# allegro: file(1) magic for Allegro datafiles 273# Toby Deshane <hac@shoelace.digivill.net> 274# 2750 belong 0x736C6821 Allegro datafile (packed) 2760 belong 0x736C682E Allegro datafile (not packed/autodetect) 2770 belong 0x736C682B Allegro datafile (appended exe data) 278 279#------------------------------------------------------------------------------ 280# $File: alliant,v 1.7 2009/09/19 16:28:07 christos Exp $ 281# alliant: file(1) magic for Alliant FX series a.out files 282# 283# If the FX series is the one that had a processor with a 68K-derived 284# instruction set, the "short" should probably become "beshort" and the 285# "long" should probably become "belong". 286# If it's the i860-based one, they should probably become either the 287# big-endian or little-endian versions, depending on the mode they ran 288# the 860 in.... 289# 2900 short 0420 0420 Alliant virtual executable 291>2 short &0x0020 common library 292>16 long >0 not stripped 2930 short 0421 0421 Alliant compact executable 294>2 short &0x0020 common library 295>16 long >0 not stripped 296 297#------------------------------------------------------------------------------ 298# $File: amanda,v 1.6 2017/03/17 21:35:28 christos Exp $ 299# amanda: file(1) magic for amanda file format 300# 3010 string AMANDA:\ AMANDA 302>8 string TAPESTART\ DATE tape header file, 303>>23 string X 304>>>25 string >\ Unused %s 305>>23 string >\ DATE %s 306>8 string FILE\ dump file, 307>>13 string >\ DATE %s 308 309#------------------------------------------------------------------------------ 310# $File: amigaos,v 1.17 2018/10/16 18:57:19 christos Exp $ 311# amigaos: file(1) magic for AmigaOS binary formats: 312 313# 314# From ignatios@cs.uni-bonn.de (Ignatios Souvatzis) 315# 3160 belong 0x000003fa AmigaOS shared library 3170 belong 0x000003f3 AmigaOS loadseg()ble executable/binary 3180 belong 0x000003e7 AmigaOS object/library data 319# 3200 beshort 0xe310 Amiga Workbench 321>2 beshort 1 322>>48 byte 1 disk icon 323>>48 byte 2 drawer icon 324>>48 byte 3 tool icon 325>>48 byte 4 project icon 326>>48 byte 5 garbage icon 327>>48 byte 6 device icon 328>>48 byte 7 kickstart icon 329>>48 byte 8 workbench application icon 330>2 beshort >1 icon, vers. %d 331# 332# various sound formats from the Amiga 333# G=F6tz Waschk <waschk@informatik.uni-rostock.de> 334# 3350 string FC14 Future Composer 1.4 Module sound file 3360 string SMOD Future Composer 1.3 Module sound file 3370 string AON4artofnoise Art Of Noise Module sound file 3381 string MUGICIAN/SOFTEYES Mugician Module sound file 33958 string SIDMON\ II\ -\ THE Sidmon 2.0 Module sound file 3400 string Synth4.0 Synthesis Module sound file 3410 string ARP. The Holy Noise Module sound file 3420 string BeEp\0 JamCracker Module sound file 3430 string COSO\0 Hippel-COSO Module sound file 344# Too simple (short, pure ASCII, deep), MPi 345#26 string V.3 Brian Postma's Soundmon Module sound file v3 346#26 string BPSM Brian Postma's Soundmon Module sound file v3 347#26 string V.2 Brian Postma's Soundmon Module sound file v2 348 349# The following are from: "Stefan A. Haubenthal" <polluks@web.de> 3500 beshort 0x0f00 AmigaOS bitmap font 3510 beshort 0x0f03 AmigaOS outline font 3520 belong 0x80001001 AmigaOS outline tag 3530 string ##\ version catalog translation 3540 string EMOD\0 Amiga E module 3558 string ECXM\0 ECX module 3560 string/c @database AmigaGuide file 357 358# Amiga disk types 359# 3600 string RDSK Rigid Disk Block 361>160 string x on %.24s 3620 string DOS\0 Amiga DOS disk 3630 string DOS\1 Amiga FFS disk 3640 string DOS\2 Amiga Inter DOS disk 3650 string DOS\3 Amiga Inter FFS disk 3660 string DOS\4 Amiga Fastdir DOS disk 3670 string DOS\5 Amiga Fastdir FFS disk 3680 string KICK Kickstart disk 369 370# From: Alex Beregszaszi <alex@fsn.hu> 3710 string LZX LZX compressed archive (Amiga) 372 373# From: Przemek Kramarczyk <pkramarczyk@gmail.com> 3740 string .KEY AmigaDOS script 3750 string .key AmigaDOS script 376 377# AMOS Basic file formats 378# https://www.exotica.org.uk/wiki/AMOS_file_formats 3790 string AMOS\040Basic\040 AMOS Basic source code 380>11 byte =0x56 \b, tested 381>11 byte =0x76 \b, untested 3820 string AMOS\040Pro AMOS Basic source code 383>11 byte =0x56 \b, tested 384>11 byte =0x76 \b, untested 3850 string AmSp AMOS Basic sprite bank 386>4 beshort x \b, %d sprites 3870 string AmIc AMOS Basic icon bank 388>4 beshort x \b, %d icons 3890 string AmBk AMOS Basic memory bank 390>4 beshort x \b, bank number %d 391>8 belong&0xFFFFFFF x \b, length %d 392>12 regex .{8} \b, type %s 3930 string AmBs AMOS Basic memory banks 394>4 beshort x \b, %d banks 395 396#------------------------------------------------------------ 397# $File: android,v 1.16 2019/11/15 21:03:14 christos Exp $ 398# Various android related magic entries 399#------------------------------------------------------------ 400 401# Dalvik .dex format. http://retrodev.com/android/dexformat.html 402# From <mkf@google.com> "Mike Fleming" 403# Fixed to avoid regexec 17 errors on some dex files 404# From <diff@lookout.com> "Tim Strazzere" 4050 string dex\n 406>0 regex dex\n[0-9]{2}\0 Dalvik dex file 407>4 string >000 version %s 4080 string dey\n 409>0 regex dey\n[0-9]{2}\0 Dalvik dex file (optimized for host) 410>4 string >000 version %s 411 412# Android bootimg format 413# From https://android.googlesource.com/\ 414# platform/system/core/+/master/mkbootimg/bootimg.h 415# https://github.com/djrbliss/loki/blob/master/loki.h#L43 4160 string ANDROID! Android bootimg 417>1024 string LOKI \b, LOKI'd 418>>1028 lelong 0 \b (boot) 419>>1028 lelong 1 \b (recovery) 420>8 lelong >0 \b, kernel 421>>12 lelong >0 \b (0x%x) 422>16 lelong >0 \b, ramdisk 423>>20 lelong >0 \b (0x%x) 424>24 lelong >0 \b, second stage 425>>28 lelong >0 \b (0x%x) 426>36 lelong >0 \b, page size: %d 427>38 string >0 \b, name: %s 428>64 string >0 \b, cmdline (%s) 429 430# Android Backup archive 431# From: Ariel Shkedi 432# Update: Joerg Jenderek 433# URL: https://github.com/android/platform_frameworks_base/blob/\ 434# 0bacfd2ba68d21a68a3df345b830bc2a1e515b5a/services/java/com/\ 435# android/server/BackupManagerService.java#L2367 436# Reference: https://sourceforge.net/projects/adbextractor/ 437# android-backup-extractor/perl/backupencrypt.pl 438# Note: only unix line feeds "\n" found 439# After the header comes a tar file 440# If compressed, the entire tar file is compressed with JAVA deflate 441# 442# Include the version number hardcoded with the magic string to avoid 443# false positives 4440 string/b ANDROID\ BACKUP\n Android Backup 445# maybe look for some more characteristics like linefeed '\n' or version 446#>16 string \n 447# No mime-type defined officially 448!:mime application/x-google-ab 449!:ext ab 450# on 2nd line version (often 1, 2 on kitkat 4.4.3+, 4 on 7.1.2) 451>15 string >\0 \b, version %s 452# "1" on 3rd line means compressed 453>17 string 0\n \b, Not-Compressed 454>17 string 1\n \b, Compressed 455# The 4th line is encryption "none" or "AES-256" 456# any string as long as it's not the word none (which is matched below) 457>19 string none\n \b, Not-Encrypted 458# look for backup content after line with encryption info 459#>>19 search/7 \n 460# data part after header for not encrypted Android Backup 461#>>>&0 ubequad x \b, content 0x%16.16llx... 462# look for zlib compressed by ./compress after message with 1 space at end 463#>>>&0 indirect x \b; contains 464# look for tar archive block by ./archive for package name manifest 465>>288 string ustar \b; contains 466>>>31 use tar-file 467# look for zip/jar archive by ./archive ./zip after message with 1 space at end 468#>>2079 search/1025/s PK\003\004 \b; contains 469#>>>&0 indirect x 470>19 string !none 471>>19 regex/1l \^([^n\n]|n[^o]|no[^n]|non[^e]|none.+).* \b, Encrypted (%s) 472# Commented out because they don't seem useful to print 473# (but they are part of the header - the tar file comes after them): 474# The 5th line is User Password Salt (128 Hex) 475# string length too high with standard src configuration 476#>>>&1 string >\0 \b, PASSWORD salt: "%-128.128s" 477#>>>&1 regex/1l .* \b, Password salt: %s 478# The 6th line is Master Key Checksum Salt (128 Hex) 479#>>>>&1 regex/1l .* \b, Master salt: %s 480# The 7th line is Number of PBDKF2 Rounds (10000) 481#>>>>>&1 regex/1l .* \b, PBKDF2 rounds: %s 482# The 8th line is User key Initialization Vector (IV) (32 Hex) 483#>>>>>>&1 regex/1l .* \b, IV: %s 484#>>>>>>&1 regex/1l .* \b, IV: %s 485# The 9th line is Master IV+Key+Checksum (192 Hex) 486#>>>>>>>&1 regex/1l .* \b, Key: %s 487# look for new line separator char after line number 9 488#>>>0x204 ubyte 0x0a NL found 489#>>>>&1 ubequad x \b, Content magic %16.16llx 490 491# *.pit files by Joerg Jenderek 492# https://forum.xda-developers.com/showthread.php?p=9122369 493# https://forum.xda-developers.com/showthread.php?t=816449 494# Partition Information Table for Samsung's smartphone with Android 495# used by flash software Odin 4960 ulelong 0x12349876 497# 1st pit entry marker 498>0x01C ulequad&0xFFFFFFFCFFFFFFFC =0x0000000000000000 499# minimal 13 and maximal 18 PIT entries found 500>>4 ulelong <128 Partition Information Table for Samsung smartphone 501>>>4 ulelong x \b, %d entries 502# 1. pit entry 503>>>4 ulelong >0 \b; #1 504>>>0x01C use PIT-entry 505>>>4 ulelong >1 \b; #2 506>>>0x0A0 use PIT-entry 507>>>4 ulelong >2 \b; #3 508>>>0x124 use PIT-entry 509>>>4 ulelong >3 \b; #4 510>>>0x1A8 use PIT-entry 511>>>4 ulelong >4 \b; #5 512>>>0x22C use PIT-entry 513>>>4 ulelong >5 \b; #6 514>>>0x2B0 use PIT-entry 515>>>4 ulelong >6 \b; #7 516>>>0x334 use PIT-entry 517>>>4 ulelong >7 \b; #8 518>>>0x3B8 use PIT-entry 519>>>4 ulelong >8 \b; #9 520>>>0x43C use PIT-entry 521>>>4 ulelong >9 \b; #10 522>>>0x4C0 use PIT-entry 523>>>4 ulelong >10 \b; #11 524>>>0x544 use PIT-entry 525>>>4 ulelong >11 \b; #12 526>>>0x5C8 use PIT-entry 527>>>4 ulelong >12 \b; #13 528>>>>0x64C use PIT-entry 529# 14. pit entry 530>>>4 ulelong >13 \b; #14 531>>>>0x6D0 use PIT-entry 532>>>4 ulelong >14 \b; #15 533>>>0x754 use PIT-entry 534>>>4 ulelong >15 \b; #16 535>>>0x7D8 use PIT-entry 536>>>4 ulelong >16 \b; #17 537>>>0x85C use PIT-entry 538# 18. pit entry 539>>>4 ulelong >17 \b; #18 540>>>0x8E0 use PIT-entry 541 5420 name PIT-entry 543# garbage value implies end of pit entries 544>0x00 ulequad&0xFFFFFFFCFFFFFFFC =0x0000000000000000 545# skip empty partition name 546>>0x24 ubyte !0 547# partition name 548>>>0x24 string >\0 %-.32s 549# flags 550>>>0x0C ulelong&0x00000002 2 \b+RW 551# partition ID: 552# 0~IPL,MOVINAND,GANG;1~PIT,GPT;2~HIDDEN;3~SBL,HIDDEN;4~SBL2,HIDDEN;5~BOOT;6~KENREl,RECOVER,misc;7~RECOVER 553# ;11~MODEM;20~efs;21~PARAM;22~FACTORY,SYSTEM;23~DBDATAFS,USERDATA;24~CACHE;80~BOOTLOADER;81~TZSW 554>>>0x08 ulelong x (0x%x) 555# filename 556>>>0x44 string >\0 "%-.64s" 557#>>>0x18 ulelong >0 558# blocksize in 512 byte units ? 559#>>>>0x18 ulelong x \b, %db 560# partition size in blocks ? 561#>>>>0x22 ulelong x \b*%d 562 563# Android sparse img format 564# From https://android.googlesource.com/\ 565# platform/system/core/+/master/libsparse/sparse_format.h 5660 lelong 0xed26ff3a Android sparse image 567>4 leshort x \b, version: %d 568>6 leshort x \b.%d 569>16 lelong x \b, Total of %d 570>12 lelong x \b %d-byte output blocks in 571>20 lelong x \b %d input chunks. 572 573# Android binary XML magic 574# In include/androidfw/ResourceTypes.h: 575# RES_XML_TYPE = 0x0003 followed by the size of the header (ResXMLTree_header), 576# which is 8 bytes (2 bytes type + 2 bytes header size + 4 bytes size). 5770 lelong 0x00080003 Android binary XML 578 579# Android cryptfs footer 580# From https://android.googlesource.com/\ 581# platform/system/vold/+/refs/heads/master/cryptfs.h 5820 lelong 0xd0b5b1c4 Android cryptfs footer 583>4 leshort x \b, version: %d 584>6 leshort x \b.%d 585 586#------------------------------------------------------------------------------ 587# $File: animation,v 1.77 2020/04/26 15:23:43 christos Exp $ 588# animation: file(1) magic for animation/movie formats 589# 590# animation formats 591# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8) 592# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com) 593 594# SGI and Apple formats 5950 string MOVI Silicon Graphics movie file 596!:mime video/x-sgi-movie 5974 string moov Apple QuickTime 598!:mime video/quicktime 599>12 string mvhd \b movie (fast start) 600>12 string mdra \b URL 601>12 string cmov \b movie (fast start, compressed header) 602>12 string rmra \b multiple URLs 6034 string mdat Apple QuickTime movie (unoptimized) 604!:mime video/quicktime 605#4 string wide Apple QuickTime movie (unoptimized) 606#!:mime video/quicktime 607#4 string skip Apple QuickTime movie (modified) 608#!:mime video/quicktime 609#4 string free Apple QuickTime movie (modified) 610#!:mime video/quicktime 6114 string idsc Apple QuickTime image (fast start) 612!:mime image/x-quicktime 613#4 string idat Apple QuickTime image (unoptimized) 614#!:mime image/x-quicktime 6154 string pckg Apple QuickTime compressed archive 616!:mime application/x-quicktime-player 6174 string/W jP JPEG 2000 image 618!:mime image/jp2 619# https://www.ftyps.com/ with local additions 6204 string ftyp ISO Media 621# https://aeroquartet.com/wordpress/2016/03/05/3-xavc-s/ 622>8 string XAVC \b, MPEG v4 system, Sony XAVC Codec 623>>96 string x \b, Audio "%.4s" 624>>118 beshort x at %dHz 625>>140 string x \b, Video "%.4s" 626>>168 beshort x %d 627>>170 beshort x \bx%d 628>8 string 3g2 \b, MPEG v4 system, 3GPP2 629!:mime video/3gpp2 630>>11 byte 4 \b v4 (H.263/AMR GSM 6.10) 631>>11 byte 5 \b v5 (H.263/AMR GSM 6.10) 632>>11 byte 6 \b v6 (ITU H.264/AMR GSM 6.10) 633# https://www.3gpp2.org/Public_html/Specs/C.S0050-B_v1.0_070521.pdf 634# Section 8.1.1, corresponds to a, b, c 635>>11 byte 0x61 \b C.S0050-0 V1.0 636>>11 byte 0x62 \b C.S0050-0-A V1.0.0 637>>11 byte 0x63 \b C.S0050-0-B V1.0 638>8 string 3ge \b, MPEG v4 system, 3GPP 639!:mime video/3gpp 640>>11 byte 6 \b, Release 6 MBMS Extended Presentations 641>>11 byte 7 \b, Release 7 MBMS Extended Presentations 642>8 string 3gg \b, MPEG v4 system, 3GPP 643!:mime video/3gpp 644>>11 byte 6 \b, Release 6 General Profile 645>8 string 3gp \b, MPEG v4 system, 3GPP 646!:mime video/3gpp 647>>11 byte 1 \b, Release %d (non existent) 648>>11 byte 2 \b, Release %d (non existent) 649>>11 byte 3 \b, Release %d (non existent) 650>>11 byte 4 \b, Release %d 651>>11 byte 5 \b, Release %d 652>>11 byte 6 \b, Release %d 653>>11 byte 7 \b, Release %d Streaming Servers 654>8 string 3gs \b, MPEG v4 system, 3GPP 655!:mime video/3gpp 656>>11 byte 7 \b, Release %d Streaming Servers 657>8 string avc1 \b, MPEG v4 system, 3GPP JVT AVC [ISO 14496-12:2005] 658!:mime video/mp4 659>8 string/W qt \b, Apple QuickTime movie 660!:mime video/quicktime 661>8 string CAEP \b, Canon Digital Camera 662>8 string caqv \b, Casio Digital Camera 663>8 string CDes \b, Convergent Design 664>8 string da0a \b, DMB MAF w/ MPEG Layer II aud, MOT slides, DLS, JPG/PNG/MNG 665>8 string da0b \b, DMB MAF, ext DA0A, with 3GPP timed text, DID, TVA, REL, IPMP 666>8 string da1a \b, DMB MAF audio with ER-BSAC audio, JPG/PNG/MNG images 667>8 string da1b \b, DMB MAF, ext da1a, with 3GPP timed text, DID, TVA, REL, IPMP 668>8 string da2a \b, DMB MAF aud w/ HE-AAC v2 aud, MOT slides, DLS, JPG/PNG/MNG 669>8 string da2b \b, DMB MAF, ext da2a, with 3GPP timed text, DID, TVA, REL, IPMP 670>8 string da3a \b, DMB MAF aud with HE-AAC aud, JPG/PNG/MNG images 671>8 string da3b \b, DMB MAF, ext da3a w/ BIFS, 3GPP, DID, TVA, REL, IPMP 672>8 string dash \b, MPEG v4 system, Dynamic Adaptive Streaming over HTTP 673!:mime video/mp4 674>8 string dmb1 \b, DMB MAF supporting all the components defined in the spec 675>8 string dmpf \b, Digital Media Project 676>8 string drc1 \b, Dirac (wavelet compression), encap in ISO base media (MP4) 677>8 string dv1a \b, DMB MAF vid w/ AVC vid, ER-BSAC aud, BIFS, JPG/PNG/MNG, TS 678>8 string dv1b \b, DMB MAF, ext dv1a, with 3GPP timed text, DID, TVA, REL, IPMP 679>8 string dv2a \b, DMB MAF vid w/ AVC vid, HE-AAC v2 aud, BIFS, JPG/PNG/MNG, TS 680>8 string dv2b \b, DMB MAF, ext dv2a, with 3GPP timed text, DID, TVA, REL, IPMP 681>8 string dv3a \b, DMB MAF vid w/ AVC vid, HE-AAC aud, BIFS, JPG/PNG/MNG, TS 682>8 string dv3b \b, DMB MAF, ext dv3a, with 3GPP timed text, DID, TVA, REL, IPMP 683>8 string dvr1 \b, DVB (.DVB) over RTP 684!:mime video/vnd.dvb.file 685>8 string dvt1 \b, DVB (.DVB) over MPEG-2 Transport Stream 686!:mime video/vnd.dvb.file 687>8 string F4V \b, Video for Adobe Flash Player 9+ (.F4V) 688!:mime video/mp4 689>8 string F4P \b, Protected Video for Adobe Flash Player 9+ (.F4P) 690!:mime video/mp4 691>8 string F4A \b, Audio for Adobe Flash Player 9+ (.F4A) 692!:mime audio/mp4 693>8 string F4B \b, Audio Book for Adobe Flash Player 9+ (.F4B) 694!:mime audio/mp4 695>8 string isc2 \b, ISMACryp 2.0 Encrypted File 696# ?/enc-isoff-generic 697>8 string iso2 \b, MP4 Base Media v2 [ISO 14496-12:2005] 698!:mime video/mp4 699>8 string isom \b, MP4 Base Media v1 [IS0 14496-12:2003] 700!:mime video/mp4 701>8 string/W jp2 \b, JPEG 2000 702!:mime image/jp2 703>8 string JP2 \b, JPEG 2000 Image (.JP2) [ISO 15444-1 ?] 704!:mime image/jp2 705>8 string JP20 \b, Unknown, from GPAC samples (prob non-existent) 706>8 string jpm \b, JPEG 2000 Compound Image (.JPM) [ISO 15444-6] 707!:mime image/jpm 708>8 string jpx \b, JPEG 2000 w/ extensions (.JPX) [ISO 15444-2] 709!:mime image/jpx 710>8 string KDDI \b, 3GPP2 EZmovie for KDDI 3G cellphones 711!:mime video/3gpp2 712>8 string M4A \b, Apple iTunes ALAC/AAC-LC (.M4A) Audio 713!:mime audio/x-m4a 714>8 string M4B \b, Apple iTunes ALAC/AAC-LC (.M4B) Audio Book 715!:mime audio/mp4 716>8 string M4P \b, Apple iTunes ALAC/AAC-LC (.M4P) AES Protected Audio 717!:mime video/mp4 718>8 string M4V \b, Apple iTunes Video (.M4V) Video 719!:mime video/x-m4v 720>8 string M4VH \b, Apple TV (.M4V) 721!:mime video/x-m4v 722>8 string M4VP \b, Apple iPhone (.M4V) 723!:mime video/x-m4v 724>8 string mj2s \b, Motion JPEG 2000 [ISO 15444-3] Simple Profile 725!:mime video/mj2 726>8 string mjp2 \b, Motion JPEG 2000 [ISO 15444-3] General Profile 727!:mime video/mj2 728>8 string mmp4 \b, MPEG-4/3GPP Mobile Profile (.MP4 / .3GP) (for NTT) 729!:mime video/mp4 730>8 string mobi \b, MPEG-4, MOBI format 731!:mime video/mp4 732>8 string mp21 \b, MPEG-21 [ISO/IEC 21000-9] 733>8 string mp41 \b, MP4 v1 [ISO 14496-1:ch13] 734!:mime video/mp4 735>8 string mp42 \b, MP4 v2 [ISO 14496-14] 736!:mime video/mp4 737>8 string mp71 \b, MP4 w/ MPEG-7 Metadata [per ISO 14496-12] 738>8 string mp7t \b, MPEG v4 system, MPEG v7 XML 739>8 string mp7b \b, MPEG v4 system, MPEG v7 binary XML 740>8 string mmp4 \b, MPEG v4 system, 3GPP Mobile 741!:mime video/mp4 742>8 string MPPI \b, Photo Player, MAF [ISO/IEC 23000-3] 743>8 string mqt \b, Sony / Mobile QuickTime (.MQV) US Pat 7,477,830 744!:mime video/quicktime 745>8 string MSNV \b, MPEG-4 (.MP4) for SonyPSP 746!:mime video/mp4 747>8 string NDAS \b, MP4 v2 [ISO 14496-14] Nero Digital AAC Audio 748!:mime audio/mp4 749>8 string NDSC \b, MPEG-4 (.MP4) Nero Cinema Profile 750!:mime video/mp4 751>8 string NDSH \b, MPEG-4 (.MP4) Nero HDTV Profile 752!:mime video/mp4 753>8 string NDSM \b, MPEG-4 (.MP4) Nero Mobile Profile 754!:mime video/mp4 755>8 string NDSP \b, MPEG-4 (.MP4) Nero Portable Profile 756!:mime video/mp4 757>8 string NDSS \b, MPEG-4 (.MP4) Nero Standard Profile 758!:mime video/mp4 759>8 string NDXC \b, H.264/MPEG-4 AVC (.MP4) Nero Cinema Profile 760!:mime video/mp4 761>8 string NDXH \b, H.264/MPEG-4 AVC (.MP4) Nero HDTV Profile 762!:mime video/mp4 763>8 string NDXM \b, H.264/MPEG-4 AVC (.MP4) Nero Mobile Profile 764!:mime video/mp4 765>8 string NDXP \b, H.264/MPEG-4 AVC (.MP4) Nero Portable Profile 766!:mime video/mp4 767>8 string NDXS \b, H.264/MPEG-4 AVC (.MP4) Nero Standard Profile 768!:mime video/mp4 769>8 string odcf \b, OMA DCF DRM Format 2.0 (OMA-TS-DRM-DCF-V2_0-20060303-A) 770>8 string opf2 \b, OMA PDCF DRM Format 2.1 (OMA-TS-DRM-DCF-V2_1-20070724-C) 771>8 string opx2 \b, OMA PDCF DRM + XBS ext (OMA-TS-DRM_XBS-V1_0-20070529-C) 772>8 string pana \b, Panasonic Digital Camera 773>8 string qt \b, Apple QuickTime (.MOV/QT) 774!:mime video/quicktime 775# HEIF image format 776# see https://nokiatech.github.io/heif/technical.html 777>8 string mif1 \b, HEIF Image 778!:mime image/heif 779>8 string msf1 \b, HEIF Image Sequence 780!:mime image/heif-sequence 781>8 string heic \b, HEIF Image HEVC Main or Main Still Picture Profile 782!:mime image/heic 783>8 string heix \b, HEIF Image HEVC Main 10 Profile 784!:mime image/heic 785>8 string hevc \b, HEIF Image Sequenz HEVC Main or Main Still Picture Profile 786!:mime image/heic-sequence 787>8 string hevx \b, HEIF Image Sequence HEVC Main 10 Profile 788!:mime image/heic-sequence 789# following HEIF brands are not mentioned in the heif technical info currently (Oct 2017) 790# but used in the reference implementation: 791# https://github.com/nokiatech/heif/blob/d5e9a21c8ba8df712bdf643021dd9f6518134776/Srcs/reader/hevcimagefilereader.cpp 792>8 string heim \b, HEIF Image L-HEVC 793!:mime image/heif 794>8 string heis \b, HEIF Image L-HEVC 795!:mime image/heif 796>8 string avic \b, HEIF Image AVC 797!:mime image/heif 798>8 string hevm \b, HEIF Image Sequence L-HEVC 799!:mime image/heif-sequence 800>8 string hevs \b, HEIF Image Sequence L-HEVC 801!:mime image/heif-sequence 802>8 string avcs \b, HEIF Image Sequence AVC 803!:mime image/heif-sequence 804 805>8 string ROSS \b, Ross Video 806>8 string sdv \b, SD Memory Card Video 807>8 string ssc1 \b, Samsung stereo, single stream (patent pending) 808>8 string ssc2 \b, Samsung stereo, dual stream (patent pending) 809 810# MPEG sequences 811# Scans for all common MPEG header start codes 8120 belong 0x00000001 813>4 byte&0x1F 0x07 JVT NAL sequence, H.264 video 814>>5 byte 66 \b, baseline 815>>5 byte 77 \b, main 816>>5 byte 88 \b, extended 817>>7 byte x \b @ L %u 8180 belong&0xFFFFFF00 0x00000100 819>3 byte 0xBA MPEG sequence 820!:mime video/mpeg 821>>4 byte &0x40 \b, v2, program multiplex 822>>4 byte ^0x40 \b, v1, system multiplex 823>3 byte 0xBB MPEG sequence, v1/2, multiplex (missing pack header) 824>3 byte&0x1F 0x07 MPEG sequence, H.264 video 825>>4 byte 66 \b, baseline 826>>4 byte 77 \b, main 827>>4 byte 88 \b, extended 828>>6 byte x \b @ L %u 829# GRR too general as it catches also FoxPro Memo example NG.FPT 830>3 byte 0xB0 MPEG sequence, v4 831# TODO: maybe this extra line exclude FoxPro Memo example NG.FPT starting with 000001b0 00000100 00000000 832#>>4 byte !0 MPEG sequence, v4 833!:mime video/mpeg4-generic 834>>5 belong 0x000001B5 835>>>9 byte &0x80 836>>>>10 byte&0xF0 16 \b, video 837>>>>10 byte&0xF0 32 \b, still texture 838>>>>10 byte&0xF0 48 \b, mesh 839>>>>10 byte&0xF0 64 \b, face 840>>>9 byte&0xF8 8 \b, video 841>>>9 byte&0xF8 16 \b, still texture 842>>>9 byte&0xF8 24 \b, mesh 843>>>9 byte&0xF8 32 \b, face 844>>4 byte 1 \b, simple @ L1 845>>4 byte 2 \b, simple @ L2 846>>4 byte 3 \b, simple @ L3 847>>4 byte 4 \b, simple @ L0 848>>4 byte 17 \b, simple scalable @ L1 849>>4 byte 18 \b, simple scalable @ L2 850>>4 byte 33 \b, core @ L1 851>>4 byte 34 \b, core @ L2 852>>4 byte 50 \b, main @ L2 853>>4 byte 51 \b, main @ L3 854>>4 byte 53 \b, main @ L4 855>>4 byte 66 \b, n-bit @ L2 856>>4 byte 81 \b, scalable texture @ L1 857>>4 byte 97 \b, simple face animation @ L1 858>>4 byte 98 \b, simple face animation @ L2 859>>4 byte 99 \b, simple face basic animation @ L1 860>>4 byte 100 \b, simple face basic animation @ L2 861>>4 byte 113 \b, basic animation text @ L1 862>>4 byte 114 \b, basic animation text @ L2 863>>4 byte 129 \b, hybrid @ L1 864>>4 byte 130 \b, hybrid @ L2 865>>4 byte 145 \b, advanced RT simple @ L! 866>>4 byte 146 \b, advanced RT simple @ L2 867>>4 byte 147 \b, advanced RT simple @ L3 868>>4 byte 148 \b, advanced RT simple @ L4 869>>4 byte 161 \b, core scalable @ L1 870>>4 byte 162 \b, core scalable @ L2 871>>4 byte 163 \b, core scalable @ L3 872>>4 byte 177 \b, advanced coding efficiency @ L1 873>>4 byte 178 \b, advanced coding efficiency @ L2 874>>4 byte 179 \b, advanced coding efficiency @ L3 875>>4 byte 180 \b, advanced coding efficiency @ L4 876>>4 byte 193 \b, advanced core @ L1 877>>4 byte 194 \b, advanced core @ L2 878>>4 byte 209 \b, advanced scalable texture @ L1 879>>4 byte 210 \b, advanced scalable texture @ L2 880>>4 byte 211 \b, advanced scalable texture @ L3 881>>4 byte 225 \b, simple studio @ L1 882>>4 byte 226 \b, simple studio @ L2 883>>4 byte 227 \b, simple studio @ L3 884>>4 byte 228 \b, simple studio @ L4 885>>4 byte 229 \b, core studio @ L1 886>>4 byte 230 \b, core studio @ L2 887>>4 byte 231 \b, core studio @ L3 888>>4 byte 232 \b, core studio @ L4 889>>4 byte 240 \b, advanced simple @ L0 890>>4 byte 241 \b, advanced simple @ L1 891>>4 byte 242 \b, advanced simple @ L2 892>>4 byte 243 \b, advanced simple @ L3 893>>4 byte 244 \b, advanced simple @ L4 894>>4 byte 245 \b, advanced simple @ L5 895>>4 byte 247 \b, advanced simple @ L3b 896>>4 byte 248 \b, FGS @ L0 897>>4 byte 249 \b, FGS @ L1 898>>4 byte 250 \b, FGS @ L2 899>>4 byte 251 \b, FGS @ L3 900>>4 byte 252 \b, FGS @ L4 901>>4 byte 253 \b, FGS @ L5 902>3 byte 0xB5 MPEG sequence, v4 903!:mime video/mpeg4-generic 904>>4 byte &0x80 905>>>5 byte&0xF0 16 \b, video (missing profile header) 906>>>5 byte&0xF0 32 \b, still texture (missing profile header) 907>>>5 byte&0xF0 48 \b, mesh (missing profile header) 908>>>5 byte&0xF0 64 \b, face (missing profile header) 909>>4 byte&0xF8 8 \b, video (missing profile header) 910>>4 byte&0xF8 16 \b, still texture (missing profile header) 911>>4 byte&0xF8 24 \b, mesh (missing profile header) 912>>4 byte&0xF8 32 \b, face (missing profile header) 913>3 byte 0xB3 MPEG sequence 914!:mime video/mpeg 915>>12 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video 916>>12 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video 917>>12 belong 0x000001B5 \b, v2, 918>>>16 byte&0x0F 1 \b HP 919>>>16 byte&0x0F 2 \b Spt 920>>>16 byte&0x0F 3 \b SNR 921>>>16 byte&0x0F 4 \b MP 922>>>16 byte&0x0F 5 \b SP 923>>>17 byte&0xF0 64 \b@HL 924>>>17 byte&0xF0 96 \b@H-14 925>>>17 byte&0xF0 128 \b@ML 926>>>17 byte&0xF0 160 \b@LL 927>>>17 byte &0x08 \b progressive 928>>>17 byte ^0x08 \b interlaced 929>>>17 byte&0x06 2 \b Y'CbCr 4:2:0 video 930>>>17 byte&0x06 4 \b Y'CbCr 4:2:2 video 931>>>17 byte&0x06 6 \b Y'CbCr 4:4:4 video 932>>11 byte &0x02 933>>>75 byte &0x01 934>>>>140 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video 935>>>>140 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video 936>>>>140 belong 0x000001B5 \b, v2, 937>>>>>144 byte&0x0F 1 \b HP 938>>>>>144 byte&0x0F 2 \b Spt 939>>>>>144 byte&0x0F 3 \b SNR 940>>>>>144 byte&0x0F 4 \b MP 941>>>>>144 byte&0x0F 5 \b SP 942>>>>>145 byte&0xF0 64 \b@HL 943>>>>>145 byte&0xF0 96 \b@H-14 944>>>>>145 byte&0xF0 128 \b@ML 945>>>>>145 byte&0xF0 160 \b@LL 946>>>>>145 byte &0x08 \b progressive 947>>>>>145 byte ^0x08 \b interlaced 948>>>>>145 byte&0x06 2 \b Y'CbCr 4:2:0 video 949>>>>>145 byte&0x06 4 \b Y'CbCr 4:2:2 video 950>>>>>145 byte&0x06 6 \b Y'CbCr 4:4:4 video 951>>76 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video 952>>76 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video 953>>76 belong 0x000001B5 \b, v2, 954>>>80 byte&0x0F 1 \b HP 955>>>80 byte&0x0F 2 \b Spt 956>>>80 byte&0x0F 3 \b SNR 957>>>80 byte&0x0F 4 \b MP 958>>>80 byte&0x0F 5 \b SP 959>>>81 byte&0xF0 64 \b@HL 960>>>81 byte&0xF0 96 \b@H-14 961>>>81 byte&0xF0 128 \b@ML 962>>>81 byte&0xF0 160 \b@LL 963>>>81 byte &0x08 \b progressive 964>>>81 byte ^0x08 \b interlaced 965>>>81 byte&0x06 2 \b Y'CbCr 4:2:0 video 966>>>81 byte&0x06 4 \b Y'CbCr 4:2:2 video 967>>>81 byte&0x06 6 \b Y'CbCr 4:4:4 video 968>>4 belong&0xFFFFFF00 0x78043800 \b, HD-TV 1920P 969>>>7 byte&0xF0 0x10 \b, 16:9 970>>4 belong&0xFFFFFF00 0x50002D00 \b, SD-TV 1280I 971>>>7 byte&0xF0 0x10 \b, 16:9 972>>4 belong&0xFFFFFF00 0x30024000 \b, PAL Capture 973>>>7 byte&0xF0 0x10 \b, 4:3 974>>4 beshort&0xFFF0 0x2C00 \b, 4CIF 975>>>5 beshort&0x0FFF 0x01E0 \b NTSC 976>>>5 beshort&0x0FFF 0x0240 \b PAL 977>>>7 byte&0xF0 0x20 \b, 4:3 978>>>7 byte&0xF0 0x30 \b, 16:9 979>>>7 byte&0xF0 0x40 \b, 11:5 980>>>7 byte&0xF0 0x80 \b, PAL 4:3 981>>>7 byte&0xF0 0xC0 \b, NTSC 4:3 982>>4 belong&0xFFFFFF00 0x2801E000 \b, LD-TV 640P 983>>>7 byte&0xF0 0x10 \b, 4:3 984>>4 belong&0xFFFFFF00 0x1400F000 \b, 320x240 985>>>7 byte&0xF0 0x10 \b, 4:3 986>>4 belong&0xFFFFFF00 0x0F00A000 \b, 240x160 987>>>7 byte&0xF0 0x10 \b, 4:3 988>>4 belong&0xFFFFFF00 0x0A007800 \b, 160x120 989>>>7 byte&0xF0 0x10 \b, 4:3 990>>4 beshort&0xFFF0 0x1600 \b, CIF 991>>>5 beshort&0x0FFF 0x00F0 \b NTSC 992>>>5 beshort&0x0FFF 0x0120 \b PAL 993>>>7 byte&0xF0 0x20 \b, 4:3 994>>>7 byte&0xF0 0x30 \b, 16:9 995>>>7 byte&0xF0 0x40 \b, 11:5 996>>>7 byte&0xF0 0x80 \b, PAL 4:3 997>>>7 byte&0xF0 0xC0 \b, NTSC 4:3 998>>>5 beshort&0x0FFF 0x0240 \b PAL 625 999>>>>7 byte&0xF0 0x20 \b, 4:3 1000>>>>7 byte&0xF0 0x30 \b, 16:9 1001>>>>7 byte&0xF0 0x40 \b, 11:5 1002>>4 beshort&0xFFF0 0x2D00 \b, CCIR/ITU 1003>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525 1004>>>5 beshort&0x0FFF 0x0240 \b PAL 625 1005>>>7 byte&0xF0 0x20 \b, 4:3 1006>>>7 byte&0xF0 0x30 \b, 16:9 1007>>>7 byte&0xF0 0x40 \b, 11:5 1008>>4 beshort&0xFFF0 0x1E00 \b, SVCD 1009>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525 1010>>>5 beshort&0x0FFF 0x0240 \b PAL 625 1011>>>7 byte&0xF0 0x20 \b, 4:3 1012>>>7 byte&0xF0 0x30 \b, 16:9 1013>>>7 byte&0xF0 0x40 \b, 11:5 1014>>7 byte&0x0F 1 \b, 23.976 fps 1015>>7 byte&0x0F 2 \b, 24 fps 1016>>7 byte&0x0F 3 \b, 25 fps 1017>>7 byte&0x0F 4 \b, 29.97 fps 1018>>7 byte&0x0F 5 \b, 30 fps 1019>>7 byte&0x0F 6 \b, 50 fps 1020>>7 byte&0x0F 7 \b, 59.94 fps 1021>>7 byte&0x0F 8 \b, 60 fps 1022>>11 byte &0x04 \b, Constrained 1023 1024# MPEG ADTS Audio (*.mpx/mxa/aac) 1025# from dreesen@math.fu-berlin.de 1026# modified to fully support MPEG ADTS 1027 1028# MP3, M1A 1029# modified by Joerg Jenderek 1030# GRR the original test are too common for many DOS files 1031# so don't accept as MP3 until we've tested the rate 1032# But also beat GEMDOS fonts 10330 beshort&0xFFFE 0xFFFA 1034# rates 1035>2 byte&0xF0 !0 1036>>2 byte&0xF0 !0xF0 MPEG ADTS, layer III, v1 1037!:strength +20 1038!:mime audio/mpeg 1039>2 byte&0xF0 0x10 \b, 32 kbps 1040>2 byte&0xF0 0x20 \b, 40 kbps 1041>2 byte&0xF0 0x30 \b, 48 kbps 1042>2 byte&0xF0 0x40 \b, 56 kbps 1043>2 byte&0xF0 0x50 \b, 64 kbps 1044>2 byte&0xF0 0x60 \b, 80 kbps 1045>2 byte&0xF0 0x70 \b, 96 kbps 1046>2 byte&0xF0 0x80 \b, 112 kbps 1047>2 byte&0xF0 0x90 \b, 128 kbps 1048>2 byte&0xF0 0xA0 \b, 160 kbps 1049>2 byte&0xF0 0xB0 \b, 192 kbps 1050>2 byte&0xF0 0xC0 \b, 224 kbps 1051>2 byte&0xF0 0xD0 \b, 256 kbps 1052>2 byte&0xF0 0xE0 \b, 320 kbps 1053# timing 1054>2 byte&0x0C 0x00 \b, 44.1 kHz 1055>2 byte&0x0C 0x04 \b, 48 kHz 1056>2 byte&0x0C 0x08 \b, 32 kHz 1057# channels/options 1058>3 byte&0xC0 0x00 \b, Stereo 1059>3 byte&0xC0 0x40 \b, JntStereo 1060>3 byte&0xC0 0x80 \b, 2x Monaural 1061>3 byte&0xC0 0xC0 \b, Monaural 1062#>1 byte ^0x01 \b, Data Verify 1063#>2 byte &0x02 \b, Packet Pad 1064#>2 byte &0x01 \b, Custom Flag 1065#>3 byte &0x08 \b, Copyrighted 1066#>3 byte &0x04 \b, Original Source 1067#>3 byte&0x03 1 \b, NR: 50/15 ms 1068#>3 byte&0x03 3 \b, NR: CCIT J.17 1069 1070# MP2, M1A 10710 beshort&0xFFFE 0xFFFC MPEG ADTS, layer II, v1 1072!:mime audio/mpeg 1073# rates 1074>2 byte&0xF0 0x10 \b, 32 kbps 1075>2 byte&0xF0 0x20 \b, 48 kbps 1076>2 byte&0xF0 0x30 \b, 56 kbps 1077>2 byte&0xF0 0x40 \b, 64 kbps 1078>2 byte&0xF0 0x50 \b, 80 kbps 1079>2 byte&0xF0 0x60 \b, 96 kbps 1080>2 byte&0xF0 0x70 \b, 112 kbps 1081>2 byte&0xF0 0x80 \b, 128 kbps 1082>2 byte&0xF0 0x90 \b, 160 kbps 1083>2 byte&0xF0 0xA0 \b, 192 kbps 1084>2 byte&0xF0 0xB0 \b, 224 kbps 1085>2 byte&0xF0 0xC0 \b, 256 kbps 1086>2 byte&0xF0 0xD0 \b, 320 kbps 1087>2 byte&0xF0 0xE0 \b, 384 kbps 1088# timing 1089>2 byte&0x0C 0x00 \b, 44.1 kHz 1090>2 byte&0x0C 0x04 \b, 48 kHz 1091>2 byte&0x0C 0x08 \b, 32 kHz 1092# channels/options 1093>3 byte&0xC0 0x00 \b, Stereo 1094>3 byte&0xC0 0x40 \b, JntStereo 1095>3 byte&0xC0 0x80 \b, 2x Monaural 1096>3 byte&0xC0 0xC0 \b, Monaural 1097#>1 byte ^0x01 \b, Data Verify 1098#>2 byte &0x02 \b, Packet Pad 1099#>2 byte &0x01 \b, Custom Flag 1100#>3 byte &0x08 \b, Copyrighted 1101#>3 byte &0x04 \b, Original Source 1102#>3 byte&0x03 1 \b, NR: 50/15 ms 1103#>3 byte&0x03 3 \b, NR: CCIT J.17 1104 1105# MPA, M1A 1106# updated by Joerg Jenderek 1107# GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448 1108# GRR this test is still too general as it catches a BOM of UTF-16 files (0xFFFE) 1109# FIXME: Almost all little endian UTF-16 text with BOM are clobbered by these entries 1110#0 beshort&0xFFFE 0xFFFE 1111#>2 ubyte&0xF0 >0x0F 1112#>>2 ubyte&0xF0 <0xE1 MPEG ADTS, layer I, v1 1113## rate 1114#>>>2 byte&0xF0 0x10 \b, 32 kbps 1115#>>>2 byte&0xF0 0x20 \b, 64 kbps 1116#>>>2 byte&0xF0 0x30 \b, 96 kbps 1117#>>>2 byte&0xF0 0x40 \b, 128 kbps 1118#>>>2 byte&0xF0 0x50 \b, 160 kbps 1119#>>>2 byte&0xF0 0x60 \b, 192 kbps 1120#>>>2 byte&0xF0 0x70 \b, 224 kbps 1121#>>>2 byte&0xF0 0x80 \b, 256 kbps 1122#>>>2 byte&0xF0 0x90 \b, 288 kbps 1123#>>>2 byte&0xF0 0xA0 \b, 320 kbps 1124#>>>2 byte&0xF0 0xB0 \b, 352 kbps 1125#>>>2 byte&0xF0 0xC0 \b, 384 kbps 1126#>>>2 byte&0xF0 0xD0 \b, 416 kbps 1127#>>>2 byte&0xF0 0xE0 \b, 448 kbps 1128## timing 1129#>>>2 byte&0x0C 0x00 \b, 44.1 kHz 1130#>>>2 byte&0x0C 0x04 \b, 48 kHz 1131#>>>2 byte&0x0C 0x08 \b, 32 kHz 1132## channels/options 1133#>>>3 byte&0xC0 0x00 \b, Stereo 1134#>>>3 byte&0xC0 0x40 \b, JntStereo 1135#>>>3 byte&0xC0 0x80 \b, 2x Monaural 1136#>>>3 byte&0xC0 0xC0 \b, Monaural 1137##>1 byte ^0x01 \b, Data Verify 1138##>2 byte &0x02 \b, Packet Pad 1139##>2 byte &0x01 \b, Custom Flag 1140##>3 byte &0x08 \b, Copyrighted 1141##>3 byte &0x04 \b, Original Source 1142##>3 byte&0x03 1 \b, NR: 50/15 ms 1143##>3 byte&0x03 3 \b, NR: CCIT J.17 1144 1145# MP3, M2A 11460 beshort&0xFFFE 0xFFF2 MPEG ADTS, layer III, v2 1147!:mime audio/mpeg 1148# rate 1149>2 byte&0xF0 0x10 \b, 8 kbps 1150>2 byte&0xF0 0x20 \b, 16 kbps 1151>2 byte&0xF0 0x30 \b, 24 kbps 1152>2 byte&0xF0 0x40 \b, 32 kbps 1153>2 byte&0xF0 0x50 \b, 40 kbps 1154>2 byte&0xF0 0x60 \b, 48 kbps 1155>2 byte&0xF0 0x70 \b, 56 kbps 1156>2 byte&0xF0 0x80 \b, 64 kbps 1157>2 byte&0xF0 0x90 \b, 80 kbps 1158>2 byte&0xF0 0xA0 \b, 96 kbps 1159>2 byte&0xF0 0xB0 \b, 112 kbps 1160>2 byte&0xF0 0xC0 \b, 128 kbps 1161>2 byte&0xF0 0xD0 \b, 144 kbps 1162>2 byte&0xF0 0xE0 \b, 160 kbps 1163# timing 1164>2 byte&0x0C 0x00 \b, 22.05 kHz 1165>2 byte&0x0C 0x04 \b, 24 kHz 1166>2 byte&0x0C 0x08 \b, 16 kHz 1167# channels/options 1168>3 byte&0xC0 0x00 \b, Stereo 1169>3 byte&0xC0 0x40 \b, JntStereo 1170>3 byte&0xC0 0x80 \b, 2x Monaural 1171>3 byte&0xC0 0xC0 \b, Monaural 1172#>1 byte ^0x01 \b, Data Verify 1173#>2 byte &0x02 \b, Packet Pad 1174#>2 byte &0x01 \b, Custom Flag 1175#>3 byte &0x08 \b, Copyrighted 1176#>3 byte &0x04 \b, Original Source 1177#>3 byte&0x03 1 \b, NR: 50/15 ms 1178#>3 byte&0x03 3 \b, NR: CCIT J.17 1179 1180# MP2, M2A 11810 beshort&0xFFFE 0xFFF4 MPEG ADTS, layer II, v2 1182!:mime audio/mpeg 1183# rate 1184>2 byte&0xF0 0x10 \b, 8 kbps 1185>2 byte&0xF0 0x20 \b, 16 kbps 1186>2 byte&0xF0 0x30 \b, 24 kbps 1187>2 byte&0xF0 0x40 \b, 32 kbps 1188>2 byte&0xF0 0x50 \b, 40 kbps 1189>2 byte&0xF0 0x60 \b, 48 kbps 1190>2 byte&0xF0 0x70 \b, 56 kbps 1191>2 byte&0xF0 0x80 \b, 64 kbps 1192>2 byte&0xF0 0x90 \b, 80 kbps 1193>2 byte&0xF0 0xA0 \b, 96 kbps 1194>2 byte&0xF0 0xB0 \b, 112 kbps 1195>2 byte&0xF0 0xC0 \b, 128 kbps 1196>2 byte&0xF0 0xD0 \b, 144 kbps 1197>2 byte&0xF0 0xE0 \b, 160 kbps 1198# timing 1199>2 byte&0x0C 0x00 \b, 22.05 kHz 1200>2 byte&0x0C 0x04 \b, 24 kHz 1201>2 byte&0x0C 0x08 \b, 16 kHz 1202# channels/options 1203>3 byte&0xC0 0x00 \b, Stereo 1204>3 byte&0xC0 0x40 \b, JntStereo 1205>3 byte&0xC0 0x80 \b, 2x Monaural 1206>3 byte&0xC0 0xC0 \b, Monaural 1207#>1 byte ^0x01 \b, Data Verify 1208#>2 byte &0x02 \b, Packet Pad 1209#>2 byte &0x01 \b, Custom Flag 1210#>3 byte &0x08 \b, Copyrighted 1211#>3 byte &0x04 \b, Original Source 1212#>3 byte&0x03 1 \b, NR: 50/15 ms 1213#>3 byte&0x03 3 \b, NR: CCIT J.17 1214 1215# MPA, M2A 12160 beshort&0xFFFE 0xFFF6 MPEG ADTS, layer I, v2 1217!:mime audio/mpeg 1218# rate 1219>2 byte&0xF0 0x10 \b, 32 kbps 1220>2 byte&0xF0 0x20 \b, 48 kbps 1221>2 byte&0xF0 0x30 \b, 56 kbps 1222>2 byte&0xF0 0x40 \b, 64 kbps 1223>2 byte&0xF0 0x50 \b, 80 kbps 1224>2 byte&0xF0 0x60 \b, 96 kbps 1225>2 byte&0xF0 0x70 \b, 112 kbps 1226>2 byte&0xF0 0x80 \b, 128 kbps 1227>2 byte&0xF0 0x90 \b, 144 kbps 1228>2 byte&0xF0 0xA0 \b, 160 kbps 1229>2 byte&0xF0 0xB0 \b, 176 kbps 1230>2 byte&0xF0 0xC0 \b, 192 kbps 1231>2 byte&0xF0 0xD0 \b, 224 kbps 1232>2 byte&0xF0 0xE0 \b, 256 kbps 1233# timing 1234>2 byte&0x0C 0x00 \b, 22.05 kHz 1235>2 byte&0x0C 0x04 \b, 24 kHz 1236>2 byte&0x0C 0x08 \b, 16 kHz 1237# channels/options 1238>3 byte&0xC0 0x00 \b, Stereo 1239>3 byte&0xC0 0x40 \b, JntStereo 1240>3 byte&0xC0 0x80 \b, 2x Monaural 1241>3 byte&0xC0 0xC0 \b, Monaural 1242#>1 byte ^0x01 \b, Data Verify 1243#>2 byte &0x02 \b, Packet Pad 1244#>2 byte &0x01 \b, Custom Flag 1245#>3 byte &0x08 \b, Copyrighted 1246#>3 byte &0x04 \b, Original Source 1247#>3 byte&0x03 1 \b, NR: 50/15 ms 1248#>3 byte&0x03 3 \b, NR: CCIT J.17 1249 1250# MP3, M25A 12510 beshort&0xFFFE 0xFFE2 MPEG ADTS, layer III, v2.5 1252!:mime audio/mpeg 1253# rate 1254>2 byte&0xF0 0x10 \b, 8 kbps 1255>2 byte&0xF0 0x20 \b, 16 kbps 1256>2 byte&0xF0 0x30 \b, 24 kbps 1257>2 byte&0xF0 0x40 \b, 32 kbps 1258>2 byte&0xF0 0x50 \b, 40 kbps 1259>2 byte&0xF0 0x60 \b, 48 kbps 1260>2 byte&0xF0 0x70 \b, 56 kbps 1261>2 byte&0xF0 0x80 \b, 64 kbps 1262>2 byte&0xF0 0x90 \b, 80 kbps 1263>2 byte&0xF0 0xA0 \b, 96 kbps 1264>2 byte&0xF0 0xB0 \b, 112 kbps 1265>2 byte&0xF0 0xC0 \b, 128 kbps 1266>2 byte&0xF0 0xD0 \b, 144 kbps 1267>2 byte&0xF0 0xE0 \b, 160 kbps 1268# timing 1269>2 byte&0x0C 0x00 \b, 11.025 kHz 1270>2 byte&0x0C 0x04 \b, 12 kHz 1271>2 byte&0x0C 0x08 \b, 8 kHz 1272# channels/options 1273>3 byte&0xC0 0x00 \b, Stereo 1274>3 byte&0xC0 0x40 \b, JntStereo 1275>3 byte&0xC0 0x80 \b, 2x Monaural 1276>3 byte&0xC0 0xC0 \b, Monaural 1277#>1 byte ^0x01 \b, Data Verify 1278#>2 byte &0x02 \b, Packet Pad 1279#>2 byte &0x01 \b, Custom Flag 1280#>3 byte &0x08 \b, Copyrighted 1281#>3 byte &0x04 \b, Original Source 1282#>3 byte&0x03 1 \b, NR: 50/15 ms 1283#>3 byte&0x03 3 \b, NR: CCIT J.17 1284 1285# AAC (aka MPEG-2 NBC audio) and MPEG-4 audio 1286 1287# Stored AAC streams (instead of the MP4 format) 12880 string ADIF MPEG ADIF, AAC 1289!:mime audio/x-hx-aac-adif 1290>4 byte &0x80 1291>>13 byte &0x10 \b, VBR 1292>>13 byte ^0x10 \b, CBR 1293>>16 byte&0x1E 0x02 \b, single stream 1294>>16 byte&0x1E 0x04 \b, 2 streams 1295>>16 byte&0x1E 0x06 \b, 3 streams 1296>>16 byte &0x08 \b, 4 or more streams 1297>>16 byte &0x10 \b, 8 or more streams 1298>>4 byte &0x80 \b, Copyrighted 1299>>13 byte &0x40 \b, Original Source 1300>>13 byte &0x20 \b, Home Flag 1301>4 byte ^0x80 1302>>4 byte &0x10 \b, VBR 1303>>4 byte ^0x10 \b, CBR 1304>>7 byte&0x1E 0x02 \b, single stream 1305>>7 byte&0x1E 0x04 \b, 2 streams 1306>>7 byte&0x1E 0x06 \b, 3 streams 1307>>7 byte &0x08 \b, 4 or more streams 1308>>7 byte &0x10 \b, 8 or more streams 1309>>4 byte &0x40 \b, Original Stream(s) 1310>>4 byte &0x20 \b, Home Source 1311 1312# Live or stored single AAC stream (used with MPEG-2 systems) 13130 beshort&0xFFF6 0xFFF0 MPEG ADTS, AAC 1314!:mime audio/x-hx-aac-adts 1315>1 byte &0x08 \b, v2 1316>1 byte ^0x08 \b, v4 1317# profile 1318>>2 byte &0xC0 \b LTP 1319>2 byte&0xc0 0x00 \b Main 1320>2 byte&0xc0 0x40 \b LC 1321>2 byte&0xc0 0x80 \b SSR 1322# timing 1323>2 byte&0x3c 0x00 \b, 96 kHz 1324>2 byte&0x3c 0x04 \b, 88.2 kHz 1325>2 byte&0x3c 0x08 \b, 64 kHz 1326>2 byte&0x3c 0x0c \b, 48 kHz 1327>2 byte&0x3c 0x10 \b, 44.1 kHz 1328>2 byte&0x3c 0x14 \b, 32 kHz 1329>2 byte&0x3c 0x18 \b, 24 kHz 1330>2 byte&0x3c 0x1c \b, 22.05 kHz 1331>2 byte&0x3c 0x20 \b, 16 kHz 1332>2 byte&0x3c 0x24 \b, 12 kHz 1333>2 byte&0x3c 0x28 \b, 11.025 kHz 1334>2 byte&0x3c 0x2c \b, 8 kHz 1335# channels 1336>2 beshort&0x01c0 0x0040 \b, monaural 1337>2 beshort&0x01c0 0x0080 \b, stereo 1338>2 beshort&0x01c0 0x00c0 \b, stereo + center 1339>2 beshort&0x01c0 0x0100 \b, stereo+center+LFE 1340>2 beshort&0x01c0 0x0140 \b, surround 1341>2 beshort&0x01c0 0x0180 \b, surround + LFE 1342>2 beshort &0x01C0 \b, surround + side 1343#>1 byte ^0x01 \b, Data Verify 1344#>2 byte &0x02 \b, Custom Flag 1345#>3 byte &0x20 \b, Original Stream 1346#>3 byte &0x10 \b, Home Source 1347#>3 byte &0x08 \b, Copyrighted 1348 1349# Live MPEG-4 audio streams (instead of RTP FlexMux) 13500 beshort&0xFFE0 0x56E0 MPEG-4 LOAS 1351!:mime audio/x-mp4a-latm 1352#>1 beshort&0x1FFF x \b, %hu byte packet 1353>3 byte&0xE0 0x40 1354>>4 byte&0x3C 0x04 \b, single stream 1355>>4 byte&0x3C 0x08 \b, 2 streams 1356>>4 byte&0x3C 0x0C \b, 3 streams 1357>>4 byte &0x08 \b, 4 or more streams 1358>>4 byte &0x20 \b, 8 or more streams 1359>3 byte&0xC0 0 1360>>4 byte&0x78 0x08 \b, single stream 1361>>4 byte&0x78 0x10 \b, 2 streams 1362>>4 byte&0x78 0x18 \b, 3 streams 1363>>4 byte &0x20 \b, 4 or more streams 1364>>4 byte &0x40 \b, 8 or more streams 1365# This magic isn't strong enough (matches plausible ISO-8859-1 text) 1366#0 beshort 0x4DE1 MPEG-4 LO-EP audio stream 1367#!:mime audio/x-mp4a-latm 1368 1369# Summary: FLI animation format 1370# Created by: Daniel Quinlan <quinlan@yggdrasil.com> 1371# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection) 13724 leshort 0xAF11 1373# standard FLI always has 320x200 resolution and 8 bit color 1374>8 leshort 320 1375>>10 leshort 200 1376>>>12 leshort 8 FLI animation, 320x200x8 1377!:mime video/x-fli 1378>>>>6 leshort x \b, %d frames 1379# frame speed is multiple of 1/70s 1380>>>>16 leshort x \b, %d/70s per frame 1381 1382# Summary: FLC animation format 1383# Created by: Daniel Quinlan <quinlan@yggdrasil.com> 1384# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection) 13854 leshort 0xAF12 1386# standard FLC always use 8 bit color 1387>12 leshort 8 FLC animation 1388!:mime video/x-flc 1389>>8 leshort x \b, %d 1390>>10 leshort x \bx%dx8 1391>>6 uleshort x \b, %d frames 1392>>16 uleshort x \b, %dms per frame 1393 1394# DL animation format 1395# XXX - collision with most `mips' magic 1396# 1397# I couldn't find a real magic number for these, however, this 1398# -appears- to work. Note that it might catch other files, too, so be 1399# careful! 1400# 1401# Note that title and author appear in the two 20-byte chunks 1402# at decimal offsets 2 and 22, respectively, but they are XOR'ed with 1403# 255 (hex FF)! The DL format is really bad. 1404# 1405#0 byte 1 DL version 1, medium format (160x100, 4 images/screen) 1406#!:mime video/x-unknown 1407#>42 byte x - %d screens, 1408#>43 byte x %d commands 1409#0 byte 2 DL version 2 1410#!:mime video/x-unknown 1411#>1 byte 1 - large format (320x200,1 image/screen), 1412#>1 byte 2 - medium format (160x100,4 images/screen), 1413#>1 byte >2 - unknown format, 1414#>42 byte x %d screens, 1415#>43 byte x %d commands 1416# Based on empirical evidence, DL version 3 have several nulls following the 1417# \003. Most of them start with non-null values at hex offset 0x34 or so. 1418#0 string \3\0\0\0\0\0\0\0\0\0\0\0 DL version 3 1419 1420# iso 13818 transport stream 1421# 1422# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1) 1423# syncbyte 8 bit 0x47 1424# error_ind 1 bit - 1425# payload_start 1 bit 1 1426# priority 1 bit - 1427# PID 13 bit 0x0000 1428# scrambling 2 bit - 1429# adaptfld_ctrl 2 bit 1 or 3 1430# conti_count 4 bit - 14310 belong&0xFF5FFF10 0x47400010 1432>188 byte 0x47 MPEG transport stream data 1433!:mime video/MP2T 1434 1435# DIF digital video file format <mpruett@sgi.com> 14360 belong&0xffffff00 0x1f070000 DIF 1437>4 byte &0x01 (DVCPRO) movie file 1438>4 byte ^0x01 (DV) movie file 1439>3 byte &0x80 (PAL) 1440>3 byte ^0x80 (NTSC) 1441 1442# MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/> 14430 string \x8aMNG MNG video data, 1444!:mime video/x-mng 1445>4 belong !0x0d0a1a0a CORRUPTED, 1446>4 belong 0x0d0a1a0a 1447>>16 belong x %d x 1448>>20 belong x %d 1449 1450# JNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/> 14510 string \x8bJNG JNG video data, 1452!:mime video/x-jng 1453>4 belong !0x0d0a1a0a CORRUPTED, 1454>4 belong 0x0d0a1a0a 1455>>16 belong x %d x 1456>>20 belong x %d 1457 1458# Vivo video (Wolfram Kleff) 14593 string \x0D\x0AVersion:Vivo Vivo video data 1460 1461# ABC (alembic.io 3d models) 14620 string 0gawa ABC 3d model 1463 1464# VRML (Virtual Reality Modelling Language) 14650 string/w #VRML\ V1.0\ ascii VRML 1 file 1466!:mime model/vrml 14670 string/w #VRML\ V2.0\ utf8 ISO/IEC 14772 VRML 97 file 1468!:mime model/vrml 1469 1470# X3D (Extensible 3D) [https://www.web3d.org/specifications/x3d-3.0.dtd] 1471# From Michel Briand <michelbriand@free.fr> 1472# mimetype from https://www.iana.org/assignments/media-types/model/x3d+xml 1473# Example https://www.web3d.org/x3d/content/examples/Basic/course/CreateX3DFromStringRandomSpheres.x3d 14740 string/w \<?xml\ version= 1475!:strength + 5 1476>20 search/1000/w \<!DOCTYPE\ X3D X3D (Extensible 3D) model xml text 1477!:mime model/x3d+xml 1478 1479#--------------------------------------------------------------------------- 1480# HVQM4: compressed movie format designed by Hudson for Nintendo GameCube 1481# From Mark Sheppard <msheppard@climax.co.uk>, 2002-10-03 1482# 14830 string HVQM4 %s 1484>6 string >\0 v%s 1485>0 byte x GameCube movie, 1486>0x34 ubeshort x %d x 1487>0x36 ubeshort x %d, 1488>0x26 ubeshort x %dus, 1489>0x42 ubeshort 0 no audio 1490>0x42 ubeshort >0 %dHz audio 1491 1492# From: "Stefan A. Haubenthal" <polluks@web.de> 14930 string DVDVIDEO-VTS Video title set, 1494>0x21 byte x v%x 14950 string DVDVIDEO-VMG Video manager, 1496>0x21 byte x v%x 1497 1498# From: Behan Webster <behanw@websterwood.com> 1499# NuppelVideo used by Mythtv (*.nuv) 1500# Note: there are two identical stanzas here differing only in the 1501# initial string matched. It used to be done with a regex, but we're 1502# trying to get rid of those. 15030 string NuppelVideo MythTV NuppelVideo 1504>12 string x v%s 1505>20 lelong x (%d 1506>24 lelong x \bx%d), 1507>36 string P \bprogressive, 1508>36 string I \binterlaced, 1509>40 ledouble x \baspect:%.2f, 1510>48 ledouble x \bfps:%.2f 15110 string MythTV MythTV NuppelVideo 1512>12 string x v%s 1513>20 lelong x (%d 1514>24 lelong x \bx%d), 1515>36 string P \bprogressive, 1516>36 string I \binterlaced, 1517>40 ledouble x \baspect:%.2f, 1518>48 ledouble x \bfps:%.2f 1519 1520# MPEG file 1521# MPEG sequences 1522# FIXME: This section is from the old magic.mime file and needs 1523# integrating with the rest 1524#0 belong 0x000001BA 1525#>4 byte &0x40 1526#!:mime video/mp2p 1527#>4 byte ^0x40 1528#!:mime video/mpeg 1529#0 belong 0x000001BB 1530#!:mime video/mpeg 1531#0 belong 0x000001B0 1532#!:mime video/mp4v-es 1533#0 belong 0x000001B5 1534#!:mime video/mp4v-es 1535#0 belong 0x000001B3 1536#!:mime video/mpv 1537#0 belong&0xFF5FFF10 0x47400010 1538#!:mime video/mp2t 1539#0 belong 0x00000001 1540#>4 byte&0x1F 0x07 1541#!:mime video/h264 1542 1543# Type: Bink Video 1544# Extension: .bik 1545# URL: https://wiki.multimedia.cx/index.php?title=Bink_Container 1546# From: <hoehle@users.sourceforge.net> 2008-07-18 15470 name bik 1548#>4 ulelong x size %d 1549>20 ulelong x \b, %d 1550>24 ulelong x \bx%d 1551>8 ulelong x \b, %d frames 1552>32 ulelong x at rate %d/ 1553>28 ulelong >1 \b%d 1554>40 ulelong =0 \b, no audio 1555>40 ulelong !0 \b, %d audio track 1556>>40 ulelong !1 \bs 1557# follow properties of the first audio track only 1558>>48 uleshort x %dHz 1559>>51 byte&0x20 0 mono 1560>>51 byte&0x20 !0 stereo 1561#>>51 byte&0x10 0 FFT 1562#>>51 byte&0x10 !0 DCT 1563 15640 string BIK 1565>3 regex =[bdfghi] Bink Video rev.%s 1566>>0 use bik 1567 15680 string KB2 1569>3 regex =[adfghi] Bink Video 2 rev.%s 1570>>0 use bik 1571 1572# Type: NUT Container 1573# URL: https://wiki.multimedia.cx/index.php?title=NUT 1574# From: Adam Buchbinder <adam.buchbinder@gmail.com> 15750 string nut/multimedia\ container\0 NUT multimedia container 1576 1577# Type: Nullsoft Video (NSV) 1578# URL: https://wiki.multimedia.cx/index.php?title=Nullsoft_Video 1579# From: Mike Melanson <mike@multimedia.cx> 15800 string NSVf Nullsoft Video 1581 1582# Type: REDCode Video 1583# URL: https://www.red.com/ ; https://wiki.multimedia.cx/index.php?title=REDCode 1584# From: Mike Melanson <mike@multimedia.cx> 15854 string RED1 REDCode Video 1586 1587# Type: MTV Multimedia File 1588# URL: https://wiki.multimedia.cx/index.php?title=MTV 1589# From: Mike Melanson <mike@multimedia.cx> 15900 string AMVS MTV Multimedia File 1591 1592# Type: ARMovie 1593# URL: https://wiki.multimedia.cx/index.php?title=ARMovie 1594# From: Mike Melanson <mike@multimedia.cx> 15950 string ARMovie\012 ARMovie 1596 1597# Type: Interplay MVE Movie 1598# URL: https://wiki.multimedia.cx/index.php?title=Interplay_MVE 1599# From: Mike Melanson <mike@multimedia.cx> 16000 string Interplay\040MVE\040File\032 Interplay MVE Movie 1601 1602# Type: Windows Television DVR File 1603# URL: https://wiki.multimedia.cx/index.php?title=WTV 1604# From: Mike Melanson <mike@mutlimedia.cx> 1605# This takes the form of a Windows-style GUID 16060 bequad 0xB7D800203749DA11 1607>8 bequad 0xA64E0007E95EAD8D Windows Television DVR Media 1608 1609# Type: Sega FILM/CPK Multimedia 1610# URL: https://wiki.multimedia.cx/index.php?title=Sega_FILM 1611# From: Mike Melanson <mike@multimedia.cx> 16120 string FILM Sega FILM/CPK Multimedia, 1613>32 belong x %d x 1614>28 belong x %d 1615 1616# Type: Nintendo THP Multimedia 1617# URL: https://wiki.multimedia.cx/index.php?title=THP 1618# From: Mike Melanson <mike@multimedia.cx> 16190 string THP\0 Nintendo THP Multimedia 1620 1621# Type: BBC Dirac Video 1622# URL: https://wiki.multimedia.cx/index.php?title=Dirac 1623# From: Mike Melanson <mike@multimedia.cx> 16240 string BBCD BBC Dirac Video 1625 1626# Type: RAD Game Tools Smacker Multimedia 1627# URL: https://wiki.multimedia.cx/index.php?title=Smacker 1628# From: Mike Melanson <mike@multimedia.cx> 16290 string SMK RAD Game Tools Smacker Multimedia 1630>3 byte x version %c, 1631>4 lelong x %d x 1632>8 lelong x %d, 1633>12 lelong x %d frames 1634 1635# Material Exchange Format 1636# More information: 1637# https://en.wikipedia.org/wiki/Material_Exchange_Format 1638# http://www.freemxf.org/ 16390 string \x06\x0e\x2b\x34\x02\x05\x01\x01\x0d\x01\x02\x01\x01\x02 Material exchange container format 1640!:ext mxf 1641!:mime application/mxf 1642 1643# Recognize LucasArts Smush video files (cf. 1644# https://wiki.multimedia.cx/index.php/Smush) 16450 string ANIM 1646>8 string AHDR LucasArts Smush Animation Format (SAN) video 16470 string SANM 1648>8 string SHDR LucasArts Smush v2 (SANM) video 1649 1650# Type: Scaleform video 1651# Extension: .usm 1652# URL: https://wiki.multimedia.cx/index.php/USM 1653# From: David Korth <gerbilsoft@gerbilsoft.com> 16540 string CRID 1655>32 string @UTF Scaleform video 1656 1657#------------------------------------------------------------------------------ 1658# $File: aout,v 1.1 2013/01/09 22:37:23 christos Exp $ 1659# aout: file(1) magic for a.out executable/object/etc entries that 1660# handle executables on multiple platforms. 1661# 1662 1663# 1664# Little-endian 32-bit-int a.out, merged from bsdi (for BSD/OS, from 1665# BSDI), netbsd, and vax (for UNIX/32V and BSD) 1666# 1667# XXX - is there anything we can look at to distinguish BSD/OS 386 from 1668# NetBSD 386 from various VAX binaries? The BSD/OS shared library flag 1669# works only for binaries using shared libraries. Grabbing the entry 1670# point from the a.out header, using it to find the first code executed 1671# in the program, and looking at that might help. 1672# 16730 lelong 0407 a.out little-endian 32-bit executable 1674>16 lelong >0 not stripped 1675>32 byte 0x6a (uses BSD/OS shared libs) 1676 16770 lelong 0410 a.out little-endian 32-bit pure executable 1678>16 lelong >0 not stripped 1679>32 byte 0x6a (uses BSD/OS shared libs) 1680 16810 lelong 0413 a.out little-endian 32-bit demand paged pure executable 1682>16 lelong >0 not stripped 1683>32 byte 0x6a (uses BSD/OS shared libs) 1684 1685# 1686# Big-endian 32-bit-int a.out, merged from sun (for old 68010 SunOS a.out), 1687# mips (for old 68020(!) SGI a.out), and netbsd (for old big-endian a.out). 1688# 1689# XXX - is there anything we can look at to distinguish old SunOS 68010 1690# from old 68020 IRIX from old NetBSD? Again, I guess we could look at 1691# the first instruction or instructions in the program. 1692# 16930 belong 0407 a.out big-endian 32-bit executable 1694>16 belong >0 not stripped 1695 16960 belong 0410 a.out big-endian 32-bit pure executable 1697>16 belong >0 not stripped 1698 16990 belong 0413 a.out big-endian 32-bit demand paged executable 1700>16 belong >0 not stripped 1701 1702 1703#------------------------------------------------------------------------------ 1704# $File: apache,v 1.1 2017/04/11 14:52:15 christos Exp $ 1705# apache: file(1) magic for Apache Big Data formats 1706 1707# Avro files 17080 string Obj Apache Avro 1709>3 byte x version %d 1710 1711# ORC files 1712# Important information is in file footer, which we can't index to :( 17130 string ORC Apache ORC 1714 1715# Parquet files 17160 string PAR1 Apache Parquet 1717 1718# Hive RC files 17190 string RCF Apache Hive RC file 1720>3 byte x version %d 1721 1722# Sequence files (and the careless first version of RC file) 1723 17240 string SEQ 1725>3 byte <6 Apache Hadoop Sequence file version %d 1726>3 byte >6 Apache Hadoop Sequence file version %d 1727>3 byte =6 1728>>5 string org.apache.hadoop.hive.ql.io.RCFile$KeyBuffer Apache Hive RC file version 0 1729>>3 default x Apache Hadoop Sequence file version 6 1730 1731#------------------------------------------------------------------------------ 1732# $File: apl,v 1.6 2009/09/19 16:28:07 christos Exp $ 1733# apl: file(1) magic for APL (see also "pdp" and "vax" for other APL 1734# workspaces) 1735# 17360 long 0100554 APL workspace (Ken's original?) 1737 1738#------------------------------------------------------------------------------ 1739# $File: apple,v 1.44 2019/10/18 15:21:02 christos Exp $ 1740# apple: file(1) magic for Apple file formats 1741# 17420 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text 17430 string \x0aGL Binary II (apple ][) data 17440 string \x76\xff Squeezed (apple ][) data 17450 string NuFile NuFile archive (apple ][) data 17460 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data 17470 belong 0x00051600 AppleSingle encoded Macintosh file 17480 belong 0x00051607 AppleDouble encoded Macintosh file 1749 1750# Type: Apple Emulator WOZ format 1751# From: Greg Wildman <greg@apple2.org.za> 1752# Ref: https://applesaucefdc.com/woz/reference/ 1753# Ref: https://applesaucefdc.com/woz/reference2/ 1754# 1755# Note: The following test are mostly identical. I would rather not 1756# use a regex to identify the WOZ format number. 17570 string WOZ1 1758>4 string \xFF\x0A\x0D\x0A Apple ][ WOZ 1.0 Disk Image 1759>12 string INFO 1760>>21 byte 01 \b, 5.25 inch 1761>>21 byte 02 \b, 3.5 inch 1762>>22 byte 01 \b, write protected 1763>>23 byte 01 \b, cross track synchronized 1764>>25 string/T x \b, %.32s 17650 string WOZ2 1766>4 string \xFF\x0A\x0D\x0A Apple ][ WOZ 2.0 Disk Image 1767>12 string INFO 1768>>21 byte 01 \b, 5.25 inch 1769>>21 byte 02 \b, 3.5 inch 1770>>22 byte 01 \b, write protected 1771>>23 byte 01 \b, cross track synchronized 1772>>25 string/T x \b, %.32s 1773 1774# Type: Apple Emulator disk images 1775# From: Greg Wildman <greg@apple2.org.za> 1776# ProDOS boot loader? 17770 string \x01\x38\xB0\x03\x4C Apple ProDOS Image 1778# Detect Volume Directory block ($02) 1779>0x400 string \x00\x00\x03\x00 1780>>0x404 byte &0xF0 1781>>>0x405 string x \b, Volume /%s 1782>>>0x429 leshort x \b, %u Blocks 1783# ProDOS ordered ? 1784>0xb00 string \x00\x00\x03\x00 1785>>0xb04 byte &0xF0 1786>>>0xb05 string x \b, Volume /%s 1787>>>0xb29 leshort x \b, %u Blocks 1788# 1789# DOS3.3 boot loader? 17900 string \x01\xA5\x27\xC9\x09\xD0\x18\xA5\x2B 1791>0x11001 string \x11\x0F\x03 Apple DOS 3.3 Image 1792>>0x11006 byte x \b, Volume %u 1793>>0x11034 byte x \b, %u Tracks 1794>>0x11035 byte x \b, %u Sectors 1795>>0x11036 leshort x \b, %u bytes per sector 1796# DOS3.2 ? 1797>0x11001 string \x11\x0C\x02 Apple DOS 3.2 Image 1798>>0x11006 byte x \b, Volume %u 1799>>0x11034 byte x \b, %u Tracks 1800>>0x11035 byte x \b, %u Sectors 1801>>0x11036 leshort x \b, %u bytes per sector 1802# DOS3.1 ? 1803>0x11001 string \x11\x0C\x01 1804>>0x11c00 string \x00\x11\x0B Apple DOS 3.1 Image 1805# 1806# Pascal boot loader? 18070 string \x01\xE0\x60\xF0\x03\x4C\xE3\x08\xAD 1808>0xd6 pstring SYSTEM.APPLE 1809>>0xb00 leshort 0x0000 1810>>>0xb04 leshort 0x0000 Apple Pascal Image 1811>>>>0xb06 pstring x \b, Volume %s: 1812>>>>0xb0e leshort x \b, %u Blocks 1813>>>>0xb10 leshort x \b, %u Files 1814# 1815# Diversi Dos boot loader? 18160 string \x01\xA8\xAD\x81\xC0\xEE\x09\x08\xAD 1817>0x11001 string \x11\x0F\x03 Apple Diversi Dos Image 1818>>0x11006 byte x \b, Volume %u 1819>>0x11034 byte x \b, %u Tracks 1820>>0x11035 byte x \b, %u Sectors 1821>>0x11036 leshort x \b, %u bytes per sector 1822 1823# Type: Apple Emulator 2IMG format 1824# From: Radek Vokal <rvokal@redhat.com> 1825# Update: Greg Wildman <greg@apple2.org.za> 18260 string 2IMG Apple ][ 2IMG Disk Image 1827>4 clear x 1828>4 string XGS! \b, XGS 1829>4 string CTKG \b, Catakig 1830>4 string ShIm \b, Sheppy's ImageMaker 1831>4 string SHEP \b, Sheppy's ImageMaker 1832>4 string WOOF \b, Sweet 16 1833>4 string B2TR \b, Bernie ][ the Rescue 1834>4 string \!nfc \b, ASIMOV2 1835>4 string \>BD\< \b, Brutal Deluxe's Cadius 1836>4 string CdrP \b, CiderPress 1837>4 string Vi][ \b, Virtual ][ 1838>4 string PRFS \b, ProFUSE 1839>4 string FISH \b, FishWings 1840>4 string RVLW \b, Revival for Windows 1841>4 default x 1842>>4 string x \b, Creator tag "%-4.4s" 1843>0xc byte 00 \b, DOS 3.3 sector order 1844>>0x10 byte 00 \b, Volume 254 1845>>0x10 byte&0x7f x \b, Volume %u 1846>0xc byte 01 \b, ProDOS sector order 1847# Detect Volume Directory block ($02) + 2mg header offset 1848>>0x440 string \x00\x00\x03\x00 1849>>>0x444 byte &0xF0 1850>>>>0x445 string x \b, Volume /%s 1851>>>>0x469 leshort x \b, %u Blocks 1852>0xc byte 02 \b, NIB data 1853 1854# magic for Newton PDA package formats 1855# from Ruda Moura <ruda@helllabs.org> 18560 string package0 Newton package, NOS 1.x, 1857>12 belong &0x80000000 AutoRemove, 1858>12 belong &0x40000000 CopyProtect, 1859>12 belong &0x10000000 NoCompression, 1860>12 belong &0x04000000 Relocation, 1861>12 belong &0x02000000 UseFasterCompression, 1862>16 belong x version %d 1863 18640 string package1 Newton package, NOS 2.x, 1865>12 belong &0x80000000 AutoRemove, 1866>12 belong &0x40000000 CopyProtect, 1867>12 belong &0x10000000 NoCompression, 1868>12 belong &0x04000000 Relocation, 1869>12 belong &0x02000000 UseFasterCompression, 1870>16 belong x version %d 1871 18720 string package4 Newton package, 1873>8 byte 8 NOS 1.x, 1874>8 byte 9 NOS 2.x, 1875>12 belong &0x80000000 AutoRemove, 1876>12 belong &0x40000000 CopyProtect, 1877>12 belong &0x10000000 NoCompression, 1878 1879# The following entries for the Apple II are for files that have 1880# been transferred as raw binary data from an Apple, without having 1881# been encapsulated by any of the above archivers. 1882# 1883# In general, Apple II formats are hard to identify because Apple DOS 1884# and especially Apple ProDOS have strong typing in the file system and 1885# therefore programmers never felt much need to include type information 1886# in the files themselves. 1887# 1888# Eric Fischer <enf@pobox.com> 1889 1890# AppleWorks word processor: 1891# URL: https://en.wikipedia.org/wiki/AppleWorks 1892# Reference: http://www.gno.org/pub/apple2/doc/apple/filetypes/ftn.1a.xxxx 1893# Update: Joerg Jenderek 1894# NOTE: 1895# The "O" is really the magic number, but that's so common that it's 1896# necessary to check the tab stops that follow it to avoid false positives. 1897# and/or look for unused bits of booleans bytes like zoom, paginated, mail merge 1898# the newer AppleWorks is from claris with extension CWK 18994 string O 1900# test for unused bits of zoom- , paginated-boolean bytes 1901>84 ubequad ^0x00Fe00000000Fe00 1902# look for tabstop definitions "=" no tab, "|" no tab 1903# "<" left tab,"^" center tab,">" right tab, "." decimal tab, 1904# unofficial "!" other , "\x8a" other 1905# official only if SFMinVers is nonzero 1906>>5 regex/s [=.<>|!^\x8a]{79} AppleWorks Word Processor 1907# AppleWorks Word Processor File (Apple II) 1908# ./apple (version 5.25) labeled the entry as "AppleWorks word processor data" 1909# application/x-appleworks is mime type for claris version with cwk extension 1910!:mime application/x-appleworks3 1911# http://home.earthlink.net/~hughhood/appleiiworksenvoy/ 1912# ('p' + 1-byte ProDOS File Type + 2-byte ProDOS Aux Type') 1913# $70 $1A $F8 $FF is this the apple type ? 1914#:apple pdosp^Z\xf8\xff 1915!:ext awp 1916# minimum version needed to read this files. SFMinVers (0 , 30~3.0 ) 1917>>>183 ubyte 30 3.0 1918>>>183 ubyte !30 1919>>>>183 ubyte !0 0x%x 1920# usual tabstop start sequence "=====<" 1921>>>5 string x \b, tabstop ruler "%6.6s" 1922# tabstop ruler 1923#>>>5 string >\0 \b, tabstops "%-79s" 1924# zoom switch 1925>>>85 byte&0x01 >0 \b, zoomed 1926# whether paginated 1927>>>90 byte&0x01 >0 \b, paginated 1928# contains any mail-merge commands 1929>>>92 byte&0x01 >0 \b, with mail merge 1930# left margin in 1/10 inches ( normally 0 or 10 ) 1931>>>91 ubyte >0 1932>>>>91 ubyte x \b, %d/10 inch left margin 1933 1934# AppleWorks database: 1935# 1936# This isn't really a magic number, but it's the closest thing to one 1937# that I could find. The 1 and 2 really mean "order in which you defined 1938# categories" and "left to right, top to bottom," respectively; the D and R 1939# mean that the cursor should move either down or right when you press Return. 1940 1941#30 string \x01D AppleWorks database data 1942#30 string \x02D AppleWorks database data 1943#30 string \x01R AppleWorks database data 1944#30 string \x02R AppleWorks database data 1945 1946# AppleWorks spreadsheet: 1947# 1948# Likewise, this isn't really meant as a magic number. The R or C means 1949# row- or column-order recalculation; the A or M means automatic or manual 1950# recalculation. 1951 1952#131 string RA AppleWorks spreadsheet data 1953#131 string RM AppleWorks spreadsheet data 1954#131 string CA AppleWorks spreadsheet data 1955#131 string CM AppleWorks spreadsheet data 1956 1957# Applesoft BASIC: 1958# 1959# This is incredibly sloppy, but will be true if the program was 1960# written at its usual memory location of 2048 and its first line 1961# number is less than 256. Yuck. 1962# update by Joerg Jenderek at Feb 2013 1963 1964# GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000) 1965#0 belong&0xff00ff 0x80000 Applesoft BASIC program data 19660 belong&0x00ff00ff 0x00080000 1967# assuming that line number must be positive 1968>2 leshort >0 Applesoft BASIC program data, first line number %d 1969#>2 leshort x \b, first line number %d 1970 1971# ORCA/EZ assembler: 1972# 1973# This will not identify ORCA/M source files, since those have 1974# some sort of date code instead of the two zero bytes at 6 and 7 1975# XXX Conflicts with ELF 1976#4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data 1977#>5 byte x \b, build number %d 1978 1979# Broderbund Fantavision 1980# 1981# I don't know what these values really mean, but they seem to recur. 1982# Will they cause too many conflicts? 1983 1984# Probably :-) 1985#2 belong&0xFF00FF 0x040008 Fantavision movie data 1986 1987# Some attempts at images. 1988# 1989# These are actually just bit-for-bit dumps of the frame buffer, so 1990# there's really no reasonably way to distinguish them except for their 1991# address (if preserved) -- 8192 or 16384 -- and their length -- 8192 1992# or, occasionally, 8184. 1993# 1994# Nevertheless this will manage to catch a lot of images that happen 1995# to have a solid-colored line at the bottom of the screen. 1996 1997# GRR: Magic too weak 1998#8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background 1999#8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background 2000#8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background 2001#8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background 2002#8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background 2003 2004# Beagle Bros. Apple Mechanic fonts 2005 20060 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font 2007 2008# Apple Universal Disk Image Format (UDIF) - dmg files. 2009# From Johan Gade. 2010# These entries are disabled for now until we fix the following issues. 2011# 2012# Note there might be some problems with the "VAX COFF executable" 2013# entry. Note this entry should be placed before the mac filesystem section, 2014# particularly the "Apple Partition data" entry. 2015# 2016# The intended meaning of these tests is, that the file is only of the 2017# specified type if both of the lines are correct - i.e. if the first 2018# line matches and the second doesn't then it is not of that type. 2019# 2020#0 long 0x7801730d 2021#>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO) 2022# 2023# Note that this entry is recognized correctly by the "Apple Partition 2024# data" entry - however since this entry is more specific - this 2025# information seems to be more useful. 2026#0 long 0x45520200 2027#>0x410 string disk\ image UDIF read/write image (UDRW) 2028 2029# From: Toby Peterson <toby@apple.com> 20300 string bplist00 Apple binary property list 2031 2032# Apple binary property list (bplist) 2033# Assumes version bytes are hex. 2034# Provides content hints for version 0 files. Assumes that the root 2035# object is the first object (true for CoreFoundation implementation). 2036# From: David Remahl <dremahl@apple.com> 20370 string bplist 2038>6 byte x \bCoreFoundation binary property list data, version 0x%c 2039>>7 byte x \b%c 2040>6 string 00 \b 2041>>8 byte&0xF0 0x00 \b 2042>>>8 byte&0x0F 0x00 \b, root type: null 2043>>>8 byte&0x0F 0x08 \b, root type: false boolean 2044>>>8 byte&0x0F 0x09 \b, root type: true boolean 2045>>8 byte&0xF0 0x10 \b, root type: integer 2046>>8 byte&0xF0 0x20 \b, root type: real 2047>>8 byte&0xF0 0x30 \b, root type: date 2048>>8 byte&0xF0 0x40 \b, root type: data 2049>>8 byte&0xF0 0x50 \b, root type: ascii string 2050>>8 byte&0xF0 0x60 \b, root type: unicode string 2051>>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT) 2052>>8 byte&0xF0 0xa0 \b, root type: array 2053>>8 byte&0xF0 0xd0 \b, root type: dictionary 2054 2055# Apple/NeXT typedstream data 2056# Serialization format used by NeXT and Apple for various 2057# purposes in YellowStep/Cocoa, including some nib files. 2058# From: David Remahl <dremahl@apple.com> 20592 string typedstream NeXT/Apple typedstream data, big endian 2060>0 byte x \b, version %d 2061>0 byte <5 \b 2062>>13 byte 0x81 \b 2063>>>14 ubeshort x \b, system %d 20642 string streamtyped NeXT/Apple typedstream data, little endian 2065>0 byte x \b, version %d 2066>0 byte <5 \b 2067>>13 byte 0x81 \b 2068>>>14 uleshort x \b, system %d 2069 2070#------------------------------------------------------------------------------ 2071# CAF: Apple CoreAudio File Format 2072# 2073# Container format for high-end audio purposes. 2074# From: David Remahl <dremahl@apple.com> 2075# 20760 string caff CoreAudio Format audio file 2077>4 beshort <10 version %d 2078>6 beshort x 2079 2080 2081#------------------------------------------------------------------------------ 2082# Keychain database files 20830 string kych Mac OS X Keychain File 2084 2085#------------------------------------------------------------------------------ 2086# Code Signing related file types 20870 belong 0xfade0c00 Mac OS X Code Requirement 2088>8 belong 1 (opExpr) 2089>4 belong x - %d bytes 2090 20910 belong 0xfade0c01 Mac OS X Code Requirement Set 2092>8 belong >1 containing %d items 2093>4 belong x - %d bytes 2094 20950 belong 0xfade0c02 Mac OS X Code Directory 2096>8 belong x version %x 2097>12 belong >0 flags 0x%x 2098>4 belong x - %d bytes 2099 21000 belong 0xfade0cc0 Mac OS X Detached Code Signature (non-executable) 2101>4 belong x - %d bytes 2102 21030 belong 0xfade0cc1 Mac OS X Detached Code Signature 2104>8 belong >1 (%d elements) 2105>4 belong x - %d bytes 2106 2107# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 2108# .vdi 21094 string innotek\ VirtualBox\ Disk\ Image %s 2110 2111# Apple disk partition stuff 2112# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map 2113# Reference: https://ftp.netbsd.org/pub/NetBSD/NetBSD-current/src/sys/sys/bootblock.h 2114# Update: Joerg Jenderek 2115# "ER" is APPLE_DRVR_MAP_MAGIC signature 21160 beshort 0x4552 2117# display Apple Driver Map (strength=50) after Syslinux bootloader (71) 2118#!:strength +0 2119# strengthen the magic by looking for used blocksizes 512 2048 2120>2 ubeshort&0xf1FF 0 Apple Driver Map 2121# last 6 bytes for padding found are 0 or end with 55AAh marker for MBR hybrid 2122#>>504 ubequad&0x0000FFffFFff0000 0 2123!:mime application/x-apple-diskimage 2124!:apple ????devr 2125# https://en.wikipedia.org/wiki/Apple_Disk_Image 2126!:ext dmg/iso 2127# sbBlkSize for driver descriptor map 512 2048 2128>>2 beshort x \b, blocksize %d 2129# sbBlkCount sometimes garbish like 2130# 0xb0200000 for unzlibed install_flash_player_19.0.0.245_osx.dmg 2131# 0xf2720100 for bunziped Firefox 48.0-2.dmg 2132# 0xeb02ffff for super_grub2_disk_hybrid_2.02s3.iso 2133# 0x00009090 by syslinux-6.03/utils/isohybrid.c 2134>>4 ubelong x \b, blockcount %u 2135# following device/driver information not very useful 2136# device type 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) 2137>>8 ubeshort x \b, devtype %u 2138# device id 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) 2139>>10 ubeshort x \b, devid %u 2140# driver data 0 (2425393296 garbage for super_grub2_disk_hybrid_2.02s3.iso) 2141>>12 ubelong >0 2142>>>12 ubelong x \b, driver data %u 2143# number of driver descriptors sbDrvrCount <= 61 2144# (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) 2145>>16 ubeshort x \b, driver count %u 2146# 61 * apple_drvr_descriptor[8]. information not very useful or same as in partition map 2147# >>18 use apple-driver-map 2148# >>26 use apple-driver-map 2149# # ... 2150# >>500 use apple-driver-map 2151# number of partitions is always same in every partition (map block count) 2152#>>0x0204 ubelong x \b, %u partitions 2153>>0x0204 ubelong >0 \b, contains[@0x200]: 2154>>>0x0200 use apple-apm 2155>>0x0204 ubelong >1 \b, contains[@0x400]: 2156>>>0x0400 use apple-apm 2157>>0x0204 ubelong >2 \b, contains[@0x600]: 2158>>>0x0600 use apple-apm 2159>>0x0204 ubelong >3 \b, contains[@0x800]: 2160>>>0x0800 use apple-apm 2161>>0x0204 ubelong >4 \b, contains[@0xA00]: 2162>>>0x0A00 use apple-apm 2163>>0x0204 ubelong >5 \b, contains[@0xC00]: 2164>>>0x0C00 use apple-apm 2165>>0x0204 ubelong >6 \b, contains[@0xE00]: 2166>>>0x0E00 use apple-apm 2167>>0x0204 ubelong >7 \b, contains[@0x1000]: 2168>>>0x1000 use apple-apm 2169# display apple driver descriptor map (start-block, # blocks in sbBlkSize sizes, type) 21700 name apple-driver-map 2171>0 ubequad !0 2172# descBlock first block of driver 2173>>0 ubelong x \b, driver start block %u 2174# descSize driver size in blocks 2175>>4 ubeshort x \b, size %u 2176# descType driver system type 1 701h F8FFh FFFFh 2177>>6 ubeshort x \b, type 0x%x 2178 2179# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map 2180# Reference: https://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h 2181# Update: Joerg Jenderek 2182# Yes, the 3rd and 4th bytes pmSigPad are reserved, but we use them to make the 2183# magic stronger. 2184# for apple partition map stored as a single file 21850 belong 0x504d0000 2186# to display Apple Partition Map (strength=70) after Syslinux bootloader (71) 2187#!:strength +0 2188>0 use apple-apm 2189# magic/Magdir/apple14.test, 365: Warning: Current entry does not yet have a description for adding a EXTENSION type 2190# file: could not find any valid magic files! 2191#!:ext bin 2192# display apple partition map. Normally called after Apple driver map 21930 name apple-apm 2194>0 belong 0x504d0000 Apple Partition Map 2195# number of partitions 2196>>4 ubelong x \b, map block count %u 2197# logical block (512 bytes) start of partition 2198>>8 ubelong x \b, start block %u 2199>>12 ubelong x \b, block count %u 2200>>16 string >0 \b, name %s 2201>>48 string >0 \b, type %s 2202# processor type dpme_process_id[16] e.g. "68000" "68020" 2203>>120 string >0 \b, processor %s 2204# A/UX boot arguments BootArgs[128] 2205>>136 string >0 \b, boot arguments %s 2206# status of partition dpme_flags 2207>>88 belong & 1 \b, valid 2208>>88 belong & 2 \b, allocated 2209>>88 belong & 4 \b, in use 2210>>88 belong & 8 \b, has boot info 2211>>88 belong & 16 \b, readable 2212>>88 belong & 32 \b, writable 2213>>88 belong & 64 \b, pic boot code 2214>>88 belong & 128 \b, chain compatible driver 2215>>88 belong & 256 \b, real driver 2216>>88 belong & 512 \b, chain driver 2217# mount automatically at startup APPLE_PS_AUTO_MOUNT 2218>>88 ubelong &0x40000000 \b, mount at startup 2219# is the startup partition APPLE_PS_STARTUP 2220>>88 ubelong &0x80000000 \b, is the startup partition 2221 2222#https://wiki.mozilla.org/DS_Store_File_Format 2223#https://en.wikipedia.org/wiki/.DS_Store 22240 string \0\0\0\1Bud1\0 Apple Desktop Services Store 2225 2226# HFS/HFS+ Resource fork files (andrew.roazen@nau.edu Apr 13 2015) 2227# Usually not in separate files, but have either filename rsrc with 2228# no extension, or a filename corresponding to another file, with 2229# extensions rsr/rsrc 22300 string \000\000\001\000 2231>4 leshort 0 2232>>16 lelong 0 Apple HFS/HFS+ resource fork 2233 2234#https://en.wikipedia.org/wiki/AppleScript 22350 string FasdUAS AppleScript compiled 2236 2237# AppleWorks/ClarisWorks 2238# https://github.com/joshenders/appleworks_format 2239# http://fileformats.archiveteam.org/wiki/AppleWorks 22400 name appleworks 2241>0 belong&0x00ffffff 0x07e100 AppleWorks CWK Document 2242>0 belong&0x00ffffff 0x008803 ClarisWorks CWK Document 2243>0 default x 2244>>0 belong x AppleWorks/ClarisWorks CWK Document 2245>0 byte x \b, version %d 2246>30 beshort x \b, %d 2247>32 beshort x \bx%d 2248!:ext cwk 2249 22504 string BOBO 2251>0 byte >4 2252>>12 belong 0 2253>>>26 belong 0 2254>>>>0 use appleworks 2255>0 belong 0x0481ad00 2256>>0 use appleworks 2257 2258# magic for Apple File System (APFS) 2259# from Alex Myczko <alex@aiei.ch> 226032 string NXSB Apple File System (APFS) 2261>36 ulelong x \b, blocksize %u 2262 2263# iTunes cover art (versions 1 and 2) 22644 string itch 2265>24 string artw 2266>>0x1e8 string data iTunes cover art 2267>>>0x1ed string PNG (PNG) 2268>>>0x1ec beshort 0xffd8 (JPEG) 2269 2270# MacPaint image 227165 string PNTGMPNT MacPaint image data 2272#0 belong 2 MacPaint image data 2273 2274#------------------------------------------------------------------------------ 2275# $File: application,v 1.1 2016/10/17 12:13:01 christos Exp $ 2276# application: file(1) magic for applications on small devices 2277# 2278# Pebble Application 22790 string PBLAPP\000\000 Pebble application 2280 2281#------------------------------------------------------------------------------ 2282# $File: applix,v 1.5 2009/09/19 16:28:08 christos Exp $ 2283# applix: file(1) magic for Applixware 2284# From: Peter Soos <sp@osb.hu> 2285# 22860 string *BEGIN Applixware 2287>7 string WORDS Words Document 2288>7 string GRAPHICS Graphic 2289>7 string RASTER Bitmap 2290>7 string SPREADSHEETS Spreadsheet 2291>7 string MACRO Macro 2292>7 string BUILDER Builder Object 2293 2294#------------------------------------------------------------------------------ 2295# $File: apt,v 1.1 2016/10/17 19:51:57 christos Exp $ 2296# apt: file(1) magic for APT Cache files 2297# <http://www.fifi.org/doc/libapt-pkg-doc/cache.html/ch2.html> 2298# <https://anonscm.debian.org/cgit/apt/apt.git/tree/apt-pkg/pkgcache.h#n292> 2299 2300# before version 10 ("old format"), data was in arch-specific long/short 2301 2302# old format 64 bit 23030 name apt-cache-64bit-be 2304>12 beshort 1 \b, dirty 2305>40 bequad x \b, %llu packages 2306>48 bequad x \b, %llu versions 2307 2308# old format 32 bit 23090 name apt-cache-32bit-be 2310>8 beshort 1 \b, dirty 2311>40 belong x \b, %u packages 2312>44 belong x \b, %u versions 2313 2314# new format 23150 name apt-cache-be 2316>6 byte 1 \b, dirty 2317>24 belong x \b, %u packages 2318>28 belong x \b, %u versions 2319 23200 bequad 0x98FE76DC 2321>8 ubeshort <10 APT cache data, version %u 2322>>10 beshort x \b.%u, 64 bit big-endian 2323>>0 use apt-cache-64bit-be 2324 23250 lequad 0x98FE76DC 2326>8 uleshort <10 APT cache data, version %u 2327>>10 leshort x \b.%u, 64 bit little-endian 2328>>0 use \^apt-cache-64bit-be 2329 23300 belong 0x98FE76DC 2331>4 ubeshort <10 APT cache data, version %u 2332>>6 ubeshort x \b.%u, 32 bit big-endian 2333>>0 use apt-cache-32bit-be 2334>4 ubyte >9 APT cache data, version %u 2335>>5 ubyte x \b.%u, big-endian 2336>>0 use apt-cache-be 2337 23380 lelong 0x98FE76DC 2339>4 uleshort <10 APT cache data, version %u 2340>>6 uleshort x \b.%u, 32 bit little-endian 2341>>0 use \^apt-cache-32bit-be 2342>4 ubyte >9 APT cache data, version %u 2343>>5 ubyte x \b.%u, little-endian 2344>>0 use \^apt-cache-be 2345#------------------------------------------------------------------------------ 2346# $File: archive,v 1.138 2020/06/07 23:29:26 christos Exp $ 2347# archive: file(1) magic for archive formats (see also "msdos" for self- 2348# extracting compressed archives) 2349# 2350# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc. 2351# pre-POSIX "tar" archives are also handled in the C code ../../src/is_tar.c. 2352 2353# POSIX tar archives 2354# URL: https://en.wikipedia.org/wiki/Tar_(computing) 2355# Reference: https://www.freebsd.org/cgi/man.cgi?query=tar&sektion=5&manpath=FreeBSD+8-current 2356# header mainly padded with nul bytes 2357500 quad 0 2358!:strength /2 2359# filename or extended attribute printable strings in range space null til umlaut ue 2360>0 ubeshort >0x1F00 2361>>0 ubeshort <0xFCFD 2362# last 4 header bytes often null but tar\0 in gtarfail2.tar gtarfail.tar-bad 2363# at https://sourceforge.net/projects/s-tar/files/testscripts/ 2364>>>508 ubelong&0x8B9E8DFF 0 2365# nul, space or ascii digit 0-7 at start of mode 2366>>>>100 ubyte&0xC8 =0 2367>>>>>101 ubyte&0xC8 =0 2368# nul, space at end of check sum 2369>>>>>>155 ubyte&0xDF =0 2370# space or ascii digit 0 at start of check sum 2371>>>>>>>148 ubyte&0xEF =0x20 2372>>>>>>>>0 use tar-file 2373# minimal check and then display tar archive information which can also be 2374# embedded inside others like Android Backup, Clam AntiVirus database 23750 name tar-file 2376>257 string !ustar 2377# header padded with nuls 2378>>257 ulong =0 2379# GNU tar version 1.29 with non pax format option without refusing 2380# creates misleading V7 header for Long path, Multi-volume, Volume type 2381>>>156 ubyte 0x4c GNU tar archive 2382!:mime application/x-gtar 2383!:ext tar/gtar 2384>>>156 ubyte 0x4d GNU tar archive 2385!:mime application/x-gtar 2386!:ext tar/gtar 2387>>>156 ubyte 0x56 GNU tar archive 2388!:mime application/x-gtar 2389!:ext tar/gtar 2390>>>156 default x tar archive (V7) 2391!:mime application/x-tar 2392!:ext tar 2393# other stuff in padding 2394# some implementations add new fields to the blank area at the end of the header record 2395# created for example by DOS TAR 3.20g 1994 Tim V.Shapore with -j option 2396>>257 ulong !0 tar archive (old) 2397!:mime application/x-tar 2398!:ext tar 2399# magic in newer, GNU, posix variants 2400>257 string =ustar 2401# 2 last char of magic and UStar version because string expression does not work 2402# 2 space characters followed by a null for GNU variant 2403>>261 ubelong =0x72202000 POSIX tar archive (GNU) 2404!:mime application/x-gtar 2405!:ext tar/gtar 2406# UStar version with ASCII "00" 2407>>261 ubelong 0x72003030 POSIX 2408# gLOBAL and ExTENSION type only found in POSIX.1-2001 format 2409>>>156 ubyte 0x67 \b.1-2001 2410>>>156 ubyte 0x78 \b.1-2001 2411>>>156 ubyte x tar archive 2412!:mime application/x-ustar 2413!:ext tar/ustar 2414# version with 2 binary nuls embedded in Android Backup like com.android.settings.ab 2415>>261 ubelong 0x72000000 tar archive (ustar) 2416!:mime application/x-ustar 2417!:ext tar/ustar 2418# not seen ustar variant with garbish version 2419>>261 default x tar archive (unknown ustar) 2420!:mime application/x-ustar 2421!:ext tar/ustar 2422# type flag of 1st tar archive member 2423#>156 ubyte x \b, %c-type 2424>156 ubyte x 2425>>156 ubyte 0 \b, file 2426>>156 ubyte 0x30 \b, file 2427>>156 ubyte 0x31 \b, hard link 2428>>156 ubyte 0x32 \b, symlink 2429>>156 ubyte 0x33 \b, char device 2430>>156 ubyte 0x34 \b, block device 2431>>156 ubyte 0x35 \b, directory 2432>>156 ubyte 0x36 \b, fifo 2433>>156 ubyte 0x37 \b, reserved 2434>>156 ubyte 0x4c \b, long path 2435>>156 ubyte 0x4d \b, multi volume 2436>>156 ubyte 0x56 \b, volume 2437>>156 ubyte 0x67 \b, global 2438>>156 ubyte 0x78 \b, extension 2439>>156 default x \b, type 2440>>>156 ubyte x '%c' 2441# name[100] 2442>0 string >\0 %-.60s 2443# mode mainly stored as an octal number in ASCII null or space terminated 2444>100 string >\0 \b, mode %-.7s 2445# user id mainly as octal numbers in ASCII null or space terminated 2446>108 string >\0 \b, uid %-.7s 2447# group id mainly as octal numbers in ASCII null or space terminated 2448>116 string >\0 \b, gid %-.7s 2449# size mainly as octal number in ASCII 2450>124 ubyte <0x38 2451>>124 string >\0 \b, size %-.12s 2452# coding indicated by setting the high-order bit of the leftmost byte 2453>124 ubyte >0xEF \b, size 0x 2454>>124 ubyte !0xff \b%2.2x 2455>>125 ubyte !0xff \b%2.2x 2456>>126 ubyte !0xff \b%2.2x 2457>>127 ubyte !0xff \b%2.2x 2458>>128 ubyte !0xff \b%2.2x 2459>>129 ubyte !0xff \b%2.2x 2460>>130 ubyte !0xff \b%2.2x 2461>>131 ubyte !0xff \b%2.2x 2462>>132 ubyte !0xff \b%2.2x 2463>>133 ubyte !0xff \b%2.2x 2464>>134 ubyte !0xff \b%2.2x 2465>>135 ubyte !0xff \b%2.2x 2466# seconds since 0:0:0 1 jan 1970 UTC as octal number mainly in ASCII null or space terminated 2467>136 string >\0 \b, seconds %-.11s 2468# header checksum stored as an octal number in ASCII null or space terminated 2469#>148 string x \b, cksum %.7s 2470# linkname[100] 2471>157 string >\0 \b, linkname %-.40s 2472# additional fields for ustar 2473>257 string =ustar 2474# owner user name null terminated 2475>>265 string >\0 \b, user %-.32s 2476# group name null terminated 2477>>297 string >\0 \b, group %-.32s 2478# device major minor if not zero 2479>>329 ubequad&0xCFCFCFCFcFcFcFdf !0 2480>>>329 string x \b, devmaj %-.7s 2481>>337 ubequad&0xCFCFCFCFcFcFcFdf !0 2482>>>337 string x \b, devmin %-.7s 2483# prefix[155] 2484>>345 string >\0 \b, prefix %-.155s 2485# old non ustar/POSIX tar 2486>257 string !ustar 2487>>508 string =tar\0 2488# padding[255] in old star 2489>>>257 string >\0 \b, padding: %-.40s 2490>>508 default x 2491# padding[255] in old tar sometimes comment field 2492>>>257 string >\0 \b, comment: %-.40s 2493 2494# Incremental snapshot gnu-tar format from: 2495# https://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html 24960 string GNU\ tar- GNU tar incremental snapshot data 2497>&0 regex [0-9]\.[0-9]+-[0-9]+ version %s 2498 2499# cpio archives 2500# 2501# Yes, the top two "cpio archive" formats *are* supposed to just be "short". 2502# The idea is to indicate archives produced on machines with the same 2503# byte order as the machine running "file" with "cpio archive", and 2504# to indicate archives produced on machines with the opposite byte order 2505# from the machine running "file" with "byte-swapped cpio archive". 2506# 2507# The SVR4 "cpio(4)" hints that there are additional formats, but they 2508# are defined as "short"s; I think all the new formats are 2509# character-header formats and thus are strings, not numbers. 25100 short 070707 cpio archive 2511!:mime application/x-cpio 25120 short 0143561 byte-swapped cpio archive 2513!:mime application/x-cpio # encoding: swapped 25140 string 070707 ASCII cpio archive (pre-SVR4 or odc) 25150 string 070701 ASCII cpio archive (SVR4 with no CRC) 25160 string 070702 ASCII cpio archive (SVR4 with CRC) 2517 2518# 2519# Various archive formats used by various versions of the "ar" 2520# command. 2521# 2522 2523# 2524# Original UNIX archive formats. 2525# They were written with binary values in host byte order, and 2526# the magic number was a host "int", which might have been 16 bits 2527# or 32 bits. We don't say "PDP-11" or "VAX", as there might have 2528# been ports to little-endian 16-bit-int or 32-bit-int platforms 2529# (x86?) using some of those formats; if none existed, feel free 2530# to use "PDP-11" for little-endian 16-bit and "VAX" for little-endian 2531# 32-bit. There might have been big-endian ports of that sort as 2532# well. 2533# 25340 leshort 0177555 very old 16-bit-int little-endian archive 25350 beshort 0177555 very old 16-bit-int big-endian archive 25360 lelong 0177555 very old 32-bit-int little-endian archive 25370 belong 0177555 very old 32-bit-int big-endian archive 2538 25390 leshort 0177545 old 16-bit-int little-endian archive 2540>2 string __.SYMDEF random library 25410 beshort 0177545 old 16-bit-int big-endian archive 2542>2 string __.SYMDEF random library 25430 lelong 0177545 old 32-bit-int little-endian archive 2544>4 string __.SYMDEF random library 25450 belong 0177545 old 32-bit-int big-endian archive 2546>4 string __.SYMDEF random library 2547 2548# 2549# From "pdp" (but why a 4-byte quantity?) 2550# 25510 lelong 0x39bed PDP-11 old archive 25520 lelong 0x39bee PDP-11 4.0 archive 2553 2554# 2555# XXX - what flavor of APL used this, and was it a variant of 2556# some ar archive format? It's similar to, but not the same 2557# as, the APL workspace magic numbers in pdp. 2558# 25590 long 0100554 apl workspace 2560 2561# 2562# System V Release 1 portable(?) archive format. 2563# 25640 string =<ar> System V Release 1 ar archive 2565!:mime application/x-archive 2566 2567# 2568# Debian package; it's in the portable archive format, and needs to go 2569# before the entry for regular portable archives, as it's recognized as 2570# a portable archive whose first member has a name beginning with 2571# "debian". 2572# 2573# Update: Joerg Jenderek 2574# URL: https://en.wikipedia.org/wiki/Deb_(file_format) 25750 string =!<arch>\ndebian 2576# https://manpages.debian.org/testing/dpkg/dpkg-split.1.en.html 2577>14 string -split part of multipart Debian package 2578!:mime application/vnd.debian.binary-package 2579# udeb is used for stripped down deb file 2580!:ext deb/udeb 2581>14 string -binary Debian binary package 2582!:mime application/vnd.debian.binary-package 2583# For ipk packager see also https://en.wikipedia.org/wiki/Opkg 2584!:ext deb/udeb/ipk 2585# This should not happen 2586>14 default x Unknown Debian package 2587# NL terminated version; for most Debian cases this is 2.0 or 2.1 for splitted 2588>68 string >\0 (format %s) 2589#>68 string !2.0\n 2590#>>68 string x (format %.3s) 2591>68 string =2.0\n 2592# 2nd archive name=control archive name like control.tar.gz or control.tar.xz 2593>>72 string >\0 \b, with %.14s 2594# look for 3rd archive name=data archive name like data.tar.{gz,xz,bz2,lzma} 2595>>0 search/0x93e4f data.tar. \b, data compression 2596# the above line only works if FILE_BYTES_MAX in ../../src/file.h is raised 2597# for example like libreoffice-dev-doc_1%3a5.2.7-1+rpi1+deb9u3_all.deb 2598>>>&0 string x %.2s 2599# skip space (0x20 BSD) and slash (0x2f System V) character marking end of name 2600>>>&2 ubyte !0x20 2601>>>>&-1 ubyte !0x2f 2602# display 3rd character of file name extension like 2 of bz2 or m of lzma 2603>>>>>&-1 ubyte x \b%c 2604>>>>>>&0 ubyte !0x20 2605>>>>>>>&-1 ubyte !0x2f 2606# display 4th character of file name extension like a of lzma 2607>>>>>>>>&-1 ubyte x \b%c 2608# splitted debian package case 2609>68 string =2.1\n 2610# dpkg-1.18.25/dpkg-split/info.c 2611# NL terminated ASCII package name like ckermit 2612>>&0 string x \b, %s 2613# NL terminated package version like 302-5.3 2614>>>&1 string x %s 2615# NL terminated MD5 checksum 2616>>>>&1 string x \b, MD5 %s 2617# NL terminated original package length 2618>>>>>&1 string x \b, unsplitted size %s 2619# NL terminated part length 2620>>>>>>&1 string x \b, part length %s 2621# NL terminated package part like n/m 2622>>>>>>>&1 string x \b, part %s 2623# NL terminated package architecture like armhf since dpkg 1.16.1 or later 2624>>>>>>>>&1 string x \b, %s 2625 2626# 2627# MIPS archive; they're in the portable archive format, and need to go 2628# before the entry for regular portable archives, as it's recognized as 2629# a portable archive whose first member has a name beginning with 2630# "__________E". 2631# 26320 string =!<arch>\n__________E MIPS archive 2633!:mime application/x-archive 2634>20 string U with MIPS Ucode members 2635>21 string L with MIPSEL members 2636>21 string B with MIPSEB members 2637>19 string L and an EL hash table 2638>19 string B and an EB hash table 2639>22 string X -- out of date 2640 2641# 2642# BSD/SVR2-and-later portable archive formats. 2643# 2644# Update: Joerg Jenderek 2645# URL: http://fileformats.archiveteam.org/wiki/AR 2646# Reference: https://www.unix.com/man-page/opensolaris/3HEAD/ar.h/ 2647# Note: Mach-O universal binary in ./cafebabe is dependent 2648# TODO: unify current ar archive, MIPS archive, Debian package 2649# distinguish BSD, SVR; 32, 64 bit; HP from other 32-bit SVR; 2650# *.ar packages from *.a libraries. handle empty archive 26510 string =!<arch>\n current ar archive 2652# print first and possibly second ar_name[16] for debugging purpose 2653#>8 string x \b, 1st "%.16s" 2654#>68 string x \b, 2nd "%.16s" 2655!:mime application/x-archive 2656# a in most case for libraries; lib for Microsoft libraries; ar else cases 2657!:ext a/lib/ar 2658>8 string __.SYMDEF random library 2659# first member with long marked name __.SYMDEF SORTED implies BSD library 2660>68 string __.SYMDEF\ SORTED random library 2661# Reference: https://parisc.wiki.kernel.org/images-parisc/b/b2/Rad_11_0_32.pdf 2662# "archive file" entry moved from ./hp 2663# LST header system_id 0210h~PA-RISC 1.1,... identifies the target architecture 2664# LST header a_magic 0619h~relocatable library 2665>68 belong 0x020b0619 - PA-RISC1.0 relocatable library 2666>68 belong 0x02100619 - PA-RISC1.1 relocatable library 2667>68 belong 0x02110619 - PA-RISC1.2 relocatable library 2668>68 belong 0x02140619 - PA-RISC2.0 relocatable library 2669#EOF for common ar archives 2670 2671# 2672# "Thin" archive, as can be produced by GNU ar. 2673# 26740 string =!<thin>\n thin archive with 2675>68 belong 0 no symbol entries 2676>68 belong 1 %d symbol entry 2677>68 belong >1 %d symbol entries 2678 26790 search/1 -h- Software Tools format archive text 2680 2681# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com) 2682# 2683# The first byte is the magic (0x1a), byte 2 is the compression type for 2684# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS 2685# filename of the first file (null terminated). Since some types collide 2686# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%), 2687# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo. 26880 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW 2689!:mime application/x-arc 26900 lelong&0x8080ffff 0x0000091a ARC archive data, squashed 2691!:mime application/x-arc 26920 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed 2693!:mime application/x-arc 26940 lelong&0x8080ffff 0x0000031a ARC archive data, packed 2695!:mime application/x-arc 26960 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed 2697!:mime application/x-arc 26980 lelong&0x8080ffff 0x0000061a ARC archive data, crunched 2699!:mime application/x-arc 2700# [JW] stuff taken from idarc, obviously ARC successors: 27010 lelong&0x8080ffff 0x00000a1a PAK archive data 2702!:mime application/x-arc 27030 lelong&0x8080ffff 0x0000141a ARC+ archive data 2704!:mime application/x-arc 27050 lelong&0x8080ffff 0x0000481a HYP archive data 2706!:mime application/x-arc 2707 2708# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk) 2709# I can't create either SPARK or ArcFS archives so I have not tested this stuff 2710# [GRR: the original entries collide with ARC, above; replaced with combined 2711# version (not tested)] 2712#0 byte 0x1a RISC OS archive (spark format) 27130 string \032archive RISC OS archive (ArcFS format) 27140 string Archive\000 RISC OS archive (ArcFS format) 2715 2716# All these were taken from idarc, many could not be verified. Unfortunately, 2717# there were many low-quality sigs, i.e. easy to trigger false positives. 2718# Please notify me of any real-world fishy/ambiguous signatures and I'll try 2719# to get my hands on the actual archiver and see if I find something better. [JW] 2720# probably many can be enhanced by finding some 0-byte or control char near the start 2721 2722# idarc calls this Crush/Uncompressed... *shrug* 27230 string CRUSH Crush archive data 2724# Squeeze It (.sqz) 27250 string HLSQZ Squeeze It archive data 2726# SQWEZ 27270 string SQWEZ SQWEZ archive data 2728# HPack (.hpk) 27290 string HPAK HPack archive data 2730# HAP 27310 string \x91\x33HF HAP archive data 2732# MD/MDCD 27330 string MDmd MDCD archive data 2734# LIM 27350 string LIM\x1a LIM archive data 2736# SAR 27373 string LH5 SAR archive data 2738# BSArc/BS2 27390 string \212\3SB\020\0 BSArc/BS2 archive data 2740# Bethesda Softworks Archive (Oblivion) 27410 string BSA\0 BSArc archive data 2742>4 lelong x version %d 2743# MAR 27442 string =-ah MAR archive data 2745# ACB 2746#0 belong&0x00f800ff 0x00800000 ACB archive data 2747# CPZ 2748# TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data 2749# JRC 27500 string JRchive JRC archive data 2751# Quantum 27520 string DS\0 Quantum archive data 2753# ReSOF 27540 string PK\3\6 ReSOF archive data 2755# QuArk 27560 string 7\4 QuArk archive data 2757# YAC 275814 string YC YAC archive data 2759# X1 27600 string X1 X1 archive data 27610 string XhDr X1 archive data 2762# CDC Codec (.dqt) 27630 belong&0xffffe000 0x76ff2000 CDC Codec archive data 2764# AMGC 27650 string \xad6" AMGC archive data 2766# NuLIB 27670 string N\xc3\xb5F\xc3\xa9lx\xc3\xa5 NuLIB archive data 2768# PakLeo 27690 string LEOLZW PAKLeo archive data 2770# ChArc 27710 string SChF ChArc archive data 2772# PSA 27730 string PSA PSA archive data 2774# CrossePAC 27750 string DSIGDCC CrossePAC archive data 2776# Freeze 27770 string \x1f\x9f\x4a\x10\x0a Freeze archive data 2778# KBoom 27790 string \xc2\xa8MP\xc2\xa8 KBoom archive data 2780# NSQ, must go after CDC Codec 27810 string \x76\xff NSQ archive data 2782# DPA 27830 string Dirk\ Paehl DPA archive data 2784# BA 2785# TODO: idarc says "bytes 0-2 == bytes 3-5" 2786# TTComp 2787# URL: http://fileformats.archiveteam.org/wiki/TTComp_archive 2788# Update: Joerg Jenderek 2789# GRR: line below is too general as it matches also Panorama database "TCDB 2003-10 demo.pan", others 27900 string \0\6 2791# look for first keyword of Panorama database *.pan 2792>12 search/261 DESIGN 2793# skip keyword with low entropy 2794>12 default x TTComp archive, binary, 4K dictionary 2795# (version 5.25) labeled the above entry as "TTComp archive data" 2796# From: Joerg Jenderek 2797# URL: https://wiki.68kmla.org/DiskCopy_4.2_format_specification 2798# reference: http://nulib.com/library/FTN.e00005.htm 27990x52 ubeshort 0x0100 2800# test for disk size equal or above 400k 2801>0x40 ubelong >409599 Apple DiskCopy 4.2 image 2802#!:mime application/octet-stream 2803!:apple dCpydImg 2804!:ext image/dc42 2805# image pascal name padded with NULs like Microsoft Mail 2806>>00 pstring/B x %s 2807# data size in bytes like 409600 2808>>0x40 ubelong x \b, %u bytes 2809# tag size in bytes 2810>>0x44 ubelong >0 \b, 0x%x tag size 2811# data checksum 2812#>>0x48 ubelong x \b, 0x%x checksum 2813# tag checksum 2814#>>0x4c ubelong x \b, 0x%x tag checksum 2815# disk encoding 2816>>0x50 ubyte 0 \b, GCR CLV ssdd (400k) 2817>>0x50 ubyte 1 \b, GCR CLV dsdd (800k) 2818>>0x50 ubyte 2 \b, MFM CAV dsdd (720k) 2819>>0x50 ubyte 3 \b, MFM CAV dshd (1440k) 2820>>0x50 ubyte >3 \b, 0x%x encoding 2821# format byte 2822>>0x51 ubyte x \b, 0x%x format 2823#>>0x54 ubequad x \b, data 0x%16.16llx 2824# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation? 28250 string ESP ESP archive data 2826# ZPack 28270 string \1ZPK\1 ZPack archive data 2828# Sky 28290 string \xbc\x40 Sky archive data 2830# UFA 28310 string UFA UFA archive data 2832# Dry 28330 string =-H2O DRY archive data 2834# FoxSQZ 28350 string FOXSQZ FoxSQZ archive data 2836# AR7 28370 string ,AR7 AR7 archive data 2838# PPMZ 28390 string PPMZ PPMZ archive data 2840# MS Compress 2841# Update: Joerg Jenderek 2842# URL: http://fileformats.archiveteam.org/wiki/MS-DOS_installation_compression 2843# Reference: https://hwiegman.home.xs4all.nl/fileformats/compress/szdd_kwaj_format.html 2844# Note: use correct version of extracting tool like EXPAND, UNPACK, DECOMP or 7Z 28454 string \x88\xf0\x27 2846# KWAJ variant 2847>0 string KWAJ MS Compress archive data, KWAJ variant 2848!:mime application/x-ms-compress-kwaj 2849# extension not working in version 5.32 2850# magic/Magdir/archive, 284: Warning: EXTENSION type ` ??_' has bad char '?' 2851# file: line 284: Bad magic entry ' ??_' 2852!:ext ??_ 2853# compression method (0-4) 2854>>8 uleshort x \b, %u method 2855# offset of compressed data 2856>>10 uleshort x \b, 0x%x offset 2857#>>(10.s) uleshort x 2858#>>>&-6 string x \b, TEST extension %-.3s 2859# header flags to mark header extensions 2860>>12 uleshort >0 \b, 0x%x flags 2861# 4 bytes: decompressed length of file 2862>>12 uleshort &0x01 2863>>>14 ulelong x \b, original size: %u bytes 2864# 2 bytes: unknown purpose 2865# 2 bytes: length of unknown data + mentioned bytes 2866# 1-9 bytes: null-terminated file name 2867# 1-4 bytes: null-terminated file extension 2868>>12 uleshort &0x08 2869>>>12 uleshort ^0x01 2870>>>>12 uleshort ^0x02 2871>>>>>12 uleshort ^0x04 2872>>>>>>12 uleshort ^0x10 2873>>>>>>>14 string x \b, %-.8s 2874>>>>>>12 uleshort &0x10 2875>>>>>>>14 string x \b, %-.8s 2876>>>>>>>>&1 string x \b.%-.3s 2877>>>>>12 uleshort &0x04 2878>>>>>>12 uleshort ^0x10 2879>>>>>>>(14.s) uleshort x 2880>>>>>>>>&14 string x \b, %-.8s 2881>>>>>>12 uleshort &0x10 2882>>>>>>>(14.s) uleshort x 2883>>>>>>>>&14 string x \b, %-.8s 2884>>>>>>>>>&1 string x \b.%-.3s 2885>>>>12 uleshort &0x02 2886>>>>>12 uleshort ^0x04 2887>>>>>>12 uleshort ^0x10 2888>>>>>>>16 string x \b, %-.8s 2889>>>>>>12 uleshort &0x10 2890>>>>>>>16 string x \b, %-.8s 2891>>>>>>>>&1 string x \b.%-.3s 2892>>>>>12 uleshort &0x04 2893>>>>>>12 uleshort ^0x10 2894>>>>>>>(16.s) uleshort x 2895>>>>>>>>&16 string x \b, %-.8s 2896>>>>>>12 uleshort &0x10 2897>>>>>>>(16.s) uleshort x 2898>>>>>>>&16 string x %-.8s 2899>>>>>>>>&1 string x \b.%-.3s 2900>>>12 uleshort &0x01 2901>>>>12 uleshort ^0x02 2902>>>>>12 uleshort ^0x04 2903>>>>>>12 uleshort ^0x10 2904>>>>>>>18 string x \b, %-.8s 2905>>>>>>12 uleshort &0x10 2906>>>>>>>18 string x \b, %-.8s 2907>>>>>>>>&1 string x \b.%-.3s 2908>>>>>12 uleshort &0x04 2909>>>>>>12 uleshort ^0x10 2910>>>>>>>(18.s) uleshort x 2911>>>>>>>>&18 string x \b, %-.8s 2912>>>>>>12 uleshort &0x10 2913>>>>>>>(18.s) uleshort x 2914>>>>>>>>&18 string x \b, %-.8s 2915>>>>>>>>>&1 string x \b.%-.3s 2916>>>>12 uleshort &0x02 2917>>>>>12 uleshort ^0x04 2918>>>>>>12 uleshort ^0x10 2919>>>>>>>20 string x \b, %-.8s 2920>>>>>>12 uleshort &0x10 2921>>>>>>>20 string x \b, %-.8s 2922>>>>>>>>&1 string x \b.%-.3s 2923>>>>>12 uleshort &0x04 2924>>>>>>12 uleshort ^0x10 2925>>>>>>>(20.s) uleshort x 2926>>>>>>>>&20 string x \b, %-.8s 2927>>>>>>12 uleshort &0x10 2928>>>>>>>(20.s) uleshort x 2929>>>>>>>>&20 string x \b, %-.8s 2930>>>>>>>>>&1 string x \b.%-.3s 2931# 2 bytes: length of data + mentioned bytes 2932# 2933# SZDD variant Haruhiko Okumura's LZSS or 7z type MsLZ 2934>0 string SZDD MS Compress archive data, SZDD variant 2935!:mime application/x-ms-compress-szdd 2936!:ext ??_ 2937# The character missing from the end of the filename (0=unknown) 2938>>9 string >\0 \b, %-.1s is last character of original name 2939# https://www.betaarchive.com/forum/viewtopic.php?t=26161 2940# Compression mode: "A" (0x41) found but sometimes "B" in Windows 3.1 builds 026 and 034e 2941>>8 string !A \b, %-.1s method 2942>>10 ulelong >0 \b, original size: %u bytes 2943# QBasic SZDD variant 29443 string \x88\xf0\x27 2945>0 string SZ\x20 MS Compress archive data, QBasic variant 2946!:mime application/x-ms-compress-sz 2947!:ext ??$ 2948>>8 ulelong >0 \b, original size: %u bytes 2949 2950# MP3 (archiver, not lossy audio compression) 29510 string MP3\x1a MP3-Archiver archive data 2952# ZET 29530 string OZ\xc3\x9d ZET archive data 2954# TSComp 29550 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data 2956# ARQ 29570 string gW\4\1 ARQ archive data 2958# Squash 29593 string OctSqu Squash archive data 2960# Terse 29610 string \5\1\1\0 Terse archive data 2962# PUCrunch 29630 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data 2964# UHarc 29650 string UHA UHarc archive data 2966# ABComp 29670 string \2AB ABComp archive data 29680 string \3AB2 ABComp archive data 2969# CMP 29700 string CO\0 CMP archive data 2971# Splint 29720 string \x93\xb9\x06 Splint archive data 2973# InstallShield 29740 string \x13\x5d\x65\x8c InstallShield Z archive Data 2975# Gather 29761 string GTH Gather archive data 2977# BOA 29780 string BOA BOA archive data 2979# RAX 29800 string ULEB\xa RAX archive data 2981# Xtreme 29820 string ULEB\0 Xtreme archive data 2983# Pack Magic 29840 string @\xc3\xa2\1\0 Pack Magic archive data 2985# BTS 29860 belong&0xfeffffff 0x1a034465 BTS archive data 2987# ELI 5750 29880 string Ora\ ELI 5750 archive data 2989# QFC 29900 string \x1aFC\x1a QFC archive data 29910 string \x1aQF\x1a QFC archive data 2992# PRO-PACK 29930 string RNC PRO-PACK archive data 2994# 777 29950 string 777 777 archive data 2996# LZS221 29970 string sTaC LZS221 archive data 2998# HPA 29990 string HPA HPA archive data 3000# Arhangel 30010 string LG Arhangel archive data 3002# EXP1, uses bzip2 30030 string 0123456789012345BZh EXP1 archive data 3004# IMP 30050 string IMP\xa IMP archive data 3006# NRV 30070 string \x00\x9E\x6E\x72\x76\xFF NRV archive data 3008# Squish 30090 string \x73\xb2\x90\xf4 Squish archive data 3010# Par 30110 string PHILIPP Par archive data 30120 string PAR Par archive data 3013# HIT 30140 string UB HIT archive data 3015# SBX 30160 belong&0xfffff000 0x53423000 SBX archive data 3017# NaShrink 30180 string NSK NaShrink archive data 3019# SAPCAR 30200 string #\ CAR\ archive\ header SAPCAR archive data 30210 string CAR\ 2.00RG SAPCAR archive data 3022# Disintegrator 30230 string DST Disintegrator archive data 3024# ASD 30250 string ASD ASD archive data 3026# InstallShield CAB 30270 string ISc( InstallShield CAB 3028# TOP4 30290 string T4\x1a TOP4 archive data 3030# BatComp left out: sig looks like COM executable 3031# so TODO: get real 4dos batcomp file and find sig 3032# BlakHole 30330 string BH\5\7 BlakHole archive data 3034# BIX 30350 string BIX0 BIX archive data 3036# ChiefLZA 30370 string ChfLZ ChiefLZA archive data 3038# Blink 30390 string Blink Blink archive data 3040# Logitech Compress 30410 string \xda\xfa Logitech Compress archive data 3042# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE) 30431 string (C)\ STEPANYUK ARS-Sfx archive data 3044# AKT/AKT32 30450 string AKT32 AKT32 archive data 30460 string AKT AKT archive data 3047# NPack 30480 string MSTSM NPack archive data 3049# PFT 30500 string \0\x50\0\x14 PFT archive data 3051# SemOne 30520 string SEM SemOne archive data 3053# PPMD 30540 string \x8f\xaf\xac\x84 PPMD archive data 3055# FIZ 30560 string FIZ FIZ archive data 3057# MSXiE 30580 belong&0xfffff0f0 0x4d530000 MSXiE archive data 3059# DeepFreezer 30600 belong&0xfffffff0 0x797a3030 DeepFreezer archive data 3061# DC 30620 string =<DC- DC archive data 3063# TPac 30640 string \4TPAC\3 TPac archive data 3065# Ai 30660 string Ai\1\1\0 Ai archive data 30670 string Ai\1\0\0 Ai archive data 3068# Ai32 30690 string Ai\2\0 Ai32 archive data 30700 string Ai\2\1 Ai32 archive data 3071# SBC 30720 string SBC SBC archive data 3073# Ybs 30740 string YBS Ybs archive data 3075# DitPack 30760 string \x9e\0\0 DitPack archive data 3077# DMS 30780 string DMS! DMS archive data 3079# EPC 30800 string \x8f\xaf\xac\x8c EPC archive data 3081# VSARC 30820 string VS\x1a VSARC archive data 3083# PDZ 30840 string PDZ PDZ archive data 3085# ReDuq 30860 string rdqx ReDuq archive data 3087# GCA 30880 string GCAX GCA archive data 3089# PPMN 30900 string pN PPMN archive data 3091# WinImage 30923 string WINIMAGE WinImage archive data 3093# Compressia 30940 string CMP0CMP Compressia archive data 3095# UHBC 30960 string UHB UHBC archive data 3097# WinHKI 30980 string \x61\x5C\x04\x05 WinHKI archive data 3099# WWPack data file 31000 string WWP WWPack archive data 3101# BSN (BSA, PTS-DOS) 31020 string \xffBSG BSN archive data 31031 string \xffBSG BSN archive data 31043 string \xffBSG BSN archive data 31051 string \0\xae\2 BSN archive data 31061 string \0\xae\3 BSN archive data 31071 string \0\xae\7 BSN archive data 3108# AIN 31090 string \x33\x18 AIN archive data 31100 string \x33\x17 AIN archive data 3111# XPA32 test moved and merged with XPA by Joerg Jenderek at Sep 2015 3112# SZip (TODO: doesn't catch all versions) 31130 string SZ\x0a\4 SZip archive data 3114# XPack DiskImage 3115# *.XDI updated by Joerg Jenderek Sep 2015 3116# ftp://ftp.sac.sk/pub/sac/pack/0index.txt 3117# GRR: this test is still too general as it catches also text files starting with jm 31180 string jm 3119# only found examples with this additional characteristic 2 bytes 3120>2 string \x2\x4 Xpack DiskImage archive data 3121#!:ext xdi 3122# XPack Data 3123# *.xpa updated by Joerg Jenderek Sep 2015 3124# ftp://ftp.elf.stuba.sk/pub/pc/pack/ 31250 string xpa XPA 3126!:ext xpa 3127# XPA32 3128# ftp://ftp.elf.stuba.sk/pub/pc/pack/xpa32.zip 3129# created by XPA32.EXE version 1.0.2 for Windows 3130>0 string xpa\0\1 \b32 archive data 3131# created by XPACK.COM version 1.67m or 1.67r with short 0x1800 3132>3 ubeshort !0x0001 \bck archive data 3133# XPack Single Data 3134# changed by Joerg Jenderek Sep 2015 back to like in version 5.12 3135# letter 'I'+ acute accent is equivalent to \xcd 31360 string \xcd\ jm Xpack single archive data 3137#!:mime application/x-xpa-compressed 3138!:ext xpa 3139 3140# TODO: missing due to unknown magic/magic at end of file: 3141#DWC 3142#ARG 3143#ZAR 3144#PC/3270 3145#InstallIt 3146#RKive 3147#RK 3148#XPack Diskimage 3149 3150# These were inspired by idarc, but actually verified 3151# Dzip archiver (.dz) 3152# Update: Joerg Jenderek 3153# URL: http://speeddemosarchive.com/dzip/ 3154# reference: http://speeddemosarchive.com/dzip/dz29src.zip/main.c 3155# GRR: line below is too general as it matches also ASCII texts like Doszip commander help dz.txt 31560 string DZ 3157# latest version is 2.9 dated 7 may 2003 3158>2 byte <4 Dzip archive data 3159!:mime application/x-dzip 3160!:ext dz 3161>>2 byte x \b, version %i 3162>>3 byte x \b.%i 3163>>4 ulelong x \b, offset 0x%x 3164>>8 ulelong x \b, %u files 3165# ZZip archiver (.zz) 31660 string ZZ\ \0\0 ZZip archive data 31670 string ZZ0 ZZip archive data 3168# PAQ archiver (.paq) 31690 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data 31700 string PAQ PAQ archive data 3171>3 byte&0xf0 0x30 3172>>3 byte x (v%c) 3173# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP) 31740xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data 31750 string JARCS JAR (ARJ Software, Inc.) archive data 3176 3177# ARJ archiver (jason@jarthur.Claremont.EDU) 31780 leshort 0xea60 ARJ archive data 3179!:mime application/x-arj 3180>5 byte x \b, v%d, 3181>8 byte &0x04 multi-volume, 3182>8 byte &0x10 slash-switched, 3183>8 byte &0x20 backup, 3184>34 string x original name: %s, 3185>7 byte 0 os: MS-DOS 3186>7 byte 1 os: PRIMOS 3187>7 byte 2 os: Unix 3188>7 byte 3 os: Amiga 3189>7 byte 4 os: Macintosh 3190>7 byte 5 os: OS/2 3191>7 byte 6 os: Apple ][ GS 3192>7 byte 7 os: Atari ST 3193>7 byte 8 os: NeXT 3194>7 byte 9 os: VAX/VMS 3195>3 byte >0 %d] 3196# [JW] idarc says this is also possible 31972 leshort 0xea60 ARJ archive data 3198 3199# HA archiver (Greg Roelofs, newt@uchicago.edu) 3200# This is a really bad format. A file containing HAWAII will match this... 3201#0 string HA HA archive data, 3202#>2 leshort =1 1 file, 3203#>2 leshort >1 %hu files, 3204#>4 byte&0x0f =0 first is type CPY 3205#>4 byte&0x0f =1 first is type ASC 3206#>4 byte&0x0f =2 first is type HSC 3207#>4 byte&0x0f =0x0e first is type DIR 3208#>4 byte&0x0f =0x0f first is type SPECIAL 3209# suggestion: at least identify small archives (<1024 files) 32100 belong&0xffff00fc 0x48410000 HA archive data 3211>2 leshort =1 1 file, 3212>2 leshort >1 %u files, 3213>4 byte&0x0f =0 first is type CPY 3214>4 byte&0x0f =1 first is type ASC 3215>4 byte&0x0f =2 first is type HSC 3216>4 byte&0x0f =0x0e first is type DIR 3217>4 byte&0x0f =0x0f first is type SPECIAL 3218 3219# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz) 32200 string HPAK HPACK archive data 3221 3222# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net 32230 string \351,\001JAM\ JAM archive, 3224>7 string >\0 version %.4s 3225>0x26 byte =0x27 - 3226>>0x2b string >\0 label %.11s, 3227>>0x27 lelong x serial %08x, 3228>>0x36 string >\0 fstype %.8s 3229 3230# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu) 3231# Update: Joerg Jenderek 3232# URL: https://en.wikipedia.org/wiki/LHA_(file_format) 3233# Reference: https://web.archive.org/web/20021005080911/http://www.osirusoft.com/joejared/lzhformat.html 3234# 3235# check and display information of lharc (LHa,PMarc) file 32360 name lharc-file 3237# check 1st character of method id like -lz4- -lh5- or -pm2- 3238>2 string - 3239# check 5th character of method id 3240>>6 string - 3241# check header level 0 1 2 3 3242>>>20 ubyte <4 3243# check 2nd, 3th and 4th character of method id 3244>>>>3 regex \^(lh[0-9a-ex]|lz[s2-8]|pm[012]|pc1) \b 3245!:mime application/x-lzh-compressed 3246# creator type "LHA " 3247!:apple ????LHA 3248# display archive type name like "LHa/LZS archive data" or "LArc archive" 3249>>>>>2 string -lz \b 3250!:ext lzs 3251# already known -lzs- -lz4- -lz5- with old names 3252>>>>>>2 string -lzs LHa/LZS archive data 3253>>>>>>3 regex \^lz[45] LHarc 1.x archive data 3254# missing -lz?- with wikipedia names 3255>>>>>>3 regex \^lz[2378] LArc archive 3256# display archive type name like "LHa (2.x) archive data" 3257>>>>>2 string -lh \b 3258# already known -lh0- -lh1- -lh2- -lh3- -lh4- -lh5- -lh6- -lh7- -lhd- variants with old names 3259>>>>>>3 regex \^lh[01] LHarc 1.x/ARX archive data 3260# LHice archiver use ".ICE" as name extension instead usual one ".lzh" 3261# FOOBAR archiver use ".foo" as name extension instead usual one 3262# "Florain Orjanov's and Olga Bachetska's ARchiver" not found at the moment 3263>>>>>>>2 string -lh1 \b 3264!:ext lha/lzh/ice 3265>>>>>>3 regex \^lh[23d] LHa 2.x? archive data 3266>>>>>>3 regex \^lh[7] LHa (2.x)/LHark archive data 3267>>>>>>3 regex \^lh[456] LHa (2.x) archive data 3268>>>>>>>2 string -lh5 \b 3269# https://en.wikipedia.org/wiki/BIOS 3270# Some mainboard BIOS like Award use LHa compression. So archives with unusal extension are found like 3271# bios.rom , kd7_v14.bin, 1010.004, ... 3272!:ext lha/lzh/rom/bin 3273# missing -lh?- variants (Joe Jared) 3274>>>>>>3 regex \^lh[89a-ce] LHa (Joe Jared) archive 3275# UNLHA32 2.67a 3276>>>>>>2 string -lhx LHa (UNLHA32) archive 3277# lha archives with standard file name extensions ".lha" ".lzh" 3278>>>>>>3 regex !\^(lh1|lh5) \b 3279!:ext lha/lzh 3280# this should not happen if all -lh variants are described 3281>>>>>>2 default x LHa (unknown) archive 3282#!:ext lha 3283# PMarc 3284>>>>>3 regex \^pm[012] PMarc archive data 3285!:ext pma 3286# append method id without leading and trailing minus character 3287>>>>>3 string x [%3.3s] 3288>>>>>>0 use lharc-header 3289# 3290# check and display information of lharc header 32910 name lharc-header 3292# header size 0x4 , 0x1b-0x61 3293>0 ubyte x 3294# compressed data size != compressed file size 3295#>7 ulelong x \b, data size %d 3296# attribute: 0x2~?? 0x10~symlink|target 0x20~normal 3297#>19 ubyte x \b, 19_0x%x 3298# level identifier 0 1 2 3 3299#>20 ubyte x \b, level %d 3300# time stamp 3301#>15 ubelong x DATE 0x%8.8x 3302# OS ID for level 1 3303>20 ubyte 1 3304# 0x20 types find for *.rom files 3305>>(21.b+24) ubyte <0x21 \b, 0x%x OS 3306# ascii type like M for MSDOS 3307>>(21.b+24) ubyte >0x20 \b, '%c' OS 3308# OS ID for level 2 3309>20 ubyte 2 3310#>>23 ubyte x \b, OS ID 0x%x 3311>>23 ubyte <0x21 \b, 0x%x OS 3312>>23 ubyte >0x20 \b, '%c' OS 3313# filename only for level 0 and 1 3314>20 ubyte <2 3315# length of filename 3316>>21 ubyte >0 \b, with 3317# filename 3318>>>21 pstring x "%s" 3319# 3320#2 string -lh0- LHarc 1.x/ARX archive data [lh0] 3321#!:mime application/x-lharc 33222 string -lh0- 3323>0 use lharc-file 3324#2 string -lh1- LHarc 1.x/ARX archive data [lh1] 3325#!:mime application/x-lharc 33262 string -lh1- 3327>0 use lharc-file 3328# NEW -lz2- ... -lz8- 33292 string -lz2- 3330>0 use lharc-file 33312 string -lz3- 3332>0 use lharc-file 33332 string -lz4- 3334>0 use lharc-file 33352 string -lz5- 3336>0 use lharc-file 33372 string -lz7- 3338>0 use lharc-file 33392 string -lz8- 3340>0 use lharc-file 3341# [never seen any but the last; -lh4- reported in comp.compression:] 3342#2 string -lzs- LHa/LZS archive data [lzs] 33432 string -lzs- 3344>0 use lharc-file 3345# According to wikipedia and others such a version does not exist 3346#2 string -lh\40- LHa 2.x? archive data [lh ] 3347#2 string -lhd- LHa 2.x? archive data [lhd] 33482 string -lhd- 3349>0 use lharc-file 3350#2 string -lh2- LHa 2.x? archive data [lh2] 33512 string -lh2- 3352>0 use lharc-file 3353#2 string -lh3- LHa 2.x? archive data [lh3] 33542 string -lh3- 3355>0 use lharc-file 3356#2 string -lh4- LHa (2.x) archive data [lh4] 33572 string -lh4- 3358>0 use lharc-file 3359#2 string -lh5- LHa (2.x) archive data [lh5] 33602 string -lh5- 3361>0 use lharc-file 3362#2 string -lh6- LHa (2.x) archive data [lh6] 33632 string -lh6- 3364>0 use lharc-file 3365#2 string -lh7- LHa (2.x)/LHark archive data [lh7] 33662 string -lh7- 3367# !:mime application/x-lha 3368# >20 byte x - header level %d 3369>0 use lharc-file 3370# NEW -lh8- ... -lhe- , -lhx- 33712 string -lh8- 3372>0 use lharc-file 33732 string -lh9- 3374>0 use lharc-file 33752 string -lha- 3376>0 use lharc-file 33772 string -lhb- 3378>0 use lharc-file 33792 string -lhc- 3380>0 use lharc-file 33812 string -lhe- 3382>0 use lharc-file 33832 string -lhx- 3384>0 use lharc-file 3385# taken from idarc [JW] 33862 string -lZ PUT archive data 3387# already done by LHarc magics 3388# this should never happen if all sub types of LZS archive are identified 3389#2 string -lz LZS archive data 33902 string -sw1- Swag archive data 3391 33920 name rar-file-header 3393>24 byte 15 \b, v1.5 3394>24 byte 20 \b, v2.0 3395>24 byte 29 \b, v4 3396>15 byte 0 \b, os: MS-DOS 3397>15 byte 1 \b, os: OS/2 3398>15 byte 2 \b, os: Win32 3399>15 byte 3 \b, os: Unix 3400>15 byte 4 \b, os: Mac OS 3401>15 byte 5 \b, os: BeOS 3402 34030 name rar-archive-header 3404>3 leshort&0x1ff >0 \b, flags: 3405>>3 leshort &0x01 ArchiveVolume 3406>>3 leshort &0x02 Commented 3407>>3 leshort &0x04 Locked 3408>>3 leshort &0x10 NewVolumeNaming 3409>>3 leshort &0x08 Solid 3410>>3 leshort &0x20 Authenticated 3411>>3 leshort &0x40 RecoveryRecordPresent 3412>>3 leshort &0x80 EncryptedBlockHeader 3413>>3 leshort &0x100 FirstVolume 3414 3415# RAR (Roshal Archive) archive 34160 string Rar!\x1a\7\0 RAR archive data 3417!:mime application/x-rar 3418!:ext rar/cbr 3419# file header 3420>(0xc.l+9) byte 0x74 3421>>(0xc.l+7) use rar-file-header 3422# subblock seems to share information with file header 3423>(0xc.l+9) byte 0x7a 3424>>(0xc.l+7) use rar-file-header 3425>9 byte 0x73 3426>>7 use rar-archive-header 3427 34280 string Rar!\x1a\7\1\0 RAR archive data, v5 3429!:mime application/x-rar 3430!:ext rar 3431 3432# Very old RAR archive 3433# https://jasonblanks.com/wp-includes/images/papers/KnowyourarchiveRAR.pdf 34340 string RE\x7e\x5e RAR archive data (<v1.5) 3435!:mime application/x-rar 3436!:ext rar/cbr 3437 3438# SQUISH archiver (Greg Roelofs, newt@uchicago.edu) 34390 string SQSH squished archive data (Acorn RISCOS) 3440 3441# UC2 archiver (Greg Roelofs, newt@uchicago.edu) 3442# [JW] see exe section for self-extracting version 34430 string UC2\x1a UC2 archive data 3444 3445# PKZIP multi-volume archive 34460 string PK\x07\x08PK\x03\x04 Zip multi-volume archive data, at least PKZIP v2.50 to extract 3447!:mime application/zip 3448!:ext zip/cbz 3449 3450# Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 34510 string PK\005\006 Zip archive data (empty) 3452!:mime application/zip 3453!:ext zip/cbz 3454!:strength +1 34550 string PK\003\004 3456!:strength +1 3457 3458# Specialised zip formats which start with a member named 'mimetype' 3459# (stored uncompressed, with no 'extra field') containing the file's MIME type. 3460# Check for have 8-byte name, 0-byte extra field, name "mimetype", and 3461# contents starting with "application/": 3462>26 string \x8\0\0\0mimetypeapplication/ 3463 3464# KOffice / OpenOffice & StarOffice / OpenDocument formats 3465# From: Abel Cheung <abel@oaka.org> 3466 3467# KOffice (1.2 or above) formats 3468# (mimetype contains "application/vnd.kde.<SUBTYPE>") 3469>>50 string vnd.kde. KOffice (>=1.2) 3470>>>58 string karbon Karbon document 3471>>>58 string kchart KChart document 3472>>>58 string kformula KFormula document 3473>>>58 string kivio Kivio document 3474>>>58 string kontour Kontour document 3475>>>58 string kpresenter KPresenter document 3476>>>58 string kspread KSpread document 3477>>>58 string kword KWord document 3478 3479# OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) 3480# (mimetype contains "application/vnd.sun.xml.<SUBTYPE>") 3481# URL: https://en.wikipedia.org/wiki/OpenOffice.org_XML 3482# reference: http://fileformats.archiveteam.org/wiki/OpenOffice.org_XML 3483>>50 string vnd.sun.xml. OpenOffice.org 1.x 3484>>>62 string writer Writer 3485>>>>68 byte !0x2e document 3486!:mime application/vnd.sun.xml.writer 3487!:ext sxw 3488>>>>68 string .template template 3489!:mime application/vnd.sun.xml.writer.template 3490!:ext stw 3491>>>>68 string .web Web template 3492!:mime application/vnd.sun.xml.writer.web 3493!:ext stw 3494>>>>68 string .global global document 3495!:mime application/vnd.sun.xml.writer.global 3496!:ext sxg 3497>>>62 string calc Calc 3498>>>>66 byte !0x2e spreadsheet 3499!:mime application/vnd.sun.xml.calc 3500!:ext sxc 3501>>>>66 string .template template 3502!:mime application/vnd.sun.xml.calc.template 3503!:ext stc 3504>>>62 string draw Draw 3505>>>>66 byte !0x2e document 3506!:mime application/vnd.sun.xml.draw 3507!:ext sxd 3508>>>>66 string .template template 3509!:mime application/vnd.sun.xml.draw.template 3510!:ext std 3511>>>62 string impress Impress 3512>>>>69 byte !0x2e presentation 3513!:mime application/vnd.sun.xml.impress 3514!:ext sxi 3515>>>>69 string .template template 3516!:mime application/vnd.sun.xml.impress.template 3517!:ext sti 3518>>>62 string math Math document 3519!:mime application/vnd.sun.xml.math 3520!:ext sxm 3521>>>62 string base Database file 3522!:mime application/vnd.sun.xml.base 3523!:ext sdb 3524 3525# OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) 3526# URL: http://fileformats.archiveteam.org/wiki/OpenDocument 3527# https://lists.oasis-open.org/archives/office/200505/msg00006.html 3528# (mimetype contains "application/vnd.oasis.opendocument.<SUBTYPE>") 3529>>50 string vnd.oasis.opendocument. OpenDocument 3530>>>73 string text 3531>>>>77 byte !0x2d Text 3532!:mime application/vnd.oasis.opendocument.text 3533!:ext odt 3534>>>>77 string -template Text Template 3535!:mime application/vnd.oasis.opendocument.text-template 3536!:ext ott 3537>>>>77 string -web HTML Document Template 3538!:mime application/vnd.oasis.opendocument.text-web 3539!:ext oth 3540>>>>77 string -master Master Document 3541!:mime application/vnd.oasis.opendocument.text-master 3542!:ext odm 3543>>>73 string graphics 3544>>>>81 byte !0x2d Drawing 3545!:mime application/vnd.oasis.opendocument.graphics 3546!:ext odg 3547>>>>81 string -template Drawing Template 3548!:mime application/vnd.oasis.opendocument.graphics-template 3549!:ext otg 3550>>>73 string presentation 3551>>>>85 byte !0x2d Presentation 3552!:mime application/vnd.oasis.opendocument.presentation 3553!:ext odp 3554>>>>85 string -template Presentation Template 3555!:mime application/vnd.oasis.opendocument.presentation-template 3556!:ext otp 3557>>>73 string spreadsheet 3558>>>>84 byte !0x2d Spreadsheet 3559!:mime application/vnd.oasis.opendocument.spreadsheet 3560!:ext ods 3561>>>>84 string -template Spreadsheet Template 3562!:mime application/vnd.oasis.opendocument.spreadsheet-template 3563!:ext ots 3564>>>73 string chart 3565>>>>78 byte !0x2d Chart 3566!:mime application/vnd.oasis.opendocument.chart 3567!:ext odc 3568>>>>78 string -template Chart Template 3569!:mime application/vnd.oasis.opendocument.chart-template 3570!:ext otc 3571>>>73 string formula 3572>>>>80 byte !0x2d Formula 3573!:mime application/vnd.oasis.opendocument.formula 3574!:ext odf 3575>>>>80 string -template Formula Template 3576!:mime application/vnd.oasis.opendocument.formula-template 3577!:ext otf 3578# https://www.loc.gov/preservation/digital/formats/fdd/fdd000441.shtml 3579>>>73 string database Database 3580!:mime application/vnd.oasis.opendocument.database 3581!:ext odb 3582# Valid for LibreOffice Base 6.0.1.1 at least 3583>>>73 string base Database 3584# https://bugs.documentfoundation.org/show_bug.cgi?id=45854 3585!:mime application/vnd.oasis.opendocument.database 3586#!:mime application/vnd.oasis.opendocument.base 3587!:ext odb 3588>>>73 string image 3589>>>>78 byte !0x2d Image 3590!:mime application/vnd.oasis.opendocument.image 3591!:ext odi 3592>>>>78 string -template Image Template 3593!:mime application/vnd.oasis.opendocument.image-template 3594!:ext oti 3595 3596# EPUB (OEBPS) books using OCF (OEBPS Container Format) 3597# https://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4. 3598# From: Ralf Brown <ralf.brown@gmail.com> 3599>>50 string epub+zip EPUB document 3600!:mime application/epub+zip 3601 3602# From: Joerg Jenderek 3603# URL: http://en.wikipedia.org/wiki/CorelDRAW 3604# NOTE: version; til 2 WL-based; from 3 til 13 by ./riff; from 14 zip based 3605>>50 string x-vnd.corel. Corel 3606>>>62 string draw.document+zip Draw drawing, version 14-16 3607!:mime application/x-vnd.corel.draw.document+zip 3608!:ext cdr 3609>>>62 string draw.template+zip Draw template, version 14-16 3610!:mime application/x-vnd.corel.draw.template+zip 3611!:ext cdrt 3612>>>62 string zcf.draw.document+zip Draw drawing, version 17-22 3613!:mime application/x-vnd.corel.zcf.draw.document+zip 3614!:ext cdr 3615>>>62 string zcf.draw.template+zip Draw template, version 17-22 3616!:mime application/x-vnd.corel.zcf.draw.template+zip 3617!:ext cdt/cdrt 3618# URL: http://product.corel.com/help/CorelDRAW/540240626/Main/EN/Doc/CorelDRAW-Other-file-formats.html 3619>>>62 string zcf.pattern+zip Draw pattern, version 22 3620!:mime application/x-vnd.corel.zcf.pattern+zip 3621!:ext pat 3622# URL: https://en.wikipedia.org/wiki/Corel_Designer 3623# Reference: http://fileformats.archiveteam.org/wiki/Corel_Designer 3624# Note: called by TrID "Corel DESIGN graphics" 3625>>>62 string designer.document+zip DESIGNER graphics, version 14-16 3626!:mime application/x-vnd.corel.designer.document+zip 3627!:ext des 3628>>>62 string zcf.designer.document+zip DESIGNER graphics, version 17-21 3629!:mime application/x-vnd.corel.zcf.designer.document+zip 3630!:ext des 3631# URL: http://product.corel.com/help/CorelDRAW/540223850/Main/EN/Documentation/ 3632# CorelDRAW-Corel-Symbol-Library-CSL.html 3633>>>62 string symbol.library+zip Symbol Library, version 6-16.3 3634!:mime application/x-vnd.corel.symbol.library+zip 3635!:ext csl 3636>>>62 string zcf.symbol.library+zip Symbol Library, version 17-22 3637!:mime application/x-vnd.corel.zcf.symbol.library+zip 3638!:ext csl 3639 3640# Catch other ZIP-with-mimetype formats 3641# In a ZIP file, the bytes immediately after a member's contents are 3642# always "PK". The 2 regex rules here print the "mimetype" member's 3643# contents up to the first 'P'. Luckily, most MIME types don't contain 3644# any capital 'P's. This is a kludge. 3645# (mimetype contains "application/<OTHER>") 3646>>50 default x Zip data 3647>>>38 regex [!-OQ-~]+ (MIME type "%s"?) 3648!:mime application/zip 3649# (mimetype contents other than "application/*") 3650>26 string \x8\0\0\0mimetype 3651>>38 string !application/ 3652>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?) 3653!:mime application/zip 3654 3655# Java Jar files 3656>(26.s+30) leshort 0xcafe Java archive data (JAR) 3657!:mime application/java-archive 3658 3659# iOS App 3660>(26.s+30) leshort !0xcafe 3661>>26 string !\x8\0\0\0mimetype 3662>>>30 string Payload/ 3663>>>>38 search/64 .app/ iOS App 3664!:mime application/x-ios-app 3665 3666>30 search/100/b application/epub+zip EPUB document 3667!:mime application/epub+zip 3668 3669# Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 3670# Next line excludes specialized formats: 3671>(26.s+30) leshort !0xcafe 3672>>30 search/100/b !application/epub+zip 3673>>>26 string !\x8\0\0\0mimetype Zip archive data 3674!:mime application/zip 3675>>>>4 beshort x \b, at least 3676>>>>4 use zipversion 3677>>>>4 beshort x to extract 3678>>>>0x161 string WINZIP \b, WinZIP self-extracting 3679 3680# StarView Metafile 3681# From Pierre Ducroquet <pinaraf@pinaraf.info> 36820 string VCLMTF StarView MetaFile 3683>6 beshort x \b, version %d 3684>8 belong x \b, size %d 3685 3686# Zoo archiver 368720 lelong 0xfdc4a7dc Zoo archive data 3688!:mime application/x-zoo 3689>4 byte >48 \b, v%c. 3690>>6 byte >47 \b%c 3691>>>7 byte >47 \b%c 3692>32 byte >0 \b, modify: v%d 3693>>33 byte x \b.%d+ 3694>42 lelong 0xfdc4a7dc \b, 3695>>70 byte >0 extract: v%d 3696>>>71 byte x \b.%d+ 3697 3698# Shell archives 369910 string #\ This\ is\ a\ shell\ archive shell archive text 3700!:mime application/octet-stream 3701 3702# 3703# LBR. NB: May conflict with the questionable 3704# "binary Computer Graphics Metafile" format. 3705# 37060 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data 3707# 3708# PMA (CP/M derivative of LHA) 3709# Update: Joerg Jenderek 3710# URL: https://en.wikipedia.org/wiki/LHA_(file_format) 3711# 3712#2 string -pm0- PMarc archive data [pm0] 37132 string -pm0- 3714>0 use lharc-file 3715#2 string -pm1- PMarc archive data [pm1] 37162 string -pm1- 3717>0 use lharc-file 3718#2 string -pm2- PMarc archive data [pm2] 37192 string -pm2- 3720>0 use lharc-file 37212 string -pms- PMarc SFX archive (CP/M, DOS) 3722#!:mime application/x-foobar-exec 3723!:ext com 37245 string -pc1- PopCom compressed executable (CP/M) 3725#!:mime application/x- 3726#!:ext com 3727 3728# From Rafael Laboissiere <rafael@laboissiere.net> 3729# The Project Revision Control System (see 3730# http://prcs.sourceforge.net) generates a packaged project 3731# file which is recognized by the following entry: 37320 leshort 0xeb81 PRCS packaged project 3733 3734# Microsoft cabinets 3735# by David Necas (Yeti) <yeti@physics.muni.cz> 3736#0 string MSCF\0\0\0\0 Microsoft cabinet file data, 3737#>25 byte x v%d 3738#>24 byte x \b.%d 3739# MPi: All CABs have version 1.3, so this is pointless. 3740# Better magic in debian-additions. 3741 3742# GTKtalog catalogs 3743# by David Necas (Yeti) <yeti@physics.muni.cz> 37444 string gtktalog\ GTKtalog catalog data, 3745>13 string 3 version 3 3746>>14 beshort 0x677a (gzipped) 3747>>14 beshort !0x677a (not gzipped) 3748>13 string >3 version %s 3749 3750############################################################################ 3751# Parity archive reconstruction file, the 'par' file format now used on Usenet. 37520 string PAR\0 PARity archive data 3753>48 leshort =0 - Index file 3754>48 leshort >0 - file number %d 3755 3756# Felix von Leitner <felix-file@fefe.de> 37570 string d8:announce BitTorrent file 3758!:mime application/x-bittorrent 3759# Durval Menezes, <jmgthbfile at durval dot com> 37600 string d13:announce-list BitTorrent file 3761!:mime application/x-bittorrent 37620 string d7:comment BitTorrent file 3763!:mime application/x-bittorrent 37640 string d4:info BitTorrent file 3765!:mime application/x-bittorrent 3766 3767# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi> 37680 beshort 0x0e0f Atari MSA archive data 3769>2 beshort x \b, %d sectors per track 3770>4 beshort 0 \b, 1 sided 3771>4 beshort 1 \b, 2 sided 3772>6 beshort x \b, starting track: %d 3773>8 beshort x \b, ending track: %d 3774 3775# Alternate ZIP string (amc@arwen.cs.berkeley.edu) 37760 string PK00PK\003\004 Zip archive data 3777!:mime application/zip 3778!:ext zip/cbz 3779 3780# ACE archive (from http://www.wotsit.org/download.asp?f=ace) 3781# by Stefan `Sec` Zehl <sec@42.org> 37827 string **ACE** ACE archive data 3783>15 byte >0 version %d 3784>16 byte =0x00 \b, from MS-DOS 3785>16 byte =0x01 \b, from OS/2 3786>16 byte =0x02 \b, from Win/32 3787>16 byte =0x03 \b, from Unix 3788>16 byte =0x04 \b, from MacOS 3789>16 byte =0x05 \b, from WinNT 3790>16 byte =0x06 \b, from Primos 3791>16 byte =0x07 \b, from AppleGS 3792>16 byte =0x08 \b, from Atari 3793>16 byte =0x09 \b, from Vax/VMS 3794>16 byte =0x0A \b, from Amiga 3795>16 byte =0x0B \b, from Next 3796>14 byte x \b, version %d to extract 3797>5 leshort &0x0080 \b, multiple volumes, 3798>>17 byte x \b (part %d), 3799>5 leshort &0x0002 \b, contains comment 3800>5 leshort &0x0200 \b, sfx 3801>5 leshort &0x0400 \b, small dictionary 3802>5 leshort &0x0800 \b, multi-volume 3803>5 leshort &0x1000 \b, contains AV-String 3804>>30 string \x16*UNREGISTERED\x20VERSION* (unregistered) 3805>5 leshort &0x2000 \b, with recovery record 3806>5 leshort &0x4000 \b, locked 3807>5 leshort &0x8000 \b, solid 3808# Date in MS-DOS format (whatever that is) 3809#>18 lelong x Created on 3810 3811# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann 3812# <doj@cubic.org> 38130x1A string sfArk sfArk compressed Soundfont 3814>0x15 string 2 3815>>0x1 string >\0 Version %s 3816>>0x2A string >\0 : %s 3817 3818# DR-DOS 7.03 Packed File *.??_ 38190 string Packed\ File\ Personal NetWare Packed File 3820>12 string x \b, was "%.12s" 3821 3822# EET archive 3823# From: Tilman Sauerbeck <tilman@code-monkey.de> 38240 belong 0x1ee7ff00 EET archive 3825!:mime application/x-eet 3826 3827# rzip archives 38280 string RZIP rzip compressed data 3829>4 byte x - version %d 3830>5 byte x \b.%d 3831>6 belong x (%d bytes) 3832 3833# From: Joerg Jenderek 3834# URL: https://help.foxitsoftware.com/kb/install-fzip-file.php 3835# reference: http://mark0.net/download/triddefs_xml.7z/ 3836# defs/f/fzip.trid.xml 3837# Note: unknown compression; No "PK" zip magic; normally in directory like 3838# "%APPDATA%\Foxit Software\Addon\Foxit Reader\Install" 38390 ubequad 0x2506781901010000 Foxit add-on/update 3840!:mime application/x-fzip 3841!:ext fzip 3842 3843# From: "Robert Dale" <robdale@gmail.com> 38440 belong 123 dar archive, 3845>4 belong x label "%.8x 3846>>8 belong x %.8x 3847>>>12 beshort x %.4x" 3848>14 byte 0x54 end slice 3849>14 beshort 0x4e4e multi-part 3850>14 beshort 0x4e53 multi-part, with -S 3851 3852# Symbian installation files 3853# https://www.thouky.co.uk/software/psifs/sis.html 3854# http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf 38558 lelong 0x10000419 Symbian installation file 3856!:mime application/vnd.symbian.install 3857>4 lelong 0x1000006D (EPOC release 3/4/5) 3858>4 lelong 0x10003A12 (EPOC release 6) 38590 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x) 3860!:mime x-epoc/x-sisx-app 3861 3862# From "Nelson A. de Oliveira" <naoliv@gmail.com> 38630 string MPQ\032 MoPaQ (MPQ) archive 3864 3865# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 3866# .kgb 38670 string KGB_arch KGB Archiver file 3868>10 string x with compression level %.1s 3869 3870# xar (eXtensible ARchiver) archive 3871# URL: https://en.wikipedia.org/wiki/Xar_(archiver) 3872# xar archive format: https://code.google.com/p/xar/ 3873# From: "David Remahl" <dremahl@apple.com> 3874# Update: Joerg Jenderek 3875# TODO: lzma compression; X509Data for pkg and xip 3876# Note: verified by `xar --dump-header -f FullBundleUpdate.xar` or 3877# 7z t -txar Xcode_10.2_beta_4.xip` 38780 string xar! xar archive 3879!:mime application/x-xar 3880# pkg for Mac OSX installer package like FullBundleUpdate.pkg 3881# xip for signed Apple software like Xcode_10.2_beta_4.xip 3882!:ext xar/pkg/xip 3883# always 28 in older archives 3884>4 ubeshort >28 \b, header size %u 3885# currently there exit only version 1 since about 2014 3886>6 ubeshort >1 version %u, 3887>8 ubequad x compressed TOC: %llu, 3888#>16 ubequad x uncompressed TOC: %llu, 3889# cksum_alg 0-2 in older and also 3-4 in newer 3890>24 belong 0 no checksum 3891>24 belong 1 SHA-1 checksum 3892>24 belong 2 MD5 checksum 3893>24 belong 3 SHA-256 checksum 3894>24 belong 4 SHA-512 checksum 3895>24 belong >4 unknown 0x%x checksum 3896#>24 belong >4 checksum 3897# For no compression jump 0 bytes 3898>24 belong 0 3899>>0 ubyte x 3900# jump more bytes forward by header size 3901>>>&(4.S) ubyte x 3902# jump more bytes forward by compressed table of contents size 3903#>>>>&(8.Q) ubequad x \b, heap data 0x%llx 3904>>>>&(8.Q) ubyte x 3905# look for data by ./compress after message with 1 space at end 3906>>>>>&-3 indirect x \b, contains 3907# For SHA-1 jump 20 minus 2 bytes 3908>24 belong 1 3909>>18 ubyte x 3910# jump more bytes forward by header size 3911>>>&(4.S) ubyte x 3912# jump more bytes forward by compressed table of contents size 3913>>>>&(8.Q) ubyte x 3914# data compressed by gzip, bzip, lzma or none 3915>>>>>&-1 indirect x \b, contains 3916# For SHA-256 jump 32 minus 2 bytes 3917>24 belong 3 3918>>30 ubyte x 3919# jump more bytes forward by header size 3920>>>&(4.S) ubyte x 3921# jump more bytes forward by compressed table of contents size 3922>>>>&(8.Q) ubyte x 3923>>>>>&-1 indirect x \b, contains 3924# For SHA-512 jump 64 minus 2 bytes 3925>24 belong 4 3926>>62 ubyte x 3927# jump more bytes forward by header size 3928>>>&(4.S) ubyte x 3929# jump more bytes forward by compressed table of contents size 3930>>>>&(8.Q) ubyte x 3931>>>>>&-1 indirect x \b, contains 3932 3933# Type: Parity Archive 3934# From: Daniel van Eeden <daniel_e@dds.nl> 39350 string PAR2 Parity Archive Volume Set 3936 3937# Bacula volume format. (Volumes always start with a block header.) 3938# URL: https://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html 3939# From: Adam Buchbinder <adam.buchbinder@gmail.com> 394012 string BB02 Bacula volume 3941>20 bedate x \b, started %s 3942 3943# ePub is XHTML + XML inside a ZIP archive. The first member of the 3944# archive must be an uncompressed file called 'mimetype' with contents 3945# 'application/epub+zip' 3946 3947 3948# From: "Michael Gorny" <mgorny@gentoo.org> 3949# ZPAQ: http://mattmahoney.net/dc/zpaq.html 39500 string zPQ ZPAQ stream 3951>3 byte x \b, level %d 3952# From: Barry Carter <carter.barry@gmail.com> 3953# https://encode.ru/threads/456-zpaq-updates/page32 39540 string 7kSt ZPAQ file 3955 3956# BBeB ebook, unencrypted (LRF format) 3957# URL: https://www.sven.de/librie/Librie/LrfFormat 3958# From: Adam Buchbinder <adam.buchbinder@gmail.com> 39590 string L\0R\0F\0\0\0 BBeB ebook data, unencrypted 3960>8 beshort x \b, version %d 3961>36 byte 1 \b, front-to-back 3962>36 byte 16 \b, back-to-front 3963>42 beshort x \b, (%dx, 3964>44 beshort x %d) 3965 3966# Symantec GHOST image by Joerg Jenderek at May 2014 3967# https://us.norton.com/ghost/ 3968# https://www.garykessler.net/library/file_sigs.html 39690 ubelong&0xFFFFf7f0 0xFEEF0100 Norton GHost image 3970# *.GHO 3971>2 ubyte&0x08 0x00 \b, first file 3972# *.GHS or *.[0-9] with cns program option 3973>2 ubyte&0x08 0x08 \b, split file 3974# part of split index interesting for *.ghs 3975>>4 ubyte x id=0x%x 3976# compression tag minus one equals numeric compression command line switch z[1-9] 3977>3 ubyte 0 \b, no compression 3978>3 ubyte 2 \b, fast compression (Z1) 3979>3 ubyte 3 \b, medium compression (Z2) 3980>3 ubyte >3 3981>>3 ubyte <11 \b, compression (Z%d-1) 3982>2 ubyte&0x08 0x00 3983# ~ 30 byte password field only for *.gho 3984>>12 ubequad !0 \b, password protected 3985>>44 ubyte !1 3986# 1~Image All, sector-by-sector only for *.gho 3987>>>10 ubyte 1 \b, sector copy 3988# 1~Image Boot track only for *.gho 3989>>>43 ubyte 1 \b, boot track 3990# 1~Image Disc only for *.gho implies Image Boot track and sector copy 3991>>44 ubyte 1 \b, disc sector copy 3992# optional image description only *.gho 3993>>0xff string >\0 "%-.254s" 3994# look for DOS sector end sequence 3995>0xE08 search/7776 \x55\xAA 3996>>&-512 indirect x \b; contains 3997 3998# Google Chrome extensions 3999# https://developer.chrome.com/extensions/crx 4000# https://developer.chrome.com/extensions/hosting 40010 string Cr24 Google Chrome extension 4002!:mime application/x-chrome-extension 4003>4 ulong x \b, version %u 4004 4005# SeqBox - Sequenced container 4006# ext: sbx, seqbox 4007# Marco Pontello marcopon@gmail.com 4008# reference: https://github.com/MarcoPon/SeqBox 40090 string SBx SeqBox, 4010>3 byte x version %d 4011 4012# LyNX archive 401356 string USE\040LYNX\040TO\040DISSOLVE\040THIS\040FILE LyNX archive 4014 4015# From: Joerg Jenderek 4016# URL: https://www.acronis.com/ 4017# Reference: https://en.wikipedia.org/wiki/TIB_(file_format) 4018# Note: only tested with True Image 2013 Build 5962 and 2019 Build 14110 40190 ubequad 0xce24b9a220000000 Acronis True Image backup 4020!:mime application/x-acronis-tib 4021!:ext tib 4022# 01000000 4023#>20 ubelong x \b, at 20 0x%x 4024# 20000000 4025#>28 ubelong x \b, at 28 0x%x 4026# strings like "Generic- SD/MMC 1.00" "Unknown Disk" "Msft Virtual Disk 1.0" 4027# ??? 4028# strings like "\Device\0000011e" "\Device\0000015a" 4029#>0 search/0x6852300/cs \\Device\\ 4030#>>&-1 pstring x \b, %s 4031# "\Device\HarddiskVolume30" "\Device\HarddiskVolume39" 4032#>>>&1 search/180/cs \\Device\\ 4033#>>>>&-1 pstring x \b, %s 4034#>>>>>&0 search/29/cs \0\0\xc8\0 4035# disk label 4036#>>>>>>&10 lestring16 x \b, disk label %11.11s 4037#>>>>>>&9 plestring16 x \b, disk label "%11.11s" 4038#>>>>>>&10 ubequad x %16.16llx 4039 4040 4041# Gentoo XPAK binary package 4042# by Michal Gorny <mgorny@gentoo.org> 4043# https://gitweb.gentoo.org/proj/portage.git/tree/man/xpak.5 4044-4 string STOP 4045>-16 string XPAKSTOP Gentoo binary package (XPAK) 4046 4047# From: Joerg Jenderek 4048# URL: https://kodi.wiki/view/TexturePacker 4049# Reference: https://mirrors.kodi.tv/releases/source/17.3-Krypton.tar.gz 4050# /xbmc-Krypton/xbmc/guilib/XBTF.h 4051# /xbmc-Krypton/xbmc/guilib/XBTF.cpp 40520 string XBTF 4053# skip ASCII text by looking for terminating \0 of path 4054>264 ubyte 0 XBMC texture package 4055!:mime application/x-xbmc-xbt 4056!:ext xbt 4057# XBTF_VERSION 2 4058>>4 string !2 \b, version %-.1s 4059# nofFiles /xbmc-Krypton/xbmc/guilib/XBTFReader.cpp 4060>>5 ulelong x \b, %u file 4061# plural s 4062>>5 ulelong >1 \bs 4063# path[CXBTFFile[MaximumPathLength=256] 4064>>9 string x \b, 1st %s 4065 4066 4067#------------------------------------------------------------------------------ 4068# $File: asf,v 1.1 2019/12/26 02:07:53 christos Exp $ 4069# asf: file(1) magic for Microsoft Advanced Systems Format (ASF) files 4070# http://www.staroceans.org/e-book/ASF_Specification.pdf 4071 40720 name asf-name 4073# ASF_Data_Object 4074#>0 guid 75B22636-668E-11CF-A6D9-00AA0062CE6C 4075#>16 lequad >0 4076#>>(16.q) use asf-object 4077# ASF_Simple_Index_Object 4078>0 guid 33000890-E5B1-11CF-89F4-00A0C90349CB 4079>0 guid D6E229D3-35DA-11D1-9034-00A0C90349BE ASF_Index_Object 4080>0 guid FEB103F8-12AD-4C64-840F-2A1D2F7AD48C ASF_Media_Object_Index_Object 4081>0 guid 3CB73FD0-0C4A-4803-953D-EDF7B6228F0C ASF_Timecode_Index_Object 4082 4083# ASF_File_Properties_Object 4084>0 guid 8CABDCA1-A947-11CF-8EE4-00C00C205365 4085 4086# ASF_Stream_Properties_Object 4087>0 guid B7DC0791-A9B7-11CF-8EE6-00C00C205365 4088#>>56 lequad x Time Offset %lld 4089#>>64 lelong x Type-Specicic Data Length %d 4090#>>68 lelong x Error Correction Data Length %d 4091#>>72 leshort x Flags 0x%x 4092#>>74 lelong x Reserved %x 4093# ASF_Audio_Media 4094>>24 guid F8699E40-5B4D-11CF-A8FD-00805F5C442B \b, Audio Media ( 4095>>>78 leshort x \bCodec Id %d 4096>>>80 leshort x \b, Number of channels %d 4097>>>82 lelong x \b, Samples Per Second %d 4098>>>86 lelong x \b, Average Number of Bytes Per Second %d 4099>>>90 lelong x \b, Block Alignment %d 4100>>>94 leshort x \b, Bits Per Sample %d 4101# ASF_Video_Media 4102>>24 guid BC19EFC0-5B4D-11CF-A8FD-00805F5C442B \b, Video Media ( 4103>>>78 lelong x \bEncoded Image Width %d 4104>>>82 lelong x \b, Encoded Image Height %d 4105#>>>85 leshort x \b, Format Data Size %x 4106>>>93 lelong x \b, Image Width %d 4107>>>97 lelong x \b, Image Height %d 4108#>>>101 leshort x \b, Reserved 0x%x 4109>>>103 leshort x \b, Bits Per Pixel Count %d 4110#>>>105 lelong x \b, Compression ID %d 4111#>>>109 lelong x \b, Image Size %d 4112#>>>113 lelong x \b, Horizontal Pixels Per Meter %d 4113#>>>117 lelong x \b, Vertical Pixels Per Meter %d 4114#>>>121 lelong x \b, Colors Used Count %d 4115#>>>125 lelong x \b, Important Colors Count %d 4116>>0 lelong x \b, Error correction type 4117>>40 use asf-name 4118>>0 lelong x \b) 4119#ASF_Header_Extension_Object 4120>0 guid 5FBF03B5-A92E-11CF-8EE3-00C00C205365 4121# ASF_Codec_List_Object 4122>0 guid 86D15240-311D-11D0-A3A4-00A0C90348F6 4123>0 guid 1EFB1A30-0B62-11D0-A39B-00A0C90348F6 ASF_Script_Command_Object 4124>0 guid F487CD01-A951-11CF-8EE6-00C00C205365 ASF_Marker_Object 4125>0 guid D6E229DC-35DA-11D1-9034-00A0C90349BE ASF_Bitrate_Mutual_Exclusion_Object 4126>0 guid 75B22635-668E-11CF-A6D9-00AA0062CE6C ASF_Error_Correction_Object 4127# ASF_Content_Description_Object 4128>0 guid 75B22633-668E-11CF-A6D9-00AA0062CE6C 4129#>>24 leshort title length %d 4130#>>26 leshort author length %d 4131#>>28 leshort copyright length %d 4132#>>30 leshort descriptor length %d 4133#>>32 leshort rating length %d 4134>0 guid D2D0A440-E307-11D2-97F0-00A0C95EA850 ASF_Extended_Content_Description_Object 4135>0 guid 2211B3FA-BD23-11D2-B4B7-00A0C955FC6E ASF_Content_Branding_Object 4136>0 guid 7BF875CE-468D-11D1-8D82-006097C9A2B2 ASF_Stream_Bitrate_Properties_Object 4137>0 guid 2211B3FB-BD23-11D2-B4B7-00A0C955FC6E ASF_Content_Encryption_Object 4138>0 guid 298AE614-2622-4C17-B935-DAE07EE9289C ASF_Extended_Content_Encryption_Object 4139>0 guid 2211B3FC-BD23-11D2-B4B7-00A0C955FC6E ASF_Digital_Signature_Object 4140# ASF_Padding_Object 4141>0 guid 1806D474-CADF-4509-A4BA-9AABCB96AAE8 4142>0 guid 14E6A5CB-C672-4332-8399-A96952065B5A ASF_Extended_Stream_Properties_Object 4143>0 guid A08649CF-4775-4670-8A16-6E35357566CD ASF_Advanced_Mutual_Exclusion_Object 4144>0 guid D1465A40-5A79-4338-B71B-E36B8FD6C249 ASF_Group_Mutual_Exclusion_Object 4145>0 guid D4FED15B-88D3-454F-81F0-ED5C45999E24 ASF_Stream_Prioritization_Object 4146>0 guid A69609E6-517B-11D2-B6AF-00C04FD908E9 ASF_Bandwidth_Sharing_Object 4147>0 guid 7C4346A9-EFE0-4BFC-B229-393EDE415C85 ASF_Language_List_Object 4148>0 guid C5F8CBEA-5BAF-4877-8467-AA8C44FA4CCA ASF_Metadata_Object 4149>0 guid 44231C94-9498-49D1-A141-1D134E457054 ASF_Metadata_Library_Object 4150>0 guid D6E229DF-35DA-11D1-9034-00A0C90349BE ASF_Index_Parameters_Object 4151>0 guid 6B203BAD-3F11-48E4-ACA8-D7613DE2CFA7 ASF_Media_Object_Index_Parameters_Object 4152>0 guid F55E496D-9797-4B5D-8C8B-604DFE9BFB24 ASF_Timecode_Index_Parameters_Object 4153>0 guid 26F18B5D-4584-47EC-9F5F-0E651F0452C9 ASF_Compatibility_Object 4154>0 guid 43058533-6981-49E6-9B74-AD12CB86D58C ASF_Advanced_Content_Encryption_Object 4155>0 guid 59DACFC0-59E6-11D0-A3AC-00A0C90348F6 ASF_Command_Media 4156>0 guid B61BE100-5B4E-11CF-A8FD-00805F5C44 ASF_JFIF_Media 4157>0 guid 35907DE0-E415-11CF-A917-00805F5C442B ASF_Degradable_JPEG_Media 4158>0 guid 91BD222C-F21C-497A-8B6D-5AA86BFC0185 ASF_File_Transfer_Media 4159>0 guid 3AFB65E2-47EF-40F2-AC2C-70A90D71D343 ASF_Binary_Media 4160>0 guid 776257D4-C627-41CB-8F81-7AC7FF1C40CC ASF_Web_Stream_Media_Subtype 4161>0 guid DA1E6B13-8359-4050-B398-388E965BF00C ASF_Web_Stream_Format 4162>0 guid 20FB5700-5B55-11CF-A8FD-00805F5C442B ASF_No_Error_Correction 4163>0 guid BFC3CD50-618F-11CF-8BB2-00AA00B4E220 ASF_Audio_Spread 4164>0 guid ABD3D211-A9BA-11cf-8EE6-00C00C205365 ASF_Reserved_1 4165>0 guid 7A079BB6-DAA4-4e12-A5CA-91D38DC11A8D ASF_Content_Encryption_System_Windows_Media_DRM 4166# _Network_Devices 4167>0 guid 86D15241-311D-11D0-A3A4-00A0C90348F6 ASF_Reserved_2 4168>0 guid 4B1ACBE3-100B-11D0-A39B-00A0C90348F6 ASF_Reserved_3 4169>0 guid 4CFEDB20-75F6-11CF-9C0F-00A0C90349CB ASF_Reserved_4 4170>0 guid D6E22A00-35DA-11D1-9034-00A0C90349BE ASF_Mutex_Language 4171>0 guid D6E22A01-35DA-11D1-9034-00A0C90349BE ASF_Mutex_Bitrate 4172>0 guid D6E22A02-35DA-11D1-9034-00A0C90349BE ASF_Mutex_Unknown 4173>0 guid AF6060AA-5197-11D2-B6AF-00C04FD908E9 ASF_Bandwidth_Sharing_Exclusive 4174>0 guid AF6060AB-5197-11D2-B6AF-00C04FD908E9 ASF_Bandwidth_Sharing_Partial 4175>0 guid 399595EC-8667-4E2D-8FDB-98814CE76C1E ASF_Payload_Extension_System_Timecode 4176>0 guid E165EC0E-19ED-45D7-B4A7-25CBD1E28E9B ASF_Payload_Extension_System_File_Name 4177>0 guid D590DC20-07BC-436C-9CF7-F3BBFBF1A4DC ASF_Payload_Extension_System_Content_Type 4178>0 guid 1B1EE554-F9EA-4BC8-821A-376B74E4C4B8 ASF_Payload_Extension_System_Pixel_Aspect_Ratio 4179>0 guid C6BD9450-867F-4907-83A3-C77921B733AD ASF_Payload_Extension_System_Sample_Duration 4180>0 guid 6698B84E-0AFA-4330-AEB2-1C0A98D7A44D ASF_Payload_Extension_System_Encryption_Sample_ID 4181>0 guid 00E1AF06-7BEC-11D1-A582-00C04FC29CFB ASF_Payload_Extension_System_Degradable_JPEG 4182 41830 name asf-object 4184>0 use asf-name 4185#>>16 lequad >0 (size %lld) [ 4186>>16 lequad >0 4187>>>(16.q) use asf-object 4188#>>16 lequad 0 ] 4189 4190# Microsoft Advanced Streaming Format (ASF) <mpruett@sgi.com> 41910 guid 75B22630-668E-11CF-A6D9-00AA0062CE6C Microsoft ASF 4192!:mime video/x-ms-asf 4193#>16 lequad >0 (size %lld 4194#>>24 lelong x \b, %d header objects) 4195>16 lequad >0 4196>>30 use asf-object 4197>>(16.q) use asf-object 4198#------------------------------------------------------------------------------ 4199# $File: assembler,v 1.6 2013/12/11 14:14:20 christos Exp $ 4200# make: file(1) magic for assembler source 4201# 42020 regex \^[\040\t]{0,50}\\.asciiz assembler source text 4203!:mime text/x-asm 42040 regex \^[\040\t]{0,50}\\.byte assembler source text 4205!:mime text/x-asm 42060 regex \^[\040\t]{0,50}\\.even assembler source text 4207!:mime text/x-asm 42080 regex \^[\040\t]{0,50}\\.globl assembler source text 4209!:mime text/x-asm 42100 regex \^[\040\t]{0,50}\\.text assembler source text 4211!:mime text/x-asm 42120 regex \^[\040\t]{0,50}\\.file assembler source text 4213!:mime text/x-asm 42140 regex \^[\040\t]{0,50}\\.type assembler source text 4215!:mime text/x-asm 4216 4217#------------------------------------------------------------------------------ 4218# $File: asterix,v 1.5 2009/09/19 16:28:08 christos Exp $ 4219# asterix: file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character 4220# strings as "long" - we assume they're just strings: 4221# From: guy@netapp.com (Guy Harris) 4222# 42230 string *STA Aster*x 4224>7 string WORD Words Document 4225>7 string GRAP Graphic 4226>7 string SPRE Spreadsheet 4227>7 string MACR Macro 42280 string 2278 Aster*x Version 2 4229>29 byte 0x36 Words Document 4230>29 byte 0x35 Graphic 4231>29 byte 0x32 Spreadsheet 4232>29 byte 0x38 Macro 4233 4234 4235#------------------------------------------------------------------------------ 4236# $File: att3b,v 1.10 2017/03/17 21:35:28 christos Exp $ 4237# att3b: file(1) magic for AT&T 3B machines 4238# 4239# The `versions' should be un-commented if they work for you. 4240# (Was the problem just one of endianness?) 4241# 4242# 3B20 4243# 4244# The 3B20 conflicts with SCCS. 4245#0 beshort 0550 3b20 COFF executable 4246#>12 belong >0 not stripped 4247#>22 beshort >0 - version %d 4248#0 beshort 0551 3b20 COFF executable (TV) 4249#>12 belong >0 not stripped 4250#>22 beshort >0 - version %d 4251# 4252# WE32K 4253# 42540 beshort 0560 WE32000 COFF 4255>18 beshort ^00000020 object 4256>18 beshort &00000020 executable 4257>12 belong >0 not stripped 4258>18 beshort ^00010000 N/A on 3b2/300 w/paging 4259>18 beshort &00020000 32100 required 4260>18 beshort &00040000 and MAU hardware required 4261>20 beshort 0407 (impure) 4262>20 beshort 0410 (pure) 4263>20 beshort 0413 (demand paged) 4264>20 beshort 0443 (target shared library) 4265>22 beshort >0 - version %d 42660 beshort 0561 WE32000 COFF executable (TV) 4267>12 belong >0 not stripped 4268#>18 beshort &00020000 - 32100 required 4269#>18 beshort &00040000 and MAU hardware required 4270#>22 beshort >0 - version %d 4271# 4272# core file for 3b2 42730 string \000\004\036\212\200 3b2 core file 4274>364 string >\0 of '%s' 4275 4276#------------------------------------------------------------------------------ 4277# $File: audio,v 1.118 2019/11/19 05:30:07 christos Exp $ 4278# audio: file(1) magic for sound formats (see also "iff") 4279# 4280# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com), 4281# and others 4282# 4283 4284# Sun/NeXT audio data 42850 string .snd Sun/NeXT audio data: 4286>12 belong 1 8-bit ISDN mu-law, 4287!:mime audio/basic 4288>12 belong 2 8-bit linear PCM [REF-PCM], 4289!:mime audio/basic 4290>12 belong 3 16-bit linear PCM, 4291!:mime audio/basic 4292>12 belong 4 24-bit linear PCM, 4293!:mime audio/basic 4294>12 belong 5 32-bit linear PCM, 4295!:mime audio/basic 4296>12 belong 6 32-bit IEEE floating point, 4297!:mime audio/basic 4298>12 belong 7 64-bit IEEE floating point, 4299!:mime audio/basic 4300>12 belong 8 Fragmented sample data, 4301>12 belong 10 DSP program, 4302>12 belong 11 8-bit fixed point, 4303>12 belong 12 16-bit fixed point, 4304>12 belong 13 24-bit fixed point, 4305>12 belong 14 32-bit fixed point, 4306>12 belong 18 16-bit linear with emphasis, 4307>12 belong 19 16-bit linear compressed, 4308>12 belong 20 16-bit linear with emphasis and compression, 4309>12 belong 21 Music kit DSP commands, 4310>12 belong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.), 4311!:mime audio/x-adpcm 4312>12 belong 24 compressed (8-bit CCITT G.722 ADPCM) 4313>12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), 4314>12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), 4315>12 belong 27 8-bit A-law (CCITT G.711), 4316>20 belong 1 mono, 4317>20 belong 2 stereo, 4318>20 belong 4 quad, 4319>16 belong >0 %d Hz 4320 4321# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format 4322# that uses little-endian encoding and has a different magic number 43230 lelong 0x0064732E DEC audio data: 4324>12 lelong 1 8-bit ISDN mu-law, 4325!:mime audio/x-dec-basic 4326>12 lelong 2 8-bit linear PCM [REF-PCM], 4327!:mime audio/x-dec-basic 4328>12 lelong 3 16-bit linear PCM, 4329!:mime audio/x-dec-basic 4330>12 lelong 4 24-bit linear PCM, 4331!:mime audio/x-dec-basic 4332>12 lelong 5 32-bit linear PCM, 4333!:mime audio/x-dec-basic 4334>12 lelong 6 32-bit IEEE floating point, 4335!:mime audio/x-dec-basic 4336>12 lelong 7 64-bit IEEE floating point, 4337!:mime audio/x-dec-basic 4338>12 belong 8 Fragmented sample data, 4339>12 belong 10 DSP program, 4340>12 belong 11 8-bit fixed point, 4341>12 belong 12 16-bit fixed point, 4342>12 belong 13 24-bit fixed point, 4343>12 belong 14 32-bit fixed point, 4344>12 belong 18 16-bit linear with emphasis, 4345>12 belong 19 16-bit linear compressed, 4346>12 belong 20 16-bit linear with emphasis and compression, 4347>12 belong 21 Music kit DSP commands, 4348>12 lelong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.), 4349!:mime audio/x-dec-basic 4350>12 belong 24 compressed (8-bit CCITT G.722 ADPCM) 4351>12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), 4352>12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), 4353>12 belong 27 8-bit A-law (CCITT G.711), 4354>20 lelong 1 mono, 4355>20 lelong 2 stereo, 4356>20 lelong 4 quad, 4357>16 lelong >0 %d Hz 4358 4359# Creative Labs AUDIO stuff 43600 string MThd Standard MIDI data 4361!:mime audio/midi 4362>8 beshort x (format %d) 4363>10 beshort x using %d track 4364>10 beshort >1 \bs 4365>12 beshort&0x7fff x at 1/%d 4366>12 beshort&0x8000 >0 SMPTE 4367 43680 string CTMF Creative Music (CMF) data 4369!:mime audio/x-unknown 43700 string SBI SoundBlaster instrument data 4371!:mime audio/x-unknown 43720 string Creative\ Voice\ File Creative Labs voice data 4373!:mime audio/x-unknown 4374# is this next line right? it came this way... 4375>19 byte 0x1A 4376>23 byte >0 - version %d 4377>22 byte >0 \b.%d 4378 4379# first entry is also the string "NTRK" 43800 belong 0x4e54524b MultiTrack sound data 4381>4 belong x - version %d 4382 4383# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED 4384# [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi] 43850 string EMOD Extended MOD sound data, 4386>4 byte&0xf0 x version %d 4387>4 byte&0x0f x \b.%d, 4388>45 byte x %d instruments 4389>83 byte 0 (module) 4390>83 byte 1 (song) 4391 4392# Real Audio (Magic .ra\0375) 43930 belong 0x2e7261fd RealAudio sound file 4394!:mime audio/x-pn-realaudio 43950 string .RMF\0\0\0 RealMedia file 4396!:mime application/vnd.rn-realmedia 4397#video/x-pn-realvideo 4398#video/vnd.rn-realvideo 4399#application/vnd.rn-realmedia 4400# sigh, there are many mimes for that but the above are the most common. 4401 4402# MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net] 4403# Oct 31, 1995 4404# fixed by <doj@cubic.org> 2003-06-24 4405# Too short... 4406#0 string MTM MultiTracker Module sound file 4407#0 string if Composer 669 Module sound data 4408#0 string JN Composer 669 Module sound data (extended format) 44090 string MAS_U ULT(imate) Module sound data 4410 4411#0 string FAR Module sound data 4412#>4 string >\15 Title: "%s" 4413 44140x2c string SCRM ScreamTracker III Module sound data 4415>0 string >\0 Title: "%s" 4416!:mime audio/x-s3m 4417 4418# .stm before it got above .s3m extension 44190x16 string \!Scream\! ScreamTracker Module sound data 4420>0 string >\0 Title: "%s" 4421 4422# Gravis UltraSound patches 4423# From <ache@nagual.ru> 4424 44250 string GF1PATCH110\0ID#000002\0 GUS patch 44260 string GF1PATCH100\0ID#000002\0 Old GUS patch 4427 4428# mime types according to http://www.geocities.com/nevilo/mod.htm: 4429# audio/it .it 4430# audio/x-zipped-it .itz 4431# audio/xm fasttracker modules 4432# audio/x-s3m screamtracker modules 4433# audio/s3m screamtracker modules 4434# audio/x-zipped-mod mdz 4435# audio/mod mod 4436# audio/x-mod All modules (mod, s3m, 669, mtm, med, xm, it, mdz, stm, itz, xmz, s3z) 4437 4438# 4439# Taken from loader code from mikmod version 2.14 4440# by Steve McIntyre (stevem@chiark.greenend.org.uk) 4441# <doj@cubic.org> added title printing on 2003-06-24 44420 string MAS_UTrack_V00 4443>14 string >/0 ultratracker V1.%.1s module sound data 4444!:mime audio/x-mod 4445#audio/x-tracker-module 4446 44470 string UN05 MikMod UNI format module sound data 4448 44490 string Extended\ Module: Fasttracker II module sound data 4450!:mime audio/x-mod 4451#audio/x-tracker-module 4452>17 string >\0 Title: "%s" 4453 445421 string/c =!SCREAM! Screamtracker 2 module sound data 4455!:mime audio/x-mod 4456#audio/x-screamtracker-module 445721 string BMOD2STM Screamtracker 2 module sound data 4458!:mime audio/x-mod 4459#audio/x-screamtracker-module 44601080 string M.K. 4-channel Protracker module sound data 4461!:mime audio/x-mod 4462#audio/x-protracker-module 4463>0 string >\0 Title: "%s" 44641080 string M!K! 4-channel Protracker module sound data 4465!:mime audio/x-mod 4466#audio/x-protracker-module 4467>0 string >\0 Title: "%s" 44681080 string FLT4 4-channel Startracker module sound data 4469!:mime audio/x-mod 4470#audio/x-startracker-module 4471>0 string >\0 Title: "%s" 44721080 string FLT8 8-channel Startracker module sound data 4473!:mime audio/x-mod 4474#audio/x-startracker-module 4475>0 string >\0 Title: "%s" 44761080 string 4CHN 4-channel Fasttracker module sound data 4477!:mime audio/x-mod 4478#audio/x-fasttracker-module 4479>0 string >\0 Title: "%s" 44801080 string 6CHN 6-channel Fasttracker module sound data 4481!:mime audio/x-mod 4482#audio/x-fasttracker-module 4483>0 string >\0 Title: "%s" 44841080 string 8CHN 8-channel Fasttracker module sound data 4485!:mime audio/x-mod 4486#audio/x-fasttracker-module 4487>0 string >\0 Title: "%s" 44881080 string CD81 8-channel Octalyser module sound data 4489!:mime audio/x-mod 4490#audio/x-octalysertracker-module 4491>0 string >\0 Title: "%s" 44921080 string OKTA 8-channel Octalyzer module sound data 4493!:mime audio/x-mod 4494#audio/x-octalysertracker-module 4495>0 string >\0 Title: "%s" 4496# Not good enough. 4497#1082 string CH 4498#>1080 string >/0 %.2s-channel Fasttracker "oktalyzer" module sound data 44991080 string 16CN 16-channel Taketracker module sound data 4500!:mime audio/x-mod 4501#audio/x-taketracker-module 4502>0 string >\0 Title: "%s" 45031080 string 32CN 32-channel Taketracker module sound data 4504!:mime audio/x-mod 4505#audio/x-taketracker-module 4506>0 string >\0 Title: "%s" 4507 4508# TOC sound files -Trevor Johnson <trevor@jpj.net> 4509# 45100 string TOC TOC sound file 4511 4512# sidfiles <pooka@iki.fi> 4513# added name,author,(c) and new RSID type by <doj@cubic.org> 2003-06-24 45140 string SIDPLAY\ INFOFILE Sidplay info file 4515 45160 string PSID PlaySID v2.2+ (AMIGA) sidtune 4517>4 beshort >0 w/ header v%d, 4518>14 beshort =1 single song, 4519>14 beshort >1 %d songs, 4520>16 beshort >0 default song: %d 4521>0x16 string >\0 name: "%s" 4522>0x36 string >\0 author: "%s" 4523>0x56 string >\0 copyright: "%s" 4524 45250 string RSID RSID sidtune PlaySID compatible 4526>4 beshort >0 w/ header v%d, 4527>14 beshort =1 single song, 4528>14 beshort >1 %d songs, 4529>16 beshort >0 default song: %d 4530>0x16 string >\0 name: "%s" 4531>0x36 string >\0 author: "%s" 4532>0x56 string >\0 copyright: "%s" 4533 4534# IRCAM sound files - Michael Pruett <michael@68k.org> 4535# http://www-mmsp.ece.mcgill.ca/documents/AudioFormats/IRCAM/IRCAM.html 45360 belong 0x64a30100 IRCAM file (VAX little-endian) 45370 belong 0x0001a364 IRCAM file (VAX big-endian) 45380 belong 0x64a30200 IRCAM file (Sun big-endian) 45390 belong 0x0002a364 IRCAM file (Sun little-endian) 45400 belong 0x64a30300 IRCAM file (MIPS little-endian) 45410 belong 0x0003a364 IRCAM file (MIPS big-endian) 45420 belong 0x64a30400 IRCAM file (NeXT big-endian) 45430 belong 0x64a30400 IRCAM file (NeXT big-endian) 45440 belong 0x0004a364 IRCAM file (NeXT little-endian) 4545 4546# NIST SPHERE <mpruett@sgi.com> 45470 string NIST_1A\n\ \ \ 1024\n NIST SPHERE file 4548 4549# Sample Vision <mpruett@sgi.com> 45500 string SOUND\ SAMPLE\ DATA\ Sample Vision file 4551 4552# Audio Visual Research <tonigonenstein@users.sourceforge.net> 45530 string 2BIT Audio Visual Research file, 4554>12 beshort =0 mono, 4555>12 beshort =-1 stereo, 4556>14 beshort x %d bits 4557>16 beshort =0 unsigned, 4558>16 beshort =-1 signed, 4559>22 belong&0x00ffffff x %d Hz, 4560>18 beshort =0 no loop, 4561>18 beshort =-1 loop, 4562>21 ubyte <128 note %d, 4563>22 byte =0 replay 5.485 KHz 4564>22 byte =1 replay 8.084 KHz 4565>22 byte =2 replay 10.971 KHz 4566>22 byte =3 replay 16.168 KHz 4567>22 byte =4 replay 21.942 KHz 4568>22 byte =5 replay 32.336 KHz 4569>22 byte =6 replay 43.885 KHz 4570>22 byte =7 replay 47.261 KHz 4571 4572# SGI SoundTrack <mpruett@sgi.com> 45730 string _SGI_SoundTrack SGI SoundTrack project file 4574# ID3 version 2 tags <waschk@informatik.uni-rostock.de> 45750 string ID3 Audio file with ID3 version 2 4576>3 byte x \b.%d 4577>4 byte x \b.%d 4578>>5 byte &0x80 \b, unsynchronized frames 4579>>5 byte &0x40 \b, extended header 4580>>5 byte &0x20 \b, experimental 4581>>5 byte &0x10 \b, footer present 4582>(6.I+10) indirect x \b, contains: 4583 4584# NSF (NES sound file) magic 45850 string NESM\x1a NES Sound File 4586>14 string >\0 ("%s" by 4587>46 string >\0 %s, copyright 4588>78 string >\0 %s), 4589>5 byte x version %d, 4590>6 byte x %d tracks, 4591>122 byte&0x2 =1 dual PAL/NTSC 4592>122 byte&0x1 =1 PAL 4593>122 byte&0x1 =0 NTSC 4594 4595# NSFE (Extended NES sound file) magic 4596# http://slickproductions.org/docs/NSF/nsfespec.txt 4597# From: David Pflug <david@pflug.email> 45980 string NSFE Extended NES Sound File 4599>48 search/0x1000 auth 4600>>&0 string >\0 ("%s" 4601>>>&1 string >\0 by %s 4602>>>>&1 string >\0 \b, copyright %s 4603>>>>>&1 string >\0 \b, ripped by %s 4604>20 byte x \b), %d tracks, 4605>18 byte&0x2 =1 dual PAL/NTSC 4606>18 byte&0x2 =0 4607>>18 byte&0x1 =1 PAL 4608>>18 byte&0x1 =0 NTSC 4609 4610# Type: SNES SPC700 sound files 4611# From: Josh Triplett <josh@freedesktop.org> 46120 string SNES-SPC700\ Sound\ File\ Data\ v SNES SPC700 sound file 4613>&0 string 0.30 \b, version %s 4614>>0x23 byte 0x1B \b, without ID666 tag 4615>>0x23 byte 0x1A \b, with ID666 tag 4616>>>0x2E string >\0 \b, song "%.32s" 4617>>>0x4E string >\0 \b, game "%.32s" 4618 4619# Impulse tracker module (audio/x-it) 46200 string IMPM Impulse Tracker module sound data - 4621!:mime audio/x-mod 4622>4 string >\0 "%s" 4623>40 leshort !0 compatible w/ITv%x 4624>42 leshort !0 created w/ITv%x 4625 4626# Imago Orpheus module (audio/x-imf) 462760 string IM10 Imago Orpheus module sound data - 4628>0 string >\0 "%s" 4629 4630# From <collver1@attbi.com> 4631# These are the /etc/magic entries to decode modules, instruments, and 4632# samples in Impulse Tracker's native format. 4633 46340 string IMPS Impulse Tracker Sample 4635>18 byte &2 16 bit 4636>18 byte ^2 8 bit 4637>18 byte &4 stereo 4638>18 byte ^4 mono 46390 string IMPI Impulse Tracker Instrument 4640>28 leshort !0 ITv%x 4641>30 byte !0 %d samples 4642 4643# Yamaha TX Wave: file(1) magic for Yamaha TX Wave audio files 4644# From <collver1@attbi.com> 46450 string LM8953 Yamaha TX Wave 4646>22 byte 0x49 looped 4647>22 byte 0xC9 non-looped 4648>23 byte 1 33kHz 4649>23 byte 2 50kHz 4650>23 byte 3 16kHz 4651 4652# scream tracker: file(1) magic for Scream Tracker sample files 4653# 4654# From <collver1@attbi.com> 465576 string SCRS Scream Tracker Sample 4656>0 byte 1 sample 4657>0 byte 2 adlib melody 4658>0 byte >2 adlib drum 4659>31 byte &2 stereo 4660>31 byte ^2 mono 4661>31 byte &4 16bit little endian 4662>31 byte ^4 8bit 4663>30 byte 0 unpacked 4664>30 byte 1 packed 4665 4666# audio 4667# From: Cory Dikkers <cdikkers@swbell.net> 46680 string MMD0 MED music file, version 0 46690 string MMD1 OctaMED Pro music file, version 1 46700 string MMD3 OctaMED Soundstudio music file, version 3 46710 string OctaMEDCmpr OctaMED Soundstudio compressed file 46720 string MED MED_Song 46730 string SymM Symphonie SymMOD music file 4674# 4675# Track Length (TRL), Tracks (TRK), Samples (SMP), Subsongs (SS) 4676# http://lclevy.free.fr/exotica/ahx/ahxformat.txt 46770 string THX AHX version 4678>3 byte =0 1 module data 4679>3 byte =1 2 module data 4680>10 byte x TRL: %u 4681>11 byte x TRK: %u 4682>12 byte x SMP: %u 4683>13 byte x SS: %u 4684# 46850 string OKTASONG Oktalyzer module data 4686# 46870 string DIGI\ Booster\ module\0 %s 4688>20 byte >0 %c 4689>>21 byte >0 \b%c 4690>>>22 byte >0 \b%c 4691>>>>23 byte >0 \b%c 4692>610 string >\0 \b, "%s" 4693# 46940 string DBM0 DIGI Booster Pro Module 4695>4 byte >0 V%X. 4696>>5 byte x \b%02X 4697>16 string >\0 \b, "%s" 4698# 46990 string FTMN FaceTheMusic module 4700>16 string >\0d \b, "%s" 4701 4702# From: <doj@cubic.org> 2003-06-24 47030 string AMShdr\32 Velvet Studio AMS Module v2.2 47040 string Extreme Extreme Tracker AMS Module v1.3 47050 string DDMF Xtracker DMF Module 4706>4 byte x v%i 4707>0xD string >\0 Title: "%s" 4708>0x2B string >\0 Composer: "%s" 47090 string DSM\32 Dynamic Studio Module DSM 47100 string SONG DigiTrekker DTM Module 47110 string DMDL DigiTrakker MDL Module 47120 string PSM\32 Protracker Studio PSM Module 471344 string PTMF Poly Tracker PTM Module 4714>0 string >\32 Title: "%s" 47150 string MT20 MadTracker 2.0 Module MT2 47160 string RAD\40by\40REALiTY!! RAD Adlib Tracker Module RAD 47170 string RTMM RTM Module 47180x426 string MaDoKaN96 XMS Adlib Module 4719>0 string >\0 Composer: "%s" 47200 string AMF AMF Module 4721>4 string >\0 Title: "%s" 47220 string MODINFO1 Open Cubic Player Module Inforation MDZ 47230 string Extended\40Instrument: Fast Tracker II Instrument 4724 4725# From: Takeshi Hamasaki <hma@syd.odn.ne.jp> 4726# NOA Nancy Codec file 47270 string \210NOA\015\012\032 NOA Nancy Codec Movie file 4728# Yamaha SMAF format 47290 string MMMD Yamaha SMAF file 4730# Sharp Jisaku Melody format for PDC 47310 string \001Sharp\040JisakuMelody SHARP Cell-Phone ringing Melody 4732>20 string Ver01.00 Ver. 1.00 4733>>32 byte x , %d tracks 4734 4735# Free lossless audio codec <http://flac.sourceforge.net> 4736# From: Przemyslaw Augustyniak <silvathraec@rpg.pl> 47370 string fLaC FLAC audio bitstream data 4738!:mime audio/flac 4739>4 byte&0x7f >0 \b, unknown version 4740>4 byte&0x7f 0 \b 4741# some common bits/sample values 4742>>20 beshort&0x1f0 0x030 \b, 4 bit 4743>>20 beshort&0x1f0 0x050 \b, 6 bit 4744>>20 beshort&0x1f0 0x070 \b, 8 bit 4745>>20 beshort&0x1f0 0x0b0 \b, 12 bit 4746>>20 beshort&0x1f0 0x0f0 \b, 16 bit 4747>>20 beshort&0x1f0 0x170 \b, 24 bit 4748>>20 byte&0xe 0x0 \b, mono 4749>>20 byte&0xe 0x2 \b, stereo 4750>>20 byte&0xe 0x4 \b, 3 channels 4751>>20 byte&0xe 0x6 \b, 4 channels 4752>>20 byte&0xe 0x8 \b, 5 channels 4753>>20 byte&0xe 0xa \b, 6 channels 4754>>20 byte&0xe 0xc \b, 7 channels 4755>>20 byte&0xe 0xe \b, 8 channels 4756# sample rates derived from known oscillator frequencies; 4757# 24.576 MHz (video/fs=48kHz), 22.5792 (audio/fs=44.1kHz) and 4758# 16.384 (other/fs=32kHz). 4759>>17 belong&0xfffff0 0x02b110 \b, 11.025 kHz 4760>>17 belong&0xfffff0 0x03e800 \b, 16 kHz 4761>>17 belong&0xfffff0 0x056220 \b, 22.05 kHz 4762>>17 belong&0xfffff0 0x05dc00 \b, 24 kHz 4763>>17 belong&0xfffff0 0x07d000 \b, 32 kHz 4764>>17 belong&0xfffff0 0x0ac440 \b, 44.1 kHz 4765>>17 belong&0xfffff0 0x0bb800 \b, 48 kHz 4766>>17 belong&0xfffff0 0x0fa000 \b, 64 kHz 4767>>17 belong&0xfffff0 0x158880 \b, 88.2 kHz 4768>>17 belong&0xfffff0 0x177000 \b, 96 kHz 4769>>17 belong&0xfffff0 0x1f4000 \b, 128 kHz 4770>>17 belong&0xfffff0 0x2b1100 \b, 176.4 kHz 4771>>17 belong&0xfffff0 0x2ee000 \b, 192 kHz 4772>>17 belong&0xfffff0 0x3e8000 \b, 256 kHz 4773>>17 belong&0xfffff0 0x562200 \b, 352.8 kHz 4774>>17 belong&0xfffff0 0x5dc000 \b, 384 kHz 4775>>21 byte&0xf >0 \b, >4G samples 4776>>21 byte&0xf 0 \b 4777>>>22 belong >0 \b, %u samples 4778>>>22 belong 0 \b, length unknown 4779 4780# (ISDN) VBOX voice message file (Wolfram Kleff) 47810 string VBOX VBOX voice message data 4782 4783# ReBorn Song Files (.rbs) 4784# David J. Singer <doc@deadvirgins.org.uk> 47858 string RB40 RBS Song file 4786>29 string ReBorn created by ReBorn 4787>37 string Propellerhead created by ReBirth 4788 4789# Synthesizer Generator and Kimwitu share their file format 47900 string A#S#C#S#S#L#V#3 Synthesizer Generator or Kimwitu data 4791# Kimwitu++ uses a slightly different magic 47920 string A#S#C#S#S#L#HUB Kimwitu++ data 4793 4794# From "Simon Hosie 47950 string TFMX-SONG TFMX module sound data 4796 4797# Monkey's Audio compressed audio format (.ape) 4798# From danny.milo@gmx.net (Danny Milosavljevic) 4799# New version from Abel Cheung <abel (@) oaka.org> 48000 string MAC\040 Monkey's Audio compressed format 4801!:mime audio/x-ape 4802>4 uleshort >0x0F8B version %d 4803>>(0x08.l) uleshort =1000 with fast compression 4804>>(0x08.l) uleshort =2000 with normal compression 4805>>(0x08.l) uleshort =3000 with high compression 4806>>(0x08.l) uleshort =4000 with extra high compression 4807>>(0x08.l) uleshort =5000 with insane compression 4808>>(0x08.l+18) uleshort =1 \b, mono 4809>>(0x08.l+18) uleshort =2 \b, stereo 4810>>(0x08.l+20) ulelong x \b, sample rate %d 4811>4 uleshort <0x0F8C version %d 4812>>6 uleshort =1000 with fast compression 4813>>6 uleshort =2000 with normal compression 4814>>6 uleshort =3000 with high compression 4815>>6 uleshort =4000 with extra high compression 4816>>6 uleshort =5000 with insane compression 4817>>10 uleshort =1 \b, mono 4818>>10 uleshort =2 \b, stereo 4819>>12 ulelong x \b, sample rate %d 4820 4821# adlib sound files 4822# From: Alex Myczko <alex@aiei.ch> 4823 4824# https://github.com/rerrahkr/BambooTracker 48250 string BambooTrackerMod BambooTracker module 4826>22 byte x \b, version %u 4827>21 byte x \b.%u 4828>20 byte x \b.%u 4829 48300 string BambooTrackerIst BambooTracker instrument 4831>22 byte x \b, version %u 4832>21 byte x \b.%u 4833>20 byte x \b.%u 4834 48350 string CC2x CheeseCutter 2 song 4836 48370 string RAWADATA RdosPlay RAW 4838 48391068 string RoR AMUSIC Adlib Tracker 4840 48410 string JCH EdLib 4842 48430 string mpu401tr MPU-401 Trakker 4844 48450 string SAdT Surprise! Adlib Tracker 4846>4 byte x Version %d 4847 48480 string XAD! eXotic ADlib 4849 48500 string ofTAZ! eXtra Simple Music 4851 48520 string FMK! FM Kingtracker Song 4853 48540 string DFM DFM Song 4855 48560 string \<CUD-FM-File\> CFF Song 4857 48580 string _A2module A2M Song 4859 4860# Spectrum 128 tunes (.ay files). 4861# From: Emanuel Haupt <ehaupt@critical.ch> 48620 string ZXAYEMUL Spectrum 128 tune 4863 48640 string \0BONK BONK, 4865#>5 byte x version %d 4866>14 byte x %d channel(s), 4867>15 byte =1 lossless, 4868>15 byte =0 lossy, 4869>16 byte x mid-side 4870 4871384 string LockStream LockStream Embedded file (mostly MP3 on old Nokia phones) 4872 4873# format VQF (proprietary codec for sound) 4874# some infos on the header file available at : 4875# http://www.twinvq.org/english/technology_format.html 48760 string TWIN97012000 VQF data 4877>27 short 0 \b, Mono 4878>27 short 1 \b, Stereo 4879>31 short >0 \b, %d kbit/s 4880>35 short >0 \b, %d kHz 4881 4882# Nelson A. de Oliveira (naoliv@gmail.com) 4883# .eqf 48840 string Winamp\ EQ\ library\ file %s 4885# it will match only versions like v<digit>.<digit> 4886# Since I saw only eqf files with version v1.1 I think that it's OK 4887>23 string x \b%.4s 4888# .preset 48890 string [Equalizer\ preset] XMMS equalizer preset 4890# .m3u 48910 search/1 #EXTM3U M3U playlist text 4892# .pls 48930 search/1 [playlist] PLS playlist text 4894# licq.conf 48951 string [licq] LICQ configuration file 4896 4897# Atari ST audio files by Dirk Jagdmann <doj@cubic.org> 4898# NOTE: Most SNDH music is packed using ICE, which has 4899# magic numbers "ICE!" and "Ice!". Some SNDH music is 4900# not packed, so we check for both packed and unpacked. 490112 string SNDH SNDH Atari ST music 49020 belong&0xFFDFDFFF 0x49434521 4903>14 search/40 NDH SNDH Atari ST music 4904>14 search/40 TITL SNDH Atari ST music 49050 string SC68\ Music-file\ /\ (c)\ (BeN)jami sc68 Atari ST music 4906 4907# musepak support From: "Jiri Pejchal" <jiri.pejchal@gmail.com> 49080 string MP+ Musepack audio (MP+) 4909!:mime audio/x-musepack 4910>3 byte 255 \b, SV pre8 4911>3 byte&0xF 0x6 \b, SV 6 4912>3 byte&0xF 0x8 \b, SV 8 4913>3 byte&0xF 0x7 \b, SV 7 4914>>3 byte&0xF0 0x0 \b.0 4915>>3 byte&0xF0 0x10 \b.1 4916>>3 byte&0xF0 240 \b.15 4917>>10 byte&0xF0 0x0 \b, no profile 4918>>10 byte&0xF0 0x10 \b, profile 'Unstable/Experimental' 4919>>10 byte&0xF0 0x50 \b, quality 0 4920>>10 byte&0xF0 0x60 \b, quality 1 4921>>10 byte&0xF0 0x70 \b, quality 2 (Telephone) 4922>>10 byte&0xF0 0x80 \b, quality 3 (Thumb) 4923>>10 byte&0xF0 0x90 \b, quality 4 (Radio) 4924>>10 byte&0xF0 0xA0 \b, quality 5 (Standard) 4925>>10 byte&0xF0 0xB0 \b, quality 6 (Xtreme) 4926>>10 byte&0xF0 0xC0 \b, quality 7 (Insane) 4927>>10 byte&0xF0 0xD0 \b, quality 8 (BrainDead) 4928>>10 byte&0xF0 0xE0 \b, quality 9 4929>>10 byte&0xF0 0xF0 \b, quality 10 4930>>27 byte 0x0 \b, Buschmann 1.7.0-9, Klemm 0.90-1.05 4931>>27 byte 102 \b, Beta 1.02 4932>>27 byte 104 \b, Beta 1.04 4933>>27 byte 105 \b, Alpha 1.05 4934>>27 byte 106 \b, Beta 1.06 4935>>27 byte 110 \b, Release 1.1 4936>>27 byte 111 \b, Alpha 1.11 4937>>27 byte 112 \b, Beta 1.12 4938>>27 byte 113 \b, Alpha 1.13 4939>>27 byte 114 \b, Beta 1.14 4940>>27 byte 115 \b, Alpha 1.15 4941 49420 string MPCK Musepack audio (MPCK) 4943!:mime audio/x-musepack 4944 4945# IMY 4946# from http://filext.com/detaillist.php?extdetail=IMY 4947# https://cellphones.about.com/od/cellularfaqs/f/rf_imelody.htm 4948# http://download.ncl.ie/doc/api/ie/ncl/media/music/IMelody.html 4949# http://www.wx800.com/msg/download/irda/iMelody.pdf 49500 string BEGIN:IMELODY iMelody Ringtone Format 4951 4952# From: "Mateus Caruccio" <mateus@caruccio.com> 4953# guitar pro v3,4,5 from http://filext.com/file-extension/gp3 49540 string \030FICHIER\ GUITAR\ PRO\ v3. Guitar Pro Ver. 3 Tablature 4955 4956# From: "Leslie P. Polzer" <leslie.polzer@gmx.net> 495760 string SONG SoundFX Module sound file 4958 4959# Type: Adaptive Multi-Rate Codec 4960# URL: http://filext.com/detaillist.php?extdetail=AMR 4961# From: Russell Coker <russell@coker.com.au> 49620 string #!AMR Adaptive Multi-Rate Codec (GSM telephony) 4963!:mime audio/amr 4964!:ext amr 4965 4966# Type: SuperCollider 3 Synth Definition File Format 4967# From: Mario Lang <mlang@debian.org> 49680 string SCgf SuperCollider3 Synth Definition file, 4969>4 belong x version %d 4970 4971# Type: True Audio Lossless Audio 4972# URL: https://wiki.multimedia.cx/index.php?title=True_Audio 4973# From: Mike Melanson <mike@multimedia.cx> 49740 string TTA1 True Audio Lossless Audio 4975 4976# Type: WavPack Lossless Audio 4977# URL: https://wiki.multimedia.cx/index.php?title=WavPack 4978# From: Mike Melanson <mike@multimedia.cx> 49790 string wvpk WavPack Lossless Audio 4980 4981# From Fabio R. Schmidlin <frs@pop.com.br> 4982# VGM music file 49830 string Vgm\040 4984>9 ubyte >0 VGM Video Game Music dump v 4985!:mime audio/x-vgm 4986!:ext vgm 4987>>9 ubyte/16 >0 \b%d 4988>>9 ubyte&0x0F x \b%d 4989>>8 ubyte/16 x \b.%d 4990>>8 ubyte&0x0F >0 \b%d 4991#Get soundchips 4992>>8 ubyte x \b, soundchip(s)= 4993>>0x0C ulelong >0 SN76489, 4994>>0x10 ulelong >0 YM2413, 4995>>0x2C ulelong >0 YM2612, 4996>>0x30 ulelong >0 YM2151, 4997>>0x38 ulelong >0 Sega PCM, 4998>>0x34 ulelong >0xC 4999>>>0x40 ulelong >0 RF5C68, 5000>>0x34 ulelong >0x10 5001>>>0x44 ulelong >0 YM2203, 5002>>0x34 ulelong >0x14 5003>>>0x48 ulelong >0 YM2608, 5004>>0x34 ulelong >0x18 5005>>>0x4C lelong >0 YM2610, 5006>>>0x4C lelong <0 YM2610B, 5007>>0x34 ulelong >0x1C 5008>>>0x50 ulelong >0 YM3812, 5009>>0x34 ulelong >0x20 5010>>>0x54 ulelong >0 YM3526, 5011>>0x34 ulelong >0x24 5012>>>0x58 ulelong >0 Y8950, 5013>>0x34 ulelong >0x28 5014>>>0x5C ulelong >0 YMF262, 5015>>0x34 ulelong >0x2C 5016>>>0x60 ulelong >0 YMF278B, 5017>>0x34 ulelong >0x30 5018>>>0x64 ulelong >0 YMF271, 5019>>0x34 ulelong >0x34 5020>>>0x68 ulelong >0 YMZ280B, 5021>>0x34 ulelong >0x38 5022>>>0x6C ulelong >0 RF5C164, 5023>>0x34 ulelong >0x3C 5024>>>0x70 ulelong >0 PWM, 5025>>0x34 ulelong >0x40 5026>>>0x74 ulelong >0 5027>>>>0x78 ubyte 0x00 AY-3-8910, 5028>>>>0x78 ubyte 0x01 AY-3-8912, 5029>>>>0x78 ubyte 0x02 AY-3-8913, 5030>>>>0x78 ubyte 0x03 AY-3-8930, 5031>>>>0x78 ubyte 0x10 YM2149, 5032>>>>0x78 ubyte 0x11 YM3439, 5033>>>>0x78 ubyte 0x12 YMZ284, 5034>>>>0x78 ubyte 0x13 YMZ294, 5035# VGM 1.61 5036>>0x34 ulelong >0x4C 5037>>>0x80 ulelong >0 DMG, 5038>>0x34 ulelong >0x50 5039>>>0x84 lelong >0 NES APU, 5040>>>0x84 lelong <0 NES APU with FDS, 5041>>0x34 ulelong >0x54 5042>>>0x88 ulelong >0 MultiPCM, 5043>>0x34 ulelong >0x58 5044>>>0x8C ulelong >0 uPD7759, 5045>>0x34 ulelong >0x5C 5046>>>0x90 ulelong >0 OKIM6258, 5047>>0x34 ulelong >0x64 5048>>>0x98 ulelong >0 OKIM6295, 5049>>0x34 ulelong >0x68 5050>>>0x9C ulelong >0 K051649, 5051>>0x34 ulelong >0x6C 5052>>>0xA0 ulelong >0 K054539, 5053>>0x34 ulelong >0x70 5054>>>0xA4 ulelong >0 HuC6280, 5055>>0x34 ulelong >0x74 5056>>>0xA8 ulelong >0 C140, 5057>>0x34 ulelong >0x78 5058>>>0xAC ulelong >0 K053260, 5059>>0x34 ulelong >0x7C 5060>>>0xB0 ulelong >0 Pokey, 5061>>0x34 ulelong >0x80 5062>>>0xB4 ulelong >0 QSound, 5063# VGM 1.71 5064>>0x34 ulelong >0x84 5065>>>0xB8 ulelong >0 SCSP, 5066>>0x34 ulelong >0x8C 5067>>>0xC0 ulelong >0 WonderSwan, 5068>>0x34 ulelong >0x90 5069>>>0xC4 ulelong >0 VSU, 5070>>0x34 ulelong >0x94 5071>>>0xC8 ulelong >0 SAA1099, 5072>>0x34 ulelong >0x98 5073>>>0xCC ulelong >0 ES5503, 5074>>0x34 ulelong >0x9C 5075>>>0xD0 lelong >0 ES5505, 5076>>>0xD0 lelong <0 ES5506, 5077>>0x34 ulelong >0xA4 5078>>>0xD8 ulelong >0 X1-010, 5079>>0x34 ulelong >0xA8 5080>>>0xDC ulelong >0 C352, 5081>>0x34 ulelong >0xAC 5082>>>0xE0 ulelong >0 GA20, 5083 5084# GVOX Encore file format 5085# Since this is a proprietary file format and there is no publicly available 5086# format specification, this is just based on induction 5087# 50880 string SCOW 5089>4 byte 0xc4 GVOX Encore music, version 5.0 or above 5090>4 byte 0xc2 GVOX Encore music, version < 5.0 5091 50920 string ZBOT 5093>4 byte 0xc5 GVOX Encore music, version < 5.0 5094 5095# Summary: Garmin Voice Processing Module (WAVE audios) 5096# From: Joerg Jenderek 5097# URL: https://www.garmin.com/ 5098# Reference: http://www.poi-factory.com/node/19580 5099# NOTE: there exist 2 other Garmin VPM formats 51000 string AUDIMG 5101# skip text files starting with string "AUDIMG" 5102>13 ubyte <13 Garmin Voice Processing Module 5103!:mime audio/x-vpm-wav-garmin 5104!:ext vpm 5105# 3 bytes indicating the voice version (200,220) 5106>>6 string x \b, version %3.3s 5107# day of release (01-31) 5108>>12 ubyte x \b, %.2d 5109# month of release (01-12) 5110>>13 ubyte x \b.%.2d 5111# year of release (like 2006, 2007, 2008) 5112>>14 uleshort x \b.%.4d 5113# hour of release (0-23) 5114>>11 ubyte x %.2d 5115# minute of release (0-59) 5116>>10 ubyte x \b:%.2d 5117# second of release (0-59) 5118>>9 ubyte x \b:%.2d 5119# if you select a language like german on your garmin device 5120# you can only select voice modules with corresponding language byte ID like 1 5121>>18 ubyte x \b, language ID %d 5122# structure for phrases/sentences? 5123# number of voice sample in the 1st phrase? 5124#>>19 uleshort x \b, 0x%x samples 5125#>>>21 uleshort >0 \b, at 0x%4.4x 5126#>>>(21.s) ubequad x 0x%llx 5127# 2nd phrase? 5128#>>23 uleshort x \b, 0x%x samples 5129#>>>25 uleshort >0 \b, at 0x%4.4x 5130#>>>(25.s) ubequad x 0x%llx 5131# pointer to 1st audio WAV sample 5132>>16 uleshort >0 5133>>>(16.s) ulelong >0 \b, at 0x%x 5134# WAV length 5135# 1 space char after "bytes" to get phrase "bytes RIFF" 5136>>>>(16.s+4) ulelong >0 %u bytes 5137# look for magic 5138>>>>>(&-8.l) string RIFF 5139# determine type by ./riff 5140>>>>>>&-4 indirect x 5141# 2 - ~ 131 WAV samples following same way 5142# 5143# Summary: encrypted Garmin Voice Processing Module 5144# From: Joerg Jenderek 5145# URL: https://www.garmin.com/us/products/ontheroad/voicestudio 5146# NOTE: Encrypted variant used in voices like DrNightmare, Elfred, Yeti. 5147# There exist 2 other Garmin VPM formats 51480 ubequad 0xa141190fecc8ced6 Garmin Voice Processing Module (encrypted) 5149!:mime audio/x-vpm-garmin 5150!:ext vpm 5151 5152# From Martin Mueller Skarbiniks Pedersen 51530 string GDM 5154>0x3 byte 0xFE General Digital Music. 5155>0x4 string >\0 title: "%s" 5156>0x24 string >\0 musician: "%s" 5157>>0x44 beshort 0x0D0A 5158>>>0x46 byte 0x1A 5159>>>>0x47 string GMFS Version 5160>>>>0x4B byte x %d. 5161>>>>0x4C byte x \b%02d 5162>>>>0x4D beshort 0x000 (2GDM v 5163>>>>0x4F byte x \b%d. 5164>>>>>0x50 byte x \b%d) 5165 51660 string MTM Multitracker 5167>0x3 byte/16 x Version %d. 5168>0x3 byte&0x0F x \b%02d 5169>>0x4 string >\0 title: "%s" 5170 51710 string HVL 5172>3 byte <2 Hively Tracker Song 5173>3 byte 0 1 module data 5174>3 byte 1 2 module data 5175 51760 string MO3 5177>3 ubyte <6 MOdule with MP3 5178>>3 byte 0 Version 0 (With MP3 and lossless) 5179>>3 byte 1 Version 1 (With ogg and lossless) 5180>>3 byte 3 Version 2.2 5181>>3 byte 4 (With no LAME header) 5182>>3 byte 5 Version 2.4 5183 51840 string ADRVPACK AProSys module 5185 5186# ftp://ftp.modland.com/pub/documents/format_documentation/\ 5187# Art%20Of%20Noise%20(.aon).txt 51880 string AON 5189>4 string "ArtOfNoise by Bastian Spiegel(twice/lego)" 5190>0x2e string NAME Art of Noise Tracker Song 5191>3 string <9 5192>3 string 4 (4 voices) 5193>3 string 8 (8 voices) 5194>>0x36 string >\0 Title: "%s" 5195 51960 string FAR 5197>0x2c byte 0x0d 5198>0x2d byte 0x0a 5199>0x2e byte 0x1a 5200>>0x3 byte 0xFE Farandole Tracker Song 5201>>>0x31 byte/16 x Version %d. 5202>>>0x31 byte&0x0F x \b%02d 5203>>>>0x4 string >\0 \b, title: "%s" 5204 5205# magic for Klystrack, https://kometbomb.github.io/klystrack/ 5206# from Alex Myczko <alex@aiei.ch> 52070 string cyd!song Klystrack song 5208>8 byte >0 \b, version %u 5209>8 byte >26 5210#>>9 byte x \b, channels %u 5211#>>10 leshort x \b, time signature %u 5212#>>12 leshort x \b, sequence step %u 5213#>>14 byte x \b, instruments %u 5214#>>15 leshort x \b, patterns %u 5215#>>17 leshort x \b, sequences %u 5216#>>19 leshort x \b, length %u 5217#>>21 leshort x \b, loop point %u 5218#>>23 byte x \b, master volume %u 5219#>>24 byte x \b, song speed %u 5220#>>25 byte x \b, song speed2 %u 5221#>>26 byte x \b, song rate %u 5222#>>27 belong x \b, flags %#x 5223#>>31 byte x \b, multiplex period %u 5224#>>32 byte x \b, pitch inaccuracy %u 5225>>149 pstring x \b, title %s 5226 52270 string cyd!inst Klystrack instrument 5228 5229# magic for WOPL instrument files, https://github.com/Wohlstand/OPL3BankEditor 5230# see Specifications/WOPL-and-OPLI-Specification.txt 5231 52320 string WOPL3-INST\0 WOPL instrument 5233>11 leshort x \b, version %u 52340 string WOPL3-BANK\0 WOPL instrument bank 5235>11 leshort x \b, version %u 5236 5237# AdLib/OPL instrument files. Format specifications on 5238# http://www.shikadi.net/moddingwiki 52390 string Junglevision\ Patch\ File Junglevision instrument data 52400 string #OPL_II# DMX OP2 instrument data 52410 string IBK\x1a IBK instrument data 52420 string 2OP\x1a IBK instrument data, 2 operators 52430 string 4OP\x1a IBK instrument data, 4 operators 52442 string ADLIB- AdLib instrument data 5245>0 byte x \b, version %u 5246>1 byte x \b.%u 5247 5248# CRI ADX ADPCM audio 5249# Used by various Sega games. 5250# https://en.wikipedia.org/wiki/ADX_(file_format) 5251# https://wiki.multimedia.cx/index.php/CRI_ADX_file 5252# Added by David Korth <gerbilsoft@gerbilsoft.com> 52530x00 beshort 0x8000 5254>(2.S-2) string (c)CRI CRI ADX ADPCM audio 5255!:ext adx 5256!:mime audio/x-adx 5257!:strength +50 5258>>0x12 byte x v%u 5259>>0x04 byte 0x02 \b, pre-set prediction coefficients 5260>>0x04 byte 0x03 \b, standard ADX 5261>>0x04 byte 0x04 \b, exponential scale 5262>>0x04 byte 0x10 \b, AHX (Dreamcast) 5263>>0x04 byte 0x11 \b, AHX 5264>>0x08 belong x \b, %u Hz 5265>>0x12 byte 0x03 5266>>>0x02 beshort >0x2B 5267>>>>0x18 belong !0 \b, looping 5268>>0x12 byte 0x04 5269>>>0x02 beshort >0x37 5270>>>>0x24 belong !0 \b, looping 5271>>0x13 byte&0x08 0x08 \b, encrypted 5272 5273# Lossless audio (.la) (http://www.lossless-audio.com/) 52740 string LA 5275>2 string 03 Lossless audio version 0.3 5276>2 string 04 Lossless audio version 0.4 5277 5278# Sony PlayStation Audio (.xa) 52790 leshort 0x4158 Sony PlayStation Audio 5280 5281# Portable Sound Format 5282# Used for audio rips for various consoles. 5283# http://fileformats.archiveteam.org/wiki/Portable_Sound_Format 5284# Added by David Korth <gerbilsoft@gerbilsoft.com> 52850 string PSF 5286>3 byte 0x01 5287>3 byte 0x02 5288>3 byte 0x11 5289>3 byte 0x12 5290>3 byte 0x13 5291>3 byte 0x21 5292>3 byte 0x22 5293>3 byte 0x23 5294>3 byte 0x41 5295>>0 string PSF Portable Sound Format 5296!:mime audio/x-psf 5297>>>3 byte 0x01 (Sony PlayStation) 5298>>>3 byte 0x02 (Sony PlayStation 2) 5299>>>3 byte 0x11 (Sega Saturn) 5300>>>3 byte 0x12 (Sega Dreamcast) 5301>>>3 byte 0x13 (Sega Mega Drive) 5302>>>3 byte 0x21 (Nintendo 64) 5303>>>3 byte 0x22 (Game Boy Advance) 5304>>>3 byte 0x23 (Super NES) 5305>>>3 byte 0x41 (Capcom QSound) 5306 5307# Atari 8-bit SAP audio format 5308# http://asap.sourceforge.net/sap-format.html 5309# Added by David Korth <gerbilsoft@gerbilsoft.com> 53100 string SAP\r\n Atari 8-bit SAP audio file 5311!:mime audio/x-sap 5312!:ext sap 5313>5 search/1024 NAME 5314>>&1 string x \b: %s 5315>>5 search/1024 AUTHOR 5316>>>&1 string x by %s 5317 5318# Nintendo Wii BRSTM audio format (fields) 5319# NOTE: Assuming HEAD starts at 0x40. 5320# FIXME: Replace 0x48 with HEAD offset plus 8. 53210 name nintendo-wii-brstm-fields 5322>(0x10.L) string HEAD \b: 5323>>(0x10.L+0x0C) belong x 5324>>>(&-4.L+0x48) belong x 5325>>>>&-4 byte 0 PCM, signed 8-bit, 5326>>>>&-4 byte 1 PCM, signed 16-bit, 5327>>>>&-4 byte 2 THP ADPCM, 5328>>>>&-3 byte !0 looping, 5329>>>>&-2 byte 1 mono 5330>>>>&-2 byte 2 stereo 5331>>>>&-2 byte 3 3 channels 5332>>>>&-2 byte 4 quad 5333>>>>&-2 byte >4 %u channels 5334>>>>&0 beshort !0 %u Hz 5335 5336# Nintendo Wii BRSTM audio format 5337# https://wiibrew.org/wiki/BRSTM_file 5338# Added by David Korth <gerbilsoft@gerbilsoft.com> 53390 string RSTM Nintendo Wii BRSTM audio file 5340!:mime audio/x-brstm 5341!:ext brstm 5342# Wii is big-endian, so default to BE. 5343>4 beshort 0xFEFF 5344>>0 use nintendo-wii-brstm-fields 5345>4 leshort 0xFEFF 5346>>0 use \^nintendo-wii-brstm-fields 5347 5348# Nintendo 3DS BCSTM audio format (fields) 53490 name nintendo-3ds-bcstm-fields 5350>(0x18.l) string INFO \b: 5351# INFO block: Stream information starts at 0x20 (minus 4 for the 'INFO' magic) 5352>>&0x1C byte 0 PCM, signed 8-bit, 5353>>&0x1C byte 1 PCM, signed 16-bit, 5354>>&0x1C byte 2 DSP ADPCM, 5355>>&0x1C byte 3 IMA ADPCM, 5356>>&0x1D byte !0 looping, 5357>>&0x1E byte 1 mono 5358>>&0x1E byte 2 stereo 5359>>&0x1E byte 3 3 channels 5360>>&0x1E byte 4 quad 5361>>&0x1E byte >4 %u channels 5362>>&0x20 lelong !0 %u Hz 5363 5364# Nintendo 3DS BCSTM audio format 5365# https://www.3dbrew.org/wiki/BCSTM 5366# Added by David Korth <gerbilsoft@gerbilsoft.com> 53670 string CSTM Nintendo 3DS BCSTM audio file 5368!:mime audio/x-bcstm 5369!:ext bcstm 5370# 3DS is little-endian, so default to LE. 5371>4 leshort 0xFEFF 5372>>0 use nintendo-3ds-bcstm-fields 5373>4 beshort 0xFEFF 5374>>0 use \^nintendo-3ds-bcstm-fields 5375 5376# Nintendo Wii U BFSTM audio format 5377# http://mk8.tockdom.com/wiki/BFSTM_(File_Format) 5378# NOTE: This format is very similar to BCSTM. 5379# Added by David Korth <gerbilsoft@gerbilsoft.com> 53800 string FSTM Nintendo Wii U BFSTM audio file 5381!:mime audio/x-bfstm 5382!:ext bfstm 5383# BFSTM is used on both Wii U (BE) and Switch (LE), 5384# so default to LE. 5385>4 leshort 0xFEFF 5386>>0 use nintendo-3ds-bcstm-fields 5387>4 beshort 0xFEFF 5388>>0 use \^nintendo-3ds-bcstm-fields 5389 5390# Nintendo 3DS BCSTM audio format (fields) 53910 name nintendo-3ds-bcwav-fields 5392>(0x18.l) string INFO \b: 5393# INFO block (minus 4 for INFO magic) 5394>>&0x4 byte 0 PCM, signed 8-bit, 5395>>&0x4 byte 1 PCM, signed 16-bit, 5396>>&0x4 byte 2 DSP ADPCM, 5397>>&0x4 byte 3 IMA ADPCM, 5398>>&0x5 byte !0 looping, 5399>>&0x8 lelong x stereo 5400>>&0x8 lelong !0 %u Hz 5401 5402# Nintendo 3DS BCWAV audio format 5403# https://www.3dbrew.org/wiki/BCWAV 5404# Added by David Korth <gerbilsoft@gerbilsoft.com> 54050 string CWAV Nintendo 3DS BCWAV audio file 5406!:mime audio/x-bcwav 5407!:ext bcwav 5408# 3DS is little-endian, so default to LE. 5409>4 leshort 0xFEFF 5410>>0 use nintendo-3ds-bcwav-fields 5411>4 beshort 0xFEFF 5412>>0 use \^nintendo-3ds-bcwav-fields 5413 5414#---------------------------------------------------------------- 5415# $File: basis,v 1.5 2019/04/19 00:42:27 christos Exp $ 5416# basis: file(1) magic for BBx/Pro5-files 5417# Oliver Dammer <dammer@olida.de> 2005/11/07 5418# https://www.basis.com business-basic-files. 5419# 54200 string \074\074bbx\076\076 BBx 5421>7 string \000 indexed file 5422>7 string \001 serial file 5423>7 string \002 keyed file 5424>>13 short 0 (sort) 5425>7 string \004 program 5426>>18 byte x (LEVEL %d) 5427>>>23 string >\000 psaved 5428>7 string \006 mkeyed file 5429>>13 short 0 (sort) 5430>>8 string \000 (mkey) 5431#------------------------------------------------------------------------------ 5432# $File: beetle,v 1.2 2018/02/05 23:42:17 rrt Exp $ 5433# beetle: file(1) magic for Beetle VM object files 5434# https://github.com/rrthomas/beetle/ 5435 5436# Beetle object module 54370 string BEETLE\000 Beetle VM object file 5438 5439#------------------------------------------------------------------------------ 5440# $File: ber,v 1.2 2019/04/19 00:42:27 christos Exp $ 5441# ber: file(1) magic for several BER formats used in the mobile 5442# telecommunications industry (Georg Sauthoff) 5443 5444# The file formats are standardized by the GSMA (GSM association). 5445# They are specified via ASN.1 schemas and some prose. Basic encoding 5446# rules (BER) is the used encoding. The formats are used for exchanging 5447# call data records (CDRs) between mobile operators and associated 5448# parties for roaming clearing purposes and fraud detection. 5449 5450# The magic file covers: 5451 5452# - TAP files (TD.57) - CDR batches and notifications 5453# - RAP files (TD.32) - return batches and acknowledgements 5454# - NRT files (TD.35) - CDR batches for 'near real time' processing 5455 5456# 5457# TAP 3 Files 5458# TAP -> Transferred Account Procedure 5459# cf. https://www.gsma.com/newsroom/wp-content/uploads/TD.57-v32.31.pdf 5460# TransferBatch short tag 54610 byte 0x61 5462# BatchControlInfo short tag 5463>&1 search/b5 \x64 5464# Sender long tag #TAP 3.x (BER encoded) 5465>>&1 search/b8 \x5f\x81\x44 5466# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block 5467>>>&64 search/b64 \x5f\x81\x49\x01\x03\x5f\x81\x3d\x01 5468>>>>&0 byte x TAP 3.%d Batch (TD.57, Transferred Account) 5469 5470# Notification short tag 54710 byte 0x62 5472# Sender long tag 5473>2 search/b8 \x5f\x81\x44 5474# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block 5475>>&64 search/b64 \x5f\x81\x49\x01\x03\x5f\x81\x3d\x01 5476>>>&0 byte x TAP 3.%d Notification (TD.57, Transferred Account) 5477 5478 5479# NRT Files 5480# NRT a.k.a. NRTRDE 54810 byte 0x61 5482# <SpecificationVersionNumber>2</><ReleaseVersionNumber> block 5483>&1 search/b8 \x5f\x29\x01\x02\x5f\x25\x01 5484>>&0 byte x NRT 2.%d (TD.35, Near Real Time Roaming Data Exchange) 5485 5486# RAP Files 5487# cf. https://www.gsma.com/newsroom/wp-content/uploads/TD.32-v6.11.pdf 5488# Long ReturnBatch tag 54890 string \x7f\x84\x16 5490# Long RapBatchControlInfo tag 5491>&1 search/b8 \x7f\x84\x19 5492# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block 5493>>&64 search/b64 \x5f\x81\x49\x01\x03\x5f\x81\x3d\x01 5494# <RapSpecificationVersionNumber>1</><RapReleaseVersionNumber> block 5495>>>&1 string/b \x5f\x84\x20\x01\x01\x5f\x84\x1f\x01 5496>>>>&0 byte x RAP 1.%d Batch (TD.32, Returned Account Procedure), 5497>>>&0 byte x TAP 3.%d 5498 5499# Long Acknowledgement tag 55000 string \x7f\x84\x17 5501# Long Sender tag 5502>&1 search/b5 \x5f\x81\x44 RAP Acknowledgement (TD.32, Returned Account Procedure) 5503 5504#------------------------------------------------------------------------------ 5505# $File: bflt,v 1.5 2014/04/30 21:41:02 christos Exp $ 5506# bFLT: file(1) magic for BFLT uclinux binary files 5507# 5508# From Philippe De Muyter <phdm@macqel.be> 5509# 55100 string bFLT BFLT executable 5511>4 belong x - version %d 5512>4 belong 4 5513>>36 belong&0x1 0x1 ram 5514>>36 belong&0x2 0x2 gotpic 5515>>36 belong&0x4 0x4 gzip 5516>>36 belong&0x8 0x8 gzdata 5517 5518#------------------------------------------------------------------------------ 5519# $File: bhl,v 1.1 2017/06/11 22:20:02 christos Exp $ 5520# BlockHashLoc 5521# ext: bhl 5522# Marco Pontello marcopon@gmail.com 5523# reference: https://github.com/MarcoPon/BlockHashLoc 55240 string BlockHashLoc\x1a BlockHashLoc recovery info, 5525>13 byte x version %d 5526!:ext bhl 5527 5528#------------------------------------------------------------------------------ 5529# $File: bioinformatics,v 1.5 2019/04/19 00:42:27 christos Exp $ 5530# bioinfomatics: file(1) magic for Bioinfomatics file formats 5531 5532############################################################################### 5533# BGZF (Blocked GNU Zip Format) - gzip compatible, but also indexable 5534# used by SAMtools bgzip/tabix (http://samtools.sourceforge.net/tabix.shtml) 5535############################################################################### 55360 string \037\213 5537>3 byte &0x04 5538>>12 string BC 5539>>>14 leshort &0x02 Blocked GNU Zip Format (BGZF; gzip compatible) 5540>>>>16 leshort x \b, block length %d 5541!:mime application/x-gzip 5542 5543 5544############################################################################### 5545# Tabix index file 5546# used by SAMtools bgzip/tabix (http://samtools.sourceforge.net/tabix.shtml) 5547############################################################################### 55480 string TBI\1 SAMtools TBI (Tabix index format) 5549>0x04 lelong =1 \b, with %d reference sequence 5550>0x04 lelong >1 \b, with %d reference sequences 5551>0x08 lelong &0x10000 \b, using half-closed-half-open coordinates (BED style) 5552>0x08 lelong ^0x10000 5553>>0x08 lelong =0 \b, using closed and one based coordinates (GFF style) 5554>>0x08 lelong =1 \b, using SAM format 5555>>0x08 lelong =2 \b, using VCF format 5556>0x0c lelong x \b, sequence name column: %d 5557>0x10 lelong x \b, region start column: %d 5558>0x08 lelong =0 5559>>0x14 lelong x \b, region end column: %d 5560>0x18 byte x \b, comment character: %c 5561>0x1c lelong x \b, skip line count: %d 5562 5563 5564############################################################################### 5565# BAM (Binary Sequence Alignment/Map format) 5566# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf) 5567# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it 5568############################################################################### 55690 string BAM\1 SAMtools BAM (Binary Sequence Alignment/Map) 5570>0x04 lelong >0 5571>>&0x00 regex =^[@]HD\t.*VN: \b, with SAM header 5572>>>&0 regex =[0-9.]+ \b version %s 5573>>&(0x04) lelong >0 \b, with %d reference sequences 5574 5575 5576############################################################################### 5577# BAI (BAM indexing format) 5578# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf) 5579############################################################################### 55800 string BAI\1 SAMtools BAI (BAM indexing format) 5581>0x04 lelong >0 \b, with %d reference sequences 5582 5583 5584############################################################################### 5585# CRAM (Binary Sequence Alignment/Map format) 5586############################################################################### 55870 string CRAM CRAM 5588>0x04 byte >-1 version %d. 5589>0x05 byte >-1 \b%d 5590>0x06 string >\0 (identified as %s) 5591 5592 5593############################################################################### 5594# BCF (Binary Call Format), version 1 5595# used by SAMtools & VCFtools (http://vcftools.sourceforge.net/bcf.pdf) 5596# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it 5597############################################################################### 55980 string BCF\4 5599# length of seqnm data in bytes is positive 5600>&0x00 lelong >0 5601# length of smpl data in bytes is positive 5602>>&(&-0x04) lelong >0 SAMtools BCF (Binary Call Format) 5603# length of meta in bytes 5604>>>&(&-0x04) lelong >0 5605# have meta text string 5606>>>>&0x00 search ##samtoolsVersion= 5607>>>>>&0x00 string x \b, generated by SAMtools version %s 5608 5609 5610############################################################################### 5611# BCF (Binary Call Format), version 2.1 5612# used by SAMtools (https://samtools.github.io/hts-specs/BCFv2_qref.pdf) 5613# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it 5614############################################################################### 56150 string BCF\2\1 Binary Call Format (BCF) version 2.1 5616# length of header text 5617>&0x00 lelong >0 5618# have header string 5619>>&0x00 search ##samtoolsVersion= 5620>>>&0x00 string x \b, generated by SAMtools version %s 5621 5622 5623############################################################################### 5624# BCF (Binary Call Format), version 2.2 5625# used by SAMtools (https://samtools.github.io/hts-specs/BCFv2_qref.pdf) 5626# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it 5627############################################################################### 56280 string BCF\2\2 Binary Call Format (BCF) version 2.2 5629# length of header text 5630>&0x00 lelong >0 5631# have header string 5632>>&0x00 search ##samtoolsVersion= 5633>>>&0x00 string x \b, generated by SAMtools version %s 5634 5635############################################################################### 5636# VCF (Variant Call Format) 5637# used by VCFtools (http://vcftools.sourceforge.net/) 5638############################################################################### 56390 search ##fileformat=VCFv Variant Call Format (VCF) 5640>&0 string x \b version %s 5641 5642############################################################################### 5643# FASTQ 5644# used by MAQ (http://maq.sourceforge.net/fastq.shtml) 5645############################################################################### 5646# XXX Broken? 5647# @<seqname> 5648#0 regex =^@[A-Za-z0-9_.:-]+\?\n 5649# <seq> 5650#>&1 regex =^[A-Za-z\n.~]++ 5651# +[<seqname>] 5652#>>&1 regex =^[A-Za-z0-9_.:-]*\?\n 5653# <qual> 5654#>>>&1 regex =^[!-~\n]+\n FASTQ 5655 5656############################################################################### 5657# FASTA 5658# used by FASTA (https://fasta.bioch.virginia.edu/fasta_www2/fasta_guide.pdf) 5659############################################################################### 5660#0 byte 0x3e 5661# q>0 regex =^[>][!-~\t\ ]+$ 5662# Amino Acid codes: [A-IK-Z*-]+ 5663#>>1 regex !=[!-'Jj;:=?@^`|~\\] FASTA 5664# IUPAC codes/gaps: [ACGTURYKMSWBDHVNX-]+ 5665# not in IUPAC codes/gaps: [EFIJLOPQZ] 5666#>>>1 regex !=[EFIJLOPQZefijlopqz] \b, with IUPAC nucleotide codes 5667#>>>1 regex =^[EFIJLOPQZefijlopqz]+$ \b, with Amino Acid codes 5668 5669############################################################################### 5670# SAM (Sequence Alignment/Map format) 5671# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf) 5672############################################################################### 5673# Short-cut version to recognise SAM files with (optional) header at beginning 5674############################################################################### 56750 string @HD\t 5676>4 search VN: Sequence Alignment/Map (SAM), with header 5677>>&0 regex [0-9.]+ \b version %s 5678############################################################################### 5679# Longer version to recognise SAM alignment lines using (many) regexes 5680############################################################################### 5681# SAM Alignment QNAME 56820 regex =^[!-?A-~]{1,255}(\t[^\t]+){11} 5683# SAM Alignment FLAG 5684>0 regex =^([^\t]+\t){1}[0-9]{1,5}\t 5685# SAM Alignment RNAME 5686>>0 regex =^([^\t]+\t){2}\\*|[^*=]*\t 5687# SAM Alignment POS 5688>>>0 regex =^([^\t]+\t){3}[0-9]{1,9}\t 5689# SAM Alignment MAPQ 5690>>>>0 regex =^([^\t]+\t){4}[0-9]{1,3}\t 5691# SAM Alignment CIGAR 5692>>>>>0 regex =\t(\\*|([0-9]+[MIDNSHPX=])+)\t 5693# SAM Alignment RNEXT 5694>>>>>>0 regex =\t(\\*|=|[!-()+->?-~][!-~]*)\t 5695# SAM Alignment PNEXT 5696>>>>>>>0 regex =^([^\t]+\t){7}[0-9]{1,9}\t 5697# SAM Alignment TLEN 5698>>>>>>>>0 regex =\t[+-]{0,1}[0-9]{1,9}\t.*\t 5699# SAM Alignment SEQ 5700>>>>>>>>>0 regex =^([^\t]+\t){9}(\\*|[A-Za-z=.]+)\t 5701# SAM Alignment QUAL 5702>>>>>>>>>>0 regex =^([^\t]+\t){10}[!-~]+ Sequence Alignment/Map (SAM) 5703>>>>>>>>>>>0 regex =^[@]HD\t.*VN: \b, with header 5704>>>>>>>>>>>>&0 regex =[0-9.]+ \b version %s 5705 5706############################################################################## 5707# 5708# Magic ids for biomedical signal file formats 5709# Copyright (C) 2018 Alois Schloegl <alois.schloegl@gmail.com> 5710# 5711# The list has been derived from biosig projects 5712# http://biosig.sourceforge.net 5713# https://pub.ist.ac.at/~schloegl/matlab/eeg/ 5714# https://pub.ist.ac.at/~schloegl/biosig/TESTED 5715# 5716############################################################################## 5717# 57180 string ABF\x20 Biosig/Axon Binary format 5719!:mime biosig/abf2 57200 string ABF2\0\0 Biosig/Axon Binary format 5721!:mime biosig/abf2 5722# 57230 string ATES\x20MEDICA\x20SOFT.\x20EEG\x20for\x20Windows Biosig/ATES MEDICA SOFT. EEG for Windows 5724!:mime biosig/ates 5725# 57260 string ATF\x09 Biosig/Axon Text fomrat 5727!:mime biosig/atf 5728# 57290 string ADU1 Biosig/Axona file format 5730!:mime biosig/axona 57310 string ADU2 Biosig/Axona file format 5732!:mime biosig/axona 5733# 57340 string ALPHA-TRACE-MEDICAL Biosig/alpha trace 5735!:mime biosig/alpha 5736# 57370 string AxGr Biosig/AXG 57380 string axgx Biosig/AXG 5739!:mime biosig/axg 5740# 57410 string HeaderLen= Biosig/BCI2000 57420 string BCI2000V Biosig/BCI2000 5743!:mime biosig/bci2000 5744# 5745### Specification: https://www.biosemi.com/faq/file_format.htm 57460 string \xffBIOSEMI Biosig/Biosemi data format 5747!:mime biosig/bdf 5748# 57490 string Brain\x20Vision\x20Data\x20Exchange\x20Header\x20File Biosig/Brainvision data file 57500 string Brain\x20Vision\x20V-Amp\x20Data\x20Header\x20File\x20Version Biosig/Brainvision V-Amp file 57510 string Brain\x20Vision\x20Data\x20Exchange\x20Marker\x20File,\x20Version Biosig/Brainvision Marker file 5752!:mime biosig/brainvision 5753# 57540 string CEDFILE Biosig/CFS: Cambridge Electronic devices File format 5755!:mime biosig/ced 5756# 5757### Specification: https://www.edfplus.info/specs/index.html 57580 string 0\x20\x20\x20\x20\x20\x20\x20 Biosig/EDF: European Data format 5759!:mime biosig/edf 5760# 5761### Specifications: https://arxiv.org/abs/cs/0608052 57620 string GDF Biosig/GDF: General data format for biosignals 5763!:mime biosig/gdf 5764# 57650 string DATA\0\0\0\0 Biosig/Heka Patchmaster 57660 string DAT1\0\0\0\0 Biosig/Heka Patchmaster 57670 string DAT2\0\0\0\0 Biosig/Heka Patchmaster 5768!:mime biosig/heka 5769# 57700 string (C)\x20CED\x2087 Biosig/CED SMR 5771!:mime biosig/ced-smr 5772# 57730 string CFWB\1\0\0\0 Biosig/CFWB 5774!:mime biosig/cfwb 5775# 57760 string DEMG Biosig/DEMG 5777!:mime biosig/demg 5778# 57790 string EBS\x94\x0a\x13\x1a\x0d Biosig/EBS 5780!:mime biosig/ebs 5781# 57820 string Embla\x20data\x20file Biosig/Embla 5783!:mime biosig/embla 5784# 57850 string Header\r\nFile Version Biosig/ETG4000 5786!:mime biosig/etg4000 5787# 57880 string GALILEO\x20EEG\x20TRACE\x20FILE Biosig/Galileo 5789!:mime biosig/galileo 5790# 57910 string IGOR Biosig/IgorPro ITX file 5792!:mime biosig/igorpro 5793# 5794# Specification: http://www.ampsmedical.com/uploads/2017-12-7/The_ISHNE_Format.pdf 57950 string ISHNE1.0 Biosig/ISHNE 5796!:mime biosig/ishne 5797# 5798# CEN/ISO 11073/22077 series, http://www.mfer.org/en/document.htm 57990 string @\x20\x20MFER\x20 Biosig/MFER 58000 string @\x20MFR\x20 Biosig/MFER 5801!:mime biosig/mfer 5802# 58030 string NEURALEV Biosig/NEV 58040 string N.EV.\0 Biosig/NEV 5805!:mime biosig/nev 5806# 58070 string NEX1 Biosig/NEX 5808!:mime biosig/nex1 5809# 58100 string PLEX Biosig/Plexon v1.0 581110 string PLEXON Biosig/Plexon v2.0 5812!:mime biosig/plexon 5813# 58140 string \x02\x27\x91\xC6 Biosig/RHD2000: Intan RHD2000 format 5815# 5816# Specification: CEN 1064:2005/ISO 11073:91064 581716 string SCPECG\0\0 Biosig/SCP-ECG format CEN 1064:2005/ISO 11073:91064 5818!:mime biosig/scpecg 5819# 58200 string IAvSFo Biosig/SIGIF 5821!:mime biosig/sigif 5822# 58230 string POLY\x20SAMPLE\x20FILEversion\x20 Biosig/TMS32 5824!:mime biosig/tms32 5825# 58260 string FileId=TMSi\x20PortiLab\x20sample\x20log\x20file\x0a\x0dVersion= Biosig/TMSiLOG 5827!:mime biosig/tmsilog 5828# 58294 string Synergy\0\48\49\50\46\48\48\51\46\48\48\48\46\48\48\48\0\28\0\0\0\2\0\0\0 5830>63 string CRawDataElement 5831>>85 string CRawDataBuffer Biosig/SYNERGY 5832!:mime biosig/synergy 5833# 58344 string \40\0\4\1\44\1\102\2\146\3\44\0\190\3 Biosig/UNIPRO 5835!:mime biosig/unipro 5836# 58370 string VER=9\r\nCTIME= Biosig/WCP 5838!:mime biosig/wcp 5839# 58400 string \xAF\xFE\xDA\xDA Biosig/Walter Graphtek 58410 string \xDA\xDA\xFE\xAF Biosig/Walter Graphtek 58420 string \x55\x55\xFE\xAF Biosig/Walter Graphtek 5843!:mime biosig/walter-graphtek 5844# 58450 string V3.0\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20 5846>32 string [PatInfo] Biosig/Sigma 5847!:mime biosig/sigma 5848# 58490 string \067\069\078\013\010\0x1a\04\0x84 Biosig/File exchange format (FEF) 5850!:mime biosig/fef 58510 string \67\69\78\0x13\0x10\0x1a\4\0x84 Biosig/File exchange format (FEF) 5852!:mime biosig/fef 5853# 58540 string \0\0\0\x64\0\0\0\x1f\0\0\0\x14\0\0\0\0\0\1 5855>36 string \0\0\0\x65\0\0\0\3\0\0\0\4\0\0 5856>>56 string \0\0\0\x6a\0\0\0\3\0\0\0\4\0\0\0\0\xff\xff\xff\xff\0\0 Biosig/FIFF 5857!:mime biosig/fiff 5858# 5859 5860#------------------------------------------------------------------------------ 5861# $File: blackberry,v 1.2 2017/03/17 21:35:28 christos Exp $ 5862# blackberry: file(1) magic for BlackBerry file formats 5863# 58645 belong 0 5865>8 belong 010010010 BlackBerry RIM ETP file 5866>>22 string x \b for %s 5867# Berkeley Lab Checkpoint Restart (BLCR) checkpoint context files 5868# https://ftg.lbl.gov/checkpoint 58690 string C\0\0\0R\0\0\0 BLCR 5870>16 lelong 1 x86 5871>16 lelong 3 alpha 5872>16 lelong 5 x86-64 5873>16 lelong 7 ARM 5874>8 lelong x context data (little endian, version %d) 5875# Uncomment the following only of your "file" program supports "search" 5876#>0 search/1024 VMA\06 for kernel 5877#>>&1 byte x %d. 5878#>>&2 byte x %d. 5879#>>&3 byte x %d 58800 string \0\0\0C\0\0\0R BLCR 5881>16 belong 2 SPARC 5882>16 belong 4 ppc 5883>16 belong 6 ppc64 5884>16 belong 7 ARMEB 5885>16 belong 8 SPARC64 5886>8 belong x context data (big endian, version %d) 5887# Uncomment the following only of your "file" program supports "search" 5888#>0 search/1024 VMA\06 for kernel 5889#>>&1 byte x %d. 5890#>>&2 byte x \b%d. 5891#>>&3 byte x \b%d 5892 5893#------------------------------------------------------------------------------ 5894# $File: blender,v 1.8 2019/04/19 00:42:27 christos Exp $ 5895# blender: file(1) magic for Blender 3D related files 5896# 5897# Native format rule v1.2. For questions use the developers list 5898# https://lists.blender.org/mailman/listinfo/bf-committers 5899# GLOB chunk was moved near start and provides subversion info since 2.42 5900 59010 string =BLENDER Blender3D, 5902>7 string =_ saved as 32-bits 5903>>8 string =v little endian 5904>>>9 byte x with version %c. 5905>>>10 byte x \b%c 5906>>>11 byte x \b%c 5907>>>0x40 string =GLOB \b. 5908>>>>0x58 leshort x \b%.4d 5909>>8 string =V big endian 5910>>>9 byte x with version %c. 5911>>>10 byte x \b%c 5912>>>11 byte x \b%c 5913>>>0x40 string =GLOB \b. 5914>>>>0x58 beshort x \b%.4d 5915>7 string =- saved as 64-bits 5916>>8 string =v little endian 5917>>9 byte x with version %c. 5918>>10 byte x \b%c 5919>>11 byte x \b%c 5920>>0x44 string =GLOB \b. 5921>>>0x60 leshort x \b%.4d 5922>>8 string =V big endian 5923>>>9 byte x with version %c. 5924>>>10 byte x \b%c 5925>>>11 byte x \b%c 5926>>>0x44 string =GLOB \b. 5927>>>>0x60 beshort x \b%.4d 5928 5929# Scripts that run in the embedded Python interpreter 59300 string #!BPY Blender3D BPython script 5931 5932#------------------------------------------------------------------------------ 5933# $File: blit,v 1.8 2009/09/19 16:28:08 christos Exp $ 5934# blit: file(1) magic for 68K Blit stuff as seen from 680x0 machine 5935# 5936# Note that this 0407 conflicts with several other a.out formats... 5937# 5938# XXX - should this be redone with "be" and "le", so that it works on 5939# little-endian machines as well? If so, what's the deal with 5940# "VAX-order" and "VAX-order2"? 5941# 5942#0 long 0407 68K Blit (standalone) executable 5943#0 short 0407 VAX-order2 68K Blit (standalone) executable 59440 short 03401 VAX-order 68K Blit (standalone) executable 59450 long 0406 68k Blit mpx/mux executable 59460 short 0406 VAX-order2 68k Blit mpx/mux executable 59470 short 03001 VAX-order 68k Blit mpx/mux executable 5948# Need more values for WE32 DMD executables. 5949# Note that 0520 is the same as COFF 5950#0 short 0520 tty630 layers executable 5951 5952#------------------------------------------------------------------------------ 5953# $File: bout,v 1.5 2009/09/19 16:28:08 christos Exp $ 5954# i80960 b.out objects and archives 5955# 59560 long 0x10d i960 b.out relocatable object 5957>16 long >0 not stripped 5958# 5959# b.out archive (hp-rt on i960) 59600 string =!<bout> b.out archive 5961>8 string __.SYMDEF random library 5962 5963#------------------------------------------------------------------------------ 5964# $File: bsdi,v 1.7 2014/03/29 15:40:34 christos Exp $ 5965# bsdi: file(1) magic for BSD/OS (from BSDI) objects 5966# Some object/executable formats use the same magic numbers as are used 5967# in other OSes; those are handled by entries in aout. 5968# 5969 59700 lelong 0314 386 compact demand paged pure executable 5971>16 lelong >0 not stripped 5972>32 byte 0x6a (uses shared libs) 5973 5974# same as in SunOS 4.x, except for static shared libraries 59750 belong&077777777 0600413 SPARC demand paged 5976>0 byte &0x80 5977>>20 belong <4096 shared library 5978>>20 belong =4096 dynamically linked executable 5979>>20 belong >4096 dynamically linked executable 5980>0 byte ^0x80 executable 5981>16 belong >0 not stripped 5982>36 belong 0xb4100001 (uses shared libs) 5983 59840 belong&077777777 0600410 SPARC pure 5985>0 byte &0x80 dynamically linked executable 5986>0 byte ^0x80 executable 5987>16 belong >0 not stripped 5988>36 belong 0xb4100001 (uses shared libs) 5989 59900 belong&077777777 0600407 SPARC 5991>0 byte &0x80 dynamically linked executable 5992>0 byte ^0x80 executable 5993>16 belong >0 not stripped 5994>36 belong 0xb4100001 (uses shared libs) 5995# Chiasmus is an encryption standard developed by the German Federal 5996# Office for Information Security (Bundesamt fuer Sicherheit in der 5997# Informationstechnik). 5998 5999# Extension: .xia 60000 string XIA1 Chiasmus encrypted data 6001 6002# Extension: .xis 60030 string XIS Chiasmus key 6004 6005#------------------------------------------------------------------------------ 6006# $File: btsnoop,v 1.5 2009/09/19 16:28:08 christos Exp $ 6007# BTSnoop: file(1) magic for BTSnoop files 6008# 6009# From <marcel@holtmann.org> 60100 string btsnoop\0 BTSnoop 6011>8 belong x version %d, 6012>12 belong 1001 Unencapsulated HCI 6013>12 belong 1002 HCI UART (H4) 6014>12 belong 1003 HCI BCSP 6015>12 belong 1004 HCI Serial (H5) 6016>>12 belong x type %d 6017 6018#------------------------------------------------------------------------------ 6019# $File: c64,v 1.7 2017/11/15 12:19:06 christos Exp $ 6020# c64: file(1) magic for various commodore 64 related files 6021# 6022# From: Dirk Jagdmann <doj@cubic.org> 6023 60240x16500 belong 0x12014100 D64 Image 60250x16500 belong 0x12014180 D71 Image 60260x61800 belong 0x28034400 D81 Image 60270 string C64\40CARTRIDGE CCS C64 Emultar Cartridge Image 60280 belong 0x43154164 X64 Image 6029 60300 string GCR-1541 GCR Image 6031>8 byte x version: %i 6032>9 byte x tracks: %i 6033 60349 string PSUR ARC archive (c64) 60352 string -LH1- LHA archive (c64) 6036 60370 string C64File PC64 Emulator file 6038>8 string >\0 "%s" 60390 string C64Image PC64 Freezer Image 6040 60410 beshort 0x38CD C64 PCLink Image 60420 string CBM\144\0\0 Power 64 C64 Emulator Snapshot 6043 60440 belong 0xFF424CFF WRAptor packer (c64) 6045 60460 string C64S\x20tape\x20file T64 tape Image 6047>32 leshort x Version:0x%x 6048>36 leshort !0 Entries:%i 6049>40 string x Name:%.24s 6050 60510 string C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image 6052>32 leshort x Version:0x%x 6053>36 leshort !0 Entries:%i 6054>40 string x Name:%.24s 6055 60560 string C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image 6057>32 leshort x Version:0x%x 6058>36 leshort !0 Entries:%i 6059>40 string x Name:%.24s 6060 6061# Raw tape file format (.tap files) 6062# Esa Hyyti <esa@netlab.tkk.fi> 60630 string C64-TAPE-RAW C64 Raw Tape File (.tap), 6064>0x0c byte x Version:%u, 6065>0x10 lelong x Length:%u cycles 6066 6067# magic for Goattracker2, http://covertbitops.c64.org/ 6068# from Alex Myczko <alex@aiei.ch> 60690 string GTS5 GoatTracker 2 song 6070>4 string >\0 \b, "%s" 6071>36 string >\0 \b by %s 6072>68 string >\0 \b (C) %s 6073>100 byte >0 \b, %u subsong(s) 6074 6075 6076#------------------------------------------------------------------------------ 6077# $File: cad,v 1.23 2020/05/30 23:58:07 christos Exp $ 6078# autocad: file(1) magic for cad files 6079# 6080 6081# Microstation DGN/CIT Files (www.bentley.com) 6082# Last updated July 29, 2005 by Lester Hightower 6083# DGN is the default file extension of Microstation/Intergraph CAD files. 6084# CIT is the proprietary raster format (similar to TIFF) used to attach 6085# raster underlays to Microstation DGN (vector) drawings. 6086# 6087# http://www.wotsit.org/search.asp 6088# https://filext.com/detaillist.php?extdetail=DGN 6089# https://filext.com/detaillist.php?extdetail=CIT 6090# 6091# https://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2 6092# 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928 6093# https://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682 6094# 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F 6095# 6096# URL: https://en.wikipedia.org/wiki/MicroStation 6097# reference: http://dgnlib.maptools.org/dgn.html 6098# http://dgnlib.maptools.org/dl/ref18.pdf 6099# Update: Joerg Jenderek 6100# Note: verfied by command like `dgndump seed2d_b.dgn` 6101# test for level 8 and type 5 or 9 61020 beshort&0x3F73 0x0801 6103# level of element like 8 6104#>0 ubyte&0x3F x \b, level %u 6105#>0 ubyte &0x80 \b, complex 6106#>0 ubyte &0x40 \b, reserved 6107# type of element 9~TCB 8~Digitizer setup 5~Group Data Elements 6108#>1 ubyte&0x7F x \b, type %u 6109# words to follow in element: 17H~CEL libray 2FEh~DGN 9FEh,DFEh~CIT 6110#>2 uleshort x \b, words 0x%4.4x to follow 6111# test for 3 reserved 0 bytes in CIT or "conversion" in ViewInfo structure (DGN CEL) 6112#>508 ubelong x \b, RESERVED %8.8x 6113>508 ubelong&0xFFffFF00 =0 6114# test for level 8 and type 9 for INGR raster image 6115>>0 beshort 0x0809 6116# test for length of 1st element is multiple of blocks a 512 bytes 6117>>>2 ubyte 0xfe 6118>>>>0 use ingr-image 6119# test for DGN or CEL by jump words (uleshort) forward to next element 6120>(2.s*2) ulong x 6121# 2nd element type: 8~Digitizer~DesiGNfile 1~library cell header other~CIT 6122#>>&1 ubyte&0x7F x \b, 2nd type %u 6123# DGN 6124>>&1 ubyte&0x7F 8 6125>>>2 uleshort =0x02FE Bentley/Intergraph Microstation CAD drawing 6126!:mime application/x-bentley-dgn 6127!:ext dgn 6128# The 0x40 bit of this byte is 1 if the file is 3D, otherwise 0 6129>>>>1214 ubyte &0x40 3D 6130>>>>1214 ubyte ^0x40 2D 6131# 2 chars for name of subunits like ft FT in IN mu m mm '\0 '\040 6132>>>>1120 string x \b, units %-.2s 6133# 2 chars for name of master unit like IN in ML SU tn th TH HU mm "\0 "\040 \0\0 6134>>>>1122 string >\0 %-.2s 6135#>>>>1120 ubelong x \b, units 0x%8.8x 6136# element range low,high x y z like xlow=0 08010000h 01080000h 6137#>>>>4 ubelong !0 \b, xlow %8.8x 6138#>>>>8 ubelong !0 \b, ylow %8.8x 6139#>>>>12 ubelong !0 \b, zlow %8.8x 6140#>>>>16 ubelong !0 \b, xhigh %8.8x 6141#>>>>20 ubelong !0 \b, yhigh %8.8x 6142#>>>>24 ubelong !0 \b, zhigh %8.8x 6143# graphic group number; all other elements in that group have same non-0 number 6144#>>>>28 leshort x \b, grphgrp 0x%4.4x 6145# words to optional attribute linkage 6146#>>>>30 ubyte x \b, attindx \%o 6147#>>>>31 ubyte x \b\%o 6148# >>30 string \026\105 DGNFile 6149# >>30 string \034\105 DGNFile 6150# >>30 string \073\107 DGNFile 6151# >>30 string \073\110 DGNFile 6152# >>30 string \106\107 DGNFile 6153# >>30 string \110\103 DGNFile 6154# >>30 string \120\104 DGNFile 6155# >>30 string \172\104 DGNFile 6156# >>30 string \172\105 DGNFile 6157# >>30 string \172\106 DGNFile 6158# >>30 string \234\106 DGNFile 6159# >>30 string \273\105 DGNFile 6160# >>30 string \306\106 DGNFile 6161# >>30 string \310\104 DGNFile 6162# >>30 string \341\104 DGNFile 6163# >>30 string \372\103 DGNFile 6164# >>30 string \372\104 DGNFile 6165# >>30 string \372\106 DGNFile 6166# >>30 string \376\103 DGNFile 6167# elements properties indicator 6168#>>>>32 uleshort !0 \b, properties 0x%4.4x 6169# class 0~Primary 6170#>>>>>32 uleshort&0x000F !0 \b, class 0x%4.4x 6171# Symbology 6172#>>>>>34 uleshort x \b, Symbology 0x%4.4x 6173# test for 2nd element type 1~library cell header 6174>>&1 ubyte&0x7F 1 6175# test for 1st element with level 8 and type 5 for cell library 6176>>>0 beshort 0x0805 Bentley/Intergraph Microstation CAD cell library 6177!:mime application/x-bentley-cel 6178!:ext cel 6179# 6180# URL: http://fileformats.archiveteam.org/wiki/Intergraph_Raster 6181# reference: https://web.archive.org/web/20140903185431/ 6182# http://oreilly.com/www/centers/gff/formats/ingr/index.htm 6183# note: verfied by command like `nconvert -fullinfo LONGLAT.CIT` 6184# display information for intergraph raster bitmap 61850 name ingr-image 6186# in 5.37 "Microstation CITFile" "Bentley/Intergraph MicroStation CIT raster CAD" 6187# DataTypeCode indicates format, depth of the pixel data and used compression 6188>4 uleshort x Intergraph raster image 6189>>4 uleshort 0x0009 \b, Run-Length Encoded 1-bit 6190!:mime image/x-intergraph-rle 6191!:ext rel 6192>>4 uleshort 0x0018 \b, CCITT Group 4 1-bit 6193!:mime image/x-intergraph-cit 6194!:ext cit 6195>>4 uleshort 27 \b, Adaptive RLE RGB 6196!:mime image/x-intergraph-rgb 6197!:ext rgb 6198>>4 default x 6199>>>4 uleshort x \b, Type %u 6200!:mime image/x-intergraph 6201# TODO: 6202#>4 uleshort 0 \b, no data 6203# ... 6204#>4 uleshort 0x0045 \b, Continuous Tone CMKY (Uncompressed) 6205# ApplicationType: 0~generic raster image 3~drawing, scanning 6206# 8~I/IMAGE and MicroStation Imager 9~ModelView 6207>6 uleshort !0 \b, ApplicationType %u 6208#>6 uleshort x \b, ApplicationType %u 6209# XViewOrigin; Raster grid data X origin 6210#>8 ulequad !0 \b, XViewOrigin %llx 6211# PixelsPerLine is the number of pixels in a scan line of bitmapp 6212>184 ulelong x \b, %u x 6213# NumberOfLines is height of the raster data in scanlines 6214>188 ulelong x %u 6215# DeviceResolution; resolution of scanning device 6216# positive indicates number of micros between lines; negative indicates DPI 6217#>192 leshort x \b, DeviceResolution %d 6218# ScanlineOrient indicates the origin and the orientation of the scan lines 6219#>194 ubyte x \b, ScanlineOrient %x 6220>194 ubyte x \b, orientation 6221>194 ubyte &0x01 right 6222>194 ubyte ^0x01 left 6223>194 ubyte &0x02 down 6224>194 ubyte ^0x02 top 6225>194 ubyte &0x04 horizontal 6226>194 ubyte ^0x04 vertical 6227# ScannableFlag; Scanline indexing method used 6228#>195 ubyte !0 \b, ScannableFlag 0x%x 6229# RotationAngle; Rotation angle of raster data 6230#>196 ubequad !0 \b, RotationAngle 0x%llx 6231# SkewAngle; Skew angle of raster data 6232#>204 ubequad !0 \b, SkewAngle %llx 6233# DataTypeModifier; Additional raster data format info 6234#>212 uleshort !0 \b, DataTypeModifier 0x%4.4x 6235# DesignFile[66]; Name of the design file 6236>214 string >\0 \b, DesignFile %-.66s 6237# DatabaseFile[66]; Name of the database file 6238>280 string >\0 \b, DatabaseFile %-.66s 6239# ParentGridFile[66]; Name of parent grid file 6240>346 string >\0 \b, ParentGridFile %-.66s 6241# FileDescription[80]; Text description of file and contents 6242>412 string >\0 \b, FileDescription %-.80s 6243# MinValue 6244#>492 ubequad !0 \b, MinValue 0x%llx 6245# MaxValue 6246#>500 ubequad !0 \b, MaxValue 0x%llx 6247# Reserved[3]; Unused (always 0) 6248#>508 ubelong&0xFFffFF00 x \b, RESERVED %8.8x 6249# GridFileVersion; Grid File Version like 2 3 6250#>511 ubyte x \b, GridFileVersion %x 6251 6252# AutoCAD 6253# Merge of the different contributions and updates from https://en.wikipedia.org/wiki/Dwg 6254# and https://www.iana.org/assignments/media-types/image/vnd.dwg 62550 string MC0.0 DWG AutoDesk AutoCAD Release 1.0 6256!:mime image/vnd.dwg 62570 string AC1.2 DWG AutoDesk AutoCAD Release 1.2 6258!:mime image/vnd.dwg 62590 string AC1.3 DWG AutoDesk AutoCAD Release 1.3 6260!:mime image/vnd.dwg 62610 string AC1.40 DWG AutoDesk AutoCAD Release 1.40 6262!:mime image/vnd.dwg 62630 string AC1.50 DWG AutoDesk AutoCAD Release 2.05 6264!:mime image/vnd.dwg 62650 string AC2.10 DWG AutoDesk AutoCAD Release 2.10 6266!:mime image/vnd.dwg 62670 string AC2.21 DWG AutoDesk AutoCAD Release 2.21 6268!:mime image/vnd.dwg 62690 string AC2.22 DWG AutoDesk AutoCAD Release 2.22 6270!:mime image/vnd.dwg 62710 string AC1001 DWG AutoDesk AutoCAD Release 2.22 6272!:mime image/vnd.dwg 62730 string AC1002 DWG AutoDesk AutoCAD Release 2.50 6274!:mime image/vnd.dwg 62750 string AC1003 DWG AutoDesk AutoCAD Release 2.60 6276!:mime image/vnd.dwg 62770 string AC1004 DWG AutoDesk AutoCAD Release 9 6278!:mime image/vnd.dwg 62790 string AC1006 DWG AutoDesk AutoCAD Release 10 6280!:mime image/vnd.dwg 62810 string AC1009 DWG AutoDesk AutoCAD Release 11/12 6282!:mime image/vnd.dwg 6283# AutoCAD DWG versions R13/R14 (www.autodesk.com) 6284# Written December 01, 2003 by Lester Hightower 6285# Based on the DWG File Format Specifications at http://www.opendwg.org/ 6286# AutoCad, from Nahuel Greco 6287# AutoCAD DWG versions R12/R13/R14 (www.autodesk.com) 62880 string AC1012 DWG AutoDesk AutoCAD Release 13 6289!:mime image/vnd.dwg 62900 string AC1014 DWG AutoDesk AutoCAD Release 14 6291!:mime image/vnd.dwg 62920 string AC1015 DWG AutoDesk AutoCAD 2000/2002 6293!:mime image/vnd.dwg 6294 6295# A new version of AutoCAD DWG 6296# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru, 6297# ICQ 358572321) 6298# From various sources like: 6299# https://autodesk.blogs.com/between_the_lines/autocad-release-history.html 63000 string AC1018 DWG AutoDesk AutoCAD 2004/2005/2006 6301!:mime image/vnd.dwg 63020 string AC1021 DWG AutoDesk AutoCAD 2007/2008/2009 6303!:mime image/vnd.dwg 63040 string AC1024 DWG AutoDesk AutoCAD 2010/2011/2012 6305!:mime image/vnd.dwg 63060 string AC1027 DWG AutoDesk AutoCAD 2013-2017 6307!:mime image/vnd.dwg 6308 6309# From GNU LibreDWG 63100 string AC1032 DWG AutoDesk AutoCAD 2018/2019 6311!:mime image/vnd.dwg 6312 6313# KOMPAS 2D drawing from ASCON 6314# This is KOMPAS 2D drawing or fragment of drawing but is not detailed nor 6315# gathered nor specification 6316# ASCON https://ascon.net/main/ in English, 6317# https://ascon.ru/ main site in Russian 6318# Extension is CDW for drawing and FRW for fragment of drawing 6319# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru, 6320# ICQ 358572321, https://vkontakte.ru/id16076543) 6321# From: 6322# https://sd.ascon.ru/otrs/customer.pl?Action=CustomerFAQ&CategoryID=4&ItemID=292 6323# (in russian) and my experiments 63240 string KF 6325>2 belong 0x4E00000C Kompas drawing 12.0 SP1 6326>2 belong 0x4D00000C Kompas drawing 12.0 6327>2 belong 0x3200000B Kompas drawing 11.0 SP1 6328>2 belong 0x3100000B Kompas drawing 11.0 6329>2 belong 0x2310000A Kompas drawing 10.0 SP1 6330>2 belong 0x2110000A Kompas drawing 10.0 6331>2 belong 0x08000009 Kompas drawing 9.0 SP1 6332>2 belong 0x05000009 Kompas drawing 9.0 6333>2 belong 0x33010008 Kompas drawing 8+ 6334>2 belong 0x1A000008 Kompas drawing 8.0 6335>2 belong 0x2C010107 Kompas drawing 7+ 6336>2 belong 0x05000007 Kompas drawing 7.0 6337>2 belong 0x32000006 Kompas drawing 6+ 6338>2 belong 0x09000006 Kompas drawing 6.0 6339>2 belong 0x5C009005 Kompas drawing 5.11R03 6340>2 belong 0x54009005 Kompas drawing 5.11R02 6341>2 belong 0x51009005 Kompas drawing 5.11R01 6342>2 belong 0x22009005 Kompas drawing 5.10R03 6343>2 belong 0x22009005 Kompas drawing 5.10R02 mar 6344>2 belong 0x21009005 Kompas drawing 5.10R02 febr 6345>2 belong 0x19009005 Kompas drawing 5.10R01 6346>2 belong 0xF4008005 Kompas drawing 5.9R01.003 6347>2 belong 0x1C008005 Kompas drawing 5.9R01.002 6348>2 belong 0x11008005 Kompas drawing 5.8R01.003 6349 6350# CAD: file(1) magic for computer aided design files 6351# Phillip Griffith <phillip dot griffith at gmail dot com> 6352# AutoCAD magic taken from the Open Design Alliance's OpenDWG specifications. 6353# 6354 6355# 3DS (3d Studio files) 63560 leshort 0x4d4d 6357>6 leshort 0x2 6358>>8 lelong 0xa 6359>>>16 leshort 0x3d3d 3D Studio model 6360!:mime image/x-3ds 6361!:ext 3ds 6362 6363# MegaCAD 2D/3D drawing (.prt) 6364# https://megacad.de/ 6365# From: Markus Heidelberg <markus.heidelberg@web.de> 63660 string MegaCad23\0 MegaCAD 2D/3D drawing 6367 6368# Hoops CAD files 6369# https://docs.techsoft3d.com/visualize/3df/latest/build/general/hsf/\ 6370# HSF_architecture.html 6371# Stephane Charette <stephane.charette@gmail.com> 63720 string ;;\020HSF\020V OpenHSF (Hoops Stream Format) 6373>7 regex/9 V[.0-9]{4,5}\020 %s 6374!:ext hsf 6375 6376# AutoCAD Drawing Exchange Format 63770 regex \^[\ \t]*0\r?\000$ 6378>1 regex \^[\ \t]*SECTION\r?$ 6379>>2 regex \^[\ \t]*2\r?$ 6380>>>3 regex \^[\ \t]*HEADER\r?$ AutoCAD Drawing Exchange Format 6381!:mime application/x-dxf 6382!:ext dxf 6383>>>>&1 search/8192 AC1006 \b, R10 6384>>>>&1 search/8192 AC1009 \b, R11/R12 6385>>>>&1 search/8192 AC1012 \b, R13 6386>>>>&1 search/8192 AC1014 \b, R14 6387>>>>&1 search/8192 AC1015 \b, version 2000 6388>>>>&1 search/8192 AC1018 \b, version 2004 6389>>>>&1 search/8192 AC1021 \b, version 2007 6390>>>>&1 search/8192 AC1024 \b, version 2010 6391 6392# The Sketchup 3D model format https://www.sketchup.com/ 63930 string \xff\xfe\xff\x0e\x53\x00\x6b\x00\x65\x00\x74\x00\x63\x00\x68\x00\x55\x00\x70\x00\x20\x00\x4d\x00\x6f\x00\x64\x00\x65\x00\x6c\x00 SketchUp Model 6394!:mime application/vnd.sketchup.skp 6395!:ext skp 6396 63974 regex/b P[0-9][0-9]\\.[0-9][0-9][0-9][0-9]\\.[0-9][0-9][0-9][0-9]\\.[0-9] NAXOS CAD System file from version %s 6398!:strength +40 6399 6400#------------------------------------------------------------------------------ 6401# $File: cafebabe,v 1.24 2018/10/01 23:33:15 christos Exp $ 6402# Cafe Babes unite! 6403# 6404# Since Java bytecode and Mach-O universal binaries have the same magic number, 6405# the test must be performed in the same "magic" sequence to get both right. 6406# The long at offset 4 in a Mach-O universal binary tells the number of 6407# architectures; the short at offset 4 in a Java bytecode file is the JVM minor 6408# version and the short at offset 6 is the JVM major version. Since there are only 6409# only 18 labeled Mach-O architectures at current, and the first released 6410# Java class format was version 43.0, we can safely choose any number 6411# between 18 and 39 to test the number of architectures against 6412# (and use as a hack). Let's not use 18, because the Mach-O people 6413# might add another one or two as time goes by... 6414# 6415### JAVA START ### 64160 belong 0xcafebabe 6417>4 belong >30 compiled Java class data, 6418!:mime application/x-java-applet 6419>>6 beshort x version %d. 6420>>4 beshort x \b%d 6421# Which is which? 6422#>>4 belong 0x032d (Java 1.0) 6423#>>4 belong 0x032d (Java 1.1) 6424>>4 belong 0x002e (Java 1.2) 6425>>4 belong 0x002f (Java 1.3) 6426>>4 belong 0x0030 (Java 1.4) 6427>>4 belong 0x0031 (Java 1.5) 6428>>4 belong 0x0032 (Java 1.6) 6429>>4 belong 0x0033 (Java 1.7) 6430>>4 belong 0x0034 (Java 1.8) 6431 64320 belong 0xcafed00d JAR compressed with pack200, 6433>5 byte x version %d. 6434>4 byte x \b%d 6435!:mime application/x-java-pack200 6436 6437 64380 belong 0xcafed00d JAR compressed with pack200, 6439>5 byte x version %d. 6440>4 byte x \b%d 6441!:mime application/x-java-pack200 6442 6443### JAVA END ### 6444### MACH-O START ### 6445 64460 name mach-o \b [ 6447>0 use mach-o-cpu \b 6448>(8.L) indirect x \b: 6449>0 belong x \b] 6450 64510 belong 0xcafebabe 6452>4 belong 1 Mach-O universal binary with 1 architecture: 6453!:mime application/x-mach-binary 6454>>8 use mach-o \b 6455>4 belong >1 6456>>4 belong <20 Mach-O universal binary with %d architectures: 6457!:mime application/x-mach-binary 6458>>>8 use mach-o \b 6459>>4 belong >1 6460>>>28 use mach-o \b 6461>>4 belong >2 6462>>>48 use mach-o \b 6463>>4 belong >3 6464>>>68 use mach-o \b 6465>>4 belong >4 6466>>>88 use mach-o \b 6467>>4 belong >5 6468>>>108 use mach-o \b 6469 6470### MACH-O END ### 6471 6472#------------------------------------------------------------------------------ 6473# $File: cbor,v 1.1 2015/01/28 01:05:21 christos Exp $ 6474# cbor: file(1) magic for CBOR files as defined in RFC 7049 6475 64760 string \xd9\xd9\xf7 Concise Binary Object Representation (CBOR) container 6477!:mime application/cbor 6478>3 ubyte <0x20 (positive integer) 6479>3 ubyte <0x40 6480>>3 ubyte >0x1f (negative integer) 6481>3 ubyte <0x60 6482>>3 ubyte >0x3f (byte string) 6483>3 ubyte <0x80 6484>>3 ubyte >0x5f (text string) 6485>3 ubyte <0xa0 6486>3 ubyte >0x7f (array) 6487>3 ubyte <0xc0 6488>>3 ubyte >0x9f (map) 6489>3 ubyte <0xe0 6490>>3 ubyte >0xbf (tagged) 6491>3 ubyte >0xdf (other) 6492 6493#------------------------------------------------------------------------------ 6494# $File: cddb,v 1.4 2009/09/19 16:28:08 christos Exp $ 6495# CDDB: file(1) magic for CDDB(tm) format CD text data files 6496# 6497# From <steve@gracenote.com> 6498# 6499# This is the /etc/magic entry to decode datafiles as used by 6500# CDDB-enabled CD player applications. 6501# 6502 65030 search/1/w #\040xmcd CDDB(tm) format CD text data 6504 6505#------------------------------------------------------------------------------ 6506# $File: chord,v 1.5 2010/09/20 19:19:16 rrt Exp $ 6507# chord: file(1) magic for Chord music sheet typesetting utility input files 6508# 6509# From Philippe De Muyter <phdm@macqel.be> 6510# File format is actually free, but many distributed files begin with `{title' 6511# 65120 string {title Chord text file 6513 6514# Type: PowerTab file format 6515# URL: http://www.power-tab.net/ 6516# From: Jelmer Vernooij <jelmer@samba.org> 65170 string ptab\003\000 Power-Tab v3 Tablature File 65180 string ptab\004\000 Power-Tab v4 Tablature File 6519 6520#------------------------------------------------------------------------------ 6521# $File: cisco,v 1.4 2009/09/19 16:28:08 christos Exp $ 6522# cisco: file(1) magic for cisco Systems routers 6523# 6524# Most cisco file-formats are covered by the generic elf code 6525# 6526# Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha. 65270 belong&0xffffff00 0x85011400 cisco IOS microcode 6528>7 string >\0 for '%s' 65290 belong&0xffffff00 0x8501cb00 cisco IOS experimental microcode 6530>7 string >\0 for '%s' 6531 6532#------------------------------------------------------------------------------ 6533# $File: citrus,v 1.4 2009/09/19 16:28:08 christos Exp $ 6534# citrus locale declaration 6535# 6536 65370 string RuneCT Citrus locale declaration for LC_CTYPE 6538 6539#------------------------------------------------------------------------------ 6540# $File: c-lang,v 1.28 2019/11/15 21:03:14 christos Exp $ 6541# c-lang: file(1) magic for C and related languages programs 6542# 6543# The strength is to beat standard HTML 6544 6545# BCPL 65460 search/8192 "libhdr" BCPL source text 6547!:mime text/x-bcpl 65480 search/8192 "LIBHDR" BCPL source text 6549!:mime text/x-bcpl 6550 6551# C 6552# Check for class if include is found, otherwise class is beaten by include because of lowered strength 65530 search/8192 #include 6554>0 regex \^#include C 6555>>0 regex \^class[[:space:]]+ 6556>>>&0 regex \\{[\.\*]\\}(;)?$ \b++ 6557>>&0 clear x source text 6558!:strength + 13 6559!:mime text/x-c 65600 search/8192 pragma 6561>0 regex \^#[[:space:]]*pragma C source text 6562!:mime text/x-c 65630 search/8192 endif 6564>0 regex \^#[[:space:]]*(if\|ifn)def 6565>>&0 regex \^#[[:space:]]*endif$ C source text 6566!:mime text/x-c 65670 search/8192 define 6568>0 regex \^#[[:space:]]*(if\|ifn)def 6569>>&0 regex \^#[[:space:]]*define C source text 6570!:mime text/x-c 65710 search/8192 char 6572>0 regex \^[[:space:]]*char(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text 6573!:mime text/x-c 65740 search/8192 double 6575>0 regex \^[[:space:]]*double(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text 6576!:mime text/x-c 65770 search/8192 extern 6578>0 regex \^[[:space:]]*extern[[:space:]]+ C source text 6579!:mime text/x-c 65800 search/8192 float 6581>0 regex \^[[:space:]]*float(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text 6582!:mime text/x-c 65830 search/8192 struct 6584>0 regex \^struct[[:space:]]+ C source text 6585!:mime text/x-c 65860 search/8192 union 6587>0 regex \^union[[:space:]]+ C source text 6588!:mime text/x-c 65890 search/8192 main( 6590>&0 regex \\)[[:space:]]*\\{ C source text 6591!:mime text/x-c 6592 6593# C++ 6594# The strength of these rules is increased so they beat the C rules above 65950 search/8192 namespace 6596>0 regex \^namespace[[:space:]]+[_[:alpha:]]{1,30}[[:space:]]*\\{ C++ source text 6597!:strength + 30 6598!:mime text/x-c++ 6599# using namespace [namespace] or using std::[lib] 66000 search/8192 using 6601>0 regex \^using[[:space:]]+(namespace\ )?std(::)?[[:alpha:]]*[[:space:]]*; C++ source text 6602!:strength + 30 6603!:mime text/x-c++ 66040 search/8192 template 6605>0 regex \^[[:space:]]*template[[:space:]]*<.*>[[:space:]]*$ C++ source text 6606!:strength + 30 6607!:mime text/x-c++ 66080 search/8192 virtual 6609>0 regex \^[[:space:]]*virtual[[:space:]]+.*[};][[:space:]]*$ C++ source text 6610!:strength + 30 6611!:mime text/x-c++ 6612# But class alone is reduced to avoid beating php (Jens Schleusener) 66130 search/8192 class 6614>0 regex \^[[:space:]]*class[[:space:]]+[[:digit:][:alpha:]:_]+[[:space:]]*\\{(.*[\n]*)*\\}(;)?$ C++ source text 6615!:strength + 13 6616!:mime text/x-c++ 66170 search/8192 public 6618>0 regex \^[[:space:]]*public: C++ source text 6619!:strength + 30 6620!:mime text/x-c++ 66210 search/8192 private 6622>0 regex \^[[:space:]]*private: C++ source text 6623!:strength + 30 6624!:mime text/x-c++ 66250 search/8192 protected 6626>0 regex \^[[:space:]]*protected: C++ source text 6627!:strength + 30 6628!:mime text/x-c++ 6629 6630# Objective-C 66310 search/8192 #import 6632>0 regex \^#import Objective-C source text 6633!:strength + 25 6634!:mime text/x-objective-c 6635 6636# From: Mikhail Teterin <mi@aldan.algebra.com> 66370 string cscope cscope reference data 6638>7 string x version %.2s 6639# We skip the path here, because it is often long (so file will 6640# truncate it) and mostly redundant. 6641# The inverted index functionality was added some time between 6642# versions 11 and 15, so look for -q if version is above 14: 6643>7 string >14 6644>>10 search/100 \ -q\ with inverted index 6645>10 search/100 \ -c\ text (non-compressed) 6646 6647#------------------------------------------------------------------------------ 6648# $File: clarion,v 1.5 2014/04/30 21:41:02 christos Exp $ 6649# clarion: file(1) magic for # Clarion Personal/Professional Developer 6650# (v2 and above) 6651# From: Julien Blache <jb@jblache.org> 6652 6653# Database files 6654# signature 66550 leshort 0x3343 Clarion Developer (v2 and above) data file 6656# attributes 6657>2 leshort &0x0001 \b, locked 6658>2 leshort &0x0004 \b, encrypted 6659>2 leshort &0x0008 \b, memo file exists 6660>2 leshort &0x0010 \b, compressed 6661>2 leshort &0x0040 \b, read only 6662# number of records 6663>5 lelong x \b, %d records 6664 6665# Memo files 66660 leshort 0x334d Clarion Developer (v2 and above) memo data 6667 6668# Key/Index files 6669# No magic? :( 6670 6671# Help files 66720 leshort 0x49e0 Clarion Developer (v2 and above) help data 6673 6674#------------------------------------------------------------------------------ 6675# $File: claris,v 1.8 2016/07/18 19:23:38 christos Exp $ 6676# claris: file(1) magic for claris 6677# "H. Nanosecond" <aldomel@ix.netcom.com> 6678# Claris Works a word processor, etc. 6679# Version 3.0 6680 6681# .pct claris works clip art files 6682#0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 6683#* 6684#0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000 6685#null to byte 1000 octal 6686514 string \377\377\377\377\000 6687>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 Claris clip art 6688514 string \377\377\377\377\001 6689>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 Claris clip art 6690 6691# Claris works files 6692# .cwk 6693# Moved to Apple AppleWorks document 6694#0 string \002\000\210\003\102\117\102\117\000\001\206 Claris works document 6695# .plt 66960 string \020\341\000\000\010\010 Claris Works palette files .plt 6697 6698# .msp a dictionary file I am not sure about this I have only one .msp file 66990 string \002\271\262\000\040\002\000\164 Claris works dictionary 6700 6701# .usp are user dictionary bits 6702# I am not sure about a magic header: 6703#0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151 6704# soh S p f 8 U D sp ^ S cr nl p o d i 6705#0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043 6706# a t r i s t sp ^ S cr nl d i v sp # 6707 6708# .mth Thesaurus 6709# starts with \0 but no magic header 6710 6711# .chy Hyphenation file 6712# I am not sure: 000 210 034 000 000 6713 6714# other claris files 6715#./windows/claris/useng.ndx: data 6716#./windows/claris/xtndtran.l32: data 6717#./windows/claris/xtndtran.lst: data 6718#./windows/claris/clworks.lbl: data 6719#./windows/claris/clworks.prf: data 6720#./windows/claris/userd.spl: data 6721 6722#------------------------------------------------------------------------------ 6723# $File: clipper,v 1.8 2017/03/17 21:35:28 christos Exp $ 6724# clipper: file(1) magic for Intergraph (formerly Fairchild) Clipper. 6725# 6726# XXX - what byte order does the Clipper use? 6727# 6728# XXX - what's the "!" stuff: 6729# 6730# >18 short !074000,000000 C1 R1 6731# >18 short !074000,004000 C2 R1 6732# >18 short !074000,010000 C3 R1 6733# >18 short !074000,074000 TEST 6734# 6735# I shall assume it's ANDing the field with the first value and 6736# comparing it with the second, and rewrite it as: 6737# 6738# >18 short&074000 000000 C1 R1 6739# >18 short&074000 004000 C2 R1 6740# >18 short&074000 010000 C3 R1 6741# >18 short&074000 074000 TEST 6742# 6743# as SVR3.1's "file" doesn't support anything of the "!074000,000000" 6744# sort, nor does SunOS 4.x, so either it's something Intergraph added 6745# in CLIX, or something AT&T added in SVR3.2 or later, or something 6746# somebody else thought was a good idea; it's not documented in the 6747# man page for this version of "magic", nor does it appear to be 6748# implemented (at least not after I blew off the bogus code to turn 6749# old-style "&"s into new-style "&"s, which just didn't work at all). 6750# 67510 short 0575 CLIPPER COFF executable (VAX #) 6752>20 short 0407 (impure) 6753>20 short 0410 (5.2 compatible) 6754>20 short 0411 (pure) 6755>20 short 0413 (demand paged) 6756>20 short 0443 (target shared library) 6757>12 long >0 not stripped 6758>22 short >0 - version %d 67590 short 0577 CLIPPER COFF executable 6760>18 short&074000 000000 C1 R1 6761>18 short&074000 004000 C2 R1 6762>18 short&074000 010000 C3 R1 6763>18 short&074000 074000 TEST 6764>20 short 0407 (impure) 6765>20 short 0410 (pure) 6766>20 short 0411 (separate I&D) 6767>20 short 0413 (paged) 6768>20 short 0443 (target shared library) 6769>12 long >0 not stripped 6770>22 short >0 - version %d 6771>48 long&01 01 alignment trap enabled 6772>52 byte 1 -Ctnc 6773>52 byte 2 -Ctsw 6774>52 byte 3 -Ctpw 6775>52 byte 4 -Ctcb 6776>53 byte 1 -Cdnc 6777>53 byte 2 -Cdsw 6778>53 byte 3 -Cdpw 6779>53 byte 4 -Cdcb 6780>54 byte 1 -Csnc 6781>54 byte 2 -Cssw 6782>54 byte 3 -Cspw 6783>54 byte 4 -Cscb 67844 string pipe CLIPPER instruction trace 67854 string prof CLIPPER instruction profile 6786#------------------------------------------------------------------------------ 6787# file: file(1) magic for Clojure 6788# URL: https://clojure.org/ 6789# From: Jason Felice <jason.m.felice@gmail.com> 6790 67910 string/w #!\ /usr/bin/clj Clojure script text executable 6792!:mime text/x-clojure 67930 string/w #!\ /usr/local/bin/clj Clojure script text executable 6794!:mime text/x-clojure 67950 string/w #!\ /usr/bin/clojure Clojure script text executable 6796!:mime text/x-clojure 67970 string/w #!\ /usr/local/bin/clojure Clojure script text executable 6798!:mime text/x-clojure 67990 string/W #!/usr/bin/env\ clj Clojure script text executable 6800!:mime text/x-clojure 68010 string/W #!/usr/bin/env\ clojure Clojure script text executable 6802!:mime text/x-clojure 68030 string/W #!\ /usr/bin/env\ clj Clojure script text executable 6804!:mime text/x-clojure 68050 string/W #!\ /usr/bin/env\ clojure Clojure script text executable 6806!:mime text/x-clojure 6807 68080 regex \^\\\(ns[[:space:]]+[a-z] Clojure module source text 6809!:mime text/x-clojure 6810 68110 regex \^\\\(ns[[:space:]]+\\\^\\{: Clojure module source text 6812!:mime text/x-clojure 6813 68140 regex \^\\\(defn-?[[:space:]] Clojure module source text 6815!:mime text/x-clojure 6816 6817#------------------------------------------------------------------------------ 6818# $File: coff,v 1.3 2018/08/01 10:34:03 christos Exp $ 6819# coff: file(1) magic for Common Object Files not specific to known cpu types or manufactures 6820# 6821# COFF 6822# 6823# by Joerg Jenderek at Oct 2015 6824# https://en.wikipedia.org/wiki/COFF 6825# https://de.wikipedia.org/wiki/Common_Object_File_Format 6826# http://www.delorie.com/djgpp/doc/coff/filhdr.html 6827 6828# display name+variables+flags of Common Object Files Format (32bit) 6829# Maybe used also in adi,att3b,clipper,hitachi-sh,hp,ibm6000,intel, 6830# mips,motorola,msdos,osf1,sharc,varied.out,vax 68310 name display-coff 6832# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags 6833>18 uleshort&0x8E80 0 6834>>0 clear x 6835# f_magic - magic number 6836# DJGPP, 80386 COFF executable, MS Windows COFF Intel 80386 object file (./intel) 6837>>0 uleshort 0x014C Intel 80386 6838# Hitachi SH big-endian COFF (./hitachi-sh) 6839>>0 uleshort 0x0500 Hitachi SH big-endian 6840# Hitachi SH little-endian COFF (./hitachi-sh) 6841>>0 uleshort 0x0550 Hitachi SH little-endian 6842# executable (RISC System/6000 V3.1) or obj module (./ibm6000) 6843#>>0 uleshort 0x01DF 6844# MS Windows COFF Intel Itanium, AMD64 6845# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680313(v=vs.85).aspx 6846>>0 uleshort 0x0200 Intel ia64 6847>>0 uleshort 0x8664 Intel amd64 6848# TODO for other COFFs 6849#>>0 uleshort 0xABCD COFF_TEMPLATE 6850>>0 default x 6851>>>0 uleshort x type 0x%04x 6852>>0 uleshort x COFF 6853# F_EXEC flag bit 6854>>18 leshort ^0x0002 object file 6855#!:mime application/x-coff 6856#!:ext cof/o/obj/lib 6857>>18 leshort &0x0002 executable 6858#!:mime application/x-coffexec 6859# F_RELFLG flag bit,static object 6860>>18 leshort &0x0001 \b, no relocation info 6861# F_LNNO flag bit 6862>>18 leshort &0x0004 \b, no line number info 6863# F_LSYMS flag bit 6864>>18 leshort &0x0008 \b, stripped 6865>>18 leshort ^0x0008 \b, not stripped 6866# flags in other COFF versions 6867#0x0010 F_FDPR_PROF 6868#0x0020 F_FDPR_OPTI 6869#0x0040 F_DSA 6870# F_AR32WR flag bit 6871#>>>18 leshort &0x0100 \b, 32 bit little endian 6872#0x1000 F_DYNLOAD 6873#0x2000 F_SHROBJ 6874#0x4000 F_LOADONLY 6875# f_nscns - number of sections 6876>>2 uleshort <2 \b, %d section 6877>>2 uleshort >1 \b, %d sections 6878# f_timdat - file time & date stamp only for little endian 6879#>>4 date x \b, %s 6880# f_symptr - symbol table pointer, only for not stripped 6881>>8 ulelong >0 \b, symbol offset=0x%x 6882# f_nsyms - number of symbols, only for not stripped 6883>>12 ulelong >0 \b, %d symbols 6884# f_opthdr - optional header size 6885>>16 uleshort >0 \b, optional header size %d 6886# at offset 20 can be optional header, extra bytes FILHSZ-20 because 6887# do not rely on sizeof(FILHDR) to give the correct size for header. 6888# or first section header 6889# additional variables for other COFF files 6890# >20 beshort 0407 (impure) 6891# >20 beshort 0410 (pure) 6892# >20 beshort 0413 (demand paged) 6893# >20 beshort 0421 (standalone) 6894# >22 leshort >0 - version %d 6895# >168 string .lowmem Apple toolbox 6896 6897 6898#------------------------------------------------------------------------------ 6899# $File: commands,v 1.63 2020/06/06 15:36:30 christos Exp $ 6900# commands: file(1) magic for various shells and interpreters 6901# 6902#0 string/w : shell archive or script for antique kernel text 69030 string/wt #!\ /bin/sh POSIX shell script text executable 6904!:mime text/x-shellscript 69050 string/wb #!\ /bin/sh POSIX shell script executable (binary data) 6906!:mime text/x-shellscript 6907 69080 string/wt #!\ /bin/csh C shell script text executable 6909!:mime text/x-shellscript 6910 6911# korn shell magic, sent by George Wu, gwu@clyde.att.com 69120 string/wt #!\ /bin/ksh Korn shell script text executable 6913!:mime text/x-shellscript 69140 string/wb #!\ /bin/ksh Korn shell script executable (binary data) 6915!:mime text/x-shellscript 6916 69170 string/wt #!\ /bin/tcsh Tenex C shell script text executable 6918!:mime text/x-shellscript 69190 string/wt #!\ /usr/bin/tcsh Tenex C shell script text executable 6920!:mime text/x-shellscript 69210 string/wt #!\ /usr/local/tcsh Tenex C shell script text executable 6922!:mime text/x-shellscript 69230 string/wt #!\ /usr/local/bin/tcsh Tenex C shell script text executable 6924!:mime text/x-shellscript 6925 6926# 6927# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson) 69280 string/wt #!\ /bin/zsh Paul Falstad's zsh script text executable 6929!:mime text/x-shellscript 69300 string/wt #!\ /usr/bin/zsh Paul Falstad's zsh script text executable 6931!:mime text/x-shellscript 69320 string/wt #!\ /usr/local/bin/zsh Paul Falstad's zsh script text executable 6933!:mime text/x-shellscript 69340 search/1 #!/usr/bin/env\ zsh Paul Falstad's zsh script text executable 6935!:mime text/x-shellscript 6936 69370 string/wt #!\ /usr/local/bin/ash Neil Brown's ash script text executable 6938!:mime text/x-shellscript 69390 string/wt #!\ /usr/local/bin/ae Neil Brown's ae script text executable 6940!:mime text/x-shellscript 69410 string/wt #!\ /bin/nawk new awk script text executable 6942!:mime text/x-nawk 69430 string/wt #!\ /usr/bin/nawk new awk script text executable 6944!:mime text/x-nawk 69450 string/wt #!\ /usr/local/bin/nawk new awk script text executable 6946!:mime text/x-nawk 69470 string/wt #!\ /bin/gawk GNU awk script text executable 6948!:mime text/x-gawk 69490 string/wt #!\ /usr/bin/gawk GNU awk script text executable 6950!:mime text/x-gawk 69510 string/wt #!\ /usr/local/bin/gawk GNU awk script text executable 6952!:mime text/x-gawk 6953# 69540 string/wt #!\ /bin/awk awk script text executable 6955!:mime text/x-awk 69560 string/wt #!\ /usr/bin/awk awk script text executable 6957!:mime text/x-awk 69580 regex/4096 =^[\040\t\f\r\n]{0,100}BEGIN[\040\t\f\r\n]{0,100}[{] awk or perl script text 6959 6960# AT&T Bell Labs' Plan 9 shell 69610 string/wt #!\ /bin/rc Plan 9 rc shell script text executable 6962 6963# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de) 69640 string/wt #!\ /bin/bash Bourne-Again shell script text executable 6965!:mime text/x-shellscript 69660 string/wb #!\ /bin/bash Bourne-Again shell script executable (binary data) 6967!:mime text/x-shellscript 69680 string/wt #!\ /usr/bin/bash Bourne-Again shell script text executable 6969!:mime text/x-shellscript 69700 string/wb #!\ /usr/bin/bash Bourne-Again shell script executable (binary data) 6971!:mime text/x-shellscript 69720 string/wt #!\ /usr/local/bash Bourne-Again shell script text executable 6973!:mime text/x-shellscript 69740 string/wb #!\ /usr/local/bash Bourne-Again shell script executable (binary data) 6975!:mime text/x-shellscript 69760 string/wt #!\ /usr/local/bin/bash Bourne-Again shell script text executable 6977!:mime text/x-shellscript 69780 string/wb #!\ /usr/local/bin/bash Bourne-Again shell script executable (binary data) 6979!:mime text/x-shellscript 69800 string/wt #!\ /usr/bin/env\ bash Bourne-Again shell script text executable 6981!:mime text/x-shellscript 6982 6983# Fish shell magic 6984# From: Benjamin Lowry <ben@ben.gmbh> 69850 string/wt #!\ /usr/local/bin/fish fish shell script text executable 6986!:mime text/x-shellscript 69870 string/wt #!\ /usr/bin/fish fish shell script text executable 6988!:mime text/x-shellscript 69890 string/wt #!\ /usr/bin/env\ fish fish shell script text executable 6990!:mime text/x-shellscript 6991 6992 69930 search/1/wt #!\ /usr/bin/tclsh Tcl/Tk script text executable 6994!:mime text/x-tcl 6995 69960 search/1/wt #!\ /usr/bin/texlua LuaTex script text executable 6997!:mime text/x-luatex 6998 69990 search/1/wt #!\ /usr/bin/luatex LuaTex script text executable 7000!:mime text/x-luatex 7001 70020 search/1/wt #!\ /usr/bin/stap Systemtap script text executable 7003!:mime text/x-systemtap 7004 7005 7006 7007# PHP scripts 7008# Ulf Harnhammar <ulfh@update.uu.se> 70090 search/1/c =<?php PHP script text 7010!:strength + 30 7011!:mime text/x-php 70120 search/1 =<?\n PHP script text 7013!:mime text/x-php 70140 search/1 =<?\r PHP script text 7015!:mime text/x-php 70160 search/1/w #!\ /usr/local/bin/php PHP script text executable 7017!:strength + 10 7018!:mime text/x-php 70190 search/1/w #!\ /usr/bin/php PHP script text executable 7020!:strength + 10 7021!:mime text/x-php 7022# Smarty compiled template, https://www.smarty.net/ 7023# Elan Ruusamae <glen@delfi.ee> 70240 string =<?php 7025>5 regex [\ \n] 7026>>6 string /*\ Smarty\ version Smarty compiled template 7027>>>24 regex [0-9.]+ \b, version %s 7028!:mime text/x-php 7029 70300 string Zend\x00 PHP script Zend Optimizer data 7031 70320 string/t $! DCL command file 7033 7034# Type: Pdmenu 7035# URL: https://packages.debian.org/pdmenu 7036# From: Edward Betts <edward@debian.org> 70370 string #!/usr/bin/pdmenu Pdmenu configuration file text 7038 7039# From Danny Weldon 70400 string \x0b\x13\x08\x00 7041>0x04 uleshort <4 ksh byte-code version %d 7042 7043#---------------------------------------------------------------------------- 7044# $File: communications,v 1.5 2009/09/19 16:28:08 christos Exp $ 7045# communication 7046 7047# TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3. 7048# It is used for conformance testing of communication protocols. 7049# Added by W. Borgert <debacle@debian.org>. 70500 string $Suite TTCN Abstract Test Suite 7051>&1 string $SuiteId 7052>>&1 string >\n %s 7053>&2 string $SuiteId 7054>>&1 string >\n %s 7055>&3 string $SuiteId 7056>>&1 string >\n %s 7057 7058# MSC (message sequence charts) are a formal description technique, 7059# described in ITU-T Z.120, mainly used for communication protocols. 7060# Added by W. Borgert <debacle@debian.org>. 70610 string mscdocument Message Sequence Chart (document) 70620 string msc Message Sequence Chart (chart) 70630 string submsc Message Sequence Chart (subchart) 7064#------------------------------------------------------------------------------ 7065# $File: compress,v 1.79 2020/05/30 23:53:04 christos Exp $ 7066# compress: file(1) magic for pure-compression formats (no archives) 7067# 7068# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc. 7069# 7070# Formats for various forms of compressed data 7071# Formats for "compress" proper have been moved into "compress.c", 7072# because it tries to uncompress it to figure out what's inside. 7073 7074# standard unix compress 70750 string \037\235 compress'd data 7076!:mime application/x-compress 7077!:apple LZIVZIVU 7078>2 byte&0x80 >0 block compressed 7079>2 byte&0x1f x %d bits 7080 7081# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver) 7082# URL: https://en.wikipedia.org/wiki/Gzip 7083# Reference: https://tools.ietf.org/html/rfc1952 7084# Update: Joerg Jenderek, Apr 2019 7085# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002 7086# * Original filename is only at offset 10 if "extra field" absent 7087# * Produce shorter output - notably, only report compression methods 7088# other than 8 ("deflate", the only method defined in RFC 1952). 7089# Note: find defs -iname '*.trid.xml' -exec grep -q '<Bytes>1F8B08' {} \; -ls 7090# TODO: 7091# FBR Blueberry FlashBack screen Record https://www.flashbackrecorder.com/ 7092# KPR KOffice/Calligra KPresenter application/x-kpresenter 7093# KPT KOffice/Calligra KPresenter template? application/x-kpresenter 7094# SAV Diggles Saved Game File http://www.innonics.com 7095# SAV FarCry (demo) saved game http://www.farcry-thegame.com 7096# DAT ZOAGZIP game data format http://en.wikipedia.org/wiki/SD_Gundam_Capsule_Fighter 70970 string \037\213 7098# to display gzip compressed (strength=100=2*50) before other (strength=50)? 7099#!:strength * 2 7100# no FNAME and FCOMMENT bit implies no file name/comment. That means only binary 7101>3 byte&0x18 =0 7102# For binary gzipped no ASCII text should occur 7103# mcd-monu-cad.trid.xml 7104>>10 string MCD Monu-Cad Drawing, Component or Font 7105#>>36 string Created\ with\ MONU-CAD 7106#!:mime application/octet-stream 7107# http://fileformats.archiveteam.org/wiki/Monu-CAD 7108# http://www.monucad.com/downloads/FullDemo-2005.EXE 7109# /HANDS96.MCC Component 7110# /DEMO_DD01.MCD Drawing 7111# /MCALF020.FNT Font 7112!:ext mcc/mcd/fnt 7113# http://www.generalcadd.com 7114>>10 string GXD General CADD, Drawing or Component 7115#!:mime application/octet-stream 7116# /gxc/BUILDINGEDGE.gxc Component 7117# /gxd/HOCKETT-STPAUL-WRHSE.gxd Drawing 7118# /gxd/POWERLAND-MILL-ADD-11.gxd Drawing v9.1.06 7119!:ext gxc/gxd 7120#>>>13 ubyte 0 \b, version 0 7121>>>13 string 09 \b, version 9 7122# other gzipped binary like gzipped tar, VirtualBox extension package,... 7123>>10 default x gzip compressed data 7124!:mime application/gzip 7125>>>0 use gzip-info 7126# size of the original (uncompressed) input data modulo 2^32 7127>>-0 offset >48 7128>>>-4 ulelong x \b, original size modulo 2^32 %u 7129>>-0 offset <48 \b, truncated 7130# gzipped TAR or VirtualBox extension package 7131#!:mime application/x-compressed-tar 7132#!:mime application/x-virtualbox-vbox-extpack 7133# https://www.w3.org/TR/SVG/mimereg.html 7134#!:mime image/image/svg+xml-compressed 7135# zlib.3.gz 7136# microcode-20180312.tgz 7137# tpz same as tgz 7138# lua-md5_1.2-1_i386_i486.ipk https://en.wikipedia.org/wiki/Opkg 7139# Oracle_VM_VirtualBox_Extension_Pack-5.0.12-104815.vbox-extpack 7140!:ext gz/tgz/tpz/ipk/vbox-extpack/svgz 7141# FNAME/FCOMMENT bit implies file name/comment as iso-8859-1 text 7142>3 byte&0x18 >0 gzip compressed data 7143!:mime application/gzip 7144# gzipped tar, gzipped Abiword document 7145#!:mime application/x-compressed-tar 7146#!:mime application/x-abiword-compressed 7147#!:mime image/image/svg+xml-compressed 7148# kleopatra_splashscreen.svgz gzipped .svg 7149!:ext gz/tgz/tpz/zabw/svgz 7150>>0 use gzip-info 7151# size of the original (uncompressed) input data modulo 2^32 7152>>-0 offset >48 7153>>>-4 ulelong x \b, original size modulo 2^32 %u 7154>>-0 offset <48 \b, truncated 7155# display information of gzip compressed files 71560 name gzip-info 7157#>2 byte x THIS iS GZIP 7158>2 byte <8 \b, reserved method 7159>2 byte >8 \b, unknown method 7160>3 byte &0x01 \b, ASCII 7161>3 byte &0x02 \b, has CRC 7162>3 byte &0x04 \b, extra field 7163>3 byte&0xC =0x08 7164>>10 string x \b, was "%s" 7165>3 byte &0x10 \b, has comment 7166>3 byte &0x20 \b, encrypted 7167>4 ledate >0 \b, last modified: %s 7168>8 byte 2 \b, max compression 7169>8 byte 4 \b, max speed 7170>9 byte =0x00 \b, from FAT filesystem (MS-DOS, OS/2, NT) 7171>9 byte =0x01 \b, from Amiga 7172>9 byte =0x02 \b, from VMS 7173>9 byte =0x03 \b, from Unix 7174>9 byte =0x04 \b, from VM/CMS 7175>9 byte =0x05 \b, from Atari 7176>9 byte =0x06 \b, from HPFS filesystem (OS/2, NT) 7177>9 byte =0x07 \b, from MacOS 7178>9 byte =0x08 \b, from Z-System 7179>9 byte =0x09 \b, from CP/M 7180>9 byte =0x0A \b, from TOPS/20 7181>9 byte =0x0B \b, from NTFS filesystem (NT) 7182>9 byte =0x0C \b, from QDOS 7183>9 byte =0x0D \b, from Acorn RISCOS 7184# size of the original (uncompressed) input data modulo 2^32 7185#>-4 ulelong x \b, original size modulo 2^32 %u 7186#ERROR: line 114: non zero offset 1048572 at level 1 7187 7188# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis 71890 string \037\036 packed data 7190!:mime application/octet-stream 7191>2 belong >1 \b, %d characters originally 7192>2 belong =1 \b, %d character originally 7193# 7194# This magic number is byte-order-independent. 71950 short 0x1f1f old packed data 7196!:mime application/octet-stream 7197 7198# XXX - why *two* entries for "compacted data", one of which is 7199# byte-order independent, and one of which is byte-order dependent? 7200# 72010 short 0x1fff compacted data 7202!:mime application/octet-stream 7203# This string is valid for SunOS (BE) and a matching "short" is listed 7204# in the Ultrix (LE) magic file. 72050 string \377\037 compacted data 7206!:mime application/octet-stream 72070 short 0145405 huf output 7208!:mime application/octet-stream 7209 7210# bzip2 72110 string BZh bzip2 compressed data 7212!:mime application/x-bzip2 7213>3 byte >47 \b, block size = %c00k 7214 7215# bzip a block-sorting file compressor 7216# by Julian Seward <sewardj@cs.man.ac.uk> and others 72170 string BZ0 bzip compressed data 7218!:mime application/x-bzip 7219>3 byte >47 \b, block size = %c00k 7220 7221# lzip 72220 string LZIP lzip compressed data 7223!:mime application/x-lzip 7224>4 byte x \b, version: %d 7225 7226# squeeze and crunch 7227# Michael Haardt <michael@cantor.informatik.rwth-aachen.de> 72280 beshort 0x76FF squeezed data, 7229>4 string x original name %s 72300 beshort 0x76FE crunched data, 7231>2 string x original name %s 72320 beshort 0x76FD LZH compressed data, 7233>2 string x original name %s 7234 7235# Freeze 72360 string \037\237 frozen file 2.1 72370 string \037\236 frozen file 1.0 (or gzip 0.5) 7238 7239# SCO compress -H (LZH) 72400 string \037\240 SCO compress -H (LZH) data 7241 7242# European GSM 06.10 is a provisional standard for full-rate speech 7243# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse 7244# excitation/long term prediction) coding at 13 kbit/s. 7245# 7246# There's only a magic nibble (4 bits); that nibble repeats every 33 7247# bytes. This isn't suited for use, but maybe we can use it someday. 7248# 7249# This will cause very short GSM files to be declared as data and 7250# mismatches to be declared as data too! 7251#0 byte&0xF0 0xd0 data 7252#>33 byte&0xF0 0xd0 7253#>66 byte&0xF0 0xd0 7254#>99 byte&0xF0 0xd0 7255#>132 byte&0xF0 0xd0 GSM 06.10 compressed audio 7256 7257# lzop from <markus.oberhumer@jk.uni-linz.ac.at> 72580 string \x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a lzop compressed data 7259>9 beshort <0x0940 7260>>9 byte&0xf0 =0x00 - version 0. 7261>>9 beshort&0x0fff x \b%03x, 7262>>13 byte 1 LZO1X-1, 7263>>13 byte 2 LZO1X-1(15), 7264>>13 byte 3 LZO1X-999, 7265## >>22 bedate >0 last modified: %s, 7266>>14 byte =0x00 os: MS-DOS 7267>>14 byte =0x01 os: Amiga 7268>>14 byte =0x02 os: VMS 7269>>14 byte =0x03 os: Unix 7270>>14 byte =0x05 os: Atari 7271>>14 byte =0x06 os: OS/2 7272>>14 byte =0x07 os: MacOS 7273>>14 byte =0x0A os: Tops/20 7274>>14 byte =0x0B os: WinNT 7275>>14 byte =0x0E os: Win32 7276>9 beshort >0x0939 7277>>9 byte&0xf0 =0x00 - version 0. 7278>>9 byte&0xf0 =0x10 - version 1. 7279>>9 byte&0xf0 =0x20 - version 2. 7280>>9 beshort&0x0fff x \b%03x, 7281>>15 byte 1 LZO1X-1, 7282>>15 byte 2 LZO1X-1(15), 7283>>15 byte 3 LZO1X-999, 7284## >>25 bedate >0 last modified: %s, 7285>>17 byte =0x00 os: MS-DOS 7286>>17 byte =0x01 os: Amiga 7287>>17 byte =0x02 os: VMS 7288>>17 byte =0x03 os: Unix 7289>>17 byte =0x05 os: Atari 7290>>17 byte =0x06 os: OS/2 7291>>17 byte =0x07 os: MacOS 7292>>17 byte =0x0A os: Tops/20 7293>>17 byte =0x0B os: WinNT 7294>>17 byte =0x0E os: Win32 7295 7296# 4.3BSD-Quasijarus Strong Compression 7297# https://minnie.tuhs.org/Quasijarus/compress.html 72980 string \037\241 Quasijarus strong compressed data 7299 7300# From: Cory Dikkers <cdikkers@swbell.net> 73010 string XPKF Amiga xpkf.library compressed data 73020 string PP11 Power Packer 1.1 compressed data 73030 string PP20 Power Packer 2.0 compressed data, 7304>4 belong 0x09090909 fast compression 7305>4 belong 0x090A0A0A mediocre compression 7306>4 belong 0x090A0B0B good compression 7307>4 belong 0x090A0C0C very good compression 7308>4 belong 0x090A0C0D best compression 7309 7310# 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at) 7311# https://www.7-zip.org or DOC/7zFormat.txt 7312# 73130 string 7z\274\257\047\034 7-zip archive data, 7314>6 byte x version %d 7315>7 byte x \b.%d 7316!:mime application/x-7z-compressed 7317!:ext 7z/cb7 7318 7319# Type: LZMA 73200 lelong&0xffffff =0x5d 7321>12 leshort 0xff LZMA compressed data, 7322!:mime application/x-lzma 7323>>5 lequad =0xffffffffffffffff streamed 7324>>5 lequad !0xffffffffffffffff non-streamed, size %lld 7325>12 leshort 0 LZMA compressed data, 7326>>5 lequad =0xffffffffffffffff streamed 7327>>5 lequad !0xffffffffffffffff non-streamed, size %lld 7328 7329# http://tukaani.org/xz/xz-file-format.txt 73300 ustring \xFD7zXZ\x00 XZ compressed data 7331!:strength * 2 7332!:mime application/x-xz 7333 7334# https://github.com/ckolivas/lrzip/blob/master/doc/magic.header.txt 73350 string LRZI LRZIP compressed data 7336>4 byte x - version %d 7337>5 byte x \b.%d 7338!:mime application/x-lrzip 7339 7340# https://fastcompression.blogspot.fi/2013/04/lz4-streaming-format-final.html 73410 lelong 0x184d2204 LZ4 compressed data (v1.4+) 7342!:mime application/x-lz4 7343# Added by osm0sis@xda-developers.com 73440 lelong 0x184c2103 LZ4 compressed data (v1.0-v1.3) 7345!:mime application/x-lz4 73460 lelong 0x184c2102 LZ4 compressed data (v0.1-v0.9) 7347!:mime application/x-lz4 7348 7349# Zstandard/LZ4 skippable frames 7350# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md 73510 lelong&0xFFFFFFF0 0x184D2A50 7352>(4.l+8) indirect x 7353 7354# Zstandard Dictionary ID subroutine 73550 name zstd-dictionary-id 7356# Single Segment = True 7357>0 byte &0x20 \b, Dictionary ID: 7358>>0 byte&0x03 0 None 7359>>0 byte&0x03 1 7360>>>1 byte x %u 7361>>0 byte&0x03 2 7362>>>1 leshort x %u 7363>>0 byte&0x03 3 7364>>>1 lelong x %u 7365# Single Segment = False 7366>0 byte ^0x20 \b, Dictionary ID: 7367>>0 byte&0x03 0 None 7368>>0 byte&0x03 1 7369>>>2 byte x %u 7370>>0 byte&0x03 2 7371>>>2 leshort x %u 7372>>0 byte&0x03 3 7373>>>2 lelong x %u 7374 7375# Zstandard compressed data 7376# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md 73770 lelong 0xFD2FB522 Zstandard compressed data (v0.2) 7378!:mime application/zstd 73790 lelong 0xFD2FB523 Zstandard compressed data (v0.3) 7380!:mime application/zstd 73810 lelong 0xFD2FB524 Zstandard compressed data (v0.4) 7382!:mime application/zstd 73830 lelong 0xFD2FB525 Zstandard compressed data (v0.5) 7384!:mime application/zstd 73850 lelong 0xFD2FB526 Zstandard compressed data (v0.6) 7386!:mime application/zstd 73870 lelong 0xFD2FB527 Zstandard compressed data (v0.7) 7388!:mime application/zstd 7389>4 use zstd-dictionary-id 73900 lelong 0xFD2FB528 Zstandard compressed data (v0.8+) 7391!:mime application/zstd 7392>4 use zstd-dictionary-id 7393 7394# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md 73950 lelong 0xEC30A437 Zstandard dictionary 7396!:mime application/x-std-dictionary 7397>4 lelong x (ID %u) 7398 7399# AFX compressed files (Wolfram Kleff) 74002 string -afx- AFX compressed file data 7401 7402# Supplementary magic data for the file(1) command to support 7403# rzip(1). The format is described in magic(5). 7404# 7405# Copyright (C) 2003 by Andrew Tridgell. You may do whatever you want with 7406# this file. 7407# 74080 string RZIP rzip compressed data 7409>4 byte x - version %d 7410>5 byte x \b.%d 7411>6 belong x (%d bytes) 7412 74130 string ArC\x01 FreeArc archive <http://freearc.org> 7414 7415# Type: DACT compressed files 74160 long 0x444354C3 DACT compressed data 7417>4 byte >-1 (version %i. 7418>5 byte >-1 %i. 7419>6 byte >-1 %i) 7420>7 long >0 , original size: %i bytes 7421>15 long >30 , block size: %i bytes 7422 7423# Valve Pack (VPK) files 74240 lelong 0x55aa1234 Valve Pak file 7425>0x4 lelong x \b, version %u 7426>0x8 lelong x \b, %u entries 7427 7428# Snappy framing format 7429# https://code.google.com/p/snappy/source/browse/trunk/framing_format.txt 74300 string \377\006\0\0sNaPpY snappy framed data 7431!:mime application/x-snappy-framed 7432 7433# qpress, https://www.quicklz.com/ 74340 string qpress10 qpress compressed data 7435!:mime application/x-qpress 7436 7437# Zlib https://www.ietf.org/rfc/rfc6713.txt 74380 string/b x 7439>0 beshort%31 =0 7440>>0 byte&0xf =8 7441>>>0 byte&0x80 =0 zlib compressed data 7442!:mime application/zlib 7443 7444# BWC compression 74450 string BWC 7446>3 byte 0 BWC compressed data 7447 7448# UCL compression 74490 bequad 0x00e955434cff011a UCL compressed data 7450 7451# Softlib archive 74520 string SLIB Softlib archive 7453>4 leshort x \b, version %d 7454>6 leshort x (contains %d files) 7455 7456# URL: https://github.com/lzfse/lzfse/blob/master/src/lzfse_internal.h#L276 7457# From: Eric Hall <eric.hall@darkart.com> 74580 string bvx- lzfse encoded, no compression 74590 string bvx1 lzfse compressed, uncompressed tables 74600 string bvx2 lzfse compressed, compressed tables 74610 string bvxn lzfse encoded, lzvn compressed 7462 7463# pcxLib.exe compression program 7464# http://www.shikadi.net/moddingwiki/PCX_Library 74650 string/b pcxLib 7466>0x0A string/b Copyright\020(c)\020Genus\020Microprogramming,\020Inc. pcxLib compressed 7467 7468#------------------------------------------------------------------------------ 7469# $File: console,v 1.55 2020/04/19 17:30:55 christos Exp $ 7470# Console game magic 7471# Toby Deshane <hac@shoelace.digivill.net> 7472 7473# ines: file(1) magic for Marat's iNES Nintendo Entertainment System ROM dump format 7474# Updated by David Korth <gerbilsoft@gerbilsoft.com> 7475# References: 7476# - https://wiki.nesdev.com/w/index.php/INES 7477# - https://wiki.nesdev.com/w/index.php/NES_2.0 7478 7479# Common header for iNES, NES 2.0, and Wii U iNES. 74800 name nes-rom-image-ines 7481>7 byte&0x0C =0x8 (NES 2.0) 7482>4 byte x \b: %ux16k PRG 7483>5 byte x \b, %ux8k CHR 7484>6 byte&0x08 =0x8 [4-Scr] 7485>6 byte&0x09 =0x0 [H-mirror] 7486>6 byte&0x09 =0x1 [V-mirror] 7487>6 byte&0x02 =0x2 [SRAM] 7488>6 byte&0x04 =0x4 [Trainer] 7489>7 byte&0x03 =0x2 [PC10] 7490>7 byte&0x03 =0x1 [VS] 7491>>7 byte&0x0C =0x8 7492# NES 2.0: VS PPU 7493>>>13 byte&0x0F =0x0 \b, RP2C03B 7494>>>13 byte&0x0F =0x1 \b, RP2C03G 7495>>>13 byte&0x0F =0x2 \b, RP2C04-0001 7496>>>13 byte&0x0F =0x3 \b, RP2C04-0002 7497>>>13 byte&0x0F =0x4 \b, RP2C04-0003 7498>>>13 byte&0x0F =0x5 \b, RP2C04-0004 7499>>>13 byte&0x0F =0x6 \b, RP2C03B 7500>>>13 byte&0x0F =0x7 \b, RP2C03C 7501>>>13 byte&0x0F =0x8 \b, RP2C05-01 7502>>>13 byte&0x0F =0x9 \b, RP2C05-02 7503>>>13 byte&0x0F =0xA \b, RP2C05-03 7504>>>13 byte&0x0F =0xB \b, RP2C05-04 7505>>>13 byte&0x0F =0xC \b, RP2C05-05 7506# TODO: VS protection hardware? 7507>>7 byte x \b] 7508# NES 2.0-specific flags. 7509>7 byte&0x0C =0x8 7510>>12 byte&0x03 =0x0 [NTSC] 7511>>12 byte&0x03 =0x1 [PAL] 7512>>12 byte&0x02 =0x2 [NTSC+PAL] 7513 7514# Standard iNES ROM header. 75150 string NES\x1A NES ROM image (iNES) 7516!:mime application/x-nes-rom 7517>0 use nes-rom-image-ines 7518 7519# Wii U Virtual Console iNES ROM header. 75200 belong 0x4E455300 NES ROM image (Wii U Virtual Console) 7521!:mime application/x-nes-rom 7522>0 use nes-rom-image-ines 7523 7524#------------------------------------------------------------------------------ 7525# unif: file(1) magic for UNIF-format Nintendo Entertainment System ROM images 7526# Reference: https://wiki.nesdev.com/w/index.php/UNIF 7527# From: David Korth <gerbilsoft@gerbilsoft.com> 7528# 7529# NOTE: The UNIF format uses chunks instead of a fixed header, 7530# so most of the data isn't easily parseable. 7531# 75320 string UNIF 7533>4 lelong <16 NES ROM image (UNIF v%d format) 7534!:mime application/x-nes-rom 7535 7536#------------------------------------------------------------------------------ 7537# fds: file(1) magic for Famciom Disk System disk images 7538# Reference: https://wiki.nesdev.com/w/index.php/Family_Computer_Disk_System#.FDS_format 7539# From: David Korth <gerbilsoft@gerbilsoft.com> 7540# TODO: Check "Disk info block" and get info from that in addition to the optional header. 7541 7542# Disk info block. (block 1) 75430 name nintendo-fds-disk-info-block 7544>23 byte !1 FMC- 7545>23 byte 1 FSC- 7546>16 string x \b%.3s 7547>15 byte x \b, mfr %02X 7548>20 byte x (Rev.%02u) 7549 7550# Headered version. 75510 string FDS\x1A 7552>0x11 string *NINTENDO-HVC* Famicom Disk System disk image: 7553!:mime application/x-fds-disk 7554>>0x10 use nintendo-fds-disk-info-block 7555>4 byte 1 (%u side) 7556>4 byte !1 (%u sides) 7557 7558# Unheadered version. 75591 string *NINTENDO-HVC* Famicom Disk System disk image: 7560!:mime application/x-fds-disk 7561>0 use nintendo-fds-disk-info-block 7562 7563#------------------------------------------------------------------------------ 7564# tnes: file(1) magic for TNES-format Nintendo Entertainment System ROM images 7565# Used by Nintendo 3DS NES Virtual Console games. 7566# From: David Korth <gerbilsoft@gerbilsoft.com> 7567# 75680 string TNES NES ROM image (Nintendo 3DS Virtual Console) 7569!:mime application/x-nes-rom 7570>4 byte 100 \b: FDS, 7571>>0x2010 use nintendo-fds-disk-info-block 7572>4 byte !100 \b: TNES mapper %u 7573>>5 byte x \b, %ux8k PRG 7574>>6 byte x \b, %ux8k CHR 7575>>7 byte&0x08 =1 [WRAM] 7576>>8 byte&0x09 =1 [H-mirror] 7577>>8 byte&0x09 =2 [V-mirror] 7578>>8 byte&0x02 =3 [VRAM] 7579 7580#------------------------------------------------------------------------------ 7581# gameboy: file(1) magic for the Nintendo (Color) Gameboy raw ROM format 7582# Reference: http://gbdev.gg8.se/wiki/articles/The_Cartridge_Header 7583# 75840x104 bequad 0xCEED6666CC0D000B Game Boy ROM image 7585# TODO: application/x-gameboy-color-rom for GBC. 7586!:mime application/x-gameboy-rom 7587>0x143 byte&0x80 0x80 7588>>0x134 string >\0 \b: "%.15s" 7589>0x143 byte&0x80 !0x80 7590>>0x134 string >\0 \b: "%.16s" 7591>0x14c byte x (Rev.%02u) 7592 7593# Machine type. (SGB, CGB, SGB+CGB) 7594>0x14b byte 0x33 7595>>0x146 byte 0x03 7596>>>0x143 byte&0x80 0x80 [SGB+CGB] 7597>>>0x143 byte&0x80 !0x80 [SGB] 7598>>0x146 byte !0x03 7599>>>0x143 byte&0xC0 0x80 [CGB] 7600>>>0x143 byte&0xC0 0xC0 [CGB ONLY] 7601>0x14b byte !0x33 7602 7603# Mapper. 7604>0x147 byte 0x00 [ROM ONLY] 7605>0x147 byte 0x01 [MBC1] 7606>0x147 byte 0x02 [MBC1+RAM] 7607>0x147 byte 0x03 [MBC1+RAM+BATT] 7608>0x147 byte 0x05 [MBC2] 7609>0x147 byte 0x06 [MBC2+BATTERY] 7610>0x147 byte 0x08 [ROM+RAM] 7611>0x147 byte 0x09 [ROM+RAM+BATTERY] 7612>0x147 byte 0x0B [MMM01] 7613>0x147 byte 0x0C [MMM01+SRAM] 7614>0x147 byte 0x0D [MMM01+SRAM+BATT] 7615>0x147 byte 0x0F [MBC3+TIMER+BATT] 7616>0x147 byte 0x10 [MBC3+TIMER+RAM+BATT] 7617>0x147 byte 0x11 [MBC3] 7618>0x147 byte 0x12 [MBC3+RAM] 7619>0x147 byte 0x13 [MBC3+RAM+BATT] 7620>0x147 byte 0x19 [MBC5] 7621>0x147 byte 0x1A [MBC5+RAM] 7622>0x147 byte 0x1B [MBC5+RAM+BATT] 7623>0x147 byte 0x1C [MBC5+RUMBLE] 7624>0x147 byte 0x1D [MBC5+RUMBLE+SRAM] 7625>0x147 byte 0x1E [MBC5+RUMBLE+SRAM+BATT] 7626>0x147 byte 0xFC [Pocket Camera] 7627>0x147 byte 0xFD [Bandai TAMA5] 7628>0x147 byte 0xFE [Hudson HuC-3] 7629>0x147 byte 0xFF [Hudson HuC-1] 7630 7631# ROM size. 7632>0x148 byte 0 \b, ROM: 256Kbit 7633>0x148 byte 1 \b, ROM: 512Kbit 7634>0x148 byte 2 \b, ROM: 1Mbit 7635>0x148 byte 3 \b, ROM: 2Mbit 7636>0x148 byte 4 \b, ROM: 4Mbit 7637>0x148 byte 5 \b, ROM: 8Mbit 7638>0x148 byte 6 \b, ROM: 16Mbit 7639>0x148 byte 7 \b, ROM: 32Mbit 7640>0x148 byte 0x52 \b, ROM: 9Mbit 7641>0x148 byte 0x53 \b, ROM: 10Mbit 7642>0x148 byte 0x54 \b, ROM: 12Mbit 7643 7644# RAM size. 7645>0x149 byte 1 \b, RAM: 16Kbit 7646>0x149 byte 2 \b, RAM: 64Kbit 7647>0x149 byte 3 \b, RAM: 128Kbit 7648>0x149 byte 4 \b, RAM: 1Mbit 7649>0x149 byte 5 \b, RAM: 512Kbit 7650 7651#------------------------------------------------------------------------------ 7652# genesis: file(1) magic for various Sega Mega Drive / Genesis ROM image and disc formats 7653# Updated by David Korth <gerbilsoft@gerbilsoft.com> 7654# References: 7655# - https://www.retrodev.com/segacd.html 7656# - http://devster.monkeeh.com/sega/32xguide1.txt 7657# 7658 7659# Common Sega Mega Drive header format. 7660# FIXME: Name fields are 48 bytes, but have spaces for padding instead of 00s. 76610 name sega-mega-drive-header 7662# ROM title. (Use domestic if present; if not, use international.) 7663>0x120 byte >0x20 7664>>0x120 string >\0 \b: "%.16s" 7665>0x120 byte <0x21 7666>>0x150 string >\0 \b: "%.16s" 7667# Other information. 7668>0x180 string >\0 (%.14s 7669>>0x110 string >\0 \b, %.16s 7670>0x180 byte 0 7671>>0x110 string >\0 (%.16s 7672>0 byte x \b) 7673 7674# TODO: Check for 32X CD? 7675# Sega Mega CD disc images: 2048-byte sectors. 76760 string SEGADISCSYSTEM\ \ Sega Mega CD disc image 7677!:mime application/x-sega-cd-rom 7678>0 use sega-mega-drive-header 7679>0 byte x \b, 2048-byte sectors 76800 string SEGABOOTDISC\ \ \ \ Sega Mega CD disc image 7681!:mime application/x-sega-cd-rom 7682>0 use sega-mega-drive-header 7683>0 byte x \b, 2048-byte sectors 7684# Sega Mega CD disc images: 2352-byte sectors. 76850x10 string SEGADISCSYSTEM\ \ Sega Mega CD disc image 7686!:mime application/x-sega-cd-rom 7687>0x10 use sega-mega-drive-header 7688>0 byte x \b, 2352-byte sectors 76890x10 string SEGABOOTDISC\ \ \ \ Sega Mega CD disc image 7690!:mime application/x-sega-cd-rom 7691>0x10 use sega-mega-drive-header 7692>0 byte x \b, 2352-byte sectors 7693 7694# Sega Mega Drive, 32X, Pico, and Mega CD Boot ROM images. 76950x100 string SEGA 7696>0x3C0 bequad 0x4D41525320434845 Sega 32X ROM image 7697!:mime application/x-genesis-32x-rom 7698>>0 use sega-mega-drive-header 7699>0x3C0 bequad !0x4D41525320434845 7700>>0x105 belong 0x5049434F Sega Pico ROM image 7701!:mime application/x-sega-pico-rom 7702>>>0 use sega-mega-drive-header 7703>>0x105 belong !0x5049434F 7704>>>0x180 beshort 0x4252 Sega Mega CD Boot ROM image 7705!:mime application/x-genesis-rom 7706>>>0x180 beshort !0x4252 Sega Mega Drive / Genesis ROM image 7707!:mime application/x-genesis-rom 7708>>>0 use sega-mega-drive-header 7709 7710#------------------------------------------------------------------------------ 7711# genesis: file(1) magic for the Super MegaDrive ROM dump format 7712# 7713 7714# NOTE: Due to interleaving, we can't display anything 7715# other than the copier header information. 77160 name sega-genesis-smd-header 7717>0 byte x %dx16k blocks 7718>2 byte 0 \b, last in series or standalone 7719>2 byte >0 \b, split ROM 7720 7721# "Sega Genesis" header. 77220x280 string EAGN 7723>8 beshort 0xAABB Sega Mega Drive / Genesis ROM image (SMD format): 7724!:mime application/x-genesis-rom 7725>>0 use sega-genesis-smd-header 7726 7727# "Sega Mega Drive" header. 77280x280 string EAMG 7729>8 beshort 0xAABB Sega Mega Drive / Genesis ROM image (SMD format): 7730!:mime application/x-genesis-rom 7731>>0 use sega-genesis-smd-header 7732 7733#------------------------------------------------------------------------------ 7734# smsgg: file(1) magic for Sega Master System and Game Gear ROM images 7735# Detects all Game Gear and export Sega Master System ROM images, 7736# and some Japanese Sega Master System ROM images. 7737# From: David Korth <gerbilsoft@gerbilsoft.com> 7738# Reference: https://www.smspower.org/Development/ROMHeader 7739# 7740 7741# General SMS header rule. 7742# The SMS boot ROM checks the header at three locations. 77430 name sega-master-system-rom-header 7744# Machine type. 7745>0x0F byte&0xF0 0x30 Sega Master System 7746!:mime application/x-sms-rom 7747>0x0F byte&0xF0 0x40 Sega Master System 7748!:mime application/x-sms-rom 7749>0x0F byte&0xF0 0x50 Sega Game Gear 7750!:mime application/x-gamegear-rom 7751>0x0F byte&0xF0 0x60 Sega Game Gear 7752!:mime application/x-gamegear-rom 7753>0x0F byte&0xF0 0x70 Sega Game Gear 7754!:mime application/x-gamegear-rom 7755>0x0F default x Sega Master System / Game Gear 7756!:mime application/x-sms-rom 7757>0 byte x ROM image: 7758# Product code. 7759>0x0E byte&0xF0 0x10 1 7760>0x0E byte&0xF0 0x20 2 7761>0x0E byte&0xF0 0x30 3 7762>0x0E byte&0xF0 0x40 4 7763>0x0E byte&0xF0 0x50 5 7764>0x0E byte&0xF0 0x60 6 7765>0x0E byte&0xF0 0x70 7 7766>0x0E byte&0xF0 0x80 8 7767>0x0E byte&0xF0 0x90 9 7768>0x0E byte&0xF0 0xA0 10 7769>0x0E byte&0xF0 0xB0 11 7770>0x0E byte&0xF0 0xC0 12 7771>0x0E byte&0xF0 0xD0 13 7772>0x0E byte&0xF0 0xE0 14 7773>0x0E byte&0xF0 0xF0 15 7774# If the product code is 5 digits, we'll need to backspace here. 7775>0x0E byte&0xF0 !0 7776>>0x0C leshort x \b%04x 7777>0x0E byte&0xF0 0 7778>>0x0C leshort x %04x 7779# Revision. 7780>0x0E byte&0x0F x (Rev.%02d) 7781# ROM size. (Used for the boot ROM checksum routine.) 7782>0x0F byte&0x0F 0x0A (8 KB) 7783>0x0F byte&0x0F 0x0B (16 KB) 7784>0x0F byte&0x0F 0x0C (32 KB) 7785>0x0F byte&0x0F 0x0D (48 KB) 7786>0x0F byte&0x0F 0x0E (64 KB) 7787>0x0F byte&0x0F 0x0F (128 KB) 7788>0x0F byte&0x0F 0x00 (256 KB) 7789>0x0F byte&0x0F 0x01 (512 KB) 7790>0x0F byte&0x0F 0x02 (1 MB) 7791 7792# SMS/GG header locations. 77930x7FF0 string TMR\ SEGA 7794>0x7FF0 use sega-master-system-rom-header 77950x3FF0 string TMR\ SEGA 7796>0x3FF0 use sega-master-system-rom-header 77970x1FF0 string TMR\ SEGA 7798>0x1FF0 use sega-master-system-rom-header 7799 7800#------------------------------------------------------------------------------ 7801# saturn: file(1) magic for the Sega Saturn disc image format. 7802# From: David Korth <gerbilsoft@gerbilsoft.com> 7803# 7804 7805# Common Sega Saturn disc header format. 7806# NOTE: Title is 112 bytes, but we're only showing 32 due to space padding. 7807# TODO: Release date, device information, region code, others? 78080 name sega-saturn-disc-header 7809>0x60 string >\0 \b: "%.32s" 7810>0x20 string >\0 (%.10s 7811>>0x2A string >\0 \b, %.6s) 7812>>0x2A byte 0 \b) 7813 7814# 2048-byte sector version. 78150 string SEGA\ SEGASATURN\ Sega Saturn disc image 7816!:mime application/x-saturn-rom 7817>0 use sega-saturn-disc-header 7818>0 byte x (2048-byte sectors) 7819# 2352-byte sector version. 78200x10 string SEGA\ SEGASATURN\ Sega Saturn disc image 7821!:mime application/x-saturn-rom 7822>0x10 use sega-saturn-disc-header 7823>0 byte x (2352-byte sectors) 7824 7825#------------------------------------------------------------------------------ 7826# dreamcast: file(1) magic for the Sega Dreamcast disc image format. 7827# From: David Korth <gerbilsoft@gerbilsoft.com> 7828# Reference: https://mc.pp.se/dc/ip0000.bin.html 7829# 7830 7831# Common Sega Dreamcast disc header format. 7832# NOTE: Title is 128 bytes, but we're only showing 32 due to space padding. 7833# TODO: Release date, device information, region code, others? 78340 name sega-dreamcast-disc-header 7835>0x80 string >\0 \b: "%.32s" 7836>0x40 string >\0 (%.10s 7837>>0x4A string >\0 \b, %.6s) 7838>>0x4A byte 0 \b) 7839 7840# 2048-byte sector version. 78410 string SEGA\ SEGAKATANA\ Sega Dreamcast disc image 7842!:mime application/x-dc-rom 7843>0 use sega-dreamcast-disc-header 7844>0 byte x (2048-byte sectors) 7845# 2352-byte sector version. 78460x10 string SEGA\ SEGAKATANA\ Sega Dreamcast disc image 7847!:mime application/x-dc-rom 7848>0x10 use sega-dreamcast-disc-header 7849>0 byte x (2352-byte sectors) 7850 7851#------------------------------------------------------------------------------ 7852# dreamcast: file(1) uncertain magic for the Sega Dreamcast VMU image format 7853# 78540 belong 0x21068028 Sega Dreamcast VMU game image 78550 string LCDi Dream Animator file 7856 7857#------------------------------------------------------------------------------ 7858# z64: file(1) magic for the Z64 format N64 ROM dumps 7859# Reference: http://forum.pj64-emu.com/showthread.php?t=2239 7860# From: David Korth <gerbilsoft@gerbilsoft.com> 7861# 78620 bequad 0x803712400000000F Nintendo 64 ROM image 7863!:mime application/x-n64-rom 7864>0x20 string >\0 \b: "%.20s" 7865>0x3B string x (%.4s 7866>0x3F byte x \b, Rev.%02u) 7867 7868#------------------------------------------------------------------------------ 7869# v64: file(1) magic for the V64 format N64 ROM dumps 7870# Same as z64 format, but with 16-bit byteswapping. 7871# 78720 bequad 0x3780401200000F00 Nintendo 64 ROM image (V64) 7873!:mime application/x-n64-rom 7874 7875#------------------------------------------------------------------------------ 7876# n64-swap2: file(1) magic for the swap2 format N64 ROM dumps 7877# Same as z64 format, but with swapped 16-bit words. 7878# 78790 bequad 0x12408037000F0000 Nintendo 64 ROM image (wordswapped) 7880!:mime application/x-n64-rom 7881 7882#------------------------------------------------------------------------------ 7883# n64-le32: file(1) magic for the 32-bit byteswapped format N64 ROM dumps 7884# Same as z64 format, but with 32-bit byteswapping. 7885# 78860 bequad 0x401237800F000000 Nintendo 64 ROM image (32-bit byteswapped) 7887!:mime application/x-n64-rom 7888 7889#------------------------------------------------------------------------------ 7890# gba: file(1) magic for the Nintendo Game Boy Advance raw ROM format 7891# Reference: https://problemkaputt.de/gbatek.htm#gbacartridgeheader 7892# 7893# Original version from: "Nelson A. de Oliveira" <naoliv@gmail.com> 7894# Updated version from: David Korth <gerbilsoft@gerbilsoft.com> 7895# 78964 bequad 0x24FFAE51699AA221 Game Boy Advance ROM image 7897!:mime application/x-gba-rom 7898>0xA0 string >\0 \b: "%.12s" 7899>0xAC string x (%.6s 7900>0xBC byte x \b, Rev.%02u) 7901 7902#------------------------------------------------------------------------------ 7903# nds: file(1) magic for the Nintendo DS(i) raw ROM format 7904# Reference: https://problemkaputt.de/gbatek.htm#dscartridgeheader 7905# 7906# Original version from: "Nelson A. de Oliveira" <naoliv@gmail.com> 7907# Updated version from: David Korth <gerbilsoft@gerbilsoft.com> 7908# 79090xC0 bequad 0x24FFAE51699AA221 Nintendo DS ROM image 7910!:mime application/x-nintendo-ds-rom 7911>0x00 string >\0 \b: "%.12s" 7912>0x0C string x (%.6s 7913>0x1E byte x \b, Rev.%02u) 7914>0x12 byte 2 (DSi enhanced) 7915>0x12 byte 3 (DSi only) 7916# Secure Area check. 7917>0x20 lelong <0x4000 (homebrew) 7918>0x20 lelong >0x3FFF 7919>>0x4000 lequad 0x0000000000000000 (multiboot) 7920>>0x4000 lequad !0x0000000000000000 7921>>>0x4000 lequad 0xE7FFDEFFE7FFDEFF (decrypted) 7922>>>0x4000 lequad !0xE7FFDEFFE7FFDEFF 7923>>>>0x1000 lequad 0x0000000000000000 (encrypted) 7924>>>>0x1000 lequad !0x0000000000000000 (mask ROM) 7925 7926#------------------------------------------------------------------------------ 7927# nds_passme: file(1) magic for Nintendo DS ROM images for GBA cartridge boot. 7928# This is also used for loading .nds files using the MSET exploit on 3DS. 7929# Reference: https://github.com/devkitPro/ndstool/blob/master/source/ndscreate.cpp 79300xC0 bequad 0xC8604FE201708FE2 Nintendo DS Slot-2 ROM image (PassMe) 7931!:mime application/x-nintendo-ds-rom 7932 7933#------------------------------------------------------------------------------ 7934# ngp: file(1) magic for the Neo Geo Pocket (Color) raw ROM format. 7935# From: David Korth <gerbilsoft@gerbilsoft.com> 7936# References: 7937# - https://neogpc.googlecode.com/svn-history/r10/trunk/src/core/neogpc.cpp 7938# - https://www.devrs.com/ngp/files/ngpctech.txt 7939# 79400x0A string BY\ SNK\ CORPORATION Neo Geo Pocket 7941!:mime application/x-neo-geo-pocket-rom 7942>0x23 byte 0x10 Color 7943>0 byte x ROM image 7944>0x24 string >\0 \b: "%.12s" 7945>0x1F byte 0xFF (debug mode enabled) 7946 7947#------------------------------------------------------------------------------ 7948# msx: file(1) magic for MSX game cartridge dumps 7949# Too simple - MPi 7950#0 beshort 0x4142 MSX game cartridge dump 7951 7952#------------------------------------------------------------------------------ 7953# Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) : 79540 string PS-X\ EXE Sony Playstation executable 7955>16 lelong x PC=0x%08x, 7956>20 lelong !0 GP=0x%08x, 7957>24 lelong !0 .text=[0x%08x, 7958>>28 lelong x \b0x%x], 7959>32 lelong !0 .data=[0x%08x, 7960>>36 lelong x \b0x%x], 7961>40 lelong !0 .bss=[0x%08x, 7962>>44 lelong x \b0x%x], 7963>48 lelong !0 Stack=0x%08x, 7964>48 lelong =0 No Stack!, 7965>52 lelong !0 StackSize=0x%x, 7966#>76 string >\0 (%s) 7967# Area: 7968>113 string x (%s) 7969 7970# CPE executables 79710 string CPE CPE executable 7972>3 byte x (version %d) 7973 7974#------------------------------------------------------------------------------ 7975# Microsoft Xbox executables .xbe (Esa Hyytia <ehyytia@cc.hut.fi>) 79760 string XBEH Microsoft Xbox executable 7977!:mime audio/x-xbox-executable 7978!:ext xbe 7979# expect base address of 0x10000 7980>0x0104 ulelong =0x10000 7981>>(0x0118.l-0x0FFF4) lestring16 x \b: "%.40s" 7982>>(0x0118.l-0x0FFF5) byte x (%c 7983>>(0x0118.l-0x0FFF6) byte x \b%c- 7984>>(0x0118.l-0x0FFF8) uleshort x \b%03u) 7985>>(0x0118.l-0x0FF60) ulelong&0x80000007 0x80000007 \b, all regions 7986>>(0x0118.l-0x0FF60) ulelong&0x80000007 !0x80000007 7987>>>(0x0118.l-0x0FF60) ulelong >0 (regions: 7988>>>>(0x0118.l-0x0FF60) ulelong &0x00000001 NA 7989>>>>(0x0118.l-0x0FF60) ulelong &0x00000002 Japan 7990>>>>(0x0118.l-0x0FF60) ulelong &0x00000004 Rest_of_World 7991>>>>(0x0118.l-0x0FF60) ulelong &0x80000000 Manufacturer 7992>>>(0x0118.l-0x0FF60) ulelong >0 \b) 7993# probabilistic checks whether signed or not 7994>0x0004 ulelong =0x0 7995>>&2 ulelong =0x0 7996>>>&2 ulelong =0x0 \b, not signed 7997>0x0004 ulelong >0 7998>>&2 ulelong >0 7999>>>&2 ulelong >0 \b, signed 8000 8001# -------------------------------- 8002# Microsoft Xbox data file formats 80030 string XIP0 XIP, Microsoft Xbox data 80040 string XTF0 XTF, Microsoft Xbox data 8005 8006#------------------------------------------------------------------------------ 8007# Microsoft Xbox 360 executables (.xex) 8008# From: David Korth <gerbilsoft@gerbilsoft.com> 8009# References: 8010# - https://free60project.github.io/wiki/XEX.html 8011# - https://github.com/xenia-project/xenia/blob/HEAD/src/xenia/kernel/util/xex2_info.h 8012 8013# Title ID (part of Execution ID section) 80140 name xbox-360-xex-execution-id 8015>(0.L+0xC) byte x (%c 8016>(0.L+0xD) byte x \b%c 8017>(0.L+0xE) beshort x \b-%04u, media ID: 8018>(0.L) belong x %08X) 8019 8020# Region code (part of Security Info) 80210 name xbox-360-xex-region-code 8022>0 ubelong 0xFFFFFFFF \b, all regions 8023>0 ubelong !0xFFFFFFFF 8024>>0 ubelong >0 (regions: 8025>>0 ubelong&0x000000FF 0x000000FF USA 8026>>0 ubelong&0x00000100 0x00000100 Japan 8027>>0 ubelong&0x00000200 0x00000200 China 8028>>0 ubelong&0x0000FC00 0x0000FC00 Asia 8029>>0 ubelong&0x00FF0000 0x00FF0000 PAL 8030>>0 ubelong&0x00FF0000 0x00FE0000 PAL [except AU/NZ] 8031>>0 ubelong&0x00FF0000 0x00010000 AU/NZ 8032>>0 ubelong&0xFF000000 0xFF000000 Other 8033>>0 ubelong >0 \b) 8034 80350 string XEX2 Microsoft Xbox 360 executable 8036!:mime audio/x-xbox360-executable 8037!:ext xex 8038>0x18 search/0x100 \x00\x04\x00\x06 8039>>&0 use xbox-360-xex-execution-id 8040>(0x010.L+0x178) use xbox-360-xex-region-code 8041 80420 string XEX1 Microsoft Xbox 360 executable (XEX1) 8043!:mime audio/x-xbox360-executable 8044!:ext xex 8045>0x18 search/0x100 \x00\x04\x00\x06 8046>>&0 use xbox-360-xex-execution-id 8047>(0x010.L+0x154) use xbox-360-xex-region-code 8048 8049#------------------------------------------------------------------------------ 8050# Microsoft Xbox 360 packages 8051# From: David Korth <gerbilsoft@gerbilsoft.com> 8052# References: 8053# - https://free60project.github.io/wiki/STFS.html 8054# - https://github.com/xenia-project/xenia/blob/HEAD/src/xenia/kernel/util/xex2_info.h 8055 8056# TODO: More information for console-signed packages. 8057 80580 name xbox-360-package 8059>0x360 byte x (%c 8060>0x361 byte x \b%c 8061>0x362 beshort x \b-%04u, media ID: 8062>0x354 belong x %08X) 8063>0x344 belong x \b, content type: 8064>>0x344 belong 0x1 Saved Game 8065>>0x344 belong 0x2 Marketplace Content 8066>>0x344 belong 0x3 Publisher 8067>>0x344 belong 0x1000 Xbox 360 Title 8068>>0x344 belong 0x2000 IPTV Pause Buffer 8069>>0x344 belong 0x4000 Installed Game 8070>>0x344 belong 0x5000 Original Xbox Game 8071>>0x344 belong 0x9000 Avatar Item 8072>>0x344 belong 0x10000 Profile 8073>>0x344 belong 0x20000 Gamer Picture 8074>>0x344 belong 0x30000 Theme 8075>>0x344 belong 0x40000 Cache File 8076>>0x344 belong 0x50000 Storage Download 8077>>0x344 belong 0x60000 Xbox Saved Game 8078>>0x344 belong 0x70000 Xbox Download 8079>>0x344 belong 0x80000 Game Demo 8080>>0x344 belong 0x90000 Video 8081>>0x344 belong 0xA0000 Game 8082>>0x344 belong 0xB0000 Installer 8083>>0x344 belong 0xC0000 Game Trailer 8084>>0x344 belong 0xD0000 Arcade Title 8085>>0x344 belong 0xE0000 XNA 8086>>0x344 belong 0xF0000 License Store 8087>>0x344 belong 0x100000 Movie 8088>>0x344 belong 0x200000 TV 8089>>0x344 belong 0x300000 Music Video 8090>>0x344 belong 0x400000 Game Video 8091>>0x344 belong 0x500000 Podcast Video 8092>>0x344 belong 0x600000 Viral Video 8093>>0x344 belong 0x2000000 Community Game 8094 80950 string CON\x20 Microsoft Xbox 360 package (console-signed) 8096>0 use xbox-360-package 80970 string PIRS 8098>0 belong 0 Microsoft Xbox 360 package (non-Xbox Live) 8099>>0 use xbox-360-package 81000 string LIVE 8101>0x104 belong 0 Microsoft Xbox 360 package (Xbox Live) 8102>>0 use xbox-360-package 8103 8104# Atari Lynx cartridge dump (EXE/BLL header) 8105# From: "Stefan A. Haubenthal" <polluks@web.de> 8106 8107# Double-check that the image type matches too, 0x8008 conflicts with 8108# 8 character OMF-86 object file headers. 81090 beshort 0x8008 8110>6 string BS93 Lynx homebrew cartridge 8111!:mime application/x-atari-lynx-rom 8112>>2 beshort x \b, RAM start $%04x 8113>6 string LYNX Lynx cartridge 8114!:mime application/x-atari-lynx-rom 8115>>2 beshort x \b, RAM start $%04x 8116 8117# Opera file system that is used on the 3DO console 8118# From: Serge van den Boom <svdb@stack.nl> 81190 string \x01ZZZZZ\x01 3DO "Opera" file system 8120 8121# From: Alex Myczko <alex@aiei.ch> 8122# From: David Pflug <david@pflug.email> 8123# is the offset 12 or the offset 16 correct? 8124# GBS (Game Boy Sound) magic 8125# ftp://ftp.modland.com/pub/documents/format_documentation/\ 8126# Gameboy%20Sound%20System%20(.gbs).txt 81270 string GBS Nintendo Gameboy Music/Audio Data 8128#12 string GameBoy\ Music\ Module Nintendo Gameboy Music Module 8129>16 string >\0 ("%.32s" by 8130>48 string >\0 %.32s, copyright 8131>80 string >\0 %.32s), 8132>3 byte x version %u, 8133>4 byte x %u tracks 8134 8135# IPS Patch Files from: From: Thomas Klausner <tk@giga.or.at> 8136# see https://zerosoft.zophar.net/ips.php 81370 string PATCH IPS patch file 8138!:ext ips 8139 8140# BPS Patch Files - from: David Korth <gerbilsoft@gerbilsoft.com> 8141# Reference: https://www.romhacking.net/documents/746/ 81420 string BPS1 BPS patch file 8143!:ext bps 8144 8145# APS Patch Files - from: David Korth <gerbilsoft@gerbilsoft.com> 8146# Reference: https://github.com/btimofeev/UniPatcher/wiki/APS-(N64) 81470 string APS10 APS patch file 8148!:ext aps 8149>5 byte 0 \b, simple patch 8150>5 byte 1 \b, N64-specific patch for 8151>>58 byte x N%c 8152>>59 byte x \b%c 8153>>60 byte x \b%c 8154>7 byte !0x20 8155# FIXME: /T specifier isn't working with a fixed-length string. 8156>>7 string x \b: "%.50s" 8157 8158# UPS Patch Files - from: David Korth <gerbilsoft@gerbilsoft.com> 8159# Reference: http://fileformats.archiveteam.org/wiki/UPS_(binary_patch_format) 81600 string UPS1 UPS patch file 8161!:ext ups 8162 8163# Playstations Patch Files from: From: Thomas Klausner <tk@giga.or.at> 81640 string PPF30 Playstation Patch File version 3.0 8165>5 byte 0 \b, PPF 1.0 patch 8166>5 byte 1 \b, PPF 2.0 patch 8167>5 byte 2 \b, PPF 3.0 patch 8168>>56 byte 0 \b, Imagetype BIN (any) 8169>>56 byte 1 \b, Imagetype GI (PrimoDVD) 8170>>57 byte 0 \b, Blockcheck disabled 8171>>57 byte 1 \b, Blockcheck enabled 8172>>58 byte 0 \b, Undo data not available 8173>>58 byte 1 \b, Undo data available 8174>6 string x \b, description: %s 8175 81760 string PPF20 Playstation Patch File version 2.0 8177>5 byte 0 \b, PPF 1.0 patch 8178>5 byte 1 \b, PPF 2.0 patch 8179>>56 lelong >0 \b, size of file to patch %d 8180>6 string x \b, description: %s 8181 81820 string PPF10 Playstation Patch File version 1.0 8183>5 byte 0 \b, Simple Encoding 8184>6 string x \b, description: %s 8185 8186# From: Daniel Dawson <ddawson@icehouse.net> 8187# SNES9x .smv "movie" file format. 81880 string SMV\x1A SNES9x input recording 8189>0x4 lelong x \b, version %d 8190# version 4 is latest so far 8191>0x4 lelong <5 8192>>0x8 ledate x \b, recorded at %s 8193>>0xc lelong >0 \b, rerecorded %d times 8194>>0x10 lelong x \b, %d frames long 8195>>0x14 byte >0 \b, data for controller(s): 8196>>>0x14 byte &0x1 #1 8197>>>0x14 byte &0x2 #2 8198>>>0x14 byte &0x4 #3 8199>>>0x14 byte &0x8 #4 8200>>>0x14 byte &0x10 #5 8201>>0x15 byte ^0x1 \b, begins from snapshot 8202>>0x15 byte &0x1 \b, begins from reset 8203>>0x15 byte ^0x2 \b, NTSC standard 8204>>0x15 byte &0x2 \b, PAL standard 8205>>0x17 byte &0x1 \b, settings: 8206# WIP1Timing not used as of version 4 8207>>>0x4 lelong <4 8208>>>>0x17 byte &0x2 WIP1Timing 8209>>>0x17 byte &0x4 Left+Right 8210>>>0x17 byte &0x8 VolumeEnvX 8211>>>0x17 byte &0x10 FakeMute 8212>>>0x17 byte &0x20 SyncSound 8213# New flag as of version 4 8214>>>0x4 lelong >3 8215>>>>0x17 byte &0x80 NoCPUShutdown 8216>>0x4 lelong <4 8217>>>0x18 lelong >0x23 8218>>>>0x20 leshort !0 8219>>>>>0x20 lestring16 x \b, metadata: "%s" 8220>>0x4 lelong >3 8221>>>0x24 byte >0 \b, port 1: 8222>>>>0x24 byte 1 joypad 8223>>>>0x24 byte 2 mouse 8224>>>>0x24 byte 3 SuperScope 8225>>>>0x24 byte 4 Justifier 8226>>>>0x24 byte 5 multitap 8227>>>0x24 byte >0 \b, port 2: 8228>>>>0x25 byte 1 joypad 8229>>>>0x25 byte 2 mouse 8230>>>>0x25 byte 3 SuperScope 8231>>>>0x25 byte 4 Justifier 8232>>>>0x25 byte 5 multitap 8233>>>0x18 lelong >0x43 8234>>>>0x40 leshort !0 8235>>>>>0x40 lestring16 x \b, metadata: "%s" 8236>>0x17 byte &0x40 \b, ROM: 8237>>>(0x18.l-26) lelong x CRC32 0x%08x 8238>>>(0x18.l-23) string x "%s" 8239 8240# Type: scummVM savegame files 8241# From: Sven Hartge <debian@ds9.argh.org> 82420 string SCVM ScummVM savegame 8243>12 string >\0 "%s" 8244 8245#------------------------------------------------------------------------------ 8246# Nintendo GameCube / Wii file formats. 8247# 8248 8249# Type: Nintendo GameCube/Wii common disc header data. 8250# From: David Korth <gerbilsoft@gerbilsoft.com> 8251# Reference: https://wiibrew.org/wiki/Wii_Disc 82520 name nintendo-gcn-disc-common 8253>0x20 string x "%.64s" 8254>0x00 string x (%.6s 8255>0x06 byte >0 8256>>0x06 byte 1 \b, Disc 2 8257>>0x06 byte 2 \b, Disc 3 8258>>0x06 byte 3 \b, Disc 4 8259>0x07 byte x \b, Rev.%02u) 8260>0x18 belong 0x5D1C9EA3 8261>>0x60 beshort 0x0101 \b (Unencrypted) 8262>0x200 string NKIT \b (NKit compressed) 8263 8264 8265# Type: Nintendo GameCube disc image 8266# From: David Korth <gerbilsoft@gerbilsoft.com> 8267# Reference: https://wiibrew.org/wiki/Wii_Disc 82680x1C belong 0xC2339F3D Nintendo GameCube disc image: 8269!:mime application/x-gamecube-rom 8270>0 use nintendo-gcn-disc-common 8271 8272# Type: Nintendo GameCube embedded disc image 8273# Commonly found on demo discs. 8274# From: David Korth <gerbilsoft@gerbilsoft.com> 8275# Reference: http://hitmen.c02.at/files/yagcd/yagcd/index.html#idx14.8 82760 belong 0xAE0F38A2 8277>0x0C belong 0x00100000 8278>>(8.L+0x1C) belong 0xC2339F3D Nintendo GameCube embedded disc image: 8279!:mime application/x-gamecube-rom 8280>>>(8.L) use nintendo-gcn-disc-common 8281 8282# Type: Nintendo Wii disc image 8283# From: David Korth <gerbilsoft@gerbilsoft.com> 8284# Reference: https://wiibrew.org/wiki/Wii_Disc 82850x18 belong 0x5D1C9EA3 Nintendo Wii disc image: 8286>0 use nintendo-gcn-disc-common 8287 8288# Type: Nintendo Wii disc image (WBFS format) 8289# From: David Korth <gerbilsoft@gerbilsoft.com> 8290# Reference: https://wiibrew.org/wiki/Wii_Disc 82910 string WBFS 8292>0x218 belong 0x5D1C9EA3 Nintendo Wii disc image (WBFS format): 8293!:mime application/x-wii-rom 8294>>0x200 use nintendo-gcn-disc-common 8295 8296# Type: Nintendo GameCube/Wii disc image (CISO format) 8297# NOTE: This is NOT the same as Compact ISO or PSP CISO, 8298# though it has the same magic number. 82990 string CISO 8300# Other fields are used to determine what type of CISO this is: 8301# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size) 8302# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size) 8303# - None of the above: Compact ISO. 8304>4 lelong 0x200000 8305>>8 byte 1 8306>>>0x801C belong 0xC2339F3D Nintendo GameCube disc image (CISO format): 8307!:mime application/x-wii-rom 8308>>>>0x8000 use nintendo-gcn-disc-common 8309>>>0x8018 belong 0x5D1C9EA3 Nintendo Wii disc image (CISO format): 8310!:mime application/x-wii-rom 8311>>>>0x8000 use nintendo-gcn-disc-common 8312 8313# Type: Nintendo GameCube/Wii disc image (GCZ format) 8314# Due to zlib compression, we can't get the actual disc information. 83150 lelong 0xB10BC001 8316>4 lelong 0 Nintendo GameCube disc image (GCZ format) 8317!:mime application/x-gamecube-rom 8318>4 lelong 1 Nintendo Wii disc image (GCZ format) 8319!:mime application/x-wii-rom 8320>4 default x Nintendo GameCube/Wii disc image (GCZ format) 8321 8322# Type: Nintendo GameCube/Wii disc image (WDF format) 83230 string WII\001DISC 8324>8 belong 1 8325# WDFv1 8326>>0x54 belong 0xC2339F3D Nintendo GameCube disc image (WDFv1 format): 8327!:mime application/x-gamecube-rom 8328>>>0x38 use nintendo-gcn-disc-common 8329>>0x58 belong 0x5D1C9EA3 Nintendo Wii disc image (WDFv1 format): 8330!:mime application/x-wii-rom 8331>>>0x38 use nintendo-gcn-disc-common 8332>8 belong 2 8333# WDFv2 8334>>(12.L+0x1C) belong 0xC2339F3D Nintendo GameCube disc image (WDFv2 format): 8335!:mime application/x-gamecube-rom 8336>>>(12.L) use nintendo-gcn-disc-common 8337>>(12.L+0x18) belong 0x5D1C9EA3 Nintendo Wii disc image (WDFv2 format): 8338!:mime application/x-wii-rom 8339>>>(12.L) use nintendo-gcn-disc-common 8340 8341# Type: Nintendo GameCube/Wii disc image (WIA format) 83420 string WIA\001 Nintendo 8343>0x48 belong 1 GameCube 8344!:mime application/x-gamecube-rom 8345>0x48 belong 2 Wii 8346!:mime application/x-wii-rom 8347>0x48 default x GameCube/Wii 8348>0x48 belong x disc image (WIA format): 8349>>0x58 use nintendo-gcn-disc-common 8350 8351# Type: Nintendo GameCube/Wii disc image (with SDK header) 8352# From: David Korth <gerbilsoft@gerbilsoft.com> 8353# Reference: https://wiibrew.org/wiki/Wii_Disc 83540 belong 0xFFFF0000 8355>0x18 belong 0x00000000 8356>>0x1C belong 0x00000000 8357>>>0x8018 belong 0x5D1C9EA3 Nintendo Wii SDK disc image: 8358!:mime application/x-wii-rom 8359>>>>0x8000 use nintendo-gcn-disc-common 8360>>>0x801C belong 0xC2339F3D Nintendo GameCube SDK disc image: 8361!:mime application/x-gamecube-rom 8362>>>>0x8000 use nintendo-gcn-disc-common 8363 8364#------------------------------------------------------------------------------ 8365# Nintendo 3DS file formats. 8366# 8367 8368# Type: Nintendo 3DS "NCSD" image. (game cards and eMMC) 8369# From: David Korth <gerbilsoft@gerbilsoft.com> 8370# Reference: https://www.3dbrew.org/wiki/NCSD 83710x100 string NCSD 8372>0x118 lequad 0 Nintendo 3DS Game Card image 8373# NCCH header for partition 0. (game data) 8374>>0x1150 string >\0 \b: "%.16s" 8375>>0x312 byte x (Rev.%02u) 8376>>0x118C byte 2 (New3DS only) 8377>>0x18D byte 0 (inner device) 8378>>0x18D byte 1 (Card1) 8379>>0x18D byte 2 (Card2) 8380>>0x18D byte 3 (extended device) 8381>0x118 bequad 0x0102020202000000 Nintendo 3DS eMMC dump (Old3DS) 8382>0x118 bequad 0x0102020203000000 Nintendo 3DS eMMC dump (New3DS) 8383 8384# Nintendo 3DS version code. 8385# Reference: https://www.3dbrew.org/wiki/Titles 8386# Format: leshort containing three fields: 8387# - 6-bit: Major 8388# - 6-bit: Minor 8389# - 4-bit: Revision 8390# NOTE: Only supporting major/minor versions from 0-15 right now. 8391# NOTE: Should be prefixed with "v". 83920 name nintendo-3ds-version-code 8393# Raw version. 8394>0 leshort x \b%u, 8395# Major version. 8396>0 leshort&0xFC00 0x0000 0 8397>0 leshort&0xFC00 0x0400 1 8398>0 leshort&0xFC00 0x0800 2 8399>0 leshort&0xFC00 0x0C00 3 8400>0 leshort&0xFC00 0x1000 4 8401>0 leshort&0xFC00 0x1400 5 8402>0 leshort&0xFC00 0x1800 6 8403>0 leshort&0xFC00 0x1C00 7 8404>0 leshort&0xFC00 0x2000 8 8405>0 leshort&0xFC00 0x2400 9 8406>0 leshort&0xFC00 0x2800 10 8407>0 leshort&0xFC00 0x2C00 11 8408>0 leshort&0xFC00 0x3000 12 8409>0 leshort&0xFC00 0x3400 13 8410>0 leshort&0xFC00 0x3800 14 8411>0 leshort&0xFC00 0x3C00 15 8412# Minor version. 8413>0 leshort&0x03F0 0x0000 \b.0 8414>0 leshort&0x03F0 0x0010 \b.1 8415>0 leshort&0x03F0 0x0020 \b.2 8416>0 leshort&0x03F0 0x0030 \b.3 8417>0 leshort&0x03F0 0x0040 \b.4 8418>0 leshort&0x03F0 0x0050 \b.5 8419>0 leshort&0x03F0 0x0060 \b.6 8420>0 leshort&0x03F0 0x0070 \b.7 8421>0 leshort&0x03F0 0x0080 \b.8 8422>0 leshort&0x03F0 0x0090 \b.9 8423>0 leshort&0x03F0 0x00A0 \b.10 8424>0 leshort&0x03F0 0x00B0 \b.11 8425>0 leshort&0x03F0 0x00C0 \b.12 8426>0 leshort&0x03F0 0x00D0 \b.13 8427>0 leshort&0x03F0 0x00E0 \b.14 8428>0 leshort&0x03F0 0x00F0 \b.15 8429# Revision. 8430>0 leshort&0x000F x \b.%u 8431 8432# Type: Nintendo 3DS "NCCH" container. 8433# https://www.3dbrew.org/wiki/NCCH 84340x100 string NCCH Nintendo 3DS 8435>0x18D byte&2 0 File Archive (CFA) 8436>0x18D byte&2 2 Executable Image (CXI) 8437>0x150 string >\0 \b: "%.16s" 8438>0x18D byte 0x05 8439>>0x10E leshort x (Old3DS System Update v 8440>>0x10E use nintendo-3ds-version-code 8441>>0x10E leshort x \b) 8442>0x18D byte 0x15 8443>>0x10E leshort x (New3DS System Update v 8444>>0x10E use nintendo-3ds-version-code 8445>>0x10E leshort x \b) 8446>0x18D byte !0x05 8447>>0x18D byte !0x15 8448>>>0x112 byte x (v 8449>>>0x112 use nintendo-3ds-version-code 8450>>>0x112 byte x \b) 8451>0x18C byte 2 (New3DS only) 8452 8453# Type: Nintendo 3DS "SMDH" file. (application description) 8454# From: David Korth <gerbilsoft@gerbilsoft.com> 8455# Reference: https://3dbrew.org/wiki/SMDH 84560 string SMDH Nintendo 3DS SMDH file 8457>0x208 leshort !0 8458>>0x208 lestring16 x \b: "%.128s" 8459>>0x388 leshort !0 8460>>>0x388 lestring16 x by %.128s 8461>0x208 leshort 0 8462>>0x008 leshort !0 8463>>>0x008 lestring16 x \b: "%.128s" 8464>>>0x188 leshort !0 8465>>>>0x188 lestring16 x by %.128s 8466 8467# Type: Nintendo 3DS Homebrew Application. 8468# From: David Korth <gerbilsoft@gerbilsoft.com> 8469# Reference: https://3dbrew.org/wiki/3DSX_Format 84700 string 3DSX Nintendo 3DS Homebrew Application (3DSX) 8471 8472#------------------------------------------------------------------------------ 8473# a7800: file(1) magic for the Atari 7800 raw ROM format. 8474# From: David Korth <gerbilsoft@gerbilsoft.com> 8475# Reference: https://sites.google.com/site/atari7800wiki/a78-header 8476 84770 byte >0 8478>0 byte <3 8479>>1 string ATARI7800 Atari 7800 ROM image 8480!:mime application/x-atari-7800-rom 8481>>>0x11 string >\0 \b: "%.32s" 8482# Display type. 8483>>>0x39 byte 0 (NTSC) 8484>>>0x39 byte 1 (PAL) 8485>>>0x36 byte&1 1 (POKEY) 8486 8487#------------------------------------------------------------------------------ 8488# vectrex: file(1) magic for the GCE Vectrex raw ROM format. 8489# From: David Korth <gerbilsoft@gerbilsoft.com> 8490# Reference: http://www.playvectrex.com/designit/chrissalo/hello1.htm 8491# 8492# NOTE: Title is terminated with 0x80, not 0. 8493# The header is terminated with a 0, so that will 8494# terminate the title as well. 8495# 84960 string g\ GCE Vectrex ROM image 8497>0x11 string >\0 \b: "%.16s" 8498 8499#------------------------------------------------------------------------------ 8500# amiibo: file(1) magic for Nintendo amiibo NFC dumps. 8501# From: David Korth <gerbilsoft@gerbilsoft.com> 8502# Reference: https://www.3dbrew.org/wiki/Amiibo 85030x00 byte 0x04 8504>0x0A beshort 0x0FE0 8505>>0x0C belong 0xF110FFEE 8506>>>0x208 beshort 0x0100 8507>>>>0x020A byte 0x0F 8508>>>>>0x020C bequad 0x000000045F000000 8509>>>>>>0x5B byte 0x02 8510>>>>>>>0x54 belong x Nintendo amiibo NFC dump - amiibo ID: %08X- 8511>>>>>>>0x58 belong x \b%08X 8512 8513#------------------------------------------------------------------------------ 8514# Type: Nintendo Switch XCI (Game Cartridge Image) 8515# From: Benjamin Lowry <ben@ben.gmbh> 8516# Reference: https://switchbrew.org/wiki/Gamecard_Format 85170x100 string HEAD 8518>0x10D byte 0xFA Nintendo Switch cartridge image (XCI), 1GB 8519>0x10D byte 0xF8 Nintendo Switch cartridge image (XCI), 2GB 8520>0x10D byte 0xF0 Nintendo Switch cartridge image (XCI), 4GB 8521>0x10D byte 0xE0 Nintendo Switch cartridge image (XCI), 8GB 8522>0x10D byte 0xE1 Nintendo Switch cartridge image (XCI), 16GB 8523>0x10D byte 0xE2 Nintendo Switch cartridge image (XCI), 32GB 8524 8525#------------------------------------------------------------------------------ 8526# Type: Nintendo Switch Executable 8527# From: Benjamin Lowry <ben@ben.gmbh> 8528# Reference: https://switchbrew.org/wiki/NSO 85290x00 string NSO0 Nintendo Switch executable (NSO) 8530 8531#------------------------------------------------------------------------------ 8532# Type: Nintendo Switch PFS0 8533# From: Benjamin Lowry <ben@ben.gmbh> 8534# Reference: https://switchbrew.org/wiki/NCA_Format#PFS0 85350x00 string PFS0 Nintendo Switch partition filesystem (PFS0) 8536>0x04 ulelong x \b, %d files 8537 8538#------------------------------------------------------------------------------ 8539# amiibo: file(1) magic for Nintendo Badge Arcade files. 8540# From: David Korth <gerbilsoft@gerbilsoft.com> 8541# References: 8542# - https://github.com/GerbilSoft/rom-properties/issues/92 8543# - https://github.com/CaitSith2/BadgeArcadeTool 8544# - https://github.com/TheMachinumps/Advanced-badge-editor 8545 8546# PRBS: Individual badge and/or mega badge. 85470 string PRBS 8548>0x44 byte >0x20 Nintendo Badge Arcade 8549>>0xB8 ulelong <2 8550>>>0xBC ulelong <2 badge: 8551>>>0xBC ulelong >1 Mega Badge 8552>>>>0xB8 ulelong x (%ux 8553>>>>0xBC ulelong x \b%u): 8554>>0xB8 ulelong >1 Mega Badge 8555>>>0xB8 ulelong x (%ux 8556>>>0xBC ulelong x \b%u): 8557>0x44 string x "%s" 8558>0x3C ulelong x \b, badge ID: %u 8559>0x74 byte >0x20 8560>>0x74 string x \b, set: "%s" 8561>0xA8 ulelong !0xFFFFFFFF 8562>>0xA8 ulelong x \b, launch title ID: %08X 8563>>0xA4 ulelong x \b-%08X 8564 8565# CABS: Badge set. 85660 string CABS 8567>0x2C byte >0x20 Nintendo Badge Arcade badge set: 8568>>0x2C string x "%.48s" 8569>>0x24 ulelong x \b, set ID: %u 8570 8571#------------------------------------------------------------------------------ 8572# $File: convex,v 1.8 2012/10/03 23:44:43 christos Exp $ 8573# convex: file(1) magic for Convex boxes 8574# 8575# Convexes are big-endian. 8576# 8577# /*\ 8578# * Below are the magic numbers and tests added for Convex. 8579# * Added at beginning, because they are expected to be used most. 8580# \*/ 85810 belong 0507 Convex old-style object 8582>16 belong >0 not stripped 85830 belong 0513 Convex old-style demand paged executable 8584>16 belong >0 not stripped 85850 belong 0515 Convex old-style pre-paged executable 8586>16 belong >0 not stripped 85870 belong 0517 Convex old-style pre-paged, non-swapped executable 8588>16 belong >0 not stripped 85890 belong 0x011257 Core file 8590# 8591# The following are a series of dump format magic numbers. Each one 8592# corresponds to a drastically different dump format. The first on is 8593# the original dump format on a 4.1 BSD or earlier file system. The 8594# second marks the change between the 4.1 file system and the 4.2 file 8595# system. The Third marks the changing of the block size from 1K 8596# to 2K to be compatible with an IDC file system. The fourth indicates 8597# a dump that is dependent on Convex Storage Manager, because data in 8598# secondary storage is not physically contained within the dump. 8599# The restore program uses these number to determine how the data is 8600# to be extracted. 8601# 860224 belong =60013 dump format, 4.2 or 4.3 BSD (IDC compatible) 860324 belong =60014 dump format, Convex Storage Manager by-reference dump 8604# 8605# what follows is a bunch of bit-mask checks on the flags field of the opthdr. 8606# If there is no `=' sign, assume just checking for whether the bit is set? 8607# 86080 belong 0601 Convex SOFF 8609>88 belong&0x000f0000 =0x00000000 c1 8610>88 belong &0x00010000 c2 8611>88 belong &0x00020000 c2mp 8612>88 belong &0x00040000 parallel 8613>88 belong &0x00080000 intrinsic 8614>88 belong &0x00000001 demand paged 8615>88 belong &0x00000002 pre-paged 8616>88 belong &0x00000004 non-swapped 8617>88 belong &0x00000008 POSIX 8618# 8619>84 belong &0x80000000 executable 8620>84 belong &0x40000000 object 8621>84 belong&0x20000000 =0 not stripped 8622>84 belong&0x18000000 =0x00000000 native fpmode 8623>84 belong&0x18000000 =0x10000000 ieee fpmode 8624>84 belong&0x18000000 =0x18000000 undefined fpmode 8625# 86260 belong 0605 Convex SOFF core 8627# 86280 belong 0607 Convex SOFF checkpoint 8629>88 belong&0x000f0000 =0x00000000 c1 8630>88 belong &0x00010000 c2 8631>88 belong &0x00020000 c2mp 8632>88 belong &0x00040000 parallel 8633>88 belong &0x00080000 intrinsic 8634>88 belong &0x00000008 POSIX 8635# 8636>84 belong&0x18000000 =0x00000000 native fpmode 8637>84 belong&0x18000000 =0x10000000 ieee fpmode 8638>84 belong&0x18000000 =0x18000000 undefined fpmode 8639 8640#------------------------------------------------------------------------------ 8641# $File: coverage,v 1.2 2019/04/19 00:42:27 christos Exp $ 8642# xoverage: file(1) magic for test coverage data 8643 8644# File formats used to store test coverage data 8645# 2016-05-21, Georg Sauthoff <mail@georg.so> 8646 8647 8648# - GCC gcno - written by GCC at compile time when compiling with 8649# gcc -ftest-coverage 8650# - GCC gcda - written by a program that was compiled with 8651# gcc -fprofile-arcs 8652# - LLVM raw profiles - generated by a program compiled with 8653# clang -fprofile-instr-generate -fcoverage-mapping ... 8654# - LLVM indexed profiles - generated by 8655# llvm-profdata 8656# - GCOV reports, i.e. the annotated source code 8657# - LCOV trace files, i.e. aggregated GCC profiles 8658# 8659# GCC coverage tracefiles 8660# .gcno file are created during compile time, 8661# while data collected during runtime is stored in .gcda files 8662# cf. gcov-io.h 8663# https://gcc.gnu.org/onlinedocs/gcc-5.3.0/gcc/Gcov-Data-Files.html 8664# Examples: 8665# Fedora 23/x86-64/gcc-5.3.1: 6f 6e 63 67 52 33 30 35 8666# Debian 8 PPC64/gcc-4.9.2 : 67 63 6e 6f 34 30 39 2a 86670 lelong 0x67636e6f GCC gcno coverage (-ftest-coverage), 8668>&3 byte x version %c. 8669>&1 byte x \b%c 8670 8671# big endian 86720 belong 0x67636e6f GCC gcno coverage (-ftest-coverage), 8673>&0 byte x version %c. 8674>&2 byte x \b%c (big-endian) 8675 8676# Examples: 8677# Fedora 23/x86-64/gcc-5.3.1: 61 64 63 67 52 33 30 35 8678# Debian 8 PPC64/gcc-4.9.2 : 67 63 64 61 34 30 39 2a 86790 lelong 0x67636461 GCC gcda coverage (-fprofile-arcs), 8680>&3 byte x version %c. 8681>&1 byte x \b%c 8682 8683# big endian 86840 belong 0x67636461 GCC gcda coverage (-fprofile-arcs), 8685>&0 byte x version %c. 8686>&2 byte x \b%c (big-endian) 8687 8688 8689# LCOV tracefiles 8690# cf. http://ltp.sourceforge.net/coverage/lcov/geninfo.1.php 86910 string TN: 8692>&0 search/64 \nSF:/ LCOV coverage tracefile 8693 8694 8695# Coverage reports generated by gcov 8696# i.e. source code annoted with coverage information 86970 string \x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Source: 8698>&0 search/128 \x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Graph: 8699>>&0 search/128 \x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Data: GCOV coverage report 8700 8701 8702# LLVM coverage files 8703 8704# raw data after running a program compiled with: 8705# `clang -fprofile-instr-generate -fcoverage-mapping ...` 8706# default name: default.profraw 8707# magic is: \xFF lprofr \x81 8708# cf. https://llvm.org/docs/doxygen/html/InstrProfData_8inc_source.html 87090 lequad 0xff6c70726f667281 LLVM raw profile data, 8710>&0 byte x version %d 8711 8712# big endian 87130 bequad 0xff6c70726f667281 LLVM raw profile data, 8714>&7 byte x version %d (big-endian) 8715 8716 8717# LLVM indexed instruction profile (as generated by llvm-profdata) 8718# magic is: reverse(\xFF lprofi \x81) 8719# cf. https://llvm.org/docs/CoverageMappingFormat.html 8720# https://llvm.org/docs/doxygen/html/namespacellvm_1_1IndexedInstrProf.html 8721# https://llvm.org/docs/CommandGuide/llvm-cov.html 8722# https://llvm.org/docs/CommandGuide/llvm-profdata.html 87230 lequad 0x8169666f72706cff LLVM indexed profile data, 8724>&0 byte x version %d 8725 8726# big endian 87270 bequad 0x8169666f72706cff LLVM indexed profile data, 8728>&7 byte x version %d (big-endian) 8729 8730 8731#------------------------------------------------------------------------------ 8732# $File: cracklib,v 1.7 2009/09/19 16:28:08 christos Exp $ 8733# cracklib: file (1) magic for cracklib v2.7 8734 87350 lelong 0x70775631 Cracklib password index, little endian 8736>4 long >0 (%i words) 8737>4 long 0 ("64-bit") 8738>>8 long >-1 (%i words) 87390 belong 0x70775631 Cracklib password index, big endian 8740>4 belong >-1 (%i words) 8741# really bellong 0x0000000070775631 87420 search/1 \0\0\0\0pwV1 Cracklib password index, big endian ("64-bit") 8743>12 belong >0 (%i words) 8744 8745# ---------------------------------------------------------------------------- 8746# $File: ctags,v 1.6 2009/09/19 16:28:08 christos Exp $ 8747# ctags: file (1) magic for Exuberant Ctags files 8748# From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de> 87490 search/1 =!_TAG Exuberant Ctags tag file text 8750 8751#-------------------------------------------------------------- 8752# ctf: file(1) magic for CTF (Common Trace Format) trace files 8753# 8754# Specs. available here: <https://www.efficios.com/ctf> 8755#-------------------------------------------------------------- 8756 8757# CTF trace data 87580 lelong 0xc1fc1fc1 Common Trace Format (CTF) trace data (LE) 87590 belong 0xc1fc1fc1 Common Trace Format (CTF) trace data (BE) 8760 8761# CTF metadata (packetized) 87620 lelong 0x75d11d57 Common Trace Format (CTF) packetized metadata (LE) 8763>35 byte x \b, v%d 8764>36 byte x \b.%d 87650 belong 0x75d11d57 Common Trace Format (CTF) packetized metadata (BE) 8766>35 byte x \b, v%d 8767>36 byte x \b.%d 8768 8769# CTF metadata (plain text) 87700 string /*\x20CTF\x20 Common Trace Format (CTF) plain text metadata 8771!:strength + 5 # this is to make sure we beat C 8772>&0 regex [0-9]+\.[0-9]+ \b, v%s 8773 8774#------------------------------------------------------------------------------ 8775# $File: cubemap,v 1.1 2012/06/06 13:03:20 christos Exp $ 8776# file(1) magic(5) data for cubemaps Martin Erik Werner <martinerikwerner@gmail.com> 8777# 87780 string ACMP Map file for the AssaultCube FPS game 87790 string CUBE Map file for cube and cube2 engine games 87800 string MAPZ) Map file for the Blood Frontier/Red Eclipse FPS games 8781 8782#------------------------------------------------------------------------------ 8783# $File: cups,v 1.6 2019/04/19 00:42:27 christos Exp $ 8784# Cups: file(1) magic for the cups raster file format 8785# From: Laurent Martelli <martellilaurent@gmail.com> 8786# https://www.cups.org/documentation.php/spec-raster.html 8787# 8788 87890 name cups-le 8790>280 lelong x \b, %d 8791>284 lelong x \bx%d dpi 8792>376 lelong x \b, %dx 8793>380 lelong x \b%d pixels 8794>388 lelong x %d bits/color 8795>392 lelong x %d bits/pixel 8796>400 lelong 0 ColorOrder=Chunky 8797>400 lelong 1 ColorOrder=Banded 8798>400 lelong 2 ColorOrder=Planar 8799>404 lelong 0 ColorSpace=gray 8800>404 lelong 1 ColorSpace=RGB 8801>404 lelong 2 ColorSpace=RGBA 8802>404 lelong 3 ColorSpace=black 8803>404 lelong 4 ColorSpace=CMY 8804>404 lelong 5 ColorSpace=YMC 8805>404 lelong 6 ColorSpace=CMYK 8806>404 lelong 7 ColorSpace=YMCK 8807>404 lelong 8 ColorSpace=KCMY 8808>404 lelong 9 ColorSpace=KCMYcm 8809>404 lelong 10 ColorSpace=GMCK 8810>404 lelong 11 ColorSpace=GMCS 8811>404 lelong 12 ColorSpace=WHITE 8812>404 lelong 13 ColorSpace=GOLD 8813>404 lelong 14 ColorSpace=SILVER 8814>404 lelong 15 ColorSpace=CIE XYZ 8815>404 lelong 16 ColorSpace=CIE Lab 8816>404 lelong 17 ColorSpace=RGBW 8817>404 lelong 18 ColorSpace=sGray 8818>404 lelong 19 ColorSpace=sRGB 8819>404 lelong 20 ColorSpace=AdobeRGB 8820 8821# Cups Raster image format, Big Endian 88220 string RaS 8823>3 string t Cups Raster version 1, Big Endian 8824>3 string 2 Cups Raster version 2, Big Endian 8825>3 string 3 Cups Raster version 3, Big Endian 8826!:mime application/vnd.cups-raster 8827>0 use \^cups-le 8828 8829 8830# Cups Raster image format, Little Endian 88311 string SaR 8832>0 string t Cups Raster version 1, Little Endian 8833>0 string 2 Cups Raster version 2, Little Endian 8834>0 string 3 Cups Raster version 3, Little Endian 8835!:mime application/vnd.cups-raster 8836>0 use cups-le 8837 8838#------------------------------------------------------------------------------ 8839# $File: dact,v 1.4 2009/09/19 16:28:08 christos Exp $ 8840# dact: file(1) magic for DACT compressed files 8841# 88420 long 0x444354C3 DACT compressed data 8843>4 byte >-1 (version %i. 8844>5 byte >-1 $BS%i. 8845>6 byte >-1 $BS%i) 8846>7 long >0 $BS, original size: %i bytes 8847>15 long >30 $BS, block size: %i bytes 8848 8849#------------------------------------------------------------------------------ 8850# $File: database,v 1.59 2020/03/25 01:49:58 christos Exp $ 8851# database: file(1) magic for various databases 8852# 8853# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk) 8854# 8855# 8856# GDBM magic numbers 8857# Will be maintained as part of the GDBM distribution in the future. 8858# <downsj@teeny.org> 88590 belong 0x13579acd GNU dbm 1.x or ndbm database, big endian, 32-bit 8860!:mime application/x-gdbm 88610 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian, old 8862!:mime application/x-gdbm 88630 belong 0x13579acf GNU dbm 1.x or ndbm database, big endian, 64-bit 8864!:mime application/x-gdbm 88650 lelong 0x13579acd GNU dbm 1.x or ndbm database, little endian, 32-bit 8866!:mime application/x-gdbm 88670 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian, old 8868!:mime application/x-gdbm 88690 lelong 0x13579acf GNU dbm 1.x or ndbm database, little endian, 64-bit 8870!:mime application/x-gdbm 88710 string GDBM GNU dbm 2.x database 8872!:mime application/x-gdbm 8873# 8874# Berkeley DB 8875# 8876# Ian Darwin's file /etc/magic files: big/little-endian version. 8877# 8878# Hash 1.85/1.86 databases store metadata in network byte order. 8879# Btree 1.85/1.86 databases store the metadata in host byte order. 8880# Hash and Btree 2.X and later databases store the metadata in host byte order. 8881 88820 long 0x00061561 Berkeley DB 8883!:mime application/x-dbm 8884>8 belong 4321 8885>>4 belong >2 1.86 8886>>4 belong <3 1.85 8887>>4 belong >0 (Hash, version %d, native byte-order) 8888>8 belong 1234 8889>>4 belong >2 1.86 8890>>4 belong <3 1.85 8891>>4 belong >0 (Hash, version %d, little-endian) 8892 88930 belong 0x00061561 Berkeley DB 8894>8 belong 4321 8895>>4 belong >2 1.86 8896>>4 belong <3 1.85 8897>>4 belong >0 (Hash, version %d, big-endian) 8898>8 belong 1234 8899>>4 belong >2 1.86 8900>>4 belong <3 1.85 8901>>4 belong >0 (Hash, version %d, native byte-order) 8902 89030 long 0x00053162 Berkeley DB 1.85/1.86 8904>4 long >0 (Btree, version %d, native byte-order) 89050 belong 0x00053162 Berkeley DB 1.85/1.86 8906>4 belong >0 (Btree, version %d, big-endian) 89070 lelong 0x00053162 Berkeley DB 1.85/1.86 8908>4 lelong >0 (Btree, version %d, little-endian) 8909 891012 long 0x00061561 Berkeley DB 8911>16 long >0 (Hash, version %d, native byte-order) 891212 belong 0x00061561 Berkeley DB 8913>16 belong >0 (Hash, version %d, big-endian) 891412 lelong 0x00061561 Berkeley DB 8915>16 lelong >0 (Hash, version %d, little-endian) 8916 891712 long 0x00053162 Berkeley DB 8918>16 long >0 (Btree, version %d, native byte-order) 891912 belong 0x00053162 Berkeley DB 8920>16 belong >0 (Btree, version %d, big-endian) 892112 lelong 0x00053162 Berkeley DB 8922>16 lelong >0 (Btree, version %d, little-endian) 8923 892412 long 0x00042253 Berkeley DB 8925>16 long >0 (Queue, version %d, native byte-order) 892612 belong 0x00042253 Berkeley DB 8927>16 belong >0 (Queue, version %d, big-endian) 892812 lelong 0x00042253 Berkeley DB 8929>16 lelong >0 (Queue, version %d, little-endian) 8930 8931# From Max Bowsher. 893212 long 0x00040988 Berkeley DB 8933>16 long >0 (Log, version %d, native byte-order) 893412 belong 0x00040988 Berkeley DB 8935>16 belong >0 (Log, version %d, big-endian) 893612 lelong 0x00040988 Berkeley DB 8937>16 lelong >0 (Log, version %d, little-endian) 8938 8939# 8940# 8941# Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch> 89420 string/b RRD\0 RRDTool DB 8943>4 string/b x version %s 8944 8945>>10 short !0 16bit aligned 8946>>>10 bedouble 8.642135e+130 big-endian 8947>>>>18 short x 32bit long (m68k) 8948 8949>>10 short 0 8950>>>12 long !0 32bit aligned 8951>>>>12 bedouble 8.642135e+130 big-endian 8952>>>>>20 long 0 64bit long 8953>>>>>20 long !0 32bit long 8954>>>>12 ledouble 8.642135e+130 little-endian 8955>>>>>24 long 0 64bit long 8956>>>>>24 long !0 32bit long (i386) 8957>>>>12 string \x43\x2b\x1f\x5b\x2f\x25\xc0\xc7 middle-endian 8958>>>>>24 short !0 32bit long (arm) 8959 8960>>8 quad 0 64bit aligned 8961>>>16 bedouble 8.642135e+130 big-endian 8962>>>>24 long 0 64bit long (s390x) 8963>>>>24 long !0 32bit long (hppa/mips/ppc/s390/SPARC) 8964>>>16 ledouble 8.642135e+130 little-endian 8965>>>>28 long 0 64bit long (alpha/amd64/ia64) 8966>>>>28 long !0 32bit long (armel/mipsel) 8967 8968#---------------------------------------------------------------------- 8969# ROOT: file(1) magic for ROOT databases 8970# 89710 string root\0 ROOT file 8972>4 belong x Version %d 8973>33 belong x (Compression: %d) 8974 8975# XXX: Weak magic. 8976# Alex Ott <ott@jet.msk.su> 8977## Paradox file formats 8978#2 leshort 0x0800 Paradox 8979#>0x39 byte 3 v. 3.0 8980#>0x39 byte 4 v. 3.5 8981#>0x39 byte 9 v. 4.x 8982#>0x39 byte 10 v. 5.x 8983#>0x39 byte 11 v. 5.x 8984#>0x39 byte 12 v. 7.x 8985#>>0x04 byte 0 indexed .DB data file 8986#>>0x04 byte 1 primary index .PX file 8987#>>0x04 byte 2 non-indexed .DB data file 8988#>>0x04 byte 3 non-incrementing secondary index .Xnn file 8989#>>0x04 byte 4 secondary index .Ynn file 8990#>>0x04 byte 5 incrementing secondary index .Xnn file 8991#>>0x04 byte 6 non-incrementing secondary index .XGn file 8992#>>0x04 byte 7 secondary index .YGn file 8993#>>>0x04 byte 8 incrementing secondary index .XGn file 8994 8995## XBase database files 8996# updated by Joerg Jenderek at Feb 2013 8997# https://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm 8998# https://www.clicketyclick.dk/databases/xbase/format/dbf.html 8999# inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31 90000 ubelong&0x0000FFFF <0x00000C20 9001# skip Infocom game Z-machine 9002>2 ubyte >0 9003# skip Androids *.xml 9004>>3 ubyte >0 9005>>>3 ubyte <32 9006# 1 < version VV 9007>>>>0 ubyte >1 9008# skip HELP.CA3 by test for reserved byte ( NULL ) 9009>>>>>27 ubyte 0 9010# reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF) 9011#>>>>>30 ubeshort x 30NULL?%x 9012# possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL) 9013>>>>>>24 ubelong&0xffFFFFff >0x01302000 9014# .DBF or .MDX 9015>>>>>>24 ubelong&0xffFFFFff <0x01302001 9016# for Xbase Database file (*.DBF) reserved (NULL) for multi-user 9017>>>>>>>24 ubelong&0xffFFFFff =0 9018# test for 2 reserved NULL bytes,transaction and encryption byte flag 9019>>>>>>>>12 ubelong&0xFFFFfEfE 0 9020# test for MDX flag 9021>>>>>>>>>28 ubyte x 9022>>>>>>>>>28 ubyte&0xf8 0 9023# header size >= 32 9024>>>>>>>>>>8 uleshort >31 9025# skip PIC15736.PCX by test for language driver name or field name 9026>>>>>>>>>>>32 ubyte >0 9027#!:mime application/x-dbf; charset=unknown-8bit ?? 9028#!:mime application/x-dbase 9029>>>>>>>>>>>>0 use xbase-type 9030# database file 9031>>>>>>>>>>>>0 ubyte x \b DBF 9032>>>>>>>>>>>>4 lelong 0 \b, no records 9033>>>>>>>>>>>>4 lelong >0 \b, %d record 9034# plural s appended 9035>>>>>>>>>>>>>4 lelong >1 \bs 9036# https://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF 9037# 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000) 9038>>>>>>>>>>>>10 uleshort x * %d 9039# file size = records * record size + header size 9040>>>>>>>>>>>>1 ubyte x \b, update-date 9041>>>>>>>>>>>>1 use xbase-date 9042# https://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx 9043#>>>>>>>>>>>>29 ubyte =0 \b, codepage ID=0x%x 9044# 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ? 9045>>>>>>>>>>>>29 ubyte >0 \b, codepage ID=0x%x 9046#>>>>>>>>>>>>28 ubyte&0x01 0 \b, no index file 9047>>>>>>>>>>>>28 ubyte&0x01 1 \b, with index file .MDX 9048>>>>>>>>>>>>28 ubyte&0x02 2 \b, with memo .FPT 9049>>>>>>>>>>>>28 ubyte&0x04 4 \b, DataBaseContainer 9050# 1st record offset + 1 = header size 9051>>>>>>>>>>>>8 uleshort >0 9052>>>>>>>>>>>>(8.s+1) ubyte >0 9053>>>>>>>>>>>>>8 uleshort >0 \b, at offset %d 9054>>>>>>>>>>>>>(8.s+1) ubyte >0 9055>>>>>>>>>>>>>>&-1 string >\0 1st record "%s" 9056# for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL) 9057>>>>>>>24 ubelong&0x0133f7ff >0 9058# test for reserved NULL byte 9059>>>>>>>>47 ubyte 0 9060# test for valid TAG key format (0x10 or 0) 9061>>>>>>>>>559 ubyte&0xeF 0 9062# test MM <= 12 9063>>>>>>>>>>45 ubeshort <0x0C20 9064>>>>>>>>>>>45 ubyte >0 9065>>>>>>>>>>>>46 ubyte <32 9066>>>>>>>>>>>>>46 ubyte >0 9067#!:mime application/x-mdx 9068>>>>>>>>>>>>>>0 use xbase-type 9069>>>>>>>>>>>>>>0 ubyte x \b MDX 9070>>>>>>>>>>>>>>1 ubyte x \b, creation-date 9071>>>>>>>>>>>>>>1 use xbase-date 9072>>>>>>>>>>>>>>44 ubyte x \b, update-date 9073>>>>>>>>>>>>>>44 use xbase-date 9074# No.of tags in use (1,2,5,12) 9075>>>>>>>>>>>>>>28 uleshort x \b, %d 9076# No. of entries in tag (0x30) 9077>>>>>>>>>>>>>>25 ubyte x \b/%d tags 9078# Length of tag 9079>>>>>>>>>>>>>>26 ubyte x * %d 9080# 1st tag name_ 9081>>>>>>>>>>>>>548 string x \b, 1st tag "%.11s" 9082# 2nd tag name 9083#>>>>>>>>>>>>(26.b+548) string x \b, 2nd tag "%.11s" 9084# 9085# Print the xBase names of different version variants 90860 name xbase-type 9087>0 ubyte <2 9088# 1 < version 9089>0 ubyte >1 9090>>0 ubyte 0x02 FoxBase 9091# FoxBase+/dBaseIII+, no memo 9092>>0 ubyte 0x03 FoxBase+/dBase III 9093!:mime application/x-dbf 9094# dBASE IV no memo file 9095>>0 ubyte 0x04 dBase IV 9096!:mime application/x-dbf 9097# dBASE V no memo file 9098>>0 ubyte 0x05 dBase V 9099!:mime application/x-dbf 9100>>0 ubyte 0x30 Visual FoxPro 9101!:mime application/x-dbf 9102>>0 ubyte 0x31 Visual FoxPro, autoincrement 9103!:mime application/x-dbf 9104# Visual FoxPro, with field type Varchar or Varbinary 9105>>0 ubyte 0x32 Visual FoxPro, with field type Varchar 9106!:mime application/x-dbf 9107# dBASE IV SQL, no memo;dbv memo var size (Flagship) 9108>>0 ubyte 0x43 dBase IV, with SQL table 9109!:mime application/x-dbf 9110# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 9111#>>0 ubyte 0x62 dBase IV, with SQL table 9112#!:mime application/x-dbf 9113# dBASE IV, with memo!! 9114>>0 ubyte 0x7b dBase IV, with memo 9115!:mime application/x-dbf 9116# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 9117#>>0 ubyte 0x82 dBase IV, with SQL system 9118#!:mime application/x-dbf 9119# FoxBase+/dBaseIII+ with memo .DBT! 9120>>0 ubyte 0x83 FoxBase+/dBase III, with memo .DBT 9121!:mime application/x-dbf 9122# VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file 9123>>0 ubyte 0x87 VISUAL OBJECTS, with memo file 9124!:mime application/x-dbf 9125# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 9126#>>0 ubyte 0x8A FoxBase+/dBase III, with memo .DBT 9127#!:mime application/x-dbf 9128# dBASE IV with memo! 9129>>0 ubyte 0x8B dBase IV, with memo .DBT 9130!:mime application/x-dbf 9131# dBase IV with SQL Table,no memo? 9132>>0 ubyte 0x8E dBase IV, with SQL table 9133!:mime application/x-dbf 9134# .dbv and .dbt memo (Flagship)? 9135>>0 ubyte 0xB3 Flagship 9136# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 9137#>>0 ubyte 0xCA dBase IV with memo .DBT 9138#!:mime application/x-dbf 9139# dBASE IV with SQL table, with memo .DBT 9140>>0 ubyte 0xCB dBase IV with SQL table, with memo .DBT 9141!:mime application/x-dbf 9142# HiPer-Six format;Clipper SIX, with SMT memo file 9143>>0 ubyte 0xE5 Clipper SIX with memo 9144!:mime application/x-dbf 9145# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 9146#>>0 ubyte 0xF4 dBase IV, with SQL table, with memo 9147#!:mime application/x-dbf 9148>>0 ubyte 0xF5 FoxPro with memo 9149!:mime application/x-dbf 9150# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 9151#>>0 ubyte 0xFA FoxPro 2.x, with memo 9152#!:mime application/x-dbf 9153# unknown version (should not happen) 9154>>0 default x xBase 9155!:mime application/x-dbf 9156>>>0 ubyte x (0x%x) 9157# flags in version byte 9158# DBT flag (with dBASE III memo .DBT)!! 9159# >>0 ubyte&0x80 >0 DBT_FLAG=%x 9160# memo flag ?? 9161# >>0 ubyte&0x08 >0 MEMO_FLAG=%x 9162# SQL flag ?? 9163# >>0 ubyte&0x70 >0 SQL_FLAG=%x 9164# test and print the date of xBase .DBF .MDX 91650 name xbase-date 9166# inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31 9167>0 ubelong x 9168>1 ubyte <13 9169>>1 ubyte >0 9170>>>2 ubyte >0 9171>>>>2 ubyte <32 9172>>>>>0 ubyte x 9173# YY is interpreted as 20YY or 19YY 9174>>>>>>0 ubyte <100 \b %.2d 9175# YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY 9176>>>>>>0 ubyte >99 \b %d 9177>>>>>1 ubyte x \b-%d 9178>>>>>2 ubyte x \b-%d 9179 9180# dBase memo files .DBT or .FPT 9181# https://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx 918216 ubyte <4 9183>16 ubyte !2 9184>>16 ubyte !1 9185# next free block index is positive 9186>>>0 ulelong >0 9187# skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size 9188>>>>17 ubelong&0xFFfdFEff 0x00000000 9189# skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h 9190>>>>>20 ubelong&0xFF01209B 0x00000000 9191# dBASE III 9192>>>>>>16 ubyte 3 9193# dBASE III DBT 9194>>>>>>>0 use dbase3-memo-print 9195# dBASE III DBT without version, dBASE IV DBT , FoxPro FPT , or many ZIP , DBF garbage 9196>>>>>>16 ubyte 0 9197# unusual dBASE III DBT like angest.dbt, dBASE IV DBT with block size 0 , FoxPro FPT , or garbage PCX DBF 9198>>>>>>>20 uleshort 0 9199# FoxPro FPT , unusual dBASE III DBT like biblio.dbt or garbage 9200>>>>>>>>8 ulong =0 9201>>>>>>>>>6 ubeshort >0 9202# skip emacs.PIF 9203>>>>>>>>>>4 ushort 0 9204# check for valid FoxPro field type 9205>>>>>>>>>>>512 ubelong <3 9206>>>>>>>>>>>>0 use foxpro-memo-print 9207# dBASE III DBT , garbage 9208# skip WORD1XW.DOC with improbably high free block index 9209>>>>>>>>>0 ulelong <0x400000 9210# skip WinStore.App.exe by looking for printable 2nd character of 1st memo item 9211>>>>>>>>>>513 ubyte >037 9212# unusual dBASE III DBT like adressen.dbt 9213>>>>>>>>>>>0 use dbase3-memo-print 9214# dBASE III DBT like angest.dbt, or garbage PCX DBF 9215>>>>>>>>8 ubelong !0 9216# skip PCX and some DBF by test for for reserved NULL bytes 9217>>>>>>>>>510 ubeshort 0 9218# skip bad symples with improbably high free block index above 2 GiB file limit 9219>>>>>>>>>>0 ulelong <0x400000 9220# skip AI070GEP.EPS by printable 1st character of 1st memo item 9221>>>>>>>>>>>512 ubyte >037 9222# skip gluon-ffhat-1.0-tp-link-tl-wr1043n-nd-v2-sysupgrade.bin by printable 2nd character 9223>>>>>>>>>>>>513 ubyte >037 9224>>>>>>>>>>>>>0 use dbase3-memo-print 9225# dBASE IV DBT with positive block size 9226>>>>>>>20 uleshort >0 9227# dBASE IV DBT with valid block length like 512, 1024 9228# multiple of 2 in between 16 and 16 K ,implies upper and lower bits are zero 9229# skip also 3600h 3E00h size 9230>>>>>>>>20 uleshort&0xE00f 0 9231>>>>>>>>>0 use dbase4-memo-print 9232 9233# Print the information of dBase III DBT memo file 92340 name dbase3-memo-print 9235>0 ubyte x dBase III DBT 9236!:mime application/x-dbt 9237!:ext dbt 9238# instead 3 as version number 0 for unusual examples like biblio.dbt 9239>16 ubyte !3 \b, version number %u 9240# Number of next available block for appending data 9241#>0 lelong =0 \b, next free block index %u 9242>0 lelong !0 \b, next free block index %u 9243# no positiv block length 9244#>20 uleshort =0 \b, block length %u 9245>20 uleshort !0 \b, block length %u 9246# dBase III memo field terminated by \032\032 9247>512 string >\0 \b, 1st item "%s" 9248# https://www.clicketyclick.dk/databases/xbase/format/dbt.html 9249# Print the information of dBase IV DBT memo file 92500 name dbase4-memo-print 9251>0 lelong x dBase IV DBT 9252!:mime application/x-dbt 9253!:ext dbt 9254# 8 character shorted main name of coresponding dBASE IV DBF file 9255>8 ubelong >0x20000000 9256# skip unusual like for angest.dbt 9257>>20 uleshort >0 9258>>>8 string >\0 \b of %-.8s.DBF 9259# value 0 implies 512 as size 9260#>4 ulelong =0 \b, blocks size %u 9261# size of blocks not reliable like 0x2020204C in angest.dbt 9262>4 ulelong !0 9263>>4 ulelong&0x0000003f 0 \b, blocks size %u 9264# dBase IV DBT with positive block length (found 512 , 1024) 9265>20 uleshort >0 \b, block length %u 9266# next available block 9267#>0 lelong =0 \b, next free block index %u 9268>0 lelong !0 \b, next free block index %u 9269>20 uleshort >0 9270>>(20.s) ubelong x 9271>>>&-4 use dbase4-memofield-print 9272# unusual dBase IV DBT without block length (implies 512 as length) 9273>20 uleshort =0 9274>>512 ubelong x 9275>>>&-4 use dbase4-memofield-print 9276# Print the information of dBase IV memo field 92770 name dbase4-memofield-print 9278# free dBase IV memo field 9279>0 ubelong !0xFFFF0800 9280>>0 lelong x \b, next free block %u 9281>>4 lelong x \b, next used block %u 9282# used dBase IV memo field 9283>0 ubelong =0xFFFF0800 9284# length of memo field 9285>>4 lelong x \b, field length %d 9286>>>8 string >\0 \b, 1st used item "%s" 9287# http://www.dbfree.org/webdocs/1-documentation/0018-developers_stuff_(advanced)/os_related_stuff/xbase_file_format.htm 9288# Print the information of FoxPro FPT memo file 92890 name foxpro-memo-print 9290>0 belong x FoxPro FPT 9291!:mime application/x-fpt 9292!:ext fpt 9293# Size of blocks for FoxPro ( 64,256 ) 9294>6 ubeshort x \b, blocks size %u 9295# next available block 9296#>0 belong =0 \b, next free block index %u 9297>0 belong !0 \b, next free block index %u 9298# field type ( 0~picture, 1~memo, 2~object ) 9299>512 ubelong <3 \b, field type %u 9300# length of memo field 9301>512 ubelong 1 9302>>516 belong >0 \b, field length %d 9303>>>520 string >\0 \b, 1st item "%s" 9304 9305# TODO: 9306# DBASE index file *.NDX 9307# DBASE Compound Index file *.CDX 9308# dBASE IV Printer Driver *.PRF 9309## End of XBase database stuff 9310 9311# MS Access database 93124 string Standard\ Jet\ DB Microsoft Access Database 9313!:mime application/x-msaccess 93144 string Standard\ ACE\ DB Microsoft Access Database 9315!:mime application/x-msaccess 9316 9317# From: Joerg Jenderek 9318# URL: http://fileformats.archiveteam.org/wiki/Extensible_Storage_Engine 9319# Reference: https://github.com/libyal/libesedb/archive/master.zip 9320# libesedb-master/documentation/ 9321# Extensible Storage Engine (ESE) Database File (EDB) format.asciidoc 9322# Note: also known as "JET Blue". Used by numerous Windows components such as 9323# Windows Search, Mail, Exchange and Active Directory. 93244 ubelong 0xefcdab89 9325# unknown1 9326>132 ubelong 0 Extensible storage engine 9327!:mime application/x-ms-ese 9328# file_type 0~database 1~stream 9329>>12 ulelong 0 DataBase 9330# Security DataBase (sdb) 9331!:ext edb/sdb 9332>>12 ulelong 1 STreaMing 9333!:ext stm 9334# format_version 620h 9335>>8 uleshort x \b, version 0x%x 9336>>10 uleshort >0 revision 0x%4.4x 9337>>0 ubelong x \b, checksum 0x%8.8x 9338# Page size 4096 8192 32768 9339>>236 ulequad x \b, page size %lld 9340# database_state 9341>>52 ulelong 1 \b, JustCreated 9342>>52 ulelong 2 \b, DirtyShutdown 9343#>>52 ulelong 3 \b, CleanShutdown 9344>>52 ulelong 4 \b, BeingConverted 9345>>52 ulelong 5 \b, ForceDetach 9346# Windows NT major version when the databases indexes were updated. 9347>>216 ulelong x \b, Windows version %d 9348# Windows NT minor version 9349>>220 ulelong x \b.%d 9350 9351# From: Joerg Jenderek 9352# URL: https://forensicswiki.org/wiki/Windows_Application_Compatibility 9353# Note: files contain application compatibility fixes, application compatibility modes and application help messages. 93548 string sdbf 9355>7 ubyte 0 9356# TAG_TYPE_LIST+TAG_INDEXES 9357>>12 uleshort 0x7802 Windows application compatibility Shim DataBase 9358# version? 2 3 9359#>>>0 ulelong x \b, version %d 9360!:mime application/x-ms-sdb 9361!:ext sdb 9362 9363# TDB database from Samba et al - Martin Pool <mbp@samba.org> 93640 string TDB\ file TDB database 9365>32 lelong 0x2601196D version 6, little-endian 9366>>36 lelong x hash size %d bytes 9367 9368# SE Linux policy database 93690 lelong 0xf97cff8c SE Linux policy 9370>16 lelong x v%d 9371>20 lelong 1 MLS 9372>24 lelong x %d symbols 9373>28 lelong x %d ocons 9374 9375# ICE authority file data (Wolfram Kleff) 93762 string ICE ICE authority data 9377 9378# X11 Xauthority file (Wolfram Kleff) 937910 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 938011 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 938112 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 938213 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 938314 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 938415 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 938516 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 938617 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 938718 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 9388 9389# From: Maxime Henrion <mux@FreeBSD.org> 9390# PostgreSQL's custom dump format, Maxime Henrion <mux@FreeBSD.org> 93910 string PGDMP PostgreSQL custom database dump 9392>5 byte x - v%d 9393>6 byte x \b.%d 9394>5 beshort <0x101 \b-0 9395>5 beshort >0x100 9396>>7 byte x \b-%d 9397 9398# Type: Advanced Data Format (ADF) database 9399# URL: https://www.grc.nasa.gov/WWW/cgns/adf/ 9400# From: Nicolas Chauvat <nicolas.chauvat@logilab.fr> 94010 string @(#)ADF\ Database CGNS Advanced Data Format 9402 9403# Tokyo Cabinet magic data 9404# http://tokyocabinet.sourceforge.net/index.html 94050 string ToKyO\ CaBiNeT\n Tokyo Cabinet 9406>14 string x \b (%s) 9407>32 byte 0 \b, Hash 9408!:mime application/x-tokyocabinet-hash 9409>32 byte 1 \b, B+ tree 9410!:mime application/x-tokyocabinet-btree 9411>32 byte 2 \b, Fixed-length 9412!:mime application/x-tokyocabinet-fixed 9413>32 byte 3 \b, Table 9414!:mime application/x-tokyocabinet-table 9415>33 byte &1 \b, [open] 9416>33 byte &2 \b, [fatal] 9417>34 byte x \b, apow=%d 9418>35 byte x \b, fpow=%d 9419>36 byte &0x01 \b, [large] 9420>36 byte &0x02 \b, [deflate] 9421>36 byte &0x04 \b, [bzip] 9422>36 byte &0x08 \b, [tcbs] 9423>36 byte &0x10 \b, [excodec] 9424>40 lequad x \b, bnum=%lld 9425>48 lequad x \b, rnum=%lld 9426>56 lequad x \b, fsiz=%lld 9427 9428# Type: QDBM Quick Database Manager 9429# From: Benoit Sibaud <bsibaud@april.org> 94300 string \\[depot\\]\n\f Quick Database Manager, little endian 94310 string \\[DEPOT\\]\n\f Quick Database Manager, big endian 9432 9433# Type: TokyoCabinet database 9434# URL: http://tokyocabinet.sourceforge.net/ 9435# From: Benoit Sibaud <bsibaud@april.org> 94360 string ToKyO\ CaBiNeT\n TokyoCabinet database 9437>14 string x (version %s) 9438 9439# From: Stephane Blondon https://www.yaal.fr 9440# Database file for Zope (done by FileStorage) 94410 string FS21 Zope Object Database File Storage v3 (data) 94420 string FS30 Zope Object Database File Storage v4 (data) 9443 9444# Cache file for the database of Zope (done by ClientStorage) 94450 string ZEC3 Zope Object Database Client Cache File (data) 9446 9447# IDA (Interactive Disassembler) database 94480 string IDA1 IDA (Interactive Disassembler) database 9449 9450# Hopper (reverse engineering tool) https://www.hopperapp.com/ 94510 string hopperdb Hopper database 9452 9453# URL: https://en.wikipedia.org/wiki/Panorama_(database_engine) 9454# Reference: http://www.provue.com/Panorama/ 9455# From: Joerg Jenderek 9456# NOTE: test only versions 4 and 6.0 with Windows 9457# length of Panorama database name 94585 ubyte >0 9459# look after database name for "some" null bits 9460>(5.B+7) ubelong&0xF3ffF000 0 9461# look for first keyword 9462>>&1 search/2 DESIGN Panorama database 9463#!:mime application/x-panorama-database 9464!:apple KASXZEPD 9465!:ext pan 9466# database name 9467>>>5 pstring x \b, "%s" 9468 9469# 9470# 9471# askSam Database by Stefan A. Haubenthal <polluks@web.de> 94720 string askw40\0 askSam DB 9473 9474# 9475# 9476# MUIbase Database Tool by Stefan A. Haubenthal <polluks@web.de> 94770 string MBSTV\040 MUIbase DB 9478>6 string x version %s 9479 9480# 9481# CDB database 94820 string NBCDB\012 NetBSD Constant Database 9483>7 byte x \b, version %d 9484>8 string x \b, for '%s' 9485>24 lelong x \b, datasize %d 9486>28 lelong x \b, entries %d 9487>32 lelong x \b, index %d 9488>36 lelong x \b, seed %#x 9489 9490# 9491# Redis RDB - https://redis.io/topics/persistence 94920 string REDIS Redis RDB file, 9493>5 regex [0-9][0-9][0-9][0-9] version %s 9494 9495# Mork database. 9496# Used by older versions of Mozilla Suite and Firefox, 9497# and current versions of Thunderbird. 9498# From: David Korth <gerbilsoft@gerbilsoft.com> 94990 string //\ <!--\ <mdb:mork:z\ v=" Mozilla Mork database 9500>23 string x \b, version %.3s 9501 9502# URL: https://en.wikipedia.org/wiki/Management_Information_Format 9503# Reference: https://www.dmtf.org/sites/default/files/standards/documents/DSP0005.pdf 9504# From: Joerg Jenderek 9505# Note: only tested with monitor asset reports of Dell Display Manager 9506# skip start like Language=fr|CA|iso8859-1 95070 search/27/C Start\040Component DMI Management Information Format 9508#!:mime text/plain 9509!:mime text/x-dmtf-mif 9510!:ext mif 9511 9512 9513#------------------------------------------------------------------------------ 9514# $File: dataone,v 1.2 2019/04/19 00:42:27 christos Exp $ 9515# 9516# DataONE- files from Dave Vieglais <dave.vieglais@gmail.com> & 9517# Pratik Shrivastava <pratikshrivastava23@gmail.com> 9518# 9519# file formats: https://cn.dataone.org/cn/v2/formats 9520#------------------------------------------------------------------------------ 9521 9522# EML (Ecological Metadata Language Format) 95230 string <?xml 9524>&0 regex (eml)-[0-9].[0-9].[0-9]+ eml://ecoinformatics.org/%s 9525 9526# onedcx (DataONE Dublin Core Extended v1.0) 9527>&0 regex (onedcx/v)[0-9].[0-9]+ https://ns.dataone.org/metadata/schema/onedcx/v1.0 9528 9529# FGDC-STD-001-1998 (Content Standard for Digital Geospatial Metadata, 9530# version 001-1998) 9531>&0 regex fgdc FGDC-STD-001-1998 9532 9533# Mercury (Oak Ridge National Lab Mercury Metadata version 1.0) 9534>&0 regex (mercury/terms/v)[0-9].[0-9] https://purl.org/ornl/schema/mercury/terms/v1.0 9535 9536# ISOTC211 (Geographic MetaData (GMD) Extensible Markup Language) 9537>&0 regex isotc211 9538>>&0 regex eng;USA https://www.isotc211.org/2005/gmd 9539 9540# ISOTC211 (NOAA Variant Geographic MetaData (GMD) Extensible Markup Language) 9541>>&0 regex gov.noaa.nodc:[0-9]+ https://www.isotc211.org/2005/gmd-noaa 9542 9543# ISOTC211 PANGAEA Variant Geographic MetaData (GMD) Extensible Markup Language 9544>>&0 regex pangaea.dataset[0-9][0-9][0-9][0-9][0-9][0-9]+ https://www.isotc211.org/2005/gmd-pangaea 9545!:mime text/xml 9546 9547 9548# Object Reuse and Exchange Vocabulary 95490 string <?xml 9550>&0 regex rdf 9551>>&0 regex openarchives https://www.openarchives.org/ore/terms 9552!:mime application/rdf+xml 9553 9554 9555# Dryad Metadata Application Profile Version 3.1 95560 string <DryadData 9557>&0 regex (dryad-bibo/v)[0-9].[0-9] https://datadryad.org/profile/v3.1 9558!:mime text/xml 9559 9560#------------------------------------------------------------------------------ 9561# $File: dbpf,v 1.3 2019/04/19 00:42:27 christos Exp $ 9562# dppf: Maxis Database Packed Files, the stored data file format used by all 9563# Maxis games after the Sims: http://wiki.niotso.org/DBPF 9564# https://www.wiki.sc4devotion.com/index.php?title=DBPF 9565# 13 Oct 2017, Kip Warner <kip at thevertigo dot com> 95660 string DBPF Maxis Database Packed File 9567>4 ulelong x \b, version: %u. 9568>>8 ulelong x \b%u 9569>>>36 ulelong x \b, files: %u 9570>>24 ledate !0 \b, created: %s 9571>>28 ledate !0 \b, modified: %s 9572!:ext dbpf/package/dat/sc4 9573!:mime application/x-maxis-dbpf 9574#------------------------------------------------------------------------------ 9575# $File: der,v 1.3 2020/02/16 20:45:21 christos Exp $ 9576# der: file(1) magic for DER encoded files 9577# 9578 9579# Certificate information piece 95800 name certinfo 9581>0 der seq 9582>>&0 der set 9583>>>&0 der seq 9584>>>>&0 der obj_id3=550406 9585>>>>&0 der prt_str=x \b, countryName=%s 9586>>&0 der set 9587>>>&0 der seq 9588>>>>&0 der obj_id3=550408 9589>>>>&0 der utf8_str=x \b, stateOrProvinceName=%s 9590>>&0 der set 9591>>>&0 der seq 9592>>>>&0 der obj_id3=55040a 9593>>>>&0 der utf8_str=x \b, organizationName=%s 9594>>&0 der set 9595>>>&0 der seq 9596>>>>&0 der obj_id3=550403 9597>>>>&0 der utf8_str=x \b, commonName=%s 9598>>&0 der seq 9599 9600# Certificate requests 96010 der seq 9602>&0 der seq 9603>>&0 der int1=00 DER Encoded Certificate request 9604>>&0 use certinfo 9605 9606# Key Pairs 96070 der seq 9608>&0 der int1=00 9609>&0 der int65=x 9610>&0 der int3=010001 DER Encoded Key Pair, 512 bits 9611 96120 der seq 9613>&0 der int1=00 9614>&0 der int129=x 9615>&0 der int3=010001 DER Encoded Key Pair, 1024 bits 9616 96170 der seq 9618>&0 der int1=00 9619>&0 der int257=x 9620>&0 der int3=010001 DER Encoded Key Pair, 2048 bits 9621 96220 der seq 9623>&0 der int1=00 9624>&0 der int513=x 9625>&0 der int3=010001 DER Encoded Key Pair, 4096 bits 9626 96270 der seq 9628>&0 der int1=00 9629>&0 der int1025=x 9630>&0 der int3=010001 DER Encoded Key Pair, 8192 bits 9631 96320 der seq 9633>&0 der int1=00 9634>&0 der int2049=x 9635>&0 der int3=010001 DER Encoded Key Pair, 16k bits 9636 96370 der seq 9638>&0 der int1=00 9639>&0 der int4097=x 9640>&0 der int3=010001 DER Encoded Key Pair, 32k bits 9641 9642# Certificates 96430 der seq 9644>&0 der seq 9645>>&0 der int2=0dfa DER Encoded Certificate, 512 bits 9646>>&0 der int2=0dfb DER Encoded Certificate, 1024 bits 9647>>&0 der int2=0dfc DER Encoded Certificate, 2048 bits 9648>>&0 der int2=0dfd DER Encoded Certificate, 4096 bits 9649>>&0 der int2=0dfe DER Encoded Certificate, 8192 bits 9650>>&0 der int2=0dff DER Encoded Certificate, 16k bits 9651>>&0 der int2=0e04 DER Encoded Certificate, 32k bits 9652>>&0 der int2=x DER Encoded Certificate, ? bits (%s) 9653>>&0 der seq 9654>>>&0 der obj_id9=2a864886f70d010105 \b, sha1WithRSAEncryption 9655>>>&0 der obj_id9=x \b, ? Encryption (%s) 9656>>>&0 der null 9657>>&0 der seq 9658>>>&0 der set 9659>>>>&0 der seq 9660>>>>>&0 der obj_id3=550406 9661>>>>>&0 der prt_str=x \b, countryName=%s 9662>>>&0 der set 9663>>>>&0 der seq 9664>>>>>&0 der obj_id3=550408 9665>>>>>&0 der prt_str=x \b, stateOrProvinceName=%s 9666>>>&0 der set 9667>>>>&0 der seq 9668>>>>>&0 der obj_id3=550407 9669>>>>>&0 der prt_str=x \b, localityName=%s 9670>>>&0 der set 9671>>>>&0 der seq 9672>>>>>&0 der obj_id3=55040a 9673>>>>>&0 der prt_str=x \b, organizationName=%s 9674>>>&0 der set 9675>>>>&0 der seq 9676>>>>>&0 der obj_id3=55040b 9677>>>>>&0 der prt_str=x \b, organizationUnitName=%s 9678>>>&0 der set 9679>>>>&0 der seq 9680>>>>>&0 der obj_id3=550403 9681>>>>>&0 der prt_str=x \b, commonName=%s 9682>>>&0 der set 9683>>>>&0 der seq 9684>>>>>&0 der obj_id9=2a864886f70d010901 9685>>>>>&0 der ia5_str=x \b, emailAddress=%s 9686>>&0 der seq 9687>>>&0 der utc_time=x \b, utcTime=%s 9688>>>&0 der utc_time=x \b, utcTime=%s 9689>>&0 use certinfo 9690 96910 der seq 9692>&0 der seq 9693>>&0 der eoc Certificate 9694>>>&0 der int1=02 \b, Version=3 9695>>&0 der int9=x \b, Serial=%s 9696>>&0 der seq 9697>>>&0 der obj_id9=2a864886f70d01010b 9698>>>&0 der null 9699>>&0 der seq 9700>>>&0 der set 9701>>>>&0 der seq 9702>>>>>&0 der obj_id3=550403 9703>>>>>&0 der utf8_str=x \b, Issuer=%s 9704>>&0 der seq 9705>>>&0 der utc_time=x \b, not-valid-before=%s 9706>>>&0 der utc_time=x \b, not-valid-after=%s 9707>>&0 der seq 9708>>>&0 der set 9709>>>>&0 der seq 9710>>>>>&0 der obj_id3=550403 9711>>>>>&0 der utf8_str=x \b, Subject=%s 9712 9713#------------------------------------------------------------------------------ 9714# $File: diamond,v 1.7 2009/09/19 16:28:08 christos Exp $ 9715# diamond: file(1) magic for Diamond system 9716# 9717# ... diamond is a multi-media mail and electronic conferencing system.... 9718# 9719# XXX - I think it was either renamed Slate, or replaced by Slate.... 9720# 9721# The full deal is too long... 9722#0 string <list>\n<protocol\ bbn-multimedia-format> Diamond Multimedia Document 97230 string =<list>\n<protocol\ bbn-m Diamond Multimedia Document 9724 9725#------------------------------------------------------------------------------ 9726# $File: dif,v 1.1 2020/04/09 19:14:01 christos Exp $ 9727# dif: file(1) magic for DIF text files 9728 9729#------------------------------------------------------------------------------ 9730# From: Joerg Jenderek 9731# URL: http://en.wikipedia.org/wiki/Data_Interchange_Format 9732# http://fileformats.archiveteam.org/wiki/Data_Interchange_Format 9733# Note: called by TrID "Data Interchange Format", 9734# by DROID x-fmt/368 "VisiCalc Database" 97350 string TABLE 9736# skip text starting with TABLE by looking for numeric version on 2nd line 9737>6 search/2 0, 9738# skip DROID x-fmt-41-signature-id-380.dif by looking for key word TUPLES at the beginning 9739>>27 search/128 TUPLES Data Interchange Format 9740# https://www.pcmatic.com/company/libraries/fileextension/detail.asp?ext=dif.html 9741#!:mime application/x-dif-spreadsheet Gnumeric 9742# https://github.com/LibreOffice/online/blob/master/discovery.xml 9743#!:mime application/x-dif-document LibreOffice 9744# https://www.wikidata.org/wiki/Wikidata:WikiProject_Informatics/File_formats/Lists/File_formats 9745!:mime application/x-dif 9746# https://extension.nirsoft.net/dif 9747#!:mime application/vnd.ms-excel 9748#!:mime text/plain 9749!:ext dif 9750# look for double quote 0x22 on 3rd line 9751>>>10 search/3 " 9752# skip if next character also double quote 9753>>>>&0 ubyte !0x22 \b, generator or table name 9754# comment like EXCEL, pwm enclosed in double quotes 9755>>>>>&-2 string x %s 9756 9757 9758#------------------------------------------------------------------------------ 9759# $File: diff,v 1.16 2017/03/17 22:20:22 christos Exp $ 9760# diff: file(1) magic for diff(1) output 9761# 97620 search/1 diff\040 diff output text 9763!:mime text/x-diff 97640 search/1 ***\040 diff output text 9765!:mime text/x-diff 97660 search/1 Only\040in\040 diff output text 9767!:mime text/x-diff 97680 search/1 Common\040subdirectories:\040 diff output text 9769!:mime text/x-diff 9770 97710 search/1 Index: RCS/CVS diff output text 9772!:mime text/x-diff 9773 9774# bsdiff: file(1) magic for bsdiff(1) output 97750 string/b BSDIFF40 bsdiff(1) patch file 9776 9777 9778# unified diff 97790 search/4096 ---\040 9780>&0 search/1024 \n 9781>>&0 search/1 +++\040 9782>>>&0 search/1024 \n 9783>>>>&0 search/1 @@ unified diff output text 9784!:mime text/x-diff 9785!:strength + 90 9786 9787# librsync -- the library for network deltas 9788# 9789# Copyright (C) 2001 by Martin Pool. You may do whatever you want with 9790# this file. 9791# 97920 belong 0x72730236 rdiff network-delta data 9793 97940 belong 0x72730136 rdiff network-delta signature data 9795>4 belong x (block length=%d, 9796>8 belong x signature strength=%d) 9797 9798#------------------------------------------------------------------------------ 9799# $File: digital,v 1.11 2013/01/11 16:45:23 christos Exp $ 9800# Digital UNIX - Info 9801# 98020 string =!<arch>\n________64E Alpha archive 9803>22 string X -- out of date 9804# 9805 98060 leshort 0603 9807>24 leshort 0410 COFF format alpha pure 9808>24 leshort 0413 COFF format alpha demand paged 9809>>22 leshort&030000 !020000 executable 9810>>22 leshort&020000 !0 dynamically linked 9811>>16 lelong !0 not stripped 9812>>16 lelong 0 stripped 9813>>27 byte x - version %d 9814>>26 byte x \b.%d 9815>>28 byte x \b-%d 9816>24 leshort 0407 COFF format alpha object 9817>>22 leshort&030000 020000 shared library 9818>>27 byte x - version %d 9819>>26 byte x \b.%d 9820>>28 byte x \b-%d 9821 9822# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk> 9823# 9824# The actual magic number is just "Core", followed by a 2-byte version 9825# number; however, treating any file that begins with "Core" as a Digital 9826# UNIX core dump file may produce too many false hits, so we include one 9827# byte of the version number as well; DU 5.0 appears only to be up to 9828# version 2. 9829# 98300 string Core\001 Alpha COFF format core dump (Digital UNIX) 9831>24 string >\0 \b, from '%s' 98320 string Core\002 Alpha COFF format core dump (Digital UNIX) 9833>24 string >\0 \b, from '%s' 9834# 9835# The next is incomplete, we could tell more about this format, 9836# but its not worth it. 98370 leshort 0x188 Alpha compressed COFF 98380 leshort 0x18f Alpha u-code object 9839# 9840# 9841# Some other interesting Digital formats, 98420 string \377\377\177 ddis/ddif 98430 string \377\377\174 ddis/dots archive 98440 string \377\377\176 ddis/dtif table data 98450 string \033c\033 LN03 output 98460 long 04553207 X image 9847# 98480 string =!<PDF>!\n profiling data file 9849# 9850# Locale data tables (MIPS and Alpha). 9851# 98520 short 0x0501 locale data table 9853>6 short 0x24 for MIPS 9854>6 short 0x40 for Alpha 9855 9856#------------------------------------------------------------------------------ 9857# $File: dolby,v 1.9 2019/04/19 00:42:27 christos Exp $ 9858# ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at> 9859# from https://www.atsc.org/standards/a_52a.pdf 9860# corrections, additions, etc. are always welcome! 9861# 9862# syncword 98630 beshort 0x0b77 ATSC A/52 aka AC-3 aka Dolby Digital stream, 9864# Proposed audio/ac3 RFC/4184 9865!:mime audio/vnd.dolby.dd-raw 9866# fscod 9867>4 byte&0xc0 = 0x00 48 kHz, 9868>4 byte&0xc0 = 0x40 44.1 kHz, 9869>4 byte&0xc0 = 0x80 32 kHz, 9870# is this one used for 96 kHz? 9871>4 byte&0xc0 = 0xc0 reserved frequency, 9872# 9873>5 byte&0x07 = 0x00 \b, complete main (CM) 9874>5 byte&0x07 = 0x01 \b, music and effects (ME) 9875>5 byte&0x07 = 0x02 \b, visually impaired (VI) 9876>5 byte&0x07 = 0x03 \b, hearing impaired (HI) 9877>5 byte&0x07 = 0x04 \b, dialogue (D) 9878>5 byte&0x07 = 0x05 \b, commentary (C) 9879>5 byte&0x07 = 0x06 \b, emergency (E) 9880>5 beshort&0x07e0 0x0720 \b, voiceover (VO) 9881>5 beshort&0x07e0 >0x0720 \b, karaoke 9882# acmod 9883>6 byte&0xe0 = 0x00 1+1 front, 9884>>6 byte&0x10 = 0x10 LFE on, 9885>6 byte&0xe0 = 0x20 1 front/0 rear, 9886>>6 byte&0x10 = 0x10 LFE on, 9887>6 byte&0xe0 = 0x40 2 front/0 rear, 9888# dsurmod (for stereo only) 9889>>6 byte&0x18 = 0x00 Dolby Surround not indicated 9890>>6 byte&0x18 = 0x08 not Dolby Surround encoded 9891>>6 byte&0x18 = 0x10 Dolby Surround encoded 9892>>6 byte&0x18 = 0x18 reserved Dolby Surround mode 9893>>6 byte&0x04 = 0x04 LFE on, 9894>6 byte&0xe0 = 0x60 3 front/0 rear, 9895>>6 byte&0x04 = 0x04 LFE on, 9896>6 byte&0xe0 = 0x80 2 front/1 rear, 9897>>6 byte&0x04 = 0x04 LFE on, 9898>6 byte&0xe0 = 0xa0 3 front/1 rear, 9899>>6 byte&0x01 = 0x01 LFE on, 9900>6 byte&0xe0 = 0xc0 2 front/2 rear, 9901>>6 byte&0x04 = 0x04 LFE on, 9902>6 byte&0xe0 = 0xe0 3 front/2 rear, 9903>>6 byte&0x01 = 0x01 LFE on, 9904# 9905>4 byte&0x3e = 0x00 \b, 32 kbit/s 9906>4 byte&0x3e = 0x02 \b, 40 kbit/s 9907>4 byte&0x3e = 0x04 \b, 48 kbit/s 9908>4 byte&0x3e = 0x06 \b, 56 kbit/s 9909>4 byte&0x3e = 0x08 \b, 64 kbit/s 9910>4 byte&0x3e = 0x0a \b, 80 kbit/s 9911>4 byte&0x3e = 0x0c \b, 96 kbit/s 9912>4 byte&0x3e = 0x0e \b, 112 kbit/s 9913>4 byte&0x3e = 0x10 \b, 128 kbit/s 9914>4 byte&0x3e = 0x12 \b, 160 kbit/s 9915>4 byte&0x3e = 0x14 \b, 192 kbit/s 9916>4 byte&0x3e = 0x16 \b, 224 kbit/s 9917>4 byte&0x3e = 0x18 \b, 256 kbit/s 9918>4 byte&0x3e = 0x1a \b, 320 kbit/s 9919>4 byte&0x3e = 0x1c \b, 384 kbit/s 9920>4 byte&0x3e = 0x1e \b, 448 kbit/s 9921>4 byte&0x3e = 0x20 \b, 512 kbit/s 9922>4 byte&0x3e = 0x22 \b, 576 kbit/s 9923>4 byte&0x3e = 0x24 \b, 640 kbit/s 9924 9925#------------------------------------------------------------------------------ 9926# $File: dump,v 1.17 2018/06/26 01:07:17 christos Exp $ 9927# dump: file(1) magic for dump file format--for new and old dump filesystems 9928# 9929# We specify both byte orders in order to recognize byte-swapped dumps. 9930# 99310 name new-dump-be 9932>4 bedate x This dump %s, 9933>8 bedate x Previous dump %s, 9934>12 belong >0 Volume %d, 9935>692 belong 0 Level zero, type: 9936>692 belong >0 Level %d, type: 9937>0 belong 1 tape header, 9938>0 belong 2 beginning of file record, 9939>0 belong 3 map of inodes on tape, 9940>0 belong 4 continuation of file record, 9941>0 belong 5 end of volume, 9942>0 belong 6 map of inodes deleted, 9943>0 belong 7 end of medium (for floppy), 9944>676 string >\0 Label %s, 9945>696 string >\0 Filesystem %s, 9946>760 string >\0 Device %s, 9947>824 string >\0 Host %s, 9948>888 belong >0 Flags %x 9949 99500 name old-dump-be 9951#>4 bedate x This dump %s, 9952#>8 bedate x Previous dump %s, 9953>12 belong >0 Volume %d, 9954>692 belong 0 Level zero, type: 9955>692 belong >0 Level %d, type: 9956>0 belong 1 tape header, 9957>0 belong 2 beginning of file record, 9958>0 belong 3 map of inodes on tape, 9959>0 belong 4 continuation of file record, 9960>0 belong 5 end of volume, 9961>0 belong 6 map of inodes deleted, 9962>0 belong 7 end of medium (for floppy), 9963>676 string >\0 Label %s, 9964>696 string >\0 Filesystem %s, 9965>760 string >\0 Device %s, 9966>824 string >\0 Host %s, 9967>888 belong >0 Flags %x 9968 99690 name ufs2-dump-be 9970>896 beqdate x This dump %s, 9971>904 beqdate x Previous dump %s, 9972>12 belong >0 Volume %d, 9973>692 belong 0 Level zero, type: 9974>692 belong >0 Level %d, type: 9975>0 belong 1 tape header, 9976>0 belong 2 beginning of file record, 9977>0 belong 3 map of inodes on tape, 9978>0 belong 4 continuation of file record, 9979>0 belong 5 end of volume, 9980>0 belong 6 map of inodes deleted, 9981>0 belong 7 end of medium (for floppy), 9982>676 string >\0 Label %s, 9983>696 string >\0 Filesystem %s, 9984>760 string >\0 Device %s, 9985>824 string >\0 Host %s, 9986>888 belong >0 Flags %x 9987 998824 belong 60012 new-fs dump file (big endian), 9989>0 use new-dump-be 9990 999124 belong 60011 old-fs dump file (big endian), 9992>0 use old-dump-be 9993 999424 lelong 60012 new-fs dump file (little endian), 9995# to correctly recognize '*.mo' GNU message catalog (little endian) 9996!:strength - 15 9997>0 use \^new-dump-be 9998 999924 lelong 60011 old-fs dump file (little endian), 10000>0 use \^old-dump-be 10001 10002 1000324 belong 0x19540119 new-fs dump file (ufs2, big endian), 10004>0 use ufs2-dump-be 10005 1000624 lelong 0x19540119 new-fs dump file (ufs2, little endian), 10007>0 use \^ufs2-dump-be 10008 1000918 leshort 60011 old-fs dump file (16-bit, assuming PDP-11 endianness), 10010>2 medate x Previous dump %s, 10011>6 medate x This dump %s, 10012>10 leshort >0 Volume %d, 10013>0 leshort 1 tape header. 10014>0 leshort 2 beginning of file record. 10015>0 leshort 3 map of inodes on tape. 10016>0 leshort 4 continuation of file record. 10017>0 leshort 5 end of volume. 10018>0 leshort 6 map of inodes deleted. 10019>0 leshort 7 end of medium (for floppy). 10020 10021#------------------------------------------------------------------------------ 10022# $File: dyadic,v 1.9 2019/04/19 00:42:27 christos Exp $ 10023# Dyadic: file(1) magic for Dyalog APL. 10024# 10025# updated by Joerg Jenderek at Oct 2013 10026# https://en.wikipedia.org/wiki/Dyalog_APL 10027# https://www.dyalog.com/ 10028# .DXV Dyalog APL External Variable 10029# .DIN Dyalog APL Input Table 10030# .DOT Dyalog APL Output Table 10031# .DFT Dyalog APL Format File 100320 ubeshort&0xFF60 0xaa00 10033# skip biblio.dbt 10034>1 byte !4 10035# real Dyalog APL have non zero version numbers like 7.3 or 13.4 10036>>2 ubeshort >0x0000 Dyalog APL 10037>>>1 byte 0x00 aplcore 10038#>>>1 byte 0x00 incomplete workspace 10039# *.DCF Dyalog APL Component File 10040>>>1 byte 0x01 component file 32-bit non-journaled non-checksummed 10041#>>>1 byte 0x01 component file 10042>>>1 byte 0x02 external variable exclusive 10043#>>>1 byte 0x02 external variable 10044# *.DWS Dyalog APL Workspace 10045>>>1 byte 0x03 workspace 10046>>>>7 byte&0x28 0x00 32-bit 10047>>>>7 byte&0x28 0x20 64-bit 10048>>>>7 byte&0x0c 0x00 classic 10049>>>>7 byte&0x0c 0x04 unicode 10050>>>>7 byte&0x88 0x00 big-endian 10051>>>>7 byte&0x88 0x80 little-endian 10052>>>1 byte 0x06 external variable shared 10053# *.DSE Dyalog APL Session , *.DLF Dyalog APL Session Log File 10054>>>1 byte 0x07 session 10055>>>1 byte 0x08 mapped file 32-bit 10056>>>1 byte 0x09 component file 64-bit non-journaled non-checksummed 10057>>>1 byte 0x0a mapped file 64-bit 10058>>>1 byte 0x0b component file 32-bit level 1 journaled non-checksummed 10059>>>1 byte 0x0c component file 64-bit level 1 journaled non-checksummed 10060>>>1 byte 0x0d component file 32-bit level 1 journaled checksummed 10061>>>1 byte 0x0e component file 64-bit level 1 journaled checksummed 10062>>>1 byte 0x0f component file 32-bit level 2 journaled checksummed 10063>>>1 byte 0x10 component file 64-bit level 2 journaled checksummed 10064>>>1 byte 0x11 component file 32-bit level 3 journaled checksummed 10065>>>1 byte 0x12 component file 64-bit level 3 journaled checksummed 10066>>>1 byte 0x13 component file 32-bit non-journaled checksummed 10067>>>1 byte 0x14 component file 64-bit non-journaled checksummed 10068>>>1 byte 0x15 component file under construction 10069>>>1 byte 0x16 DFS component file 64-bit level 1 journaled checksummed 10070>>>1 byte 0x17 DFS component file 64-bit level 2 journaled checksummed 10071>>>1 byte 0x18 DFS component file 64-bit level 3 journaled checksummed 10072>>>1 byte 0x19 external workspace 10073>>>1 byte 0x80 DDB 10074>>>2 byte x version %d 10075>>>3 byte x \b.%d 10076#>>>2 byte x type %d 10077#>>>3 byte x subtype %d 10078 10079# *.DXF Dyalog APL Transfer File 100800 short 0x6060 Dyalog APL transfer 10081 10082#------------------------------------------------------------------------------ 10083# $File: ebml,v 1.2 2019/04/19 00:42:27 christos Exp $ 10084# ebml: file(1) magic for various Extensible Binary Meta Language 10085# https://www.matroska.org/technical/specs/index.html#track 100860 belong 0x1a45dfa3 EBML file 10087>4 search/b/100 \102\202 10088>>&1 string x \b, creator %.8s 10089 10090#------------------------------------------------------------------------------ 10091# $File: edid,v 1.1 2019/03/28 12:36:01 christos Exp $ 10092# edid: file(1) magic for EDID dump files 10093 100940 quad 0x00ffffffffffff00 Extended display identification data dump 10095!:mime application/x-edid-dump 10096>18 byte 0x01 Version 1 10097>>19 byte <0x04 \b.%d 10098>18 byte 0x02 Version 2 10099>>19 byte 0x00 \b.0 10100 10101#------------------------------------------------------------------------------ 10102# $File: editors,v 1.11 2017/03/17 21:35:28 christos Exp $ 10103# T602 editor documents 10104# by David Necas <yeti@physics.muni.cz> 101050 string @CT\ T602 document data, 10106>4 string 0 Kamenicky 10107>4 string 1 CP 852 10108>4 string 2 KOI8-CS 10109>4 string >2 unknown encoding 10110 10111# Vi IMproved Encrypted file 10112# by David Necas <yeti@physics.muni.cz> 101130 string VimCrypt~ Vim encrypted file data 10114 101150 name vimnanoswap 10116>67 byte 0 10117>>107 byte 0 10118#>>>2 string x %s swap file 10119>>>24 ulelong x \b, pid %d 10120>>>28 string >\0 \b, user %s 10121>>>68 string >\0 \b, host %s 10122>>>108 string >\0 \b, file %s 10123>>>1007 byte 0x55 \b, modified 10124 10125# Vi IMproved Swap file 10126# by Sven Wegener <swegener@gentoo.org> 101270 string b0VIM\ Vim swap file 10128>&0 string >\0 \b, version %s 10129>0 use vimnanoswap 10130 10131 10132# Lock/swap file for several editors, at least 10133# Vi IMproved and nano 101340 string b0nano Nano swap file 10135>0 use vimnanoswap 10136 10137# kate (K Advanced Text Editor) 101380 string \x00\x00\x00\x12Kate\ Swap\ File\ 2.0\x00 Kate swap file 10139 10140#------------------------------------------------------------------------------ 10141# $File: efi,v 1.5 2014/04/30 21:41:02 christos Exp $ 10142# efi: file(1) magic for Universal EFI binaries 10143 101440 lelong 0x0ef1fab9 10145>4 lelong 1 Universal EFI binary with 1 architecture 10146>>&0 lelong 7 \b, i386 10147>>&0 lelong 0x01000007 \b, x86_64 10148>4 lelong 2 Universal EFI binary with 2 architectures 10149>>&0 lelong 7 \b, i386 10150>>&0 lelong 0x01000007 \b, x86_64 10151>>&20 lelong 7 \b, i386 10152>>&20 lelong 0x01000007 \b, x86_64 10153>4 lelong >2 Universal EFI binary with %d architectures 10154 10155#------------------------------------------------------------------------------ 10156# $File: elf,v 1.80 2020/02/12 22:17:33 christos Exp $ 10157# elf: file(1) magic for ELF executables 10158# 10159# We have to check the byte order flag to see what byte order all the 10160# other stuff in the header is in. 10161# 10162# What're the correct byte orders for the nCUBE and the Fujitsu VPP500? 10163# 10164# Created by: unknown 10165# Modified by (1): Daniel Quinlan <quinlan@yggdrasil.com> 10166# Modified by (2): Peter Tobias <tobias@server.et-inf.fho-emden.de> (core support) 10167# Modified by (3): Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> (fix of core support) 10168# Modified by (4): <gerardo.cacciari@gmail.com> (VMS Itanium) 10169# Modified by (5): Matthias Urlichs <smurf@debian.org> (Listing of many architectures) 10170 101710 name elf-mips 10172>0 lelong&0xf0000000 0x00000000 MIPS-I 10173>0 lelong&0xf0000000 0x10000000 MIPS-II 10174>0 lelong&0xf0000000 0x20000000 MIPS-III 10175>0 lelong&0xf0000000 0x30000000 MIPS-IV 10176>0 lelong&0xf0000000 0x40000000 MIPS-V 10177>0 lelong&0xf0000000 0x50000000 MIPS32 10178>0 lelong&0xf0000000 0x60000000 MIPS64 10179>0 lelong&0xf0000000 0x70000000 MIPS32 rel2 10180>0 lelong&0xf0000000 0x80000000 MIPS64 rel2 10181>0 lelong&0xf0000000 0x90000000 MIPS32 rel6 10182>0 lelong&0xf0000000 0xa0000000 MIPS64 rel6 10183 101840 name elf-sparc 10185>0 lelong&0x00ffff00 0x00000100 V8+ Required, 10186>0 lelong&0x00ffff00 0x00000200 Sun UltraSPARC1 Extensions Required, 10187>0 lelong&0x00ffff00 0x00000400 HaL R1 Extensions Required, 10188>0 lelong&0x00ffff00 0x00000800 Sun UltraSPARC3 Extensions Required, 10189>0 lelong&0x3 0 total store ordering, 10190>0 lelong&0x3 1 partial store ordering, 10191>0 lelong&0x3 2 relaxed memory ordering, 10192 101930 name elf-pa-risc 10194>2 leshort 0x020b 1.0 10195>2 leshort 0x0210 1.1 10196>2 leshort 0x0214 2.0 10197>0 leshort &0x0008 (LP64) 10198 101990 name elf-le 10200>16 leshort 0 no file type, 10201!:mime application/octet-stream 10202>16 leshort 1 relocatable, 10203!:mime application/x-object 10204>16 leshort 2 executable, 10205!:mime application/x-executable 10206>16 leshort 3 ${x?pie executable:shared object}, 10207 10208!:mime application/x-${x?pie-executable:sharedlib} 10209>16 leshort 4 core file, 10210!:mime application/x-coredump 10211# OS-specific 10212>7 byte 202 10213>>16 leshort 0xFE01 executable, 10214!:mime application/x-executable 10215# Core file detection is not reliable. 10216#>>>(0x38+0xcc) string >\0 of '%s' 10217#>>>(0x38+0x10) lelong >0 (signal %d), 10218>16 leshort &0xff00 processor-specific, 10219>18 clear x 10220>18 leshort 0 no machine, 10221>18 leshort 1 AT&T WE32100, 10222>18 leshort 2 SPARC, 10223>18 leshort 3 Intel 80386, 10224>18 leshort 4 Motorola m68k, 10225>>4 byte 1 10226>>>36 lelong &0x01000000 68000, 10227>>>36 lelong &0x00810000 CPU32, 10228>>>36 lelong 0 68020, 10229>18 leshort 5 Motorola m88k, 10230>18 leshort 6 Intel 80486, 10231>18 leshort 7 Intel 80860, 10232# The official e_machine number for MIPS is now #8, regardless of endianness. 10233# The second number (#10) will be deprecated later. For now, we still 10234# say something if #10 is encountered, but only gory details for #8. 10235>18 leshort 8 MIPS, 10236>>4 byte 1 10237>>>36 lelong &0x20 N32 10238>18 leshort 10 MIPS, 10239>>4 byte 1 10240>>>36 lelong &0x20 N32 10241>18 leshort 8 10242# only for 32-bit 10243>>4 byte 1 10244>>>36 use elf-mips 10245# only for 64-bit 10246>>4 byte 2 10247>>>48 use elf-mips 10248>18 leshort 9 Amdahl, 10249>18 leshort 10 MIPS (deprecated), 10250>18 leshort 11 RS6000, 10251>18 leshort 15 PA-RISC, 10252# only for 32-bit 10253>>4 byte 1 10254>>>36 use elf-pa-risc 10255# only for 64-bit 10256>>4 byte 2 10257>>>48 use elf-pa-risc 10258>18 leshort 16 nCUBE, 10259>18 leshort 17 Fujitsu VPP500, 10260>18 leshort 18 SPARC32PLUS, 10261# only for 32-bit 10262>>4 byte 1 10263>>>36 use elf-sparc 10264>18 leshort 19 Intel 80960, 10265>18 leshort 20 PowerPC or cisco 4500, 10266>18 leshort 21 64-bit PowerPC or cisco 7500, 10267>18 leshort 22 IBM S/390, 10268>18 leshort 23 Cell SPU, 10269>18 leshort 24 cisco SVIP, 10270>18 leshort 25 cisco 7200, 10271>18 leshort 36 NEC V800 or cisco 12000, 10272>18 leshort 37 Fujitsu FR20, 10273>18 leshort 38 TRW RH-32, 10274>18 leshort 39 Motorola RCE, 10275>18 leshort 40 ARM, 10276>>4 byte 1 10277>>>36 lelong&0xff000000 0x04000000 EABI4 10278>>>36 lelong&0xff000000 0x05000000 EABI5 10279>>>36 lelong &0x00800000 BE8 10280>>>36 lelong &0x00400000 LE8 10281>18 leshort 41 Alpha, 10282>18 leshort 42 Renesas SH, 10283>18 leshort 43 SPARC V9, 10284>>4 byte 2 10285>>>48 use elf-sparc 10286>18 leshort 44 Siemens Tricore Embedded Processor, 10287>18 leshort 45 Argonaut RISC Core, Argonaut Technologies Inc., 10288>18 leshort 46 Renesas H8/300, 10289>18 leshort 47 Renesas H8/300H, 10290>18 leshort 48 Renesas H8S, 10291>18 leshort 49 Renesas H8/500, 10292>18 leshort 50 IA-64, 10293>18 leshort 51 Stanford MIPS-X, 10294>18 leshort 52 Motorola Coldfire, 10295>18 leshort 53 Motorola M68HC12, 10296>18 leshort 54 Fujitsu MMA, 10297>18 leshort 55 Siemens PCP, 10298>18 leshort 56 Sony nCPU, 10299>18 leshort 57 Denso NDR1, 10300>18 leshort 58 Start*Core, 10301>18 leshort 59 Toyota ME16, 10302>18 leshort 60 ST100, 10303>18 leshort 61 Tinyj emb., 10304>18 leshort 62 x86-64, 10305>18 leshort 63 Sony DSP, 10306>18 leshort 64 DEC PDP-10, 10307>18 leshort 65 DEC PDP-11, 10308>18 leshort 66 FX66, 10309>18 leshort 67 ST9+ 8/16 bit, 10310>18 leshort 68 ST7 8 bit, 10311>18 leshort 69 MC68HC16, 10312>18 leshort 70 MC68HC11, 10313>18 leshort 71 MC68HC08, 10314>18 leshort 72 MC68HC05, 10315>18 leshort 73 SGI SVx or Cray NV1, 10316>18 leshort 74 ST19 8 bit, 10317>18 leshort 75 Digital VAX, 10318>18 leshort 76 Axis cris, 10319>18 leshort 77 Infineon 32-bit embedded, 10320>18 leshort 78 Element 14 64-bit DSP, 10321>18 leshort 79 LSI Logic 16-bit DSP, 10322>18 leshort 80 MMIX, 10323>18 leshort 81 Harvard machine-independent, 10324>18 leshort 82 SiTera Prism, 10325>18 leshort 83 Atmel AVR 8-bit, 10326>18 leshort 84 Fujitsu FR30, 10327>18 leshort 85 Mitsubishi D10V, 10328>18 leshort 86 Mitsubishi D30V, 10329>18 leshort 87 NEC v850, 10330>18 leshort 88 Renesas M32R, 10331>18 leshort 89 Matsushita MN10300, 10332>18 leshort 90 Matsushita MN10200, 10333>18 leshort 91 picoJava, 10334>18 leshort 92 OpenRISC, 10335>18 leshort 93 ARC Cores Tangent-A5, 10336>18 leshort 94 Tensilica Xtensa, 10337>18 leshort 95 Alphamosaic VideoCore, 10338>18 leshort 96 Thompson Multimedia, 10339>18 leshort 97 NatSemi 32k, 10340>18 leshort 98 Tenor Network TPC, 10341>18 leshort 99 Trebia SNP 1000, 10342>18 leshort 100 STMicroelectronics ST200, 10343>18 leshort 101 Ubicom IP2022, 10344>18 leshort 102 MAX Processor, 10345>18 leshort 103 NatSemi CompactRISC, 10346>18 leshort 104 Fujitsu F2MC16, 10347>18 leshort 105 TI msp430, 10348>18 leshort 106 Analog Devices Blackfin, 10349>18 leshort 107 S1C33 Family of Seiko Epson, 10350>18 leshort 108 Sharp embedded, 10351>18 leshort 109 Arca RISC, 10352>18 leshort 110 PKU-Unity Ltd., 10353>18 leshort 111 eXcess: 16/32/64-bit, 10354>18 leshort 112 Icera Deep Execution Processor, 10355>18 leshort 113 Altera Nios II, 10356>18 leshort 114 NatSemi CRX, 10357>18 leshort 115 Motorola XGATE, 10358>18 leshort 116 Infineon C16x/XC16x, 10359>18 leshort 117 Renesas M16C series, 10360>18 leshort 118 Microchip dsPIC30F, 10361>18 leshort 119 Freescale RISC core, 10362>18 leshort 120 Renesas M32C series, 10363>18 leshort 131 Altium TSK3000 core, 10364>18 leshort 132 Freescale RS08, 10365>18 leshort 134 Cyan Technology eCOG2, 10366>18 leshort 135 Sunplus S+core7 RISC, 10367>18 leshort 136 New Japan Radio (NJR) 24-bit DSP, 10368>18 leshort 137 Broadcom VideoCore III, 10369>18 leshort 138 LatticeMico32, 10370>18 leshort 139 Seiko Epson C17 family, 10371>18 leshort 140 TI TMS320C6000 DSP family, 10372>18 leshort 141 TI TMS320C2000 DSP family, 10373>18 leshort 142 TI TMS320C55x DSP family, 10374>18 leshort 160 STMicroelectronics 64bit VLIW DSP, 10375>18 leshort 161 Cypress M8C, 10376>18 leshort 162 Renesas R32C series, 10377>18 leshort 163 NXP TriMedia family, 10378>18 leshort 164 QUALCOMM DSP6, 10379>18 leshort 165 Intel 8051 and variants, 10380>18 leshort 166 STMicroelectronics STxP7x family, 10381>18 leshort 167 Andes embedded RISC, 10382>18 leshort 168 Cyan eCOG1X family, 10383>18 leshort 169 Dallas MAXQ30, 10384>18 leshort 170 New Japan Radio (NJR) 16-bit DSP, 10385>18 leshort 171 M2000 Reconfigurable RISC, 10386>18 leshort 172 Cray NV2 vector architecture, 10387>18 leshort 173 Renesas RX family, 10388>18 leshort 174 META, 10389>18 leshort 175 MCST Elbrus, 10390>18 leshort 176 Cyan Technology eCOG16 family, 10391>18 leshort 177 NatSemi CompactRISC, 10392>18 leshort 178 Freescale Extended Time Processing Unit, 10393>18 leshort 179 Infineon SLE9X, 10394>18 leshort 180 Intel L1OM, 10395>18 leshort 181 Intel K1OM, 10396>18 leshort 183 ARM aarch64, 10397>18 leshort 185 Atmel 32-bit family, 10398>18 leshort 186 STMicroeletronics STM8 8-bit, 10399>18 leshort 187 Tilera TILE64, 10400>18 leshort 188 Tilera TILEPro, 10401>18 leshort 189 Xilinx MicroBlaze 32-bit RISC, 10402>18 leshort 190 NVIDIA CUDA architecture, 10403>18 leshort 191 Tilera TILE-Gx, 10404>18 leshort 197 Renesas RL78 family, 10405>18 leshort 199 Renesas 78K0R, 10406>18 leshort 200 Freescale 56800EX, 10407>18 leshort 201 Beyond BA1, 10408>18 leshort 202 Beyond BA2, 10409>18 leshort 203 XMOS xCORE, 10410>18 leshort 204 Microchip 8-bit PIC(r), 10411>18 leshort 210 KM211 KM32, 10412>18 leshort 211 KM211 KMX32, 10413>18 leshort 212 KM211 KMX16, 10414>18 leshort 213 KM211 KMX8, 10415>18 leshort 214 KM211 KVARC, 10416>18 leshort 215 Paneve CDP, 10417>18 leshort 216 Cognitive Smart Memory, 10418>18 leshort 217 iCelero CoolEngine, 10419>18 leshort 218 Nanoradio Optimized RISC, 10420>18 leshort 243 UCB RISC-V, 10421>18 leshort 247 eBPF, 10422>18 leshort 251 NEC VE, 10423>18 leshort 0x1057 AVR (unofficial), 10424>18 leshort 0x1059 MSP430 (unofficial), 10425>18 leshort 0x1223 Adapteva Epiphany (unofficial), 10426>18 leshort 0x2530 Morpho MT (unofficial), 10427>18 leshort 0x3330 FR30 (unofficial), 10428>18 leshort 0x3426 OpenRISC (obsolete), 10429>18 leshort 0x4688 Infineon C166 (unofficial), 10430>18 leshort 0x5441 Cygnus FRV (unofficial), 10431>18 leshort 0x5aa5 DLX (unofficial), 10432>18 leshort 0x7650 Cygnus D10V (unofficial), 10433>18 leshort 0x7676 Cygnus D30V (unofficial), 10434>18 leshort 0x8217 Ubicom IP2xxx (unofficial), 10435>18 leshort 0x8472 OpenRISC (obsolete), 10436>18 leshort 0x9025 Cygnus PowerPC (unofficial), 10437>18 leshort 0x9026 Alpha (unofficial), 10438>18 leshort 0x9041 Cygnus M32R (unofficial), 10439>18 leshort 0x9080 Cygnus V850 (unofficial), 10440>18 leshort 0xa390 IBM S/390 (obsolete), 10441>18 leshort 0xabc7 Old Xtensa (unofficial), 10442>18 leshort 0xad45 xstormy16 (unofficial), 10443>18 leshort 0xbaab Old MicroBlaze (unofficial),, 10444>18 leshort 0xbeef Cygnus MN10300 (unofficial), 10445>18 leshort 0xdead Cygnus MN10200 (unofficial), 10446>18 leshort 0xf00d Toshiba MeP (unofficial), 10447>18 leshort 0xfeb0 Renesas M32C (unofficial), 10448>18 leshort 0xfeba Vitesse IQ2000 (unofficial), 10449>18 leshort 0xfebb NIOS (unofficial), 10450>18 leshort 0xfeed Moxie (unofficial), 10451>18 default x 10452>>18 leshort x *unknown arch 0x%x* 10453>20 lelong 0 invalid version 10454>20 lelong 1 version 1 10455 104560 string \177ELF ELF 10457!:strength *2 10458>4 byte 0 invalid class 10459>4 byte 1 32-bit 10460>4 byte 2 64-bit 10461>5 byte 0 invalid byte order 10462>5 byte 1 LSB 10463>>0 use elf-le 10464>5 byte 2 MSB 10465>>0 use \^elf-le 10466>7 byte 0 (SYSV) 10467>7 byte 1 (HP-UX) 10468>7 byte 2 (NetBSD) 10469>7 byte 3 (GNU/Linux) 10470>7 byte 4 (GNU/Hurd) 10471>7 byte 5 (86Open) 10472>7 byte 6 (Solaris) 10473>7 byte 7 (Monterey) 10474>7 byte 8 (IRIX) 10475>7 byte 9 (FreeBSD) 10476>7 byte 10 (Tru64) 10477>7 byte 11 (Novell Modesto) 10478>7 byte 12 (OpenBSD) 10479>7 byte 13 (OpenVMS) 10480>7 byte 14 (HP NonStop Kernel) 10481>7 byte 15 (AROS Research Operating System) 10482>7 byte 16 (FenixOS) 10483>7 byte 17 (Nuxi CloudABI) 10484>7 byte 97 (ARM) 10485>7 byte 202 (Cafe OS) 10486>7 byte 255 (embedded) 10487 10488#------------------------------------------------------------------------------ 10489# $File: encore,v 1.7 2014/04/30 21:41:02 christos Exp $ 10490# encore: file(1) magic for Encore machines 10491# 10492# XXX - needs to have the byte order specified (NS32K was little-endian, 10493# dunno whether they run the 88K in little-endian mode or not). 10494# 104950 short 0x154 Encore 10496>20 short 0x107 executable 10497>20 short 0x108 pure executable 10498>20 short 0x10b demand-paged executable 10499>20 short 0x10f unsupported executable 10500>12 long >0 not stripped 10501>22 short >0 - version %d 10502>22 short 0 - 10503#>4 date x stamp %s 105040 short 0x155 Encore unsupported executable 10505>12 long >0 not stripped 10506>22 short >0 - version %d 10507>22 short 0 - 10508#>4 date x stamp %s 10509 10510#------------------------------------------------------------------------------ 10511# $File: epoc,v 1.9 2013/12/21 14:28:15 christos Exp $ 10512# EPOC : file(1) magic for EPOC documents [Psion Series 5/Osaris/Geofox 1] 10513# Stefan Praszalowicz <hpicollo@worldnet.fr> and Peter Breitenlohner <peb@mppmu.mpg.de> 10514# Useful information for improving this file can be found at: 10515# http://software.frodo.looijaard.name/psiconv/formats/Index.html 10516#------------------------------------------------------------------------------ 105170 lelong 0x10000037 Psion Series 5 10518>4 lelong 0x10000039 font file 10519>4 lelong 0x1000003A printer driver 10520>4 lelong 0x1000003B clipboard 10521>4 lelong 0x10000042 multi-bitmap image 10522!:mime image/x-epoc-mbm 10523>4 lelong 0x1000006A application information file 10524>4 lelong 0x1000006D 10525>>8 lelong 0x1000007D Sketch image 10526!:mime image/x-epoc-sketch 10527>>8 lelong 0x1000007E voice note 10528>>8 lelong 0x1000007F Word file 10529!:mime application/x-epoc-word 10530>>8 lelong 0x10000085 OPL program (TextEd) 10531!:mime application/x-epoc-opl 10532>>8 lelong 0x10000087 Comms settings 10533>>8 lelong 0x10000088 Sheet file 10534!:mime application/x-epoc-sheet 10535>>8 lelong 0x100001C4 EasyFax initialisation file 10536>4 lelong 0x10000073 OPO module 10537!:mime application/x-epoc-opo 10538>4 lelong 0x10000074 OPL application 10539!:mime application/x-epoc-app 10540>4 lelong 0x1000008A exported multi-bitmap image 10541>4 lelong 0x1000016D 10542>>8 lelong 0x10000087 Comms names 10543 105440 lelong 0x10000041 Psion Series 5 ROM multi-bitmap image 10545 105460 lelong 0x10000050 Psion Series 5 10547>4 lelong 0x1000006D database 10548>>8 lelong 0x10000084 Agenda file 10549!:mime application/x-epoc-agenda 10550>>8 lelong 0x10000086 Data file 10551!:mime application/x-epoc-data 10552>>8 lelong 0x10000CEA Jotter file 10553!:mime application/x-epoc-jotter 10554>4 lelong 0x100000E4 ini file 10555 105560 lelong 0x10000079 Psion Series 5 binary: 10557>4 lelong 0x00000000 DLL 10558>4 lelong 0x10000049 comms hardware library 10559>4 lelong 0x1000004A comms protocol library 10560>4 lelong 0x1000005D OPX 10561>4 lelong 0x1000006C application 10562>4 lelong 0x1000008D DLL 10563>4 lelong 0x100000AC logical device driver 10564>4 lelong 0x100000AD physical device driver 10565>4 lelong 0x100000E5 file transfer protocol 10566>4 lelong 0x100000E5 file transfer protocol 10567>4 lelong 0x10000140 printer definition 10568>4 lelong 0x10000141 printer definition 10569 105700 lelong 0x1000007A Psion Series 5 executable 10571 10572#------------------------------------------------------------------------------ 10573# $File: erlang,v 1.7 2019/04/19 00:42:27 christos Exp $ 10574# erlang: file(1) magic for Erlang JAM and BEAM files 10575# URL: https://www.erlang.org/faq/x779.html#AEN812 10576 10577# OTP R3-R4 105780 string \0177BEAM! Old Erlang BEAM file 10579>6 short >0 - version %d 10580 10581# OTP R5 and onwards 105820 string FOR1 10583>8 string BEAM Erlang BEAM file 10584 10585# 4.2 version may have a copyright notice! 105864 string Tue\ Jan\ 22\ 14:32:44\ MET\ 1991 Erlang JAM file - version 4.2 1058779 string Tue\ Jan\ 22\ 14:32:44\ MET\ 1991 Erlang JAM file - version 4.2 10588 105894 string 1.0\ Fri\ Feb\ 3\ 09:55:56\ MET\ 1995 Erlang JAM file - version 4.3 10590 105910 bequad 0x0000000000ABCDEF Erlang DETS file 10592 10593# $File: espressif,v 1.2 2019/11/15 21:03:14 christos Exp $ 10594# configuration dump of Tasmota firmware for ESP8266 based devices by Espressif 10595# URL: https://github.com/arendst/Sonoff-Tasmota/ 10596# Reference: https://codeload.github.com/arendst/Sonoff-Tasmota/zip/release-6.2/ 10597# Sonoff-Tasmota-release-6.2.zip/Sonoff-Tasmota-release-6.2/sonoff/settings.h 10598# From: Joerg Jenderek 10599# 10600# cfg_holder=4617=0x1209 106010 uleshort 4617 10602# remaining settings normally 0x5A+offset XORed; free_1D5[20] empty since 5.12.0e 10603>0x1D5 ubequad 0x2f30313233343536 configuration of Tasmota firmware (ESP8266) 10604!:mime application/x-tasmota-dmp 10605!:ext dmp 10606# version like 6.2.1.0 ~ 0x06020100 XORed to 0x63666262 10607>>11 ubyte^0x65 x \b, version %u 10608>>10 ubyte^0x64 x \b.%u 10609>>9 ubyte^0x63 x \b.%u 10610>>8 ubyte^0x62 x \b.%u 10611#>8 ubelong x (0x%x) 10612# hostname[33] XORed 10613>>0x165 ubyte^0x1BF x \b, hostname %c 10614>>0x166 ubyte^0x1C0 >037 \b%c 10615>>0x167 ubyte^0x1C1 >037 \b%c 10616>>0x168 ubyte^0x1C2 >037 \b%c 10617>>0x169 ubyte^0x1C3 >037 \b%c 10618>>0x16A ubyte^0x1C4 >037 \b%c 10619>>0x16B ubyte^0x1C5 >037 \b%c 10620>>0x16C ubyte^0x1C6 >037 \b%c 10621>>0x16D ubyte^0x1C7 >037 \b%c 10622>>0x16E ubyte^0x1C8 >037 \b%c 10623>>0x16F ubyte^0x1C9 >037 \b%c 10624>>0x170 ubyte^0x1CA >037 \b%c 10625>>0x171 ubyte^0x1CB >037 \b%c 10626>>0x172 ubyte^0x1CC >037 \b%c 10627>>0x173 ubyte^0x1CD >037 \b%c 10628>>0x174 ubyte^0x1CE >037 \b%c 10629>>0x175 ubyte^0x1CF >037 \b%c 10630>>0x176 ubyte^0x1D0 >037 \b%c 10631>>0x177 ubyte^0x1D1 >037 \b%c 10632>>0x178 ubyte^0x1D2 >037 \b%c 10633>>0x179 ubyte^0x1D3 >037 \b%c 10634>>0x17A ubyte^0x1D4 >037 \b%c 10635>>0x17B ubyte^0x1D5 >037 \b%c 10636>>0x17C ubyte^0x1D6 >037 \b%c 10637>>0x17D ubyte^0x1D7 >037 \b%c 10638>>0x17E ubyte^0x1D8 >037 \b%c 10639>>0x17F ubyte^0x1D9 >037 \b%c 10640>>0x180 ubyte^0x1DA >037 \b%c 10641>>0x181 ubyte^0x1DB >037 \b%c 10642>>0x182 ubyte^0x1DC >037 \b%c 10643>>0x183 ubyte^0x1DD >037 \b%c 10644>>0x184 ubyte^0x1DE >037 \b%c 10645>>0x185 ubyte^0x1DF >037 \b%c 10646#>>0x165 string x (%.33s) 10647 10648 10649 10650#------------------------------------------------------------------------------ 10651# $File: esri,v 1.5 2019/04/19 00:42:27 christos Exp $ 10652# ESRI Shapefile format (.shp .shx .dbf=DBaseIII) 10653# Based on info from 10654# <URL:https://www.esri.com/library/whitepapers/pdfs/shapefile.pdf> 106550 belong 9994 ESRI Shapefile 10656>4 belong =0 10657>8 belong =0 10658>12 belong =0 10659>16 belong =0 10660>20 belong =0 10661>28 lelong x version %d 10662>24 belong x length %d 10663>32 lelong =0 type Null Shape 10664>32 lelong =1 type Point 10665>32 lelong =3 type PolyLine 10666>32 lelong =5 type Polygon 10667>32 lelong =8 type MultiPoint 10668>32 lelong =11 type PointZ 10669>32 lelong =13 type PolyLineZ 10670>32 lelong =15 type PolygonZ 10671>32 lelong =18 type MultiPointZ 10672>32 lelong =21 type PointM 10673>32 lelong =23 type PolyLineM 10674>32 lelong =25 type PolygonM 10675>32 lelong =28 type MultiPointM 10676>32 lelong =31 type MultiPatch 10677 10678#------------------------------------------------------------------------------ 10679# $File: fcs,v 1.4 2009/09/19 16:28:09 christos Exp $ 10680# fcs: file(1) magic for FCS (Flow Cytometry Standard) data files 10681# From Roger Leigh <roger@whinlatter.uklinux.net> 106820 string FCS1.0 Flow Cytometry Standard (FCS) data, version 1.0 106830 string FCS2.0 Flow Cytometry Standard (FCS) data, version 2.0 106840 string FCS3.0 Flow Cytometry Standard (FCS) data, version 3.0 10685 10686#------------------------------------------------------------------------------ 10687# $File: filesystems,v 1.133 2020/05/17 19:32:00 christos Exp $ 10688# filesystems: file(1) magic for different filesystems 10689# 106900 name partid 10691>0 ubyte 0x00 Unused 10692>0 ubyte 0x01 12-bit FAT 10693>0 ubyte 0x02 XENIX / 10694>0 ubyte 0x03 XENIX /usr 10695>0 ubyte 0x04 16-bit FAT, less than 32M 10696>0 ubyte 0x05 extended partition 10697>0 ubyte 0x06 16-bit FAT, more than 32M 10698>0 ubyte 0x07 OS/2 HPFS, NTFS, QNX2, Adv. UNIX 10699>0 ubyte 0x08 AIX or os, or etc. 10700>0 ubyte 0x09 AIX boot partition or Coherent 10701>0 ubyte 0x0a O/2 boot manager or Coherent swap 10702>0 ubyte 0x0b 32-bit FAT 10703>0 ubyte 0x0c 32-bit FAT, LBA-mapped 10704>0 ubyte 0x0d 7XXX, LBA-mapped 10705>0 ubyte 0x0e 16-bit FAT, LBA-mapped 10706>0 ubyte 0x0f extended partition, LBA-mapped 10707>0 ubyte 0x10 OPUS 10708>0 ubyte 0x11 OS/2 DOS 12-bit FAT 10709>0 ubyte 0x12 Compaq diagnostics 10710>0 ubyte 0x14 OS/2 DOS 16-bit FAT <32M 10711>0 ubyte 0x16 OS/2 DOS 16-bit FAT >=32M 10712>0 ubyte 0x17 OS/2 hidden IFS 10713>0 ubyte 0x18 AST Windows swapfile 10714>0 ubyte 0x19 Willowtech Photon coS 10715>0 ubyte 0x1b hidden win95 fat 32 10716>0 ubyte 0x1c hidden win95 fat 32 lba 10717>0 ubyte 0x1d hidden win95 fat 16 lba 10718>0 ubyte 0x20 Willowsoft OFS1 10719>0 ubyte 0x21 reserved 10720>0 ubyte 0x23 reserved 10721>0 ubyte 0x24 NEC DOS 10722>0 ubyte 0x26 reserved 10723>0 ubyte 0x31 reserved 10724>0 ubyte 0x32 Alien Internet Services NOS 10725>0 ubyte 0x33 reserved 10726>0 ubyte 0x34 reserved 10727>0 ubyte 0x35 JFS on OS2 10728>0 ubyte 0x36 reserved 10729>0 ubyte 0x38 Theos 10730>0 ubyte 0x39 Plan 9, or Theos spanned 10731>0 ubyte 0x3a Theos ver 4 4gb partition 10732>0 ubyte 0x3b Theos ve 4 extended partition 10733>0 ubyte 0x3c PartitionMagic recovery 10734>0 ubyte 0x3d Hidden Netware 10735>0 ubyte 0x40 VENIX 286 or LynxOS 10736>0 ubyte 0x41 PReP 10737>0 ubyte 0x42 linux swap sharing DRDOS disk 10738>0 ubyte 0x43 linux sharing DRDOS disk 10739>0 ubyte 0x44 GoBack change utility 10740>0 ubyte 0x45 Boot US Boot manager 10741>0 ubyte 0x46 EUMEL/Elan or Ergos 3 10742>0 ubyte 0x47 EUMEL/Elan or Ergos 3 10743>0 ubyte 0x48 EUMEL/Elan or Ergos 3 10744>0 ubyte 0x4a ALFX/THIN filesystem for DOS 10745>0 ubyte 0x4c Oberon partition 10746>0 ubyte 0x4d QNX4.x 10747>0 ubyte 0x4e QNX4.x 2nd part 10748>0 ubyte 0x4f QNX4.x 3rd part 10749>0 ubyte 0x50 DM (disk manager) 10750>0 ubyte 0x51 DM6 Aux1 (or Novell) 10751>0 ubyte 0x52 CP/M or Microport SysV/AT 10752>0 ubyte 0x53 DM6 Aux3 10753>0 ubyte 0x54 DM6 DDO 10754>0 ubyte 0x55 EZ-Drive (disk manager) 10755>0 ubyte 0x56 Golden Bow (disk manager) 10756>0 ubyte 0x57 Drive PRO 10757>0 ubyte 0x5c Priam Edisk (disk manager) 10758>0 ubyte 0x61 SpeedStor 10759>0 ubyte 0x63 GNU HURD or Mach or Sys V/386 10760>0 ubyte 0x64 Novell Netware 2.xx or Speedstore 10761>0 ubyte 0x65 Novell Netware 3.xx 10762>0 ubyte 0x66 Novell 386 Netware 10763>0 ubyte 0x67 Novell 10764>0 ubyte 0x68 Novell 10765>0 ubyte 0x69 Novell 10766>0 ubyte 0x70 DiskSecure Multi-Boot 10767>0 ubyte 0x71 reserved 10768>0 ubyte 0x73 reserved 10769>0 ubyte 0x74 reserved 10770>0 ubyte 0x75 PC/IX 10771>0 ubyte 0x76 reserved 10772>0 ubyte 0x77 M2FS/M2CS partition 10773>0 ubyte 0x78 XOSL boot loader filesystem 10774>0 ubyte 0x80 MINIX until 1.4a 10775>0 ubyte 0x81 MINIX since 1.4b 10776>0 ubyte 0x82 Linux swap or Solaris 10777>0 ubyte 0x83 Linux native 10778>0 ubyte 0x84 OS/2 hidden C: drive 10779>0 ubyte 0x85 Linux extended partition 10780>0 ubyte 0x86 NT FAT volume set 10781>0 ubyte 0x87 NTFS volume set or HPFS mirrored 10782>0 ubyte 0x8a Linux Kernel AiR-BOOT partition 10783>0 ubyte 0x8b Legacy Fault tolerant FAT32 10784>0 ubyte 0x8c Legacy Fault tolerant FAT32 ext 10785>0 ubyte 0x8d Hidden free FDISK FAT12 10786>0 ubyte 0x8e Linux Logical Volume Manager 10787>0 ubyte 0x90 Hidden free FDISK FAT16 10788>0 ubyte 0x91 Hidden free FDISK DOS EXT 10789>0 ubyte 0x92 Hidden free FDISK FAT16 Big 10790>0 ubyte 0x93 Amoeba filesystem 10791>0 ubyte 0x94 Amoeba bad block table 10792>0 ubyte 0x95 MIT EXOPC native partitions 10793>0 ubyte 0x97 Hidden free FDISK FAT32 10794>0 ubyte 0x98 Datalight ROM-DOS Super-Boot 10795>0 ubyte 0x99 Mylex EISA SCSI 10796>0 ubyte 0x9a Hidden free FDISK FAT16 LBA 10797>0 ubyte 0x9b Hidden free FDISK EXT LBA 10798>0 ubyte 0x9f BSDI? 10799>0 ubyte 0xa0 IBM Thinkpad hibernation 10800>0 ubyte 0xa1 HP Volume expansion (SpeedStor) 10801>0 ubyte 0xa3 HP Volume expansion (SpeedStor) 10802>0 ubyte 0xa4 HP Volume expansion (SpeedStor) 10803>0 ubyte 0xa5 386BSD partition type 10804>0 ubyte 0xa6 OpenBSD partition type 10805>0 ubyte 0xa7 NeXTSTEP 486 10806>0 ubyte 0xa8 Apple UFS 10807>0 ubyte 0xa9 NetBSD partition type 10808>0 ubyte 0xaa Olivetty Fat12 1.44MB Service part 10809>0 ubyte 0xab Apple Boot 10810>0 ubyte 0xae SHAG OS filesystem 10811>0 ubyte 0xaf Apple HFS 10812>0 ubyte 0xb0 BootStar Dummy 10813>0 ubyte 0xb1 reserved 10814>0 ubyte 0xb3 reserved 10815>0 ubyte 0xb4 reserved 10816>0 ubyte 0xb6 reserved 10817>0 ubyte 0xb7 BSDI BSD/386 filesystem 10818>0 ubyte 0xb8 BSDI BSD/386 swap 10819>0 ubyte 0xbb Boot Wizard Hidden 10820>0 ubyte 0xbe Solaris 8 partition type 10821>0 ubyte 0xbf Solaris partition type 10822>0 ubyte 0xc0 CTOS 10823>0 ubyte 0xc1 DRDOS/sec (FAT-12) 10824>0 ubyte 0xc2 Hidden Linux 10825>0 ubyte 0xc3 Hidden Linux swap 10826>0 ubyte 0xc4 DRDOS/sec (FAT-16, < 32M) 10827>0 ubyte 0xc5 DRDOS/sec (EXT) 10828>0 ubyte 0xc6 DRDOS/sec (FAT-16, >= 32M) 10829>0 ubyte 0xc7 Syrinx (Cyrnix?) or HPFS disabled 10830>0 ubyte 0xc8 Reserved for DR-DOS 8.0+ 10831>0 ubyte 0xc9 Reserved for DR-DOS 8.0+ 10832>0 ubyte 0xca Reserved for DR-DOS 8.0+ 10833>0 ubyte 0xcb DR-DOS 7.04+ Secured FAT32 CHS 10834>0 ubyte 0xcc DR-DOS 7.04+ Secured FAT32 LBA 10835>0 ubyte 0xcd CTOS Memdump 10836>0 ubyte 0xce DR-DOS 7.04+ FAT16X LBA 10837>0 ubyte 0xcf DR-DOS 7.04+ EXT LBA 10838>0 ubyte 0xd0 REAL/32 secure big partition 10839>0 ubyte 0xd1 Old Multiuser DOS FAT12 10840>0 ubyte 0xd4 Old Multiuser DOS FAT16 Small 10841>0 ubyte 0xd5 Old Multiuser DOS Extended 10842>0 ubyte 0xd6 Old Multiuser DOS FAT16 Big 10843>0 ubyte 0xd8 CP/M 86 10844>0 ubyte 0xdb CP/M or Concurrent CP/M 10845>0 ubyte 0xdd Hidden CTOS Memdump 10846>0 ubyte 0xde Dell PowerEdge Server utilities 10847>0 ubyte 0xdf DG/UX virtual disk manager 10848>0 ubyte 0xe0 STMicroelectronics ST AVFS 10849>0 ubyte 0xe1 DOS access or SpeedStor 12-bit 10850>0 ubyte 0xe3 DOS R/O or Storage Dimensions 10851>0 ubyte 0xe4 SpeedStor 16-bit FAT < 1024 cyl. 10852>0 ubyte 0xe5 reserved 10853>0 ubyte 0xe6 reserved 10854>0 ubyte 0xeb BeOS 10855>0 ubyte 0xee GPT Protective MBR 10856>0 ubyte 0xef EFI system partition 10857>0 ubyte 0xf0 Linux PA-RISC boot loader 10858>0 ubyte 0xf1 SpeedStor or Storage Dimensions 10859>0 ubyte 0xf2 DOS 3.3+ Secondary 10860>0 ubyte 0xf3 reserved 10861>0 ubyte 0xf4 SpeedStor large partition 10862>0 ubyte 0xf5 Prologue multi-volumen partition 10863>0 ubyte 0xf6 reserved 10864>0 ubyte 0xf9 pCache: ext2/ext3 persistent cache 10865>0 ubyte 0xfa Bochs x86 emulator 10866>0 ubyte 0xfb VMware File System 10867>0 ubyte 0xfc VMware Swap 10868>0 ubyte 0xfd Linux RAID partition persistent sb 10869>0 ubyte 0xfe LANstep or IBM PS/2 IML 10870>0 ubyte 0xff Xenix Bad Block Table 10871 108720 string \366\366\366\366 PC formatted floppy with no filesystem 10873# Sun disk labels 10874# From /usr/include/sun/dklabel.h: 108750774 beshort 0xdabe 10876# modified by Joerg Jenderek, because original test 10877# succeeds for Cabinet archive dao360.dl_ with negative blocks 10878>0770 long >0 Sun disk label 10879>>0 string x '%s 10880>>>31 string >\0 \b%s 10881>>>>63 string >\0 \b%s 10882>>>>>95 string >\0 \b%s 10883>>0 string x \b' 10884>>0734 short >0 %d rpm, 10885>>0736 short >0 %d phys cys, 10886>>0740 short >0 %d alts/cyl, 10887>>0746 short >0 %d interleave, 10888>>0750 short >0 %d data cyls, 10889>>0752 short >0 %d alt cyls, 10890>>0754 short >0 %d heads/partition, 10891>>0756 short >0 %d sectors/track, 10892>>0764 long >0 start cyl %d, 10893>>0770 long x %d blocks 10894# Is there a boot block written 1 sector in? 10895>512 belong&077777777 0600407 \b, boot block present 10896 10897# Joerg Jenderek: Smart Boot Manager backup file is 25 (MSDOS) or 41 (LINUX) byte header + first sectors of disk 10898# (http://btmgr.sourceforge.net/docs/user-guide-3.html) 108990 string SBMBAKUP_ Smart Boot Manager backup file 10900>9 string x \b, version %-5.5s 10901>>14 string =_ 10902>>>15 string x %-.1s 10903>>>>16 string =_ \b. 10904>>>>>17 string x \b%-.1s 10905>>>>>>18 string =_ \b. 10906>>>>>>>19 string x \b%-.1s 10907>>>22 ubyte 0 10908>>>>21 ubyte x \b, from drive 0x%x 10909>>>22 ubyte >0 10910>>>>21 string x \b, from drive %s 10911>>>535 search/17 \x55\xAA 10912>>>>&-512 indirect x \b; contains 10913 10914# updated by Joerg Jenderek at Nov 2012 10915# DOS Emulator image is 128 byte, null right padded header + harddisc image 109160 string DOSEMU\0 10917>0x27E leshort 0xAA55 10918#offset is 128 10919>>19 ubyte 128 10920>>>(19.b-1) ubyte 0x0 DOS Emulator image 10921>>>>7 ulelong >0 \b, %u heads 10922>>>>11 ulelong >0 \b, %d sectors/track 10923>>>>15 ulelong >0 \b, %d cylinders 10924>>>>128 indirect x \b; contains 10925 10926# added by Joerg Jenderek at Nov 2012 10927# http://www.thenakedpc.com/articles/v04/08/0408-05.html 10928# Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data 109290 string PNCIHISK\0 Norton Utilities disc image data 10930# real x86 boot sector with jump instruction 10931>509 search/1026 \x55\xAA\xeb 10932>>&-1 indirect x \b; contains 10933# http://file-extension.net/seeker/file_extension_dat 109340 string PNCIUNDO Norton Disk Doctor UnDo file 10935# 10936 10937# DOS/MBR boot sector updated by Joerg Jenderek at Sep 2007,May 2011,2013 10938# for any allowed sector sizes 1093930 search/481 \x55\xAA 10940# to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111) 10941# DOS BPB information (70) and after DOS floppy (120) like in previous file version 10942!:strength +65 10943# for sector sizes < 512 Bytes 10944>11 uleshort <512 10945>>(11.s-2) uleshort 0xAA55 DOS/MBR boot sector 10946# for sector sizes with 512 or more Bytes 10947>0x1FE leshort 0xAA55 DOS/MBR boot sector 10948 10949# keep old DOS/MBR boot sector as dummy for mbr and bootloader displaying 10950# only for sector sizes with 512 or more Bytes 109510x1FE leshort 0xAA55 DOS/MBR boot sector 10952# 10953# to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version 10954!:strength +65 10955>2 string OSBS OS/BS MBR 10956# added by Joerg Jenderek at Feb 2013 according to https://thestarman.pcministry.com/asm/mbr/ 10957# and https://en.wikipedia.org/wiki/Master_Boot_Record 10958# test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by 10959# characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00 10960>0 search/2 \x33\xc0\x8e\xd0\xbc\x00\x7c MS-MBR 10961# Microsoft Windows 95A and early ( https://thestarman.pcministry.com/asm/mbr/STDMBR.htm ) 10962# assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld 10963>>8 ubequad 0x8bf45007501ffbfc 10964# https://thestarman.pcministry.com/asm/mbr/200MBR.htm 10965>>>0x16 ubyte 0xF3 \b,DOS 2 10966>>>>219 regex Author\ -\ Author: 10967# found "David Litton" , "A Pehrsson " 10968>>>>>&0 string x "%s" 10969>>>0x16 ubyte 0xF2 10970# NEC MS-DOS 3.30 Rev. 3 . See https://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm 10971# assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz 10972>>>>0x22 ubequad 0xbf7c07813d5aa575 \b,NEC 3.3 10973# version MS-DOS 3.30 til MS-Windows 95A (WinVer=4.00.1111) 10974>>>>0x22 default x \b,D0S version 3.3-7.0 10975# error messages are printed by assembler instructions: mov si,06nn;...;int 10 (0xBEnn06;...) 10976# where nn is string offset varying for different languages 10977# "Invalid partition table" nn=0x8b for english version 10978>>>>>(0x49.b) string Invalid\ partition\ table english 10979>>>>>(0x49.b) string Ung\201ltige\ Partitionstabelle german 10980>>>>>(0x49.b) string Table\ de\ partition\ invalide french 10981>>>>>(0x49.b) string Tabela\ de\ parti\207ao\ inv\240lida portuguese 10982>>>>>(0x49.b) string Tabla\ de\ partici\242n\ no\ v\240lida spanish 10983>>>>>(0x49.b) string Tavola\ delle\ partizioni\ non\ valida italian 10984>>>>>0x49 ubyte >0 at offset 0x%x 10985>>>>>>(0x49.b) string >\0 "%s" 10986# "Error loading operating system" nn=0xa3 for english version 10987# "Fehler beim Laden des Betriebssystems" nn=0xa7 for german version 10988# "Erreur en chargeant syst\212me d'exploitation" nn=0xa7 for french version 10989# "Erro na inicializa\207ao do sistema operacional" nn=0xa7 for portuguese Brazilian version 10990# "Error al cargar sistema operativo" nn=0xa8 for spanish version 10991# "Errore durante il caricamento del sistema operativo" nn=0xae for italian version 10992>>>>>0x74 ubyte >0 at offset 0x%x 10993>>>>>>(0x74.b) string >\0 "%s" 10994# "Missing operating system" nn=0xc2 for english version 10995# "Betriebssystem fehlt" nn=0xcd for german version 10996# "Syst\212me d'exploitation absent" nn=0xd2 for french version 10997# "Sistema operacional nao encontrado" nn=0xd4 for portuguese Brazilian version 10998# "Falta sistema operativo" nn=0xca for spanish version 10999# "Sistema operativo mancante" nn=0xe2 for italian version 11000>>>>>0x79 ubyte >0 at offset 0x%x 11001>>>>>>(0x79.b) string >\0 "%s" 11002# Microsoft Windows 95B to XP (https://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm) 11003# assembler instructions: push ax;pop es;push ax;pop ds;cld;mov si,7c1b 11004>>8 ubequad 0x5007501ffcbe1b7c 11005# assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04 11006>>>24 ubequad 0xf3a4cbbebe07b104 9M 11007# "Invalid partition table" nn=0x10F for english version 11008# "Ung\201ltige Partitionstabelle" nn=0x10F for german version 11009# "Table de partition erron\202e" nn=0x10F for french version 11010# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x10F for russian version 11011>>>>(0x3C.b+0x0FF) string Invalid\ partition\ table english 11012>>>>(0x3C.b+0x0FF) string Ung\201ltige\ Partitionstabelle german 11013>>>>(0x3C.b+0x0FF) string Table\ de\ partition\ erron\202e french 11014>>>>(0x3C.b+0x0FF) string \215\245\257\340\240\242\250\253\354\255\240\357\ \342\240\241\253\250\346\240 russian 11015>>>>0x3C ubyte x at offset 0x%x+0xFF 11016>>>>(0x3C.b+0x0FF) string >\0 "%s" 11017# "Error loading operating system" nn=0x127 for english version 11018# "Fehler beim Laden des Betriebssystems" nn=0x12b for german version 11019# "Erreur lors du chargement du syst\212me d'exploitation" nn=0x12a for french version 11020# "\216\350\250\241\252\240 \257\340\250 \247\240\243\340\343\247\252\245 \256\257\245\340\240\346\250\256\255\255\256\251 \341\250\341\342\245\254\353" nn=0x12d for russian version 11021>>>>0xBD ubyte x at offset 0x1%x 11022>>>>(0xBD.b+0x100) string >\0 "%s" 11023# "Missing operating system" nn=0x146 for english version 11024# "Betriebssystem fehlt" nn=0x151 for german version 11025# "Syst\212me d'exploitation manquant" nn=0x15e for french version 11026# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x156 for russian version 11027>>>>0xA9 ubyte x at offset 0x1%x 11028>>>>(0xA9.b+0x100) string >\0 "%s" 11029# https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm 11030# assembler instructions: rep;movsb;retf;mov BP,07be;mov cl,04 11031>>>24 ubequad 0xf3a4cbbdbe07b104 XP 11032# where xxyyzz are lower bits from offsets of error messages varying for different languages 11033>>>>0x1B4 ubelong&0x00FFFFFF 0x002c4463 english 11034>>>>0x1B4 ubelong&0x00FFFFFF 0x002c486e german 11035# "Invalid partition table" xx=0x12C for english version 11036# "Ung\201ltige Partitionstabelle" xx=0x12C for german version 11037>>>>0x1b5 ubyte >0 at offset 0x1%x 11038>>>>(0x1b5.b+0x100) string >\0 "%s" 11039# "Error loading operating system" yy=0x144 for english version 11040# "Fehler beim Laden des Betriebssystems" yy=0x148 for german version 11041>>>>0x1b6 ubyte >0 at offset 0x1%x 11042>>>>(0x1b6.b+0x100) string >\0 "%s" 11043# "Missing operating system" zz=0x163 for english version 11044# "Betriebssystem nicht vorhanden" zz=0x16e for german version 11045>>>>0x1b7 ubyte >0 at offset 0x1%x 11046>>>>(0x1b7.b+0x100) string >\0 "%s" 11047# Microsoft Windows Vista or 7 11048# assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00 11049>>8 ubequad 0xc08ed8be007cbf00 11050# Microsoft Windows Vista (https://thestarman.pcministry.com/asm/mbr/VistaMBR.htm) 11051# assembler instructions: jnz 0729;cmp ebx,"TCPA" 11052>>>0xEC ubequad 0x753b6681fb544350 Vista 11053# where xxyyzz are lower bits from offsets of error messages varying for different languages 11054>>>>0x1B4 ubelong&0x00FFFFFF 0x00627a99 english 11055#>>>>0x1B4 ubelong&0x00FFFFFF ? german 11056# "Invalid partition table" xx=0x162 for english version 11057# "Ung\201ltige Partitionstabelle" xx=0x1?? for german version 11058>>>>0x1b5 ubyte >0 at offset 0x1%x 11059>>>>(0x1b5.b+0x100) string >\0 "%s" 11060# "Error loading operating system" yy=0x17a for english version 11061# "Fehler beim Laden des Betriebssystems" yy= 0x1?? for german version 11062>>>>0x1b6 ubyte >0 at offset 0x1%x 11063>>>>(0x1b6.b+0x100) string >\0 "%s" 11064# "Missing operating system" zz=0x199 for english version 11065# "Betriebssystem nicht vorhanden" zz=0x1?? for german version 11066>>>>0x1b7 ubyte >0 at offset 0x1%x 11067>>>>(0x1b7.b+0x100) string >\0 "%s" 11068# Microsoft Windows 7 (https://thestarman.pcministry.com/asm/mbr/W7MBR.htm) 11069# assembler instructions: cmp ebx,"TCPA";cmp 11070>>>0xEC ubequad 0x6681fb5443504175 Windows 7 11071# where xxyyzz are lower bits from offsets of error messages varying for different languages 11072>>>>0x1B4 ubelong&0x00FFFFFF 0x00637b9a english 11073#>>>>0x1B4 ubelong&0x00FFFFFF ? german 11074# "Invalid partition table" xx=0x163 for english version 11075# "Ung\201ltige Partitionstabelle" xx=0x1?? for german version 11076>>>>0x1b5 ubyte >0 at offset 0x1%x 11077>>>>(0x1b5.b+0x100) string >\0 "%s" 11078# "Error loading operating system" yy=0x17b for english version 11079# "Fehler beim Laden des Betriebssystems" yy=0x1?? for german version 11080>>>>0x1b6 ubyte >0 at offset 0x1%x 11081>>>>(0x1b6.b+0x100) string >\0 "%s" 11082# "Missing operating system" zz=0x19a for english version 11083# "Betriebssystem nicht vorhanden" zz=0x1?? for german version 11084>>>>0x1b7 ubyte >0 at offset 0x1%x 11085>>>>(0x1b7.b+0x100) string >\0 "%s" 11086# https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs 11087# https://en.wikipedia.org/wiki/MBR_disk_signature#ID 11088>>0x1b8 ulelong >0 \b, disk signature 0x%-.4x 11089# driveID/timestamp for Win 95B,98,98SE and ME. See https://thestarman.pcministry.com/asm/mbr/mystery.htm 11090>>0xDA uleshort 0 11091>>>0xDC ulelong >0 \b, created 11092# physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive 11093>>>>0xDC ubyte x with driveID 0x%x 11094# hours, minutes and seconds 11095>>>>0xDf ubyte x at %x 11096>>>>0xDe ubyte x \b:%x 11097>>>>0xDd ubyte x \b:%x 11098# special case for Microsoft MS-DOS 3.21 spanish 11099# assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov 11100>0 ubequad 0xfab830008ed0bc00 11101# assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov 11102>>8 ubequad 0x1fbfcb800008ed8 MS-MBR,D0S version 3.21 spanish 11103# Microsoft MBR IPL end 11104 11105# dr-dos with some upper-, lowercase variants 11106>0x9D string Invalid\ partition\ table$ 11107>>181 string No\ Operating\ System$ 11108>>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 11109>0x9D string Invalid\ partition\ table$ 11110>>181 string No\ operating\ system$ 11111>>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 11112>342 string Invalid\ partition\ table$ 11113>>366 string No\ operating\ system$ 11114>>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03 11115>295 string NEWLDR\0 11116>>302 string Bad\ PT\ $ 11117>>>310 string No\ OS\ $ 11118>>>>317 string OS\ load\ err$ 11119>>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r 11120>>>>>>358 string Press\ any\ key\ to\ continue.\n\r$ 11121>>>>>>>387 string Copyright\ (c)\ 1984,1998 11122>>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR) 11123# 11124# tests for different MS-DOS Master Boot Records (MBR) moved and merged 11125# 11126#>0x145 string Default:\ F \b, FREE-DOS MBR 11127#>0x14B string Default:\ F \b, FREE-DOS 1.0 MBR 11128>0x145 search/7 Default:\ F \b, FREE-DOS MBR 11129#>>313 string F0\ .\ .\ . 11130#>>>322 string disk\ 1 11131#>>>>382 string FAT3 11132>64 string no\ active\ partition\ found 11133>>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR 11134# Ranish Partition Manager http://www.ranish.com/part/ 11135>387 search/4 \0\ Error!\r 11136>>378 search/7 Virus! 11137>>>397 search/4 Booting\040 11138>>>>408 search/4 HD1/\0 \b, Ranish MBR ( 11139>>>>>416 string Writing\ changes... \b2.37 11140>>>>>>438 ubyte x \b,0x%x dots 11141>>>>>>440 ubyte >0 \b,virus check 11142>>>>>>441 ubyte >0 \b,partition %c 11143#2.38,2.42,2.44 11144>>>>>416 string !Writing\ changes... \b 11145>>>>>>418 ubyte 1 \bvirus check, 11146>>>>>>419 ubyte x \b0x%x seconds 11147>>>>>>420 ubyte&0x0F >0 \b,partition 11148>>>>>>>420 ubyte&0x0F <5 \b %x 11149>>>>>>>420 ubyte&0x0F 0Xf \b ask 11150>>>>>420 ubyte x \b) 11151# 11152# SYSLINUX MBR moved 11153# https://www.acronis.de/ 11154>362 string MBR\ Error\ \0\r 11155>>376 string ress\ any\ key\ to\040 11156>>>392 string boot\ from\ floppy...\0 \b, Acronis MBR 11157# added by Joerg Jenderek 11158# https://www.visopsys.org/ 11159# https://partitionlogic.org.uk/ 11160>309 string No\ bootable\ partition\ found\r 11161>>339 string I/O\ Error\ reading\ boot\ sector\r \b, Visopsys MBR 11162>349 string No\ bootable\ partition\ found\r 11163>>379 string I/O\ Error\ reading\ boot\ sector\r \b, simple Visopsys MBR 11164# bootloader, bootmanager 11165>0x40 string SBML 11166# label with 11 characters of FAT 12 bit filesystem 11167>>43 string SMART\ BTMGR 11168>>>430 string SBMK\ Bad!\r \b, Smart Boot Manager 11169# OEM-ID not always "SBM" 11170#>>>>3 strings SBM 11171>>>>6 string >\0 \b, version %s 11172>382 string XOSLLOADXCF \b, eXtended Operating System Loader 11173>6 string LILO \b, LInux i386 boot LOader 11174>>120 string LILO \b, version 22.3.4 SuSe 11175>>172 string LILO \b, version 22.5.8 Debian 11176# updated by Joerg Jenderek at Oct 2008 11177# variables according to grub-0.97/stage1/stage1.S or 11178# https://www.gnu.org/software/grub/manual/grub.html#Embedded-data 11179# usual values are marked with comments to get only informations of strange GRUB loaders 11180>342 search/60 \0Geom\0 11181#>0 ulelong x %x=0x009048EB , 0x2a9048EB 0 11182>>0x41 ubyte <2 11183>>>0x3E ubyte >2 \b; GRand Unified Bootloader 11184# 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90 11185>>>>0x3E ubyte x \b, stage1 version 0x%x 11186#If it is 0xFF, use a drive passed by BIOS 11187>>>>0x40 ubyte <0xFF \b, boot drive 0x%x 11188# in most case 0,1,0x2e for GRUB 0.5.95 11189>>>>0x41 ubyte >0 \b, LBA flag 0x%x 11190>>>>0x42 uleshort <0x8000 \b, stage2 address 0x%x 11191#>>>>0x42 uleshort =0x8000 \b, stage2 address 0x%x (usual) 11192>>>>0x42 uleshort >0x8000 \b, stage2 address 0x%x 11193#>>>>0x44 ulelong =1 \b, 1st sector stage2 0x%x (default) 11194>>>>0x44 ulelong >1 \b, 1st sector stage2 0x%x 11195>>>>0x48 uleshort <0x800 \b, stage2 segment 0x%x 11196#>>>>0x48 uleshort =0x800 \b, stage2 segment 0x%x (usual) 11197>>>>0x48 uleshort >0x800 \b, stage2 segment 0x%x 11198>>>>402 string Geom\0Hard\ Disk\0Read\0\ Error\0 11199>>>>>394 string stage1 \b, GRUB version 0.5.95 11200>>>>382 string Geom\0Hard\ Disk\0Read\0\ Error\0 11201>>>>>376 string GRUB\ \0 \b, GRUB version 0.93 or 1.94 11202>>>>383 string Geom\0Hard\ Disk\0Read\0\ Error\0 11203>>>>>377 string GRUB\ \0 \b, GRUB version 0.94 11204>>>>385 string Geom\0Hard\ Disk\0Read\0\ Error\0 11205>>>>>379 string GRUB\ \0 \b, GRUB version 0.95 or 0.96 11206>>>>391 string Geom\0Hard\ Disk\0Read\0\ Error\0 11207>>>>>385 string GRUB\ \0 \b, GRUB version 0.97 11208# unknown version 11209>>>343 string Geom\0Read\0\ Error\0 11210>>>>321 string Loading\ stage1.5 \b, GRUB version x.y 11211>>>380 string Geom\0Hard\ Disk\0Read\0\ Error\0 11212>>>>374 string GRUB\ \0 \b, GRUB version n.m 11213# SYSLINUX bootloader moved 11214>395 string chksum\0\ ERROR!\0 \b, Gujin bootloader 11215# http://www.bcdwb.de/bcdw/index_e.htm 11216>3 string BCDL 11217>>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z) 11218# mbr partition table entries updated by Joerg Jenderek at Sep 2013 11219# skip Norton Utilities disc image data 11220>3 string !IHISK 11221# skip Linux style boot sector starting with assember instructions mov 0x7c0,ax; 11222>>0 belong !0xb8c0078e 11223# not Linux kernel 11224>>>514 string !HdrS 11225# not BeOS 11226>>>>422 string !Be\ Boot\ Loader 11227# jump over BPB instruction implies DOS bootsector or AdvanceMAME mbr 11228>>>>>0 ubelong&0xFD000000 =0xE9000000 11229# AdvanceMAME mbr 11230>>>>>>(1.b+2) ubequad 0xfa31c08ed88ec08e 11231>>>>>>>446 use partition-table 11232# mbr, Norton Utilities disc image data, or 2nd,etc. sector of x86 bootloader 11233>>>>>0 ubelong&0xFD000000 !0xE9000000 11234# skip FSInfosector 11235>>>>>>0 string !RRaA 11236# skip 3rd sector of MS x86 bootloader with assember instructions cli;MOVZX EAX,BYTE PTR [BP+10];MOV ECX, 11237# https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm 11238>>>>>>>0 ubequad !0xfa660fb64610668b 11239# skip 13rd sector of MS x86 bootloader 11240>>>>>>>>0 ubequad !0x660fb64610668b4e 11241# skip sector starting with DOS new line 11242>>>>>>>>>0 string !\r\n 11243# allowed active flag 0,80h-FFh 11244>>>>>>>>>>446 ubyte 0 11245>>>>>>>>>>>446 use partition-table 11246>>>>>>>>>>446 ubyte >0x7F 11247>>>>>>>>>>>446 use partition-table 11248# TODO: test for extended bootrecord (ebr) moved and merged with mbr partition table entries 11249# mbr partition table entries end 11250# https://www.acronis.de/ 11251#FAT label=ACRONIS\ SZ 11252#OEM-ID=BOOTWIZ0 11253>442 string Non-system\ disk,\040 11254>>459 string press\ any\ key...\x7\0 \b, Acronis Startup Recovery Loader 11255# updated by Joerg Jenderek at Nov 2012, Sep 2013 11256# DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes 11257# display 1 space 11258>>>447 ubyte x \b 11259>>>477 use DOS-filename 11260# 11261>185 string FDBOOT\ Version\040 11262>>204 string \rNo\ Systemdisk.\040 11263>>>220 string Booting\ from\ harddisk.\n\r 11264>>>245 string Cannot\ load\ from\ harddisk.\n\r 11265>>>>273 string Insert\ Systemdisk\040 11266>>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader 11267>>>>>>200 string >\0 \b, version %-3s 11268>242 string Bootsector\ from\ C.H.\ Hochst\204 11269# http://freecode.com/projects/dosfstools dosfstools-n.m/src/mkdosfs.c 11270# updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string 11271# skip name "C.H. Hochstaetter" partly because it is sometimes written without umlaut 11272>242 search/127 Bootsector\ from\ C.H.\ Hochst 11273>>278 search/127 No\ Systemdisk.\ Booting\ from\ harddisk 11274# followed by variants with point,CR-NL or NL-CR 11275>>>208 search/261 Cannot\ load\ from\ harddisk. 11276# followed by variants CR-NL or NL-CR 11277>>>>236 search/235 Insert\ Systemdisk\ and\ press\ any\ key. 11278# followed by variants with point,CR-NL or NL-CR 11279>>>>>180 search/96 Disk\ formatted\ with\ WinImage\ \b, WinImage harddisk Bootloader 11280# followed by string like "6.50 (c) 1993-2004 Gilles Vollant" 11281>>>>>>&0 string x \b, version %-4.4s 11282>(1.b+2) ubyte 0xe 11283>>(1.b+3) ubyte 0x1f 11284>>>(1.b+4) ubyte 0xbe 11285# message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others 11286>>>>(1.b+5) ubyte&0xd3 0x53 11287>>>>>(1.b+6) ubyte 0x7c 11288# assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah, 11289>>>>>>(1.b+7) ubyte 0xac 11290>>>>>>>(1.b+8) ubyte 0x22 11291>>>>>>>>(1.b+9) ubyte 0xc0 11292>>>>>>>>>(1.b+10) ubyte 0x74 11293>>>>>>>>>>(1.b+11) ubyte 0x0b 11294>>>>>>>>>>>(1.b+12) ubyte 0x56 11295>>>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display 11296# FAT1X version 11297>>>>>>>>>>>>>(1.b+5) ubyte 0x5b 11298>>>>>>>>>>>>>>0x5b string >\0 "%-s" 11299# FAT32 version 11300>>>>>>>>>>>>>(1.b+5) ubyte 0x77 11301>>>>>>>>>>>>>>0x77 string >\0 "%-s" 11302>214 string Please\ try\ to\ install\ FreeDOS\ \b, DOS Emulator boot message display 11303#>>244 string from\ dosemu-freedos-*-bin.tgz\r 11304#>>>170 string Sorry,\ could\ not\ load\ an\040 11305#>>>>195 string operating\ system.\r\n 11306# 11307>103 string This\ is\ not\ a\ bootable\ disk.\040 11308>>132 string Please\ insert\ a\ bootable\040 11309>>>157 string floppy\ and\r\n 11310>>>>169 string press\ any\ key\ to\ try\ again...\r \b, FREE-DOS message display 11311# 11312>66 string Solaris\ Boot\ Sector 11313>>99 string Incomplete\ MDBoot\ load. 11314>>>89 string Version \b, Sun Solaris Bootloader 11315>>>>97 byte x version %c 11316# 11317>408 string OS/2\ !!\ SYS01475\r\0 11318>>429 string OS/2\ !!\ SYS02025\r\0 11319>>>450 string OS/2\ !!\ SYS02027\r\0 11320>>>469 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp bootloader 11321# 11322>409 string OS/2\ !!\ SYS01475\r\0 11323>>430 string OS/2\ !!\ SYS02025\r\0 11324>>>451 string OS/2\ !!\ SYS02027\r\0 11325>>>470 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp Bootloader 11326>112 string This\ disk\ is\ not\ bootable\r 11327>>142 string If\ you\ wish\ to\ make\ it\ bootable 11328>>>176 string run\ the\ DOS\ program\ SYS\040 11329>>>200 string after\ the\r 11330>>>>216 string system\ has\ been\ loaded\r\n 11331>>>>>242 string Please\ insert\ a\ DOS\ diskette\040 11332>>>>>271 string into\r\n\ the\ drive\ and\040 11333>>>>>>292 string strike\ any\ key...\0 \b, IBM OS/2 Warp message display 11334# XP 11335>430 string NTLDR\ is\ missing\xFF\r\n 11336>>449 string Disk\ error\xFF\r\n 11337>>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader 11338# DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes 11339>>>>417 ubyte&0xDF >0 11340>>>>>417 string x %-.5s 11341>>>>>>422 ubyte&0xDF >0 11342>>>>>>>422 string x \b%-.3s 11343>>>>>425 ubyte&0xDF >0 11344>>>>>>425 string >\ \b.%-.3s 11345# 11346>>>>371 ubyte >0x20 11347>>>>>368 ubyte&0xDF >0 11348>>>>>>368 string x %-.5s 11349>>>>>>>373 ubyte&0xDF >0 11350>>>>>>>>373 string x \b%-.3s 11351>>>>>>376 ubyte&0xDF >0 11352>>>>>>>376 string x \b.%-.3s 11353# 11354>430 string NTLDR\ nicht\ gefunden\xFF\r\n 11355>>453 string Datentr\204gerfehler\xFF\r\n 11356>>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german) 11357>>>>417 ubyte&0xDF >0 11358>>>>>417 string x %-.5s 11359>>>>>>422 ubyte&0xDF >0 11360>>>>>>>422 string x \b%-.3s 11361>>>>>425 ubyte&0xDF >0 11362>>>>>>425 string >\ \b.%-.3s 11363# offset variant 11364>>>>379 string \0 11365>>>>>368 ubyte&0xDF >0 11366>>>>>>368 string x %-.5s 11367>>>>>>>373 ubyte&0xDF >0 11368>>>>>>>>373 string x \b%-.3s 11369# 11370>430 string NTLDR\ fehlt\xFF\r\n 11371>>444 string Datentr\204gerfehler\xFF\r\n 11372>>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german) 11373>>>>417 ubyte&0xDF >0 11374>>>>>417 string x %-.5s 11375>>>>>>422 ubyte&0xDF >0 11376>>>>>>>422 string x \b%-.3s 11377>>>>>425 ubyte&0xDF >0 11378>>>>>>425 string >\ \b.%-.3s 11379# variant 11380>>>>371 ubyte >0x20 11381>>>>>368 ubyte&0xDF >0 11382>>>>>>368 string x %-.5s 11383>>>>>>>373 ubyte&0xDF >0 11384>>>>>>>>373 string x \b%-.3s 11385>>>>>>376 ubyte&0xDF >0 11386>>>>>>>376 string x \b.%-.3s 11387# 11388>430 string NTLDR\ fehlt\xFF\r\n 11389>>444 string Medienfehler\xFF\r\n 11390>>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german) 11391>>>>371 ubyte >0x20 11392>>>>>368 ubyte&0xDF >0 11393>>>>>>368 string x %-.5s 11394>>>>>>>373 ubyte&0xDF >0 11395>>>>>>>>373 string x \b%-.3s 11396>>>>>>376 ubyte&0xDF >0 11397>>>>>>>376 string x \b.%-.3s 11398# variant 11399>>>>417 ubyte&0xDF >0 11400>>>>>417 string x %-.5s 11401>>>>>>422 ubyte&0xDF >0 11402>>>>>>>422 string x \b%-.3s 11403>>>>>425 ubyte&0xDF >0 11404>>>>>>425 string >\ \b.%-.3s 11405# 11406>430 string Datentr\204ger\ entfernen\xFF\r\n 11407>>454 string Medienfehler\xFF\r\n 11408>>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german) 11409>>>>379 string \0 11410>>>>>368 ubyte&0xDF >0 11411>>>>>>368 string x %-.5s 11412>>>>>>>373 ubyte&0xDF >0 11413>>>>>>>>373 string x \b%-.3s 11414>>>>>>376 ubyte&0xDF >0 11415>>>>>>>376 string x \b.%-.3s 11416# variant 11417>>>>417 ubyte&0xDF >0 11418>>>>>417 string x %-.5s 11419>>>>>>422 ubyte&0xDF >0 11420>>>>>>>422 string x \b%-.3s 11421>>>>>425 ubyte&0xDF >0 11422>>>>>>425 string >\ \b.%-.3s 11423# 11424 11425#>3 string NTFS\ \ \ \040 11426>389 string Fehler\ beim\ Lesen\040 11427>>407 string des\ Datentr\204gers 11428>>>426 string NTLDR\ fehlt 11429>>>>440 string NTLDR\ ist\ komprimiert 11430>>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german) 11431#>3 string NTFS\ \ \ \040 11432>313 string A\ disk\ read\ error\ occurred.\r 11433>>345 string A\ kernel\ file\ is\ missing\040 11434>>>370 string from\ the\ disk.\r 11435>>>>484 string NTLDR\ is\ compressed 11436>>>>>429 string Insert\ a\ system\ diskette\040 11437>>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS 11438# DOS loader variants different languages,offsets 11439>472 ubyte&0xDF >0 11440>>389 string Invalid\ system\ disk\xFF\r\n 11441>>>411 string Disk\ I/O\ error 11442>>>>428 string Replace\ the\ disk,\ and\040 11443>>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader 11444#IO.SYS 11445>>>>>>472 ubyte&0xDF >0 11446>>>>>>>472 string x \b %-.2s 11447>>>>>>>>474 ubyte&0xDF >0 11448>>>>>>>>>474 string x \b%-.5s 11449>>>>>>>>>>479 ubyte&0xDF >0 11450>>>>>>>>>>>479 string x \b%-.1s 11451>>>>>>>480 ubyte&0xDF >0 11452>>>>>>>>480 string x \b.%-.3s 11453#MSDOS.SYS 11454>>>>>>>483 ubyte&0xDF >0 \b+ 11455>>>>>>>>483 string x \b%-.5s 11456>>>>>>>>>488 ubyte&0xDF >0 11457>>>>>>>>>>488 string x \b%-.3s 11458>>>>>>>>491 ubyte&0xDF >0 11459>>>>>>>>>491 string x \b.%-.3s 11460# 11461>>390 string Invalid\ system\ disk\xFF\r\n 11462>>>412 string Disk\ I/O\ error\xFF\r\n 11463>>>>429 string Replace\ the\ disk,\ and\040 11464>>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader 11465>>388 string Ungueltiges\ System\ \xFF\r\n 11466>>>410 string E/A-Fehler\ \ \ \ \xFF\r\n 11467>>>>427 string Datentraeger\ wechseln\ und\040 11468>>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german) 11469#WINBOOT.SYS only not spaces (0xDF) 11470>>>>>>497 ubyte&0xDF >0 11471>>>>>>>497 string x %-.5s 11472>>>>>>>>502 ubyte&0xDF >0 11473>>>>>>>>>502 string x \b%-.1s 11474>>>>>>>>>>503 ubyte&0xDF >0 11475>>>>>>>>>>>503 string x \b%-.1s 11476>>>>>>>>>>>>504 ubyte&0xDF >0 11477>>>>>>>>>>>>>504 string x \b%-.1s 11478>>>>>>505 ubyte&0xDF >0 11479>>>>>>>505 string x \b.%-.3s 11480#IO.SYS 11481>>>>>>472 ubyte&0xDF >0 or 11482>>>>>>>472 string x \b %-.2s 11483>>>>>>>>474 ubyte&0xDF >0 11484>>>>>>>>>474 string x \b%-.5s 11485>>>>>>>>>>479 ubyte&0xDF >0 11486>>>>>>>>>>>479 string x \b%-.1s 11487>>>>>>>480 ubyte&0xDF >0 11488>>>>>>>>480 string x \b.%-.3s 11489#MSDOS.SYS 11490>>>>>>>483 ubyte&0xDF >0 \b+ 11491>>>>>>>>483 string x \b%-.5s 11492>>>>>>>>>488 ubyte&0xDF >0 11493>>>>>>>>>>488 string x \b%-.3s 11494>>>>>>>>491 ubyte&0xDF >0 11495>>>>>>>>>491 string x \b.%-.3s 11496# 11497>>390 string Ungueltiges\ System\ \xFF\r\n 11498>>>412 string E/A-Fehler\ \ \ \ \xFF\r\n 11499>>>>429 string Datentraeger\ wechseln\ und\040 11500>>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German) 11501#WINBOOT.SYS only not spaces (0xDF) 11502>>>>>>497 ubyte&0xDF >0 11503>>>>>>>497 string x %-.7s 11504>>>>>>>>504 ubyte&0xDF >0 11505>>>>>>>>>504 string x \b%-.1s 11506>>>>>>505 ubyte&0xDF >0 11507>>>>>>>505 string x \b.%-.3s 11508#IO.SYS 11509>>>>>>472 ubyte&0xDF >0 or 11510>>>>>>>472 string x \b %-.2s 11511>>>>>>>>474 ubyte&0xDF >0 11512>>>>>>>>>474 string x \b%-.6s 11513>>>>>>>480 ubyte&0xDF >0 11514>>>>>>>>480 string x \b.%-.3s 11515#MSDOS.SYS 11516>>>>>>>483 ubyte&0xDF >0 \b+ 11517>>>>>>>>483 string x \b%-.5s 11518>>>>>>>>>488 ubyte&0xDF >0 11519>>>>>>>>>>488 string x \b%-.3s 11520>>>>>>>>491 ubyte&0xDF >0 11521>>>>>>>>>491 string x \b.%-.3s 11522# 11523>>389 string Ungueltiges\ System\ \xFF\r\n 11524>>>411 string E/A-Fehler\ \ \ \ \xFF\r\n 11525>>>>428 string Datentraeger\ wechseln\ und\040 11526>>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN) 11527# DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes 11528>>>>>>472 string x %-.2s 11529>>>>>>>474 ubyte&0xDF >0 11530>>>>>>>>474 string x \b%-.5s 11531>>>>>>>>479 ubyte&0xDF >0 11532>>>>>>>>>479 string x \b%-.1s 11533>>>>>>480 ubyte&0xDF >0 11534>>>>>>>480 string x \b.%-.3s 11535>>>>>>483 ubyte&0xDF >0 \b+ 11536>>>>>>>483 string x \b%-.5s 11537>>>>>>>488 ubyte&0xDF >0 11538>>>>>>>>488 string x \b%-.2s 11539>>>>>>>>490 ubyte&0xDF >0 11540>>>>>>>>>490 string x \b%-.1s 11541>>>>>>>491 ubyte&0xDF >0 11542>>>>>>>>491 string x \b.%-.3s 11543>479 ubyte&0xDF >0 11544>>416 string Kein\ System\ oder\040 11545>>>433 string Laufwerksfehler 11546>>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german) 11547#IO.SYS 11548>>>>>479 string x \b %-.2s 11549>>>>>>481 ubyte&0xDF >0 11550>>>>>>>481 string x \b%-.6s 11551>>>>>487 ubyte&0xDF >0 11552>>>>>>487 string x \b.%-.3s 11553#MSDOS.SYS 11554>>>>>>490 ubyte&0xDF >0 \b+ 11555>>>>>>>490 string x \b%-.5s 11556>>>>>>>>495 ubyte&0xDF >0 11557>>>>>>>>>495 string x \b%-.3s 11558>>>>>>>498 ubyte&0xDF >0 11559>>>>>>>>498 string x \b.%-.3s 11560# 11561>376 search/41 Non-System\ disk\ or\040 11562>>395 search/41 disk\ error\r 11563>>>407 search/41 Replace\ and\040 11564>>>>419 search/41 press\ \b, 11565>>>>419 search/41 strike\ \b, old 11566>>>>426 search/41 any\ key\ when\ ready\r MS or PC-DOS bootloader 11567#449 Disk\ Boot\ failure\r MS 3.21 11568#466 Boot\ Failure\r MS 3.30 11569>>>>>468 search/18 \0 11570#IO.SYS,IBMBIO.COM 11571>>>>>>&0 string x \b %-.2s 11572>>>>>>>&-20 ubyte&0xDF >0 11573>>>>>>>>&-1 string x \b%-.4s 11574>>>>>>>>>&-16 ubyte&0xDF >0 11575>>>>>>>>>>&-1 string x \b%-.2s 11576>>>>>>&8 ubyte&0xDF >0 \b. 11577>>>>>>>&-1 string x \b%-.3s 11578#MSDOS.SYS,IBMDOS.COM 11579>>>>>>&11 ubyte&0xDF >0 \b+ 11580>>>>>>>&-1 string x \b%-.5s 11581>>>>>>>>&-6 ubyte&0xDF >0 11582>>>>>>>>>&-1 string x \b%-.1s 11583>>>>>>>>>>&-5 ubyte&0xDF >0 11584>>>>>>>>>>>&-1 string x \b%-.2s 11585>>>>>>>&7 ubyte&0xDF >0 \b. 11586>>>>>>>>&-1 string x \b%-.3s 11587>441 string Cannot\ load\ from\ harddisk.\n\r 11588>>469 string Insert\ Systemdisk\040 11589>>>487 string and\ press\ any\ key.\n\r \b, MS (2.11) DOS bootloader 11590#>43 string \224R-LOADER\ \ SYS =label 11591>54 string SYS 11592>>324 string VASKK 11593>>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS) 11594# 11595>98 string Press\ a\ key\ to\ retry\0\r 11596>>120 string Cannot\ find\ file\ \0\r 11597>>>139 string Disk\ read\ error\0\r 11598>>>>156 string Loading\ ...\0 \b, DR-DOS (3.41) Bootloader 11599#DRBIOS.SYS 11600>>>>>44 ubyte&0xDF >0 11601>>>>>>44 string x \b %-.6s 11602>>>>>>>50 ubyte&0xDF >0 11603>>>>>>>>50 string x \b%-.2s 11604>>>>>>52 ubyte&0xDF >0 11605>>>>>>>52 string x \b.%-.3s 11606# 11607>70 string IBMBIO\ \ COM 11608>>472 string Cannot\ load\ DOS!\040 11609>>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader 11610>>471 string Cannot\ load\ DOS\040 11611>>487 string press\ key\ to\ retry \b, Open-DOS Bootloader 11612#?? 11613>444 string KERNEL\ \ SYS 11614>>314 string BOOT\ error! \b, FREE-DOS Bootloader 11615>499 string KERNEL\ \ SYS 11616>>305 string BOOT\ err!\0 \b, Free-DOS Bootloader 11617>449 string KERNEL\ \ SYS 11618>>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader 11619# 11620>449 string Loading\ FreeDOS 11621>>0x1AF ulelong >0 \b, FREE-DOS 0.95,1.0 Bootloader 11622>>>497 ubyte&0xDF >0 11623>>>>497 string x \b %-.6s 11624>>>>>503 ubyte&0xDF >0 11625>>>>>>503 string x \b%-.1s 11626>>>>>>>504 ubyte&0xDF >0 11627>>>>>>>>504 string x \b%-.1s 11628>>>>505 ubyte&0xDF >0 11629>>>>>505 string x \b.%-.3s 11630# 11631>331 string Error!.0 \b, FREE-DOS 1.0 bootloader 11632# 11633>125 string Loading\ FreeDOS...\r 11634>>311 string BOOT\ error!\r \b, FREE-DOS bootloader 11635>>>441 ubyte&0xDF >0 11636>>>>441 string x \b %-.6s 11637>>>>>447 ubyte&0xDF >0 11638>>>>>>447 string x \b%-.1s 11639>>>>>>>448 ubyte&0xDF >0 11640>>>>>>>>448 string x \b%-.1s 11641>>>>449 ubyte&0xDF >0 11642>>>>>449 string x \b.%-.3s 11643>124 string FreeDOS\0 11644>>331 string \ err\0 \b, FREE-DOS BETa 0.9 Bootloader 11645# DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes 11646>>>497 ubyte&0xDF >0 11647>>>>497 string x \b %-.6s 11648>>>>>503 ubyte&0xDF >0 11649>>>>>>503 string x \b%-.1s 11650>>>>>>>504 ubyte&0xDF >0 11651>>>>>>>>504 string x \b%-.1s 11652>>>>505 ubyte&0xDF >0 11653>>>>>505 string x \b.%-.3s 11654>>333 string \ err\0 \b, FREE-DOS BEta 0.9 Bootloader 11655>>>497 ubyte&0xDF >0 11656>>>>497 string x \b %-.6s 11657>>>>>503 ubyte&0xDF >0 11658>>>>>>503 string x \b%-.1s 11659>>>>>>>504 ubyte&0xDF >0 11660>>>>>>>>504 string x \b%-.1s 11661>>>>505 ubyte&0xDF >0 11662>>>>>505 string x \b.%-.3s 11663>>334 string \ err\0 \b, FREE-DOS Beta 0.9 Bootloader 11664>>>497 ubyte&0xDF >0 11665>>>>497 string x \b %-.6s 11666>>>>>503 ubyte&0xDF >0 11667>>>>>>503 string x \b%-.1s 11668>>>>>>>504 ubyte&0xDF >0 11669>>>>>>>>504 string x \b%-.1s 11670>>>>505 ubyte&0xDF >0 11671>>>>>505 string x \b.%-.3s 11672>336 string Error!\040 11673>>343 string Hit\ a\ key\ to\ reboot. \b, FREE-DOS Beta 0.9sr1 Bootloader 11674>>>497 ubyte&0xDF >0 11675>>>>497 string x \b %-.6s 11676>>>>>503 ubyte&0xDF >0 11677>>>>>>503 string x \b%-.1s 11678>>>>>>>504 ubyte&0xDF >0 11679>>>>>>>>504 string x \b%-.1s 11680>>>>505 ubyte&0xDF >0 11681>>>>>505 string x \b.%-.3s 11682# added by Joerg Jenderek 11683# https://www.visopsys.org/ 11684# https://partitionlogic.org.uk/ 11685# OEM-ID=Visopsys 11686>478 ulelong 0 11687>>(1.b+326) string I/O\ Error\ reading\040 11688>>>(1.b+344) string Visopsys\ loader\r 11689>>>>(1.b+361) string Press\ any\ key\ to\ continue.\r \b, Visopsys loader 11690# http://alexfru.chat.ru/epm.html#bootprog 11691>494 ubyte >0x4D 11692>>495 string >E 11693>>>495 string <S 11694#OEM-ID is not reliable 11695>>>>3 string BootProg 11696# It just looks for a program file name at the root directory 11697# and loads corresponding file with following execution. 11698# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes 11699>>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader 11700>>>>>499 use DOS-filename 11701#If the boot sector fails to read any other sector, 11702#it prints a very short message ("RE") to the screen and hangs the computer. 11703#If the boot sector fails to find needed program in the root directory, 11704#it also hangs with another message ("NF"). 11705>>>>>492 string RENF \b, FAT (12 bit) 11706>>>>>495 string RENF \b, FAT (16 bit) 11707#If the boot sector fails to read any other sector, 11708#it prints a very short message ("RE") to the screen and hangs the computer. 11709# x86 bootloader end 11710 11711# added by Joerg Jenderek at Feb 2013 according to https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO 11712# and https://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector 11713>0 string RRaA 11714>>0x1E4 string rrAa \b, FSInfosector 11715#>>0x1FC uleshort =0 SHOULD BE ZERO 11716>>>0x1E8 ulelong <0xffffffff \b, %u free clusters 11717>>>0x1EC ulelong <0xffffffff \b, last allocated cluster %u 11718 11719# updated by Joerg Jenderek at Sep 2007 11720>3 ubyte 0 11721#no active flag 11722>>446 ubyte 0 11723# partition 1 not empty 11724>>>450 ubyte >0 11725# partitions 3,4 empty 11726>>>>482 ubyte 0 11727>>>>>498 ubyte 0 11728# partition 2 ID=0,5,15 11729>>>>>>466 ubyte <0x10 11730>>>>>>>466 ubyte 0x05 \b, extended partition table 11731>>>>>>>466 ubyte 0x0F \b, extended partition table (LBA) 11732>>>>>>>466 ubyte 0x0 \b, extended partition table (last) 11733 11734# DOS x86 sector separated and moved from "DOS/MBR boot sector" by Joerg Jenderek at May 2011 11735 11736>0x200 lelong 0x82564557 \b, BSD disklabel 11737 11738# by Joerg Jenderek at Apr 2013 11739# Print the DOS filenames from directory entry form with 8 right space padded bytes + 3 bytes for extension 11740# like IO.SYS. MSDOS.SYS , KERNEL.SYS , DRBIO.SYS 117410 name DOS-filename 11742# space=0x20 (00100000b) means empty 11743>0 ubyte&0xDF >0 11744>>0 ubyte x \b%c 11745>>>1 ubyte&0xDF >0 11746>>>>1 ubyte x \b%c 11747>>>>>2 ubyte&0xDF >0 11748>>>>>>2 ubyte x \b%c 11749>>>>>>>3 ubyte&0xDF >0 11750>>>>>>>>3 ubyte x \b%c 11751>>>>>>>>>4 ubyte&0xDF >0 11752>>>>>>>>>>4 ubyte x \b%c 11753>>>>>>>>>>>5 ubyte&0xDF >0 11754>>>>>>>>>>>>5 ubyte x \b%c 11755>>>>>>>>>>>>>6 ubyte&0xDF >0 11756>>>>>>>>>>>>>>6 ubyte x \b%c 11757>>>>>>>>>>>>>>>7 ubyte&0xDF >0 11758>>>>>>>>>>>>>>>>7 ubyte x \b%c 11759# DOS filename extension 11760>>8 ubyte&0xDF >0 \b. 11761>>>8 ubyte x \b%c 11762>>>>9 ubyte&0xDF >0 11763>>>>>9 ubyte x \b%c 11764>>>>>>10 ubyte&0xDF >0 11765>>>>>>>10 ubyte x \b%c 11766# Print 2 following DOS filenames from directory entry form 11767# like IO.SYS+MSDOS.SYS or ibmbio.com+ibmdos.com 117680 name 2xDOS-filename 11769# display 1 space 11770>0 ubyte x \b 11771>0 use DOS-filename 11772>11 ubyte x \b+ 11773>11 use DOS-filename 11774 11775# https://en.wikipedia.org/wiki/Master_boot_record#PTE 11776# display standard partition table 117770 name partition-table 11778#>0 ubyte x PARTITION-TABLE 11779# test and display 1st til 4th partition table entry 11780>0 use partition-entry-test 11781>16 use partition-entry-test 11782>32 use partition-entry-test 11783>48 use partition-entry-test 11784# test for entry of partition table 117850 name partition-entry-test 11786# partition type ID > 0 11787>4 ubyte >0 11788# active flag 0 11789>>0 ubyte 0 11790>>>0 use partition-entry 11791# active flag 0x80, 0x81, ... 11792>>0 ubyte >0x7F 11793>>>0 use partition-entry 11794# Print entry of partition table 117950 name partition-entry 11796# partition type ID > 0 11797>4 ubyte >0 \b; partition 11798>>64 leshort 0xAA55 1 11799>>48 leshort 0xAA55 2 11800>>32 leshort 0xAA55 3 11801>>16 leshort 0xAA55 4 11802>>4 ubyte x : ID=0x%x 11803>>0 ubyte&0x80 0x80 \b, active 11804>>0 ubyte >0x80 0x%x 11805>>1 ubyte x \b, start-CHS ( 11806>>1 use partition-chs 11807>>5 ubyte x \b), end-CHS ( 11808>>5 use partition-chs 11809>>8 ulelong x \b), startsector %u 11810>>12 ulelong x \b, %u sectors 11811# Print cylinder,head,sector (CHS) of partition entry 118120 name partition-chs 11813# cylinder 11814>1 ubyte x \b0x 11815>1 ubyte&0xC0 0x40 \b1 11816>1 ubyte&0xC0 0x80 \b2 11817>1 ubyte&0xC0 0xC0 \b3 11818>2 ubyte x \b%x 11819# head 11820>0 ubyte x \b,%u 11821# sector 11822>1 ubyte&0x3F x \b,%u 11823 11824# FATX 118250 string FATX FATX filesystem data 11826 11827# romfs filesystems - Juan Cespedes <cespedes@debian.org> 118280 string -rom1fs- romfs filesystem, version 1 11829>8 belong x %d bytes, 11830>16 string x named %s. 11831 11832# netboot image - Juan Cespedes <cespedes@debian.org> 118330 lelong 0x1b031336L Netboot image, 11834>4 lelong&0xFFFFFF00 0 11835>>4 lelong&0x100 0x000 mode 2 11836>>4 lelong&0x100 0x100 mode 3 11837>4 lelong&0xFFFFFF00 !0 unknown mode 11838 118390x18b string OS/2 OS/2 Boot Manager 11840 11841# updated by Joerg Jenderek at Oct 2008 and Sep 2012 11842# https://syslinux.zytor.com/iso.php 11843# tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05 11844# assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop 118450 ulequad&0x909000007cc0eafa 0x909000007c40eafa 11846>631 search/689 ISOLINUX\ isolinux Loader 11847>>&0 string x (version %-4.4s) 11848# https://syslinux.zytor.com/pxe.php 11849# assembler instructions: jmp 7C05 118500 ulelong 0x007c05ea pxelinux loader (version 2.13 or older) 11851# assembler instructions: pushfd;pushad 118520 ulelong 0x60669c66 pxelinux loader 11853# assembler instructions: jmp 05 118540 ulelong 0xc00005ea pxelinux loader (version 3.70 or newer) 11855# https://syslinux.zytor.com/wiki/index.php/SYSLINUX 118560 string LDLINUX\ SYS\ SYSLINUX loader 11857>12 string x (older version %-4.4s) 118580 string \r\nSYSLINUX\ SYSLINUX loader 11859>11 string x (version %-4.4s) 11860# syslinux updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012 11861# assembler instructions: jmp yy (yy=0x3c,0x58);nop;"SYSLINUX" 118620 ulelong&0x80909bEB 0x009018EB 11863# OEM-ID not always "SYSLINUX" 11864>434 search/47 Boot\ failed 11865# followed by \r\n\0 or :\ 11866>>482 search/132 \0LDLINUX\ SYS Syslinux bootloader (version 2.13 or older) 11867>>1 ubyte 0x58 Syslinux bootloader (version 3.0-3.9) 11868>459 search/30 Boot\ error\r\n\0 11869>>1 ubyte 0x58 Syslinux bootloader (version 3.10 or newer) 11870# SYSLINUX MBR updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012 11871# assembler instructions: mov di,0600h;mov cx,0100h 1187216 search/4 \xbf\x00\x06\xb9\x00\x01 11873# to display SYSLINUX MBR (36) before old DOS/MBR boot sector one with partition table (strength=50+21) 11874!:strength +36 11875>94 search/249 Missing\ operating\ system 11876# followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other 11877# skip Ranish MBR 11878>>408 search/4 HD1/\0 11879>>408 default x 11880>>>250 search/118 \0Operating\ system\ load SYSLINUX MBR 11881# followed by "ing " or space 11882>>>>292 search/98 error 11883>>>>>&0 string \r (version 3.35 or older) 11884>>>>>&0 string .\r (version 3.52 or newer) 11885>>>>>&0 default x (version 3.36-3.51 ) 11886>368 search/106 \0Disk\ error\ on\ boot\r\n SYSLINUX GPT-MBR 11887>>156 search/10 \0Boot\ partition\ not\ found\r\n 11888>>>270 search/10 \0OS\ not\ bootable\r\n (version 3.86 or older) 11889>>174 search/10 \0Missing\ OS\r\n 11890>>>189 search/10 \0Multiple\ active\ partitions\r\n (version 4.00 or newer) 11891# SYSLINUX END 11892 11893# NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012 11894# assembler instructions: xor ax,ax;mov ax,ss;mov sp,0x7c00;mov ax, 118950 ubequad 0x31c08ed0bc007c8e 11896# mbr_bootsel magic before partition table not reliable with small ipl fragments 11897#>444 uleshort 0xb5e1 11898>0004 uleshort x 11899# ERRorTeXT 11900>>181 search/166 Error\ \0\r\n NetBSD mbr 11901# NT Drive Serial Number https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS 11902>>>0x1B8 ubelong >0 \b,Serial 0x%-.8x 11903# BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx 11904>>>0xbb search/71 \xcd\x13\x5a\x52\x52 \b,bootselector 11905# BOOT_EXTENDED definitions contains assembler instructions: 11906# xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13 11907>>>0x96 search/1 \x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13 \b,boot extended 11908# COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al 11909>>>0x130 search/55 \xee\x80\xc2\x05\xec\xa8\x40 \b,serial IO 11910# not TERSE_ERROR 11911>>>196 search/106 No\ active\ partition\0 11912>>>>&0 string Disk\ read\ error\0 11913>>>>>&0 string No\ operating\ system\0 \b,verbose 11914# not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13 11915>>>0x7d search/7 \x5a\x52\xb4\x08\xcd\x13 \b,CHS 11916# not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop dx;push dx;int 0x13 11917>>>0xa4 search/84 \xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13 \b,LBA-check 11918# assembler instructions: movw nametab,bx 11919>>>0x26 search/21 \xBB\x94\x07 11920# not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf 11921>>>>&-9 ubequad&0xBE00f0E800febb94 0xBE0000E80000bb94 11922>>>>>181 search/166 Error\ \0 11923# "a: disk" , "Fn: diskn" or "NetBSD MBR boot" 11924>>>>>>&3 string x \b,"%s" 11925>>>446 use partition-table 11926# Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html 11927# added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4 11928# assembler instructions: jmp short 0x58;nop;ASCII 119290 ubequad&0xeb58908000000000 0xeb58900000000000 11930# assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss, 11931>(1.b+2) ubequad 0xfa31c08ed88ec08e 11932# Error messages at end of code 11933>>376 string No\ operating\ system\r\n\0 11934>>>398 string Disk\ error\r\n\0FDD\0HDD\0 11935>>>>419 string \ EBIOS\r\n\0 AdvanceMAME mbr 11936 11937# Neil Turton mbr loader variant of https://www.chiark.greenend.org.uk/~neilt/mbr/ 11938# added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11 11939# for 1st version assembler instructions: cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI, 11940# or cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS, 119410 ulequad&0xcE1b40D48EC031FC 0x8E0000D08EC031FC 11942# pointer to the data starting with Neil Turton signature string 11943>(0x1BC.s) string NDTmbr 11944>>&-14 string 1234F\0 Turton mbr ( 11945# parameters also viewed by install-mbr --list 11946>>>(0x1BC.s+7) ubyte x \b%u<= 11947>>>(0x1BC.s+9) ubyte x \bVersion<=%u 11948#>>>(0x1BC.s+8) ubyte x asm_flag_%x 11949>>>(0x1BC.s+8) ubyte&1 1 \b,Y2K-Fix 11950# variant used by testdisk of https://www.cgsecurity.org/wiki/Menu_MBRCode 11951>>>(0x1BC.s+8) ubyte&2 2 \b,TestDisk 11952#0x1~1,..,0x8~4,0x10~F,0x80~A enabled 11953#>>>(0x1BC.s+10) ubyte x \b,flags 0x%x 11954#0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot 11955#>>>(0x1BC.s+11) ubyte x \b,cfg_def 0x%x 11956# for older versions 11957>>>(0x1BC.s+9) ubyte <2 11958#>>>>(0x1BC.s+12) ubyte 18 \b,%hhu/18 seconds 11959>>>>(0x1BC.s+12) ubyte !18 \b,%u/18 seconds 11960# floppy A: or B: 11961>>>>(0x1BC.s+13) ubyte <2 \b,floppy 0x%x 11962>>>>(0x1BC.s+13) ubyte >1 11963# 1st hard disc 11964#>>>>>(0x1BC.s+13) ubyte 0x80 \b,drive 0x%x 11965# not 1st hard disc 11966>>>>>(0x1BC.s+13) ubyte !0x80 \b,drive 0x%x 11967# for version >= 2 maximal timeout can be 65534 11968>>>(0x1BC.s+9) ubyte >1 11969#>>>>(0x1BC.s+12) uleshort 18 \b,%u/18 seconds 11970>>>>(0x1BC.s+12) uleshort !18 \b,%u/18 seconds 11971# floppy A: or B: 11972>>>>(0x1BC.s+14) ubyte <2 \b,floppy 0x%x 11973>>>>(0x1BC.s+14) ubyte >1 11974# 1st hard disc 11975#>>>>>(0x1BC.s+14) ubyte 0x80 \b,drive 0x%x 11976# not 1st hard disc 11977>>>>>(0x1BC.s+14) ubyte !0x80 \b,drive 0x%x 11978>>>0 ubyte x \b) 11979 11980# added by Joerg Jenderek 11981# In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or 11982# grub-1.94/kern/i386/pc/startup.S 11983# https://www.gnu.org/software/grub/manual/grub.html#Embedded-data 11984# usual values are marked with comments to get only informations of strange GRUB loaders 119850x200 uleshort 0x70EA 11986# found only version 3.{1,2} 11987>0x206 ubeshort >0x0300 11988# GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00" 11989>>0x212 ubyte >0x29 11990>>>0x213 ubyte >0x29 11991# not iso9660_stage1_5 11992#>>>0 ulelong&0x00BE5652 0x00BE5652 11993>>>>0x213 ubyte >0x29 GRand Unified Bootloader 11994# config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2" 11995>>>>0x217 ubyte 0xFF stage1_5 11996>>>>0x217 ubyte <0xFF stage2 11997>>>>0x206 ubyte x \b version %u 11998>>>>0x207 ubyte x \b.%u 11999# module_size for 1.94 12000>>>>0x208 ulelong <0xffffff \b, installed partition %u 12001#>>>>0x208 ulelong =0xffffff \b, %lu (default) 12002>>>>0x208 ulelong >0xffffff \b, installed partition %u 12003# GRUB 0.5.95 unofficial 12004>>>>0x20C ulelong&0x2E300000 0x2E300000 12005# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 12006>>>>>0x20C ubyte x \b, identifier 0x%x 12007#>>>>>0x20D ubyte =0 \b, LBA flag 0x%x (default) 12008>>>>>0x20D ubyte >0 \b, LBA flag 0x%x 12009# GRUB version as string 12010>>>>>0x20E string >\0 \b, GRUB version %-s 12011# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default 12012>>>>>>0x215 ulong 0xffffffff 12013>>>>>>>0x219 string >\0 \b, configuration file %-s 12014>>>>>>0x215 ulong !0xffffffff 12015>>>>>>>0x215 string >\0 \b, configuration file %-s 12016# newer GRUB versions 12017>>>>0x20C ulelong&0x2E300000 !0x2E300000 12018##>>>>>0x20C ulelong =0 \b, saved entry %d (usual) 12019>>>>>0x20C ulelong >0 \b, saved entry %d 12020# for 1.94 contains kernel image size 12021# for 0.93,0.94,0.96,0.97 12022# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2 12023>>>>>0x210 ubyte x \b, identifier 0x%x 12024# The flag for LBA forcing is in most cases 0 12025#>>>>>0x211 ubyte =0 \b, LBA flag 0x%x (default) 12026>>>>>0x211 ubyte >0 \b, LBA flag 0x%x 12027# GRUB version as string 12028>>>>>0x212 string >\0 \b, GRUB version %-s 12029# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default 12030>>>>>0x217 ulong 0xffffffff 12031>>>>>>0x21b string >\0 \b, configuration file %-s 12032>>>>>0x217 ulong !0xffffffff 12033>>>>>>0x217 string >\0 \b, configuration file %-s 12034 12035# DOS x86 sector updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at May 2011 12036# JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90 12037# over BIOS parameter block (BPB) 12038# https://thestarman.pcministry.com/asm/2bytejumps.htm#FWD 12039# older drives may use Near JuMP instruction E9 xx xx 12040# minimal short forward jump found 0x29 for bootloaders or 0x0 12041# maximal short forward jump is 0x7f 12042# OEM-ID is empty or contain readable bytes 120430 ulelong&0x804000E9 0x000000E9 12044!:strength +60 12045# mtools-3.9.8/msdos.h 12046# usual values are marked with comments to get only informations of strange FAT systems 12047# valid sectorsize must be a power of 2 from 32 to 32768 12048>11 uleshort&0x001f 0 12049>>11 uleshort <32769 12050>>>11 uleshort >31 12051>>>>21 ubyte&0xf0 0xF0 12052>>>>>0 ubyte 0xEB DOS/MBR boot sector 12053>>>>>>1 ubyte x \b, code offset 0x%x+2 12054>>>>>0 ubyte 0xE9 12055>>>>>>1 uleshort x \b, code offset 0x%x+3 12056>>>>>3 string >\0 \b, OEM-ID "%-.8s" 12057#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC 12058>>>>>>8 string IHC \b cached by Windows 9M 12059>>>>>11 uleshort >512 \b, Bytes/sector %u 12060#>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual) 12061>>>>>11 uleshort <512 \b, Bytes/sector %u 12062>>>>>13 ubyte >1 \b, sectors/cluster %u 12063#>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies) 12064# for lazy FAT32 implementation like Transcend digital photo frame PF830 12065>>>>>82 string/c fat32 12066>>>>>>14 uleshort !32 \b, reserved sectors %u 12067#>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32) 12068>>>>>82 string/c !fat32 12069>>>>>>14 uleshort >1 \b, reserved sectors %u 12070#>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16) 12071#>>>>>>14 uleshort 0 \b, reserved sectors %u (usual NTFS) 12072>>>>>16 ubyte >2 \b, FATs %u 12073#>>>>>16 ubyte =2 \b, FATs %u (usual) 12074>>>>>16 ubyte =1 \b, FAT %u 12075>>>>>16 ubyte >0 12076>>>>>17 uleshort >0 \b, root entries %u 12077#>>>>>17 uleshort =0 \b, root entries %hu=0 (usual Fat32) 12078>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB) 12079#>>>>>19 uleshort =0 \b, sectors %hu=0 (usual Fat32) 12080>>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x 12081#>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy) 12082>>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x 12083>>>>>22 uleshort >0 \b, sectors/FAT %u 12084#>>>>>22 uleshort =0 \b, sectors/FAT %hu=0 (usual Fat32) 12085>>>>>24 uleshort x \b, sectors/track %u 12086>>>>>26 ubyte >2 \b, heads %u 12087#>>>>>26 ubyte =2 \b, heads %u (usual floppy) 12088>>>>>26 ubyte =1 \b, heads %u 12089# valid only for sector sizes with more then 32 Bytes 12090>>>>>11 uleshort >32 12091# https://en.wikipedia.org/wiki/Design_of_the_FAT_file_system#Extended_BIOS_Parameter_Block 12092# skip for values 2,2Ah,70h,73h,DFh 12093# and continue for extended boot signature values 0,28h,29h,80h 12094>>>>>>38 ubyte&0x56 =0 12095>>>>>>>28 ulelong >0 \b, hidden sectors %u 12096#>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy) 12097>>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB) 12098#>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB) 12099# FAT<32 bit specific 12100>>>>>>>82 string/c !fat32 12101#>>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk) 12102#>>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy) 12103>>>>>>>>36 ubyte !0x80 12104>>>>>>>>>36 ubyte !0 \b, physical drive 0x%x 12105# VGA-copy CRC or 12106# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too 12107>>>>>>>>37 ubyte >0 \b, reserved 0x%x 12108#>>>>>>>>37 ubyte =0 \b, reserved 0x%x 12109# extended boot signatur value is 0x80 for NTFS, 0x28 or 0x29 for others 12110>>>>>>>>38 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x) 12111>>>>>>>>38 ubyte&0xFE =0x28 12112>>>>>>>>>39 ulelong x \b, serial number 0x%x 12113>>>>>>>>38 ubyte =0x29 12114>>>>>>>>>43 string <NO\ NAME \b, label: "%11.11s" 12115>>>>>>>>>43 string >NO\ NAME \b, label: "%11.11s" 12116>>>>>>>>>43 string =NO\ NAME \b, unlabeled 12117# there exist some old floppies without word FAT at offset 54 12118# a word like "FATnm " is only a hint for a FAT size on nm-bits 12119# Normally the number of clusters is calculated by the values of BPP. 12120# if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit, 12121# otherwise FAT is 16 bit. 12122# http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html 12123>>>>>82 string/c !fat32 12124>>>>>>54 string FAT12 \b, FAT (12 bit) 12125>>>>>>54 string FAT16 \b, FAT (16 bit) 12126>>>>>>54 default x 12127# determinate FAT bit size by media descriptor 12128# small floppies implies FAT12 12129>>>>>>>21 ubyte <0xF0 \b, FAT (12 bit by descriptor) 12130# with media descriptor F0h floppy or maybe superfloppy with FAT16 12131>>>>>>>21 ubyte =0xF0 12132# superfloppy (many sectors) implies FAT16 12133>>>>>>>>32 ulelong >0xFFFF \b, FAT (16 bit by descriptor+sectors) 12134# no superfloppy with media descriptor F0h implies FAT12 12135>>>>>>>>32 default x \b, FAT (12 bit by descriptor+sectors) 12136# with media descriptor F8h floppy or hard disc with FAT12 or FAT16 12137>>>>>>>21 ubyte =0xF8 12138# 360 KiB with media descriptor F8h, 9 sectors per track ,single sided floppy implies FAT12 12139>>>>>>>>19 ubequad 0xd002f80300090001 \b, FAT (12 bit by descriptor+geometry) 12140# hard disc with FAT12 or FAT16 12141>>>>>>>>19 default x \b, FAT (1Y bit by descriptor) 12142# with media descriptor FAh floppy, RAM disc with FAT12 or FAT16 or Tandy hard disc 12143>>>>>>>21 ubyte =0xFA 12144# 320 KiB with media descriptor FAh, 8 sectors per track ,single sided floppy implies FAT12 12145>>>>>>>>19 ubequad 0x8002fa0200080001 \b, FAT (12 bit by descriptor+geometry) 12146# RAM disc with FAT12 or FAT16 or Tandy hard disc 12147>>>>>>>>19 default x \b, FAT (1Y bit by descriptor) 12148# others are floppy 12149>>>>>>>21 default x \b, FAT (12 bit by descriptor) 12150# FAT32 bit specific 12151>>>>>82 string/c fat32 \b, FAT (32 bit) 12152>>>>>>36 ulelong x \b, sectors/FAT %u 12153# https://technet.microsoft.com/en-us/library/cc977221.aspx 12154>>>>>>40 uleshort >0 \b, extension flags 0x%x 12155#>>>>>>40 uleshort =0 \b, extension flags %hu 12156>>>>>>42 uleshort >0 \b, fsVersion %u 12157#>>>>>>42 uleshort =0 \b, fsVersion %u (usual) 12158>>>>>>44 ulelong >2 \b, rootdir cluster %u 12159#>>>>>>44 ulelong =2 \b, rootdir cluster %u 12160#>>>>>>44 ulelong =1 \b, rootdir cluster %u 12161>>>>>>48 uleshort >1 \b, infoSector %u 12162#>>>>>>48 uleshort =1 \b, infoSector %u (usual) 12163>>>>>>48 uleshort <1 \b, infoSector %u 12164# 0 or 0xFFFF instead of usual 6 means no backup sector 12165>>>>>>50 uleshort =0xFFFF \b, no Backup boot sector 12166>>>>>>50 uleshort =0 \b, no Backup boot sector 12167#>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual) 12168>>>>>>50 default x 12169>>>>>>>50 uleshort x \b, Backup boot sector %u 12170# corrected by Joerg Jenderek at Feb 2011 according to https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO 12171>>>>>>52 ulelong >0 \b, reserved1 0x%x 12172>>>>>>56 ulelong >0 \b, reserved2 0x%x 12173>>>>>>60 ulelong >0 \b, reserved3 0x%x 12174# same structure as FAT1X 12175#>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk) 12176#>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy) 12177>>>>>>64 ubyte !0x80 12178>>>>>>>64 ubyte >0 \b, physical drive 0x%x 12179# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too 12180>>>>>>65 ubyte >0 \b, reserved 0x%x 12181>>>>>>66 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x) 12182>>>>>>66 ubyte =0x29 12183>>>>>>>67 ulelong x \b, serial number 0x%x 12184>>>>>>>71 string <NO\ NAME \b, label: "%11.11s" 12185>>>>>>>71 string >NO\ NAME \b, label: "%11.11s" 12186>>>>>>>71 string =NO\ NAME \b, unlabeled 12187# additional tests for floppy image added by Joerg Jenderek 12188# no fixed disk 12189>>>>>21 ubyte !0xF8 12190# floppy media with 12 bit FAT 12191>>>>>>54 string !FAT16 12192# test for FAT after bootsector 12193>>>>>>>(11.s) ulelong&0x00ffffF0 0x00ffffF0 \b, followed by FAT 12194# floppy image 12195!:mime application/x-ima 12196# NTFS specific added by Joerg Jenderek at Mar 2011 according to https://thestarman.pcministry.com/asm/mbr/NTFSBR.htm 12197# and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html 12198# 0 FATs 12199>>>>>16 ubyte =0 12200# 0 root entries 12201>>>>>>17 uleshort =0 12202# 0 DOS sectors 12203>>>>>>>19 uleshort =0 12204# 0 sectors/FAT 12205# dos < 4.0 BootSector value found is 0x80 12206#38 ubyte =0x80 \b, dos < 4.0 BootSector (0x%x) 12207>>>>>>>>22 uleshort =0 \b; NTFS 12208>>>>>>>>>24 uleshort >0 \b, sectors/track %u 12209>>>>>>>>>36 ulelong !0x800080 \b, physical drive 0x%x 12210>>>>>>>>>40 ulequad >0 \b, sectors %lld 12211>>>>>>>>>48 ulequad >0 \b, $MFT start cluster %lld 12212>>>>>>>>>56 ulequad >0 \b, $MFTMirror start cluster %lld 12213# Values 0 to 127 represent MFT record sizes of 0 to 127 clusters. 12214# Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes. 12215>>>>>>>>>64 lelong <256 12216>>>>>>>>>>64 lelong <128 \b, clusters/RecordSegment %d 12217>>>>>>>>>>64 ubyte >127 \b, bytes/RecordSegment 2^(-1*%i) 12218# Values 0 to 127 represent index block sizes of 0 to 127 clusters. 12219# Values 128 to 255 represent index block sizes of 2^(256-N) byte 12220>>>>>>>>>68 ulelong <256 12221>>>>>>>>>>68 ulelong <128 \b, clusters/index block %d 12222#>>>>>>>>>>68 ulelong >127 \b, bytes/index block 2^(256-%d) 12223>>>>>>>>>>68 ubyte >127 \b, bytes/index block 2^(-1*%i) 12224>>>>>>>>>72 ulequad x \b, serial number 0%llx 12225>>>>>>>>>80 ulelong >0 \b, checksum 0x%x 12226#>>>>>>>>>80 ulelong =0 \b, checksum 0x%x=0 (usual) 12227# unicode loadername size jump 12228>>>>>>>>>(0x200.s*2) ubyte x 12229# in next sector loadername terminated by unicode CTRL-D and $ 12230>>>>>>>>>>&0x1FF ulequad&0x0000FFffFFffFF00 0x0000002400040000 \b; contains 12231# if 2nd NTFS sectors is found then assume whole filesystem 12232#!:mime application/x-raw-disk-image 12233!:ext img/bin/ntfs 12234>>>>>>>>>>>0x200 use ntfs-sector2 12235 12236# For 2nd NTFS sector added by Joerg Jenderek at Jan 2013, Mar 2019 12237# https://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm 12238# unused assembler instructions short JMP y2;NOP;NOP 122390x056 ulelong&0xFFFF0FFF 0x909002EB NTFS 12240#!:mime application/octet-stream 12241!:ext bin 12242>0 use ntfs-sector2 12243# https://memory.dataram.com/products-and-services/software/ramdisk 12244# assembler instructions JMP C000;NOP 122450x056 ulelong 0x9000c0e9 NTFS 12246#!:mime application/octet-stream 12247!:ext bin 12248>0 use ntfs-sector2 12249# check for characteristics of second NTFS sector and then display loader name 122500 name ntfs-sector2 12251# number of utf16 characters of loadername 12252>0 uleshort <8 12253# unused assembler instructions JMP y2;NOP;NOP or JMP C000;NOP 12254>>0x056 ulelong&0xFF0000FD 0x900000E9 12255# loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR 12256>>>0x002 lestring16 x bootstrap %-5.5s 12257# check for 7 character length of loader name like BOOTMGR 12258>>>0 uleshort 7 12259>>>>0x0c lestring16 x \b%-2.2s 12260### DOS,NTFS boot sectors end 12261 12262# ntfsclone-image is a special save format for NTFS volumes, 12263# created and restored by the ntfsclone program 122640 string \0ntfsclone-image ntfsclone image, 12265>0x10 byte x version %d. 12266>0x11 byte x \b%d, 12267>0x12 lelong x cluster size %d, 12268>0x16 lequad x device size %lld, 12269>0x1e lequad x %lld total clusters, 12270>0x26 lequad x %lld clusters in use 12271 122729564 lelong 0x00011954 Unix Fast File system [v1] (little-endian), 12273>8404 string x last mounted on %s, 12274#>9504 ledate x last checked at %s, 12275>8224 ledate x last written at %s, 12276>8401 byte x clean flag %d, 12277>8228 lelong x number of blocks %d, 12278>8232 lelong x number of data blocks %d, 12279>8236 lelong x number of cylinder groups %d, 12280>8240 lelong x block size %d, 12281>8244 lelong x fragment size %d, 12282>8252 lelong x minimum percentage of free blocks %d, 12283>8256 lelong x rotational delay %dms, 12284>8260 lelong x disk rotational speed %drps, 12285>8320 lelong 0 TIME optimization 12286>8320 lelong 1 SPACE optimization 12287 1228842332 lelong 0x19540119 Unix Fast File system [v2] (little-endian) 12289>&-1164 string x last mounted on %s, 12290>&-696 string >\0 volume name %s, 12291>&-304 leqldate x last written at %s, 12292>&-1167 byte x clean flag %d, 12293>&-1168 byte x readonly flag %d, 12294>&-296 lequad x number of blocks %lld, 12295>&-288 lequad x number of data blocks %lld, 12296>&-1332 lelong x number of cylinder groups %d, 12297>&-1328 lelong x block size %d, 12298>&-1324 lelong x fragment size %d, 12299>&-180 lelong x average file size %d, 12300>&-176 lelong x average number of files in dir %d, 12301>&-272 lequad x pending blocks to free %lld, 12302>&-264 lelong x pending inodes to free %d, 12303>&-664 lequad x system-wide uuid %0llx, 12304>&-1316 lelong x minimum percentage of free blocks %d, 12305>&-1248 lelong 0 TIME optimization 12306>&-1248 lelong 1 SPACE optimization 12307 1230866908 lelong 0x19540119 Unix Fast File system [v2] (little-endian) 12309>&-1164 string x last mounted on %s, 12310>&-696 string >\0 volume name %s, 12311>&-304 leqldate x last written at %s, 12312>&-1167 byte x clean flag %d, 12313>&-1168 byte x readonly flag %d, 12314>&-296 lequad x number of blocks %lld, 12315>&-288 lequad x number of data blocks %lld, 12316>&-1332 lelong x number of cylinder groups %d, 12317>&-1328 lelong x block size %d, 12318>&-1324 lelong x fragment size %d, 12319>&-180 lelong x average file size %d, 12320>&-176 lelong x average number of files in dir %d, 12321>&-272 lequad x pending blocks to free %lld, 12322>&-264 lelong x pending inodes to free %d, 12323>&-664 lequad x system-wide uuid %0llx, 12324>&-1316 lelong x minimum percentage of free blocks %d, 12325>&-1248 lelong 0 TIME optimization 12326>&-1248 lelong 1 SPACE optimization 12327 123289564 belong 0x00011954 Unix Fast File system [v1] (big-endian), 12329>7168 belong 0x4c41424c Apple UFS Volume 12330>>7186 string x named %s, 12331>>7176 belong x volume label version %d, 12332>>7180 bedate x created on %s, 12333>8404 string x last mounted on %s, 12334#>9504 bedate x last checked at %s, 12335>8224 bedate x last written at %s, 12336>8401 byte x clean flag %d, 12337>8228 belong x number of blocks %d, 12338>8232 belong x number of data blocks %d, 12339>8236 belong x number of cylinder groups %d, 12340>8240 belong x block size %d, 12341>8244 belong x fragment size %d, 12342>8252 belong x minimum percentage of free blocks %d, 12343>8256 belong x rotational delay %dms, 12344>8260 belong x disk rotational speed %drps, 12345>8320 belong 0 TIME optimization 12346>8320 belong 1 SPACE optimization 12347 1234842332 belong 0x19540119 Unix Fast File system [v2] (big-endian) 12349>&-1164 string x last mounted on %s, 12350>&-696 string >\0 volume name %s, 12351>&-304 beqldate x last written at %s, 12352>&-1167 byte x clean flag %d, 12353>&-1168 byte x readonly flag %d, 12354>&-296 bequad x number of blocks %lld, 12355>&-288 bequad x number of data blocks %lld, 12356>&-1332 belong x number of cylinder groups %d, 12357>&-1328 belong x block size %d, 12358>&-1324 belong x fragment size %d, 12359>&-180 belong x average file size %d, 12360>&-176 belong x average number of files in dir %d, 12361>&-272 bequad x pending blocks to free %lld, 12362>&-264 belong x pending inodes to free %d, 12363>&-664 bequad x system-wide uuid %0llx, 12364>&-1316 belong x minimum percentage of free blocks %d, 12365>&-1248 belong 0 TIME optimization 12366>&-1248 belong 1 SPACE optimization 12367 1236866908 belong 0x19540119 Unix Fast File system [v2] (big-endian) 12369>&-1164 string x last mounted on %s, 12370>&-696 string >\0 volume name %s, 12371>&-304 beqldate x last written at %s, 12372>&-1167 byte x clean flag %d, 12373>&-1168 byte x readonly flag %d, 12374>&-296 bequad x number of blocks %lld, 12375>&-288 bequad x number of data blocks %lld, 12376>&-1332 belong x number of cylinder groups %d, 12377>&-1328 belong x block size %d, 12378>&-1324 belong x fragment size %d, 12379>&-180 belong x average file size %d, 12380>&-176 belong x average number of files in dir %d, 12381>&-272 bequad x pending blocks to free %lld, 12382>&-264 belong x pending inodes to free %d, 12383>&-664 bequad x system-wide uuid %0llx, 12384>&-1316 belong x minimum percentage of free blocks %d, 12385>&-1248 belong 0 TIME optimization 12386>&-1248 belong 1 SPACE optimization 12387 123880 ulequad 0xc8414d4dc5523031 HAMMER filesystem (little-endian), 12389>0x90 lelong+1 x volume %d 12390>0x94 lelong x (of %d), 12391>0x50 string x name %s, 12392>0x98 ulelong x version %u, 12393>0xa0 ulelong x flags 0x%x 12394 12395# ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca> 12396# ext4 filesystem - Eric Sandeen <sandeen@sandeen.net> 12397# volume label and UUID Russell Coker 12398# https://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/ 123990x438 leshort 0xEF53 Linux 12400>0x44c lelong x rev %d 12401>0x43e leshort x \b.%d 12402# No journal? ext2 12403>0x45c lelong ^0x0000004 ext2 filesystem data 12404>>0x43a leshort ^0x0000001 (mounted or unclean) 12405# Has a journal? ext3 or ext4 12406>0x45c lelong &0x0000004 12407# and small INCOMPAT? 12408>>0x460 lelong <0x0000040 12409# and small RO_COMPAT? 12410>>>0x464 lelong <0x0000008 ext3 filesystem data 12411# else large RO_COMPAT? 12412>>>0x464 lelong >0x0000007 ext4 filesystem data 12413# else large INCOMPAT? 12414>>0x460 lelong >0x000003f ext4 filesystem data 12415>0x468 belong x \b, UUID=%08x 12416>0x46c beshort x \b-%04x 12417>0x46e beshort x \b-%04x 12418>0x470 beshort x \b-%04x 12419>0x472 belong x \b-%08x 12420>0x476 beshort x \b%04x 12421>0x478 string >0 \b, volume name "%s" 12422# General flags for any ext* fs 12423>0x460 lelong &0x0000004 (needs journal recovery) 12424>0x43a leshort &0x0000002 (errors) 12425# INCOMPAT flags 12426>0x460 lelong &0x0000001 (compressed) 12427#>0x460 lelong &0x0000002 (filetype) 12428#>0x460 lelong &0x0000010 (meta bg) 12429>0x460 lelong &0x0000040 (extents) 12430>0x460 lelong &0x0000080 (64bit) 12431#>0x460 lelong &0x0000100 (mmp) 12432#>0x460 lelong &0x0000200 (flex bg) 12433# RO_INCOMPAT flags 12434#>0x464 lelong &0x0000001 (sparse super) 12435>0x464 lelong &0x0000002 (large files) 12436>0x464 lelong &0x0000008 (huge files) 12437#>0x464 lelong &0x0000010 (gdt checksum) 12438#>0x464 lelong &0x0000020 (many subdirs) 12439#>0x463 lelong &0x0000040 (extra isize) 12440 12441# f2fs filesystem - Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi> 124420x400 lelong 0xF2F52010 F2FS filesystem 12443>0x46c belong x \b, UUID=%08x 12444>0x470 beshort x \b-%04x 12445>0x472 beshort x \b-%04x 12446>0x474 beshort x \b-%04x 12447>0x476 belong x \b-%08x 12448>0x47a beshort x \b%04x 12449>0x147c lestring16 x \b, volume name "%s" 12450 12451# Minix filesystems - Juan Cespedes <cespedes@debian.org> 124520x410 leshort 0x137f 12453!:strength / 2 12454>0x402 beshort < 100 12455>0x402 beshort > -1 Minix filesystem, V1, 14 char names, %d zones 12456>0x1e string minix \b, bootable 124570x410 beshort 0x137f 12458!:strength / 2 12459>0x402 beshort < 100 12460>0x402 beshort > -1 Minix filesystem, V1 (big endian), %d zones 12461>0x1e string minix \b, bootable 124620x410 leshort 0x138f 12463!:strength / 2 12464>0x402 beshort < 100 12465>0x402 beshort > -1 Minix filesystem, V1, 30 char names, %d zones 12466>0x1e string minix \b, bootable 124670x410 beshort 0x138f 12468!:strength / 2 12469>0x402 beshort < 100 12470>0x402 beshort > -1 Minix filesystem, V1, 30 char names (big endian), %d zones 12471>0x1e string minix \b, bootable 12472# Weak Magic: this is $x 12473#0x410 leshort 0x2468 12474#>0x402 beshort < 100 12475#>>0x402 beshort > -1 Minix filesystem, V2, 14 char names 12476#>0x1e string minix \b, bootable 12477#0x410 beshort 0x2468 12478#>0x402 beshort < 100 12479#>0x402 beshort > -1 Minix filesystem, V2 (big endian) 12480#>0x1e string minix \b, bootable 12481#0x410 leshort 0x2478 12482#>0x402 beshort < 100 12483#>0x402 beshort > -1 Minix filesystem, V2, 30 char names 12484#>0x1e string minix \b, bootable 12485#0x410 leshort 0x2478 12486#>0x402 beshort < 100 12487#>0x402 beshort > -1 Minix filesystem, V2, 30 char names 12488#>0x1e string minix \b, bootable 12489#0x410 beshort 0x2478 12490#>0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian) 12491#>0x1e string minix \b, bootable 12492# Weak Magic! this is MD 12493#0x418 leshort 0x4d5a 12494#>0x402 beshort <100 12495#>>0x402 beshort > -1 Minix filesystem, V3, 60 char names 12496 12497# SGI disk labels - Nathan Scott <nathans@debian.org> 124980 belong 0x0BE5A941 SGI disk label (volume header) 12499 12500# SGI XFS filesystem - Nathan Scott <nathans@debian.org> 125010 belong 0x58465342 SGI XFS filesystem data 12502>0x4 belong x (blksz %d, 12503>0x68 beshort x inosz %d, 12504>0x64 beshort ^0x2004 v1 dirs) 12505>0x64 beshort &0x2004 v2 dirs) 12506 12507############################################################################ 12508# Minix-ST kernel floppy 125090x800 belong 0x46fc2700 Atari-ST Minix kernel image 12510# https://en.wikipedia.org/wiki/BIOS_parameter_block 12511# floppies with valid BPB and any instruction at beginning 12512>19 string \240\005\371\005\0\011\0\2\0 \b, 720k floppy 12513>19 string \320\002\370\005\0\011\0\1\0 \b, 360k floppy 12514 12515############################################################################ 12516# Hmmm, is this a better way of detecting _standard_ floppy images ? 1251719 string \320\002\360\003\0\011\0\1\0 DOS floppy 360k 12518>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 1251919 string \240\005\371\003\0\011\0\2\0 DOS floppy 720k 12520>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 1252119 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k 12522>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 12523 1252419 string \240\005\371\005\0\011\0\2\0 DOS floppy 720k, IBM 12525>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 1252619 string \100\013\371\005\0\011\0\2\0 DOS floppy 1440k, mkdosfs 12527>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 12528 1252919 string \320\002\370\005\0\011\0\1\0 Atari-ST floppy 360k 1253019 string \240\005\371\005\0\011\0\2\0 Atari-ST floppy 720k 12531# | | | | | 12532# | | | | heads 12533# | | | sectors/track 12534# | | sectors/FAT 12535# | media descriptor 12536# BPB: sectors 12537 12538# Valid media descriptor bytes for MS-DOS: 12539# 12540# Byte Capacity Media Size and Type 12541# ------------------------------------------------- 12542# 12543# F0 2.88 MB 3.5-inch, 2-sided, 36-sector 12544# F0 1.44 MB 3.5-inch, 2-sided, 18-sector 12545# F9 720K 3.5-inch, 2-sided, 9-sector 12546# F9 1.2 MB 5.25-inch, 2-sided, 15-sector 12547# FD 360K 5.25-inch, 2-sided, 9-sector 12548# FF 320K 5.25-inch, 2-sided, 8-sector 12549# FC 180K 5.25-inch, 1-sided, 9-sector 12550# FE 160K 5.25-inch, 1-sided, 8-sector 12551# FE 250K 8-inch, 1-sided, single-density 12552# FD 500K 8-inch, 2-sided, single-density 12553# FE 1.2 MB 8-inch, 2-sided, double-density 12554# F8 ----- Fixed disk 12555# 12556# FC xxxK Apricot 70x1x9 boot disk. 12557# 12558# Originally a bitmap: 12559# xxxxxxx0 Not two sided 12560# xxxxxxx1 Double sided 12561# xxxxxx0x Not 8 SPT 12562# xxxxxx1x 8 SPT 12563# xxxxx0xx Not Removable drive 12564# xxxxx1xx Removable drive 12565# 11111xxx Must be one. 12566# 12567# But now it's rather random: 12568# 111111xx Low density disk 12569# 00 SS, Not 8 SPT 12570# 01 DS, Not 8 SPT 12571# 10 SS, 8 SPT 12572# 11 DS, 8 SPT 12573# 12574# 11111001 Double density 3 1/2 floppy disk, high density 5 1/4 12575# 11110000 High density 3 1/2 floppy disk 12576# 11111000 Hard disk any format 12577# 12578 12579# all FAT12 (strength=70) floppies with sectorsize 512 added by Joerg Jenderek at Jun 2013 12580# https://en.wikipedia.org/wiki/File_Allocation_Table#Exceptions 12581# Too Weak. 12582#512 ubelong&0xE0ffff00 0xE0ffff00 12583# without valid Media descriptor in place of BPB, cases with are done at other places 12584#>21 ubyte <0xE5 floppy with old FAT filesystem 12585# but valid Media descriptor at begin of FAT 12586#>>512 ubyte =0xed 720k 12587#>>512 ubyte =0xf0 1440k 12588#>>512 ubyte =0xf8 720k 12589#>>512 ubyte =0xf9 1220k 12590#>>512 ubyte =0xfa 320k 12591#>>512 ubyte =0xfb 640k 12592#>>512 ubyte =0xfc 180k 12593# look like an old DOS directory entry 12594#>>>0xA0E ubequad 0 12595#>>>>0xA00 ubequad !0 12596#!:mime application/x-ima 12597#>>512 ubyte =0xfd 12598# look for 2nd FAT at different location to distinguish between 360k and 500k 12599#>>>0x600 ubelong&0xE0ffff00 0xE0ffff00 360k 12600#>>>0x500 ubelong&0xE0ffff00 0xE0ffff00 500k 12601#>>>0xA0E ubequad 0 12602#!:mime application/x-ima 12603#>>512 ubyte =0xfe 12604#>>>0x400 ubelong&0xE0ffff00 0xE0ffff00 160k 12605#>>>>0x60E ubequad 0 12606#>>>>>0x600 ubequad !0 12607#!:mime application/x-ima 12608#>>>0xC00 ubelong&0xE0ffff00 0xE0ffff00 1200k 12609#>>512 ubyte =0xff 320k 12610#>>>0x60E ubequad 0 12611#>>>>0x600 ubequad !0 12612#!:mime application/x-ima 12613#>>512 ubyte x \b, Media descriptor 0x%x 12614# without x86 jump instruction 12615#>>0 ulelong&0x804000E9 !0x000000E9 12616# assembler instructions: CLI;MOV SP,1E7;MOV AX;07c0;MOV 12617#>>>0 ubequad 0xfabce701b8c0078e \b, MS-DOS 1.12 bootloader 12618# IOSYS.COM+MSDOS.COM 12619#>>>>0xc4 use 2xDOS-filename 12620#>>0 ulelong&0x804000E9 =0x000000E9 12621# only x86 short jump instruction found 12622#>>>0 ubyte =0xEB 12623#>>>>1 ubyte x \b, code offset 0x%x+2 12624# https://thestarman.pcministry.com/DOS/ibm100/Boot.htm 12625# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;MOV DX,0 12626#>>>>(1.b+2) ubequad 0xfa8cc88ed8ba0000 \b, PC-DOS 1.0 bootloader 12627# ibmbio.com+ibmdos.com 12628#>>>>>0x176 use DOS-filename 12629#>>>>>0x181 ubyte x \b+ 12630#>>>>>0x182 use DOS-filename 12631# https://thestarman.pcministry.com/DOS/ibm110/Boot.htm 12632# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;XOR DX,DX;MOV 12633#>>>>(1.b+2) ubequad 0xfa8cc88ed833d28e \b, PC-DOS 1.1 bootloader 12634# ibmbio.com+ibmdos.com 12635#>>>>>0x18b use DOS-filename 12636#>>>>>0x196 ubyte x \b+ 12637#>>>>>0x197 use DOS-filename 12638# https://en.wikipedia.org/wiki/Zenith_Data_Systems 12639# assembler instructions: MOV BX,07c0;MOV SS,BX;MOV SP,01c6 12640#>>>>(1.b+2) ubequad 0xbbc0078ed3bcc601 \b, Zenith Data Systems MS-DOS 1.25 bootloader 12641# IO.SYS+MSDOS.SYS 12642#>>>>>0x20 use 2xDOS-filename 12643# https://en.wikipedia.org/wiki/Corona_Data_Systems 12644# assembler instructions: MOV AX,CS;MOV DS,AX;CLI;MOV SS,AX; 12645#>>>>(1.b+2) ubequad 0x8cc88ed8fa8ed0bc \b, MS-DOS 1.25 bootloader 12646# IO.SYS+MSDOS.SYS 12647#>>>>>0x69 use 2xDOS-filename 12648# assembler instructions: CLI;PUSH CS;POP SS;MOV SP,7c00; 12649#>>>>(1.b+2) ubequad 0xfa0e17bc007cb860 \b, MS-DOS 2.11 bootloader 12650# defect IO.SYS+MSDOS.SYS ? 12651#>>>>>0x162 use 2xDOS-filename 12652 126530 name cdrom 12654>38913 string !NSR0 ISO 9660 CD-ROM filesystem data 12655!:mime application/x-iso9660-image 12656!:ext iso/iso9660 12657>38913 string NSR0 UDF filesystem data 12658!:mime application/x-iso9660-image 12659!:ext iso/udf 12660>>38917 string 1 (version 1.0) 12661>>38917 string 2 (version 1.5) 12662>>38917 string 3 (version 2.0) 12663>>38917 byte >0x33 (unknown version, ID 0x%X) 12664>>38917 byte <0x31 (unknown version, ID 0x%X) 12665# The next line is not necessary because the MBR staff is done looking for boot signature 12666>0x1FE leshort 0xAA55 (DOS/MBR boot sector) 12667# "application id" which appears to be used as a volume label 12668>32808 string/T >\0 '%s' 12669>34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable) 1267037633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors) 12671!:mime application/x-iso9660-image 1267232777 string CDROM High Sierra CD-ROM filesystem data 12673 12674# CDROM Filesystems 12675# https://en.wikipedia.org/wiki/ISO_9660 12676# Modified for UDF by gerardo.cacciari@gmail.com 1267732769 string CD001 12678# mime line at that position does not work 12679# to display CD-ROM (70=81-11) after MBR (113=40+72+1), partition-table (71=50+21) and before Apple Driver Map (51) 12680#!:strength -11 12681# to display CD-ROM (114=81+33) before MBR (113=40+72+1), partition-table (71=50+21) and Apple Driver Map (51) 12682!:strength +35 12683>0 use cdrom 12684 12685# URL: https://en.wikipedia.org/wiki/NRG_(file_format) 12686# Reference: https://dl.opendesktop.org/api/files/download/id/1460731811/ 12687# 11577-mount-iso-0.9.5.tar.bz2/mount-iso-0.9.5/install.sh 12688# From: Joerg Jenderek 12689# Note: Only for nero disc with once (DAO) type after 300 KB header 12690339969 string CD001 Nero CD image at 0x4B000 12691!:mime application/x-nrg 12692!:ext nrg 12693>307200 use cdrom 12694 12695# .cso files 12696# Reference: https://pismotec.com/ciso/ciso.h 12697# NOTE: There are two other formats with the same magic but 12698# completely incompatible specifications: 12699# - GameCube/Wii CISO: https://github.com/dolphin-emu/dolphin/blob/master/Source/Core/DiscIO/CISOBlob.h 12700# - PSP CISO: https://github.com/jamie/ciso/blob/master/ciso.h 127010 string CISO 12702# Other fields are used to determine what type of CISO this is: 12703# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size) 12704# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size) 12705# - 0x10 == 0x00004000: For >2GB files using maxcso... 12706# https://github.com/unknownbrackets/maxcso/issues/26 12707# - None of the above: Compact ISO. 12708>4 lelong !0 12709>>4 lelong !0x200000 12710>>>16 lelong !0x800 12711>>>>16 lelong !0x4000 Compressed ISO CD image 12712 12713# cramfs filesystem - russell@coker.com.au 127140 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian 12715>4 lelong x size %u 12716>8 lelong &1 version #2 12717>8 lelong &2 sorted_dirs 12718>8 lelong &4 hole_support 12719>32 lelong x CRC 0x%x, 12720>36 lelong x edition %u, 12721>40 lelong x %u blocks, 12722>44 lelong x %u files 12723 127240 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian 12725>4 belong x size %u 12726>8 belong &1 version #2 12727>8 belong &2 sorted_dirs 12728>8 belong &4 hole_support 12729>32 belong x CRC 0x%x, 12730>36 belong x edition %u, 12731>40 belong x %u blocks, 12732>44 belong x %u files 12733 12734# reiserfs - russell@coker.com.au 127350x10034 string ReIsErFs ReiserFS V3.5 127360x10034 string ReIsEr2Fs ReiserFS V3.6 127370x10034 string ReIsEr3Fs ReiserFS V3.6.19 12738>0x1002c leshort x block size %d 12739>0x10032 leshort &2 (mounted or unclean) 12740>0x10000 lelong x num blocks %d 12741>0x10040 lelong 1 tea hash 12742>0x10040 lelong 2 yura hash 12743>0x10040 lelong 3 r5 hash 12744 12745# EST flat binary format (which isn't, but anyway) 12746# From: Mark Brown <broonie@sirena.org.uk> 127470 string ESTFBINR EST flat binary 12748 12749# Aculab VoIP firmware 12750# From: Mark Brown <broonie@sirena.org.uk> 127510 string VoIP\ Startup\ and Aculab VoIP firmware 12752>35 string x format %s 12753 12754# From: Mark Brown <broonie@sirena.org.uk> [old] 12755# From: Behan Webster <behanw@websterwood.com> 127560 belong 0x27051956 u-boot legacy uImage, 12757>32 string x %s, 12758>28 byte 0 Invalid os/ 12759>28 byte 1 OpenBSD/ 12760>28 byte 2 NetBSD/ 12761>28 byte 3 FreeBSD/ 12762>28 byte 4 4.4BSD/ 12763>28 byte 5 Linux/ 12764>28 byte 6 SVR4/ 12765>28 byte 7 Esix/ 12766>28 byte 8 Solaris/ 12767>28 byte 9 Irix/ 12768>28 byte 10 SCO/ 12769>28 byte 11 Dell/ 12770>28 byte 12 NCR/ 12771>28 byte 13 LynxOS/ 12772>28 byte 14 VxWorks/ 12773>28 byte 15 pSOS/ 12774>28 byte 16 QNX/ 12775>28 byte 17 Firmware/ 12776>28 byte 18 RTEMS/ 12777>28 byte 19 ARTOS/ 12778>28 byte 20 Unity OS/ 12779>28 byte 21 INTEGRITY/ 12780>29 byte 0 \bInvalid CPU, 12781>29 byte 1 \bAlpha, 12782>29 byte 2 \bARM, 12783>29 byte 3 \bIntel x86, 12784>29 byte 4 \bIA64, 12785>29 byte 5 \bMIPS, 12786>29 byte 6 \bMIPS 64-bit, 12787>29 byte 7 \bPowerPC, 12788>29 byte 8 \bIBM S390, 12789>29 byte 9 \bSuperH, 12790>29 byte 10 \bSparc, 12791>29 byte 11 \bSparc 64-bit, 12792>29 byte 12 \bM68K, 12793>29 byte 13 \bNios-32, 12794>29 byte 14 \bMicroBlaze, 12795>29 byte 15 \bNios-II, 12796>29 byte 16 \bBlackfin, 12797>29 byte 17 \bAVR32, 12798>29 byte 18 \bSTMicroelectronics ST200, 12799>29 byte 19 \bSandbox architecture, 12800>29 byte 20 \bANDES Technology NDS32, 12801>29 byte 21 \bOpenRISC 1000, 12802>29 byte 22 \bARM 64-bit, 12803>29 byte 23 \bDesignWare ARC, 12804>29 byte 24 \bx86_64, 12805>29 byte 25 \bXtensa, 12806>29 byte 26 \bRISC-V, 12807>30 byte 0 Invalid Image 12808>30 byte 1 Standalone Program 12809>30 byte 2 OS Kernel Image 12810>30 byte 3 RAMDisk Image 12811>30 byte 4 Multi-File Image 12812>30 byte 5 Firmware Image 12813>30 byte 6 Script File 12814>30 byte 7 Filesystem Image (any type) 12815>30 byte 8 Binary Flat Device Tree BLOB 12816>31 byte 0 (Not compressed), 12817>31 byte 1 (gzip), 12818>31 byte 2 (bzip2), 12819>31 byte 3 (lzma), 12820>12 belong x %d bytes, 12821>8 bedate x %s, 12822>16 belong x Load Address: 0x%08X, 12823>20 belong x Entry Point: 0x%08X, 12824>4 belong x Header CRC: 0x%08X, 12825>24 belong x Data CRC: 0x%08X 12826 12827# JFFS2 file system 128280 leshort 0x1984 Linux old jffs2 filesystem data little endian 128290 beshort 0x1984 Linux old jffs2 filesystem data big endian 128300 leshort 0x1985 Linux jffs2 filesystem data little endian 128310 beshort 0x1985 Linux jffs2 filesystem data big endian 12832 12833# Squashfs 128340 name squashfs 12835>28 beshort x version %d. 12836>30 beshort x \b%d, 12837>20 beshort 0 uncompressed, 12838>20 beshort 1 zlib 12839>20 beshort 2 lzma 12840>20 beshort 3 lzo 12841>20 beshort 4 xz 12842>20 beshort 5 lz4 12843>20 beshort 6 zstd 12844>20 beshort >0 compressed, 12845>28 beshort <3 12846>>8 belong x %d bytes, 12847>28 beshort >2 12848>>28 beshort <4 12849>>>63 bequad x %lld bytes, 12850>>28 beshort >3 12851>>>40 bequad x %lld bytes, 12852#>>67 belong x %d bytes, 12853>4 belong x %d inodes, 12854>28 beshort <2 12855>>32 beshort x blocksize: %d bytes, 12856>28 beshort >1 12857>>28 beshort <4 12858>>>51 belong x blocksize: %d bytes, 12859>>28 beshort >3 12860>>>12 belong x blocksize: %d bytes, 12861>28 beshort <4 12862>>39 bedate x created: %s 12863>28 beshort >3 12864>>8 bedate x created: %s 12865 128660 string sqsh Squashfs filesystem, big endian, 12867>0 use squashfs 12868 128690 string hsqs Squashfs filesystem, little endian, 12870>0 use \^squashfs 12871 12872# AFS Dump Magic 12873# From: Ty Sarna <tsarna@sarna.org> 128740 string \x01\xb3\xa1\x13\x22 AFS Dump 12875>&0 belong x (v%d) 12876>>&0 byte 0x76 12877>>>&0 belong x Vol %d, 12878>>>>&0 byte 0x6e 12879>>>>>&0 string x %s 12880>>>>>>&1 byte 0x74 12881>>>>>>>&0 beshort 2 12882>>>>>>>>&4 bedate x on: %s 12883>>>>>>>>&0 bedate =0 full dump 12884>>>>>>>>&0 bedate !0 incremental since: %s 12885 12886#---------------------------------------------------------- 12887#delta ISO Daniel Novotny (dnovotny@redhat.com) 128880 string DISO Delta ISO data 12889!:strength +50 12890>4 belong x version %d 12891 12892# VMS backup savesets - gerardo.cacciari@gmail.com 12893# 128944 string \x01\x00\x01\x00\x01\x00 12895>(0.s+16) string \x01\x01 12896>>&(&0.b+8) byte 0x42 OpenVMS backup saveset data 12897>>>40 lelong x (block size %d, 12898>>>49 string >\0 original name '%s', 12899>>>2 short 1024 VAX generated) 12900>>>2 short 2048 AXP generated) 12901>>>2 short 4096 I64 generated) 12902 12903# Summary: Oracle Clustered Filesystem 12904# Created by: Aaron Botsis <redhat@digitalmafia.org> 129058 string OracleCFS Oracle Clustered Filesystem, 12906>4 long x rev %d 12907>0 long x \b.%d, 12908>560 string x label: %.64s, 12909>136 string x mountpoint: %.128s 12910 12911# Summary: Oracle ASM tagged volume 12912# Created by: Aaron Botsis <redhat@digitalmafia.org> 1291332 string ORCLDISK Oracle ASM Volume, 12914>40 string x Disk Name: %0.12s 1291532 string ORCLCLRD Oracle ASM Volume (cleared), 12916>40 string x Disk Name: %0.12s 12917 12918# Oracle Clustered Filesystem - Aaron Botsis <redhat@digitalmafia.org> 129198 string OracleCFS Oracle Clustered Filesystem, 12920>4 long x rev %d 12921>0 long x \b.%d, 12922>560 string x label: %.64s, 12923>136 string x mountpoint: %.128s 12924 12925# Oracle ASM tagged volume - Aaron Botsis <redhat@digitalmafia.org> 1292632 string ORCLDISK Oracle ASM Volume, 12927>40 string x Disk Name: %0.12s 1292832 string ORCLCLRD Oracle ASM Volume (cleared), 12929>40 string x Disk Name: %0.12s 12930 12931# Compaq/HP RILOE floppy image 12932# From: Dirk Jagdmann <doj@cubic.org> 129330 string CPQRFBLO Compaq/HP RILOE floppy image 12934 12935#------------------------------------------------------------------------------ 12936# Files-11 On-Disk Structure (File system for various RSX-11 and VMS flavours). 12937# These bits come from LBN 1 (home block) of ODS-1, ODS-2 and ODS-5 volumes, 12938# which is mapped to VBN 2 of [000000]INDEXF.SYS;1 - gerardo.cacciari@gmail.com 12939# 129401008 string DECFILE11 Files-11 On-Disk Structure 12941>525 byte x (ODS-%d); 12942>1017 string A RSX-11, VAX/VMS or OpenVMS VAX file system; 12943>1017 string B 12944>>525 byte 2 VAX/VMS or OpenVMS file system; 12945>>525 byte 5 OpenVMS Alpha or Itanium file system; 12946>984 string x volume label is '%-12.12s' 12947 12948# From: Thomas Klausner <wiz@NetBSD.org> 12949# https://filext.com/file-extension/DAA 12950# describes the daa file format. The magic would be: 129510 string DAA\x0\x0\x0\x0\x0 PowerISO Direct-Access-Archive 12952 12953# From Albert Cahalan <acahalan@gmail.com> 12954# really le32 operation,destination,payloadsize (but quite predictable) 12955# 01 00 00 00 00 00 00 c0 00 02 00 00 129560 string \1\0\0\0\0\0\0\300\0\2\0\0 Marvell Libertas firmware 12957 12958# From Eric Sandeen 12959# GFS2 129600x10000 belong 0x01161970 12961>0x10018 belong 0x0000051d GFS1 Filesystem 12962>>0x10024 belong x (blocksize %d, 12963>>0x10060 string >\0 lockproto %s) 12964>0x10018 belong 0x00000709 GFS2 Filesystem 12965>>0x10024 belong x (blocksize %d, 12966>>0x10060 string >\0 lockproto %s) 12967 12968# Russell Coker <russell@coker.com.au> 129690x10040 string _BHRfS_M BTRFS Filesystem 12970>0x1012b string >\0 label "%s", 12971>0x10090 lelong x sectorsize %d, 12972>0x10094 lelong x nodesize %d, 12973>0x10098 lelong x leafsize %d, 12974>0x10020 belong x UUID=%08x- 12975>0x10024 beshort x \b%04x- 12976>0x10026 beshort x \b%04x- 12977>0x10028 beshort x \b%04x- 12978>0x1002a beshort x \b%04x 12979>0x1002c belong x \b%08x, 12980>0x10078 lequad x %lld/ 12981>0x10070 lequad x \b%lld bytes used, 12982>0x10088 lequad x %lld devices 12983 12984# dvdisaster's .ecc 12985# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 129860 string *dvdisaster* dvdisaster error correction file 12987 12988# xfs metadump image 12989# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog 12990# but can we do the << ? For now it's always 512 (0x200) anyway. 129910 string XFSM 12992>0x200 string XFSB XFS filesystem metadump image 12993 12994# Type: CROM filesystem 12995# From: Werner Fink <werner@suse.de> 129960 string CROMFS CROMFS 12997>6 string >\0 \b version %2.2s, 12998>8 ulequad >0 \b block data at %lld, 12999>16 ulequad >0 \b fblock table at %lld, 13000>24 ulequad >0 \b inode table at %lld, 13001>32 ulequad >0 \b root at %lld, 13002>40 ulelong >0 \b fblock size = %d, 13003>44 ulelong >0 \b block size = %d, 13004>48 ulequad >0 \b bytes = %lld 13005 13006# Type: xfs metadump image 13007# From: Daniel Novotny <dnovotny@redhat.com> 13008# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog 13009# but can we do the << ? For now it's always 512 (0x200) anyway. 130100 string XFSM 13011>0x200 string XFSB XFS filesystem metadump image 13012 13013# Type: delta ISO 13014# From: Daniel Novotny <dnovotny@redhat.com> 130150 string DISO Delta ISO data, 13016>4 belong x version %d 13017 13018# JFS2 (Journaling File System) image. (Old JFS1 has superblock at 0x1000.) 13019# See linux/fs/jfs/jfs_superblock.h for layout; see jfs_filsys.h for flags. 13020# From: Adam Buchbinder <adam.buchbinder@gmail.com> 130210x8000 string JFS1 13022# Because it's text-only magic, check a binary value (version) to be sure. 13023# Should always be 2, but mkfs.jfs writes it as 1. Needs to be 2 or 1 to be 13024# mountable. 13025>&0 lelong <3 JFS2 filesystem image 13026# Label is followed by a UUID; we have to limit string length to avoid 13027# appending the UUID in the case of a 16-byte label. 13028>>&144 regex [\x20-\x7E]{1,16} (label "%s") 13029>>&0 lequad x \b, %lld blocks 13030>>&8 lelong x \b, blocksize %d 13031>>&32 lelong&0x00000006 >0 (dirty) 13032>>&36 lelong >0 (compressed) 13033 13034# LFS 130350 lelong 0x070162 LFS filesystem image 13036>4 lelong 1 version 1, 13037>>8 lelong x \b blocks %u, 13038>>12 lelong x \b blocks per segment %u, 13039>4 lelong 2 version 2, 13040>>8 lelong x \b fragments %u, 13041>>12 lelong x \b bytes per segment %u, 13042>16 lelong x \b disk blocks %u, 13043>20 lelong x \b block size %u, 13044>24 lelong x \b fragment size %u, 13045>28 lelong x \b fragments per block %u, 13046>32 lelong x \b start for free list %u, 13047>36 lelong x \b number of free blocks %d, 13048>40 lelong x \b number of files %u, 13049>44 lelong x \b blocks available for writing %d, 13050>48 lelong x \b inodes in cache %d, 13051>52 lelong x \b inode file disk address 0x%x, 13052>56 lelong x \b inode file inode number %u, 13053>60 lelong x \b address of last segment written 0x%x, 13054>64 lelong x \b address of next segment to write 0x%x, 13055>68 lelong x \b address of current segment written 0x%x 13056 130570 string td\000 floppy image data (TeleDisk, compressed) 130580 string TD\000 floppy image data (TeleDisk) 13059 130600 string CQ\024 floppy image data (CopyQM, 13061>16 leshort x %d sectors, 13062>18 leshort x %d heads.) 13063 130640 string ACT\020Apricot\020disk\020image\032\004 floppy image data (ApriDisk) 13065 130660 beshort 0xAA58 floppy image data (IBM SaveDskF, old) 130670 beshort 0xAA59 floppy image data (IBM SaveDskF) 130680 beshort 0xAA5A floppy image data (IBM SaveDskF, compressed) 13069 130700 string \074CPM_Disk\076 disk image data (YAZE) 13071 13072# ReFS 13073# Richard W.M. Jones <rjones@redhat.com> 130740 string \0\0\0ReFS\0 ReFS filesystem image 13075 13076# EFW encase image file format: 13077# Gregoire Passault 13078# http://www.forensicswiki.org/wiki/Encase_image_file_format 130790 string EVF\x09\x0d\x0a\xff\x00 EWF/Expert Witness/EnCase image file format 13080 13081# UBIfs 13082# Linux kernel sources: fs/ubifs/ubifs-media.h 130830 lelong 0x06101831 13084>0x16 leshort 0 UBIfs image 13085>0x08 lequad x \b, sequence number %llu 13086>0x10 leshort x \b, length %u 13087>0x04 lelong x \b, CRC 0x%08x 13088 130890 lelong 0x23494255 13090>0x04 leshort <2 13091>0x05 string \0\0\0 13092>0x1c string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 13093>0x04 leshort x UBI image, version %u 13094 13095# NEC PC-88 2D disk image 13096# From Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net> 130970x20 ulelong&0xFFFFFEFF 0x2A0 13098>0x10 string \0\0\0\0\0\0\0\0\0\0 13099>>0x280 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 13100>>>0x1A ubyte&0xEF 0 13101>>>>0x1B ubyte&0x8F 0 13102>>>>>0x1B ubyte&70 <0x40 13103>>>>>>0x1C ulelong >0x21 13104>>>>>>>0 regex [[:print:]]* NEC PC-88 disk image, name=%s 13105>>>>>>>>0x1B ubyte 0 \b, media=2D 13106>>>>>>>>0x1B ubyte 0x10 \b, media=2DD 13107>>>>>>>>0x1B ubyte 0x20 \b, media=2HD 13108>>>>>>>>0x1B ubyte 0x30 \b, media=1D 13109>>>>>>>>0x1B ubyte 0x40 \b, media=1DD 13110>>>>>>>>0x1A ubyte 0x10 \b, write-protected 13111 13112# HDD Raw Copy Tool disk image, file extension: .imgc 13113# From Benjamin Vanheuverzwijn <bvanheu@gmail.com> 131140 pstring HDD\ Raw\ Copy\ Tool %s 13115>0x100 pstring x %s 13116>0x200 pstring x - HD model: %s 13117#>0x300 pstring x unknown %s 13118>0x400 pstring x serial: %s 13119#>0x500 pstring x unknown: %s 13120!:ext imgc 13121 13122#------------------------------------------------------------------------------ 13123# $File: finger,v 1.3 2019/04/19 00:42:27 christos Exp $ 13124# fingerprint: file(1) magic for fingerprint data 13125# XPM bitmaps) 13126# 13127 13128# https://cgit.freedesktop.org/libfprint/libfprint/tree/libfprint/data.c 13129 131300 string FP1 libfprint fingerprint data V1 13131>3 beshort x \b, driver_id %x 13132>5 belong x \b, devtype %x 13133 131340 string FP2 libfprint fingerprint data V2 13135>3 beshort x \b, driver_id %x 13136>5 belong x \b, devtype %x 13137 13138#------------------------------------------------------------------------------ 13139# $File: flash,v 1.15 2019/04/19 00:42:27 christos Exp $ 13140# flash: file(1) magic for Macromedia Flash file format 13141# 13142# See 13143# 13144# https://www.macromedia.com/software/flash/open/ 13145# https://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/\ 13146# en/devnet/swf/pdf/swf-file-format-spec.pdf page 27 13147# 13148 131490 name swf-details 13150 13151>0 string F 13152>>8 byte&0xfd 0x08 Macromedia Flash data 13153!:mime application/x-shockwave-flash 13154>>>3 byte x \b, version %d 13155>>8 byte&0xfe 0x10 Macromedia Flash data 13156!:mime application/x-shockwave-flash 13157>>>3 byte x \b, version %d 13158>>8 byte 0x18 Macromedia Flash data 13159!:mime application/x-shockwave-flash 13160>>>3 byte x \b, version %d 13161>>8 beshort&0xff87 0x2000 Macromedia Flash data 13162!:mime application/x-shockwave-flash 13163>>>3 byte x \b, version %d 13164>>8 beshort&0xffe0 0x3000 Macromedia Flash data 13165!:mime application/x-shockwave-flash 13166>>>3 byte x \b, version %d 13167>>8 byte&0x7 0 13168>>>8 ubyte >0x2f 13169>>>>9 ubyte <0x20 Macromedia Flash data 13170!:mime application/x-shockwave-flash 13171>>>>>3 byte x \b, version %d 13172 13173>0 string C 13174>>8 byte 0x78 Macromedia Flash data (compressed) 13175!:mime application/x-shockwave-flash 13176>>>3 byte x \b, version %d 13177 13178>0 string Z 13179>>8 byte 0x5d Macromedia Flash data (lzma compressed) 13180!:mime application/x-shockwave-flash 13181>>>3 byte x \b, version %d 13182 13183 131841 string WS 13185>4 ulelong >14 13186>>3 ubyte !0 13187>>>0 use swf-details 13188 13189# From: Cal Peake <cp@absolutedigital.net> 131900 string FLV\x01 Macromedia Flash Video 13191!:mime video/x-flv 13192 13193# 13194# Yosu Gomez 131950 string AGD2\xbe\xb8\xbb\xcd\x00 Macromedia Freehand 7 Document 131960 string AGD3\xbe\xb8\xbb\xcc\x00 Macromedia Freehand 8 Document 13197# From Dave Wilson 131980 string AGD4\xbe\xb8\xbb\xcb\x00 Macromedia Freehand 9 Document 13199 13200#------------------------------------------------------------------------------ 13201# $File: flif,v 1.1 2015/11/23 22:04:36 christos Exp $ 13202# flif: Magic data for file(1) command. 13203# FLIF (Free Lossless Image Format) 13204 132050 string FLIF FLIF 13206>4 string <H image data 13207>>6 beshort x \b, %u 13208>>8 beshort x \bx%u 13209>>5 string 1 \b, 8-bit/color, 13210>>5 string 2 \b, 16-bit/color, 13211>>4 string 1 \b, grayscale, non-interlaced 13212>>4 string 3 \b, RGB, non-interlaced 13213>>4 string 4 \b, RGBA, non-interlaced 13214>>4 string A \b, grayscale 13215>>4 string C \b, RGB, interlaced 13216>>4 string D \b, RGBA, interlaced 13217>4 string >H \b, animation data 13218>>5 ubyte <255 \b, %i frames 13219>>>7 beshort x \b, %u 13220>>>9 beshort x \bx%u 13221>>>6 string =1 \b, 8-bit/color 13222>>>6 string =2 \b, 16-bit/color 13223>>5 ubyte 0xFF 13224>>>6 beshort x \b, %i frames, 13225>>>9 beshort x \b, %u 13226>>>11 beshort x \bx%u 13227>>>8 string =1 \b, 8-bit/color 13228>>>8 string =2 \b, 16-bit/color 13229>>4 string =Q \b, grayscale, non-interlaced 13230>>4 string =S \b, RGB, non-interlaced 13231>>4 string =T \b, RGBA, non-interlaced 13232>>4 string =a \b, grayscale 13233>>4 string =c \b, RGB, interlaced 13234>>4 string =d \b, RGBA, interlaced 13235 13236#------------------------------------------------------------------------------ 13237# $File: fonts,v 1.43 2019/07/16 11:11:31 christos Exp $ 13238# fonts: file(1) magic for font data 13239# 132400 search/1 FONT ASCII vfont text 132410 short 0436 Berkeley vfont data 132420 short 017001 byte-swapped Berkeley vfont data 13243 13244# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com 132450 string %!PS-AdobeFont-1. PostScript Type 1 font text 13246>20 string >\0 (%s) 132476 string %!PS-AdobeFont-1. PostScript Type 1 font program data 132480 string %!FontType1 PostScript Type 1 font program data 132496 string %!FontType1 PostScript Type 1 font program data 132500 string %!PS-Adobe-3.0\ Resource-Font PostScript Type 1 font text 13251 13252# Summary: PostScript Type 1 Printer Font Metrics 13253# URL: https://en.wikipedia.org/wiki/PostScript_fonts 13254# Reference: https://partners.adobe.com/public/developer/en/font/5178.PFM.pdf 13255# Modified by: Joerg Jenderek 13256# Note: moved from ./msdos magic 13257# dfVersion 256=0100h 132580 uleshort 0x0100 13259# GRR: line above is too general as it catches also TrueType font, 13260# raw G3 data FAX, WhatsApp encrypted and Panorama database 13261# dfType 129=0081h 13262>66 uleshort 0x0081 13263# dfVertRes 300=012Ch not needed as additional test 13264#>>70 uleshort 0x012c 13265# dfHorizRes 300=012Ch 13266#>>>72 uleshort 0x012c 13267# dfDriverInfo points to postscript information section 13268>>(101.l) string/c Postscript Printer Font Metrics 13269# above labeled "PFM data" by ./msdos (version 5.28) or "Adobe Printer Font Metrics" by TrID 13270!:mime application/x-font-pfm 13271# AppleShare Print Server 13272#!:apple ASPS???? 13273!:ext pfm 13274# dfCopyright 60 byte null padded Copyright string. uncomment it to get old looking 13275#>>>6 string >\060 - %-.60s 13276# dfDriverInfo 13277>>>139 ulelong >0 13278# often abbreviated and same as filename 13279>>>>(139.l) string x %s 13280# dfSize 13281>>>2 ulelong x \b, %d bytes 13282# dfFace 210=D2h 9Eh 13283>>>105 ulelong >0 13284# Windows font name 13285>>>>(105.l) string x \b, %s 13286# dfItalic 13287>>>80 ubyte 1 italic 13288# dfUnderline 13289>>>81 ubyte 1 underline 13290# dfStrikeOut 13291>>>82 ubyte 1 strikeout 13292# dfWeight 400=0x0190 300=0x012c 500=0x01f4 600=0x0258 700=0x02bc 13293>>>83 uleshort >699 bold 13294# dfPitchAndFamily 16 17 48 49 64 65 13295>>>90 ubyte 16 serif 13296>>>90 ubyte 17 serif proportional 13297#>>>90 ubyte 48 other 13298>>>90 ubyte 49 proportional 13299>>>90 ubyte 64 script 13300>>>90 ubyte 65 script proportional 13301 13302# X11 font files in SNF (Server Natural Format) format 13303# updated by Joerg Jenderek at Feb 2013 13304# http://computer-programming-forum.com/51-perl/8f22fb96d2e34bab.htm 133050 belong 00000004 X11 SNF font data, MSB first 13306#>104 belong 00000004 X11 SNF font data, MSB first 13307!:mime application/x-font-sfn 13308# GRR: line below too general as it catches also Xbase index file t3-CHAR.NDX 133090 lelong 00000004 13310>104 lelong 00000004 X11 SNF font data, LSB first 13311!:mime application/x-font-sfn 13312 13313# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com) 133140 search/1 STARTFONT\ X11 BDF font text 13315 13316# From: Joerg Jenderek 13317# URL: https://grub.gibibit.com/New_font_format 13318# Reference: util/grub-mkfont.c 13319# include/grub/fontformat.h 13320# FONT_FORMAT_SECTION_NAMES_FILE 133210 string FILE 13322# FONT_FORMAT_PFF2_MAGIC 13323>8 string PFF2 13324# leng 4 only at the moment 13325>>4 ubelong 4 13326# FONT_FORMAT_SECTION_NAMES_FONT_NAME 13327>>>12 string NAME GRUB2 font 13328!:mime application/x-font-pf2 13329!:ext pf2 13330# length of font_name 13331>>>>16 ubelong >0 13332# font_name 13333>>>>>20 string >\0 "%-s" 13334 13335# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com) 13336# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides) 133370 string \001fcp X11 Portable Compiled Font data, 13338>12 lelong ^0x08 bit: LSB, 13339>12 lelong &0x08 bit: MSB, 13340>12 lelong ^0x04 byte: LSB first 13341>12 lelong &0x04 byte: MSB first 133420 string D1.0\015 X11 Speedo font data 13343 13344#------------------------------------------------------------------------------ 13345# FIGlet fonts and controlfiles 13346# From figmagic supplied with Figlet version 2.2 13347# "David E. O'Brien" <obrien@FreeBSD.ORG> 133480 string flf FIGlet font 13349>3 string >2a version %-2.2s 133500 string flc FIGlet controlfile 13351>3 string >2a version %-2.2s 13352 13353# libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu) 13354# Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++ 133550 belong 0x14025919 libGrx font data, 13356>8 leshort x %dx 13357>10 leshort x \b%d 13358>40 string x %s 13359# Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu) 133600 belong 0xff464f4e DOS code page font data collection 133617 belong 0x00454741 DOS code page font data 133627 belong 0x00564944 DOS code page font data (from Linux?) 133634098 string DOSFONT DOSFONT2 encrypted font data 13364 13365# From: Joerg Jenderek 13366# URL: http://fileformats.archiveteam.org/wiki/GEM_bitmap_font 13367# Reference: http://cd.textfiles.com/ataricompendium/BOOK/HTML/APPENDC.HTM#cnt 13368# 13369# usual case with lightening mask and skewing mask 5555h~UU 13370#62 ulelong 0x55555555 13371# skip cl8m8ocofedso.testfile by looking for face size lower/equal 72 13372#>2 uleshort <73 13373#>>0 use gdos-font 13374# BOX18.GFT COWBOY30.GFT ROYALK30.GFT 13375#62 ulelong 0 13376# skip ISO 9660 CD-ROM ./filesystem by looking for low positive face size 13377#>2 uleshort >2 13378# skip DOS 2.0 backup id file ./msdos by looking for face size lower/equal 72 13379#>>2 uleshort <73 13380# skip MS oem.hlp, some Windows ICO ./msdos by looking for valid long name like WYE 13381#>>>4 ulelong >0x001F1f1F 13382# skip Microsoft WinWord 2.0 ./msdos by looking for positive offset to font data 13383#>>>>76 ulelong >83 13384#>>>>>0 use gdos-font 133850 name gdos-font 13386>0 uleshort x GEM GDOS font 13387!:mime application/x-font-gdos 13388# also .eps found like AA070GEP.EPS AI360GEP.EPS 13389!:ext fnt/gtf 13390# font name like Big&Tall, Celtic #s, Courier, University Bold, WYE 13391>4 string x %.32s 13392# face size in points 3-72 SLSS03CG.FNT H1CELT72.FNT 13393>2 uleshort x %u 13394# face ID (must be unique) 13395>0 uleshort x \b, ID 0x%4.4x 13396# lowest character index in face (4 but usually 32 for disk-loaded fonts) 13397#>36 uleshort !32 \b, unusual character index %u 13398# width of the widest character like 0 8 10 12 16 24 32 13399#>50 uleshort x \b, %u char width 13400# width of the widest character cell like 8 11 12 14 15 16 33 67 13401#>52 uleshort x \b, %u cell width 13402# thickening size in pixel like 0 1 2 3 4 5 6 7 8 13403#>58 uleshort x \b, %u thick 13404# lightening mask to eliminate pixels, usually 5555h 13405>62 uleshort !0x5555 \b, lightening mask 0x%x 13406# skewing mask to determine when to perform additional rotation when skewing, usually 5555h 13407>64 uleshort !0x5555 \b, skewing mask 0x%x 13408# offset to optional horizontal offset table 0 58h~88 5eh 252h 13409#>68 ulelong x \b, 0x%x horizontal table offset 13410# offset of character offset table 54h for many *.GFT 55h 58h 5Eh 120h 1D4h 202h 220h 13411#>72 ulelong x \b, 0x%x coffset 13412# offset to font data like 116h 118h 158 20Ah 20Eh 13413>76 ulelong x \b, 0x%x foffset 13414# form width in bytes like 58 67 156 190 227 317 345 13415#>80 uleshort x \b, %u fwidth 13416# form height in bytes like 4 8 11 17 26 56 70 90 120 146 150 13417#>82 uleshort x \b, %u fheight 13418# pointer to the next font like 0 10000h 20000h 30000h 40000h 60000h 80000h E0000h D0000h 13419#>84 ulelong x \b, 0x%x noffset 13420 13421# downloadable fonts for browser (prints type) anthon@mnt.org 13422# https://tools.ietf.org/html/rfc3073 134230 string PFR1 Portable Font Resource font data (new) 13424>102 string >0 \b: %s 134250 string PFR0 Portable Font Resource font data (old) 13426>4 beshort >0 version %d 13427 13428# True Type fonts 13429# Modified by: Joerg Jenderek 13430# URL: https://en.wikipedia.org/wiki/TrueType 13431# Reference: https://developer.apple.com/fonts/TrueType-Reference-Manual/ 13432# 13433# sfnt version "typ1" used by some Apple, but no example found 134340 string typ1 13435>0 use sfnt-font 13436>0 use sfnt-names 13437# sfnt version "true" used by some Apple 134380 string true 13439>0 use sfnt-font 13440>0 use sfnt-names 13441# GRR: below test is too general 13442# sfnt version often 0x00010000 134430 string \000\001\000\000 13444>0 use sfnt-font 13445>0 use sfnt-names 13446# validate and display sfnt font data like number of tables 134470 name sfnt-font 13448# file 5.30 version assumes 00FFh as maximal number of tables 13449#>4 ubeshort <0x0100 13450# maximal 27 tables found like in Skia.ttf 13451# 46 different table names mentioned on Apple specification 13452# skip 1st sequence of DOS 2 backup with path separator (\~92 or /~47) misinterpreted as table number 13453>4 ubeshort <47 13454# skip bad examples with garbage table names like in a5.show HYPERC MAC 13455# tag names consist of up to four characters padded with spaces at end like 13456# BASE DSIG OS/2 Zapf acnt glyf cvt vmtx xref ... 13457>>12 regex/4l \^[A-Za-z][A-Za-z][A-Za-z/][A-Za-z2\ ] 13458#>>>0 ubelong x \b, sfnt version 0x%x 13459>>>0 ubelong !0x4f54544f TrueType 13460!:mime font/sfnt 13461!:apple ????tfil 13462# .ttf for TrueType font 13463# EUDC.tte created by privat character editor %WINDIR%\system32\eudcedit.exe 13464!:ext ttf/tte 13465# sfnt version 4F54544Fh~OTTO 13466>>>0 ubelong =0x4f54544f OpenType 13467!:mime font/otf 13468!:apple ????OTTO 13469!:ext otf 13470>>>0 ubelong x Font data 13471# DSIG=44454947h table name implies a digitally signed font 13472# search range = number of tables * 16 =< maximal number of tables * 16 = 27 * 16 = 432 13473>>>12 search/432 DSIG \b, digitally signed 13474>>>4 ubeshort x \b, %d tables 13475# minimal 9 tables found like in NISC18030.ttf 13476#>>>4 ubeshort <10 TMIN 13477#>>>4 ubeshort >24 TBIG 13478# table directory entries 13479>>>12 string x \b, 1st "%4.4s" 13480 13481# search and display 1st name in sfnt font which is often copyright text 13482# does not work inside font collections 134830 name sfnt-names 13484# search for naming table 13485>12 search/432/s name 13486# biggest offset 0x0100bd28 like Windows10 Fonts\simsunb.ttf 13487#>>>>&8 ubelong >0x0100bd27 BIGGEST OFFSET 13488>>&8 ubelong >0x00100000 13489# offset of name table 13490>>>&-4 ubelong x \b, name offset 0x%x 13491# GRR: pointer to name table only works if offset ~< FILE_BYTES_MAX = 100000h defined in src\file.h 13492>>&8 ubelong <0x00100000 13493>>>&-16 ubelong x 13494# name table 13495>>>>(&8.L) ubequad x 13496# invalid format selector 13497#>>>>>&-8 ubeshort !0 \b, invalid selector %x 13498# minimal 3 name records found like in c:\Program Files (x86)\Tesseract-OCR\tessdata\pdf.ttf 13499# maximal 1227 name records found like in Apple Chancery.ttf 13500#>>>>>&-6 ubeshort <0x4 mincount 13501#>>>>>&-6 ubeshort >130 maxcount 13502>>>>>&-6 ubeshort x \b, %d names 13503# offset to start of string storage from start of table 13504#>>>>>&-4 ubeshort x \b, record offset %d 13505# 1st name record 13506# string offset from start of storage area 13507#>>>>>&8 ubeshort x \b, string offset %d 13508# string length 13509#>>>>>&6 ubeshort x \b, string length %d 13510# minimal name string 7 like in c:\Program Files (x86)\Kodi\addons\webinterface.default\lib\video-js\font\VideoJS.ttf 13511# also found 0 like in SWZCONLN.TTF 13512#>>>>>&6 ubeshort <8 MIN STRING 13513# maximal name string 806 like in c:\Windows\Fonts\palabi.ttf 13514#>>>>>&6 ubeshort >805 MAX STRING 13515# platform identifier: 0~Apple Unicode, 1~Macintosh, 3~Microsoft 13516#>>>>>&-2 ubeshort >3 BAD PLATFORM 13517>>>>>&-2 ubeshort 0 \b, Unicode 13518>>>>>&-2 ubeshort 1 \b, Macintosh 13519>>>>>&-2 ubeshort 3 \b, Microsoft 13520# languageID (0~english Macintosh, 0409h~english Microsoft, ...) 13521>>>>>&2 ubeshort >0 \b, language 0x%x 13522# name identifiers 13523# often 0~copyright, 1~font, 2~font subfamily, 5~version, 13~license, 19~sample, ... 13524>>>>>&4 ubeshort >0 \b, type %d string 13525# platform specific encoding: 13526# 0~undefined character set, 1~UGL set with Unicode, 3~Unicode 2.0 BMP only, 4~Unicode 2.0 13527#>>>>>&0 ubeshort x \b, %d encoding 13528>>>>>&0 ubeshort 0 13529# handle only name string offset 0 because do not know how to add 2 relative offsets 13530>>>>>>&6 ubeshort 0 13531>>>>>>>&(&-14.S-18) ubyte !0 13532# GRR: instead 806 only first MAXstring = 96 characters are displayed as defined in src\file.h 13533# often copyright string that starts like \251 2006 The Monotype Corporation 13534>>>>>>>>&-1 string x \b, %-11.96s 13535# test for unicode string 13536>>>>>>>&(&-14.S-18) ubyte 0 13537>>>>>>>>&0 lestring16 x \b, %-11.96s 13538# unicode encoding 13539>>>>>&0 ubeshort >0 13540>>>>>>&6 ubeshort 0 13541>>>>>>>&(&-14.S-17) lestring16 x \b, %-11.96s 13542 135430 string \007\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font 135440 string \012\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font 13545 13546# TrueType/OpenType font collections (.ttc) 13547# URL: https://en.wikipedia.org/wiki/OpenType 13548# https://www.microsoft.com/typography/otspec/otff.htm 13549# Modified by: Joerg Jenderek 13550# Note: container for TrueType, OpenType font 135510 string ttcf 13552# skip ASCII text 13553>4 ubyte 0 13554# sfnt version often 0x00010000 of 1st table is TrueType 13555>>(12.L) ubelong !0x4f54544f TrueType 13556!:mime font/ttf 13557!:apple ????tfil 13558!:ext ttc 13559# sfnt version 4F54544Fh~OTTO of 1st table is OpenType font 13560>>(12.L) ubelong =0x4f54544f OpenType 13561!:mime font/otf 13562!:apple ????OTTO 13563# no example found for otc 13564!:ext ttc/otc 13565>>4 ubyte x font collection data 13566#!:mime font/collection 13567# TCC version 13568>>4 belong 0x00010000 \b, 1.0 13569>>4 belong 0x00020000 \b, 2.0 13570>>8 ubelong >0 \b, %d fonts 13571# array offset size = fonts * offsetsize = fonts * 4 13572>>(8.L*4) ubequad x 13573# 0x44454947 = 'DSIG' 13574>>>&4 belong 0x44534947 \b, digitally signed 13575# offset to 1st font 13576>>12 ubelong x \b, at 0x%x 13577# point to 1st font that starts with sfnt version 13578>>(12.L) use sfnt-font 13579 13580# Opentype font data from Avi Bercovich 135810 string OTTO OpenType font data 13582!:mime application/vnd.ms-opentype 13583 13584# From: Alex Myczko <alex@aiei.ch> 135850 string SplineFontDB: Spline Font Database 13586!:mime application/vnd.font-fontforge-sfd 13587>14 string x version %s 13588 13589# EOT 135900x40 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 13591>0x22 string LP Embedded OpenType (EOT) 13592# workaround until there's lepstring16 13593# >>0x52 lepstring16/h >\0 \b, %s family 13594>>0x52 short !0 13595>>>0x54 lestring16 x \b, %s family 13596!:mime application/vnd.ms-fontobject 13597 13598# Web Open Font Format (.woff) 135990 name woff 13600>4 belong 0x00010000 \b, TrueType 13601>4 belong 0x4F54544F \b, CFF 13602>4 belong 0x74727565 \b, TrueType 13603>4 default x 13604>>4 belong x \b, flavor %d 13605>8 belong x \b, length %d 13606#>12 beshort x \b, numTables %d 13607#>14 beshort x \b, reserved %d 13608#>16 belong x \b, totalSfntSize %d 13609 13610# https://www.w3.org/TR/WOFF/ 136110 string wOFF Web Open Font Format 13612>0 use woff 13613>20 beshort x \b, version %d 13614>22 beshort x \b.%d 13615# https://www.w3.org/TR/WOFF2/ 136160 string wOF2 Web Open Font Format (Version 2) 13617>0 use woff 13618#>20 belong x \b, totalCompressedSize %d 13619>24 beshort x \b, version %d 13620>26 beshort x \b.%d 13621 13622#------------------------------------------------------------------------------ 13623# $File: forth,v 1.1 2019/06/06 19:14:20 christos Exp $ 13624# forth: file(1) magic for various Forth environments 13625# From: Lubomir Rintel <lkundrak@v3.sk> 13626# 13627 13628# Has a FORTH stack diagram and something that looks very much like a FORTH 13629# multi-line word definition. Probably a FORTH source. 136300 regex \[[:space:]]\\(([[:space:]].*)?\ --\ (.*[[:space:]])?\\) 13631>0 regex \^:\[[:space:]] 13632>>0 regex \^;$ FORTH program 13633!:mime text/x-forth 13634 13635# Inline word definition complete with a stack diagram 136360 regex \^:[[:space:]].*[[:space:]]\\(([[:space:]].*)?\ --\ (.*[[:space:]])?\\)[[:space:]].*[[:space:]];$ FORTH program 13637!:mime text/x-forth 13638 13639# Various dictionary images used by OpenFirware FORTH environent 13640 136410 lelong 0xe1a00000 13642>8 lelong 0xe1a00000 ARM OpenFirmware FORTH Dictionary, 13643>>24 lelong x Text length: %d bytes, 13644>>28 lelong x Data length: %d bytes, 13645>>32 lelong x Text Relocation Table length: %d bytes, 13646>>36 lelong x Data Relocation Table length: %d bytes, 13647>>40 lelong x Entry Point: 0x%08X, 13648>>44 lelong x BSS length: %d bytes 13649 136500 string MP 13651>28 lelong 1 x86 OpenFirmware FORTH Dictionary, 13652>>4 leshort x %d blocks 13653>>2 leshort x + %d bytes, 13654>>6 leshort x %d relocations, 13655>>8 leshort x Header length: %d paragraphs, 13656>>10 leshort x Data Size: %d 13657>>12 leshort x - %d 4K pages, 13658>>14 lelong x Initial Stack Pointer: 0x%08X, 13659>>20 lelong x Entry Point: 0x%08X, 13660>>24 lelong x First Relocation Item: %d, 13661>>26 lelong x Overlay Number: %d, 13662>>18 leshort x Checksum: 0x%08X 13663 136640 belong 0x48000020 PowerPC OpenFirmware FORTH Dictionary, 13665>4 belong x Text length: %d bytes, 13666>8 belong x Data length: %d bytes, 13667>12 belong x BSS length: %d bytes, 13668>16 belong x Symbol Table length: %d bytes, 13669>20 belong x Entry Point: 0x%08X, 13670>24 belong x Text Relocation Table length: %d bytes, 13671>28 belong x Data Relocation Table length: %d bytes 13672 136730 lelong 0x10000007 MIPS OpenFirmware FORTH Dictionary, 13674>4 lelong x Text length: %d bytes, 13675>8 lelong x Data length: %d bytes, 13676>12 lelong x BSS length: %d bytes, 13677>16 lelong x Symbol Table length: %d bytes, 13678>20 lelong x Entry Point: 0x%08X, 13679>24 lelong x Text Relocation Table length: %d bytes, 13680>28 lelong x Data Relocation Table length: %d bytes 13681 13682# Dictionary images used by minimal C FORTH environments, any platform, 13683# using native byte order. 13684 13685# Weak. 13686#0 short 0x5820 cForth 16-bit Dictionary, 13687#>2 short x Serial: 0x%08X, 13688#>4 short x Dictionary Start: 0x%08X, 13689#>6 short x Dictionary Size: %d bytes, 13690#>8 short x User Area Start: 0x%08X, 13691#>10 short x User Area Size: %d bytes, 13692#>12 short x Entry Point: 0x%08X 13693 136940 long 0x581120 cForth 32-bit Dictionary, 13695>4 long x Serial: 0x%08X, 13696>8 long x Dictionary Start: 0x%08X, 13697>12 long x Dictionary Size: %d bytes, 13698>16 long x User Area Start: 0x%08X, 13699>20 long x User Area Size: %d bytes, 13700>24 long x Entry Point: 0x%08X 13701 13702#------------------------------------------------------------------------------ 13703# $File: fortran,v 1.10 2015/11/05 18:47:16 christos Exp $ 13704# FORTRAN source 13705# Check that the first 100 lines start with C or whitespace first. 137060 regex/100l !\^[^Cc\ \t].*$ 13707>0 regex/100l \^[Cc][\ \t] FORTRAN program text 13708!:mime text/x-fortran 13709!:strength - 5 13710 13711#------------------------------------------------------------------------------ 13712# $File: frame,v 1.14 2019/11/25 00:31:30 christos Exp $ 13713# frame: file(1) magic for FrameMaker files 13714# 13715# This stuff came on a FrameMaker demo tape, most of which is 13716# copyright, but this file is "published" as witness the following: 13717# 13718# Note that this is the Framemaker Maker Interchange Format, not the 13719# Normal format which would be application/vnd.framemaker. 13720# 137210 string \<MakerFile FrameMaker document 13722!:mime application/x-mif 13723>11 string 5.5 (5.5 13724>11 string 5.0 (5.0 13725>11 string 4.0 (4.0 13726>11 string 3.0 (3.0 13727>11 string 2.0 (2.0 13728>11 string 1.0 (1.0 13729>14 byte x %c) 13730# URL: http://fileformats.archiveteam.org/wiki/Maker_Interchange_Format 13731# Reference: https://help.adobe.com/en_US/framemaker/mifreference/mifref.pdf 13732# Update: Joerg Jenderek 2019 Nov 137330 string \<MIFFile FrameMaker MIF (ASCII) file 13734# https://www.iana.org/assignments/media-types/application/vnd.mif 13735!:mime application/vnd.mif 13736# mif most but also find bookTOC.framemif 13737!:ext mif/framemif 13738# followed by space~20h 13739#>8 ubyte 0x20 \b, space before version 13740# 3 characters of version number of the MIF language like 1.0, 2.0 ... 2015 ... 13741>9 string x (%.3s 13742# if not greater sign then display 4th character of version 13743>12 ubyte =0x3e \b) 13744>12 ubyte !0x3e \b%c) 13745# comment starting with # shows the name+version number of generating program 13746>13 search/3 # 13747>>&0 string x "%s" 137480 search/1 \<MakerDictionary FrameMaker Dictionary text 13749!:mime application/x-mif 13750>17 string 3.0 (3.0) 13751>17 string 2.0 (2.0) 13752>17 string 1.0 (1.x) 137530 string \<MakerScreenFont FrameMaker Font file 13754!:mime application/x-mif 13755>17 string 1.01 (%s) 137560 string \<MML FrameMaker MML file 13757!:mime application/x-mif 137580 string \<BookFile FrameMaker Book file 13759!:mime application/x-mif 13760>10 string 3.0 (3.0 13761>10 string 2.0 (2.0 13762>10 string 1.0 (1.0 13763>13 byte x %c) 13764# XXX - this book entry should be verified, if you find one, uncomment this 13765#0 string \<Book\040 FrameMaker Book (ASCII) file 13766#!:mime application/x-mif 13767#>6 string 3.0 (3.0) 13768#>6 string 2.0 (2.0) 13769#>6 string 1.0 (1.0) 137700 string \<Maker\040Intermediate\040Print\040File FrameMaker IPL file 13771!:mime application/x-mif 13772 13773#------------------------------------------------------------------------------ 13774# $File: freebsd,v 1.7 2009/09/19 16:28:09 christos Exp $ 13775# freebsd: file(1) magic for FreeBSD objects 13776# 13777# All new-style FreeBSD magic numbers are in host byte order (i.e., 13778# little-endian on x86). 13779# 13780# XXX - this comes from the file "freebsd" in a recent FreeBSD version of 13781# "file"; it, and the NetBSD stuff in "netbsd", appear to use different 13782# schemes for distinguishing between executable images, shared libraries, 13783# and object files. 13784# 13785# FreeBSD says: 13786# 13787# Regardless of whether it's pure, demand-paged, or none of the 13788# above: 13789# 13790# if the entry point is < 4096, then it's a shared library if 13791# the "has run-time loader information" bit is set, and is 13792# position-independent if the "is position-independent" bit 13793# is set; 13794# 13795# if the entry point is >= 4096 (or >4095, same thing), then it's 13796# an executable, and is dynamically-linked if the "has run-time 13797# loader information" bit is set. 13798# 13799# On x86, NetBSD says: 13800# 13801# If it's neither pure nor demand-paged: 13802# 13803# if it has the "has run-time loader information" bit set, it's 13804# a dynamically-linked executable; 13805# 13806# if it doesn't have that bit set, then: 13807# 13808# if it has the "is position-independent" bit set, it's 13809# position-independent; 13810# 13811# if the entry point is non-zero, it's an executable, otherwise 13812# it's an object file. 13813# 13814# If it's pure: 13815# 13816# if it has the "has run-time loader information" bit set, it's 13817# a dynamically-linked executable, otherwise it's just an 13818# executable. 13819# 13820# If it's demand-paged: 13821# 13822# if it has the "has run-time loader information" bit set, 13823# then: 13824# 13825# if the entry point is < 4096, it's a shared library; 13826# 13827# if the entry point is = 4096 or > 4096 (i.e., >= 4096), 13828# it's a dynamically-linked executable); 13829# 13830# if it doesn't have the "has run-time loader information" bit 13831# set, then it's just an executable. 13832# 13833# (On non-x86, NetBSD does much the same thing, except that it uses 13834# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K 13835# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's 13836# had 8K pages; dunno about MIPS.) 13837# 13838# I suspect the two will differ only in perverse and uninteresting cases 13839# ("shared" libraries that aren't demand-paged and whose pages probably 13840# won't actually be shared, executables with entry points <4096). 13841# 13842# I leave it to those more familiar with FreeBSD and NetBSD to figure out 13843# what the right answer is (although using ">4095", FreeBSD-style, is 13844# probably better than separately checking for "=4096" and ">4096", 13845# NetBSD-style). (The old "netbsd" file analyzed FreeBSD demand paged 13846# executables using the NetBSD technique.) 13847# 138480 lelong&0377777777 041400407 FreeBSD/i386 13849>20 lelong <4096 13850>>3 byte&0xC0 &0x80 shared library 13851>>3 byte&0xC0 0x40 PIC object 13852>>3 byte&0xC0 0x00 object 13853>20 lelong >4095 13854>>3 byte&0x80 0x80 dynamically linked executable 13855>>3 byte&0x80 0x00 executable 13856>16 lelong >0 not stripped 13857 138580 lelong&0377777777 041400410 FreeBSD/i386 pure 13859>20 lelong <4096 13860>>3 byte&0xC0 &0x80 shared library 13861>>3 byte&0xC0 0x40 PIC object 13862>>3 byte&0xC0 0x00 object 13863>20 lelong >4095 13864>>3 byte&0x80 0x80 dynamically linked executable 13865>>3 byte&0x80 0x00 executable 13866>16 lelong >0 not stripped 13867 138680 lelong&0377777777 041400413 FreeBSD/i386 demand paged 13869>20 lelong <4096 13870>>3 byte&0xC0 &0x80 shared library 13871>>3 byte&0xC0 0x40 PIC object 13872>>3 byte&0xC0 0x00 object 13873>20 lelong >4095 13874>>3 byte&0x80 0x80 dynamically linked executable 13875>>3 byte&0x80 0x00 executable 13876>16 lelong >0 not stripped 13877 138780 lelong&0377777777 041400314 FreeBSD/i386 compact demand paged 13879>20 lelong <4096 13880>>3 byte&0xC0 &0x80 shared library 13881>>3 byte&0xC0 0x40 PIC object 13882>>3 byte&0xC0 0x00 object 13883>20 lelong >4095 13884>>3 byte&0x80 0x80 dynamically linked executable 13885>>3 byte&0x80 0x00 executable 13886>16 lelong >0 not stripped 13887 13888# XXX gross hack to identify core files 13889# cores start with a struct tss; we take advantage of the following: 13890# byte 7: highest byte of the kernel stack pointer, always 0xfe 13891# 8/9: kernel (ring 0) ss value, always 0x0010 13892# 10 - 27: ring 1 and 2 ss/esp, unused, thus always 0 13893# 28: low order byte of the current PTD entry, always 0 since the 13894# PTD is page-aligned 13895# 138967 string \357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 FreeBSD/i386 a.out core file 13897>1039 string >\0 from '%s' 13898 13899# /var/run/ld.so.hints 13900# What are you laughing about? 139010 lelong 011421044151 ld.so hints file (Little Endian 13902>4 lelong >0 \b, version %d) 13903>4 belong <1 \b) 139040 belong 011421044151 ld.so hints file (Big Endian 13905>4 belong >0 \b, version %d) 13906>4 belong <1 \b) 13907 13908# 13909# Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities 13910# 139110 string SCRSHOT_ scrshot(1) screenshot, 13912>8 byte x version %d, 13913>9 byte 2 %d bytes in header, 13914>>10 byte x %d chars wide by 13915>>11 byte x %d chars high 13916 13917#------------------------------------------------------------------------------ 13918# $File: fsav,v 1.19 2019/04/19 00:42:27 christos Exp $ 13919# fsav: file(1) magic for datafellows fsav virus definition files 13920# Anthon van der Neut (anthon@mnt.org) 13921 13922# ftp://ftp.f-prot.com/pub/{macrdef2.zip,nomacro.def} 139230 beshort 0x1575 fsav macro virus signatures 13924>8 leshort >0 (%d- 13925>11 byte >0 \b%02d- 13926>10 byte >0 \b%02d) 13927# ftp://ftp.f-prot.com/pub/sign.zip 13928#10 ubyte <12 13929#>9 ubyte <32 13930#>>8 ubyte 0x0a 13931#>>>12 ubyte 0x07 13932#>>>>11 uleshort >0 fsav DOS/Windows virus signatures (%d- 13933#>>>>10 byte 0 \b01- 13934#>>>>10 byte 1 \b02- 13935#>>>>10 byte 2 \b03- 13936#>>>>10 byte 3 \b04- 13937#>>>>10 byte 4 \b05- 13938#>>>>10 byte 5 \b06- 13939#>>>>10 byte 6 \b07- 13940#>>>>10 byte 7 \b08- 13941#>>>>10 byte 8 \b09- 13942#>>>>10 byte 9 \b10- 13943#>>>>10 byte 10 \b11- 13944#>>>>10 byte 11 \b12- 13945#>>>>9 ubyte >0 \b%02d) 13946# ftp://ftp.f-prot.com/pub/sign2.zip 13947#0 ubyte 0x62 13948#>1 ubyte 0xF5 13949#>>2 ubyte 0x1 13950#>>>3 ubyte 0x1 13951#>>>>4 ubyte 0x0e 13952#>>>>>13 ubyte >0 fsav virus signatures 13953#>>>>>>11 ubyte x size 0x%02x 13954#>>>>>>12 ubyte x \b%02x 13955#>>>>>>13 ubyte x \b%02x bytes 13956 13957# Joerg Jenderek: joerg dot jenderek at web dot de 13958# clamav-0.100.2\docs\html\node60.html 13959# https://github.com/vrtadmin/clamav-faq/raw/master/manual/clamdoc.pdf 13960# ClamAV virus database files start with a 512 bytes colon separated header 13961# ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime 13962# + gzipped (optional) tarball files 13963# output can often be verified by `sigtool --info=FILE` 139640 string ClamAV-VDB: Clam AntiVirus 13965# padding spaces implies database 13966>511 ubyte =0x20 database 13967!:mime application/x-clamav-database 13968# empty build time 13969>>10 string =:: (unsigned) 13970# sigtool(1) man page 13971!:ext cud 13972# display some text to avoid error like: 13973# Magdir/fsav, 78: Warning: Current entry does not yet have a description for adding a EXTENSION type 13974# file: could not find any valid magic files! (No error) 13975>>10 default x (with buildtime) 13976#>>10 default x 13977# clamtmp is used for temporily database like update process 13978# for pure tar database only cld extension found 13979!:ext cld/cvd/clamtmp/cud 13980>511 default x file 13981!:mime application/x-clamav 13982!:ext info 13983>11 string >\0 13984# buildDate empty or like "22 Mar 2017 12-57 -0400"; verified by `sigtool -i FILE` 13985>>11 regex \^[^:]{0,23} \b, %s 13986# version like 25170 13987>>>&1 regex \^[^:]{1,6} \b, version %s 13988# signaturesNumbers like 4566249 13989>>>>&1 regex \^[^:]{1,10} \b, %s signatures 13990# functionalityLevelRequired like 60 13991>>>>>&1 regex \^[^:]{1,4} \b, level %s 13992# X for nothing or MD5 13993#>>>>>>&1 regex \^[^:]{1,32} \b, MD5 "%s" 13994>>>>>>&1 regex \^[^:]{1,32} 13995# X for nothing or digital signature starting like AIzk/LYbX 13996#>>>>>>>&1 regex \^[^:]{1,255} \b, signature "%s" 13997>>>>>>>&1 regex \^[^:]{1,255} 13998# builder like neo 13999>>>>>>>>&1 regex \^[^:]{1,32} \b, builder %s 14000# buildTime like 1506611558 14001#>>>>>>>>>&1 regex \^[^:]{1,10} \b, %s 14002>>>>>>>>>&1 regex \^[^:]{1,10} 14003# padding with spaces 14004#>>>>>>>>>>&1 ubequad x \b, padding 0x%16.16llx 14005>510 ubyte =0x20 14006# inspect real database content 14007#>>512 ubeshort x \b, database MAGIC 0x%x 14008# ./archive handle pure tar archives 14009>>1012 quad =0 \b, with 14010>>>512 use tar-file 14011# not pure tar 14012>>1012 quad !0 14013# one space at the end of text and then handles gziped archives by ./compress 14014>>>512 string \037\213 \b, with 14015>>>>512 indirect x 14016 14017# Type: Grisoft AVG AntiVirus 14018# From: David Newgas <david@newgas.net> 140190 string AVG7_ANTIVIRUS_VAULT_FILE AVG 7 Antivirus vault file data 14020 140210 string X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR 14022>33 string -STANDARD-ANTIVIRUS-TEST-FILE!$H+H* EICAR virus test files 14023 14024# From: Joerg Jenderek 14025# URL: https://www.avira.com/ 14026# Note: found in directory %ProgramData%\Avira\Antivirus\INFECTED (Windows) 14027# tested with version 15.0.43.23 at November 2019 140280 string AntiVir\ Qua Avira AntiVir quarantined 14029!:mime application/x-avira-qua 14030#!:mime application/octet-stream 14031!:ext qua 14032>156 string SUSPICIOUS_FILE 14033# file path of suspicious file 14034>>220 lestring16 x %s 14035>156 string !SUSPICIOUS_FILE 14036# file path of virus file 14037>>228 lestring16 x %s 14038# quarantined date 14039>60 ldate x at %s 14040# virus/danger name 14041>156 string !SUSPICIOUS_FILE 14042>>156 string x \b, category "%s" 14043 14044 14045#------------------------------------------------------------------------------ 14046# $File: fusecompress,v 1.2 2011/08/08 09:05:55 christos Exp $ 14047# fusecompress: file(1) magic for fusecompress 140480 string \037\135\211 FuseCompress(ed) data 14049>3 byte 0x00 (none format) 14050>3 byte 0x01 (bz2 format) 14051>3 byte 0x02 (gz format) 14052>3 byte 0x03 (lzo format) 14053>3 byte 0x04 (xor format) 14054>3 byte >0x04 (unknown format) 14055>4 long x uncompressed size: %d 14056 14057#------------------------------------------------------------------------------ 14058# $File: games,v 1.20 2020/02/01 16:32:33 christos Exp $ 14059# games: file(1) for games 14060 14061# Fabio Bonelli <fabiobonelli@libero.it> 14062# Quake II - III data files 140630 string IDP2 Quake II 3D Model file, 14064>20 long x %u skin(s), 14065>8 long x (%u x 14066>12 long x %u), 14067>40 long x %u frame(s), 14068>16 long x Frame size %u bytes, 14069>24 long x %u vertices/frame, 14070>28 long x %u texture coordinates, 14071>32 long x %u triangles/frame 14072 140730 string IBSP Quake 14074>4 long 0x26 II Map file (BSP) 14075>4 long 0x2E III Map file (BSP) 14076 140770 string IDS2 Quake II SP2 sprite file 14078 14079#--------------------------------------------------------------------------- 14080# Doom and Quake 14081# submitted by Nicolas Patrois 14082 140830 string \xcb\x1dBoom\xe6\xff\x03\x01 Boom or linuxdoom demo 14084# some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01 14085 1408624 string LxD\ 203 Linuxdoom save 14087>0 string x , name=%s 14088>44 string x , world=%s 14089 14090# Quake 14091 14092# Update: Joerg Jenderek 14093# URL: http://fileformats.archiveteam.org/wiki/PAK 14094# reference: https://quakewiki.org/wiki/.pak 14095# GRR: line below is too general as it matches also Acorn PackDir compressed Archive 14096# and Git pack ./revision 140970 string PACK 14098# real Quake examples like pak0.pak have only some hundreds like 150 files 14099# So test for few files 14100>8 ulelong <0x01000000 14101# in file version 5.32 test for null terminator is only true for 14102# offset ~< FILE_BYTES_MAX = 1 MB defined in ../../src/file.h 14103# look for null terminator of 1st entry name 14104>>(4.l+55) ubyte 0 Quake I or II world or extension 14105!:mime application/x-dzip 14106!:ext pak 14107#>>>8 ulelong x \b, table size %u 14108# dividing this by entry size (64) gives number of files 14109>>>8 ulelong/64 x \b, %u files 14110# offset to the beginning of the file table 14111>>>4 ulelong x \b, offset 0x%x 14112# 1st file entry 14113>>>(4.l) use pak-entry 14114# 2nd file entry 14115#>>>4 ulelong+64 x \b, offset 0x%x 14116#>>>(4.l+64) use pak-entry 14117# 14118# display file table entry of Quake PAK archive 141190 name pak-entry 14120# normally entry start after header which implies offset 12 or higher 14121>56 ulelong >11 14122# the offset from the beginning of pak to beginning of this entry file contents 14123>>56 ulelong x at 0x%x 14124# the size of file for this entry 14125>>60 ulelong x %u bytes 14126# 56 byte null-terminated entry name string includes path like maps/e1m1.bsp 14127>>0 string x '%-.56s' 14128# inspect entry content by jumping to entry offset 14129>>(56) indirect x \b: 14130 14131#0 string -1\x0a Quake I demo 14132#>30 string x version %.4s 14133#>61 string x level %s 14134 14135#0 string 5\x0a Quake I save 14136 14137# The levels 14138 14139# Quake 1 14140 141410 string 5\x0aIntroduction Quake I save: start Introduction 141420 string 5\x0athe_Slipgate_Complex Quake I save: e1m1 The slipgate complex 141430 string 5\x0aCastle_of_the_Damned Quake I save: e1m2 Castle of the damned 141440 string 5\x0athe_Necropolis Quake I save: e1m3 The necropolis 141450 string 5\x0athe_Grisly_Grotto Quake I save: e1m4 The grisly grotto 141460 string 5\x0aZiggurat_Vertigo Quake I save: e1m8 Ziggurat vertigo (secret) 141470 string 5\x0aGloom_Keep Quake I save: e1m5 Gloom keep 141480 string 5\x0aThe_Door_To_Chthon Quake I save: e1m6 The door to Chthon 141490 string 5\x0aThe_House_of_Chthon Quake I save: e1m7 The house of Chthon 141500 string 5\x0athe_Installation Quake I save: e2m1 The installation 141510 string 5\x0athe_Ogre_Citadel Quake I save: e2m2 The ogre citadel 141520 string 5\x0athe_Crypt_of_Decay Quake I save: e2m3 The crypt of decay (dopefish lives!) 141530 string 5\x0aUnderearth Quake I save: e2m7 Underearth (secret) 141540 string 5\x0athe_Ebon_Fortress Quake I save: e2m4 The ebon fortress 141550 string 5\x0athe_Wizard's_Manse Quake I save: e2m5 The wizard's manse 141560 string 5\x0athe_Dismal_Oubliette Quake I save: e2m6 The dismal oubliette 141570 string 5\x0aTermination_Central Quake I save: e3m1 Termination central 141580 string 5\x0aVaults_of_Zin Quake I save: e3m2 Vaults of Zin 141590 string 5\x0athe_Tomb_of_Terror Quake I save: e3m3 The tomb of terror 141600 string 5\x0aSatan's_Dark_Delight Quake I save: e3m4 Satan's dark delight 141610 string 5\x0athe_Haunted_Halls Quake I save: e3m7 The haunted halls (secret) 141620 string 5\x0aWind_Tunnels Quake I save: e3m5 Wind tunnels 141630 string 5\x0aChambers_of_Torment Quake I save: e3m6 Chambers of torment 141640 string 5\x0athe_Sewage_System Quake I save: e4m1 The sewage system 141650 string 5\x0aThe_Tower_of_Despair Quake I save: e4m2 The tower of despair 141660 string 5\x0aThe_Elder_God_Shrine Quake I save: e4m3 The elder god shrine 141670 string 5\x0athe_Palace_of_Hate Quake I save: e4m4 The palace of hate 141680 string 5\x0aHell's_Atrium Quake I save: e4m5 Hell's atrium 141690 string 5\x0athe_Nameless_City Quake I save: e4m8 The nameless city (secret) 141700 string 5\x0aThe_Pain_Maze Quake I save: e4m6 The pain maze 141710 string 5\x0aAzure_Agony Quake I save: e4m7 Azure agony 141720 string 5\x0aShub-Niggurath's_Pit Quake I save: end Shub-Niggurath's pit 14173 14174# Quake DeathMatch levels 14175 141760 string 5\x0aPlace_of_Two_Deaths Quake I save: dm1 Place of two deaths 141770 string 5\x0aClaustrophobopolis Quake I save: dm2 Claustrophobopolis 141780 string 5\x0aThe_Abandoned_Base Quake I save: dm3 The abandoned base 141790 string 5\x0aThe_Bad_Place Quake I save: dm4 The bad place 141800 string 5\x0aThe_Cistern Quake I save: dm5 The cistern 141810 string 5\x0aThe_Dark_Zone Quake I save: dm6 The dark zone 14182 14183# Scourge of Armagon 14184 141850 string 5\x0aCommand_HQ Quake I save: start Command HQ 141860 string 5\x0aThe_Pumping_Station Quake I save: hip1m1 The pumping station 141870 string 5\x0aStorage_Facility Quake I save: hip1m2 Storage facility 141880 string 5\x0aMilitary_Complex Quake I save: hip1m5 Military complex (secret) 141890 string 5\x0athe_Lost_Mine Quake I save: hip1m3 The lost mine 141900 string 5\x0aResearch_Facility Quake I save: hip1m4 Research facility 141910 string 5\x0aAncient_Realms Quake I save: hip2m1 Ancient realms 141920 string 5\x0aThe_Gremlin's_Domain Quake I save: hip2m6 The gremlin's domain (secret) 141930 string 5\x0aThe_Black_Cathedral Quake I save: hip2m2 The black cathedral 141940 string 5\x0aThe_Catacombs Quake I save: hip2m3 The catacombs 141950 string 5\x0athe_Crypt__ Quake I save: hip2m4 The crypt 141960 string 5\x0aMortum's_Keep Quake I save: hip2m5 Mortum's keep 141970 string 5\x0aTur_Torment Quake I save: hip3m1 Tur torment 141980 string 5\x0aPandemonium Quake I save: hip3m2 Pandemonium 141990 string 5\x0aLimbo Quake I save: hip3m3 Limbo 142000 string 5\x0athe_Edge_of_Oblivion Quake I save: hipdm1 The edge of oblivion (secret) 142010 string 5\x0aThe_Gauntlet Quake I save: hip3m4 The gauntlet 142020 string 5\x0aArmagon's_Lair Quake I save: hipend Armagon's lair 14203 14204# Malice 14205 142060 string 5\x0aThe_Academy Quake I save: start The academy 142070 string 5\x0aThe_Lab Quake I save: d1 The lab 142080 string 5\x0aArea_33 Quake I save: d1b Area 33 142090 string 5\x0aSECRET_MISSIONS Quake I save: d3b Secret missions 142100 string 5\x0aThe_Hospital Quake I save: d10 The hospital (secret) 142110 string 5\x0aThe_Genetics_Lab Quake I save: d11 The genetics lab (secret) 142120 string 5\x0aBACK_2_MALICE Quake I save: d4b Back to Malice 142130 string 5\x0aArea44 Quake I save: d1c Area 44 142140 string 5\x0aTakahiro_Towers Quake I save: d2 Takahiro towers 142150 string 5\x0aA_Rat's_Life Quake I save: d3 A rat's life 142160 string 5\x0aInto_The_Flood Quake I save: d4 Into the flood 142170 string 5\x0aThe_Flood Quake I save: d5 The flood 142180 string 5\x0aNuclear_Plant Quake I save: d6 Nuclear plant 142190 string 5\x0aThe_Incinerator_Plant Quake I save: d7 The incinerator plant 142200 string 5\x0aThe_Foundry Quake I save: d7b The foundry 142210 string 5\x0aThe_Underwater_Base Quake I save: d8 The underwater base 142220 string 5\x0aTakahiro_Base Quake I save: d9 Takahiro base 142230 string 5\x0aTakahiro_Laboratories Quake I save: d12 Takahiro laboratories 142240 string 5\x0aStayin'_Alive Quake I save: d13 Stayin' alive 142250 string 5\x0aB.O.S.S._HQ Quake I save: d14 B.O.S.S. HQ 142260 string 5\x0aSHOWDOWN! Quake I save: d15 Showdown! 14227 14228# Malice DeathMatch levels 14229 142300 string 5\x0aThe_Seventh_Precinct Quake I save: ddm1 The seventh precinct 142310 string 5\x0aSub_Station Quake I save: ddm2 Sub station 142320 string 5\x0aCrazy_Eights! Quake I save: ddm3 Crazy eights! 142330 string 5\x0aEast_Side_Invertationa Quake I save: ddm4 East side invertationa 142340 string 5\x0aSlaughterhouse Quake I save: ddm5 Slaughterhouse 142350 string 5\x0aDOMINO Quake I save: ddm6 Domino 142360 string 5\x0aSANDRA'S_LADDER Quake I save: ddm7 Sandra's ladder 14237 14238 142390 string MComprHD MAME CHD compressed hard disk image, 14240>12 belong x version %u 14241 14242# doom - submitted by Jon Dowland 14243 142440 string =IWAD doom main IWAD data 14245>4 lelong x containing %d lumps 142460 string =PWAD doom patch PWAD data 14247>4 lelong x containing %d lumps 14248 14249# Build engine group files (Duke Nukem, Shadow Warrior, ...) 14250# Extension: .grp 14251# Created by: "Ganael Laplanche" <ganael.laplanche@martymac.org> 142520 string KenSilverman Build engine group file 14253>12 lelong x containing %d files 14254 14255# Summary: Warcraft 3 save 14256# Extension: .w3g 14257# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com> 142580 string Warcraft\ III\ recorded\ game %s 14259 14260 14261# Summary: Warcraft 3 map 14262# Extension: .w3m 14263# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com> 142640 string HM3W Warcraft III map file 14265 14266 14267# Summary: SGF Smart Game Format 14268# Extension: .sgf 14269# Reference: https://www.red-bean.com/sgf/ 14270# Created by: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar> 14271# Modified by (1): Abel Cheung (regex, more game format) 14272# FIXME: Some games don't have GM (game type) 142730 regex \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format 14274>2 search/0x200/b GM[ 14275>>&0 string 1] (Go) 14276>>&0 string 2] (Othello) 14277>>&0 string 3] (chess) 14278>>&0 string 4] (Gomoku+Renju) 14279>>&0 string 5] (Nine Men's Morris) 14280>>&0 string 6] (Backgammon) 14281>>&0 string 7] (Chinese chess) 14282>>&0 string 8] (Shogi) 14283>>&0 string 9] (Lines of Action) 14284>>&0 string 10] (Ataxx) 14285>>&0 string 11] (Hex) 14286>>&0 string 12] (Jungle) 14287>>&0 string 13] (Neutron) 14288>>&0 string 14] (Philosopher's Football) 14289>>&0 string 15] (Quadrature) 14290>>&0 string 16] (Trax) 14291>>&0 string 17] (Tantrix) 14292>>&0 string 18] (Amazons) 14293>>&0 string 19] (Octi) 14294>>&0 string 20] (Gess) 14295>>&0 string 21] (Twixt) 14296>>&0 string 22] (Zertz) 14297>>&0 string 23] (Plateau) 14298>>&0 string 24] (Yinsh) 14299>>&0 string 25] (Punct) 14300>>&0 string 26] (Gobblet) 14301>>&0 string 27] (hive) 14302>>&0 string 28] (Exxit) 14303>>&0 string 29] (Hnefatal) 14304>>&0 string 30] (Kuba) 14305>>&0 string 31] (Tripples) 14306>>&0 string 32] (Chase) 14307>>&0 string 33] (Tumbling Down) 14308>>&0 string 34] (Sahara) 14309>>&0 string 35] (Byte) 14310>>&0 string 36] (Focus) 14311>>&0 string 37] (Dvonn) 14312>>&0 string 38] (Tamsk) 14313>>&0 string 39] (Gipf) 14314>>&0 string 40] (Kropki) 14315 14316############################################## 14317# NetImmerse/Gamebryo game engine entries 14318 14319# Summary: Gamebryo game engine file 14320# Extension: .nif, .kf 14321# Created by: Abel Cheung <abelcheung@gmail.com> 143220 string Gamebryo\ File\ Format,\ Version\ Gamebryo game engine file 14323>&0 regex [0-9a-z.]+ \b, version %s 14324 14325# Summary: Gamebryo game engine file 14326# Extension: .kfm 14327# Created by: Abel Cheung <abelcheung@gmail.com> 143280 string ;Gamebryo\ KFM\ File\ Version\ Gamebryo game engine animation File 14329>&0 regex [0-9a-z.]+ \b, version %s 14330 14331# Summary: NetImmerse game engine file 14332# Extension .nif 14333# Created by: Abel Cheung <abelcheung@gmail.com> 143340 string NetImmerse\ File\ Format,\ Versio 14335>&0 string n\ NetImmerse game engine file 14336>>&0 regex [0-9a-z.]+ \b, version %s 14337 14338# Type: SGF Smart Game Format 14339# URL: https://www.red-bean.com/sgf/ 14340# From: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar> 143412 regex/c \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format 14342>2 regex/c GM\\[1\\] - Go Game 14343>2 regex/c GM\\[6\\] - BackGammon Game 14344>2 regex/c GM\\[11\\] - Hex Game 14345>2 regex/c GM\\[18\\] - Amazons Game 14346>2 regex/c GM\\[19\\] - Octi Game 14347>2 regex/c GM\\[20\\] - Gess Game 14348>2 regex/c GM\\[21\\] - twix Game 14349 14350# Epic Games/Unreal Engine Package 14351# 143520 lelong 0x9E2A83C1 Unreal Engine Package, 14353>4 leshort x version: %i 14354>12 lelong !0 \b, names: %i 14355>28 lelong !0 \b, imports: %i 14356>20 lelong !0 \b, exports: %i 14357 143580 string ESVG 14359>4 lelong 0x00160000 14360>10 string TOC\020 Empire Deluxe for DOS saved game 14361 14362# Sid Meier's Civilization V/VI 14363# From: Benjamin Lowry <ben@ben.gmbh> 143640 string CIV5 14365>4 byte 0x08 Sid Meier's Civilization V saved game, 14366>>12 regex [0-9a-z.]+ saved by game version %s 14367>4 byte 0x01 Sid Meier's Civilization V replay data, 14368>>12 regex [0-9a-z.]+ saved by game version %s 14369 143700 string CIV6 Sid Meier's Civilization VI saved game 14371 14372#------------------------------------------------------------------------------ 14373# $File: gcc,v 1.5 2016/07/01 23:31:13 christos Exp $ 14374# gcc: file(1) magic for GCC special files 14375# 143760 string gpch GCC precompiled header 14377 14378# The version field is annoying. It's 3 characters, not zero-terminated. 14379>5 byte x (version %c 14380>6 byte x \b%c 14381>7 byte x \b%c) 14382 14383# 67 = 'C', 111 = 'o', 43 = '+', 79 = 'O' 14384>4 byte 67 for C 14385>4 byte 111 for Objective-C 14386>4 byte 43 for C++ 14387>4 byte 79 for Objective-C++ 14388 14389#------------------------------------------------------------------------------ 14390# $File: gconv 14391# gconv: file(1) magic for iconv/gconv module configuration cache 14392# 14393# Magic number defined in glibc/iconv/iconvconfig.h as GCONVCACHE_MAGIC 14394# 14395# From: Marek Cermak <macermak@redhat.com> 14396# 143970 lelong 0x20010324 gconv module configuration cache data 14398 14399#------------------------------------------------------------------------------ 14400# $File: geo,v 1.7 2019/04/19 00:42:27 christos Exp $ 14401# Geo- files from Kurt Schwehr <schwehr@ccom.unh.edu> 14402 14403###################################################################### 14404# 14405# Acoustic Doppler Current Profilers (ADCP) 14406# 14407###################################################################### 14408 144090 beshort 0x7f7f RDI Acoustic Doppler Current Profiler (ADCP) 14410 14411###################################################################### 14412# 14413# Metadata 14414# 14415###################################################################### 14416 144170 string Identification_Information FGDC ASCII metadata 14418 14419###################################################################### 14420# 14421# Seimsic / Subbottom 14422# 14423###################################################################### 14424 14425# Knudsen subbottom chirp profiler - Binary File Format: B9 14426# KEB D409-03167 V1.75 Huffman 144270 string KEB\ Knudsen seismic KEL binary (KEB) - 14428>4 regex [-A-Z0-9]* Software: %s 14429>>&1 regex V[0-9]*\.[0-9]* version %s 14430 14431###################################################################### 14432# 14433# LIDAR - Laser altimetry or bathy 14434# 14435###################################################################### 14436 14437 14438# Caris LIDAR format for LADS comes as two parts... ascii location file and binary waveform data 144390 string HCA LADS Caris Ascii Format (CAF) bathymetric lidar 14440>4 regex [0-9]*\.[0-9]* version %s 14441 144420 string HCB LADS Caris Binary Format (CBF) bathymetric lidar waveform data 14443>3 byte x version %d . 14444>4 byte x %d 14445 14446 14447###################################################################### 14448# 14449# MULTIBEAM SONARS https://www.ldeo.columbia.edu/res/pi/MB-System/formatdoc/ 14450# 14451###################################################################### 14452 14453# GeoAcoustics - GeoSwath Plus 144544 beshort 0x2002 GeoSwath RDF 144550 string Start:- GeoSwatch auf text file 14456 14457# Seabeam 2100 14458# mbsystem code mb41 144590 string SB2100 SeaBeam 2100 multibeam sonar 144600 string SB2100DR SeaBeam 2100 DR multibeam sonar 144610 string SB2100PR SeaBeam 2100 PR multibeam sonar 14462 14463# This corresponds to MB-System format 94, L-3/ELAC/SeaBeam XSE vendor 14464# format. It is the format of our upgraded SeaBeam 2112 on R/V KNORR. 144650 string $HSF XSE multibeam 14466 14467# mb121 https://www.saic.com/maritime/gsf/ 144688 string GSF-v SAIC generic sensor format (GSF) sonar data, 14469>&0 regex [0-9]*\.[0-9]* version %s 14470 14471# MGD77 - https://www.ngdc.noaa.gov/mgg/dat/geodas/docs/mgd77.htm 14472# mb161 144739 string MGD77 MGD77 Header, Marine Geophysical Data Exchange Format 14474 14475# MBSystem processing caches the mbinfo output 144761 string Swath\ Data\ File: mbsystem info cache 14477 14478# Caris John Hughes Clark format 144790 string HDCS Caris multibeam sonar related data 144801 string Start/Stop\ parameter\ header: Caris ASCII project summary 14481 14482###################################################################### 14483# 14484# Visualization and 3D modeling 14485# 14486###################################################################### 14487 14488# IVS - IVS3d.com Tagged Data Represetation 144890 string %%\ TDR\ 2.0 IVS Fledermaus TDR file 14490 14491# http://www.ecma-international.org/publications/standards/Ecma-363.htm 14492# 3D in PDFs 144930 string U3D ECMA-363, Universal 3D 14494 14495###################################################################### 14496# 14497# Support files 14498# 14499###################################################################### 14500 14501# https://midas.psi.ch/elog/ 145020 string $@MID@$ elog journal entry 14503 14504# Geospatial Designs https://www.geospatialdesigns.com/surfer6_format.htm 145050 string DSBB Surfer 6 binary grid file 14506>4 leshort x \b, %d 14507>6 leshort x \bx%d 14508>8 ledouble x \b, minx=%g 14509>16 ledouble x \b, maxx=%g 14510>24 ledouble x \b, miny=%g 14511>32 ledouble x \b, maxy=%g 14512>40 ledouble x \b, minz=%g 14513>48 ledouble x \b, maxz=%g 14514 14515# magic for LAS format files 14516# alex myczko <alex@aiei.ch> 14517# https://www.asprs.org/wp-content/uploads/2010/12/LAS_1_3_r11.pdf 145180 string LASF LIDAR point data records 14519>24 byte >0 \b, version %u 14520>25 byte >0 \b.%u 14521>26 string >\0 \b, SYSID %s 14522>58 string >\0 \b, Generating Software %s 14523 14524# magic for PCD format files 14525# alex myczko <alex@aiei.ch> 14526# http://pointclouds.org/documentation/tutorials/pcd_file_format.php 145270 string #\ .PCD Point Cloud Data 14528 14529#------------------------------------------------------------------------------ 14530# $File: geos,v 1.4 2009/09/19 16:28:09 christos Exp $ 14531# GEOS files (Vidar Madsen, vidar@gimp.org) 14532# semi-commonly used in embedded and handheld systems. 145330 belong 0xc745c153 GEOS 14534>40 byte 1 executable 14535>40 byte 2 VMFile 14536>40 byte 3 binary 14537>40 byte 4 directory label 14538>40 byte <1 unknown 14539>40 byte >4 unknown 14540>4 string >\0 \b, name "%s" 14541#>44 short x \b, version %d 14542#>46 short x \b.%d 14543#>48 short x \b, rev %d 14544#>50 short x \b.%d 14545#>52 short x \b, proto %d 14546#>54 short x \br%d 14547#>168 string >\0 \b, copyright "%s" 14548 14549#------------------------------------------------------------------------------ 14550# $File: gimp,v 1.10 2019/10/15 18:19:40 christos Exp $ 14551# GIMP Gradient: file(1) magic for the GIMP's gradient data files (.ggr) 14552# by Federico Mena <federico@nuclecu.unam.mx> 14553 145540 string/t GIMP\ Gradient GIMP gradient data 14555#!:mime text/plain 14556!:mime text/x-gimp-ggr 14557!:ext ggr 14558 14559# GIMP palette (.gpl) 14560# From: Markus Heidelberg <markus.heidelberg@web.de> 145610 string/t GIMP\ Palette GIMP palette data 14562# URL: https://docs.gimp.org/en/gimp-concepts-palettes.html 14563# Reference: http://fileformats.archiveteam.org/wiki/GIMP_Palette 14564#!:mime text/plain 14565!:mime text/x-gimp-gpl 14566!:ext gpl 14567 14568#------------------------------------------------------------------------------ 14569# XCF: file(1) magic for the XCF image format used in the GIMP (.xcf) developed 14570# by Spencer Kimball and Peter Mattis 14571# ('Bucky' LaDieu, nega@vt.edu) 14572 14573# URL: https://en.wikipedia.org/wiki/XCF_(file_format) 14574# Reference: https://gitlab.gnome.org/GNOME/gimp/blob/master/devel-docs/xcf.txt 145750 string gimp\ xcf GIMP XCF image data, 14576!:mime image/x-xcf 14577!:ext xcf 14578>9 string file version 0, 14579>9 string v version 14580>>10 string >\0 %s, 14581>14 belong x %u x 14582>18 belong x %u, 14583>22 belong 0 RGB Color 14584>22 belong 1 Greyscale 14585>22 belong 2 Indexed Color 14586>22 belong >2 Unknown Image Type. 14587 14588#------------------------------------------------------------------------------ 14589# XCF: file(1) magic for the patterns used in the GIMP (.pat), developed 14590# by Spencer Kimball and Peter Mattis 14591# ('Bucky' LaDieu, nega@vt.edu) 14592 14593# Reference: http://fileformats.archiveteam.org/wiki/GIMP_Pattern 1459420 string GPAT GIMP pattern data, 14595>24 string x %s 14596!:mime image/x-gimp-pat 14597!:ext pat 14598 14599#------------------------------------------------------------------------------ 14600# XCF: file(1) magic for the brushes used in the GIMP (.gbr), developed 14601# by Spencer Kimball and Peter Mattis 14602# ('Bucky' LaDieu, nega@vt.edu) 14603 1460420 string GIMP GIMP brush data 14605# Reference: http://fileformats.archiveteam.org/wiki/GIMP_Brush 14606!:mime image/x-gimp-gbr 14607# some sources also list gpb 14608!:ext gbr 14609 14610# From: Joerg Jenderek 14611# URL: https://docs.gimp.org/en/gimp-using-animated-brushes.html 14612# Reference: http://fileformats.archiveteam.org/wiki/GIMP_Animated_Brush 14613# share\gimp\2.0\brushes\Legacy\confetti.gih 146140 search/21/b \040ncells: GIMP animated brush data 14615!:mime image/x-gimp-gih 14616!:ext gih 14617 14618# GIMP Curves File 14619# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 146200 string #\040GIMP\040Curves\040File GIMP curve file 14621#!:mime text/plain 14622!:mime text/x-gimp-curve 14623!:ext /txt 14624 14625 14626#------------------------------------------------------------------------------ 14627# $File: git,v 1.1 2019/10/04 18:46:29 christos Exp $ 14628# git: file(1) magic for Git objects 14629 146300 string blob\040 14631>5 regex [0-9]+ Git blob %s 14632 146330 string tree\040 14634>5 regex [0-9]+ Git tree %s 14635 146360 string commit\040 14637>7 regex [0-9]+ Git commit %s 14638 14639#------------------------------------------------------------------------------ 14640# $File: glibc,v 1.1 2018/10/11 15:35:43 christos Exp $ 14641# glibc locale files 14642# 14643# https://sourceware.org/git/?p=glibc.git;f=locale/localeinfo.h;h=68822a63#l32 14644 146450 belong 0x20070920 glibc locale file LC_CTYPE 146460 belong 0x14110320 glibc locale file LC_NUMERIC 146470 belong 0x17110320 glibc locale file LC_TIME 146480 belong 0x17100520 glibc locale file LC_COLLATE 146490 belong 0x11110320 glibc locale file LC_MONETARY 146500 belong 0x10110320 glibc locale file LC_MESSAGES 146510 belong 0x13110320 glibc locale file LC_ALL 146520 belong 0x12110320 glibc locale file LC_PAPER 146530 belong 0x1d110320 glibc locale file LC_NAME 146540 belong 0x1c110320 glibc locale file LC_ADDRESS 146550 belong 0x1f110320 glibc locale file LC_TELEPHONE 146560 belong 0x1e110320 glibc locale file LC_MEASUREMENT 146570 belong 0x19110320 glibc locale file LC_IDENTIFICATION 14658 14659 14660#------------------------------------------------------------------------------ 14661# $File: gnome,v 1.6 2019/04/19 00:42:27 christos Exp $ 14662# GNOME related files 14663 14664# Contributed by Josh Triplett 14665# FIXME: Could be simplified if pstring supported two-byte counts 146660 string GnomeKeyring\n\r\0\n GNOME keyring 14667>&0 ubyte 0 \b, major version 0 14668>>&0 ubyte 0 \b, minor version 0 14669>>>&0 ubyte 0 \b, crypto type 0 (AES) 14670>>>&0 ubyte >0 \b, crypto type %u (unknown) 14671>>>&1 ubyte 0 \b, hash type 0 (MD5) 14672>>>&1 ubyte >0 \b, hash type %u (unknown) 14673>>>&2 ubelong 0xFFFFFFFF \b, name NULL 14674>>>&2 ubelong !0xFFFFFFFF 14675>>>>&-4 ubelong >255 \b, name too long for file's pstring type 14676>>>>&-4 ubelong <256 14677>>>>>&-1 pstring x \b, name "%s" 14678>>>>>>&0 ubeqdate x \b, last modified %s 14679>>>>>>&8 ubeqdate x \b, created %s 14680>>>>>>&16 ubelong &1 14681>>>>>>>&0 ubelong x \b, locked if idle for %u seconds 14682>>>>>>&16 ubelong ^1 \b, not locked if idle 14683>>>>>>&24 ubelong x \b, hash iterations %u 14684>>>>>>&28 ubequad x \b, salt %llu 14685>>>>>>&52 ubelong x \b, %u item(s) 14686 14687# From: Alex Beregszaszi <alex@fsn.hu> 146884 string gtktalog GNOME Catalogue (gtktalog) 14689>13 string >\0 version %s 14690 14691# Summary: GStreamer binary registry 14692# Extension: .bin 14693# Submitted by: Josh Triplett <josh@joshtriplett.org> 146940 belong 0xc0def00d GStreamer binary registry 14695>4 string x \b, version %s 14696 14697# GVariant Database file 14698# By Elan Ruusamae <glen@delfi.ee> 14699# https://github.com/GNOME/gvdb/blob/master/gvdb-format.h 14700# It's always "GVariant", it's byte swapped on incompatible archs 14701# See https://github.com/GNOME/gvdb/blob/master/gvdb-builder.c 14702# file_builder_serialise() 14703# https://developer.gnome.org/glib/2.34/glib-GVariant.html#GVariant 147040 string GVariant GVariant Database file, 14705# version is never filled. probably future extension 14706>8 lelong x version %d 14707# not sure are these usable, so commented out 14708#>>16 lelong x start %d, 14709#>>>20 lelong x end %d 14710 14711# G-IR database made by gobject-introspect toolset, 14712# https://live.gnome.org/GObjectIntrospection 147130 string GOBJ\nMETADATA\r\n\032 G-IR binary database 14714>16 byte x \b, v%d 14715>17 byte x \b.%d 14716>20 leshort x \b, %d entries 14717>22 leshort x \b/%d local 14718 14719#------------------------------------------------------------------------------ 14720# $File: gnu,v 1.22 2020/04/09 19:11:58 christos Exp $ 14721# gnu: file(1) magic for various GNU tools 14722# 14723# GNU nlsutils message catalog file format 14724# 14725# GNU message catalog (.mo and .gmo files) 14726 14727# Update: Joerg Jenderek 14728# URL: https://www.gnu.org/software/gettext/manual/html_node/MO-Files.html 14729# Reference: ftp://ftp.gnu.org/pub/gnu/gettext/gettext-0.19.8.tar.gz/ 14730# gettext-0.19.8.1/gettext-runtime/intl/gmo.h 14731# Note: maybe call it like "GNU translation gettext machine object" 147320 string \336\22\4\225 GNU message catalog (little endian), 14733#0 ulelong 0x950412DE GNU-format message catalog data 14734# TODO: write lines in such a way that code can also be called for big endian variant 14735#>0 use gettext-object 14736#0 name gettext-object 14737>4 ulelong x revision 14738!:mime application/x-gettext-translation 14739# mo extension is also used for Easeus Partition Master PE32 executable module 14740# like ConvertFatToNTFS.mo 14741!:ext gmo/mo 14742# only found three revision combinations 0.0 0.1 1.1 as unsigned 32-bit 14743# major revision 14744>4 ulelong/0xFFff x %u. 14745# minor revision 14746>4 ulelong&0x0000FFff x \b%u 14747>>8 ulelong x \b, %u message 14748# plural s 14749>>8 ulelong >1 \bs 14750# size of hashing table 14751#>20 ulelong x \b, %u hash 14752#>20 ulelong >1 \bes 14753#>24 ulelong x at 0x%x 14754# for revsion x.0 offset of table with originals is 1Ch if directly after header 14755>4 ulelong&0x0000FFff =0 14756>>12 ulelong !0x1C \b, at 0x%x string table 14757# but for x.1 table offset i found is 30h. That means directly after bigger header 14758>4 ulelong&0x0000FFff >0 14759>>12 ulelong !0x30 \b, at 0x%x string table 14760# The following variables are only used in .mo files with minor revision >= 1 14761# number of system dependent segments 14762#>>28 ulelong x \b, %u segment 14763#>>28 ulelong >1 \bs 14764# offset of table describing system dependent segments 14765#>>32 ulelong x at 0x%x 14766# number of system dependent strings pairs 14767>>36 ulelong x \b, %u sysdep message 14768>>36 ulelong >1 \bs 14769# offset of table with start offsets of original sysdep strings 14770#>>40 ulelong x \b, at 0x%x sysdep strings 14771# offset of table with start offsets of translated sysdep strings 14772#>>44 ulelong x \b, at 0x%x sysdep translations 14773# >>(44.l) ulelong x 0x%x chars 14774# >>>&0 ulelong x at 0x%x 14775# >>>>(&-4) string x "%s" 14776# string table after big header 14777#>>48 ubequad x \b, string table 0x%llx 14778# 14779# 0th string length seems to be always 0 14780#>(12.l) ulelong x \b, %u chars 14781#>>&0 ulelong x at 0x%x 14782# if 1st string length positiv inspect offset and string 14783#>(12.l+8) ulelong >0 \b, %u chars 14784#>>&0 ulelong x at 0x%x 14785# if 2nd string length positiv inspect offset and string 14786# >(12.l+16) ulelong >0 \b, %u chars 14787# >>&0 ulelong x at 0x%x 14788# skip newline byte 14789#>>>(&-4) ubyte =0x0A 14790#>>>>&0 string x "%s" 14791#>>>(&-4) ubyte !0x0A 14792#>>>>&-1 string x '%s' 14793# offset of table with translation strings 14794#>16 ulelong x \b, at 0x%x translation table 14795# check translation 0 length and offset 14796>(16.l) ulelong >0 14797>>&0 ulelong x 14798# translation 0 seems to be often Project-Id with name and version 14799>>>(&-4) string x \b, %s 14800# trans. 1 with bytes >= 1 unlike icoutils-0.31.0\po\en@boldquot.gmo with 1 NL 14801>(16.l+8) ulelong >1 14802>>&0 ulelong x 14803>>>(&-4) ubyte !0x0A 14804>>>>&-1 string x '%s' 14805# 1 New Line like in tar-1.29\po\de.gmo 14806>>>(&-4) ubyte =0x0A 14807>>>>&0 ubyte !0x0A 14808>>>>>&-1 string x '%s' 14809# 2nd New Line like in parted-3.1\po\de.gmo 14810>>>>&0 ubyte =0x0A 14811>>>>>&0 string x '%s' 14812 148130 string \225\4\22\336 GNU message catalog (big endian), 14814#0 ubelong 0x950412DE GNU-format message catalog data 14815!:mime application/x-gettext-translation 14816!:ext gmo/mo 14817# TODO: for big endian use same code as for little endian 14818#>0 use \^gettext-object 14819# DEBUG code 14820#>16 ubelong x \b, at 0x%x translation table 14821#>(16.L) ubelong x 0x%x chars 14822#>>&0 ubelong x at 0x%x 14823# unexpected value HERE! 14824#>>>(&-4) ubequad x 0x%llx 14825# 14826>4 beshort x revision %d. 14827>6 beshort >0 \b%d, 14828>>8 belong x %d messages, 14829>>36 belong x %d sysdep messages 14830>6 beshort =0 \b%d, 14831>>8 belong x %d messages 14832 14833 14834# GnuPG 14835# The format is very similar to pgp 148360 string \001gpg GPG key trust database 14837>4 byte x version %d 14838# Note: magic.mime had 0x8501 for the next line instead of 0x8502 148390 beshort 0x8502 GPG encrypted data 14840!:mime text/PGP # encoding: data 14841 14842# Update: Joerg Jenderek 14843# Note: PGP and GPG use same data structure. 14844# So recognition is now done by ./pgp with start test for byte 0x99 14845# This magic is not particularly good, as the keyrings don't have true 14846# magic. Nevertheless, it covers many keyrings. 14847# 0 ubeshort-0x9901 <2 14848# >3 byte 4 14849# >>4 bedate x GPG key public ring, created %s 14850# !:mime application/x-gnupg-keyring 14851 14852# Symmetric encryption 148530 leshort 0x0d8c 14854>4 leshort 0x0203 14855>>2 leshort 0x0204 GPG symmetrically encrypted data (3DES cipher) 14856>>2 leshort 0x0304 GPG symmetrically encrypted data (CAST5 cipher) 14857>>2 leshort 0x0404 GPG symmetrically encrypted data (BLOWFISH cipher) 14858>>2 leshort 0x0704 GPG symmetrically encrypted data (AES cipher) 14859>>2 leshort 0x0804 GPG symmetrically encrypted data (AES192 cipher) 14860>>2 leshort 0x0904 GPG symmetrically encrypted data (AES256 cipher) 14861>>2 leshort 0x0a04 GPG symmetrically encrypted data (TWOFISH cipher) 14862>>2 leshort 0x0b04 GPG symmetrically encrypted data (CAMELLIA128 cipher) 14863>>2 leshort 0x0c04 GPG symmetrically encrypted data (CAMELLIA192 cipher) 14864>>2 leshort 0x0d04 GPG symmetrically encrypted data (CAMELLIA256 cipher) 14865 14866 14867# GnuPG Keybox file 14868# <https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=kbx/keybox-blob.c;hb=HEAD> 14869# From: Philipp Hahn <hahn@univention.de> 148700 belong 32 14871>4 byte 1 14872>>8 string KBXf GPG keybox database 14873>>>5 byte 1 version %d 14874>>>16 bedate x \b, created-at %s 14875>>>20 bedate x \b, last-maintained %s 14876 14877 14878# From: James Youngman <jay@gnu.org> 14879# gnu find magic 148800 string \0LOCATE GNU findutils locate database data 14881>7 string >\0 \b, format %s 14882>7 string 02 \b (frcode) 14883 14884# Files produced by GNU gettext 14885 14886# gettext message catalogue 148870 search/1024 \nmsgid 14888>&0 search/1024 \nmsgstr GNU gettext message catalogue text 14889!:strength +100 14890!:mime text/x-po 14891 14892#------------------------------------------------------------------------------ 14893# $File: gnumeric,v 1.4 2009/09/19 16:28:09 christos Exp $ 14894# gnumeric: file(1) magic for Gnumeric spreadsheet 14895# This entry is only semi-helpful, as Gnumeric compresses its files, so 14896# they will ordinarily reported as "compressed", but at least -z helps 1489739 string =<gmr:Workbook Gnumeric spreadsheet 14898!:mime application/x-gnumeric 14899 14900#------------------------------------------------------------------------------ 14901# $File: gpt,v 1.4 2017/03/17 21:35:28 christos Exp $ 14902# 14903# GPT Partition table patterns. 14904# Author: Rogier Goossens (goossens.rogier@gmail.com) 14905# Note that a GPT-formatted disk must contain an MBR as well. 14906# 14907 14908# The initial segment (up to >>>>>>>>422) was copied from the X86 14909# partition table code (aka MBR). 14910# This is kept separate, so that MBR partitions are not reported as well. 14911# (use -k if you do want them as well) 14912 14913# First, detect the MBR partiton table 14914# If more than one GPT protective MBR partition exists, don't print anything 14915# (the other MBR detection code will then just print the MBR partition table) 149160x1FE leshort 0xAA55 14917>3 string !MS 14918>>3 string !SYSLINUX 14919>>>3 string !MTOOL 14920>>>>3 string !NEWLDR 14921>>>>>5 string !DOS 14922# not FAT (32 bit) 14923>>>>>>82 string !FAT32 14924#not Linux kernel 14925>>>>>>>514 string !HdrS 14926#not BeOS 14927>>>>>>>>422 string !Be\ Boot\ Loader 14928# GPT with protective MBR entry in partition 1 (only) 14929>>>>>>>>>450 ubyte 0xee 14930>>>>>>>>>>466 ubyte !0xee 14931>>>>>>>>>>>482 ubyte !0xee 14932>>>>>>>>>>>>498 ubyte !0xee 14933#>>>>>>>>>>>>>446 use gpt-mbr-partition 14934>>>>>>>>>>>>>(454.l*8192) string EFI\ PART GPT partition table 14935>>>>>>>>>>>>>>0 use gpt-mbr-type 14936>>>>>>>>>>>>>>&-8 use gpt-table 14937>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 14938>>>>>>>>>>>>>(454.l*8192) string !EFI\ PART 14939>>>>>>>>>>>>>>(454.l*4096) string EFI\ PART GPT partition table 14940>>>>>>>>>>>>>>>0 use gpt-mbr-type 14941>>>>>>>>>>>>>>>&-8 use gpt-table 14942>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 14943>>>>>>>>>>>>>>(454.l*4096) string !EFI\ PART 14944>>>>>>>>>>>>>>>(454.l*2048) string EFI\ PART GPT partition table 14945>>>>>>>>>>>>>>>>0 use gpt-mbr-type 14946>>>>>>>>>>>>>>>>&-8 use gpt-table 14947>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 14948>>>>>>>>>>>>>>>(454.l*2048) string !EFI\ PART 14949>>>>>>>>>>>>>>>>(454.l*1024) string EFI\ PART GPT partition table 14950>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 14951>>>>>>>>>>>>>>>>>&-8 use gpt-table 14952>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 14953>>>>>>>>>>>>>>>>(454.l*1024) string !EFI\ PART 14954>>>>>>>>>>>>>>>>>(454.l*512) string EFI\ PART GPT partition table 14955>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 14956>>>>>>>>>>>>>>>>>>&-8 use gpt-table 14957>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 14958# GPT with protective MBR entry in partition 2 (only) 14959>>>>>>>>>450 ubyte !0xee 14960>>>>>>>>>>466 ubyte 0xee 14961>>>>>>>>>>>482 ubyte !0xee 14962>>>>>>>>>>>>498 ubyte !0xee 14963#>>>>>>>>>>>>>462 use gpt-mbr-partition 14964>>>>>>>>>>>>>(470.l*8192) string EFI\ PART GPT partition table 14965>>>>>>>>>>>>>>0 use gpt-mbr-type 14966>>>>>>>>>>>>>>&-8 use gpt-table 14967>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 14968>>>>>>>>>>>>>(470.l*8192) string !EFI\ PART 14969>>>>>>>>>>>>>>(470.l*4096) string EFI\ PART GPT partition table 14970>>>>>>>>>>>>>>>0 use gpt-mbr-type 14971>>>>>>>>>>>>>>>&-8 use gpt-table 14972>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 14973>>>>>>>>>>>>>>(470.l*4096) string !EFI\ PART 14974>>>>>>>>>>>>>>>(470.l*2048) string EFI\ PART GPT partition table 14975>>>>>>>>>>>>>>>>0 use gpt-mbr-type 14976>>>>>>>>>>>>>>>>&-8 use gpt-table 14977>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 14978>>>>>>>>>>>>>>>(470.l*2048) string !EFI\ PART 14979>>>>>>>>>>>>>>>>(470.l*1024) string EFI\ PART GPT partition table 14980>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 14981>>>>>>>>>>>>>>>>>&-8 use gpt-table 14982>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 14983>>>>>>>>>>>>>>>>(470.l*1024) string !EFI\ PART 14984>>>>>>>>>>>>>>>>>(470.l*512) string EFI\ PART GPT partition table 14985>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 14986>>>>>>>>>>>>>>>>>>&-8 use gpt-table 14987>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 14988# GPT with protective MBR entry in partition 3 (only) 14989>>>>>>>>>450 ubyte !0xee 14990>>>>>>>>>>466 ubyte !0xee 14991>>>>>>>>>>>482 ubyte 0xee 14992>>>>>>>>>>>>498 ubyte !0xee 14993#>>>>>>>>>>>>>478 use gpt-mbr-partition 14994>>>>>>>>>>>>>(486.l*8192) string EFI\ PART GPT partition table 14995>>>>>>>>>>>>>>0 use gpt-mbr-type 14996>>>>>>>>>>>>>>&-8 use gpt-table 14997>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 14998>>>>>>>>>>>>>(486.l*8192) string !EFI\ PART 14999>>>>>>>>>>>>>>(486.l*4096) string EFI\ PART GPT partition table 15000>>>>>>>>>>>>>>>0 use gpt-mbr-type 15001>>>>>>>>>>>>>>>&-8 use gpt-table 15002>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 15003>>>>>>>>>>>>>>(486.l*4096) string !EFI\ PART 15004>>>>>>>>>>>>>>>(486.l*2048) string EFI\ PART GPT partition table 15005>>>>>>>>>>>>>>>>0 use gpt-mbr-type 15006>>>>>>>>>>>>>>>>&-8 use gpt-table 15007>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 15008>>>>>>>>>>>>>>>(486.l*2048) string !EFI\ PART 15009>>>>>>>>>>>>>>>>(486.l*1024) string EFI\ PART GPT partition table 15010>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 15011>>>>>>>>>>>>>>>>>&-8 use gpt-table 15012>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 15013>>>>>>>>>>>>>>>>(486.l*1024) string !EFI\ PART 15014>>>>>>>>>>>>>>>>>(486.l*512) string EFI\ PART GPT partition table 15015>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 15016>>>>>>>>>>>>>>>>>>&-8 use gpt-table 15017>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 15018# GPT with protective MBR entry in partition 4 (only) 15019>>>>>>>>>450 ubyte !0xee 15020>>>>>>>>>>466 ubyte !0xee 15021>>>>>>>>>>>482 ubyte !0xee 15022>>>>>>>>>>>>498 ubyte 0xee 15023#>>>>>>>>>>>>>494 use gpt-mbr-partition 15024>>>>>>>>>>>>>(502.l*8192) string EFI\ PART GPT partition table 15025>>>>>>>>>>>>>>0 use gpt-mbr-type 15026>>>>>>>>>>>>>>&-8 use gpt-table 15027>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 15028>>>>>>>>>>>>>(502.l*8192) string !EFI\ PART 15029>>>>>>>>>>>>>>(502.l*4096) string EFI\ PART GPT partition table 15030>>>>>>>>>>>>>>>0 use gpt-mbr-type 15031>>>>>>>>>>>>>>>&-8 use gpt-table 15032>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 15033>>>>>>>>>>>>>>(502.l*4096) string !EFI\ PART 15034>>>>>>>>>>>>>>>(502.l*2048) string EFI\ PART GPT partition table 15035>>>>>>>>>>>>>>>>0 use gpt-mbr-type 15036>>>>>>>>>>>>>>>>&-8 use gpt-table 15037>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 15038>>>>>>>>>>>>>>>(502.l*2048) string !EFI\ PART 15039>>>>>>>>>>>>>>>>(502.l*1024) string EFI\ PART GPT partition table 15040>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 15041>>>>>>>>>>>>>>>>>&-8 use gpt-table 15042>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 15043>>>>>>>>>>>>>>>>(502.l*1024) string !EFI\ PART 15044>>>>>>>>>>>>>>>>>(502.l*512) string EFI\ PART GPT partition table 15045>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 15046>>>>>>>>>>>>>>>>>>&-8 use gpt-table 15047>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 15048 15049# The following code does GPT detection and processing, including 15050# sector size detection. 15051# It has to be duplicated above because the top-level pattern 15052# (i.e. not called using 'use') must print *something* for file 15053# to count it as a match. Text only printed in named patterns is 15054# not counted, and causes file to continue, and try and match 15055# other patterns. 15056# 15057# Unfortunately, when assuming sector sizes >=16k, if the sector size 15058# happens to be 512 instead, we may find confusing data after the GPT 15059# table... If the GPT table has less than 128 entries, this may even 15060# happen for assumed sector sizes as small as 4k 15061# This could be solved by checking for the presence of the backup GPT 15062# header as well, but that makes the logic extremely complex 15063##0 name gpt-mbr-partition 15064##>(8.l*8192) string EFI\ PART 15065##>>(8.l*8192) use gpt-mbr-type 15066##>>&-8 use gpt-table 15067##>>0 ubyte x of 8192 bytes 15068##>(8.l*8192) string !EFI\ PART 15069##>>(8.l*4096) string EFI\ PART GPT partition table 15070##>>>0 use gpt-mbr-type 15071##>>>&-8 use gpt-table 15072##>>>0 ubyte x of 4096 bytes 15073##>>(8.l*4096) string !EFI\ PART 15074##>>>(8.l*2048) string EFI\ PART GPT partition table 15075##>>>>0 use gpt-mbr-type 15076##>>>>&-8 use gpt-table 15077##>>>>0 ubyte x of 2048 bytes 15078##>>>(8.l*2048) string !EFI\ PART 15079##>>>>(8.l*1024) string EFI\ PART GPT partition table 15080##>>>>>0 use gpt-mbr-type 15081##>>>>>&-8 use gpt-table 15082##>>>>>0 ubyte x of 1024 bytes 15083##>>>>(8.l*1024) string !EFI\ PART 15084##>>>>>(8.l*512) string EFI\ PART GPT partition table 15085##>>>>>>0 use gpt-mbr-type 15086##>>>>>>&-8 use gpt-table 15087##>>>>>>0 ubyte x of 512 bytes 15088 15089# Print details of MBR type for a GPT-disk 15090# Calling code ensures that there is only one 0xee partition. 150910 name gpt-mbr-type 15092# GPT with protective MBR entry in partition 1 15093>450 ubyte 0xee 15094>>454 ulelong 1 15095>>>462 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 15096>>454 ulelong !1 \b (nonstandard: not at LBA 1) 15097# GPT with protective MBR entry in partition 2 15098>466 ubyte 0xee 15099>>470 ulelong 1 15100>>>478 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 15101>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 15102>>>478 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 15103>>470 ulelong !1 \b (nonstandard: not at LBA 1) 15104# GPT with protective MBR entry in partition 3 15105>482 ubyte 0xee 15106>>486 ulelong 1 15107>>>494 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 15108>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 15109>>>494 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 15110>>486 ulelong !1 \b (nonstandard: not at LBA 1) 15111# GPT with protective MBR entry in partition 4 15112>498 ubyte 0xee 15113>>502 ulelong 1 15114>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 15115>>502 ulelong !1 \b (nonstandard: not at LBA 1) 15116 15117# Print the information from a GPT partition table structure 151180 name gpt-table 15119>10 uleshort x \b, version %u 15120>8 uleshort x \b.%u 15121>56 ulelong x \b, GUID: %08x 15122>60 uleshort x \b-%04x 15123>62 uleshort x \b-%04x 15124>64 ubeshort x \b-%04x 15125>66 ubeshort x \b-%04x 15126>68 ubelong x \b%08x 15127#>80 uleshort x \b, %d partition entries 15128>32 ulequad+1 x \b, disk size: %lld sectors 15129 15130# In case a GPT data-structure is at LBA 0, report it as well 15131# This covers systems which are not GPT-aware, and which show 15132# and allow access to the protective partition. This code will 15133# detect the contents of such a partition. 151340 string EFI\ PART GPT data structure (nonstandard: at LBA 0) 15135>0 use gpt-table 15136>0 ubyte x (sector size unknown) 15137 15138 15139 15140#------------------------------------------------------------------------------ 15141# $File: gpu,v 1.2 2017/03/23 22:11:53 christos Exp $ 15142# gpu: file(1) magic for GPU input files 15143 15144# Standard Portable Intermediate Representation (SPIR) 15145# Documentation: https://www.khronos.org/spir 15146# Typical file extension: .spv 15147 151480 belong 0x07230203 Khronos SPIR-V binary, big-endian 15149>4 belong x \b, version 0x%08x 15150>8 belong x \b, generator 0x%08x 15151 151520 lelong 0x07230203 Khronos SPIR-V binary, little-endian 15153>4 lelong x \b, version 0x%08x 15154>8 lelong x \b, generator 0x%08x 15155 15156# Vulkan Trace file 15157# Documentation: 15158# https://github.com/LunarG/VulkanTools/blob/master/vktrace/vktrace_common/\ 15159# vktrace_trace_packet_identifiers.h 15160# Typical file extension: .vktrace 15161 151628 lequad 0xABADD068ADEAFD0C Vulkan trace file, little-endian 15163>0 leshort x \b, version %d 15164 151658 bequad 0xABADD068ADEAFD0C Vulkan trace file, big-endian 15166>0 beshort x \b, version %d 15167 15168#------------------------------------------------------------------------------ 15169# $File: grace,v 1.4 2009/09/19 16:28:09 christos Exp $ 15170# ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE 15171# 15172# ACE/gr binary 151730 string \000\000\0001\000\000\0000\000\000\0000\000\000\0002\000\000\0000\000\000\0000\000\000\0003 old ACE/gr binary file 15174>39 byte >0 - version %c 15175# ACE/gr ascii 151760 string #\ xvgr\ parameter\ file ACE/gr ascii file 151770 string #\ xmgr\ parameter\ file ACE/gr ascii file 151780 string #\ ACE/gr\ parameter\ file ACE/gr ascii file 15179# Grace projects 151800 string #\ Grace\ project\ file Grace project file 15181>23 string @version\ (version 15182>>32 byte >0 %c 15183>>33 string >\0 \b.%.2s 15184>>35 string >\0 \b.%.2s) 15185# ACE/gr fit description files 151860 string #\ ACE/gr\ fit\ description\ ACE/gr fit description file 15187# end of ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE 15188 15189#------------------------------------------------------------------------------ 15190# $File: graphviz,v 1.9 2019/04/30 04:01:40 christos Exp $ 15191# graphviz: file(1) magic for https://www.graphviz.org/ 15192 15193# FIXME: These patterns match too generally. For example, the first 15194# line matches a LaTeX file containing the word "graph" (with a { 15195# following later) and the second line matches this file. 15196#0 regex/100l [\r\n\t\ ]*graph[\r\n\t\ ]+.*\\{ graphviz graph text 15197#!:mime text/vnd.graphviz 15198#0 regex/100l [\r\n\t\ ]*digraph[\r\n\t\ ]+.*\\{ graphviz digraph text 15199#!:mime text/vnd.graphviz 15200 15201#------------------------------------------------------------------------------ 15202# $File: gringotts,v 1.6 2017/03/17 21:35:28 christos Exp $ 15203# gringotts: file(1) magic for Gringotts 15204# http://devel.pluto.linux.it/projects/Gringotts/ 15205# author: Germano Rizzo <mano@pluto.linux.it> 15206#GRG3????Y 152070 string GRG Gringotts data file 15208#file format 1 15209>3 string 1 v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9 15210#file format 2 15211>3 string 2 v.2, MCRYPT S2K, 15212>>8 byte&0x70 0x00 RIJNDAEL-128 crypt, 15213>>8 byte&0x70 0x10 SERPENT crypt, 15214>>8 byte&0x70 0x20 TWOFISH crypt, 15215>>8 byte&0x70 0x30 CAST-256 crypt, 15216>>8 byte&0x70 0x40 SAFER+ crypt, 15217>>8 byte&0x70 0x50 LOKI97 crypt, 15218>>8 byte&0x70 0x60 3DES crypt, 15219>>8 byte&0x70 0x70 RIJNDAEL-256 crypt, 15220>>8 byte&0x08 0x00 SHA1 hash, 15221>>8 byte&0x08 0x08 RIPEMD-160 hash, 15222>>8 byte&0x04 0x00 ZLib 15223>>8 byte&0x04 0x04 BZip2 15224>>8 byte&0x03 0x00 lvl.0 15225>>8 byte&0x03 0x01 lvl.3 15226>>8 byte&0x03 0x02 lvl.6 15227>>8 byte&0x03 0x03 lvl.9 15228#file format 3 15229>3 string 3 v.3, OpenPGP S2K, 15230>>8 byte&0x70 0x00 RIJNDAEL-128 crypt, 15231>>8 byte&0x70 0x10 SERPENT crypt, 15232>>8 byte&0x70 0x20 TWOFISH crypt, 15233>>8 byte&0x70 0x30 CAST-256 crypt, 15234>>8 byte&0x70 0x40 SAFER+ crypt, 15235>>8 byte&0x70 0x50 LOKI97 crypt, 15236>>8 byte&0x70 0x60 3DES crypt, 15237>>8 byte&0x70 0x70 RIJNDAEL-256 crypt, 15238>>8 byte&0x08 0x00 SHA1 hash, 15239>>8 byte&0x08 0x08 RIPEMD-160 hash, 15240>>8 byte&0x04 0x00 ZLib 15241>>8 byte&0x04 0x04 BZip2 15242>>8 byte&0x03 0x00 lvl.0 15243>>8 byte&0x03 0x01 lvl.3 15244>>8 byte&0x03 0x02 lvl.6 15245>>8 byte&0x03 0x03 lvl.9 15246#file format >3 15247>3 string >3 v.%.1s (unknown details) 15248 15249#------------------------------------------------------------------------------ 15250# $File: guile,v 1.2 2019/04/19 00:42:27 christos Exp $ 15251# Guile file magic from <dalepsmith@gmail.com> 15252# https://www.gnu.org/s/guile/ 15253# https://git.savannah.gnu.org/gitweb/?p=guile.git;f=libguile/_scm.h;hb=HEAD#l250 15254 152550 string GOOF---- Guile Object 15256>8 string LE \b, little endian 15257>8 string BE \b, big endian 15258>11 string 4 \b, 32bit 15259>11 string 8 \b, 64bit 15260>13 regex .\.. \b, bytecode v%s 15261 15262#------------------------------------------------------------------------------ 15263# $File: hardware,v 1.1 2018/08/02 06:32:52 christos Exp $ 15264# hardware magic 15265 15266# EDID 15267# https://en.wikipedia.org/wiki/Extended_Display_Identification_Data 152680 string \x00\xFF\xFF\xFF\xFF\xFF\xFF\x00 15269>19 byte x 15270>>18 byte x EDID data, version %u. 15271>>19 byte x \b%u 15272#>>17 ubyte+1990 <255 \b, manufactured %u 15273 15274#------------------------------------------------------------------------------ 15275# $File: hitachi-sh,v 1.9 2018/08/21 12:48:41 christos Exp $ 15276# hitach-sh: file(1) magic for Hitachi Super-H 15277# 15278# Super-H COFF 15279# 15280# updated by Joerg Jenderek at Oct 2015 15281# https://en.wikipedia.org/wiki/COFF 15282# https://de.wikipedia.org/wiki/Common_Object_File_Format 15283# http://www.delorie.com/djgpp/doc/coff/filhdr.html 15284# below test line conflicts with 2nd NTFS filesystem sector 15285# 2nd NTFS filesystem sector often starts with 0x05004e00 for unicode string 5 NTLDR 15286# and Portable Gaming Notation Compressed format (*.WID http://pgn.freeservers.com/) 152870 beshort 0x0500 15288# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags 15289>18 ubeshort&0x8E80 0 15290# use big endian variant of subroutine to display name+variables+flags 15291# for common object formated files 15292>>0 use \^display-coff 15293!:strength -10 15294 152950 leshort 0x0550 15296# test for unused flag bits in f_flags 15297>18 uleshort&0x8E80 0 15298# use little endian variant of subroutine to 15299# display name+variables+flags for common object formated files 15300>>0 use display-coff 15301!:strength -10 15302 15303 15304#------------------------------------------------------------------------------ 15305# $File: hp,v 1.25 2019/01/13 00:32:38 christos Exp $ 15306# hp: file(1) magic for Hewlett Packard machines (see also "printer") 15307# 15308# XXX - somebody should figure out whether any byte order needs to be 15309# applied to the "TML" stuff; I'm assuming the Apollo stuff is 15310# big-endian as it was mostly 68K-based. 15311# 15312# I think the 500 series was the old stack-based machines, running a 15313# UNIX environment atop the "SUN kernel"; dunno whether it was 15314# big-endian or little-endian. 15315# 15316# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based; 15317# hp300 are 68020+68881 based; hp400 are also 68k. The following basic 15318# HP magic is useful for reference, but using "long" magic is a better 15319# practice in order to avoid collisions. 15320# 15321# Guy Harris (guy@netapp.com): some additions to this list came from 15322# HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1, 15323# 1.2, and 2.0). The 1.2 and 2.0 stuff isn't in the HP-UX 10.0 15324# "/etc/magic", though, except for the "archive file relocatable library" 15325# stuff, and the 68030 and 68040 stuff isn't there at all - are they not 15326# used in executables, or have they just not yet updated "/etc/magic" 15327# completely? 15328# 15329# 0 beshort 200 hp200 (68010) BSD binary 15330# 0 beshort 300 hp300 (68020+68881) BSD binary 15331# 0 beshort 0x20c hp200/300 HP-UX binary 15332# 0 beshort 0x20d hp400 (68030) HP-UX binary 15333# 0 beshort 0x20e hp400 (68040?) HP-UX binary 15334# 0 beshort 0x20b PA-RISC1.0 HP-UX binary 15335# 0 beshort 0x210 PA-RISC1.1 HP-UX binary 15336# 0 beshort 0x211 PA-RISC1.2 HP-UX binary 15337# 0 beshort 0x214 PA-RISC2.0 HP-UX binary 15338 15339# 15340# The "misc" stuff needs a byte order; the archives look suspiciously 15341# like the old 177545 archives (0xff65 = 0177545). 15342# 15343#### Old Apollo stuff 153440 beshort 0627 Apollo m68k COFF executable 15345>18 beshort ^040000 not stripped 15346>22 beshort >0 - version %d 153470 beshort 0624 apollo a88k COFF executable 15348>18 beshort ^040000 not stripped 15349>22 beshort >0 - version %d 153500 long 01203604016 TML 0123 byte-order format 153510 long 01702407010 TML 1032 byte-order format 153520 long 01003405017 TML 2301 byte-order format 153530 long 01602007412 TML 3210 byte-order format 15354#### PA-RISC 1.1 153550 belong 0x02100106 PA-RISC1.1 relocatable object 153560 belong 0x02100107 PA-RISC1.1 executable 15357>168 belong &0x00000004 dynamically linked 15358>(144) belong 0x054ef630 dynamically linked 15359>96 belong >0 - not stripped 15360 153610 belong 0x02100108 PA-RISC1.1 shared executable 15362>168 belong&0x4 0x4 dynamically linked 15363>(144) belong 0x054ef630 dynamically linked 15364>96 belong >0 - not stripped 15365 153660 belong 0x0210010b PA-RISC1.1 demand-load executable 15367>168 belong&0x4 0x4 dynamically linked 15368>(144) belong 0x054ef630 dynamically linked 15369>96 belong >0 - not stripped 15370 153710 belong 0x0210010e PA-RISC1.1 shared library 15372>96 belong >0 - not stripped 15373 153740 belong 0x0210010d PA-RISC1.1 dynamic load library 15375>96 belong >0 - not stripped 15376 15377#### PA-RISC 2.0 153780 belong 0x02140106 PA-RISC2.0 relocatable object 15379 153800 belong 0x02140107 PA-RISC2.0 executable 15381>168 belong &0x00000004 dynamically linked 15382>(144) belong 0x054ef630 dynamically linked 15383>96 belong >0 - not stripped 15384 153850 belong 0x02140108 PA-RISC2.0 shared executable 15386>168 belong &0x00000004 dynamically linked 15387>(144) belong 0x054ef630 dynamically linked 15388>96 belong >0 - not stripped 15389 153900 belong 0x0214010b PA-RISC2.0 demand-load executable 15391>168 belong &0x00000004 dynamically linked 15392>(144) belong 0x054ef630 dynamically linked 15393>96 belong >0 - not stripped 15394 153950 belong 0x0214010e PA-RISC2.0 shared library 15396>96 belong >0 - not stripped 15397 153980 belong 0x0214010d PA-RISC2.0 dynamic load library 15399>96 belong >0 - not stripped 15400 15401#### 800 154020 belong 0x020b0106 PA-RISC1.0 relocatable object 15403 154040 belong 0x020b0107 PA-RISC1.0 executable 15405>168 belong&0x4 0x4 dynamically linked 15406>(144) belong 0x054ef630 dynamically linked 15407>96 belong >0 - not stripped 15408 154090 belong 0x020b0108 PA-RISC1.0 shared executable 15410>168 belong&0x4 0x4 dynamically linked 15411>(144) belong 0x054ef630 dynamically linked 15412>96 belong >0 - not stripped 15413 154140 belong 0x020b010b PA-RISC1.0 demand-load executable 15415>168 belong&0x4 0x4 dynamically linked 15416>(144) belong 0x054ef630 dynamically linked 15417>96 belong >0 - not stripped 15418 154190 belong 0x020b010e PA-RISC1.0 shared library 15420>96 belong >0 - not stripped 15421 154220 belong 0x020b010d PA-RISC1.0 dynamic load library 15423>96 belong >0 - not stripped 15424 15425#### 500 154260 long 0x02080106 HP s500 relocatable executable 15427>16 long >0 - version %d 15428 154290 long 0x02080107 HP s500 executable 15430>16 long >0 - version %d 15431 154320 long 0x02080108 HP s500 pure executable 15433>16 long >0 - version %d 15434 15435#### 200 154360 belong 0x020c0108 HP s200 pure executable 15437>4 beshort >0 - version %d 15438>8 belong &0x80000000 save fp regs 15439>8 belong &0x40000000 dynamically linked 15440>8 belong &0x20000000 debuggable 15441>36 belong >0 not stripped 15442 154430 belong 0x020c0107 HP s200 executable 15444>4 beshort >0 - version %d 15445>8 belong &0x80000000 save fp regs 15446>8 belong &0x40000000 dynamically linked 15447>8 belong &0x20000000 debuggable 15448>36 belong >0 not stripped 15449 154500 belong 0x020c010b HP s200 demand-load executable 15451>4 beshort >0 - version %d 15452>8 belong &0x80000000 save fp regs 15453>8 belong &0x40000000 dynamically linked 15454>8 belong &0x20000000 debuggable 15455>36 belong >0 not stripped 15456 154570 belong 0x020c0106 HP s200 relocatable executable 15458>4 beshort >0 - version %d 15459>6 beshort >0 - highwater %d 15460>8 belong &0x80000000 save fp regs 15461>8 belong &0x20000000 debuggable 15462>8 belong &0x10000000 PIC 15463 154640 belong 0x020a0108 HP s200 (2.x release) pure executable 15465>4 beshort >0 - version %d 15466>36 belong >0 not stripped 15467 154680 belong 0x020a0107 HP s200 (2.x release) executable 15469>4 beshort >0 - version %d 15470>36 belong >0 not stripped 15471 154720 belong 0x020c010e HP s200 shared library 15473>4 beshort >0 - version %d 15474>6 beshort >0 - highwater %d 15475>36 belong >0 not stripped 15476 154770 belong 0x020c010d HP s200 dynamic load library 15478>4 beshort >0 - version %d 15479>6 beshort >0 - highwater %d 15480>36 belong >0 not stripped 15481 15482#### MISC 154830 long 0x0000ff65 HP old archive 154840 long 0x020aff65 HP s200 old archive 154850 long 0x020cff65 HP s200 old archive 154860 long 0x0208ff65 HP s500 old archive 15487 154880 long 0x015821a6 HP core file 15489 154900 long 0x4da7eee8 HP-WINDOWS font 15491>8 byte >0 - version %d 154920 string Bitmapfile HP Bitmapfile 15493 154940 string IMGfile CIS compimg HP Bitmapfile 15495# XXX - see "lif" 15496#0 short 0x8000 lif file 154970 long 0x020c010c compiled Lisp 15498 154990 string msgcat01 HP NLS message catalog, 15500>8 long >0 %d messages 15501 15502# Summary: HP-48/49 calculator 15503# Created by: phk@data.fls.dk 15504# Modified by (1): AMAKAWA Shuhei <sa264@cam.ac.uk> 15505# Modified by (2): Samuel Thibault <samuel.thibault@ens-lyon.org> (HP49 support) 155060 string HPHP HP 15507>4 string 48 48 binary 15508>4 string 49 49 binary 15509>7 byte >64 - Rev %c 15510>8 leshort 0x2911 (ADR) 15511>8 leshort 0x2933 (REAL) 15512>8 leshort 0x2955 (LREAL) 15513>8 leshort 0x2977 (COMPLX) 15514>8 leshort 0x299d (LCOMPLX) 15515>8 leshort 0x29bf (CHAR) 15516>8 leshort 0x29e8 (ARRAY) 15517>8 leshort 0x2a0a (LNKARRAY) 15518>8 leshort 0x2a2c (STRING) 15519>8 leshort 0x2a4e (HXS) 15520>8 leshort 0x2a74 (LIST) 15521>8 leshort 0x2a96 (DIR) 15522>8 leshort 0x2ab8 (ALG) 15523>8 leshort 0x2ada (UNIT) 15524>8 leshort 0x2afc (TAGGED) 15525>8 leshort 0x2b1e (GROB) 15526>8 leshort 0x2b40 (LIB) 15527>8 leshort 0x2b62 (BACKUP) 15528>8 leshort 0x2b88 (LIBDATA) 15529>8 leshort 0x2d9d (PROG) 15530>8 leshort 0x2dcc (CODE) 15531>8 leshort 0x2e48 (GNAME) 15532>8 leshort 0x2e6d (LNAME) 15533>8 leshort 0x2e92 (XLIB) 15534 155350 string %%HP: HP text 15536>6 string T(0) - T(0) 15537>6 string T(1) - T(1) 15538>6 string T(2) - T(2) 15539>6 string T(3) - T(3) 15540>10 string A(D) A(D) 15541>10 string A(R) A(R) 15542>10 string A(G) A(G) 15543>14 string F(.) F(.); 15544>14 string F(,) F(,); 15545 15546 15547# Summary: HP-38/39 calculator 15548# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org> 155490 string HP3 15550>3 string 8 HP 38 15551>3 string 9 HP 39 15552>4 string Bin binary 15553>4 string Asc ASCII 15554>7 string A (Directory List) 15555>7 string B (Zaplet) 15556>7 string C (Note) 15557>7 string D (Program) 15558>7 string E (Variable) 15559>7 string F (List) 15560>7 string G (Matrix) 15561>7 string H (Library) 15562>7 string I (Target List) 15563>7 string J (ASCII Vector specification) 15564>7 string K (wildcard) 15565 15566# Summary: HP-38/39 calculator 15567# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org> 155680 string HP3 15569>3 string 8 HP 38 15570>3 string 9 HP 39 15571>4 string Bin binary 15572>4 string Asc ASCII 15573>7 string A (Directory List) 15574>7 string B (Zaplet) 15575>7 string C (Note) 15576>7 string D (Program) 15577>7 string E (Variable) 15578>7 string F (List) 15579>7 string G (Matrix) 15580>7 string H (Library) 15581>7 string I (Target List) 15582>7 string J (ASCII Vector specification) 15583>7 string K (wildcard) 15584 15585# hpBSD magic numbers 155860 beshort 200 hp200 (68010) BSD 15587>2 beshort 0407 impure binary 15588>2 beshort 0410 read-only binary 15589>2 beshort 0413 demand paged binary 155900 beshort 300 hp300 (68020+68881) BSD 15591>2 beshort 0407 impure binary 15592>2 beshort 0410 read-only binary 15593>2 beshort 0413 demand paged binary 15594# 15595# From David Gero <dgero@nortelnetworks.com> 15596# HP-UX 10.20 core file format from /usr/include/sys/core.h 15597# Unfortunately, HP-UX uses corehead blocks without specifying the order 15598# There are four we care about: 15599# CORE_KERNEL, which starts with the string "HP-UX" 15600# CORE_EXEC, which contains the name of the command 15601# CORE_PROC, which contains the signal number that caused the core dump 15602# CORE_FORMAT, which contains the version of the core file format (== 1) 15603# The only observed order in real core files is KERNEL, EXEC, FORMAT, PROC 15604# but we include all 6 variations of the order of the first 3, and 15605# assume that PROC will always be last 15606# Order 1: KERNEL, EXEC, FORMAT, PROC 156070x10 string HP-UX 15608>0 belong 2 15609>>0xC belong 0x3C 15610>>>0x4C belong 0x100 15611>>>>0x58 belong 0x44 15612>>>>>0xA0 belong 1 15613>>>>>>0xAC belong 4 15614>>>>>>>0xB0 belong 1 15615>>>>>>>>0xB4 belong 4 core file 15616>>>>>>>>>0x90 string >\0 from '%s' 15617>>>>>>>>>0xC4 belong 3 - received SIGQUIT 15618>>>>>>>>>0xC4 belong 4 - received SIGILL 15619>>>>>>>>>0xC4 belong 5 - received SIGTRAP 15620>>>>>>>>>0xC4 belong 6 - received SIGABRT 15621>>>>>>>>>0xC4 belong 7 - received SIGEMT 15622>>>>>>>>>0xC4 belong 8 - received SIGFPE 15623>>>>>>>>>0xC4 belong 10 - received SIGBUS 15624>>>>>>>>>0xC4 belong 11 - received SIGSEGV 15625>>>>>>>>>0xC4 belong 12 - received SIGSYS 15626>>>>>>>>>0xC4 belong 33 - received SIGXCPU 15627>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 15628# Order 2: KERNEL, FORMAT, EXEC, PROC 15629>>>0x4C belong 1 15630>>>>0x58 belong 4 15631>>>>>0x5C belong 1 15632>>>>>>0x60 belong 0x100 15633>>>>>>>0x6C belong 0x44 15634>>>>>>>>0xB4 belong 4 core file 15635>>>>>>>>>0xA4 string >\0 from '%s' 15636>>>>>>>>>0xC4 belong 3 - received SIGQUIT 15637>>>>>>>>>0xC4 belong 4 - received SIGILL 15638>>>>>>>>>0xC4 belong 5 - received SIGTRAP 15639>>>>>>>>>0xC4 belong 6 - received SIGABRT 15640>>>>>>>>>0xC4 belong 7 - received SIGEMT 15641>>>>>>>>>0xC4 belong 8 - received SIGFPE 15642>>>>>>>>>0xC4 belong 10 - received SIGBUS 15643>>>>>>>>>0xC4 belong 11 - received SIGSEGV 15644>>>>>>>>>0xC4 belong 12 - received SIGSYS 15645>>>>>>>>>0xC4 belong 33 - received SIGXCPU 15646>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 15647# Order 3: FORMAT, KERNEL, EXEC, PROC 156480x24 string HP-UX 15649>0 belong 1 15650>>0xC belong 4 15651>>>0x10 belong 1 15652>>>>0x14 belong 2 15653>>>>>0x20 belong 0x3C 15654>>>>>>0x60 belong 0x100 15655>>>>>>>0x6C belong 0x44 15656>>>>>>>>0xB4 belong 4 core file 15657>>>>>>>>>0xA4 string >\0 from '%s' 15658>>>>>>>>>0xC4 belong 3 - received SIGQUIT 15659>>>>>>>>>0xC4 belong 4 - received SIGILL 15660>>>>>>>>>0xC4 belong 5 - received SIGTRAP 15661>>>>>>>>>0xC4 belong 6 - received SIGABRT 15662>>>>>>>>>0xC4 belong 7 - received SIGEMT 15663>>>>>>>>>0xC4 belong 8 - received SIGFPE 15664>>>>>>>>>0xC4 belong 10 - received SIGBUS 15665>>>>>>>>>0xC4 belong 11 - received SIGSEGV 15666>>>>>>>>>0xC4 belong 12 - received SIGSYS 15667>>>>>>>>>0xC4 belong 33 - received SIGXCPU 15668>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 15669# Order 4: EXEC, KERNEL, FORMAT, PROC 156700x64 string HP-UX 15671>0 belong 0x100 15672>>0xC belong 0x44 15673>>>0x54 belong 2 15674>>>>0x60 belong 0x3C 15675>>>>>0xA0 belong 1 15676>>>>>>0xAC belong 4 15677>>>>>>>0xB0 belong 1 15678>>>>>>>>0xB4 belong 4 core file 15679>>>>>>>>>0x44 string >\0 from '%s' 15680>>>>>>>>>0xC4 belong 3 - received SIGQUIT 15681>>>>>>>>>0xC4 belong 4 - received SIGILL 15682>>>>>>>>>0xC4 belong 5 - received SIGTRAP 15683>>>>>>>>>0xC4 belong 6 - received SIGABRT 15684>>>>>>>>>0xC4 belong 7 - received SIGEMT 15685>>>>>>>>>0xC4 belong 8 - received SIGFPE 15686>>>>>>>>>0xC4 belong 10 - received SIGBUS 15687>>>>>>>>>0xC4 belong 11 - received SIGSEGV 15688>>>>>>>>>0xC4 belong 12 - received SIGSYS 15689>>>>>>>>>0xC4 belong 33 - received SIGXCPU 15690>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 15691# Order 5: FORMAT, EXEC, KERNEL, PROC 156920x78 string HP-UX 15693>0 belong 1 15694>>0xC belong 4 15695>>>0x10 belong 1 15696>>>>0x14 belong 0x100 15697>>>>>0x20 belong 0x44 15698>>>>>>0x68 belong 2 15699>>>>>>>0x74 belong 0x3C 15700>>>>>>>>0xB4 belong 4 core file 15701>>>>>>>>>0x58 string >\0 from '%s' 15702>>>>>>>>>0xC4 belong 3 - received SIGQUIT 15703>>>>>>>>>0xC4 belong 4 - received SIGILL 15704>>>>>>>>>0xC4 belong 5 - received SIGTRAP 15705>>>>>>>>>0xC4 belong 6 - received SIGABRT 15706>>>>>>>>>0xC4 belong 7 - received SIGEMT 15707>>>>>>>>>0xC4 belong 8 - received SIGFPE 15708>>>>>>>>>0xC4 belong 10 - received SIGBUS 15709>>>>>>>>>0xC4 belong 11 - received SIGSEGV 15710>>>>>>>>>0xC4 belong 12 - received SIGSYS 15711>>>>>>>>>0xC4 belong 33 - received SIGXCPU 15712>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 15713# Order 6: EXEC, FORMAT, KERNEL, PROC 15714>0 belong 0x100 15715>>0xC belong 0x44 15716>>>0x54 belong 1 15717>>>>0x60 belong 4 15718>>>>>0x64 belong 1 15719>>>>>>0x68 belong 2 15720>>>>>>>0x74 belong 0x2C 15721>>>>>>>>0xB4 belong 4 core file 15722>>>>>>>>>0x44 string >\0 from '%s' 15723>>>>>>>>>0xC4 belong 3 - received SIGQUIT 15724>>>>>>>>>0xC4 belong 4 - received SIGILL 15725>>>>>>>>>0xC4 belong 5 - received SIGTRAP 15726>>>>>>>>>0xC4 belong 6 - received SIGABRT 15727>>>>>>>>>0xC4 belong 7 - received SIGEMT 15728>>>>>>>>>0xC4 belong 8 - received SIGFPE 15729>>>>>>>>>0xC4 belong 10 - received SIGBUS 15730>>>>>>>>>0xC4 belong 11 - received SIGSEGV 15731>>>>>>>>>0xC4 belong 12 - received SIGSYS 15732>>>>>>>>>0xC4 belong 33 - received SIGXCPU 15733>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 15734 15735 15736 15737#------------------------------------------------------------------------------ 15738# $File: human68k,v 1.5 2009/09/19 16:28:09 christos Exp $ 15739# human68k: file(1) magic for Human68k (X680x0 DOS) binary formats 15740# Magic too short! 15741#0 string HU Human68k 15742#>68 string LZX LZX compressed 15743#>>72 string >\0 (version %s) 15744#>(8.L+74) string LZX LZX compressed 15745#>>(8.L+78) string >\0 (version %s) 15746#>60 belong >0 binded 15747#>(8.L+66) string #HUPAIR hupair 15748#>0 string HU X executable 15749#>(8.L+74) string #LIBCV1 - linked PD LIBC ver 1 15750#>4 belong >0 - base address 0x%x 15751#>28 belong >0 not stripped 15752#>32 belong >0 with debug information 15753#0 beshort 0x601a Human68k Z executable 15754#0 beshort 0x6000 Human68k object file 15755#0 belong 0xd1000000 Human68k ar binary archive 15756#0 belong 0xd1010000 Human68k ar ascii archive 15757#0 beshort 0x0068 Human68k lib archive 15758#4 string LZX Human68k LZX compressed 15759#>8 string >\0 (version %s) 15760#>4 string LZX R executable 15761#2 string #HUPAIR Human68k hupair R executable 15762 15763#------------------------------------------------------------------------------ 15764# $File: ibm370,v 1.10 2017/03/17 21:35:28 christos Exp $ 15765# ibm370: file(1) magic for IBM 370 and compatibles. 15766# 15767# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable". 15768# What the heck *is* "USS/370"? 15769# AIX 4.1's "/etc/magic" has 15770# 15771# 0 short 0535 370 sysV executable 15772# >12 long >0 not stripped 15773# >22 short >0 - version %d 15774# >30 long >0 - 5.2 format 15775# 0 short 0530 370 sysV pure executable 15776# >12 long >0 not stripped 15777# >22 short >0 - version %d 15778# >30 long >0 - 5.2 format 15779# 15780# instead of the "USS/370" versions of the same magic numbers. 15781# 157820 beshort 0537 370 XA sysV executable 15783>12 belong >0 not stripped 15784>22 beshort >0 - version %d 15785>30 belong >0 - 5.2 format 157860 beshort 0532 370 XA sysV pure executable 15787>12 belong >0 not stripped 15788>22 beshort >0 - version %d 15789>30 belong >0 - 5.2 format 157900 beshort 054001 370 sysV pure executable 15791>12 belong >0 not stripped 157920 beshort 055001 370 XA sysV pure executable 15793>12 belong >0 not stripped 157940 beshort 056401 370 sysV executable 15795>12 belong >0 not stripped 157960 beshort 057401 370 XA sysV executable 15797>12 belong >0 not stripped 157980 beshort 0531 SVR2 executable (Amdahl-UTS) 15799>12 belong >0 not stripped 15800>24 belong >0 - version %d 158010 beshort 0534 SVR2 pure executable (Amdahl-UTS) 15802>12 belong >0 not stripped 15803>24 belong >0 - version %d 158040 beshort 0530 SVR2 pure executable (USS/370) 15805>12 belong >0 not stripped 15806>24 belong >0 - version %d 158070 beshort 0535 SVR2 executable (USS/370) 15808>12 belong >0 not stripped 15809>24 belong >0 - version %d 15810 15811#------------------------------------------------------------------------------ 15812# $File: ibm6000,v 1.14 2019/03/07 17:21:54 christos Exp $ 15813# ibm6000: file(1) magic for RS/6000 and the RT PC. 15814# 158150 beshort 0x01df executable (RISC System/6000 V3.1) or obj module 15816>12 belong >0 not stripped 15817# Breaks sun4 statically linked execs. 15818#0 beshort 0x0103 executable (RT Version 2) or obj module 15819#>2 byte 0x50 pure 15820#>28 belong >0 not stripped 15821#>6 beshort >0 - version %ld 158220 beshort 0x0104 shared library 158230 beshort 0x0105 ctab data 158240 beshort 0xfe04 structured file 158250 string 0xabcdef AIX message catalog 158260 belong 0x000001f9 AIX compiled message catalog 158270 string \<aiaff> archive 158280 string \<bigaf> archive (big format) 158290 belong 0x09006bea AIX backup/restore format file 158300 belong 0x09006fea AIX backup/restore format file 15831 158320 beshort 0x01f7 64-bit XCOFF executable or object module 15833>20 belong 0 not stripped 15834# GRR: this test is still too general as it catches also many FATs of DOS filesystems 158354 belong &0x0feeddb0 15836# real core dump could not be 32-bit and 64-bit together 15837>7 byte&0x03 !3 AIX core file 15838>>1 byte &0x01 fulldump 15839>>7 byte &0x01 32-bit 15840>>>0x6e0 string >\0 \b, %s 15841>>7 byte &0x02 64-bit 15842>>>0x524 string >\0 \b, %s 15843 15844#------------------------------------------------------------------------------ 15845# $File: icc,v 1.6 2019/11/15 21:03:14 christos Exp $ 15846# icc: file(1) magic for International Color Consortium file formats 15847 15848# 15849# Color profiles as per the ICC's "Image technology colour management - 15850# Architecture, profile format, and data structure" specification. 15851# See 15852# 15853# http://www.color.org/specification/ICC1v43_2010-12.pdf 15854# 15855# for Specification ICC.1:2010 (Profile version 4.3.0.0). 15856# URL: http://fileformats.archiveteam.org/wiki/ICC_profile 15857# Reference: http://www.color.org/iccmax/ICC.2-2016-7.pdf 15858# Update: Joerg Jenderek 15859# 15860# Bytes 36 to 39 contain a generic profile file signature of "acsp"; 15861# bytes 40 to 43 "may be used to identify the primary platform/operating 15862# system framework for which the profile was created". 15863# 15864# check and display ICC/ICM color profile 158650 name color-profile 15866>36 string acsp 15867# skip ASCII like Cognacspirit.txt by month <= 12 15868>>26 ubeshort <13 15869# platform/operating system. Only 5 mentioned 15870 15871# 15872# This appears to be what's used for Apple ColorSync profiles. 15873# Instead of adding that, Apple just changed the generic "acsp" entry 15874# to be for "ColorSync ICC Color Profile" rather than "Kodak Color 15875# Management System, ICC Profile". 15876# Yes, it's "APPL", not "AAPL"; see the spec. 15877>>>40 string APPL ColorSync 15878 15879# Microsoft ICM color profile 15880>>>40 string MSFT Microsoft 15881 15882# Yes, that's a blank after "SGI". 15883>>>40 string SGI\ SGI 15884 15885# XXX - is this what's used for the Sun KCMS or not? The standard file 15886# uses just "acsp" for that, but Apple's file uses it for "ColorSync", 15887# and there *is* an identified "primary platform" value of SUNW. 15888>>>40 string SUNW Sun KCMS 15889 15890# 5th platform 15891>>>40 string TGNT Taligent 15892 15893# remaining "l" "e" of "color profile" printed later to avoid error 15894>>>40 string x color profi 15895#>>>40 string x (%.4s) 15896!:mime application/vnd.iccprofile 15897# for "ICM" extension only versions 2.x and for Kodak "CC" 2.0 is found 15898>>>8 ubyte =2 15899# do not use empty message text to avoid error like 15900# icc, 82: Warning: Current entry does not yet have a description for adding a EXTENSION type 15901# file.exe: could not find any valid magic files! 15902>>>>9 ubyte !0 \ble 15903!:ext icc/icm 15904# minor version 15905>>>>9 ubyte =0 \bl 15906# Kodak colour management system 15907>>>>>4 string =KCMS \be 15908!:ext icc/icm/cc 15909>>>>>4 string !KCMS \be 15910!:ext icc/icm 15911>>>8 ubyte !2 \ble 15912!:ext icc 15913# Profile version major.4bit-minor.sub1.sub2 like 4.3.0.0 (04300000h) 15914>>>8 ubyte x %u 15915>>>9 ubyte/16 x \b.%u 15916# reserved and shall be null but 205.205 in umx1220u.icm 15917>>>10 ubyte >0 \b.%u 15918>>>>11 ubyte >0 \b.%u 15919# preferred colour management module like appl CCMS KCMS Lino UCCM "Win " "FF " 15920# skip space like in brmsl08f.icm and null like in brmsl09f.icm, brmsl07f.icm 15921>>>4 string >\ \b, type %.2s 15922>>>>6 string >\ \b%.1s 15923>>>>>7 string >\ \b%.1s 15924# colour space "XYZ " "Lab " "RGB " CMYK GRAY ... 15925>>>16 string x \b, %.3s 15926>>>19 string >\ \b%.1s 15927# Profile Connection Space (PCS) field usually "XYZ " or "Lab " but sometimes 15928# null or CMYK like in ISOcoated_v2_to_PSOcoated_v3_DeviceLink.icc 15929>>>20 string >\0 \b/%.3s 15930>>>>23 string >\ \b%.1s 15931# eleven device classes 15932>>>12 string x \b-%.4s device 15933# skip 00001964h in hpf69000.icc or 0h in XRDC50Q.ICM or " ROT" in brmsl05f.icm 15934>>>52 string >\040 15935# skip "none" model like in "Trinitron Compatible 9300K G2.2.icm" 15936>>>>52 ubelong !0x6e6f6e65 15937# device manufacturer field like "HP " "IBM " EPSO 15938>>>>>48 string x \b, %.2s 15939>>>>>50 string >\ \b%.1s 15940>>>>>51 string >\ \b%.1s 15941# model like "ADI " "A265" and skip 20000404h in IS330.icm for RICOH RUSSIAN-SC 15942>>>>>52 string >\ \ \b/%.3s 15943>>>>>>55 string >\ \b%.1s 15944>>>>>52 string x model 15945# creator (often same as manufacture) like HP SONY XROX or null like in A925A.icm 15946>>>80 string >\0 by %.2s 15947>>>>82 string >\ \b%.1s 15948>>>>>83 string >\ \b%.1s 15949# profile size 15950>>>0 ubelong x \b, %u bytes 15951# skip invalid date 0 like in linearSRGB.icc 15952>>>24 ubequad !0 15953# datetime dd-mm-yyyy hh:mm:ss 15954>>>>28 ubeshort x \b, %u 15955# month <= 12 15956>>>>26 ubeshort x \b-%u 15957# year 15958>>>>24 ubeshort x \b-%u 15959# do not display midnight time like in CNHP8308.ICC 15960>>>>30 ubequad&0xFFffFFffFFff0000 !0 15961# hour <= 24 15962>>>>>30 ubeshort x %u 15963# minutes <= 59 15964>>>>>32 ubeshort x \b:%.2u 15965# seconds <= 59 15966>>>>>34 ubeshort x \b:%.2u 15967# vendor specific flags like 2 in HPCLJ5.ICM 15968>>>44 ubeshort >0 \b, 0x%x vendor flags 15969# profile flags bits 0-2 of least 16 used by ICC 15970#>>>44 ubelong >0 \b, 0x%x flags 15971# icEmbeddedProfileTrue 15972>>>44 ubelong &1 \b, embedded 15973# icEmbeddedProfileFalse 15974#>>>44 ubelong ^1 \b, not embedded 15975# icUseWithEmbeddedDataOnly 15976>>>44 ubelong &2 \b, dependently 15977# icUseAnywhere 15978#>>>44 ubelong ^2 \b, independently 15979>>>44 ubelong &4 \b, MCS 15980#>>>44 ubelong ^4 \b, no MCS 15981# vendor specific device attributes 1~srgb.icc 15982# E000D00h~CNB7QEDA.ICM C000A00h~CNB5FCAA.ICM 01040401h~CNB25PE3.ICM 15983>>>56 ubelong >0 \b, 0x%x vendor attribute 15984# ICC device attributes bits 0-7 used 15985#>>>60 ubelong x \b, 0x%x attribute 15986# http://www.color.org/icc34.h 15987>>>60 ubelong &0x01 \b, transparent 15988#>>>60 ubelong ^0x01 \b, reflective 15989>>>60 ubelong &0x02 \b, matte 15990#>>>60 ubelong ^0x02 \b, glossy 15991>>>60 ubelong &0x04 \b, negative 15992#>>>60 ubelong ^0x04 \b, positive 15993>>>60 ubelong &0x08 \b, black&white 15994#>>>60 ubelong ^0x08 \b, colour 15995>>>60 ubelong &0x10 \b, non-paper 15996#>>>60 ubelong ^0x10 \b, paper 15997>>>60 ubelong &0x20 \b, non-textured 15998#>>>60 ubelong ^0x20 \b, textured 15999>>>60 ubelong &0x40 \b, non-isotropic 16000#>>>60 ubelong ^0x40 \b, isotropic 16001>>>60 ubelong &0x80 \b, self-luminous 16002#>>>60 ubelong ^0x80 \b, non-self-luminous 16003# rendering intent 0-3 but 7AEA5027h in EE051__1.ICM 6CB1BCh in EE061__1.ICM 16004>>>64 ubelong >3 \b, 0x%x rendering intent 16005#>>>64 ubelong =0 \b, perceptual 16006>>>64 ubelong =1 \b, relative colorimetric 16007>>>64 ubelong =2 \b, saturation 16008>>>64 ubelong =3 \b, absolute colorimetric 16009# PCS illuminant (3*s15Fixed16Numbers) often 0000f6d6 00010000 0000d32d 16010>>>71 ubequad !0xd6000100000000d3 \b, PCS 16011# usually X~0.9642*65536=63189.8112~63190=F6D5h ; but also found 16012# often F6D6 in gt5000r.icm, F6B8 in kodakce.icm, F6CA in RSWOP.icm 16013>>>>68 ubelong !0x0000f6d5 X=0x%x 16014# usually Y=1.0~00010000h but Y=0 in brmsl07f.icm 16015>>>>72 ubelong !0x00010000 Y=0x%x 16016# usually Z~0.8249*65536=54060.6464~54061=D32Dh ; but also found 16017# D2F7 in hp1200c.icm, often D32C in A925A.icm, D309 in RSWOP.icm , D2F8 in kodak_dc.icm 16018>>>>76 ubelong !0x0000d32d Z=0x%x 16019# Profile ID. MD5 fingerprinting method as defined in Internet RFC 1321. 16020>>>84 ubequad >0 \b, 0x%llx MD5 16021# reserved in older versions should be zero but also found CDCDCDCDCDCDCDCD 16022#>>100 ubequad x \b 0x%llx reserved 16023# tag table 16024# 6 <= tags count <= 43 16025#>>>128 ubelong >43 \b, %u tags 16026>>>128 ubelong x 16027# shall contain the profileDescriptionTag "desc" , copyrightTag "cprt" 16028# search range = tags count * 12 -8=< maximal tag count * 12 -8= 43 * 12 -8= 508 16029>>>>132 search/508 cprt 16030# but no copyright tag in linearSRGB.icc 16031# beneath /System/Library/Frameworks/WebKit.framework/ 16032# Versions/A/Frameworks/WebCore.framework/Versions/A/Resources 16033>>>>132 default x \b, no copyright tag 16034# 1st tag 16035#>>>132 string x \b, 1st tag %.4s 16036#>>>136 ubelong x 0x%x offset 16037#>>>140 ubelong x 0x%x len 16038# 2nd tag,... 16039# look also for profileDescriptionTag "desc" 16040>>>132 search/508 desc 16041# look further for TextDescriptionType "desc" signature 16042>>>>(&0.L) string =desc 16043>>>>>&4 pstring/l x "%s" 16044# look alternative for multiLocalizedUnicodeType "mluc" signature like in VideoPAL.icc 16045>>>>(&0.L) string =mluc 16046>>>>>&(&8.L) ubequad x 16047>>>>>>&4 bestring16 x '%s' 16048 16049# Any other profile. 16050# XXX - should we use "acsp\0\0\0\0" for "no primary platform" profiles, 16051# and use "acsp" for everything else and dump the "primary platform" 16052# string in those cases? 1605336 string acsp 16054>0 use color-profile 16055 16056 16057 16058#------------------------------------------------------------------------------ 16059# $File: iff,v 1.14 2015/09/07 10:03:21 christos Exp $ 16060# iff: file(1) magic for Interchange File Format (see also "audio" & "images") 16061# 16062# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic 16063# Arts for file interchange. It has also been used by Apple, SGI, and 16064# especially Commodore-Amiga. 16065# 16066# IFF files begin with an 8 byte FORM header, followed by a 4 character 16067# FORM type, which is followed by the first chunk in the FORM. 16068 160690 string FORM IFF data 16070#>4 belong x \b, FORM is %d bytes long 16071# audio formats 16072>8 string AIFF \b, AIFF audio 16073!:mime audio/x-aiff 16074>8 string AIFC \b, AIFF-C compressed audio 16075!:mime audio/x-aiff 16076>8 string 8SVX \b, 8SVX 8-bit sampled sound voice 16077!:mime audio/x-aiff 16078>8 string 16SV \b, 16SV 16-bit sampled sound voice 16079>8 string SAMP \b, SAMP sampled audio 16080>8 string MAUD \b, MAUD MacroSystem audio 16081>8 string SMUS \b, SMUS simple music 16082>8 string CMUS \b, CMUS complex music 16083# image formats 16084>8 string ILBMBMHD \b, ILBM interleaved image 16085>>20 beshort x \b, %d x 16086>>22 beshort x %d 16087>8 string RGBN \b, RGBN 12-bit RGB image 16088>8 string RGB8 \b, RGB8 24-bit RGB image 16089>8 string DEEP \b, DEEP TVPaint/XiPaint image 16090>8 string DR2D \b, DR2D 2-D object 16091>8 string TDDD \b, TDDD 3-D rendering 16092>8 string LWOB \b, LWOB 3-D object 16093>8 string LWO2 \b, LWO2 3-D object, v2 16094>8 string LWLO \b, LWLO 3-D layered object 16095>8 string REAL \b, REAL Real3D rendering 16096>8 string MC4D \b, MC4D MaxonCinema4D rendering 16097>8 string ANIM \b, ANIM animation 16098>8 string YAFA \b, YAFA animation 16099>8 string SSA\ \b, SSA super smooth animation 16100>8 string ACBM \b, ACBM continuous image 16101>8 string FAXX \b, FAXX fax image 16102# other formats 16103>8 string FTXT \b, FTXT formatted text 16104>8 string CTLG \b, CTLG message catalog 16105>8 string PREF \b, PREF preferences 16106>8 string DTYP \b, DTYP datatype description 16107>8 string PTCH \b, PTCH binary patch 16108>8 string AMFF \b, AMFF AmigaMetaFile format 16109>8 string WZRD \b, WZRD StormWIZARD resource 16110>8 string DOC\ \b, DOC desktop publishing document 16111>8 string WVQA \b, Westwood Studios VQA Multimedia, 16112>>24 leshort x %d video frames, 16113>>26 leshort x %d x 16114>>28 leshort x %d 16115>8 string MOVE \b, Wing Commander III Video 16116>>12 string _PC_ \b, PC version 16117>>12 string 3DO_ \b, 3DO version 16118 16119# These go at the end of the iff rules 16120# 16121# David Griffith <dave@661.org> 16122# I don't see why these might collide with anything else. 16123# 16124# Interactive Fiction related formats 16125# 16126>8 string IFRS \b, Blorb Interactive Fiction 16127>>24 string Exec with executable chunk 16128>8 string IFZS \b, Z-machine or Glulx saved game file (Quetzal) 16129!:mime application/x-blorb 16130 16131#------------------------------------------------------------------------------ 16132# $File: images,v 1.183 2020/06/26 17:08:32 christos Exp $ 16133# images: file(1) magic for image formats (see also "iff", and "c-lang" for 16134# XPM bitmaps) 16135# 16136# originally from jef@helios.ee.lbl.gov (Jef Poskanzer), 16137# additions by janl@ifi.uio.no as well as others. Jan also suggested 16138# merging several one- and two-line files into here. 16139# 16140# little magic: PCX (first byte is 0x0a) 16141 16142# Targa - matches `povray', `ppmtotga' and `xv' outputs 16143# by Philippe De Muyter <phdm@macqel.be> 16144# URL: http://justsolve.archiveteam.org/wiki/TGA 16145# Reference: http://www.dca.fee.unicamp.br/~martino/disciplinas/ea978/tgaffs.pdf 16146# Update: Joerg Jenderek 16147# at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11 16148# ,32 or 33 (both not observed) 16149# at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise 16150# or theoretically 2-128 reserved for use by Truevision or 128-255 may be used for developer applications 16151# at 3, leshort Index is 0 for povray, ppmtotga and xv outputs 16152# `xv' recognizes only a subset of the following (RGB with pixelsize = 24) 16153# `tgatoppm' recognizes a superset (Index may be anything) 16154# 16155# test of Color Map Type 0~no 1~color map 16156# and Image Type 1 2 3 9 10 11 32 33 16157# and Color Map Entry Size 0 15 16 24 32 161580 ubequad&0x00FeC400000000C0 0 16159# Conflict with MPEG sequences. 16160!:strength -40 16161# Prevent conflicts with CRI ADX. 16162>(2.S-2) belong !0x28632943 16163# skip more garbage like *.iso by looking for positive image type 16164>2 ubyte >0 16165# skip some compiled terminfo like xterm+tmux by looking for image type less equal 33 16166>>2 ubyte <34 16167# skip arches.3200 , Finder.Root , Slp.1 by looking for low pixel depth 1 8 15 16 24 32 16168>>>16 ubyte 1 16169>>>>0 use tga-image 16170>>>16 ubyte 8 16171>>>>0 use tga-image 16172>>>16 ubyte 15 16173>>>>0 use tga-image 16174>>>16 ubyte 16 16175>>>>0 use tga-image 16176>>>16 ubyte 24 16177>>>>0 use tga-image 16178>>>16 ubyte 32 16179>>>>0 use tga-image 16180# display tga bitmap image information 161810 name tga-image 16182>2 ubyte <34 Targa image data 16183!:mime image/x-tga 16184!:apple ????TPIC 16185# normal extension .tga but some Truevision products used others: 16186# tpic (Apple),icb (Image Capture Board),vda (Video Display Adapter),vst (NuVista),win (UNSURE about that) 16187!:ext tga/tpic/icb/vda/vst 16188# image type 1 2 3 9 10 11 32 33 16189>2 ubyte&0xF7 1 - Map 16190>2 ubyte&0xF7 2 - RGB 16191# alpha channel 16192>>17 ubyte&0x0F >0 \bA 16193>2 ubyte&0xF7 3 - Mono 16194# type not found, but by http://www.fileformat.info/format/tga/corion.htm 16195# Compressed color-mapped data, using Huffman, Delta, and runlength encoding 16196>2 ubyte 32 - Color 16197# Compressed color-mapped data, using Huffman, Delta, and RLE. 4-pass quadtree- type process 16198>2 ubyte 33 - Color 16199# Color Map Type 0~no 1~color map 16200>1 ubyte 1 ( 16201# first color map entry, 0 normal 16202>>3 uleshort >0 \b%d- 16203# color map length 0 2 1dh 3bh d9h 100h 16204>>5 uleshort x \b%d) 16205# 8~run length encoding bit 16206>2 ubyte&0x08 8 - RLE 16207# gimp can create big pictures! 16208>12 uleshort >0 %d x 16209>12 uleshort =0 65536 x 16210# image height. 0 interpreted as 65536 16211>14 uleshort >0 %d 16212>14 uleshort =0 65536 16213# Image Pixel depth 1 8 15 16 24 32 16214>16 ubyte x x %d 16215# X origin of image. 0 normal 16216>8 uleshort >0 +%d 16217# Y origin of image. 0 normal; positive for top 16218>10 uleshort >0 +%d 16219# Image descriptor: bits 3-0 give the alpha channel depth, bits 5-4 give direction 16220>17 ubyte&0x0F >0 - %d-bit alpha 16221# bits 5-4 give direction. normal bottom left 16222>17 ubyte &0x20 - top 16223#>17 ubyte ^0x20 - bottom 16224>17 ubyte &0x10 - right 16225#>17 ubyte ^0x10 - left 16226# some info say other bits 6-7 should be zero 16227# but data storage interleave by http://www.fileformat.info/format/tga/corion.htm 16228# 00 - no interleave;01 - even/odd interleave; 10 - four way interleave; 11 - reserved 16229#>17 ubyte&0xC0 0x00 - no interleave 16230>17 ubyte&0xC0 0x40 - interleave 16231>17 ubyte&0xC0 0x80 - four way interleave 16232>17 ubyte&0xC0 0xC0 - reserved 16233# positive length implies identification field 16234>0 ubyte >0 16235>>18 string x "%s" 16236# last 18 bytes of newer tga file footer signature 16237>18 search/4261301/s TRUEVISION-XFILE.\0 16238# extension area offset if not 0 16239>>&-8 ulelong >0 16240# length of the extension area. normal 495 for version 2.0 16241>>>(&-4.l) uleshort 0x01EF 16242# AuthorName[41] 16243>>>>&0 string >\0 - author "%-.40s" 16244# Comment[324]=4 * 80 null terminated 16245>>>>&41 string >\0 - comment "%-.80s" 16246# date 16247>>>>&365 ubequad&0xffffFFFFffff0000 !0 16248# Day 16249>>>>>&-6 uleshort x %d 16250# Month 16251>>>>>&-8 uleshort x \b-%d 16252# Year 16253>>>>>&-4 uleshort x \b-%d 16254# time 16255>>>>&371 ubequad&0xffffFFFFffff0000 !0 16256# hour 16257>>>>>&-8 uleshort x %d 16258# minutes 16259>>>>>&-6 uleshort x \b:%.2d 16260# second 16261>>>>>&-4 uleshort x \b:%.2d 16262# JobName[41] 16263>>>>&377 string >\0 - job "%-.40s" 16264# JobHour Jobminute Jobsecond 16265>>>>&418 ubequad&0xffffFFFFffff0000 !0 16266>>>>>&-8 uleshort x %d 16267>>>>>&-6 uleshort x \b:%.2d 16268>>>>>&-4 uleshort x \b:%.2d 16269# SoftwareId[41] 16270>>>>&424 string >\0 - %-.40s 16271# SoftwareVersionNumber 16272>>>>&424 ubyte >0 16273>>>>>&40 uleshort/100 x %d 16274>>>>>&40 uleshort%100 x \b.%d 16275# VersionLetter 16276>>>>>&42 ubyte >0x20 \b%c 16277# KeyColor 16278>>>>&468 ulelong >0 - keycolor 0x%8.8x 16279# Denominator of Pixel ratio. 0~no pixel aspect 16280>>>>&474 uleshort >0 16281# Numerator 16282>>>>>&-4 uleshort >0 - aspect %d 16283>>>>>&-2 uleshort x \b/%d 16284# Denominator of Gamma ratio. 0~no Gamma value 16285>>>>&478 uleshort >0 16286# Numerator 16287>>>>>&-4 uleshort >0 - gamma %d 16288>>>>>&-2 uleshort x \b/%d 16289# ColorOffset 16290#>>>>&480 ulelong x - col offset 0x%8.8x 16291# StampOffset 16292#>>>>&484 ulelong x - stamp offset 0x%8.8x 16293# ScanOffset 16294#>>>>&488 ulelong x - scan offset 0x%8.8x 16295# AttributesType 16296#>>>>&492 ubyte x - Attributes 0x%x 16297## EndOfTGA 16298 16299# PBMPLUS images 16300# The next byte following the magic is always whitespace. 16301# strength is changed to try these patterns before "x86 boot sector" 163020 name netpbm 16303>3 regex/s =[0-9]{1,50}\ [0-9]{1,50} Netpbm image data 16304>>&0 regex =[0-9]{1,50} \b, size = %s x 16305>>>&0 regex =[0-9]{1,50} \b %s 16306 163070 search/1 P1 16308>0 regex/4 P1[\040\t\f\r\n] 16309>>0 use netpbm 16310>>0 string x \b, bitmap 16311!:strength + 65 16312!:mime image/x-portable-bitmap 16313 163140 search/1 P2 16315>0 regex/4 P2[\040\t\f\r\n] 16316>>0 use netpbm 16317>>0 string x \b, greymap 16318!:strength + 65 16319!:mime image/x-portable-greymap 16320 163210 search/1 P3 16322>0 regex/4 P3[\040\t\f\r\n] 16323>>0 use netpbm 16324>>0 string x \b, pixmap 16325!:strength + 65 16326!:mime image/x-portable-pixmap 16327 163280 string P4 16329>0 regex/4 P4[\040\t\f\r\n] 16330>>0 use netpbm 16331>>0 string x \b, rawbits, bitmap 16332!:strength + 65 16333!:mime image/x-portable-bitmap 16334 163350 string P5 16336>0 regex/4 P5[\040\t\f\r\n] 16337>>0 use netpbm 16338>>0 string x \b, rawbits, greymap 16339!:strength + 65 16340!:mime image/x-portable-greymap 16341 163420 string P6 16343>0 regex/4 P6[\040\t\f\r\n] 16344>>0 use netpbm 16345>>0 string x \b, rawbits, pixmap 16346!:strength + 65 16347!:mime image/x-portable-pixmap 16348 163490 string P7 Netpbm PAM image file 16350!:mime image/x-portable-pixmap 16351 16352# From: bryanh@giraffe-data.com (Bryan Henderson) 163530 string \117\072 Solitaire Image Recorder format 16354>4 string \013 MGI Type 11 16355>4 string \021 MGI Type 17 163560 string .MDA MicroDesign data 16357>21 byte 48 version 2 16358>21 byte 51 version 3 163590 string .MDP MicroDesign page data 16360>21 byte 48 version 2 16361>21 byte 51 version 3 16362 16363# NIFF (Navy Interchange File Format, a modification of TIFF) images 16364# [GRR: this *must* go before TIFF] 163650 string IIN1 NIFF image data 16366!:mime image/x-niff 16367 16368# Canon RAW version 1 (CRW) files are a type of Canon Image File Format 16369# (CIFF) file. These are apparently all little-endian. 16370# From: Adam Buchbinder <adam.buchbinder@gmail.com> 16371# URL: https://www.sno.phy.queensu.ca/~phil/exiftool/canon_raw.html 163720 string II\x1a\0\0\0HEAPCCDR Canon CIFF raw image data 16373!:mime image/x-canon-crw 16374>16 leshort x \b, version %d. 16375>14 leshort x \b%d 16376 16377# Canon RAW version 2 (CR2) files are a kind of TIFF with an extra magic 16378# number. Put this above the TIFF test to make sure we detect them. 16379# These are apparently all little-endian. 16380# From: Adam Buchbinder <adam.buchbinder@gmail.com> 16381# URL: https://libopenraw.freedesktop.org/wiki/Canon_CR2 163820 string II\x2a\0\x10\0\0\0CR Canon CR2 raw image data 16383!:mime image/x-canon-cr2 16384!:strength +80 16385>10 byte x \b, version %d. 16386>11 byte x \b%d 16387 16388# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com) 16389# The second word of TIFF files is the TIFF version number, 42, which has 16390# never changed. The TIFF specification recommends testing for it. 163910 string MM\x00\x2a TIFF image data, big-endian 16392!:strength +70 16393!:mime image/tiff 16394>(4.L) use \^tiff_ifd 163950 string II\x2a\x00 TIFF image data, little-endian 16396!:mime image/tiff 16397!:strength +70 16398>(4.l) use tiff_ifd 16399 164000 name tiff_ifd 16401>0 leshort x \b, direntries=%d 16402>2 use tiff_entry 16403 164040 name tiff_entry 16405# NewSubFileType 16406>0 leshort 0xfe 16407>>12 use tiff_entry 16408>0 leshort 0x100 16409>>4 lelong 1 16410>>>12 use tiff_entry 16411>>>8 leshort x \b, width=%d 16412>0 leshort 0x101 16413>>4 lelong 1 16414>>>8 leshort x \b, height=%d 16415>>>12 use tiff_entry 16416>0 leshort 0x102 16417>>8 leshort x \b, bps=%d 16418>>12 use tiff_entry 16419>0 leshort 0x103 16420>>4 lelong 1 \b, compression= 16421>>>8 leshort 1 \bnone 16422>>>8 leshort 2 \bhuffman 16423>>>8 leshort 3 \bbi-level group 3 16424>>>8 leshort 4 \bbi-level group 4 16425>>>8 leshort 5 \bLZW 16426>>>8 leshort 6 \bJPEG (old) 16427>>>8 leshort 7 \bJPEG 16428>>>8 leshort 8 \bdeflate 16429>>>8 leshort 9 \bJBIG, ITU-T T.85 16430>>>8 leshort 0xa \bJBIG, ITU-T T.43 16431>>>8 leshort 0x7ffe \bNeXT RLE 2-bit 16432>>>8 leshort 0x8005 \bPackBits (Macintosh RLE) 16433>>>8 leshort 0x8029 \bThunderscan RLE 16434>>>8 leshort 0x807f \bRasterPadding (CT or MP) 16435>>>8 leshort 0x8080 \bRLE (Line Work) 16436>>>8 leshort 0x8081 \bRLE (High-Res Cont-Tone) 16437>>>8 leshort 0x8082 \bRLE (Binary Line Work) 16438>>>8 leshort 0x80b2 \bDeflate (PKZIP) 16439>>>8 leshort 0x80b3 \bKodak DCS 16440>>>8 leshort 0x8765 \bJBIG 16441>>>8 leshort 0x8798 \bJPEG2000 16442>>>8 leshort 0x8799 \bNikon NEF Compressed 16443>>>8 default x 16444>>>>8 leshort x \b(unknown 0x%x) 16445>>>12 use tiff_entry 16446>0 leshort 0x106 \b, PhotometricIntepretation= 16447>>8 clear x 16448>>8 leshort 0 \bWhiteIsZero 16449>>8 leshort 1 \bBlackIsZero 16450>>8 leshort 2 \bRGB 16451>>8 leshort 3 \bRGB Palette 16452>>8 leshort 4 \bTransparency Mask 16453>>8 leshort 5 \bCMYK 16454>>8 leshort 6 \bYCbCr 16455>>8 leshort 8 \bCIELab 16456>>8 default x 16457>>>8 leshort x \b(unknown=0x%x) 16458>>12 use tiff_entry 16459# FillOrder 16460>0 leshort 0x10a 16461>>4 lelong 1 16462>>>12 use tiff_entry 16463# DocumentName 16464>0 leshort 0x10d 16465>>(8.l) string x \b, name=%s 16466>>>12 use tiff_entry 16467# ImageDescription 16468>0 leshort 0x10e 16469>>(8.l) string x \b, description=%s 16470>>>12 use tiff_entry 16471# Make 16472>0 leshort 0x10f 16473>>(8.l) string x \b, manufacturer=%s 16474>>>12 use tiff_entry 16475# Model 16476>0 leshort 0x110 16477>>(8.l) string x \b, model=%s 16478>>>12 use tiff_entry 16479# StripOffsets 16480>0 leshort 0x111 16481>>12 use tiff_entry 16482# Orientation 16483>0 leshort 0x112 \b, orientation= 16484>>8 leshort 1 \bupper-left 16485>>8 leshort 3 \blower-right 16486>>8 leshort 6 \bupper-right 16487>>8 leshort 8 \blower-left 16488>>8 leshort 9 \bundefined 16489>>8 default x 16490>>>8 leshort x \b[*%d*] 16491>>12 use tiff_entry 16492# XResolution 16493>0 leshort 0x11a 16494>>8 lelong x \b, xresolution=%d 16495>>12 use tiff_entry 16496# YResolution 16497>0 leshort 0x11b 16498>>8 lelong x \b, yresolution=%d 16499>>12 use tiff_entry 16500# ResolutionUnit 16501>0 leshort 0x128 16502>>8 leshort x \b, resolutionunit=%d 16503>>12 use tiff_entry 16504# Software 16505>0 leshort 0x131 16506>>(8.l) string x \b, software=%s 16507>>12 use tiff_entry 16508# Datetime 16509>0 leshort 0x132 16510>>(8.l) string x \b, datetime=%s 16511>>12 use tiff_entry 16512# HostComputer 16513>0 leshort 0x13c 16514>>(8.l) string x \b, hostcomputer=%s 16515>>12 use tiff_entry 16516# WhitePoint 16517>0 leshort 0x13e 16518>>12 use tiff_entry 16519# PrimaryChromaticities 16520>0 leshort 0x13f 16521>>12 use tiff_entry 16522# YCbCrCoefficients 16523>0 leshort 0x211 16524>>12 use tiff_entry 16525# YCbCrPositioning 16526>0 leshort 0x213 16527>>12 use tiff_entry 16528# ReferenceBlackWhite 16529>0 leshort 0x214 16530>>12 use tiff_entry 16531# Copyright 16532>0 leshort 0x8298 16533>>(8.l) string x \b, copyright=%s 16534>>12 use tiff_entry 16535# ExifOffset 16536>0 leshort 0x8769 16537>>12 use tiff_entry 16538# GPS IFD 16539>0 leshort 0x8825 \b, GPS-Data 16540>>12 use tiff_entry 16541 16542#>0 leshort x \b, unknown=0x%x 16543#>>12 use tiff_entry 16544 165450 string MM\x00\x2b Big TIFF image data, big-endian 16546!:mime image/tiff 165470 string II\x2b\x00 Big TIFF image data, little-endian 16548!:mime image/tiff 16549 16550# PNG [Portable Network Graphics, or "PNG's Not GIF"] images 16551# (Greg Roelofs, newt@uchicago.edu) 16552# (Albert Cahalan, acahalan@cs.uml.edu) 16553# 16554# 137 P N G \r \n ^Z \n [4-byte length] I H D R [HEAD data] [HEAD crc] ... 16555# 16556 16557# IHDR parser 165580 name png-ihdr 16559>0 belong x \b, %d x 16560>4 belong x %d, 16561>8 byte x %d-bit 16562>9 byte 0 grayscale, 16563>9 byte 2 \b/color RGB, 16564>9 byte 3 colormap, 16565>9 byte 4 gray+alpha, 16566>9 byte 6 \b/color RGBA, 16567#>10 byte 0 deflate/32K, 16568>12 byte 0 non-interlaced 16569>12 byte 1 interlaced 16570 16571# Standard PNG image. 165720 string \x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x0DIHDR PNG image data 16573!:mime image/png 16574!:ext png 16575!:strength +10 16576>16 use png-ihdr 16577 16578# Apple CgBI PNG image. 165790 string \x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x04CgBI 16580>24 string \x00\x00\x00\x0DIHDR PNG image data (CgBI) 16581!:mime image/png 16582!:ext png 16583!:strength +10 16584>>32 use png-ihdr 16585 16586# possible GIF replacements; none yet released! 16587# (Greg Roelofs, newt@uchicago.edu) 16588# 16589# GRR 950115: this was mine ("Zip GIF"): 165900 string GIF94z ZIF image (GIF+deflate alpha) 16591!:mime image/x-unknown 16592# 16593# GRR 950115: this is Jeremy Wohl's Free Graphics Format (better): 16594# 165950 string FGF95a FGF image (GIF+deflate beta) 16596!:mime image/x-unknown 16597# 16598# GRR 950115: this is Thomas Boutell's Portable Bitmap Format proposal 16599# (best; not yet implemented): 16600# 166010 string PBF PBF image (deflate compression) 16602!:mime image/x-unknown 16603 16604# GIF 16605# Strength set up to beat 0x55AA DOS/MBR signature word lookups (+65) 166060 string GIF8 GIF image data 16607!:strength +80 16608!:mime image/gif 16609!:apple 8BIMGIFf 16610>4 string 7a \b, version 8%s, 16611>4 string 9a \b, version 8%s, 16612>6 leshort >0 %d x 16613>8 leshort >0 %d 16614#>10 byte &0x80 color mapped, 16615#>10 byte&0x07 =0x00 2 colors 16616#>10 byte&0x07 =0x01 4 colors 16617#>10 byte&0x07 =0x02 8 colors 16618#>10 byte&0x07 =0x03 16 colors 16619#>10 byte&0x07 =0x04 32 colors 16620#>10 byte&0x07 =0x05 64 colors 16621#>10 byte&0x07 =0x06 128 colors 16622#>10 byte&0x07 =0x07 256 colors 16623 16624# ITC (CMU WM) raster files. It is essentially a byte-reversed Sun raster, 16625# 1 plane, no encoding. 166260 string \361\0\100\273 CMU window manager raster image data 16627>4 lelong >0 %d x 16628>8 lelong >0 %d, 16629>12 lelong >0 %d-bit 16630 16631# Magick Image File Format 16632# URL: https://imagemagick.org/script/miff.php 16633# Reference: http://fileformats.archiveteam.org/wiki/MIFF 16634# Update: Joerg Jenderek 16635# http://www.nationalarchives.gov.uk/pronom/fmt/930 166360 search/256/bc id=imagemagick 16637# skip bad ASCII text by following new line~0x0A or space~0x20 character 16638#>&0 ubyte x \b, next character 0x%x 16639# called by TriD ImageMagick Machine independent File Format bitmap 16640>&0 ubyte&0xD5 0 MIFF image data 16641# https://reposcope.com/mimetype/image/miff 16642#!:mime image/miff 16643!:mime image/x-miff 16644!:ext miff/mif 16645# examples with standard file(1) magic 16646#>>0 string =id=ImageMagick with standard magic 16647# examples with unusual file(1) magic like 16648>>0 string !id=ImageMagick starting with 16649# start with comment (brace) like http://samples.fileformat.info/.../AQUARIUM.MIF 16650>>>0 ubyte =0x7b comment 16651# skip second character which is often a newline and show comment 16652>>>>2 string x "%s" 16653# does not start with comment, probably letters with other case like Id=ImageMagick 16654# ImageMagick-7.0.9-2/Magick++/demo/smile_anim.miff 16655>>>0 ubyte !0x7b 16656>>>>0 string >\0 '%-.14s' 16657# URL: https://imagemagick.org/ 16658# Reference: https://imagemagick.org/script/magick-vector-graphics.php 16659# From: Joerg Jenderek 16660# Note: all white-spaces between commands are ignored 166610 string push 16662# skip some white spaces 16663>5 search/3 graphic-context ImageMagick Vector Graphic 16664# TODO: look for dangerous commands like CVE-2016-3715 16665#!:mime text/plain 16666!:mime image/x-mvg 16667!:ext mvg 16668 16669# Artisan 166700 long 1123028772 Artisan image data 16671>4 long 1 \b, rectangular 24-bit 16672>4 long 2 \b, rectangular 8-bit with colormap 16673>4 long 3 \b, rectangular 32-bit (24-bit with matte) 16674 16675# FIG (Facility for Interactive Generation of figures), an object-based format 166760 search/1 #FIG FIG image text 16677>5 string x \b, version %.3s 16678 16679# PHIGS 166800 string ARF_BEGARF PHIGS clear text archive 166810 string @(#)SunPHIGS SunPHIGS 16682# version number follows, in the form m.n 16683>40 string SunBin binary 16684>32 string archive archive 16685 16686# GKS (Graphics Kernel System) 166870 string GKSM GKS Metafile 16688>24 string SunGKS \b, SunGKS 16689 16690# CGM image files 166910 string BEGMF clear text Computer Graphics Metafile 16692 16693# MGR bitmaps (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de) 166940 string yz MGR bitmap, modern format, 8-bit aligned 166950 string zz MGR bitmap, old format, 1-bit deep, 16-bit aligned 166960 string xz MGR bitmap, old format, 1-bit deep, 32-bit aligned 166970 string yx MGR bitmap, modern format, squeezed 16698 16699# Fuzzy Bitmap (FBM) images 167000 string %bitmap\0 FBM image data 16701>30 long 0x31 \b, mono 16702>30 long 0x33 \b, color 16703 16704# facsimile data 167051 string PC\ Research,\ Inc group 3 fax data 16706>29 byte 0 \b, normal resolution (204x98 DPI) 16707>29 byte 1 \b, fine resolution (204x196 DPI) 16708# From: Herbert Rosmanith <herp@wildsau.idv.uni.linz.at> 167090 string Sfff structured fax file 16710 16711# From: Joerg Jenderek <joerg.jen.der.ek@gmx.net> 16712# most files with the extension .EPA and some with .BMP 167130 string \x11\x06 Award BIOS Logo, 136 x 84 16714!:mime image/x-award-bioslogo 167150 string \x11\x09 Award BIOS Logo, 136 x 126 16716!:mime image/x-award-bioslogo 16717#0 string \x07\x1f BIOS Logo corrupted? 16718# http://www.blackfiveservices.co.uk/awbmtools.shtml 16719# http://biosgfx.narod.ru/v3/ 16720# http://biosgfx.narod.ru/abr-2/ 167210 string AWBM 16722>4 leshort <1981 Award BIOS bitmap 16723!:mime image/x-award-bmp 16724# image width is a multiple of 4 16725>>4 leshort&0x0003 0 16726>>>4 leshort x \b, %d 16727>>>6 leshort x x %d 16728>>4 leshort&0x0003 >0 \b, 16729>>>4 leshort&0x0003 =1 16730>>>>4 leshort x %d+3 16731>>>4 leshort&0x0003 =2 16732>>>>4 leshort x %d+2 16733>>>4 leshort&0x0003 =3 16734>>>>4 leshort x %d+1 16735>>>6 leshort x x %d 16736# at offset 8 starts imagedata followed by "RGB " marker 16737 16738# PC bitmaps (OS/2, Windows BMP files) (Greg Roelofs, newt@uchicago.edu) 16739# https://en.wikipedia.org/wiki/BMP_file_format#DIB_header_.\ 16740# 28bitmap_information_header.29 16741# Note: variant starting direct with DIB header see 16742# http://fileformats.archiveteam.org/wiki/BMP 16743# verified by ImageMagick version 6.8.9-8 command `identify *.dib` 167440 leshort 40 16745# skip bad samples like GAME by looking for valid number of color planes 16746>12 uleshort 1 Device independent bitmap graphic 16747!:mime image/x-ms-bmp 16748!:apple ????BMPp 16749!:ext dib 16750>>4 lelong x \b, %d x 16751>>8 lelong x %d x 16752>>14 leshort x %d 16753# number of color planes (must be 1) 16754#>>12 uleshort >1 \b, %u color planes 16755# compression method: 0~no 1~RLE 8-bit/pixel 3~Huffman 1D 16756#>>16 ulelong 3 \b, Huffman 1D compression 16757>>16 ulelong >0 \b, %u compression 16758# image size is the size of raw bitmap; a dummy 0 can be given for BI_RGB bitmaps 16759>>20 ulelong x \b, image size %u 16760# horizontal and vertical resolution of the image (pixel per metre, signed integer) 16761>>24 lelong >0 \b, resolution %d x 16762>>>28 lelong x %d px/m 16763# number of colors in palette, or 0 to default to 2**n 16764#>>32 ulelong >0 \b, %u colors 16765# number of important colors used, or 0 when every color is important 16766>>36 ulelong >0 \b, %u important colors 167670 string BM 16768>14 leshort 12 PC bitmap, OS/2 1.x format 16769!:mime image/x-ms-bmp 16770>>18 leshort x \b, %d x 16771>>20 leshort x %d 16772>14 leshort 64 PC bitmap, OS/2 2.x format 16773!:mime image/x-ms-bmp 16774!:apple ????BMPp 16775!:ext bmp 16776# image width and height fields are unsigned integers for OS/2 16777>>18 ulelong x \b, %u x 16778>>22 ulelong x %u 16779# number of bits per pixel (color depth); found 1 4 8 16780>>28 uleshort >1 x %u 16781# x, y coordinates of the hotspot 16782>>6 uleshort >0 \b, hotspot %ux 16783>>>8 uleshort x \b%u 16784>>26 uleshort >1 \b, %u color planes 16785# cbSize; size of file or headers 16786>>2 ulelong x \b, cbSize %u 16787#>>2 ulelong x \b, cbSize 0x%x 16788# offBits; offset to bitmap data like 56h 5Eh 8Eh 43Eh 16789>>10 ulelong x \b, bits offset %u 16790#>>10 ulelong x \b, bits offset 0x%x 16791#>>(10.l) ubequad !0 \b, bits 0x%16.16llx 16792# BITMAPV2INFOHEADER adds RGB bit masks 16793>14 leshort 52 PC bitmap, Adobe Photoshop 16794!:mime image/x-ms-bmp 16795!:apple ????BMPp 16796!:ext bmp 16797>>18 lelong x \b, %d x 16798>>22 lelong x %d x 16799>>28 leshort x %d 16800# BITMAPV3INFOHEADER adds alpha channel bit mask 16801>14 leshort 56 PC bitmap, Adobe Photoshop with alpha channel mask 16802!:mime image/x-ms-bmp 16803!:apple ????BMPp 16804!:ext bmp 16805>>18 lelong x \b, %d x 16806>>22 lelong x %d x 16807>>28 leshort x %d 16808>14 leshort 40 16809# jump 4 bytes before end of file/header to skip fmt-116-signature-id-118.dib 16810>>(2.l-4) ulong x PC bitmap, Windows 3.x format 16811!:mime image/x-ms-bmp 16812!:apple ????BMPp 16813>>>18 lelong x \b, %d x 16814>>>22 lelong x %d 16815# 320 x 400 https://en.wikipedia.org/wiki/LOGO.SYS 16816>>>18 ulequad =0x0000019000000140 x 16817!:ext bmp/sys 16818>>>18 ulequad !0x0000019000000140 16819# compression method 2~RLE 4-bit/pixel implies also extension rle 16820>>>>30 ulelong 2 x 16821!:ext bmp/rle 16822>>>>30 default x x 16823!:ext bmp 16824# number of bits per pixel (color depth); found 1 2 4 8 16 24 32 16825>>>28 leshort x %d 16826# x, y coordinates of the hotspot; there is no hotspot in bitmaps, so values 0 16827#>>>6 uleshort >0 \b, hotspot %ux 16828#>>>>8 uleshort x \b%u 16829# number of color planes (must be 1), except badplanes.bmp for testing 16830#>>>26 uleshort >1 \b, %u color planes 16831# compression method: 0~no 1~RLE 8-bit/pixel 2~RLE 4-bit/pixel 3~Huffman 1D 6~RGBA bit field masks 16832#>>>30 ulelong 3 \b, Huffman 1D compression 16833>>>30 ulelong >0 \b, %u compression 16834# image size is the size of raw bitmap; a dummy 0 can be given for BI_RGB bitmaps 16835>>>34 ulelong >0 \b, image size %u 16836# horizontal and vertical resolution of the image (pixel per metre, signed integer) 16837>>>38 lelong >0 \b, resolution %d x 16838>>>>42 lelong x %d px/m 16839# number of colors in palette 16 256, or 0 to default to 2**n 16840#>>>46 ulelong >0 \b, %u colors 16841# number of important colors used, or 0 when every color is important 16842>>>50 ulelong >0 \b, %u important colors 16843# cbSize; often size of file 16844>>>2 ulelong x \b, cbSize %u 16845#>>>2 ulelong x \b, cbSize 0x%x 16846# offBits; offset to bitmap data like 36h 76h BEh 236h 406h 436h 4E6h 16847>>>10 ulelong x \b, bits offset %u 16848#>>>10 ulelong x \b, bits offset 0x%x 16849#>>>(10.l) ubequad !0 \b, bits 0x%16.16llxd 16850>14 leshort 124 PC bitmap, Windows 98/2000 and newer format 16851!:mime image/x-ms-bmp 16852>>18 lelong x \b, %d x 16853>>22 lelong x %d x 16854>>28 leshort x %d 16855>14 leshort 108 PC bitmap, Windows 95/NT4 and newer format 16856!:mime image/x-ms-bmp 16857>>18 lelong x \b, %d x 16858>>22 lelong x %d x 16859>>28 leshort x %d 16860>14 leshort 128 PC bitmap, Windows NT/2000 format 16861!:mime image/x-ms-bmp 16862>>18 lelong x \b, %d x 16863>>22 lelong x %d x 16864>>28 leshort x %d 16865# Update: Joerg Jenderek 16866# URL: http://fileformats.archiveteam.org/wiki/OS/2_Icon 16867# Reference: http://www.fileformat.info 16868# /format/os2bmp/spec/902d5c253f2a43ada39c2b81034f27fd/view.htm 16869# Note: verified by command like `deark -l -d3 OS2MEMU.ICO` 168700 string IC 16871# skip Lotus smart icon *.smi by looking for valid hotspot coordinates 16872>6 ulelong&0xFF00FF00 =0 OS/2 icon 16873# jump 4 bytes before end of header/file and test for accessibility 16874#>>(2.l-4) ubelong x End of header is OK! 16875!:mime image/x-os2-ico 16876!:ext ico 16877# cbSize; size of header or file in bytes like 1ah 120h 420h 16878>>2 ulelong x \b, cbSize %u 16879# xHotspot, yHotspot; coordinates of the hotspot for icons like 16 32 16880>>6 uleshort x \b, hotspot %ux 16881>>8 uleshort x \b%u 16882# offBits; offset in bytes to the beginning of the bit-map pel data like 20h 16883>>10 ulelong x \b, bits offset %u 16884#>>(10.l) ubequad x \b, bits 0x%16.16llx 16885#0 string PI PC pointer image data 16886#0 string CI PC color icon data 168870 string CI 16888# test also for valid dib header sizes 12 or 64 16889>14 ulelong <65 OS/2 16890# test also for valid hotspot coordinates 16891#>>6 ulelong&0xFE00FE00 =0 OS/2 16892!:mime image/x-os2-ico 16893!:ext ico 16894>>14 ulelong 12 1.x color icon 16895# image width and height fields are unsigned integers for OS/2 16896>>>18 uleshort x %u x 16897# stored height = 2 * real height 16898>>>20 uleshort/2 x %u 16899# number of bits per pixel (color depth). Typical 32 24 16 8 4 but only 1 found 16900>>>24 uleshort >1 x %u 16901# color planes; must be 1 16902#>>>22 uleshort >1 \b, %u color planes 16903>>14 ulelong 64 2.x color icon 16904# image width and height 16905>>>18 ulelong x %u x 16906# stored height = 2 * real height 16907>>>22 ulelong/2 x %u 16908# number of bits per pixel (color depth). only 1 found 16909>>>28 uleshort >1 x %u 16910#>>>26 uleshort >1 \b, %u color planes 16911# compression method: 0~no 3~Huffman 1D 16912>>>30 ulelong 3 \b, Huffman 1D compression 16913#>>>30 ulelong >0 \b, %u compression 16914# xHotspot, yHotspot; coordinates of the hotspot like 0 1 16 20 32 33 63 64 16915>>6 uleshort x \b, hotspot %ux 16916>>8 uleshort x \b%u 16917# cbSize; size of header or maybe file in bytes like 1Ah 4Eh 84Eh 16918>>2 ulelong x \b, cbSize %u 16919#>>2 ulelong x \b, cbSize %x 16920# offBits; offset to bitmap data (pixel array) like E4h 3Ah 66h 6Ah 33Ah 4A4h 16921>>10 ulelong x \b, bits offset %u 16922#>>10 ulelong x \b, bits offset 0x%x 16923#>>(10.l) ubequad !0 \b, bits 0x%16.16llx 16924# dib header size: 12~Ch~OS/2 1.x 64~40h~OS/2 2.x 16925#>>14 ulelong x \b, dib header size %u 16926#0 string CP PC color pointer image data 16927# URL: http://fileformats.archiveteam.org/wiki/OS/2_Pointer 16928# Reference: http://www.fileformat.info/format/os2bmp/egff.htm 169290 string CP 16930# skip CPU-Z Report by checking for valid dib header sizes 12 or 64 16931>14 ulelong <65 OS/2 16932# http://extension.nirsoft.net/PTR 16933!:mime image/x-ibm-pointer 16934!:ext ptr 16935>>14 ulelong 12 1.x color pointer 16936# image width and height fields are unsigned integers for OS/2 16937>>>18 uleshort x %u x 16938# stored height = 2 * real height 16939>>>20 uleshort/2 x %u 16940# number of bits per pixel (color depth). Typical 32 24 16 8 4 but only 1 found 16941>>>24 uleshort >1 x %u 16942# color planes; must be 1 16943#>>>22 uleshort >1 \b, %u color planes 16944>>14 ulelong 64 2.x color pointer 16945# image width and height 16946>>>18 ulelong x %u x 16947# stored height = 2 * real height 16948>>>22 ulelong/2 x %u 16949# number of bits per pixel (color depth). only 1 found 16950>>>28 uleshort >1 x %u 16951#>>>26 uleshort >1 \b, %u color planes 16952# compression method: 0~no 3~Huffman 1D 16953>>>30 ulelong 3 \b, Huffman 1D compression 16954#>>>30 ulelong >0 \b, %u compression 16955# xHotspot, yHotspot; coordinates of the hotspot like 0 3 4 8 15 16 23 27 31 16956>>6 uleshort x \b, hotspot %ux 16957>>8 uleshort x \b%u 16958# cbSize; size of header or maybe file in bytes like 1Ah 4Eh 16959>>2 ulelong x \b, cbSize %u 16960#>>2 ulelong x \b, cbSize %x 16961# offBits; offset to bitmap data (pixel array) like 6Ah A4h E4h 4A4h 16962>>10 ulelong x \b, bits offset %u 16963#>>10 ulelong x \b, bits offset 0x%x 16964#>>(10.l) ubequad !0 \b, bits 0x%16.16llx 16965# dib header size: 12~Ch~OS/2 1.x 64~40h~OS/2 2.x 16966#>>14 ulelong x \b, dib header size %u 16967# Conflicts with other entries [BABYL] 16968# URL: http://fileformats.archiveteam.org/wiki/BMP#OS.2F2_Bitmap_Array 16969# Note: container for OS/2 icon "IC", color icon "CI", color pointer "CP" or bitmap "BM" 16970#0 string BA PC bitmap array data 169710 string BA 16972# skip old Emacs RMAIL BABYL ./mail.news by checking for low header size 16973>2 ulelong <0x004c5942 OS/2 graphic array 16974!:mime image/x-os2-graphics 16975#!:apple ????BMPf 16976# cbSize; size of header like 28h 5Ch 16977>>2 ulelong x \b, cbSize %u 16978#>>2 ulelong x \b, cbSize 0x%x 16979# offNext; offset to data like 0 48h F2h 4Eh 64h C6h D2h D6h DAh E6h EAh 348h 16980>>6 ulelong >0 \b, data offset %u 16981#>>6 ulelong >0 \b, data offset 0x%x 16982#>>(6.l) ubequad !0 \b, data 0x%16.16llx 16983# dimensions of the intended device like 640 x 480 for VGA or 1024 x 768 16984>>10 uleshort >0 \b, display %u 16985>>>12 uleshort >0 x %u 16986# usType of first array element 16987#>>14 string x \b, usType %2.2s 16988# 1 space char after "1st" 16989# no *.bga examples found https://www.openwith.org/file-extensions/bga/1342 16990>>14 string BM \b; 1st 16991!:ext bmp/bga 16992>>14 string CI \b; 1st 16993!:ext ico 16994>>14 string CP \b; 1st 16995!:ext ico 16996>>14 string IC \b; 1st 16997!:ext ico 16998# no white-black pointer found 16999#>>14 string PT \b; 1st 17000#!:ext 17001>>14 indirect x 17002 17003# XPM icons (Greg Roelofs, newt@uchicago.edu) 170040 search/1 /*\ XPM\ */ X pixmap image text 17005!:mime image/x-xpmi 17006 17007# Utah Raster Toolkit RLE images (janl@ifi.uio.no) 170080 leshort 0xcc52 RLE image data, 17009>6 leshort x %d x 17010>8 leshort x %d 17011>2 leshort >0 \b, lower left corner: %d 17012>4 leshort >0 \b, lower right corner: %d 17013>10 byte&0x1 =0x1 \b, clear first 17014>10 byte&0x2 =0x2 \b, no background 17015>10 byte&0x4 =0x4 \b, alpha channel 17016>10 byte&0x8 =0x8 \b, comment 17017>11 byte >0 \b, %d color channels 17018>12 byte >0 \b, %d bits per pixel 17019>13 byte >0 \b, %d color map channels 17020 17021# image file format (Robert Potter, potter@cs.rochester.edu) 170220 string Imagefile\ version- iff image data 17023# this adds the whole header (inc. version number), informative but longish 17024>10 string >\0 %s 17025 17026# Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com) 170270 belong 0x59a66a95 Sun raster image data 17028>4 belong >0 \b, %d x 17029>8 belong >0 %d, 17030>12 belong >0 %d-bit, 17031#>16 belong >0 %d bytes long, 17032>20 belong 0 old format, 17033#>20 belong 1 standard, 17034>20 belong 2 compressed, 17035>20 belong 3 RGB, 17036>20 belong 4 TIFF, 17037>20 belong 5 IFF, 17038>20 belong 0xffff reserved for testing, 17039>24 belong 0 no colormap 17040>24 belong 1 RGB colormap 17041>24 belong 2 raw colormap 17042#>28 belong >0 colormap is %d bytes long 17043 17044# SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com) 17045# 17046# See 17047# http://reality.sgi.com/grafica/sgiimage.html 17048# 170490 beshort 474 SGI image data 17050#>2 byte 0 \b, verbatim 17051>2 byte 1 \b, RLE 17052#>3 byte 1 \b, normal precision 17053>3 byte 2 \b, high precision 17054>4 beshort x \b, %d-D 17055>6 beshort x \b, %d x 17056>8 beshort x %d 17057>10 beshort x \b, %d channel 17058>10 beshort !1 \bs 17059>80 string >0 \b, "%s" 17060 170610 string IT01 FIT image data 17062>4 belong x \b, %d x 17063>8 belong x %d x 17064>12 belong x %d 17065# 170660 string IT02 FIT image data 17067>4 belong x \b, %d x 17068>8 belong x %d x 17069>12 belong x %d 17070# 170712048 string PCD_IPI Kodak Photo CD image pack file 17072>0xe02 byte&0x03 0x00 , landscape mode 17073>0xe02 byte&0x03 0x01 , portrait mode 17074>0xe02 byte&0x03 0x02 , landscape mode 17075>0xe02 byte&0x03 0x03 , portrait mode 170760 string PCD_OPA Kodak Photo CD overview pack file 17077 17078# FITS format. Jeff Uphoff <juphoff@tarsier.cv.nrao.edu> 17079# FITS is the Flexible Image Transport System, the de facto standard for 17080# data and image transfer, storage, etc., for the astronomical community. 17081# (FITS floating point formats are big-endian.) 170820 string SIMPLE\ \ = FITS image data 17083!:mime image/fits 17084!:ext fits/fts 17085>109 string 8 \b, 8-bit, character or unsigned binary integer 17086>108 string 16 \b, 16-bit, two's complement binary integer 17087>107 string \ 32 \b, 32-bit, two's complement binary integer 17088>107 string -32 \b, 32-bit, floating point, single precision 17089>107 string -64 \b, 64-bit, floating point, double precision 17090 17091# other images 170920 string This\ is\ a\ BitMap\ file Lisp Machine bit-array-file 17093 17094# From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image 17095# stuff. 17096# 170970 beshort 0x1010 PEX Binary Archive 17098 17099# DICOM medical imaging data 17100# URL: https://en.wikipedia.org/wiki/DICOM#Data_format 17101# Note: "dcm" is the official file name extension 17102# XnView mention also "dc3" and "acr" as file name extension 17103128 string DICM DICOM medical imaging data 17104!:mime application/dicom 17105!:ext dcm/dicom/dic 17106 17107# XWD - X Window Dump file. 17108# As described in /usr/X11R6/include/X11/XWDFile.h 17109# used by the xwd program. 17110# Bradford Castalia, idaeim, 1/01 17111# updated by Adam Buchbinder, 2/09 17112# The following assumes version 7 of the format; the first long is the length 17113# of the header, which is at least 25 4-byte longs, and the one at offset 8 17114# is a constant which is always either 1 or 2. Offset 12 is the pixmap depth, 17115# which is a maximum of 32. 171160 belong >100 17117>8 belong <3 17118>>12 belong <33 17119>>>4 belong 7 XWD X Window Dump image data 17120!:mime image/x-xwindowdump 17121>>>>100 string >\0 \b, "%s" 17122>>>>16 belong x \b, %dx 17123>>>>20 belong x \b%dx 17124>>>>12 belong x \b%d 17125 17126# PDS - Planetary Data System 17127# These files use Parameter Value Language in the header section. 17128# Unfortunately, there is no certain magic, but the following 17129# strings have been found to be most likely. 171300 string NJPL1I00 PDS (JPL) image data 171312 string NJPL1I PDS (JPL) image data 171320 string CCSD3ZF PDS (CCSD) image data 171332 string CCSD3Z PDS (CCSD) image data 171340 string PDS_ PDS image data 171350 string LBLSIZE= PDS (VICAR) image data 17136 17137# pM8x: ATARI STAD compressed bitmap format 17138# 17139# from Oskar Schirmer <schirmer@scara.com> Feb 2, 2001 17140# p M 8 5/6 xx yy zz data... 17141# Atari ST STAD bitmap is always 640x400, bytewise runlength compressed. 17142# bytes either run horizontally (pM85) or vertically (pM86). yy is the 17143# most frequent byte, xx and zz are runlength escape codes, where xx is 17144# used for runs of yy. 17145# 171460 string pM85 Atari ST STAD bitmap image data (hor) 17147>5 byte 0x00 (white background) 17148>5 byte 0xFF (black background) 171490 string pM86 Atari ST STAD bitmap image data (vert) 17150>5 byte 0x00 (white background) 17151>5 byte 0xFF (black background) 17152 17153# From: Alex Myczko <alex@aiei.ch> 17154# https://www.atarimax.com/jindroush.atari.org/afmtatr.html 171550 leshort 0x0296 Atari ATR image 17156 17157# XXX: 17158# This is bad magic 0x5249 == 'RI' conflicts with RIFF and other 17159# magic. 17160# SGI RICE image file <mpruett@sgi.com> 17161#0 beshort 0x5249 RICE image 17162#>2 beshort x v%d 17163#>4 beshort x (%d x 17164#>6 beshort x %d) 17165#>8 beshort 0 8 bit 17166#>8 beshort 1 10 bit 17167#>8 beshort 2 12 bit 17168#>8 beshort 3 13 bit 17169#>10 beshort 0 4:2:2 17170#>10 beshort 1 4:2:2:4 17171#>10 beshort 2 4:4:4 17172#>10 beshort 3 4:4:4:4 17173#>12 beshort 1 RGB 17174#>12 beshort 2 CCIR601 17175#>12 beshort 3 RP175 17176#>12 beshort 4 YUV 17177 17178# PCX image files 17179# From: Dan Fandrich <dan@coneharvesters.com> 17180# updated by Joerg Jenderek at Feb 2013 by https://de.wikipedia.org/wiki/PCX 17181# https://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt 17182# GRR: original test was still too general as it catches xbase examples T5.DBT,T6.DBT with 0xa000000 17183# test for bytes 0x0a,version byte (0,2,3,4,5),compression byte flag(0,1), bit depth (>0) of PCX or T5.DBT,T6.DBT 171840 ubelong&0xffF8fe00 0x0a000000 17185# for PCX bit depth > 0 17186>3 ubyte >0 17187# test for valid versions 17188>>1 ubyte <6 17189>>>1 ubyte !1 PCX 17190!:mime image/x-pcx 17191#!:mime image/pcx 17192>>>>1 ubyte 0 ver. 2.5 image data 17193>>>>1 ubyte 2 ver. 2.8 image data, with palette 17194>>>>1 ubyte 3 ver. 2.8 image data, without palette 17195>>>>1 ubyte 4 for Windows image data 17196>>>>1 ubyte 5 ver. 3.0 image data 17197>>>>4 uleshort x bounding box [%d, 17198>>>>6 uleshort x %d] - 17199>>>>8 uleshort x [%d, 17200>>>>10 uleshort x %d], 17201>>>>65 ubyte >1 %d planes each of 17202>>>>3 ubyte x %d-bit 17203>>>>68 byte 1 colour, 17204>>>>68 byte 2 grayscale, 17205# this should not happen 17206>>>>68 default x image, 17207>>>>12 leshort >0 %d x 17208>>>>>14 uleshort x %d dpi, 17209>>>>2 byte 0 uncompressed 17210>>>>2 byte 1 RLE compressed 17211 17212# Adobe Photoshop 17213# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 172140 string 8BPS Adobe Photoshop Image 17215!:mime image/vnd.adobe.photoshop 17216>4 beshort 2 (PSB) 17217>18 belong x \b, %d x 17218>14 belong x %d, 17219>24 beshort 0 bitmap 17220>24 beshort 1 grayscale 17221>>12 beshort 2 with alpha 17222>24 beshort 2 indexed 17223>24 beshort 3 RGB 17224>>12 beshort 4 \bA 17225>24 beshort 4 CMYK 17226>>12 beshort 5 \bA 17227>24 beshort 7 multichannel 17228>24 beshort 8 duotone 17229>24 beshort 9 lab 17230>12 beshort > 1 17231>>12 beshort x \b, %dx 17232>12 beshort 1 \b, 17233>22 beshort x %d-bit channel 17234>12 beshort > 1 \bs 17235 17236# XV thumbnail indicator (ThMO) 172370 string P7\ 332 XV thumbnail image data 17238 17239# NITF is defined by United States MIL-STD-2500A 172400 string NITF National Imagery Transmission Format 17241>25 string >\0 dated %.14s 17242 17243# GEM Image: Version 1, Headerlen 8 (Wolfram Kleff) 17244# Format variations from: Bernd Nuernberger <bernd.nuernberger@web.de> 17245# Update: Joerg Jenderek 17246# See http://fileformats.archiveteam.org/wiki/GEM_Raster 17247# For variations, also see: 17248# https://www.seasip.info/Gem/ff_img.html (Ventura) 17249# http://www.atari-wiki.com/?title=IMG_file (XIMG, STTT) 17250# http://www.fileformat.info/format/gemraster/spec/index.htm (XIMG, STTT) 17251# http://sylvana.net/1stguide/1STGUIDE.ENG (TIMG) 172520 beshort 0x0001 17253# header_size 17254>2 beshort 0x0008 17255>>0 use gem_info 17256>2 beshort 0x0009 17257>>0 use gem_info 17258# no example for NOSIG 17259>2 beshort 24 17260>>0 use gem_info 17261# no example for HYPERPAINT 17262>2 beshort 25 17263>>0 use gem_info 1726416 string XIMG\0 17265>0 use gem_info 17266# no example 1726716 string STTT\0\x10 17268>0 use gem_info 17269# no example or description 1727016 string TIMG\0 17271>0 use gem_info 17272 172730 name gem_info 17274# version is 2 for some XIMG and 1 for all others 17275>0 beshort <0x0003 GEM 17276# https://www.snowstone.org.uk/riscos/mimeman/mimemap.txt 17277!:mime image/x-gem 17278# header_size 24 25 27 59 779 words for colored bitmaps 17279>>2 beshort >9 17280>>>16 string STTT\0\x10 STTT 17281>>>16 string TIMG\0 TIMG 17282# HYPERPAINT or NOSIG variant 17283>>>16 string \0\x80 17284>>>>2 beshort =24 NOSIG 17285>>>>2 beshort !24 HYPERPAINT 17286# NOSIG or XIMG variant 17287>>>16 default x 17288>>>>16 string !XIMG\0 NOSIG 17289>>16 string =XIMG\0 XIMG Image data 17290!:ext img/ximg 17291# to avoid Warning: Current entry does not yet have a description for adding a EXTENSION type 17292>>16 string !XIMG\0 Image data 17293!:ext img 17294# header_size is 9 for Ventura files and 8 for other GEM Paint files 17295>>2 beshort 9 (Ventura) 17296#>>2 beshort 8 (Paint) 17297>>12 beshort x %d x 17298>>14 beshort x %d, 17299# 1 4 8 17300>>4 beshort x %d planes, 17301# in tenths of a millimetre 17302>>8 beshort x %d x 17303>>10 beshort x %d pixelsize 17304# pattern_size 1-8. 2 for GEM Paint 17305>>6 beshort !2 \b, pattern size %d 17306 17307# GEM Metafile (Wolfram Kleff) 173080 lelong 0x0018FFFF GEM Metafile data 17309>4 leshort x version %d 17310 17311# 17312# SMJPEG. A custom Motion JPEG format used by Loki Entertainment 17313# Software Torbjorn Andersson <d91tan@Update.UU.SE>. 17314# 173150 string \0\nSMJPEG SMJPEG 17316>8 belong x %d.x data 17317# According to the specification you could find any number of _TXT 17318# headers here, but I can't think of any way of handling that. None of 17319# the SMJPEG files I tried it on used this feature. Even if such a 17320# file is encountered the output should still be reasonable. 17321>16 string _SND \b, 17322>>24 beshort >0 %d Hz 17323>>26 byte 8 8-bit 17324>>26 byte 16 16-bit 17325>>28 string NONE uncompressed 17326# >>28 string APCM ADPCM compressed 17327>>27 byte 1 mono 17328>>28 byte 2 stereo 17329# Help! Isn't there any way to avoid writing this part twice? 17330>>32 string _VID \b, 17331# >>>48 string JFIF JPEG 17332>>>40 belong >0 %d frames 17333>>>44 beshort >0 (%d x 17334>>>46 beshort >0 %d) 17335>16 string _VID \b, 17336# >>32 string JFIF JPEG 17337>>24 belong >0 %d frames 17338>>28 beshort >0 (%d x 17339>>30 beshort >0 %d) 17340 173410 string Paint\ Shop\ Pro\ Image\ File Paint Shop Pro Image File 17342 17343# "thumbnail file" (icon) 17344# descended from "xv", but in use by other applications as well (Wolfram Kleff) 173450 string P7\ 332 XV "thumbnail file" (icon) data 17346 17347# taken from fkiss: (<yav@mte.biglobe.ne.jp> ?) 173480 string KiSS KISS/GS 17349>4 byte 16 color 17350>>5 byte x %d bit 17351>>8 leshort x %d colors 17352>>10 leshort x %d groups 17353>4 byte 32 cell 17354>>5 byte x %d bit 17355>>8 leshort x %d x 17356>>10 leshort x %d 17357>>12 leshort x +%d 17358>>14 leshort x +%d 17359 17360# Webshots (www.webshots.com), by John Harrison 173610 string C\253\221g\230\0\0\0 Webshots Desktop .wbz file 17362 17363# Hercules DASD image files 17364# From Jan Jaeger <jj@septa.nl> 173650 string CKD_P370 Hercules CKD DASD image file 17366>8 long x \b, %d heads per cylinder 17367>12 long x \b, track size %d bytes 17368>16 byte x \b, device type 33%2.2X 17369 173700 string CKD_C370 Hercules compressed CKD DASD image file 17371>8 long x \b, %d heads per cylinder 17372>12 long x \b, track size %d bytes 17373>16 byte x \b, device type 33%2.2X 17374 173750 string CKD_S370 Hercules CKD DASD shadow file 17376>8 long x \b, %d heads per cylinder 17377>12 long x \b, track size %d bytes 17378>16 byte x \b, device type 33%2.2X 17379 17380# Squeak images and programs - etoffi@softhome.net 173810 string \146\031\0\0 Squeak image data 173820 search/1 'From\040Squeak Squeak program text 17383 17384# partimage: file(1) magic for PartImage files (experimental, incomplete) 17385# Author: Hans-Joachim Baader <hjb@pro-linux.de> 173860 string PaRtImAgE-VoLuMe PartImage 17387>0x0020 string 0.6.1 file version %s 17388>>0x0060 lelong >-1 volume %d 17389#>>0x0064 8 byte identifier 17390#>>0x007c reserved 17391>>0x0200 string >\0 type %s 17392>>0x1400 string >\0 device %s, 17393>>0x1600 string >\0 original filename %s, 17394# Some fields omitted 17395>>0x2744 lelong 0 not compressed 17396>>0x2744 lelong 1 gzip compressed 17397>>0x2744 lelong 2 bzip2 compressed 17398>>0x2744 lelong >2 compressed with unknown algorithm 17399>0x0020 string >0.6.1 file version %s 17400>0x0020 string <0.6.1 file version %s 17401 17402# DCX is multi-page PCX, using a simple header of up to 1024 17403# offsets for the respective PCX components. 17404# From: Joerg Wunsch <joerg_wunsch@uriah.heep.sax.de> 174050 lelong 987654321 DCX multi-page PCX image data 17406 17407# Simon Walton <simonw@matteworld.com> 17408# Kodak Cineon format for scanned negatives 17409# http://www.kodak.com/US/en/motion/support/dlad/ 174100 lelong 0xd75f2a80 Cineon image data 17411>200 belong >0 \b, %d x 17412>204 belong >0 %d 17413 17414 17415# Bio-Rad .PIC is an image format used by microscope control systems 17416# and related image processing software used by biologists. 17417# From: Vebjorn Ljosa <vebjorn@ljosa.com> 17418# BOOL values are two-byte integers; use them to rule out false positives. 17419# https://web.archive.org/web/20050317223257/www.cs.ubc.ca/spider/ladic/text/biorad.txt 17420# Samples: https://www.loci.wisc.edu/software/sample-data 1742114 leshort <2 17422>62 leshort <2 17423>>54 leshort 12345 Bio-Rad .PIC Image File 17424>>>0 leshort >0 %d x 17425>>>2 leshort >0 %d, 17426>>>4 leshort =1 1 image in file 17427>>>4 leshort >1 %d images in file 17428 17429# From Jan "Yenya" Kasprzak <kas@fi.muni.cz> 17430# The description of *.mrw format can be found at 17431# http://www.dalibor.cz/minolta/raw_file_format.htm 174320 string \000MRM Minolta Dimage camera raw image data 17433 17434# Summary: DjVu image / document 17435# Extension: .djvu 17436# Reference: http://djvu.org/docs/DjVu3Spec.djvu 17437# Submitted by: Stephane Loeuillet <stephane.loeuillet@tiscali.fr> 17438# Modified by (1): Abel Cheung <abelcheung@gmail.com> 174390 string AT&TFORM 17440>12 string DJVM DjVu multiple page document 17441!:mime image/vnd.djvu 17442>12 string DJVU DjVu image or single page document 17443!:mime image/vnd.djvu 17444>12 string DJVI DjVu shared document 17445!:mime image/vnd.djvu 17446>12 string THUM DjVu page thumbnails 17447!:mime image/vnd.djvu 17448 17449# Originally by Marc Espie 17450# Modified by Robert Minsk <robertminsk at yahoo.com> 17451# https://www.openexr.com/openexrfilelayout.pdf 174520 lelong 20000630 OpenEXR image data, 17453!:mime image/x-exr 17454>4 lelong&0x000000ff x version %d, 17455>4 lelong ^0x00000200 storage: scanline 17456>4 lelong &0x00000200 storage: tiled 17457>8 search/0x1000 compression\0 \b, compression: 17458>>&16 byte 0 none 17459>>&16 byte 1 rle 17460>>&16 byte 2 zips 17461>>&16 byte 3 zip 17462>>&16 byte 4 piz 17463>>&16 byte 5 pxr24 17464>>&16 byte 6 b44 17465>>&16 byte 7 b44a 17466>>&16 byte 8 dwaa 17467>>&16 byte 9 dwab 17468>>&16 byte >9 unknown 17469>8 search/0x1000 dataWindow\0 \b, dataWindow: 17470>>&10 lelong x (%d 17471>>&14 lelong x %d)- 17472>>&18 lelong x \b(%d 17473>>&22 lelong x %d) 17474>8 search/0x1000 displayWindow\0 \b, displayWindow: 17475>>&10 lelong x (%d 17476>>&14 lelong x %d)- 17477>>&18 lelong x \b(%d 17478>>&22 lelong x %d) 17479>8 search/0x1000 lineOrder\0 \b, lineOrder: 17480>>&14 byte 0 increasing y 17481>>&14 byte 1 decreasing y 17482>>&14 byte 2 random y 17483>>&14 byte >2 unknown 17484 17485# SMPTE Digital Picture Exchange Format, SMPTE DPX 17486# 17487# ANSI/SMPTE 268M-1994, SMPTE Standard for File Format for Digital 17488# Moving-Picture Exchange (DPX), v1.0, 18 February 1994 17489# Robert Minsk <robertminsk at yahoo.com> 17490# Modified by Harry Mallon <hjmallon at gmail.com> 174910 string SDPX DPX image data, big-endian, 17492!:mime image/x-dpx 17493>0 use dpx_info 174940 string XPDS DPX image data, little-endian, 17495!:mime image/x-dpx 17496>0 use \^dpx_info 17497 174980 name dpx_info 17499>768 beshort <4 17500>>772 belong x %dx 17501>>776 belong x \b%d, 17502>768 beshort >3 17503>>776 belong x %dx 17504>>772 belong x \b%d, 17505>768 beshort 0 left to right/top to bottom 17506>768 beshort 1 right to left/top to bottom 17507>768 beshort 2 left to right/bottom to top 17508>768 beshort 3 right to left/bottom to top 17509>768 beshort 4 top to bottom/left to right 17510>768 beshort 5 top to bottom/right to left 17511>768 beshort 6 bottom to top/left to right 17512>768 beshort 7 bottom to top/right to left 17513 17514# From: Tom Hilinski <tom.hilinski@comcast.net> 17515# https://www.unidata.ucar.edu/packages/netcdf/ 175160 string CDF\001 NetCDF Data Format data 17517# 64-bit offset netcdf Classic https://www.unidata.ucar.edu/software/netcdf/docs/file_format_specifications 175180 string CDF\002 NetCDF Data Format data (64-bit offset) 17519 17520#----------------------------------------------------------------------- 17521# Hierarchical Data Format, used to facilitate scientific data exchange 17522# specifications at http://hdf.ncsa.uiuc.edu/ 175230 belong 0x0e031301 Hierarchical Data Format (version 4) data 17524!:mime application/x-hdf 175250 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) data 17526!:mime application/x-hdf 17527512 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 512 bytes user block 17528!:mime application/x-hdf 175291024 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 1k user block 17530!:mime application/x-hdf 175312048 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 2k user block 17532!:mime application/x-hdf 175334096 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 4k user block 17534!:mime application/x-hdf 17535 17536 17537# From: Tobias Burnus <burnus@net-b.de> 17538# Xara (for a while: Corel Xara) is a graphic package, see 17539# http://www.xara.com/ for Windows and as GPL application for Linux 175400 string XARA\243\243 Xara graphics file 17541 17542# https://www.cartesianinc.com/Tech/ 175430 string CPC\262 Cartesian Perceptual Compression image 17544!:mime image/x-cpi 17545 17546# From Albert Cahalan <acahalan@gmail.com> 17547# puredigital used it for the CVS disposable camcorder 17548#8 lelong 4 ZBM bitmap image data 17549#>4 leshort x %u x 17550#>6 leshort x %u 17551 17552# From Albert Cahalan <acahalan@gmail.com> 17553# uncompressed 5:6:5 HighColor image for OLPC XO firmware icons 175540 string C565 OLPC firmware icon image data 17555>4 leshort x %u x 17556>6 leshort x %u 17557 17558# Applied Images - Image files from Cytovision 17559# Gustavo Junior Alves <gjalves@gjalves.com.br> 175600 string \xce\xda\xde\xfa Cytovision Metaphases file 175610 string \xed\xad\xef\xac Cytovision Karyotype file 175620 string \x0b\x00\x03\x00 Cytovision FISH Probe file 175630 string \xed\xfe\xda\xbe Cytovision FLEX file 175640 string \xed\xab\xed\xfe Cytovision FLEX file 175650 string \xad\xfd\xea\xad Cytovision RATS file 17566 17567# Wavelet Scalar Quantization format used in gray-scale fingerprint images 17568# From Tano M Fotang <mfotang@quanteq.com> 175690 string \xff\xa0\xff\xa8\x00 Wavelet Scalar Quantization image data 17570 17571# Type: PCO B16 image files 17572# URL: http://www.pco.de/fileadmin/user_upload/db/download/MA_CWDCOPIE_0412b.pdf 17573# From: Florian Philipp <florian.philipp@binarywings.net> 17574# Extension: .b16 17575# Description: Pixel image format produced by PCO Camware, typically used 17576# together with PCO cameras. 17577# Note: Different versions exist for e.g. 8 bit and 16 bit images. 17578# Documentation is incomplete. 175790 string/b PCO- PCO B16 image data 17580>12 lelong x \b, %dx 17581>16 lelong x \b%d 17582>20 lelong 0 \b, short header 17583>20 lelong -1 \b, extended header 17584>>24 lelong 0 \b, grayscale 17585>>>36 lelong 0 linear LUT 17586>>>36 lelong 1 logarithmic LUT 17587>>>28 lelong x [%d 17588>>>32 lelong x \b,%d] 17589>>24 lelong 1 \b, color 17590>>>64 lelong 0 linear LUT 17591>>>64 lelong 1 logarithmic LUT 17592>>>40 lelong x r[%d 17593>>>44 lelong x \b,%d] 17594>>>48 lelong x g[%d 17595>>>52 lelong x \b,%d] 17596>>>56 lelong x b[%d 17597>>>60 lelong x \b,%d] 17598 17599# Polar Monitor Bitmap (.pmb) used as logo for Polar Electro watches 17600# From: Markus Heidelberg <markus.heidelberg at web.de> 176010 string/t [BitmapInfo2] Polar Monitor Bitmap text 17602!:mime image/x-polar-monitor-bitmap 17603 17604# From: Rick Richardson <rickrich@gmail.com> 17605# updated by: Joerg Jenderek 17606# URL: http://techmods.net/nuvi/ 176070 string GARMIN\ BITMAP\ 01 Garmin Bitmap file 17608# extension is also used for 17609# Sony SRF raw image (image/x-sony-srf) 17610# SRF map 17611# Terragen Surface Map (https://www.planetside.co.uk/terragen) 17612# FileLocator Pro search criteria file (https://www.mythicsoft.com/filelocatorpro) 17613!:ext srf 17614#!:mime image/x-garmin-srf 17615# version 1.00,2.00,2.10,2.40,2.50 17616>0x2f string >0 \b, version %4.4s 17617# width (2880,2881,3240) 17618>0x55 uleshort >0 \b, %dx 17619# height (80,90) 17620>>0x53 uleshort x \b%d 17621 17622# Type: Ulead Photo Explorer5 (.pe5) 17623# URL: http://www.jisyo.com/cgibin/view.cgi?EXT=pe5 (Japanese) 17624# From: Simon Horman <horms@debian.org> 176250 string IIO2H Ulead Photo Explorer5 17626 17627# Type: X11 cursor 17628# URL: http://webcvs.freedesktop.org/mime/shared-mime-info/freedesktop.org.xml.in?view=markup 17629# From: Mathias Brodala <info@noctus.net> 176300 string Xcur X11 cursor 17631 17632# Type: Olympus ORF raw images. 17633# URL: https://libopenraw.freedesktop.org/wiki/Olympus_ORF 17634# From: Adam Buchbinder <adam.buchbinder@gmail.com> 176350 string MMOR Olympus ORF raw image data, big-endian 17636!:mime image/x-olympus-orf 176370 string IIRO Olympus ORF raw image data, little-endian 17638!:mime image/x-olympus-orf 176390 string IIRS Olympus ORF raw image data, little-endian 17640!:mime image/x-olympus-orf 17641 17642# Type: files used in modern AVCHD camcoders to store clip information 17643# Extension: .cpi 17644# From: Alexander Danilov <alexander.a.danilov@gmail.com> 176450 string HDMV0100 AVCHD Clip Information 17646 17647# From: Adam Buchbinder <adam.buchbinder@gmail.com> 17648# URL: http://local.wasp.uwa.edu.au/~pbourke/dataformats/pic/ 17649# Radiance HDR; usually has .pic or .hdr extension. 176500 string #?RADIANCE\n Radiance HDR image data 17651#!mime image/vnd.radiance 17652 17653# From: Adam Buchbinder <adam.buchbinder@gmail.com> 17654# URL: https://www.mpi-inf.mpg.de/resources/pfstools/pfs_format_spec.pdf 17655# Used by the pfstools packages. The regex matches for the image size could 17656# probably use some work. The MIME type is made up; if there's one in 17657# actual common use, it should replace the one below. 176580 string PFS1\x0a PFS HDR image data 17659#!mime image/x-pfs 17660>1 regex [0-9]*\ \b, %s 17661>>1 regex \ [0-9]{4} \bx%s 17662 17663# Type: Foveon X3F 17664# URL: https://www.photofo.com/downloads/x3f-raw-format.pdf 17665# From: Adam Buchbinder <adam.buchbinder@gmail.com> 17666# Note that the MIME type isn't defined anywhere that I can find; if 17667# there's a canonical type for this format, it should replace this one. 176680 string FOVb Foveon X3F raw image data 17669!:mime image/x-x3f 17670>6 leshort x \b, version %d. 17671>4 leshort x \b%d 17672>28 lelong x \b, %dx 17673>32 lelong x \b%d 17674 17675# Paint.NET file 17676# From Adam Buchbinder <adam.buchbinder@gmail.com> 176770 string PDN3 Paint.NET image data 17678!:mime image/x-paintnet 17679 17680# Not really an image. 17681# From: "Tano M. Fotang" <mfotang@quanteq.com> 176820 string \x46\x4d\x52\x00 ISO/IEC 19794-2 Format Minutiae Record (FMR) 17683 17684# doc: https://www.shikino.co.jp/eng/products/images/FLOWER.jpg.zip 17685# example: https://www.shikino.co.jp/eng/products/images/FLOWER.wdp.zip 1768690 bequad 0x574D50484F544F00 JPEG-XR Image 17687>98 byte&0x08 =0x08 \b, hard tiling 17688>99 byte&0x80 =0x80 \b, tiling present 17689>99 byte&0x40 =0x40 \b, codestream present 17690>99 byte&0x38 x \b, spatial xform= 17691>99 byte&0x38 0x00 \bTL 17692>99 byte&0x38 0x08 \bBL 17693>99 byte&0x38 0x10 \bTR 17694>99 byte&0x38 0x18 \bBR 17695>99 byte&0x38 0x20 \bBT 17696>99 byte&0x38 0x28 \bRB 17697>99 byte&0x38 0x30 \bLT 17698>99 byte&0x38 0x38 \bLB 17699>100 byte&0x80 =0x80 \b, short header 17700>>102 beshort+1 x \b, %d 17701>>104 beshort+1 x \bx%d 17702>100 byte&0x80 =0x00 \b, long header 17703>>102 belong+1 x \b, %x 17704>>106 belong+1 x \bx%x 17705>101 beshort&0xf x \b, bitdepth= 17706>>101 beshort&0xf 0x0 \b1-WHITE=1 17707>>101 beshort&0xf 0x1 \b8 17708>>101 beshort&0xf 0x2 \b16 17709>>101 beshort&0xf 0x3 \b16-SIGNED 17710>>101 beshort&0xf 0x4 \b16-FLOAT 17711>>101 beshort&0xf 0x5 \b(reserved 5) 17712>>101 beshort&0xf 0x6 \b32-SIGNED 17713>>101 beshort&0xf 0x7 \b32-FLOAT 17714>>101 beshort&0xf 0x8 \b5 17715>>101 beshort&0xf 0x9 \b10 17716>>101 beshort&0xf 0xa \b5-6-5 17717>>101 beshort&0xf 0xb \b(reserved %d) 17718>>101 beshort&0xf 0xc \b(reserved %d) 17719>>101 beshort&0xf 0xd \b(reserved %d) 17720>>101 beshort&0xf 0xe \b(reserved %d) 17721>>101 beshort&0xf 0xf \b1-BLACK=1 17722>101 beshort&0xf0 x \b, colorfmt= 17723>>101 beshort&0xf0 0x00 \bYONLY 17724>>101 beshort&0xf0 0x10 \bYUV240 17725>>101 beshort&0xf0 0x20 \bYWV422 17726>>101 beshort&0xf0 0x30 \bYWV444 17727>>101 beshort&0xf0 0x40 \bCMYK 17728>>101 beshort&0xf0 0x50 \bCMYKDIRECT 17729>>101 beshort&0xf0 0x60 \bNCOMPONENT 17730>>101 beshort&0xf0 0x70 \bRGB 17731>>101 beshort&0xf0 0x80 \bRGBE 17732>>101 beshort&0xf0 >0x80 \b(reserved 0x%x) 17733 17734# From: Johan van der Knijff <johan.vanderknijff@kb.nl> 17735# 17736# BPG (Better Portable Graphics) format 17737# https://bellard.org/bpg/ 17738# http://fileformats.archiveteam.org/wiki/BPG 17739# 177400 string \x42\x50\x47\xFB BPG (Better Portable Graphics) 17741!:mime image/bpg 17742 17743# From: Joerg Jenderek 17744# URL: https://en.wikipedia.org/wiki/Apple_Icon_Image_format 177450 string icns Mac OS X icon 17746!:mime image/x-icns 17747!:apple ????icns 17748!:ext icns 17749>4 ubelong >0 17750# file size 17751>>4 ubelong x \b, %d bytes 17752# icon type 17753>>8 string x \b, "%4.4s" type 17754 17755# TIM images 177560 lelong 0x00000010 TIM image, 17757>4 lelong 0x8 4-Bit, 17758>4 lelong 0x9 8-Bit, 17759>4 lelong 0x2 15-Bit, 17760>4 lelong 0x3 24-Bit, 17761>4 lelong &8 17762>>(8.l+12) leshort x Pixel at (%d, 17763>>(8.l+14) leshort x \b%d) 17764>>(8.l+16) leshort x Size=%dx 17765>>(8.l+18) leshort x \b%d, 17766>>4 lelong 0x8 16 CLUT Entries at 17767>>4 lelong 0x9 256 CLUT Entries at 17768>>12 leshort x (%d, 17769>>14 leshort x \b%d) 17770>4 lelong ^8 17771>>12 leshort x Pixel at (%d, 17772>>14 leshort x \b%d) 17773>>16 leshort x Size=%dx 17774>>18 leshort x \b%d 17775 17776# MDEC streams 177770 lelong 0x80010160 MDEC video stream, 17778>16 leshort x %dx 17779>18 leshort x \b%d 17780#>8 lelong x %d frames 17781#>4 leshort x secCount=%d; 17782#>6 leshort x nSectors=%d; 17783#>12 lelong x frameSize=%d; 17784 17785# BS encoded bitstreams 177862 leshort 0x3800 BS image, 17787>6 leshort x Version %d, 17788>4 leshort x Quantization %d, 17789>0 leshort x (Decompresses to %d words) 17790 17791# Type: farbfeld image. 17792# Url: http://tools.suckless.org/farbfeld/ 17793# From: Ian D. Scott <ian@iandouglasscott.com> 17794# 177950 string farbfeld farbfeld image data, 17796>8 ubelong x %dx 17797>12 ubelong x \b%d 17798 17799# Type: Microsoft DirectDraw Surface (common data) 17800# URL: https://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp 17801# From: Morten Hustveit <morten@debian.org> 17802# Updated by: David Korth <gerbilsoft@gerbilsoft.com> 178030 name ms-directdraw-surface 17804>0x10 ulelong x %u x 17805>0x0C ulelong x %u 17806# Color depth. 17807>0x58 ulelong >0 \b, %u-bit color 17808# Determine the pixel format. 17809>0x50 ulelong&0x4 4 17810# FIXME: Handle DX10 and XBOX formats. 17811>>0x54 string x \b, compressed using %.4s 17812>0x50 ulelong&0x2 0x2 \b, alpha only 17813>0x50 ulelong&0x200 0x200 \b, YUV 17814>0x50 ulelong&0x20000 0x20000 \b, luminance 17815# RGB pixel format 17816>0x50 ulelong&0x40 0x40 17817 17818# Determine the RGB format using the color masks. 17819# ulequad order: 0xGGGGGGGGRRRRRRRR, 0xAAAAAAAABBBBBBBB 17820 17821>>0x58 ulelong 16 17822 17823# NOTE: 15-bit color formats usually have 16-bit listed as the color depth. 17824>>>0x5C ulequad 0x000003E000007C00 17825>>>>0x64 ulequad 0x000000000000001F \b, RGB555 17826>>>0x5C ulequad 0x000003E000001F00 17827>>>>0x64 ulequad 0x000000000000007C \b, BGR555 17828 17829>>>0x5C ulequad 0x000007E00000F800 17830>>>>0x64 ulequad 0x000000000000001F \b, RGB565 17831>>>0x5C ulequad 0x000007E000001F00 17832>>>>0x64 ulequad 0x00000000000000F8 \b, BGR565 17833 17834>>>0x5C ulequad 0x000000F000000F00 17835>>>>0x64 ulequad 0x0000F0000000000F \b, ARGB4444 17836>>>0x5C ulequad 0x000000F00000000F 17837>>>>0x64 ulequad 0x0000F00000000F00 \b, ABGR4444 17838 17839>>>0x5C ulequad 0x00000F000000F000 17840>>>>0x64 ulequad 0x0000000F000000F0 \b, RGBA4444 17841>>>0x5C ulequad 0x00000F00000000F0 17842>>>>0x64 ulequad 0x0000000F0000F000 \b, BGRA4444 17843 17844>>>0x5C ulequad 0x000000F000000F00 17845>>>>0x64 ulequad 0x000000000000000F \b, xRGB4444 17846>>>0x5C ulequad 0x000000F00000000F 17847>>>>0x64 ulequad 0x0000000000000F00 \b, xBGR4444 17848 17849>>>0x5C ulequad 0x00000F000000F000 17850>>>>0x64 ulequad 0x00000000000000F0 \b, RGBx4444 17851>>>0x5C ulequad 0x00000F00000000F0 17852>>>>0x64 ulequad 0x000000000000F000 \b, BGRx4444 17853 17854>>>0x5C ulequad 0x000003E000007C00 17855>>>>0x64 ulequad 0x000080000000001F \b, ARGB1555 17856>>>0x5C ulequad 0x000003E000001F00 17857>>>>0x64 ulequad 0x000080000000007C \b, ABGR1555 17858>>>0x5C ulequad 0x000007C00000F800 17859>>>>0x64 ulequad 0x000000010000003E \b, RGBA5551 17860>>>0x5C ulequad 0x000007C00000003E 17861>>>>0x64 ulequad 0x000000010000F800 \b, BGRA5551 17862 17863>>88 ulelong 24 17864>>>0x5C ulequad 0x0000FF0000FF0000 17865>>>>0x64 ulequad 0x00000000000000FF \b, RGB888 17866>>>0x5C ulequad 0x0000FF00000000FF 17867>>>>0x64 ulequad 0x0000000000FF0000 \b, BGR888 17868 17869>>88 ulelong 32 17870>>>0x5C ulequad 0x0000FF0000FF0000 17871>>>>0x64 ulequad 0xFF000000000000FF \b, ARGB8888 17872>>>0x5C ulequad 0x0000FF00000000FF 17873>>>>0x64 ulequad 0xFF00000000FF0000 \b, ABGR8888 17874 17875>>>0x5C ulequad 0x00FF0000FF000000 17876>>>>0x64 ulequad 0x000000FF0000FF00 \b, RGBA8888 17877>>>0x5C ulequad 0x00FF00000000FF00 17878>>>>0x64 ulequad 0x000000FFFF000000 \b, BGBA8888 17879 17880>>>0x5C ulequad 0x0000FF0000FF0000 17881>>>>0x64 ulequad 0x00000000000000FF \b, xRGB8888 17882>>>0x5C ulequad 0x0000FF00000000FF 17883>>>>0x64 ulequad 0x0000000000FF0000 \b, xBGR8888 17884 17885>>>0x5C ulequad 0x00FF0000FF000000 17886>>>>0x64 ulequad 0x000000000000FF00 \b, RGBx8888 17887>>>0x5C ulequad 0x00FF00000000FF00 17888>>>>0x64 ulequad 0x00000000FF000000 \b, BGBx8888 17889 17890# Less common 32-bit color formats. 17891>>>0x5C ulequad 0xFFFF00000000FFFF 17892>>>>0x64 ulequad 0x0000000000000000 \b, G16R16 17893>>>0x5C ulequad 0x0000FFFFFFFF0000 17894>>>>0x64 ulequad 0x0000000000000000 \b, R16G16 17895 17896>>>0x5C ulequad 0x000FFC003FF00000 17897>>>>0x64 ulequad 0xC0000000000003FF \b, A2R10G10B10 17898>>>0x5C ulequad 0x000FFC00000003FF 17899>>>>0x64 ulequad 0xC00000003FF00000 \b, A2B10G10R10 17900 17901# Type: Microsoft DirectDraw Surface 17902# URL: https://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp 17903# From: Morten Hustveit <morten@debian.org> 17904# Updated by: David Korth <gerbilsoft@gerbilsoft.com> 179050 string/b DDS\040\174\000\000\000 Microsoft DirectDraw Surface (DDS): 17906>0 use ms-directdraw-surface 17907 17908# Type: Sega PVR image. 17909# From: David Korth <gerbilsoft@gerbilsoft.com> 17910# References: 17911# - https://fabiensanglard.net/Mykaruga/tools/segaPVRFormat.txt 17912# - https://github.com/yazgoo/pvrx2png 17913# - https://github.com/nickworonekin/puyotools 17914 17915# Sega PVR header. 179160 name sega-pvr-image-header 17917>0x0C leshort x %u x 17918>0x0E leshort x %u 17919# Image format. 17920>0x08 byte 0 \b, ARGB1555 17921>0x08 byte 1 \b, RGB565 17922>0x08 byte 2 \b, ARGB4444 17923>0x08 byte 3 \b, YUV442 17924>0x08 byte 4 \b, Bump 17925>0x08 byte 5 \b, 4bpp 17926>0x08 byte 6 \b, 8bpp 17927# Image data type. 17928>0x09 byte 0x01 \b, square twiddled 17929>0x09 byte 0x02 \b, square twiddled & mipmap 17930>0x09 byte 0x03 \b, VQ 17931>0x09 byte 0x04 \b, VQ & mipmap 17932>0x09 byte 0x05 \b, 8-bit CLUT twiddled 17933>0x09 byte 0x06 \b, 4-bit CLUT twiddled 17934>0x09 byte 0x07 \b, 8-bit direct twiddled 17935>0x09 byte 0x08 \b, 4-bit direct twiddled 17936>0x09 byte 0x09 \b, rectangle 17937>0x09 byte 0x0B \b, rectangular stride 17938>0x09 byte 0x0D \b, rectangular twiddled 17939>0x09 byte 0x10 \b, small VQ 17940>0x09 byte 0x11 \b, small VQ & mipmap 17941>0x09 byte 0x12 \b, square twiddled & mipmap 17942 17943# Sega PVR image. 179440 string PVRT 17945>0x10 string DDS\040\174\000\000\000 Sega PVR (Xbox) image: 17946>>0x20 use ms-directdraw-surface 17947>0x10 belong !0x44445320 Sega PVR image: 17948>>0 use sega-pvr-image-header 17949 17950# Sega PVR image with GBIX. 179510 string GBIX 17952>0x10 string PVRT 17953>>0x10 string DDS\040\174\000\000\000 Sega PVR (Xbox) image: 17954>>>0x20 use ms-directdraw-surface 17955>>0x10 belong !0x44445320 Sega PVR image: 17956>>>0x10 use sega-pvr-image-header 17957>>0x08 lelong x \b, global index = %u 17958 17959# Sega GVR header. 179600 name sega-gvr-image-header 17961>0x0C beshort x %u x 17962>0x0E beshort x %u 17963# Image data format. 17964>0x0B byte 0 \b, I4 17965>0x0B byte 1 \b, I8 17966>0x0B byte 2 \b, IA4 17967>0x0B byte 3 \b, IA8 17968>0x0B byte 4 \b, RGB565 17969>0x0B byte 5 \b, RGB5A3 17970>0x0B byte 6 \b, ARGB8888 17971>0x0B byte 8 \b, CI4 17972>0x0B byte 9 \b, CI8 17973>0x0B byte 14 \b, DXT1 17974 17975# Sega GVR image. 179760 string GVRT Sega GVR image: 17977>0x10 use sega-gvr-image-header 17978 17979# Sega GVR image with GBIX. 179800 string GBIX 17981>0x10 string GVRT Sega GVR image: 17982>>0x10 use sega-gvr-image-header 17983>>0x08 belong x \b, global index = %u 17984 17985# Sega GVR image with GCIX. (Wii) 179860 string GCIX 17987>0x10 string GVRT Sega GVR image: 17988>>0x10 use sega-gvr-image-header 17989>>0x08 belong x \b, global index = %u 17990 17991# Light Field Picture 17992# Documentation: http://optics.miloush.net/lytro/TheFileFormat.aspx 17993# Typical file extensions: .lfp .lfr .lfx 17994 179950 belong 0x894C4650 17996>4 belong 0x0D0A1A0A 17997>12 belong 0x00000000 Lytro Light Field Picture 17998>8 belong x \b, version %d 17999 18000# Type: Vision Research Phantom CINE Format 18001# URL: https://www.phantomhighspeed.com/ 18002# URL2: http://phantomhighspeed.force.com/vriknowledge/servlet/fileField?id=0BEU0000000Cfyk 18003# From: Harry Mallon <hjmallon at gmail.com> 18004# 18005# This has a short "CI" code but the 44 is the size of the struct which is 18006# stable 180070 string CI 18008>2 leshort 44 Vision Research CINE Video, 18009>>4 leshort 0 Grayscale, 18010>>4 leshort 1 JPEG Compressed, 18011>>4 leshort 2 RAW, 18012>>6 leshort x version %d, 18013>>20 lelong x %d frames, 18014>>48 lelong x %dx 18015>>52 lelong x \b%d 18016 18017# Type: ARRI Raw Image 18018# Info: SMPTE RDD30:2014 18019# From: Harry Mallon <hjmallon at gmail.com> 180200 string ARRI ARRI ARI image data, 18021>4 lelong 0x78563412 little-endian, 18022>4 lelong 0x12345678 big-endian, 18023>12 lelong x version %d, 18024>20 lelong x %dx 18025>24 lelong x \b%d 18026 18027# Type: Khronos KTX texture. 18028# From: David Korth <gerbilsoft@gerbilsoft.com> 18029# Reference: https://www.khronos.org/opengles/sdk/tools/KTX/file_format_spec/ 18030 18031# glEnum decoding. 18032# NOTE: Only the most common formats are listed here. 180330 name khronos-ktx-glEnum 18034>0 lelong 0x1907 \b, RGB 18035>0 lelong 0x1908 \b, RGBA 18036>0 lelong 0x1909 \b, LUMINANCE 18037>0 lelong 0x190A \b, LUMINANCE_ALPHA 18038>0 lelong 0x80E1 \b, BGR 18039>0 lelong 0x80E2 \b, BGRA 18040>0 lelong 0x83A0 \b, RGB_S3TC 18041>0 lelong 0x83A1 \b, RGB4_S3TC 18042>0 lelong 0x83A2 \b, RGBA_S3TC 18043>0 lelong 0x83A3 \b, RGBA4_S3TC 18044>0 lelong 0x83A4 \b, RGBA_DXT5_S3TC 18045>0 lelong 0x83A5 \b, RGBA4_DXT5_S3TC 18046>0 lelong 0x83F0 \b, COMPRESSED_RGB_S3TC_DXT1_EXT 18047>0 lelong 0x83F1 \b, COMPRESSED_RGBA_S3TC_DXT1_EXT 18048>0 lelong 0x83F2 \b, COMPRESSED_RGBA_S3TC_DXT3_EXT 18049>0 lelong 0x83F3 \b, COMPRESSED_RGBA_S3TC_DXT5_EXT 18050>0 lelong 0x8D64 \b, ETC1_RGB8_OES 18051>0 lelong 0x9270 \b, COMPRESSED_R11_EAC 18052>0 lelong 0x9271 \b, COMPRESSED_SIGNED_R11_EAC 18053>0 lelong 0x9272 \b, COMPRESSED_RG11_EAC 18054>0 lelong 0x9273 \b, COMPRESSED_SIGNED_RG11_EAC 18055>0 lelong 0x9274 \b, COMPRESSED_RGB8_ETC2 18056>0 lelong 0x9275 \b, COMPRESSED_SRGB8_ETC2 18057>0 lelong 0x9276 \b, COMPRESSED_RGB8_PUNCHTHROUGH_ALPHA1_ETC2 18058>0 lelong 0x9277 \b, COMPRESSED_SRGB8_PUNCHTHROUGH_ALPHA1_ETC2 18059>0 lelong 0x9278 \b, COMPRESSED_RGBA2_ETC2_EAC 18060>0 lelong 0x9279 \b, COMPRESSED_SRGB8_ALPHA8_ETC2_EAC 18061>0 lelong 0x93B0 \b, COMPRESSED_RGBA_ASTC_4x4_KHR 18062>0 lelong 0x93B1 \b, COMPRESSED_RGBA_ASTC_5x4_KHR 18063>0 lelong 0x93B2 \b, COMPRESSED_RGBA_ASTC_5x5_KHR 18064>0 lelong 0x93B3 \b, COMPRESSED_RGBA_ASTC_6x5_KHR 18065>0 lelong 0x93B4 \b, COMPRESSED_RGBA_ASTC_6x6_KHR 18066>0 lelong 0x93B5 \b, COMPRESSED_RGBA_ASTC_8x5_KHR 18067>0 lelong 0x93B6 \b, COMPRESSED_RGBA_ASTC_8x6_KHR 18068>0 lelong 0x93B7 \b, COMPRESSED_RGBA_ASTC_8x8_KHR 18069>0 lelong 0x93B8 \b, COMPRESSED_RGBA_ASTC_10x5_KHR 18070>0 lelong 0x93B9 \b, COMPRESSED_RGBA_ASTC_10x6_KHR 18071>0 lelong 0x93BA \b, COMPRESSED_RGBA_ASTC_10x8_KHR 18072>0 lelong 0x93BB \b, COMPRESSED_RGBA_ASTC_10x10_KHR 18073>0 lelong 0x93BC \b, COMPRESSED_RGBA_ASTC_12x10_KHR 18074>0 lelong 0x93BD \b, COMPRESSED_RGBA_ASTC_12x12_KHR 18075>0 lelong 0x93D0 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_4x4_KHR 18076>0 lelong 0x93D1 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_5x4_KHR 18077>0 lelong 0x93D2 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_5x5_KHR 18078>0 lelong 0x93D3 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_6x5_KHR 18079>0 lelong 0x93D4 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_6x6_KHR 18080>0 lelong 0x93D5 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_8x5_KHR 18081>0 lelong 0x93D6 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_8x6_KHR 18082>0 lelong 0x93D7 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_8x8_KHR 18083>0 lelong 0x93D8 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x5_KHR 18084>0 lelong 0x93D9 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x6_KHR 18085>0 lelong 0x93DA \b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x8_KHR 18086>0 lelong 0x93DB \b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x10_KHR 18087>0 lelong 0x93DC \b, COMPRESSED_SRGB8_ALPHA8_ASTC_12x10_KHR 18088>0 lelong 0x93DD \b, COMPRESSED_SRGB8_ALPHA8_ASTC_12x12_KHR 18089 18090# Endian-specific KTX header. 18091# TODO: glType (all textures I've seen so far are GL_UNSIGNED_BYTE) 180920 name khronos-ktx-endian-header 18093>20 lelong x \b, %u 18094>24 lelong >1 x %u 18095>28 lelong >1 x %u 18096>8 lelong >0 18097>>8 use khronos-ktx-glEnum 18098>8 lelong 0 18099>>12 use khronos-ktx-glEnum 18100 18101# Main KTX header. 18102# Determine endianness, then check the rest of the header. 181030 string \xABKTX\ 11\xBB\r\n\x1A\n Khronos KTX texture 18104>12 lelong 0x04030201 (little-endian) 18105>>16 use khronos-ktx-endian-header 18106>12 belong 0x04030201 (big-endian) 18107>>16 use \^khronos-ktx-endian-header 18108 18109# Type: Khronos KTX2 texture. 18110# From: David Korth <gerbilsoft@gerbilsoft.com> 18111# Based on draft19. 18112# Reference: http://github.khronos.org/KTX-Specification/ 18113 18114# Supercompression enum. 181150 name khronos-ktx2-supercompression 18116>0 lelong 1 Basis Universal 18117>0 lelong 2 Zstandard 18118 18119# Vulkan format identifier. 18120# NOTE: Formats prohibited from KTX2 are commented out. 181210 name khronos-ktx2-vkFormat 18122>0 lelong 0 UNDEFINED 18123>0 lelong 1 R4G4_UNORM_PACK8 18124>0 lelong 2 R4G4B4A4_UNORM_PACK16 18125>0 lelong 3 B4G4R4A4_UNORM_PACK16 18126>0 lelong 4 R5G6B5_UNORM_PACK16 18127>0 lelong 5 B5G6R5_UNORM_PACK16 18128>0 lelong 6 R5G5B5A1_UNORM_PACK16 18129>0 lelong 7 B5G5R5A1_UNORM_PACK16 18130>0 lelong 8 A1R5G5B5_UNORM_PACK16 18131>0 lelong 9 R8_UNORM 18132>0 lelong 10 R8_SNORM 18133#>0 lelong 11 R8_USCALED 18134#>0 lelong 12 R8_SSCALED 18135>0 lelong 13 R8_UINT 18136>0 lelong 14 R8_SINT 18137>0 lelong 15 R8_SRGB 18138>0 lelong 16 R8G8_UNORM 18139>0 lelong 17 R8G8_SNORM 18140#>0 lelong 18 R8G8_USCALED 18141#>0 lelong 19 R8G8_SSCALED 18142>0 lelong 20 R8G8_UINT 18143>0 lelong 21 R8G8_SINT 18144>0 lelong 22 R8G8_SRGB 18145>0 lelong 23 R8G8B8_UNORM 18146>0 lelong 24 R8G8B8_SNORM 18147#>0 lelong 25 R8G8B8_USCALED 18148#>0 lelong 26 R8G8B8_SSCALED 18149>0 lelong 27 R8G8B8_UINT 18150>0 lelong 28 R8G8B8_SINT 18151>0 lelong 29 R8G8B8_SRGB 18152>0 lelong 30 B8G8R8_UNORM 18153>0 lelong 31 B8G8R8_SNORM 18154#>0 lelong 32 B8G8R8_USCALED 18155#>0 lelong 33 B8G8R8_SSCALED 18156>0 lelong 34 B8G8R8_UINT 18157>0 lelong 35 B8G8R8_SINT 18158>0 lelong 36 B8G8R8_SRGB 18159>0 lelong 37 R8G8B8A8_UNORM 18160>0 lelong 38 R8G8B8A8_SNORM 18161#>0 lelong 39 R8G8B8A8_USCALED 18162#>0 lelong 40 R8G8B8A8_SSCALED 18163>0 lelong 41 R8G8B8A8_UINT 18164>0 lelong 42 R8G8B8A8_SINT 18165>0 lelong 43 R8G8B8A8_SRGB 18166>0 lelong 44 B8G8R8A8_UNORM 18167>0 lelong 45 B8G8R8A8_SNORM 18168#>0 lelong 46 B8G8R8A8_USCALED 18169#>0 lelong 47 B8G8R8A8_SSCALED 18170>0 lelong 48 B8G8R8A8_UINT 18171>0 lelong 49 B8G8R8A8_SINT 18172>0 lelong 50 B8G8R8A8_SRGB 18173#>0 lelong 51 A8B8G8R8_UNORM_PACK32 18174#>0 lelong 52 A8B8G8R8_SNORM_PACK32 18175#>0 lelong 53 A8B8G8R8_USCALED_PACK32 18176#>0 lelong 54 A8B8G8R8_SSCALED_PACK32 18177#>0 lelong 55 A8B8G8R8_UINT_PACK32 18178#>0 lelong 56 A8B8G8R8_SINT_PACK32 18179#>0 lelong 57 A8B8G8R8_SRGB_PACK32 18180>0 lelong 58 A2R10G10B10_UNORM_PACK32 18181>0 lelong 59 A2R10G10B10_SNORM_PACK32 18182#>0 lelong 60 A2R10G10B10_USCALED_PACK32 18183#>0 lelong 61 A2R10G10B10_SSCALED_PACK32 18184>0 lelong 62 A2R10G10B10_UINT_PACK32 18185>0 lelong 63 A2R10G10B10_SINT_PACK32 18186>0 lelong 64 A2B10G10R10_UNORM_PACK32 18187>0 lelong 65 A2B10G10R10_SNORM_PACK32 18188#>0 lelong 66 A2B10G10R10_USCALED_PACK32 18189#>0 lelong 67 A2B10G10R10_SSCALED_PACK32 18190>0 lelong 68 A2B10G10R10_UINT_PACK32 18191>0 lelong 69 A2B10G10R10_SINT_PACK32 18192>0 lelong 70 R16_UNORM 18193>0 lelong 71 R16_SNORM 18194#>0 lelong 72 R16_USCALED 18195#>0 lelong 73 R16_SSCALED 18196>0 lelong 74 R16_UINT 18197>0 lelong 75 R16_SINT 18198>0 lelong 76 R16_SFLOAT 18199>0 lelong 77 R16G16_UNORM 18200>0 lelong 78 R16G16_SNORM 18201#>0 lelong 79 R16G16_USCALED 18202#>0 lelong 80 R16G16_SSCALED 18203>0 lelong 81 R16G16_UINT 18204>0 lelong 82 R16G16_SINT 18205>0 lelong 83 R16G16_SFLOAT 18206>0 lelong 84 R16G16B16_UNORM 18207>0 lelong 85 R16G16B16_SNORM 18208#>0 lelong 86 R16G16B16_USCALED 18209#>0 lelong 87 R16G16B16_SSCALED 18210>0 lelong 88 R16G16B16_UINT 18211>0 lelong 89 R16G16B16_SINT 18212>0 lelong 90 R16G16B16_SFLOAT 18213>0 lelong 91 R16G16B16A16_UNORM 18214>0 lelong 92 R16G16B16A16_SNORM 18215#>0 lelong 93 R16G16B16A16_USCALED 18216#>0 lelong 94 R16G16B16A16_SSCALED 18217>0 lelong 95 R16G16B16A16_UINT 18218>0 lelong 96 R16G16B16A16_SINT 18219>0 lelong 97 R16G16B16A16_SFLOAT 18220>0 lelong 98 R32_UINT 18221>0 lelong 99 R32_SINT 18222>0 lelong 100 R32_SFLOAT 18223>0 lelong 101 R32G32_UINT 18224>0 lelong 102 R32G32_SINT 18225>0 lelong 103 R32G32_SFLOAT 18226>0 lelong 104 R32G32B32_UINT 18227>0 lelong 105 R32G32B32_SINT 18228>0 lelong 106 R32G32B32_SFLOAT 18229>0 lelong 107 R32G32B32A32_UINT 18230>0 lelong 108 R32G32B32A32_SINT 18231>0 lelong 109 R32G32B32A32_SFLOAT 18232>0 lelong 110 R64_UINT 18233>0 lelong 111 R64_SINT 18234>0 lelong 112 R64_SFLOAT 18235>0 lelong 113 R64G64_UINT 18236>0 lelong 114 R64G64_SINT 18237>0 lelong 115 R64G64_SFLOAT 18238>0 lelong 116 R64G64B64_UINT 18239>0 lelong 117 R64G64B64_SINT 18240>0 lelong 118 R64G64B64_SFLOAT 18241>0 lelong 119 R64G64B64A64_UINT 18242>0 lelong 120 R64G64B64A64_SINT 18243>0 lelong 121 R64G64B64A64_SFLOAT 18244>0 lelong 122 B10G11R11_UFLOAT_PACK32 18245>0 lelong 123 E5B9G9R9_UFLOAT_PACK32 18246>0 lelong 124 D16_UNORM 18247>0 lelong 125 X8_D24_UNORM_PACK32 18248>0 lelong 126 D32_SFLOAT 18249>0 lelong 127 S8_UINT 18250>0 lelong 128 D16_UNORM_S8_UINT 18251>0 lelong 129 D24_UNORM_S8_UINT 18252>0 lelong 130 D32_SFLOAT_S8_UINT 18253 18254>0 lelong 131 BC1_RGB_UNORM_BLOCK 18255>0 lelong 132 BC1_RGB_SRGB_BLOCK 18256>0 lelong 133 BC1_RGBA_UNORM_BLOCK 18257>0 lelong 134 BC1_RGBA_SRGB_BLOCK 18258>0 lelong 135 BC2_UNORM_BLOCK 18259>0 lelong 136 BC2_SRGB_BLOCK 18260>0 lelong 137 BC3_UNORM_BLOCK 18261>0 lelong 138 BC3_SRGB_BLOCK 18262>0 lelong 139 BC4_UNORM_BLOCK 18263>0 lelong 140 BC4_SNORM_BLOCK 18264>0 lelong 141 BC5_UNORM_BLOCK 18265>0 lelong 142 BC5_SNORM_BLOCK 18266>0 lelong 143 BC6H_UFLOAT_BLOCK 18267>0 lelong 144 BC6H_SFLOAT_BLOCK 18268>0 lelong 145 BC7_UNORM_BLOCK 18269>0 lelong 146 BC7_SRGB_BLOCK 18270 18271>0 lelong 147 ETC2_R8G8B8_UNORM_BLOCK 18272>0 lelong 148 ETC2_R8G8B8_SRGB_BLOCK 18273>0 lelong 149 ETC2_R8G8B8A1_UNORM_BLOCK 18274>0 lelong 150 ETC2_R8G8B8A1_SRGB_BLOCK 18275>0 lelong 151 ETC2_R8G8B8A8_UNORM_BLOCK 18276>0 lelong 152 ETC2_R8G8B8A8_SRGB_BLOCK 18277 18278>0 lelong 153 EAC_R11_UNORM_BLOCK 18279>0 lelong 154 EAC_R11_SNORM_BLOCK 18280>0 lelong 155 EAC_R11G11_UNORM_BLOCK 18281>0 lelong 156 EAC_R11G11_SNORM_BLOCK 18282 18283>0 lelong 157 ASTC_4x4_UNORM_BLOCK 18284>0 lelong 158 ASTC_4x4_SRGB_BLOCK 18285>0 lelong 159 ASTC_5x4_UNORM_BLOCK 18286>0 lelong 160 ASTC_5x4_SRGB_BLOCK 18287>0 lelong 161 ASTC_5x5_UNORM_BLOCK 18288>0 lelong 162 ASTC_5x5_SRGB_BLOCK 18289>0 lelong 163 ASTC_6x5_UNORM_BLOCK 18290>0 lelong 164 ASTC_6x5_SRGB_BLOCK 18291>0 lelong 165 ASTC_6x6_UNORM_BLOCK 18292>0 lelong 166 ASTC_6x6_SRGB_BLOCK 18293>0 lelong 167 ASTC_8x5_UNORM_BLOCK 18294>0 lelong 168 ASTC_8x5_SRGB_BLOCK 18295>0 lelong 169 ASTC_8x6_UNORM_BLOCK 18296>0 lelong 170 ASTC_8x6_SRGB_BLOCK 18297>0 lelong 171 ASTC_8x8_UNORM_BLOCK 18298>0 lelong 172 ASTC_8x8_SRGB_BLOCK 18299>0 lelong 173 ASTC_10x5_UNORM_BLOCK 18300>0 lelong 174 ASTC_10x5_SRGB_BLOCK 18301>0 lelong 175 ASTC_10x6_UNORM_BLOCK 18302>0 lelong 176 ASTC_10x6_SRGB_BLOCK 18303>0 lelong 177 ASTC_10x8_UNORM_BLOCK 18304>0 lelong 178 ASTC_10x8_SRGB_BLOCK 18305>0 lelong 179 ASTC_10x10_UNORM_BLOCK 18306>0 lelong 180 ASTC_10x10_SRGB_BLOCK 18307>0 lelong 181 ASTC_12x10_UNORM_BLOCK 18308>0 lelong 182 ASTC_12x10_SRGB_BLOCK 18309>0 lelong 183 ASTC_12x12_UNORM_BLOCK 18310>0 lelong 184 ASTC_12x12_SRGB_BLOCK 18311 18312>0 lelong 1000156000 G8B8G8R8_422_UNORM 18313>0 lelong 1000156001 B8G8R8G8_422_UNORM 18314>0 lelong 1000156002 G8_B8_R8_3PLANE_420_UNORM 18315>0 lelong 1000156003 G8_B8R8_2PLANE_420_UNORM 18316>0 lelong 1000156004 G8_B8_R8_3PLANE_422_UNORM 18317>0 lelong 1000156005 G8_B8R8_2PLANE_422_UNORM 18318>0 lelong 1000156006 G8_B8_R8_3PLANE_444_UNORM 18319>0 lelong 1000156007 R10X6_UNORM_PACK16 18320>0 lelong 1000156008 R10X6G10X6_UNORM_2PACK16 18321>0 lelong 1000156009 R10X6G10X6B10X6A10X6_UNORM_4PACK16 18322>0 lelong 1000156010 G10X6B10X6G10X6R10X6_422_UNORM_4PACK16 18323>0 lelong 1000156011 B10X6G10X6R10X6G10X6_422_UNORM_4PACK16 18324>0 lelong 1000156012 G10X6_B10X6_R10X6_3PLANE_420_UNORM_3PACK16 18325>0 lelong 1000156013 G10X6_B10X6R10X6_2PLANE_420_UNORM_3PACK16 18326>0 lelong 1000156014 G10X6_B10X6_R10X6_3PLANE_422_UNORM_3PACK16 18327>0 lelong 1000156015 G10X6_B10X6R10X6_2PLANE_422_UNORM_3PACK16 18328>0 lelong 1000156016 G10X6_B10X6_R10X6_3PLANE_444_UNORM_3PACK16 18329>0 lelong 1000156017 R12X4_UNORM_PACK16 18330>0 lelong 1000156018 R12X4G12X4_UNORM_2PACK16 18331>0 lelong 1000156019 R12X4G12X4B12X4A12X4_UNORM_4PACK16 18332>0 lelong 1000156020 G12X4B12X4G12X4R12X4_422_UNORM_4PACK16 18333>0 lelong 1000156021 B12X4G12X4R12X4G12X4_422_UNORM_4PACK16 18334>0 lelong 1000156022 G12X4_B12X4_R12X4_3PLANE_420_UNORM_3PACK16 18335>0 lelong 1000156023 G12X4_B12X4R12X4_2PLANE_420_UNORM_3PACK16 18336>0 lelong 1000156024 G12X4_B12X4_R12X4_3PLANE_422_UNORM_3PACK16 18337>0 lelong 1000156025 G12X4_B12X4R12X4_2PLANE_422_UNORM_3PACK16 18338>0 lelong 1000156026 G12X4_B12X4_R12X4_3PLANE_444_UNORM_3PACK16 18339>0 lelong 1000156027 G16B16G16R16_422_UNORM 18340>0 lelong 1000156028 B16G16R16G16_422_UNORM 18341>0 lelong 1000156029 G16_B16_R16_3PLANE_420_UNORM 18342>0 lelong 1000156030 G16_B16R16_2PLANE_420_UNORM 18343>0 lelong 1000156031 G16_B16_R16_3PLANE_422_UNORM 18344>0 lelong 1000156032 G16_B16R16_2PLANE_422_UNORM 18345>0 lelong 1000156033 G16_B16_R16_3PLANE_444_UNORM 18346 18347>0 lelong 1000054000 PVRTC1_2BPP_UNORM_BLOCK_IMG 18348>0 lelong 1000054001 PVRTC1_4BPP_UNORM_BLOCK_IMG 18349>0 lelong 1000054002 PVRTC2_2BPP_UNORM_BLOCK_IMG 18350>0 lelong 1000054003 PVRTC2_4BPP_UNORM_BLOCK_IMG 18351>0 lelong 1000054004 PVRTC1_2BPP_SRGB_BLOCK_IMG 18352>0 lelong 1000054005 PVRTC1_4BPP_SRGB_BLOCK_IMG 18353>0 lelong 1000054006 PVRTC2_2BPP_SRGB_BLOCK_IMG 18354>0 lelong 1000054007 PVRTC2_4BPP_SRGB_BLOCK_IMG 18355 18356>0 lelong 1000066000 ASTC_4x4_SFLOAT_BLOCK_EXT 18357>0 lelong 1000066001 ASTC_5x4_SFLOAT_BLOCK_EXT 18358>0 lelong 1000066002 ASTC_5x5_SFLOAT_BLOCK_EXT 18359>0 lelong 1000066003 ASTC_6x5_SFLOAT_BLOCK_EXT 18360>0 lelong 1000066004 ASTC_6x6_SFLOAT_BLOCK_EXT 18361>0 lelong 1000066005 ASTC_8x5_SFLOAT_BLOCK_EXT 18362>0 lelong 1000066006 ASTC_8x6_SFLOAT_BLOCK_EXT 18363>0 lelong 1000066007 ASTC_8x8_SFLOAT_BLOCK_EXT 18364>0 lelong 1000066008 ASTC_10x5_SFLOAT_BLOCK_EXT 18365>0 lelong 1000066009 ASTC_10x6_SFLOAT_BLOCK_EXT 18366>0 lelong 1000066010 ASTC_10x8_SFLOAT_BLOCK_EXT 18367>0 lelong 1000066011 ASTC_10x10_SFLOAT_BLOCK_EXT 18368>0 lelong 1000066012 ASTC_12x10_SFLOAT_BLOCK_EXT 18369>0 lelong 1000066013 ASTC_12x12_SFLOAT_BLOCK_EXT 18370 18371# Main KTX2 header. 183720 string \xABKTX\ 20\xBB\r\n\x1A\n Khronos KTX2 texture 18373>20 lelong x \b, %u 18374>24 lelong >1 x %u 18375>28 lelong >1 x %u 18376>32 lelong >1 \b, %u layers 18377>36 lelong >1 \b, %u faces 18378>40 lelong >1 \b, %u mipmaps 18379>44 lelong >0 \b, 18380>>44 use khronos-ktx2-supercompression 18381>12 lelong >0 \b, 18382>>12 use khronos-ktx2-vkFormat 18383 18384# Type: Valve VTF texture. 18385# From: David Korth <gerbilsoft@gerbilsoft.com> 18386# References: 18387# - https://developer.valvesoftware.com/wiki/Valve_Texture_Format 18388 18389# VTF image formats. 183900 name vtf-image-format 18391>0 lelong 0 RGBA8888 18392>0 lelong 1 ABGR8888 18393>0 lelong 2 RGB888 18394>0 lelong 3 BGR888 18395>0 lelong 4 RGB565 18396>0 lelong 5 I8 18397>0 lelong 6 IA88 18398>0 lelong 7 P8 18399>0 lelong 8 A8 18400>0 lelong 9 RGB888 (bluescreen) 18401>0 lelong 10 BGR888 (bluescreen) 18402>0 lelong 11 ARGB8888 18403>0 lelong 12 BGRA8888 18404>0 lelong 13 DXT1 18405>0 lelong 14 DXT3 18406>0 lelong 15 DXT5 18407>0 lelong 16 BGRx8888 18408>0 lelong 17 BGR565 18409>0 lelong 18 BGRx5551 18410>0 lelong 19 BGRA4444 18411>0 lelong 20 DXT1+A1 18412>0 lelong 21 BGRA5551 18413>0 lelong 22 UV88 18414>0 lelong 23 UVWQ8888 18415>0 lelong 24 RGBA16161616F 18416>0 lelong 25 RGBA16161616 18417>0 lelong 26 UVLX8888 18418 18419# Main VTF header. 184200 string VTF\0 Valve Texture Format 18421>4 lelong x v%u 18422>8 lelong x \b.%u 18423>0x10 leshort x \b, %u 18424>0x12 leshort >1 x %u 18425>4 lequad 0x0000000700000002 18426>>0x3F leshort >1 x %u 18427>0x18 leshort >1 \b, %u frames 18428>0x38 byte x \b, mipmaps: %u 18429>0x34 lelong >-1 \b, 18430>>0x34 use vtf-image-format 18431 18432# Type: Valve VTF3 (PS3) texture. 18433# From: David Korth <gerbilsoft@gerbilsoft.com> 184340 string VTF3 Valve Texture Format (PS3) 18435>0x14 beshort x \b, %u 18436>0x16 beshort x \b x %u 18437>0x10 belong&0x2000 0 \b, DXT1 18438>0x10 belong&0x2000 0x2000 \b, DXT5 18439 18440# Type: ASTC texture. 18441# From: David Korth <gerbilsoft@gerbilsoft.com> 18442# References: 18443# - https://stackoverflow.com/questions/22600678/determine-internal-format-of-given-astc-compressed-image-through-its-header 18444# - https://stackoverflow.com/a/22682244 184450 lelong 0x5ca1ab13 ASTC 18446>4 byte x %u 18447>5 byte x \bx%u 18448>6 byte >1 \bx%u 18449# X, Y, and Z dimensions are stored as 24-bit LE. 18450# Pretend it's 32-bit and mask off the high byte. 18451>7 lelong&0x00FFFFFF x texture, %u 18452>10 lelong&0x00FFFFFF x x %u 18453>13 lelong&0x00FFFFFF >1 x %u 18454 18455# Zebra Metafile graphic 18456# http://www.fileformat.info/format/zbr/egff.htm 184570 beshort 0x9a02 Zebra Metafile graphic 18458>2 leshort 1 (version 1.x) 18459>2 leshort 2 (version 1.1x or 1.2x) 18460>2 leshort 3 (version 1.49) 18461>2 leshort 4 (version 1.50) 18462>4 string x (comment = %s) 18463 18464# Microsoft Paint graphic 18465# http://www.fileformat.info/format/mspaint/egff.htm 184660 string DanM icrosoft Paint image data (version 1.x) 18467>4 leshort x (%d 18468>>6 leshort x x %d) 184690 string LinS Microsoft Paint image data (version 2.0) 18470>4 leshort x (%d 18471>>6 leshort x x %d) 18472 18473# reMarkable tablet internal file format (https://www.remarkable.com/) 18474# https://github.com/ax3l/lines-are-beautiful 18475# https://plasma.ninja/blog/devices/remarkable/binary/format/2017/12/26/\ 18476# reMarkable-lines-file-format.html#what-to-do-next 18477# from Axel Huebl 184780 string reMarkable 18479>11 string lines 18480>>17 string with 18481>>>22 string selections 18482>>>>33 string and 18483>>>>>37 string layers 18484>>>>>>43 lelong x reMarkable tablet notebook lines, 1404 x 1872, %x page(s) 18485 18486# newer per-page files for the reMarkable 184870 string reMarkable 18488>11 string .lines 18489>>18 string file, 18490>>>24 string version= 18491>>>>32 byte x reMarkable tablet page (v%c), 1404 x 1872, 18492>>>>>43 lelong x %d layer(s) 18493 18494# Type: PVR3 texture. 18495# From: David Korth <gerbilsoft@gerbilsoft.com> 18496# References: 18497# - http://cdn.imgtec.com/sdk-documentation/PVR+File+Format.Specification.pdf 18498 18499# PVR3 pixel formats. 185000 name pvr3-pixel-format 18501>0 ulelong 0 PVRTC 2bpp RGB 18502>0 ulelong 1 PVRTC 2bpp RGBA 18503>0 ulelong 2 PVRTC 4bpp RGB 18504>0 ulelong 3 PVRTC 4bpp RGBA 18505>0 ulelong 4 PVRTC-II 2bpp 18506>0 ulelong 5 PVRTC-II 4bpp 18507>0 ulelong 6 ETC1 18508>0 ulelong 7 DXT1 18509>0 ulelong 8 DXT2 18510>0 ulelong 9 DXT3 18511>0 ulelong 10 DXT4 18512>0 ulelong 11 DXT5 18513>0 ulelong 12 BC4 18514>0 ulelong 13 BC5 18515>0 ulelong 14 BC6 18516>0 ulelong 15 BC7 18517>0 ulelong 16 UYVY 18518>0 ulelong 17 YUY2 18519>0 ulelong 18 BW1bpp 18520>0 ulelong 19 R9G9B9E5 Shared Exponent 18521>0 ulelong 20 RGBG8888 18522>0 ulelong 21 GRGB8888 18523>0 ulelong 22 ETC2 RGB 18524>0 ulelong 23 ETC2 RGBA 18525>0 ulelong 24 ETC2 RGB A1 18526>0 ulelong 25 EAC R11 18527>0 ulelong 26 EAC RG11 18528>0 ulelong 27 ASTC_4x4 18529>0 ulelong 28 ASTC_5x4 18530>0 ulelong 29 ASTC_5x5 18531>0 ulelong 30 ASTC_6x5 18532>0 ulelong 31 ASTC_6x6 18533>0 ulelong 32 ASTC_8x5 18534>0 ulelong 33 ASTC_8x6 18535>0 ulelong 34 ASTC_8x8 18536>0 ulelong 35 ASTC_10x5 18537>0 ulelong 36 ASTC_10x6 18538>0 ulelong 37 ASTC_10x8 18539>0 ulelong 38 ASTC_10x10 18540>0 ulelong 39 ASTC_12x10 18541>0 ulelong 40 ASTC_12x12 18542>0 ulelong 41 ASTC_3x3x3 18543>0 ulelong 42 ASTC_4x3x3 18544>0 ulelong 43 ASTC_4x4x3 18545>0 ulelong 44 ASTC_4x4x4 18546>0 ulelong 45 ASTC_5x4x4 18547>0 ulelong 46 ASTC_5x5x4 18548>0 ulelong 47 ASTC_5x5x5 18549>0 ulelong 48 ASTC_6x5x5 18550>0 ulelong 49 ASTC_6x6x5 18551>0 ulelong 50 ASTC_6x6x6 18552 185530 string PVR\x03 PowerVR 3.0 texture: 18554>0x18 ulelong x %u x 18555>0x1C ulelong x %u 18556>0x20 ulelong >1 x %u 18557>0x08 byte x \b, 18558>0x0C ulelong 0 18559>>0x08 use pvr3-pixel-format 18560>0x0C ulelong !0 18561>>0x08 byte !0 %c 18562>>>0x0C byte !0 \b%u 18563>>0x09 byte !0 \b%c 18564>>>0x0D byte !0 \b%u 18565>>0x0A byte !0 \b%c 18566>>>0x0E byte !0 \b%u 18567>>0x0B byte !0 \b%c 18568>>>0x0F byte !0 \b%u 18569>0x10 ulelong 1 \b, sRGB 18570>0x04 ulelong&0x02 0x02 \b, premultiplied alpha 18571 185720 string \x03RVP PowerVR 3.0 texture: BE, 18573>0x18 ubelong x %u x 18574>0x1C ubelong x %u 18575>0x20 ubelong >1 x %u 18576>0x08 byte x \b, 18577>0x0C ubelong 0 18578>>0x08 use pvr3-pixel-format 18579>0x0C ubelong !0 18580>>0x0B byte !0 %c 18581>>>0x0F byte !0 \b%u 18582>>0x0A byte !0 \b%c 18583>>>0x0E byte !0 \b%u 18584>>0x09 byte !0 \b%c 18585>>>0x0D byte !0 \b%u 18586>>0x08 byte !0 \b%c 18587>>>0x0C byte !0 \b%u 18588>0x10 ubelong 1 \b, sRGB 18589>0x04 ubelong&0x02 0x02 \b, premultiplied alpha 18590 18591# Type: Microsoft Xbox XPR0 texture. 18592# From: David Korth <gerbilsoft@gerbilsoft.com> 18593# References: 18594# - https://github.com/Cxbx-Reloaded/Cxbx-Reloaded/blob/develop/src/core/hle/D3D8/XbD3D8Types.h 18595 18596# XPR pixel formats. 185970 name xbox-xpr-pixel-format 18598>0 byte 0x00 L8 18599>0 byte 0x01 AL8 18600>0 byte 0x02 ARGB1555 18601>0 byte 0x03 RGB555 18602>0 byte 0x04 ARGB4444 18603>0 byte 0x05 RGB565 18604>0 byte 0x06 ARGB8888 18605>0 byte 0x07 xRGB8888 18606>0 byte 0x0B P8 18607>0 byte 0x0C DXT1 18608>0 byte 0x0E DXT2 18609>0 byte 0x0F DXT4 18610>0 byte 0x10 Linear ARGB1555 18611>0 byte 0x11 Linear RGB565 18612>0 byte 0x12 Linear ARGB8888 18613>0 byte 0x13 Linear L8 18614>0 byte 0x16 Linear R8B8 18615>0 byte 0x17 Linear G8B8 18616>0 byte 0x19 A8 18617>0 byte 0x1A A8L8 18618>0 byte 0x1B Linear AL8 18619>0 byte 0x1C Linear RGB555 18620>0 byte 0x1D Linear ARGB4444 18621>0 byte 0x1E Linear xRGB8888 18622>0 byte 0x1F Linear A8 18623>0 byte 0x20 Linear A8L8 18624>0 byte 0x24 YUY2 18625>0 byte 0x25 UYVY 18626>0 byte 0x27 L6V5U5 18627>0 byte 0x28 V8U8 18628>0 byte 0x29 R8B8 18629>0 byte 0x2A D24S8 18630>0 byte 0x2B F24S8 18631>0 byte 0x2C D16 18632>0 byte 0x2D F16 18633>0 byte 0x2E Linear D24S8 18634>0 byte 0x2F Linear F24S8 18635>0 byte 0x30 Linear D16 18636>0 byte 0x31 Linear F16 18637>0 byte 0x32 L16 18638>0 byte 0x33 V16U16 18639>0 byte 0x35 Linear L16 18640>0 byte 0x36 Linear V16U16 18641>0 byte 0x37 Linear L6V5U5 18642>0 byte 0x38 RGBA5551 18643>0 byte 0x39 RGBA4444 18644>0 byte 0x3A QWVU8888 18645>0 byte 0x3B BGRA8888 18646>0 byte 0x3C RGBA8888 18647>0 byte 0x3D Linear RGBA5551 18648>0 byte 0x3E Linear RGBA4444 18649>0 byte 0x3F Linear ABGR8888 18650>0 byte 0x40 Linear BGRA8888 18651>0 byte 0x41 Linear RGBA8888 18652>0 byte 0x64 Vertex Data 18653 186540 string XPR0 Microsoft Xbox XPR0 texture 18655>0x19 byte x \b, format: 18656>>0x19 use xbox-xpr-pixel-format 18657 18658# ILDA Image Data Transfer Format 18659# https://www.ilda.com/resources/StandardsDocs/ILDA_IDTF14_rev011.pdf 18660# 18661# Updated by Chuck Hein (laser@geekdude.com) 18662# 186630 string ILDA ILDA Image Data Transfer Format 18664>7 byte 0x00 3D Coordinates with Indexed Color 18665>7 byte 0x01 2D Coordinates with Indexed Color 18666>7 byte 0x02 Color Palette 18667>7 byte 0x04 3D Coordinates with True Color 18668>7 byte 0x05 2D Coordinates with True Color 18669>8 string >0 \b, palette %s 18670>16 string >0 \b, company %s 18671>24 beshort >0 \b, number of records %d 18672>>26 beshort x \b, palette number %d 18673>>28 beshort >0 \b, number of frames %d 18674>>30 byte >0 \b, projector number %d 18675 18676# Dropbox "lepton" compressed jpeg format 18677# https://github.com/dropbox/lepton 186780 belong&0xfffff0ff 0xcf84005a Lepton image file 18679>2 byte x (version %d) 18680 18681# Apple QuickTake camera raw images 18682# https://en.wikipedia.org/wiki/Apple_QuickTake 18683# dcraw can decode them 186840 name quicktake 18685>4 belong 8 18686>>544 beshort x \b, %dx 18687>>546 beshort x \b%d 18688>4 belong 4 18689>>546 beshort x \b, %dx 18690>>544 beshort x \b%d 18691 186920 string qktk Apple QuickTake 100 Raw Image 18693>0 use quicktake 18694 186950 string qktn 18696>4 byte 0 Apple QuickTake 150 Raw Image 18697>4 byte >0 Apple QuickTake 200 Raw Image 18698>0 use quicktake 18699 18700#------------------------------------------------------------------------------ 18701# $File: inform,v 1.5 2009/09/19 16:28:09 christos Exp $ 18702# inform: file(1) magic for Inform interactive fiction language 18703 18704# URL: http://www.inform-fiction.org/ 18705# From: Reuben Thomas <rrt@sc3d.org> 18706 187070 search/100/cW constant\ story Inform source text 18708 18709#------------------------------------------------------------------------------ 18710# $File: intel,v 1.18 2020/04/18 16:19:03 christos Exp $ 18711# intel: file(1) magic for x86 Unix 18712# 18713# Various flavors of x86 UNIX executable/object (other than Xenix, which 18714# is in "microsoft"). DOS is in "msdos"; the ambitious soul can do 18715# Windows as well. 18716# 18717# Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and 18718# whatever comes next (HP-PA Hummingbird?). OS/2 may also go elsewhere 18719# as well, if, as, and when IBM makes it portable. 18720# 18721# The `versions' should be un-commented if they work for you. 18722# (Was the problem just one of endianness?) 18723# 187240 leshort 0502 basic-16 executable 18725>12 lelong >0 not stripped 18726#>22 leshort >0 - version %d 187270 leshort 0503 basic-16 executable (TV) 18728>12 lelong >0 not stripped 18729#>22 leshort >0 - version %d 187300 leshort 0510 x86 executable 18731>12 lelong >0 not stripped 187320 leshort 0511 x86 executable (TV) 18733>12 lelong >0 not stripped 187340 leshort =0512 iAPX 286 executable small model (COFF) 18735>12 lelong >0 not stripped 18736#>22 leshort >0 - version %d 187370 leshort =0522 iAPX 286 executable large model (COFF) 18738>12 lelong >0 not stripped 18739#>22 leshort >0 - version %d 18740# updated by Joerg Jenderek at Oct 2015 18741# https://de.wikipedia.org/wiki/Common_Object_File_Format 18742# http://www.delorie.com/djgpp/doc/coff/filhdr.html 18743# ./msdos (version 5.25) labeled the next entry as "MS Windows COFF Intel 80386 object file" 18744# ./intel (version 5.25) label labeled the next entry as "80386 COFF executable" 18745# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan 187460 leshort =0514 18747# use subroutine to display name+flags+variables for common object formated files 18748>0 use display-coff 18749#>12 lelong >0 not stripped 18750# no hint found, that at offset 22 is version 18751#>22 leshort >0 - version %d 187520 leshort 0x0200 18753>0 use display-coff 187540 leshort 0x8664 18755>0 use display-coff 18756 18757# rom: file(1) magic for BIOS ROM Extensions found in intel machines 18758# mapped into memory between 0xC0000 and 0xFFFFF 18759# From: Alex Myczko <alex@aiei.ch> 18760# updated by Joerg Jenderek 18761# https://en.wikipedia.org/wiki/Option_ROM 187620 beshort 0x55AA BIOS (ia32) ROM Ext. 18763!:mime application/octet-stream 18764!:ext rom/bin 18765>5 string USB USB 18766>7 string LDR UNDI image 18767>30 string IBM IBM comp. Video 18768>26 string Adaptec Adaptec 18769>28 string Adaptec Adaptec 18770>42 string PROMISE Promise 18771>2 byte x (%d*512) 18772 18773# Flash descriptors for Intel SPI flash roms. 18774# From Dr. Jesus <j@hug.gs> 187750 lelong 0x0ff0a55a Intel serial flash for ICH/PCH ROM <= 5 or 3400 series A-step 1877616 lelong 0x0ff0a55a Intel serial flash for PCH ROM 18777 18778# From: Joerg Jenderek 18779# URL: https://en.wikipedia.org/wiki/Advanced_Configuration_and_Power_Interface 18780# Reference: https://uefi.org/sites/default/files/resources/ACPI_6_3_final_Jan30.pdf 18781# Note: generated for example by `cat /sys/firmware/acpi/tables/DSDT MyDSDT.aml` 187820 string DSDT 18783>0 use acpi-table 18784# not tested or other file format 187850 string APIC 18786>0 use acpi-table 18787#0 string ASF! 18788#>0 use acpi-table 187890 string FACP 18790>0 use acpi-table 18791#0 string FACS 18792#>0 use acpi-table 187930 string MCFG 18794>0 use acpi-table 187950 string SLIC 18796>0 use acpi-table 187970 string SSDT 18798>0 use acpi-table 187990 name acpi-table 18800# skip ASCII text starting with DSDT by looking for valid "low" revision 18801>8 ubyte <17 ACPI Machine Language file 18802# assume that ACPI tables size are lower than 16 MiB 18803#>4 ulelong <0x01000000 18804# DSDT for Differentiated System Description Table 18805>>0 string x '%.4s' 18806#!:mime application/octet-stream 18807!:mime application/x-intel-aml 18808!:ext aml 18809# the manufacture model ID like: VBOXBIOS BXDSDT 18810>>16 string >\0 %.8s 18811# OEM revision of DSDT for supplied OEM Table ID like: 0 1 2 20090511 18812>>>24 ulelong x %x 18813# OEM ID like: INTEL VBOX (VirtualBox) BXDSDT (qemu) MEDION or \030\001\0\0 for s3pt.aml 18814>>10 ubyte >040 by %c 18815>>>11 ubyte >040 \b%c 18816>>>>12 ubyte >040 \b%c 18817>>>>>13 ubyte >040 \b%c 18818>>>>>>14 ubyte >040 \b%c 18819>>>>>>>15 ubyte >040 \b%c 18820# This field also sets the global integer width for the AML interpreter. 18821# Values less than two will cause the interpreter to use 32-bit. 18822# Values of two and greater will cause the interpreter to use full 64-bit. 18823# 16 for asf!.aml, 67 fo rsdp.aml 18824>>8 ubyte x \b, revision %u 18825# length, in bytes, of the entire DSDT (including the header) 18826>>4 ulelong x \b, %u bytes 18827# entire table must sum to zero 18828#>>9 ubyte x \b, checksum 0x%x 18829# vendor ID for the ASL Compiler like: INTL MSFT ... 18830>>28 string >\0 \b, created by %.4s 18831# revision number of the ASL Compiler like: 20051117 20140724 20190703 20200110 ... 18832>>>32 ulelong x %x 18833 18834 18835#------------------------------------------------------------------------------ 18836# $File: interleaf,v 1.10 2009/09/19 16:28:10 christos Exp $ 18837# interleaf: file(1) magic for InterLeaf TPS: 18838# 188390 string =\210OPS Interleaf saved data 188400 string =<!OPS Interleaf document text 18841>5 string ,\ Version\ = \b, version 18842>>17 string >\0 %.3s 18843 18844#------------------------------------------------------------------------------ 18845# $File: island,v 1.5 2009/09/19 16:28:10 christos Exp $ 18846# island: file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1 18847# "/etc/magic": 18848# From: guy@netapp.com (Guy Harris) 18849# 188504 string pgscriptver IslandWrite document 1885113 string DrawFile IslandDraw document 18852 18853 18854#------------------------------------------------------------------------------ 18855# $File: ispell,v 1.8 2009/09/19 16:28:10 christos Exp $ 18856# ispell: file(1) magic for ispell 18857# 18858# Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602. This magic 18859# will match 0x9600 through 0x9603 in *both* little endian and big endian. 18860# (No other current magic entries collide.) 18861# 18862# Updated by Daniel Quinlan (quinlan@yggdrasil.com) 18863# 188640 leshort&0xFFFC 0x9600 little endian ispell 18865>0 byte 0 hash file (?), 18866>0 byte 1 3.0 hash file, 18867>0 byte 2 3.1 hash file, 18868>0 byte 3 hash file (?), 18869>2 leshort 0x00 8-bit, no capitalization, 26 flags 18870>2 leshort 0x01 7-bit, no capitalization, 26 flags 18871>2 leshort 0x02 8-bit, capitalization, 26 flags 18872>2 leshort 0x03 7-bit, capitalization, 26 flags 18873>2 leshort 0x04 8-bit, no capitalization, 52 flags 18874>2 leshort 0x05 7-bit, no capitalization, 52 flags 18875>2 leshort 0x06 8-bit, capitalization, 52 flags 18876>2 leshort 0x07 7-bit, capitalization, 52 flags 18877>2 leshort 0x08 8-bit, no capitalization, 128 flags 18878>2 leshort 0x09 7-bit, no capitalization, 128 flags 18879>2 leshort 0x0A 8-bit, capitalization, 128 flags 18880>2 leshort 0x0B 7-bit, capitalization, 128 flags 18881>2 leshort 0x0C 8-bit, no capitalization, 256 flags 18882>2 leshort 0x0D 7-bit, no capitalization, 256 flags 18883>2 leshort 0x0E 8-bit, capitalization, 256 flags 18884>2 leshort 0x0F 7-bit, capitalization, 256 flags 18885>4 leshort >0 and %d string characters 188860 beshort&0xFFFC 0x9600 big endian ispell 18887>1 byte 0 hash file (?), 18888>1 byte 1 3.0 hash file, 18889>1 byte 2 3.1 hash file, 18890>1 byte 3 hash file (?), 18891>2 beshort 0x00 8-bit, no capitalization, 26 flags 18892>2 beshort 0x01 7-bit, no capitalization, 26 flags 18893>2 beshort 0x02 8-bit, capitalization, 26 flags 18894>2 beshort 0x03 7-bit, capitalization, 26 flags 18895>2 beshort 0x04 8-bit, no capitalization, 52 flags 18896>2 beshort 0x05 7-bit, no capitalization, 52 flags 18897>2 beshort 0x06 8-bit, capitalization, 52 flags 18898>2 beshort 0x07 7-bit, capitalization, 52 flags 18899>2 beshort 0x08 8-bit, no capitalization, 128 flags 18900>2 beshort 0x09 7-bit, no capitalization, 128 flags 18901>2 beshort 0x0A 8-bit, capitalization, 128 flags 18902>2 beshort 0x0B 7-bit, capitalization, 128 flags 18903>2 beshort 0x0C 8-bit, no capitalization, 256 flags 18904>2 beshort 0x0D 7-bit, no capitalization, 256 flags 18905>2 beshort 0x0E 8-bit, capitalization, 256 flags 18906>2 beshort 0x0F 7-bit, capitalization, 256 flags 18907>4 beshort >0 and %d string characters 18908# ispell 4.0 hash files kromJx <kromJx@crosswinds.net> 18909# Ispell 4.0 189100 string ISPL ispell 18911>4 long x hash file version %d, 18912>8 long x lexletters %d, 18913>12 long x lexsize %d, 18914>16 long x hashsize %d, 18915>20 long x stblsize %d 18916 18917#------------------------------------------------------------------------------ 18918# $File: isz,v 1.5 2019/04/19 00:42:27 christos Exp $ 18919# ISO Zipped file format 18920# https://www.ezbsystems.com/isz/iszspec.txt 189210 string IsZ! ISO Zipped file 18922>4 byte x \b, header size %u 18923>5 byte x \b, version %u 18924>8 lelong x \b, serial %u 18925#12 leshort x \b, sector size %u 18926#>16 lelong x \b, total sectors %u 18927>17 byte >0 \b, password protected 18928#>24 lequad x \b, segment size %llu 18929#>32 lelong x \b, blocks %u 18930#>36 lelong x \b, block size %u 18931 18932#------------------------------------------------------------ 18933# $File: java,v 1.21 2019/02/18 17:58:50 christos Exp $ 18934# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the 18935# same magic number, 0xcafebabe, so they are both handled 18936# in the entry called "cafebabe". 18937#------------------------------------------------------------ 18938# Java serialization 18939# From Martin Pool (m.pool@pharos.com.au) 189400 beshort 0xaced Java serialization data 18941>2 beshort >0x0004 \b, version %d 18942 189430 belong 0xfeedfeed Java KeyStore 18944!:mime application/x-java-keystore 189450 belong 0xcececece Java JCE KeyStore 18946!:mime application/x-java-jce-keystore 18947 18948# Java source 189490 regex \^import.*;$ Java source 18950!:mime text/x-java 18951 18952# Java HPROF dumps 18953# https://java.net/downloads/heap-snapshot/hprof-binary-format.html 189540 string JAVA\x20PROFILE\x201.0. 18955>0x12 byte 0 18956>>0x11 ubyte-0x31 <2 Java HPROF dump, 18957>>>0x17 beqdate/1000 x created %s 18958 18959# Java jmod module 18960# See https://hg.openjdk.java.net/jdk9/jdk9/jdk/file/tip/src/java.base/share/classes/jdk/internal/jmod/JmodFile.java 18961# Grr. 2 byte magic "JM", really? In 2019? 189620 belong 0x4a4d0100 Java jmod module version 1.0 18963!:mime application/x-java-jmod 18964 18965# Java jlinked image 18966# See https://hg.openjdk.java.net/jdk9/jdk9/jdk/file/tip/src/java.base/share/native/libjimage/imageFile.hpp 189670 belong 0xcafedada Java module image (big endian) 18968>4 beshort >0x00 \b, version %d 18969>6 beshort x \b.%d 18970!:mime application/x-java-image 18971 189720 lelong 0xcafedada Java module image (little endian) 18973>6 leshort >0x00 \b, version %d 18974>4 leshort x \b.%d 18975!:mime application/x-java-image 18976 18977#------------------------------------------------------------------------------ 18978# $File: javascript,v 1.2 2019/08/05 10:34:26 christos Exp $ 18979# javascript: magic for javascript and node.js scripts. 18980# 189810 search/1/w #!/bin/node Node.js script text executable 18982!:mime application/javascript 189830 search/1/w #!/usr/bin/node Node.js script text executable 18984!:mime application/javascript 189850 search/1/w #!/bin/nodejs Node.js script text executable 18986!:mime application/javascript 189870 search/1/w #!/usr/bin/nodejs Node.js script text executable 18988!:mime application/javascript 189890 search/1 #!/usr/bin/env\ node Node.js script text executable 18990!:mime application/javascript 189910 search/1 #!/usr/bin/env\ nodejs Node.js script text executable 18992!:mime application/javascript 18993# Hermes by Facebook https://hermesengine.dev/ 18994# https://github.com/facebook/hermes/blob/master/include/hermes/\ 18995# BCGen/HBC/BytecodeFileFormat.h#L24 189960 lequad 0x1F1903C103BC1FC6 Hermes JavaScript bytecode 18997>8 lelong x \b, version %d 18998 18999#------------------------------------------------------------------------------ 19000# $File: jpeg,v 1.32 2018/10/01 18:58:29 christos Exp $ 19001# JPEG images 19002# SunOS 5.5.1 had 19003# 19004# 0 string \377\330\377\340 JPEG file 19005# 0 string \377\330\377\356 JPG file 19006# 19007# both of which turn into "JPEG image data" here. 19008# 190090 beshort 0xffd8 JPEG image data 19010!:mime image/jpeg 19011!:apple 8BIMJPEG 19012!:strength *3 19013!:ext jpeg/jpg/jpe/jfif 19014>6 string JFIF \b, JFIF standard 19015# The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06 19016# in a vain attempt to add image size reporting for JFIF. Note that these 19017# tests are not fool-proof since some perfectly valid JPEGs are currently 19018# impossible to specify in magic(4) format. 19019# First, a little JFIF version info: 19020>>11 byte x \b %d. 19021>>12 byte x \b%02d 19022# Next, the resolution or aspect ratio of the image: 19023>>13 byte 0 \b, aspect ratio 19024>>13 byte 1 \b, resolution (DPI) 19025>>13 byte 2 \b, resolution (DPCM) 19026>>14 beshort x \b, density %dx 19027>>16 beshort x \b%d 19028>>4 beshort x \b, segment length %d 19029# Next, show thumbnail info, if it exists: 19030>>18 byte !0 \b, thumbnail %dx 19031>>>19 byte x \b%d 19032>6 string Exif \b, Exif standard: [ 19033>>12 indirect/r x 19034>>12 string x \b] 19035 19036# Jump to the first segment 19037>(4.S+4) use jpeg_segment 19038 19039# This uses recursion... 190400 name jpeg_segment 19041>0 beshort 0xFFFE 19042# Recursion handled by FFE0 19043#>>(2.S+2) use jpeg_segment 19044>>2 pstring/HJ x \b, comment: "%s" 19045 19046>0 beshort 0xFFC0 19047>>(2.S+2) use jpeg_segment 19048>>4 byte x \b, baseline, precision %d 19049>>7 beshort x \b, %dx 19050>>5 beshort x \b%d 19051>>9 byte x \b, components %d 19052 19053>0 beshort 0xFFC1 19054>>(2.S+2) use jpeg_segment 19055>>4 byte x \b, extended sequential, precision %d 19056>>7 beshort x \b, %dx 19057>>5 beshort x \b%d 19058>>9 byte x \b, components %d 19059 19060>0 beshort 0xFFC2 19061>>(2.S+2) use jpeg_segment 19062>>4 byte x \b, progressive, precision %d 19063>>7 beshort x \b, %dx 19064>>5 beshort x \b%d 19065>>9 byte x \b, components %d 19066 19067# Define Huffman Tables 19068>0 beshort 0xFFC4 19069>>(2.S+2) use jpeg_segment 19070 19071>0 beshort 0xFFE1 19072# Recursion handled by FFE0 19073#>>(2.S+2) use jpeg_segment 19074>>4 string Exif \b, Exif Standard: [ 19075>>>10 indirect/r x 19076>>>10 string x \b] 19077 19078# Application specific markers 19079>0 beshort&0xFFE0 =0xFFE0 19080>>(2.S+2) use jpeg_segment 19081 19082# DB: Define Quantization tables 19083# DD: Define Restart interval [XXX: wrong here, it is 4 bytes] 19084# D8: Start of image 19085# D9: End of image 19086# Dn: Restart 19087>0 beshort&0xFFD0 =0xFFD0 19088>>0 beshort&0xFFE0 !0xFFE0 19089>>>(2.S+2) use jpeg_segment 19090 19091#>0 beshort x unknown 0x%x 19092#>>(2.S+2) use jpeg_segment 19093 19094# HSI is Handmade Software's proprietary JPEG encoding scheme 190950 string hsi1 JPEG image data, HSI proprietary 19096 19097# From: David Santinoli <david@santinoli.com> 190980 string \x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A JPEG 2000 19099# From: Johan van der Knijff <johan.vanderknijff@kb.nl> 19100# Added sub-entries for JP2, JPX, JPM and MJ2 formats; added mimetypes 19101# https://github.com/bitsgalore/jp2kMagic 19102# 19103# Now read value of 'Brand' field, which yields a few possibilities: 19104>20 string \x6a\x70\x32\x20 Part 1 (JP2) 19105!:mime image/jp2 19106>20 string \x6a\x70\x78\x20 Part 2 (JPX) 19107!:mime image/jpx 19108>20 string \x6a\x70\x6d\x20 Part 6 (JPM) 19109!:mime image/jpm 19110>20 string \x6d\x6a\x70\x32 Part 3 (MJ2) 19111!:mime video/mj2 19112 19113# Type: JPEG 2000 codesream 19114# From: Mathieu Malaterre <mathieu.malaterre@gmail.com> 191150 belong 0xff4fff51 JPEG 2000 codestream 1911645 beshort 0xff52 19117 19118# JPEG extended range 191190 string \x49\x49\xbc 19120>3 byte 1 19121>>4 lelong%2 0 JPEG-XR 19122!:mime image/jxr 19123!:ext jxr 19124 19125#------------------------------------------------------------------------------ 19126# $File: karma,v 1.8 2015/08/29 07:10:35 christos Exp $ 19127# karma: file(1) magic for Karma data files 19128# 19129# From <rgooch@atnf.csiro.au> 19130 191310 string KarmaRHD\040Version Karma Data Structure Version 19132>16 belong x %u 19133 19134#------------------------------------------------------------------------------ 19135# $File: kde,v 1.5 2010/11/25 15:00:12 christos Exp $ 19136# kde: file(1) magic for KDE 19137 191380 string/t [KDE\ Desktop\ Entry] KDE desktop entry 19139!:mime application/x-kdelnk 191400 string/t #\ KDE\ Config\ File KDE config file 19141!:mime application/x-kdelnk 191420 string/t #\ xmcd xmcd database file for kscd 19143!:mime text/x-xmcd 19144 19145#------------------------------------------------------------------------------ 19146# $File: keepass,v 1.2 2019/04/19 00:42:27 christos Exp $ 19147# keepass: file(1) magic for KeePass file 19148# 19149# Keepass Password Safe: 19150# * original one: https://keepass.info/ 19151# * *nix port: https://www.keepassx.org/ 19152# * android port: https://code.google.com/p/keepassdroid/ 19153 191540 lelong 0x9AA2D903 Keepass password database 19155>4 lelong 0xB54BFB65 1.x KDB 19156>>48 lelong >0 \b, %d groups 19157>>52 lelong >0 \b, %d entries 19158>>8 lelong&0x0f 1 \b, SHA-256 19159>>8 lelong&0x0f 2 \b, AES 19160>>8 lelong&0x0f 4 \b, RC4 19161>>8 lelong&0x0f 8 \b, Twofish 19162>>120 lelong >0 \b, %d key transformation rounds 19163>4 lelong 0xB54BFB67 2.x KDBX 19164 19165#------------------------------------------------------------------------------ 19166# $File: kerberos,v 1.3 2019/04/19 00:42:27 christos Exp $ 19167# kerberos: MIT kerberos file binary formats 19168# 19169 19170# This magic entry is for demonstration purposes and could be improved 19171# if the following features were implemented in file: 19172# 19173# Strings inside [[ .. ]] in the descriptions have special meanings and 19174# are not printed. 19175# 19176# - Provide some form of iteration in number of components 19177# [[${counter}=%d]] in the description 19178# then append 19179# [${counter}--] in the offset of the entries 19180# - Provide a way to round the next offset 19181# Add [R:4] after the offset? 19182# - Provide a way to have optional entries 19183# XXX: Syntax: 19184# - Provide a way to "save" entries to print them later. 19185# if the description is [[${name}=%s]], then nothing is 19186# printed and a subsequent entry in the same magic file 19187# can refer to ${name} 19188# - Provide a way to format strings as hex values 19189# 19190# https://www.gnu.org/software/shishi/manual/html_node/\ 19191# The-Keytab-Binary-File-Format.html 19192# 19193 191940 name keytab_entry 19195#>0 beshort x \b, size=%d 19196#>2 beshort x \b, components=%d 19197>4 pstring/H x \b, realm=%s 19198>>&0 pstring/H x \b, principal=%s/ 19199>>>&0 pstring/H x \b%s 19200>>>>&0 belong x \b, type=%d 19201>>>>>&0 bedate x \b, date=%s 19202>>>>>>&0 byte x \b, kvno=%u 19203#>>>>>>>&0 pstring/H x 19204#>>>>>>>>&0 belong x 19205#>>>>>>>>>>&0 use keytab_entry 19206 192070 belong 0x05020000 Kerberos Keytab file 19208>4 use keytab_entry 19209 19210#------------------------------------------------------------------------------ 19211# $File: kicad,v 1.2 2020/05/06 14:03:28 christos Exp $ 19212# kicad: file(1) magic for KiCad files 19213# 19214# See 19215# 19216# http://kicad-pcb.org 19217# 19218 19219# KiCad Schematic Document 192200 string (kicad_sch 19221>10 byte 0x20 KiCad Schematic Document 19222!:ext kicad_sch/kicad_sch-bak 19223>>11 string (version 19224>>>19 byte 0x20 19225>>>>20 regex [0-9.]+ (Version %s) 19226 19227# KiCad Schematic Document (Legacy) 192280 string EESchema 19229>8 byte 0x20 19230>>9 string Schematic 19231>>>18 byte 0x20 KiCad Schematic Document (Legacy) 19232!:ext sch/bak 19233>>>>24 string Version 19234>>>>>31 byte 0x20 19235>>>>>>32 string x (Version %s) 19236 19237# KiCad Symbol Library 192380 string (kicad_symbol_lib 19239>17 byte 0x20 KiCad Symbol Library 19240!:ext kicad_sym 19241>>18 string (version 19242>>>26 byte 0x20 19243>>>>27 regex [0-9.]+ (Version %s) 19244 19245# KiCad Symbol Library (Legacy) 192460 string EESchema-LIBRARY 19247>16 byte 0x20 KiCad Symbol Library (Legacy) 19248!:ext lib 19249>>17 string Version 19250>>>24 byte 0x20 19251>>>>25 string x (Version %s) 19252 19253# KiCad Symbol Library Documentation (Legacy) 192540 string EESchema-DOCLIB 19255>15 byte 0x20 KiCad Symbol Library Documentation (Legacy) 19256!:ext dcm 19257>>17 string Version 19258>>>24 byte 0x20 19259>>>>25 string x (Version %s) 19260 19261# KiCad Board Layout 192620 string (kicad_pcb 19263>10 byte 0x20 KiCad Board Layout 19264!:ext kicad_pcb/kicad_pcb-bak 19265>>11 string (version 19266>>>19 byte 0x20 19267>>>>20 regex [0-9.]+ (Version %s) 19268 19269# KiCad Footprint 192700 string (module 19271>7 byte 0x20 KiCad Footprint 19272!:ext kicad_mod 19273 19274# KiCad Footprint (Legacy) 192750 string PCBNEW-LibModule-V1 KiCad Footprint (Legacy) 19276!:ext mod 19277 19278# KiCad Netlist 192790 string (export 19280>7 byte 0x20 KiCad Netlist 19281!:ext net 19282 19283# KiCad Symbol Library Table 192840 string (sym_lib_table 19285>14 byte 0xA KiCad Symbol Library Table 19286>14 byte 0xD KiCad Symbol Library Table 19287>14 byte 0x20 KiCad Symbol Library Table 19288 19289# KiCad Footprint Library Table 192900 string (fp_lib_table 19291>13 byte 0xA KiCad Footprint Library Table 19292>13 byte 0xD KiCad Footprint Library Table 19293>13 byte 0x20 KiCad Footprint Library Table 19294 19295#------------------------------------------------------------------------------ 19296# $File: kml,v 1.6 2019/05/21 04:50:10 christos Exp $ 19297# Type: Google KML, formerly Keyhole Markup Language 19298# Future development of this format has been handed 19299# over to the Open Geospatial Consortium. 19300# https://www.opengeospatial.org/standards/kml/ 19301# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 193020 string/t \<?xml 19303>20 search/400 \ xmlns= 19304>>&0 regex ['"]http://earth.google.com/kml Google KML document 19305!:mime application/vnd.google-earth.kml+xml 19306>>>&1 string 2.0' \b, version 2.0 19307>>>&1 string 2.1' \b, version 2.1 19308>>>&1 string 2.2' \b, version 2.2 19309 19310#------------------------------------------------------------------------------ 19311# Type: OpenGIS KML, formerly Keyhole Markup Language 19312# This standard is maintained by the 19313# Open Geospatial Consortium. 19314# https://www.opengeospatial.org/standards/kml/ 19315# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 19316>>&0 regex ['"]http://www.opengis.net/kml OpenGIS KML document 19317!:mime application/vnd.google-earth.kml+xml 19318>>>&1 string/t 2.2 \b, version 2.2 19319 19320#------------------------------------------------------------------------------ 19321# Type: Google KML Archive (ZIP based) 19322# https://code.google.com/apis/kml/documentation/kml_tut.html 19323# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 193240 string PK\003\004 19325>4 byte 0x14 19326>>30 string doc.kml Compressed Google KML Document, including resources. 19327!:mime application/vnd.google-earth.kmz 19328 19329#------------------------------------------------------------------------------ 19330# $File: lecter,v 1.4 2009/09/19 16:28:10 christos Exp $ 19331# DEC SRC Virtual Paper: Lectern files 19332# Karl M. Hegbloom <karlheg@inetarena.com> 193330 string lect DEC SRC Virtual Paper Lectern file 19334 19335#------------------------------------------------------------------------------ 19336# $File: lex,v 1.6 2009/09/19 16:28:10 christos Exp $ 19337# lex: file(1) magic for lex 19338# 19339# derived empirically, your offsets may vary! 193400 search/100 yyprevious C program text (from lex) 19341>3 search/1 >\0 for %s 19342# C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com> 193430 search/100 generated\ by\ flex C program text (from flex) 19344# lex description file, from Daniel Quinlan <quinlan@yggdrasil.com> 193450 search/1 %{ lex description text 19346 19347#------------------------------------------------------------------------------ 19348# $File: lif,v 1.8 2009/09/19 16:28:10 christos Exp $ 19349# lif: file(1) magic for lif 19350# 19351# (Daniel Quinlan <quinlan@yggdrasil.com>) 19352# 193530 beshort 0x8000 lif file 19354 19355#------------------------------------------------------------------------------ 19356# $File: linux,v 1.72 2020/06/07 21:56:13 christos Exp $ 19357# linux: file(1) magic for Linux files 19358# 19359# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com> 19360# The following basic Linux magic is useful for reference, but using 19361# "long" magic is a better practice in order to avoid collisions. 19362# 19363# 2 leshort 100 Linux/i386 19364# >0 leshort 0407 impure executable (OMAGIC) 19365# >0 leshort 0410 pure executable (NMAGIC) 19366# >0 leshort 0413 demand-paged executable (ZMAGIC) 19367# >0 leshort 0314 demand-paged executable (QMAGIC) 19368# 193690 lelong 0x00640107 Linux/i386 impure executable (OMAGIC) 19370>16 lelong 0 \b, stripped 193710 lelong 0x00640108 Linux/i386 pure executable (NMAGIC) 19372>16 lelong 0 \b, stripped 193730 lelong 0x0064010b Linux/i386 demand-paged executable (ZMAGIC) 19374>16 lelong 0 \b, stripped 193750 lelong 0x006400cc Linux/i386 demand-paged executable (QMAGIC) 19376>16 lelong 0 \b, stripped 19377# 193780 string \007\001\000 Linux/i386 object file 19379>20 lelong >0x1020 \b, DLL library 19380# Linux-8086 stuff: 193810 string \01\03\020\04 Linux-8086 impure executable 19382>28 long !0 not stripped 193830 string \01\03\040\04 Linux-8086 executable 19384>28 long !0 not stripped 19385# 193860 string \243\206\001\0 Linux-8086 object file 19387# 193880 string \01\03\020\20 Minix-386 impure executable 19389>28 long !0 not stripped 193900 string \01\03\040\20 Minix-386 executable 19391>28 long !0 not stripped 193920 string \01\03\04\20 Minix-386 NSYM/GNU executable 19393>28 long !0 not stripped 19394# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov> 19395216 lelong 0421 Linux/i386 core file 19396!:strength / 2 19397>220 string >\0 of '%s' 19398>200 lelong >0 (signal %d) 19399# 19400# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com> 19401# this can be overridden by the DOS executable (COM) entry 194022 string LILO Linux/i386 LILO boot/chain loader 19403# 19404# Linux make config build file, from Ole Aamot <oka@oka.no> 19405# Updated by Ken Sharp 1940628 string make\ config Linux make config build file (old) 1940749 search/70 Kernel\ Configuration Linux make config build file 19408 19409# 19410# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com> 19411# Updated by Adam Buchbinder <adam.buchbinder@gmail.com> 19412# See: https://www.win.tue.nl/~aeb/linux/kbd/font-formats-1.html 194130 leshort 0x0436 Linux/i386 PC Screen Font v1 data, 19414>2 byte&0x01 0 256 characters, 19415>2 byte&0x01 !0 512 characters, 19416>2 byte&0x02 0 no directory, 19417>2 byte&0x02 !0 Unicode directory, 19418>3 byte >0 8x%d 194190 string \x72\xb5\x4a\x86\x00\x00 Linux/i386 PC Screen Font v2 data, 19420>16 lelong x %d characters, 19421>12 lelong&0x01 0 no directory, 19422>12 lelong&0x01 !0 Unicode directory, 19423>24 lelong x %d 19424>28 lelong x \bx%d 19425 19426# Linux swap and hibernate files 19427# Linux kernel: include/linux/swap.h 19428# util-linux: libblkid/src/superblocks/swap.c 19429 19430# format v0, unsupported since 2002 194310xff6 string SWAP-SPACE Linux old swap file, 4k page size 194320x1ff6 string SWAP-SPACE Linux old swap file, 8k page size 194330x3ff6 string SWAP-SPACE Linux old swap file, 16k page size 194340x7ff6 string SWAP-SPACE Linux old swap file, 32k page size 194350xfff6 string SWAP-SPACE Linux old swap file, 64k page size 19436 19437# format v1, supported since 1998 194380 name linux-swap 19439>0x400 lelong 1 little endian, version %u, 19440>>0x404 lelong x size %u pages, 19441>>0x408 lelong x %u bad pages, 19442>0x400 belong 1 big endian, version %u, 19443>>0x404 belong x size %u pages, 19444>>0x408 belong x %u bad pages, 19445>0x41c string \0 no label, 19446>0x41c string >\0 LABEL=%s, 19447>0x40c belong x UUID=%08x 19448>0x410 beshort x \b-%04x 19449>0x412 beshort x \b-%04x 19450>0x414 beshort x \b-%04x 19451>0x416 belong x \b-%08x 19452>0x41a beshort x \b%04x 19453 194540xff6 string SWAPSPACE2 Linux swap file, 4k page size, 19455>0 use linux-swap 194560x1ff6 string SWAPSPACE2 Linux swap file, 8k page size, 19457>0 use linux-swap 194580x3ff6 string SWAPSPACE2 Linux swap file, 16k page size, 19459>0 use linux-swap 194600x7ff6 string SWAPSPACE2 Linux swap file, 32k page size, 19461>0 use linux-swap 194620xfff6 string SWAPSPACE2 Linux swap file, 64k page size, 19463>0 use linux-swap 19464 194650 name linux-hibernate 19466>0 string S1SUSPEND \b, with SWSUSP1 image 19467>0 string S2SUSPEND \b, with SWSUSP2 image 19468>0 string ULSUSPEND \b, with uswsusp image 19469>0 string LINHIB0001 \b, with compressed hibernate image 19470>0 string \xed\xc3\x02\xe9\x98\x56\xe5\x0c \b, with tuxonice image 19471>0 default x \b, with unknown hibernate image 19472 194730xfec string SWAPSPACE2 Linux swap file, 4k page size, 19474>0 use linux-swap 19475>0xff6 use linux-hibernate 194760x1fec string SWAPSPACE2 Linux swap file, 8k page size, 19477>0 use linux-swap 19478>0x1ff6 use linux-hibernate 194790x3fec string SWAPSPACE2 Linux swap file, 16k page size, 19480>0 use linux-swap 19481>0x3ff6 use linux-hibernate 194820x7fec string SWAPSPACE2 Linux swap file, 32k page size, 19483>0 use linux-swap 19484>0x7ff6 use linux-hibernate 194850xffec string SWAPSPACE2 Linux swap file, 64k page size, 19486>0 use linux-swap 19487>0xfff6 use linux-hibernate 19488 19489# 19490# Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu> 19491# and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de> 19492# and Nicolas Lichtmaier <nick@debian.org> 19493# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29 19494# Linux kernel boot images (i386 arch) (Wolfram Kleff) 19495# URL: https://www.kernel.org/doc/Documentation/x86/boot.txt 19496514 string HdrS Linux kernel 19497!:strength + 55 19498# often no extension like in linux, vmlinuz, bzimage or memdisk but sometimes 19499# Acronis Recovery kernel64.dat and Plop Boot Manager plpbtrom.bin 19500# DamnSmallLinux 1.5 damnsmll.lnx 19501!:ext /dat/bin/lnx 19502>510 leshort 0xAA55 x86 boot executable 19503>>518 leshort >0x1ff 19504>>>529 byte 0 zImage, 19505>>>529 byte 1 bzImage, 19506>>>526 lelong >0 19507>>>>(526.s+0x200) string >\0 version %s, 19508>>498 leshort 1 RO-rootFS, 19509>>498 leshort 0 RW-rootFS, 19510>>508 leshort >0 root_dev 0x%X, 19511>>502 leshort >0 swap_dev 0x%X, 19512>>504 leshort >0 RAMdisksize %u KB, 19513>>506 leshort 0xFFFF Normal VGA 19514>>506 leshort 0xFFFE Extended VGA 19515>>506 leshort 0xFFFD Prompt for Videomode 19516>>506 leshort >0 Video mode %d 19517# This also matches new kernels, which were caught above by "HdrS". 195180 belong 0xb8c0078e Linux kernel 19519>0x1e3 string Loading version 1.3.79 or older 19520>0x1e9 string Loading from prehistoric times 19521 19522# System.map files - Nicolas Lichtmaier <nick@debian.org> 195238 search/1 \ A\ _text Linux kernel symbol map text 19524 19525# LSM entries - Nicolas Lichtmaier <nick@debian.org> 195260 search/1 Begin3 Linux Software Map entry text 195270 search/1 Begin4 Linux Software Map entry text (new format) 19528 19529# From Matt Zimmerman, enhanced for v3 by Matthew Palmer 195300 belong 0x4f4f4f4d User-mode Linux COW file 19531>4 belong <3 \b, version %d 19532>>8 string >\0 \b, backing file %s 19533>4 belong >2 \b, version %d 19534>>32 string >\0 \b, backing file %s 19535 19536############################################################################ 19537# Linux kernel versions 19538 195390 string \xb8\xc0\x07\x8e\xd8\xb8\x00\x90 Linux 19540>497 leshort 0 x86 boot sector 19541>>514 belong 0x8e of a kernel from the dawn of time! 19542>>514 belong 0x908ed8b4 version 0.99-1.1.42 19543>>514 belong 0x908ed8b8 for memtest86 19544 19545>497 leshort !0 x86 kernel 19546>>504 leshort >0 RAMdisksize=%u KB 19547>>502 leshort >0 swap=0x%X 19548>>508 leshort >0 root=0x%X 19549>>>498 leshort 1 \b-ro 19550>>>498 leshort 0 \b-rw 19551>>506 leshort 0xFFFF vga=normal 19552>>506 leshort 0xFFFE vga=extended 19553>>506 leshort 0xFFFD vga=ask 19554>>506 leshort >0 vga=%d 19555>>514 belong 0x908ed881 version 1.1.43-1.1.45 19556>>514 belong 0x15b281cd 19557>>>0xa8e belong 0x55AA5a5a version 1.1.46-1.2.13,1.3.0 19558>>>0xa99 belong 0x55AA5a5a version 1.3.1,2 19559>>>0xaa3 belong 0x55AA5a5a version 1.3.3-1.3.30 19560>>>0xaa6 belong 0x55AA5a5a version 1.3.31-1.3.41 19561>>>0xb2b belong 0x55AA5a5a version 1.3.42-1.3.45 19562>>>0xaf7 belong 0x55AA5a5a version 1.3.46-1.3.72 19563>>514 string HdrS 19564>>>518 leshort >0x1FF 19565>>>>529 byte 0 \b, zImage 19566>>>>529 byte 1 \b, bzImage 19567>>>>(526.s+0x200) string >\0 \b, version %s 19568 19569# Linux boot sector thefts. 195700 belong 0xb8c0078e Linux 19571>0x1e6 belong 0x454c4b53 ELKS Kernel 19572>0x1e6 belong !0x454c4b53 style boot sector 19573 19574############################################################################ 19575# Linux S390 kernel image 19576# Created by: Jan Kaluza <jkaluza@redhat.com> 195778 string \x02\x00\x00\x18\x60\x00\x00\x50\x02\x00\x00\x68\x60\x00\x00\x50\x40\x40\x40\x40\x40\x40\x40\x40 Linux S390 19578>0x00010000 search/b/4096 \x00\x0a\x00\x00\x8b\xad\xcc\xcc 19579# 64bit 19580>>&0 string \xc1\x00\xef\xe3\xf0\x68\x00\x00 Z10 64bit kernel 19581>>&0 string \xc1\x00\xef\xc3\x00\x00\x00\x00 Z9-109 64bit kernel 19582>>&0 string \xc0\x00\x20\x00\x00\x00\x00\x00 Z990 64bit kernel 19583>>&0 string \x00\x00\x00\x00\x00\x00\x00\x00 Z900 64bit kernel 19584# 32bit 19585>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z10 32bit kernel 19586>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z9-109 32bit kernel 19587>>&0 string \x80\x00\x20\x00\x00\x00\x00\x00 Z990 32bit kernel 19588>>&0 string \x80\x00\x00\x00\x00\x00\x00\x00 Z900 32bit kernel 19589 19590############################################################################ 19591# Linux ARM compressed kernel image 19592# From: Kevin Cernekee <cernekee@gmail.com> 19593# Update: Joerg Jenderek 195940x24 lelong 0x016f2818 Linux kernel ARM boot executable zImage 19595# There are three posible situations: LE, BE with LE bootloader and pure BE. 19596# In order to aid telling these apart a new endian flag was added. In order 19597# to support kernels before the flag and BE with LE bootloader was added we'll 19598# do a negative check against the BE variant of the flag when we see a LE magic. 19599>0x30 belong !0x04030201 (little-endian) 19600>0x30 belong 0x04030201 (big-endian) 19601# raspian "kernel7.img", Vu+ Ultimo4K "kernel_auto.bin" 19602!:ext img/bin 196030x24 belong 0x016f2818 Linux kernel ARM boot executable zImage (big-endian) 19604 19605############################################################################ 19606# Linux AARCH64 kernel image 196070x38 lelong 0x644d5241 Linux kernel ARM64 boot executable Image 19608>0x18 lelong ^1 \b, little-endian 19609>0x18 lelong &1 \b, big-endian 19610>0x18 lelong &2 \b, 4K pages 19611>0x18 lelong &4 \b, 16K pages 19612>0x18 lelong &6 \b, 32K pages 19613 19614############################################################################ 19615# Linux 8086 executable 196160 lelong&0xFF0000FF 0xC30000E9 Linux-Dev86 executable, headerless 19617>5 string . 19618>>4 string >\0 \b, libc version %s 19619 196200 lelong&0xFF00FFFF 0x4000301 Linux-8086 executable 19621>2 byte&0x01 !0 \b, unmapped zero page 19622>2 byte&0x20 0 \b, impure 19623>2 byte&0x20 !0 19624>>2 byte&0x10 !0 \b, A_EXEC 19625>2 byte&0x02 !0 \b, A_PAL 19626>2 byte&0x04 !0 \b, A_NSYM 19627>2 byte&0x08 !0 \b, A_STAND 19628>2 byte&0x40 !0 \b, A_PURE 19629>2 byte&0x80 !0 \b, A_TOVLY 19630>28 long !0 \b, not stripped 19631>37 string . 19632>>36 string >\0 \b, libc version %s 19633 19634# 0 lelong&0xFF00FFFF 0x10000301 ld86 I80386 executable 19635# 0 lelong&0xFF00FFFF 0xB000301 ld86 M68K executable 19636# 0 lelong&0xFF00FFFF 0xC000301 ld86 NS16K executable 19637# 0 lelong&0xFF00FFFF 0x17000301 ld86 SPARC executable 19638 19639# SYSLINUX boot logo files (from 'ppmtolss16' sources) 19640# https://www.syslinux.org/wiki/index.php/SYSLINUX#Display_graphic_from_filename: 19641# file extension .lss .16 196420 lelong =0x1413f33d SYSLINUX' LSS16 image data 19643# syslinux-4.05/mime/image/x-lss16.xml 19644!:mime image/x-lss16 19645>4 leshort x \b, width %d 19646>6 leshort x \b, height %d 19647 196480 string OOOM User-Mode-Linux's Copy-On-Write disk image 19649>4 belong x version %d 19650 19651# SE Linux policy database 19652# From: Mike Frysinger <vapier@gentoo.org> 196530 lelong 0xf97cff8c SE Linux policy 19654>16 lelong x v%d 19655>20 lelong 1 MLS 19656>24 lelong x %d symbols 19657>28 lelong x %d ocons 19658 19659# Linux Logical Volume Manager (LVM) 19660# Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net> 19661# 19662# System ID, UUID and volume group name are 128 bytes long 19663# but they should never be full and initialized with zeros... 19664# 19665# LVM1 19666# 196670x0 string/b HM\001 LVM1 (Linux Logical Volume Manager), version 1 19668>0x12c string/b >\0 , System ID: %s 19669 196700x0 string/b HM\002 LVM1 (Linux Logical Volume Manager), version 2 19671>0x12c string/b >\0 , System ID: %s 19672 19673# LVM2 19674# 19675# It seems that the label header can be in one the four first sector 19676# of the disk... (from _find_labeller in lib/label/label.c of LVM2) 19677# 19678# 0x200 seems to be the common case 196790 name lvm2 19680# display UUID in LVM format + display all 32 bytes (instead of max string length: 31) 19681>0x0 string >\x2f \b, UUID: %.6s 19682>0x6 string >\x2f \b-%.4s 19683>0xa string >\x2f \b-%.4s 19684>0xe string >\x2f \b-%.4s 19685>0x12 string >\x2f \b-%.4s 19686>0x16 string >\x2f \b-%.4s 19687>0x1a string >\x2f \b-%.6s 19688>0x20 lequad x \b, size: %lld 19689 19690 19691# read the offset to add to the start of the header, and the header 19692# start in 0x200 196930x218 string/b LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 19694>&(&-12.l-0x20) use lvm2 19695 196960x018 string/b LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 19697>&(&-12.l-0x20) use lvm2 19698 196990x418 string/b LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 19700>&(&-12.l-0x20) use lvm2 19701 197020x618 string/b LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 19703>&(&-12.l-0x20) use lvm2 19704 19705# LVM snapshot 19706# from Jason Farrel 197070 string SnAp LVM Snapshot (CopyOnWrite store) 19708>4 lelong !0 - valid, 19709>4 lelong 0 - invalid, 19710>8 lelong x version %d, 19711>12 lelong x chunk_size %d 19712 19713# SE Linux policy database 197140 lelong 0xf97cff8c SE Linux policy 19715>16 lelong x v%d 19716>20 lelong 1 MLS 19717>24 lelong x %d symbols 19718>28 lelong x %d ocons 19719 19720# LUKS: Linux Unified Key Setup, On-Disk Format, http://luks.endorphin.org/spec 19721# Anthon van der Neut (anthon@mnt.org) 197220 string LUKS\xba\xbe LUKS encrypted file, 19723>6 beshort x ver %d 19724>8 string x [%s, 19725>40 string x %s, 19726>72 string x %s] 19727>168 string x UUID: %s 19728 19729 19730# Summary: Xen saved domain file 19731# Created by: Radek Vokal <rvokal@redhat.com> 197320 string LinuxGuestRecord Xen saved domain 19733>20 search/256 (name 19734>>&1 string x (name %s) 19735 19736# Type: Xen, the virtual machine monitor 19737# From: Radek Vokal <rvokal@redhat.com> 197380 string LinuxGuestRecord Xen saved domain 19739#>2 regex \(name\ [^)]*\) %s 19740>20 search/256 (name (name 19741>>&1 string x %s...) 19742 19743# Systemd journald files 19744# See https://www.freedesktop.org/wiki/Software/systemd/journal-files/. 19745# From: Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl> 19746 19747# check magic 197480 string LPKSHHRH 19749# check that state is one of known values 19750>16 ubyte&252 0 19751# check that each half of three unique id128s is non-zero 19752>>24 ubequad >0 19753>>>32 ubequad >0 19754>>>>40 ubequad >0 19755>>>>>48 ubequad >0 19756>>>>>>56 ubequad >0 19757>>>>>>>64 ubequad >0 Journal file 19758!:mime application/octet-stream 19759# provide more info 19760>>>>>>>>184 leqdate 0 empty 19761>>>>>>>>16 ubyte 0 \b, offline 19762>>>>>>>>16 ubyte 1 \b, online 19763>>>>>>>>16 ubyte 2 \b, archived 19764>>>>>>>>8 ulelong&1 1 \b, sealed 19765>>>>>>>>12 ulelong&1 1 \b, compressed 19766 19767# BCache backing and cache devices 19768# From: Gabriel de Perthuis <g2p.code@gmail.com> 197690x1008 lequad 8 19770>0x1018 string \xc6\x85\x73\xf6\x4e\x1a\x45\xca\x82\x65\xf5\x7f\x48\xba\x6d\x81 BCache 19771>>0x1010 ulequad 0 cache device 19772>>0x1010 ulequad 1 backing device 19773>>0x1010 ulequad 3 cache device 19774>>0x1010 ulequad 4 backing device 19775>>0x1048 string >0 \b, label "%.32s" 19776>>0x1028 ubelong x \b, uuid %08x 19777>>0x102c ubeshort x \b-%04x 19778>>0x102e ubeshort x \b-%04x 19779>>0x1030 ubeshort x \b-%04x 19780>>0x1032 ubelong x \b-%08x 19781>>0x1036 ubeshort x \b%04x 19782>>0x1038 ubelong x \b, set uuid %08x 19783>>0x103c ubeshort x \b-%04x 19784>>0x103e ubeshort x \b-%04x 19785>>0x1040 ubeshort x \b-%04x 19786>>0x1042 ubelong x \b-%08x 19787>>0x1046 ubeshort x \b%04x 19788 19789# Linux device tree: 19790# File format description can be found in the Linux kernel sources at 19791# Documentation/devicetree/booting-without-of.txt 19792# From Christoph Biedl 197930 belong 0xd00dfeed 19794# structure and strings must be within blob 19795>&(8.L) byte x 19796>>&(12.L) byte x 19797>>>20 belong >1 Device Tree Blob version %d 19798>>>>4 belong x \b, size=%d 19799>>>>20 belong >1 19800>>>>>28 belong x \b, boot CPU=%d 19801>>>>20 belong >2 19802>>>>>32 belong x \b, string block size=%d 19803>>>>20 belong >16 19804>>>>>36 belong x \b, DT structure block size=%d 19805 19806# glibc locale archive as defined in glibc locale/locarchive.h 198070 lelong 0xde020109 locale archive 19808>24 lelong x %d strings 19809 19810# Linux Software RAID (mdadm) 19811# Russell Coker <russell@coker.com.au> 198120 name linuxraid 19813>16 belong x UUID=%8x: 19814>20 belong x \b%8x: 19815>24 belong x \b%8x: 19816>28 belong x \b%8x 19817>32 string x name=%s 19818>72 lelong x level=%d 19819>92 lelong x disks=%d 19820 198214096 lelong 0xa92b4efc Linux Software RAID 19822>4100 lelong x version 1.2 (%d) 19823>4096 use linuxraid 19824 198250 lelong 0xa92b4efc Linux Software RAID 19826>4 lelong x version 1.1 (%d) 19827>0 use linuxraid 19828 19829# Summary: Database file for mlocate 19830# Description: A database file as used by mlocate, a fast implementation 19831# of locate/updatedb. It uses merging to reuse the existing 19832# database and avoid rereading most of the filesystem. It's 19833# the default version of locate on Arch Linux (and others). 19834# File path: /var/lib/mlocate/mlocate.db by default (but configurable) 19835# Site: https://fedorahosted.org/mlocate/ 19836# Format docs: https://linux.die.net/man/5/mlocate.db 19837# Type: mlocate database file 19838# URL: https://fedorahosted.org/mlocate/ 19839# From: Wander Nauta <info@wandernauta.nl> 198400 string \0mlocate mlocate database 19841>12 byte x \b, version %d 19842>13 byte 1 \b, require visibility 19843>16 string x \b, root %s 19844 19845# Dump files for iproute2 tool. Generated by the "ip r|a save" command. URL: 19846# https://www.linuxfoundation.org/collaborate/workgroups/networking/iproute2 19847# From: Pavel Emelyanov <xemul@parallels.com> 198480 lelong 0x45311224 iproute2 routes dump 198490 lelong 0x47361222 iproute2 addresses dump 19850 19851# Image and service files for CRIU tool. 19852# URL: https://criu.org 19853# From: Pavel Emelyanov <xemul@parallels.com> 198540 lelong 0x54564319 CRIU image file v1.1 198550 lelong 0x55105940 CRIU service file 198560 lelong 0x58313116 CRIU inventory 19857 19858# Kdump compressed dump files 19859# https://sourceforge.net/p/makedumpfile/code/ci/master/tree/IMPLEMENTATION 19860 198610 string KDUMP Kdump compressed dump 19862>8 long x v%d 19863>12 string >\0 \b, system %s 19864>77 string >\0 \b, node %s 19865>142 string >\0 \b, release %s 19866>207 string >\0 \b, version %s 19867>272 string >\0 \b, machine %s 19868>337 string >\0 \b, domain %s 19869 19870# Device Tree files 198710 search/1024 /dts-v1/ Device Tree File (v1) 19872# beat c code 19873!:strength +14 19874 19875#------------------------------------------------------------------------------ 19876# $File: lisp,v 1.26 2019/04/19 00:42:27 christos Exp $ 19877# lisp: file(1) magic for lisp programs 19878# 19879# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com) 19880 19881# updated by Joerg Jenderek 19882# GRR: This lot is too weak 19883#0 string ;; 19884# windows INF files often begin with semicolon and use CRLF as line end 19885# lisp files are mainly created on unix system with LF as line end 19886#>2 search/4096 !\r Lisp/Scheme program text 19887#>2 search/4096 \r Windows INF file 19888 198890 search/4096 (setq\ Lisp/Scheme program text 19890!:mime text/x-lisp 198910 search/4096 (defvar\ Lisp/Scheme program text 19892!:mime text/x-lisp 198930 search/4096 (defparam\ Lisp/Scheme program text 19894!:mime text/x-lisp 198950 search/4096 (defun\ Lisp/Scheme program text 19896!:mime text/x-lisp 198970 search/4096 (autoload\ Lisp/Scheme program text 19898!:mime text/x-lisp 198990 search/4096 (custom-set-variables\ Lisp/Scheme program text 19900!:mime text/x-lisp 19901 19902# URL: https://en.wikipedia.org/wiki/Emacs_Lisp 19903# Reference: https://ftp.gnu.org/old-gnu/emacs/elisp-manual-18-1.03.tar.gz 19904# Update: Joerg Jenderek 19905# Emacs 18 - this is always correct, but not very magical. 199060 string \012( 19907# look for emacs lisp keywords 19908# GRR: split regex because it is too long or get error like 19909# lisp, 36: Warning: cannot get string from `^(defun|defvar|defconst|defmacro|setq|fset|put|provide|require|' 19910>&0 regex \^(defun|defvar|defconst|defmacro|setq|fset) Emacs v18 byte-compiled Lisp data 19911!:mime application/x-elc 19912# https://searchcode.com/codesearch/view/2173420/ 19913# not really pure text 19914!:apple EMAxTEXT 19915!:ext elc 19916# remaining regex 19917>&0 regex \^(put|provide|require|random) Emacs v18 byte-compiled Lisp data 19918!:mime application/x-elc 19919!:apple EMAxTEXT 19920!:ext elc 19921# missed cl.elc dbx.elc simple.elc look like normal lisp starting with ;;; 19922 19923# Emacs 19+ - ver. recognition added by Ian Springer 19924# Also applies to XEmacs 19+ .elc files; could tell them apart with regexs 19925# - Chris Chittleborough <cchittleborough@yahoo.com.au> 19926# Update: Joerg Jenderek 199270 string ;ELC 19928# version\0\0\0 19929>4 byte >18 Emacs/XEmacs v%d byte-compiled Lisp data 19930# why less than 32 ? does not make sense to me. GNU Emacs version is 24.5 at April 2015 19931#>4 byte <32 Emacs/XEmacs v%d byte-compiled Lisp data 19932!:mime application/x-elc 19933!:apple EMAxTEXT 19934!:ext elc 19935 19936# Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr> 199370 string (SYSTEM::VERSION\040' CLISP byte-compiled Lisp program (pre 2004-03-27) 199380 string (|SYSTEM|::|VERSION|\040' CLISP byte-compiled Lisp program text 19939 199400 long 0x70768BD2 CLISP memory image data 199410 long 0xD28B7670 CLISP memory image data, other endian 19942 19943#.com and .bin for MIT scheme 199440 string \372\372\372\372 MIT scheme (library?) 19945 19946# From: David Allouche <david@allouche.net> 199470 search/1 \<TeXmacs| TeXmacs document text 19948!:mime text/texmacs 19949 19950#------------------------------------------------------------------------------ 19951# $File: llvm,v 1.9 2019/04/19 00:42:27 christos Exp $ 19952# llvm: file(1) magic for LLVM byte-codes 19953# URL: https://llvm.org/docs/BitCodeFormat.html 19954# From: Al Stone <ahs3@fc.hp.com> 19955 199560 string llvm LLVM byte-codes, uncompressed 199570 string llvc0 LLVM byte-codes, null compression 199580 string llvc1 LLVM byte-codes, gzip compression 199590 string llvc2 LLVM byte-codes, bzip2 compression 19960 199610 lelong 0x0b17c0de LLVM bitcode, wrapper 19962# Are these Mach-O ABI values? They appear to be. 19963>16 lelong 0x01000007 x86_64 19964>16 lelong 0x00000007 i386 19965>16 lelong 0x00000012 ppc 19966>16 lelong 0x01000012 ppc64 19967>16 lelong 0x0000000c arm 19968 199690 string BC\xc0\xde LLVM IR bitcode 19970 19971#------------------------------------------------------------------------------ 19972# $File: lua,v 1.7 2019/04/19 00:42:27 christos Exp $ 19973# lua: file(1) magic for Lua scripting language 19974# URL: https://www.lua.org/ 19975# From: Reuben Thomas <rrt@sc3d.org>, Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr> 19976 19977# Lua scripts 199780 search/1/w #!\ /usr/bin/lua Lua script text executable 19979!:mime text/x-lua 199800 search/1/w #!\ /usr/local/bin/lua Lua script text executable 19981!:mime text/x-lua 199820 search/1 #!/usr/bin/env\ lua Lua script text executable 19983!:mime text/x-lua 199840 search/1 #!\ /usr/bin/env\ lua Lua script text executable 19985!:mime text/x-lua 19986 19987# Lua bytecode 199880 string \033Lua Lua bytecode, 19989>4 byte 0x50 version 5.0 19990>4 byte 0x51 version 5.1 19991>4 byte 0x52 version 5.2 19992 19993#------------------------------------------------------------------------------ 19994# $File: luks,v 1.4 2009/09/19 16:28:10 christos Exp $ 19995# luks: file(1) magic for Linux Unified Key Setup 19996# URL: http://luks.endorphin.org/spec 19997# From: Anthon van der Neut <anthon@mnt.org> 19998 199990 string LUKS\xba\xbe LUKS encrypted file, 20000>6 beshort x ver %d 20001>8 string x [%s, 20002>40 string x %s, 20003>72 string x %s] 20004>168 string x UUID: %s 20005#------------------------------------------------------------------------------ 20006# $File: m4,v 1.3 2019/02/27 16:46:23 christos Exp $ 20007# make: file(1) magic for M4 scripts 20008# 200090 search/8192 dnl 20010>0 regex \^dnl\ M4 macro processor script text 20011!:mime text/x-m4 200120 search/8192 AC_DEFUN 20013>0 regex \^AC_DEFUN\\(\\[ M4 macro processor script text 20014!:strength + 15 20015!:mime text/x-m4 20016 20017#------------------------------------------------------------ 20018# $File: mach,v 1.23 2015/10/15 21:51:22 christos Exp $ 20019# Mach has two magic numbers, 0xcafebabe and 0xfeedface. 20020# Unfortunately the first, cafebabe, is shared with 20021# Java ByteCode, so they are both handled in the file "cafebabe". 20022# The "feedface" ones are handled herein. 20023#------------------------------------------------------------ 20024# if set, it's for the 64-bit version of the architecture 20025# yes, this is separate from the low-order magic number bit 20026# it's also separate from the "64-bit libraries" bit in the 20027# upper 8 bits of the CPU subtype 20028 200290 name mach-o-cpu 20030>0 belong&0x01000000 0 20031# 20032# 32-bit ABIs. 20033# 20034# 1 vax 20035>>0 belong&0x00ffffff 1 20036>>>4 belong&0x00ffffff 0 vax 20037>>>4 belong&0x00ffffff 1 vax11/780 20038>>>4 belong&0x00ffffff 2 vax11/785 20039>>>4 belong&0x00ffffff 3 vax11/750 20040>>>4 belong&0x00ffffff 4 vax11/730 20041>>>4 belong&0x00ffffff 5 uvaxI 20042>>>4 belong&0x00ffffff 6 uvaxII 20043>>>4 belong&0x00ffffff 7 vax8200 20044>>>4 belong&0x00ffffff 8 vax8500 20045>>>4 belong&0x00ffffff 9 vax8600 20046>>>4 belong&0x00ffffff 10 vax8650 20047>>>4 belong&0x00ffffff 11 vax8800 20048>>>4 belong&0x00ffffff 12 uvaxIII 20049>>>4 belong&0x00ffffff >12 vax subarchitecture=%d 20050>>0 belong&0x00ffffff 2 romp 20051>>0 belong&0x00ffffff 3 architecture=3 20052>>0 belong&0x00ffffff 4 ns32032 20053>>0 belong&0x00ffffff 5 ns32332 20054>>0 belong&0x00ffffff 6 m68k 20055# 7 x86 20056>>0 belong&0x00ffffff 7 20057>>>4 belong&0x0000000f 3 i386 20058>>>4 belong&0x0000000f 4 i486 20059>>>>4 belong&0x00fffff0 0 20060>>>>4 belong&0x00fffff0 0x80 \bsx 20061>>>4 belong&0x0000000f 5 i586 20062>>>4 belong&0x0000000f 6 20063>>>>4 belong&0x00fffff0 0 p6 20064>>>>4 belong&0x00fffff0 0x10 pentium_pro 20065>>>>4 belong&0x00fffff0 0x20 pentium_2_m0x20 20066>>>>4 belong&0x00fffff0 0x30 pentium_2_m3 20067>>>>4 belong&0x00fffff0 0x40 pentium_2_m0x40 20068>>>>4 belong&0x00fffff0 0x50 pentium_2_m5 20069>>>>4 belong&0x00fffff0 >0x50 pentium_2_m0x%x 20070>>>4 belong&0x0000000f 7 celeron 20071>>>>4 belong&0x00fffff0 0x00 \b_m0x%x 20072>>>>4 belong&0x00fffff0 0x10 \b_m0x%x 20073>>>>4 belong&0x00fffff0 0x20 \b_m0x%x 20074>>>>4 belong&0x00fffff0 0x30 \b_m0x%x 20075>>>>4 belong&0x00fffff0 0x40 \b_m0x%x 20076>>>>4 belong&0x00fffff0 0x50 \b_m0x%x 20077>>>>4 belong&0x00fffff0 0x60 20078>>>>4 belong&0x00fffff0 0x70 \b_mobile 20079>>>>4 belong&0x00fffff0 >0x70 \b_m0x%x 20080>>>4 belong&0x0000000f 8 pentium_3 20081>>>>4 belong&0x00fffff0 0x00 20082>>>>4 belong&0x00fffff0 0x10 \b_m 20083>>>>4 belong&0x00fffff0 0x20 \b_xeon 20084>>>>4 belong&0x00fffff0 >0x20 \b_m0x%x 20085>>>4 belong&0x0000000f 9 pentiumM 20086>>>>4 belong&0x00fffff0 0x00 20087>>>>4 belong&0x00fffff0 >0x00 \b_m0x%x 20088>>>4 belong&0x0000000f 10 pentium_4 20089>>>>4 belong&0x00fffff0 0x00 20090>>>>4 belong&0x00fffff0 0x10 \b_m 20091>>>>4 belong&0x00fffff0 >0x10 \b_m0x%x 20092>>>4 belong&0x0000000f 11 itanium 20093>>>>4 belong&0x00fffff0 0x00 20094>>>>4 belong&0x00fffff0 0x10 \b_2 20095>>>>4 belong&0x00fffff0 >0x10 \b_m0x%x 20096>>>4 belong&0x0000000f 12 xeon 20097>>>>4 belong&0x00fffff0 0x00 20098>>>>4 belong&0x00fffff0 0x10 \b_mp 20099>>>>4 belong&0x00fffff0 >0x10 \b_m0x%x 20100>>>4 belong&0x0000000f >12 ia32 family=%d 20101>>>>4 belong&0x00fffff0 0x00 20102>>>>4 belong&0x00fffff0 >0x00 model=%x 20103>>0 belong&0x00ffffff 8 mips 20104>>>4 belong&0x00ffffff 1 R2300 20105>>>4 belong&0x00ffffff 2 R2600 20106>>>4 belong&0x00ffffff 3 R2800 20107>>>4 belong&0x00ffffff 4 R2000a 20108>>>4 belong&0x00ffffff 5 R2000 20109>>>4 belong&0x00ffffff 6 R3000a 20110>>>4 belong&0x00ffffff 7 R3000 20111>>>4 belong&0x00ffffff >7 subarchitecture=%d 20112>>0 belong&0x00ffffff 9 ns32532 20113>>0 belong&0x00ffffff 10 mc98000 20114>>0 belong&0x00ffffff 11 hppa 20115>>>4 belong&0x00ffffff 0 7100 20116>>>4 belong&0x00ffffff 1 7100LC 20117>>>4 belong&0x00ffffff >1 subarchitecture=%d 20118>>0 belong&0x00ffffff 12 arm 20119>>>4 belong&0x00ffffff 0 20120>>>4 belong&0x00ffffff 1 subarchitecture=%d 20121>>>4 belong&0x00ffffff 2 subarchitecture=%d 20122>>>4 belong&0x00ffffff 3 subarchitecture=%d 20123>>>4 belong&0x00ffffff 4 subarchitecture=%d 20124>>>4 belong&0x00ffffff 5 \bv4t 20125>>>4 belong&0x00ffffff 6 \bv6 20126>>>4 belong&0x00ffffff 7 \bv5tej 20127>>>4 belong&0x00ffffff 8 \bxscale 20128>>>4 belong&0x00ffffff 9 \bv7 20129>>>4 belong&0x00ffffff 10 \bv7f 20130>>>4 belong&0x00ffffff 11 \bv7s 20131>>>4 belong&0x00ffffff 12 \bv7k 20132>>>4 belong&0x00ffffff 13 \bv8 20133>>>4 belong&0x00ffffff 14 \bv6m 20134>>>4 belong&0x00ffffff 15 \bv7m 20135>>>4 belong&0x00ffffff 16 \bv7em 20136>>>4 belong&0x00ffffff >16 subarchitecture=%d 20137# 13 m88k 20138>>0 belong&0x00ffffff 13 20139>>>4 belong&0x00ffffff 0 mc88000 20140>>>4 belong&0x00ffffff 1 mc88100 20141>>>4 belong&0x00ffffff 2 mc88110 20142>>>4 belong&0x00ffffff >2 mc88000 subarchitecture=%d 20143>>0 belong&0x00ffffff 14 SPARC 20144>>0 belong&0x00ffffff 15 i860g 20145>>0 belong&0x00ffffff 16 alpha 20146>>0 belong&0x00ffffff 17 rs6000 20147>>0 belong&0x00ffffff 18 ppc 20148>>>4 belong&0x00ffffff 0 20149>>>4 belong&0x00ffffff 1 \b_601 20150>>>4 belong&0x00ffffff 2 \b_602 20151>>>4 belong&0x00ffffff 3 \b_603 20152>>>4 belong&0x00ffffff 4 \b_603e 20153>>>4 belong&0x00ffffff 5 \b_603ev 20154>>>4 belong&0x00ffffff 6 \b_604 20155>>>4 belong&0x00ffffff 7 \b_604e 20156>>>4 belong&0x00ffffff 8 \b_620 20157>>>4 belong&0x00ffffff 9 \b_650 20158>>>4 belong&0x00ffffff 10 \b_7400 20159>>>4 belong&0x00ffffff 11 \b_7450 20160>>>4 belong&0x00ffffff 100 \b_970 20161>>>4 belong&0x00ffffff >100 subarchitecture=%d 20162>>0 belong&0x00ffffff >18 architecture=%d 20163>0 belong&0x01000000 0x01000000 20164# 20165# 64-bit ABIs. 20166# 20167>>0 belong&0x00ffffff 0 64-bit architecture=%d 20168>>0 belong&0x00ffffff 1 64-bit architecture=%d 20169>>0 belong&0x00ffffff 2 64-bit architecture=%d 20170>>0 belong&0x00ffffff 3 64-bit architecture=%d 20171>>0 belong&0x00ffffff 4 64-bit architecture=%d 20172>>0 belong&0x00ffffff 5 64-bit architecture=%d 20173>>0 belong&0x00ffffff 6 64-bit architecture=%d 20174>>0 belong&0x00ffffff 7 x86_64 20175>>>4 belong&0x00ffffff 0 subarchitecture=%d 20176>>>4 belong&0x00ffffff 1 subarchitecture=%d 20177>>>4 belong&0x00ffffff 2 subarchitecture=%d 20178>>>4 belong&0x00ffffff 3 20179>>>4 belong&0x00ffffff 4 \b_arch1 20180>>>4 belong&0x00ffffff 8 \b_haswell 20181>>>4 belong&0x00ffffff >4 subarchitecture=%d 20182>>0 belong&0x00ffffff 8 64-bit architecture=%d 20183>>0 belong&0x00ffffff 9 64-bit architecture=%d 20184>>0 belong&0x00ffffff 10 64-bit architecture=%d 20185>>0 belong&0x00ffffff 11 64-bit architecture=%d 20186>>0 belong&0x00ffffff 12 arm64 20187>>>4 belong&0x00ffffff 0 20188>>>4 belong&0x00ffffff 1 \bv8 20189>>0 belong&0x00ffffff 13 64-bit architecture=%d 20190>>0 belong&0x00ffffff 14 64-bit architecture=%d 20191>>0 belong&0x00ffffff 15 64-bit architecture=%d 20192>>0 belong&0x00ffffff 16 64-bit architecture=%d 20193>>0 belong&0x00ffffff 17 64-bit architecture=%d 20194>>0 belong&0x00ffffff 18 ppc64 20195>>>4 belong&0x00ffffff 0 20196>>>4 belong&0x00ffffff 1 \b_601 20197>>>4 belong&0x00ffffff 2 \b_602 20198>>>4 belong&0x00ffffff 3 \b_603 20199>>>4 belong&0x00ffffff 4 \b_603e 20200>>>4 belong&0x00ffffff 5 \b_603ev 20201>>>4 belong&0x00ffffff 6 \b_604 20202>>>4 belong&0x00ffffff 7 \b_604e 20203>>>4 belong&0x00ffffff 8 \b_620 20204>>>4 belong&0x00ffffff 9 \b_650 20205>>>4 belong&0x00ffffff 10 \b_7400 20206>>>4 belong&0x00ffffff 11 \b_7450 20207>>>4 belong&0x00ffffff 100 \b_970 20208>>>4 belong&0x00ffffff >100 subarchitecture=%d 20209>>0 belong&0x00ffffff >18 64-bit architecture=%d 20210 20211 202120 name mach-o-be 20213>0 byte 0xcf 64-bit 20214>4 use mach-o-cpu 20215>12 belong 1 object 20216>12 belong 2 executable 20217>12 belong 3 fixed virtual memory shared library 20218>12 belong 4 core 20219>12 belong 5 preload executable 20220>12 belong 6 dynamically linked shared library 20221>12 belong 7 dynamic linker 20222>12 belong 8 bundle 20223>12 belong 9 dynamically linked shared library stub 20224>12 belong 10 dSYM companion file 20225>12 belong 11 kext bundle 20226>12 belong >11 20227>>12 belong x filetype=%d 20228>24 belong >0 \b, flags:< 20229>>24 belong &0x0000001 \bNOUNDEFS 20230>>24 belong &0x0000002 \b|INCRLINK 20231>>24 belong &0x0000004 \b|DYLDLINK 20232>>24 belong &0x0000008 \b|BINDATLOAD 20233>>24 belong &0x0000010 \b|PREBOUND 20234>>24 belong &0x0000020 \b|SPLIT_SEGS 20235>>24 belong &0x0000040 \b|LAZY_INIT 20236>>24 belong &0x0000080 \b|TWOLEVEL 20237>>24 belong &0x0000100 \b|FORCE_FLAT 20238>>24 belong &0x0000200 \b|NOMULTIDEFS 20239>>24 belong &0x0000400 \b|NOFIXPREBINDING 20240>>24 belong &0x0000800 \b|PREBINDABLE 20241>>24 belong &0x0001000 \b|ALLMODSBOUND 20242>>24 belong &0x0002000 \b|SUBSECTIONS_VIA_SYMBOLS 20243>>24 belong &0x0004000 \b|CANONICAL 20244>>24 belong &0x0008000 \b|WEAK_DEFINES 20245>>24 belong &0x0010000 \b|BINDS_TO_WEAK 20246>>24 belong &0x0020000 \b|ALLOW_STACK_EXECUTION 20247>>24 belong &0x0040000 \b|ROOT_SAFE 20248>>24 belong &0x0080000 \b|SETUID_SAFE 20249>>24 belong &0x0100000 \b|NO_REEXPORTED_DYLIBS 20250>>24 belong &0x0200000 \b|PIE 20251>>24 belong &0x0400000 \b|DEAD_STRIPPABLE_DYLIB 20252>>24 belong &0x0800000 \b|HAS_TLV_DESCRIPTORS 20253>>24 belong &0x1000000 \b|NO_HEAP_EXECUTION 20254>>24 belong &0x2000000 \b|APP_EXTENSION_SAFE 20255>>24 belong x \b> 20256 20257# 202580 lelong&0xfffffffe 0xfeedface Mach-O 20259!:strength +1 20260!:mime application/x-mach-binary 20261>0 use \^mach-o-be 20262 202630 belong&0xfffffffe 0xfeedface Mach-O 20264!:strength +1 20265!:mime application/x-mach-binary 20266>0 use mach-o-be 20267 20268#------------------------------------------------------------------------------ 20269# $File: macintosh,v 1.30 2019/12/14 20:40:26 christos Exp $ 20270# macintosh description 20271# 20272# BinHex is the Macintosh ASCII-encoded file format (see also "apple") 20273# Daniel Quinlan, quinlan@yggdrasil.com 20274# Update: Joerg Jenderek 20275# URL: https://en.wikipedia.org/wiki/BinHex 20276# Reference: http://fileformats.archiveteam.org/wiki/BinHex 20277# Note: only tested with version 4.0 and hqx extension 20278# Any text/binary before the characteristic comment sentence is to be ignored like in 20279# http://ftp.vim.org/pub/ftp/ftp/infomac/disk/mac-update-40b7.hqx 202800 search/1602 (This\ file\ 20281>&0 use binhex 20282# http://ftp.vim.org/pub/ftp/ftp/infomac/_Disk_&_File/zap-res-forks-101.hqx 202830 search/2652/b (This\ file\ 20284>&0 use binhex 202850 name binhex 20286# keep splitted search string format similar like in version 5.37 20287>0 string must\ be\ converted\ with\ BinHex\ BinHex binary text, version 20288# http://www.macdisk.com/binhexen.php3 20289!:apple BNHQTEXT 20290# http://www.faqs.org/faqs/macintosh/comm-faq/part1/ 20291>>&0 string 1.0 1.0 20292!:mime application/mac-binhex 20293!:ext hex 20294>>&0 string 2.0 2.0 20295!:mime application/mac-binhex 20296!:ext hcx 20297# BinHex 3.0 never existed 20298>>&0 string 4.0 4.0 20299!:mime application/mac-binhex40 20300!:ext hqx 20301# BinHex 5.0 also MacBinary I 20302>>&0 string 5.0 5.0 20303!:mime application/mac-binhex40 20304!:ext hqx 20305# this should never happen 20306>>&0 default x 20307>>>&0 string x %.3s 20308!:mime application/mac-binhex 20309!:ext hqx 20310 20311# Stuffit archives are the de facto standard of compression for Macintosh 20312# files obtained from most archives. (franklsm@tuns.ca) 203130 string SIT! StuffIt Archive (data) 20314!:mime application/x-stuffit 20315!:apple SIT!SIT! 20316>2 string x : %s 203170 string SITD StuffIt Deluxe (data) 20318>2 string x : %s 203190 string Seg StuffIt Deluxe Segment (data) 20320>2 string x : %s 20321 20322# Newer StuffIt archives (grant@netbsd.org) 203230 string StuffIt StuffIt Archive 20324!:mime application/x-stuffit 20325!:apple SIT!SIT! 20326#>162 string >0 : %s 20327 20328# Macintosh Applications and Installation binaries (franklsm@tuns.ca) 20329# GRR: Too weak 20330#0 string APPL Macintosh Application (data) 20331#>2 string x \b: %s 20332 20333# Macintosh System files (franklsm@tuns.ca) 20334# GRR: Too weak 20335#0 string zsys Macintosh System File (data) 20336#0 string FNDR Macintosh Finder (data) 20337#0 string libr Macintosh Library (data) 20338#>2 string x : %s 20339#0 string shlb Macintosh Shared Library (data) 20340#>2 string x : %s 20341#0 string cdev Macintosh Control Panel (data) 20342#>2 string x : %s 20343#0 string INIT Macintosh Extension (data) 20344#>2 string x : %s 20345#0 string FFIL Macintosh Truetype Font (data) 20346#>2 string x : %s 20347#0 string LWFN Macintosh Postscript Font (data) 20348#>2 string x : %s 20349 20350# Additional Macintosh Files (franklsm@tuns.ca) 20351# GRR: Too weak 20352#0 string PACT Macintosh Compact Pro Archive (data) 20353#>2 string x : %s 20354#0 string ttro Macintosh TeachText File (data) 20355#>2 string x : %s 20356#0 string TEXT Macintosh TeachText File (data) 20357#>2 string x : %s 20358#0 string PDF Macintosh PDF File (data) 20359#>2 string x : %s 20360 20361# MacBinary format (Eric Fischer, enf@pobox.com) 20362# Update: Joerg Jenderek 20363# URL: https://en.wikipedia.org/wiki/MacBinary 20364# Reference: https://files.stairways.com/other/macbinaryii-standard-info.txt 20365# 20366# Unfortunately MacBinary doesn't really have a magic number prior 20367# to the MacBinary III format. 20368# 20369 20370# old version number, must be kept at zero for compatibility 203710 byte 0 20372# length of filename (must be in the range 1-63) 20373>1 ubyte >0 20374# skip T.PIC.LZ INSTRUMENT.7T INVENTORY 20375>>1 ubyte <64 20376# skip Docs.MWII ReadMe.MacWrite "Notes (MacWrite II)" 20377# by looking for printable characters at beginning of file name 20378>>>2 ubelong >0x1F000000 20379# zero fill, must be zero for compatibility 20380>>>>74 byte 0 20381# zero fill, must be zero for compatibility 20382>>>>>82 byte 0 20383# MacBinary I test for valid version numbers 20384>>>>>>122 ubeshort 0 20385# additional check for creation date after 1 Jan 1970 ~ 7C25B080h 20386#>>>>>>>91 ubelong >0x7c25b07F 20387# additional check for undefined header fields in MacBinary I 20388#>>>>>>>101 ulong 0 20389>>>>>>>0 use mac-bin 20390# MacBinary II the newer versions begins at 129 20391>>>>>>122 ubeshort 0x8181 20392>>>>>>>0 use mac-bin 20393# MacBinary III with MacBinary II to read 20394>>>>>122 ubeshort 0x8281 20395>>>>>>0 use mac-bin 20396 20397# display information of MacBinary file 203980 name mac-bin 20399>122 ubyte x MacBinary 20400# versions for MacBinary II/III 20401>122 ubyte 129 II 20402>122 ubyte 130 III 20403# only in MacBinary III 20404>>102 string !mBIN with surprising version 20405!:mime application/x-macbinary 20406!:apple PSPTBINA 20407!:ext bin/macbin 20408# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified as MacBinary 20409#>1 ubyte >63 \b, name length %u too BIG! 20410#>122 ubeshort x \b, version 0x%x 20411# Finder flags if not 0 20412# >73 byte !0 \b, flags 0x 20413# >73 byte =0 20414# >>101 byte !0 \b, flags 0x 20415# # original Finder flags (Bits 8-15) 20416# >73 byte !0 \b%x 20417# # finder flags, bits 0-7 20418# >101 byte !0 \b%x 20419>73 byte &0x01 \b, inited 20420>73 byte &0x02 \b, changed 20421>73 byte &0x04 \b, busy 20422>73 byte &0x08 \b, bozo 20423>73 byte &0x10 \b, system 20424>73 byte &0x20 \b, bundle 20425>73 byte &0x40 \b, invisible 20426>73 byte &0x80 \b, locked 20427 20428# 75 beshort # vertical posn in window 20429#>75 beshort !0 \b, v.pos %u 20430# 77 beshort # horiz posn in window 20431#>77 beshort !0 \b, h.pos %u 20432# 79 beshort # window or folder ID 20433>79 ubeshort !0 \b, ID 0x%x 20434# protected flag 20435>81 byte !0 \b, protected 0x%x 20436# length of comment after resource 20437>99 ubeshort !0 \b, comment length %u 20438# char. code of file name 20439>106 ubyte !0 \b, char. code 0x%x 20440# still more Finder flags 20441>107 ubyte !0 \b, more flags 0x%x 20442# length of total files when unpacked only used when pack and unpack on the fly 20443>116 ubelong !0 \b, total length %u 20444# 120 beshort # length of add'l header 20445>120 ubeshort !0 \b, 2nd header length %u 20446# 124 beshort # checksum 20447#>124 ubeshort !0 \b, CRC 0x%x 20448# creation date in seconds since MacOS epoch start. So 1 Jan 1970 ~ 7C25B080 20449>91 beldate-0x7C25B080 x \b, %s 20450# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified or time overflow 20451>91 ubelong <0x7c25b080 INVALID date 20452#>91 belong-0x7C25B080 x \b, DEBUG DATE %d 20453# last modified date 20454>95 beldate-0x7C25B080 x \b, modified %s 20455# Apple creator+typ if not null 20456# file creator (normally expressed as four characters) 20457>69 ulong !0 \b, creator 20458# instead 4 character code display full creator name 20459>>69 use apple-creator 20460# file type (normally expressed as four characters) 20461>65 ulong !0 \b, type 20462>>65 use apple-type 20463# length of data segment 20464>83 ubelong !0 \b, %u bytes 20465# filename (in the range 1-63) 20466>1 pstring x "%s" 20467# print 1 space and then at offset 128 inspect data fork content if it has one 20468>83 ubelong !0 \b 20469>>128 indirect x 20470# Afterwards resource fork if length of resource segment not zero 20471>87 ubelong !0 20472# calculate resource fork offset 20473>>83 ubelong+128 x \b, at 0x%x 20474# length of resource segment 20475>>87 ubelong !0 %u bytes 20476>>(83.S+128) ubequad x resource 20477# further resource fork content inspection 20478>>>&-8 indirect x 20479 20480# Apple Type/Creator Database 20481# URL: https://en.wikipedia.org/wiki/Type_code 20482# Reference: https://www.lacikam.co.il/tcdb/ 20483# https://www.macdisk.com/macsigen.php 20484# Note: classic Mac OS files have two 4 character codes for type and creator. 20485# Thereby the Finder attach documents types to applications. 20486 20487#>65 string x \b, type "%4.4s" 20488 20489# display information about apple type 204900 name apple-type 20491>0 string 8BIM PhotoShop 20492>0 string ALB3 PageMaker 3 20493>0 string ALB4 PageMaker 4 20494>0 string ALT3 PageMaker 3 20495>0 string APPL application 20496>0 string AWWP AppleWorks word processor 20497>0 string CIRC simulated circuit 20498>0 string DRWG MacDraw 20499>0 string EPSF Encapsulated PostScript 20500>0 string FFIL font suitcase 20501>0 string FKEY function key 20502>0 string FNDR Macintosh Finder 20503>0 string GIFf GIF image 20504>0 string Gzip GNU gzip 20505>0 string INIT system extension 20506>0 string LIB\ library 20507>0 string LWFN PostScript font 20508>0 string MSBC Microsoft BASIC 20509>0 string PACT Compact Pro archive 20510>0 string PDF\ Portable Document Format 20511>0 string PICT picture 20512>0 string PNTG MacPaint picture 20513>0 string PREF preferences 20514>0 string PROJ Think C project 20515>0 string QPRJ Think Pascal project 20516>0 string SCFL Defender scores 20517>0 string SCRN startup screen 20518>0 string SITD StuffIt Deluxe 20519>0 string SPn3 SuperPaint 20520>0 string STAK HyperCard stack 20521>0 string Seg\ StuffIt segment 20522>0 string TARF Unix tar archive 20523>0 string TEXT ASCII 20524>0 string TIFF TIFF image 20525>0 string TOVF Eudora table of contents 20526>0 string WDBN Microsoft Word word processor 20527>0 string WORD MacWrite word processor 20528>0 string XLS\ Microsoft Excel 20529>0 string ZIVM compress (.Z) 20530>0 string ZSYS Pre-System 7 system file 20531>0 string acf3 Aldus FreeHand 20532>0 string cdev control panel 20533>0 string dfil Desk Accessory suitcase 20534>0 string libr library 20535>0 string nX^d WriteNow word processor 20536>0 string nX^w WriteNow dictionary 20537>0 string rsrc resource 20538>0 string scbk Scrapbook 20539>0 string shlb shared library 20540>0 string ttro SimpleText read-only 20541>0 string zsys system file 20542 20543# additional types added in Dec 2017 20544>0 string BINA binary file 20545>0 string BMPp BMP image 20546>0 string JPEG JPEG image 20547#>0 string W4BN Microsoft Word x.y word processor? 20548# if type name is not known display 4 character identifier 20549>0 default x 20550>>0 string x '%4.4s' 20551 20552#>69 string x \b, creator "%4.4s" 20553 20554# Now Apple has no repository of registered Creator IDs any more. These are 20555# just the ones that I happened to have files from and was able to identify. 20556 20557# display information about apple creator 205580 name apple-creator 20559>0 string 8BIM Adobe Photoshop 20560>0 string ALD3 PageMaker 3 20561>0 string ALD4 PageMaker 4 20562>0 string ALFA Alpha editor 20563>0 string APLS Apple Scanner 20564>0 string APSC Apple Scanner 20565>0 string BRKL Brickles 20566>0 string BTFT BitFont 20567>0 string CCL2 Common Lisp 2 20568>0 string CCL\ Common Lisp 20569>0 string CDmo The Talking Moose 20570>0 string CPCT Compact Pro 20571>0 string CSOm Eudora 20572>0 string DMOV Font/DA Mover 20573>0 string DSIM DigSim 20574>0 string EDIT Macintosh Edit 20575>0 string ERIK Macintosh Finder 20576>0 string EXTR self-extracting archive 20577>0 string Gzip GNU gzip 20578>0 string KAHL Think C 20579>0 string LWFU LaserWriter Utility 20580>0 string LZIV compress 20581>0 string MACA MacWrite 20582>0 string MACS Macintosh operating system 20583>0 string MAcK MacKnowledge terminal emulator 20584>0 string MLND Defender 20585>0 string MPNT MacPaint 20586>0 string MSBB Microsoft BASIC (binary) 20587>0 string MSWD Microsoft Word 20588>0 string NCSA NCSA Telnet 20589>0 string PJMM Think Pascal 20590>0 string PSAL Hunt the Wumpus 20591#>0 string PSI2 Apple File Exchange 20592>0 string R*ch BBEdit 20593>0 string RMKR Resource Maker 20594>0 string RSED Resource Editor 20595>0 string Rich BBEdit 20596>0 string SIT! StuffIt 20597>0 string SPNT SuperPaint 20598>0 string Unix NeXT Mac filesystem 20599>0 string VIM! Vim editor 20600>0 string WILD HyperCard 20601>0 string XCEL Microsoft Excel 20602>0 string aCa2 Fontographer 20603>0 string aca3 Aldus FreeHand 20604>0 string dosa Macintosh MS-DOS file system 20605>0 string movr Font/DA Mover 20606>0 string nX^n WriteNow 20607>0 string pdos Apple ProDOS file system 20608>0 string scbk Scrapbook 20609>0 string ttxt SimpleText 20610>0 string ufox Foreign File Access 20611# additional creators added in Dec 2017 20612# Claris/Apple Works 20613>0 string BOBO Apple Works 20614# CU-SeeMe_0.87b3_(68K).bin 20615#>0 string CUce bar 20616>0 string PSPT Apple File Exchange 20617# Disk_Copy_4.2.sea.bin 20618#>0 string NCse foo 20619# probably StuffIt/Aladdin by Smith Micro Software, Inc. 20620>0 string STi0 stuffit 20621# MacGzip-1.1.3.sea.bin 20622#>0 string aust bar 20623# D-Disk_Copy_6.3.3.smi.bin 20624>0 string oneb Disk Copy Self Mounting 20625# if creator name is not known display 4 character identifier 20626>0 default x 20627>>0 string x '%4.4s' 20628 20629# sas magic from Bruce Foster (bef@nwu.edu) 20630# 20631#0 string SAS SAS 20632#>8 string x %s 206330 string SAS SAS 20634>24 string DATA data file 20635>24 string CATALOG catalog 20636>24 string INDEX data file index 20637>24 string VIEW data view 20638# sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com) 20639# 206400x54 string SAS SAS 7+ 20641>0x9C string DATA data file 20642>0x9C string CATALOG catalog 20643>0x9C string INDEX data file index 20644>0x9C string VIEW data view 20645 20646# spss magic for SPSS system and portable files, 20647# from Bruce Foster (bef@nwu.edu). 20648 206490 long 0xc1e2c3c9 SPSS Portable File 20650>40 string x %s 20651 206520 string $FL2 SPSS System File 20653>24 string x %s 20654 206550 string $FL3 SPSS System File 20656>24 string x %s 20657 20658# Macintosh filesystem data 20659# From "Tom N Harris" <telliamed@mac.com> 20660# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net> 20661# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these 20662# entries depend on the data arithmetic added after v.35 20663# There's also some Pascal strings in here, ditto... 20664 20665# The boot block signature, according to IM:Files, is 20666# "for HFS volumes, this field always contains the value 0x4C4B." 20667# But if this is true for MFS or HFS+ volumes, I don't know. 20668# Alternatively, the boot block is supposed to be zeroed if it's 20669# unused, so a simply >0 should suffice. 20670 206710x400 beshort 0xD2D7 Macintosh MFS data 20672>0 beshort 0x4C4B (bootable) 20673>0x40a beshort &0x8000 (locked) 20674>0x402 beldate-0x7C25B080 x created: %s, 20675>0x406 beldate-0x7C25B080 >0 last backup: %s, 20676>0x414 belong x block size: %d, 20677>0x412 beshort x number of blocks: %d, 20678>0x424 pstring x volume name: %s 20679 20680# *.hfs updated by Joerg Jenderek 20681# https://en.wikipedia.org/wiki/Hierarchical_File_System 20682# "BD" gives many false positives 206830x400 beshort 0x4244 20684# ftp://ftp.mars.org/pub/hfs/hfsutils-3.2.6.tar.gz/hfsutils-3.2.6/libhfs/apple.h 20685# first block of volume bit map (always 3) 20686>0x40e ubeshort 0x0003 20687# maximal length of volume name is 27 20688>>0x424 ubyte <28 Macintosh HFS data 20689!:mime application/x-apple-diskimage 20690#!:apple hfsdINIT 20691#!:apple MACSdisk 20692# https://www.macdisk.com/macsigen.php 20693#!:apple ddskdevi 20694!:apple ????devi 20695# https://en.wikipedia.org/wiki/Apple_Disk_Image 20696!:ext hfs/dmg 20697>>>0 beshort 0x4C4B (bootable) 20698#>>>0 beshort 0x0000 (not bootable) 20699>>>0x40a beshort &0x8000 (locked) 20700>>>0x40a beshort ^0x0100 (mounted) 20701>>>0x40a beshort &0x0200 (spared blocks) 20702>>>0x40a beshort &0x0800 (unclean) 20703>>>0x47C beshort 0x482B (Embedded HFS+ Volume) 20704# https://www.epochconverter.com/ 20705# 0x7C245F00 seconds ~ 2082758400 ~ 01 Jan 2036 00:00:00 ~ 66 years to 1970 20706# 0x7C25B080 seconds ~ 2082844800 ~ 02 Jan 2036 00:00:00 20707# construct not working 20708#>>>0x402 beldate-0x7C25B080 x created: %s, 20709#>>>0x406 beldate-0x7C25B080 x last modified: %s, 20710#>>>0x440 beldate-0x7C25B080 >0 last backup: %s, 20711# found block sizes 200h,1200h,2800h 20712>>>0x414 belong x block size: %d, 20713>>>0x412 beshort x number of blocks: %d, 20714>>>0x424 pstring x volume name: %s 20715 207160x400 beshort 0x482B Macintosh HFS Extended 20717>&0 beshort x version %d data 20718>0 beshort 0x4C4B (bootable) 20719>0x404 belong ^0x00000100 (mounted) 20720>&2 belong &0x00000200 (spared blocks) 20721>&2 belong &0x00000800 (unclean) 20722>&2 belong &0x00008000 (locked) 20723>&6 string x last mounted by: '%.4s', 20724# really, that should be treated as a belong and we print a string 20725# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1" 20726>&14 beldate-0x7C25B080 x created: %s, 20727# only the creation date is local time, all other timestamps in HFS+ are UTC. 20728>&18 bedate-0x7C25B080 x last modified: %s, 20729>&22 bedate-0x7C25B080 >0 last backup: %s, 20730>&26 bedate-0x7C25B080 >0 last checked: %s, 20731>&38 belong x block size: %d, 20732>&42 belong x number of blocks: %d, 20733>&46 belong x free blocks: %d 20734 20735## AFAIK, only the signature is different 20736# same as Apple Partition Map 20737# GRR: This magic is too weak, it is just "TS" 20738#0x200 beshort 0x5453 Apple Old Partition data 20739#>0x2 beshort x block size: %d, 20740#>0x230 string x first type: %s, 20741#>0x210 string x name: %s, 20742#>0x254 belong x number of blocks: %d, 20743#>0x400 beshort 0x504D 20744#>>0x430 string x second type: %s, 20745#>>0x410 string x name: %s, 20746#>>0x454 belong x number of blocks: %d, 20747#>>0x800 beshort 0x504D 20748#>>>0x830 string x third type: %s, 20749#>>>0x810 string x name: %s, 20750#>>>0x854 belong x number of blocks: %d, 20751#>>>0xa00 beshort 0x504D 20752#>>>>0xa30 string x fourth type: %s, 20753#>>>>0xa10 string x name: %s, 20754#>>>>0xa54 belong x number of blocks: %d 20755 20756# From: Remi Mommsen <mommsen@slac.stanford.edu> 207570 string BOMStore Mac OS X bill of materials (BOM) file 20758 20759# From: Adam Buchbinder <adam.buchbinder@gmail.com> 20760# URL: https://en.wikipedia.org/wiki/Datafork_TrueType 20761# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is 20762# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I 20763# don't know what they mean. 207640 belong 0x100 20765>(0x4.L+24) beshort x 20766>>&4 belong 0x73666e74 Mac OSX datafork font, TrueType 20767>>&4 belong 0x464f4e54 Mac OSX datafork font, 'FONT' 20768>>&4 belong 0x4e464e54 Mac OSX datafork font, 'NFNT' 20769>>&4 belong 0x504f5354 Mac OSX datafork font, PostScript 20770 20771#------------------------------------------------------------------------------ 20772# $File: macos,v 1.1 2012/12/21 16:41:07 christos Exp $ 20773# MacOS files 20774# 20775 207760 string book\0\0\0\0mark\0\0\0\0 MacOS Alias file 20777 20778#------------------------------------------------------------------------------ 20779# $File: magic,v 1.10 2010/11/25 15:00:12 christos Exp $ 20780# magic: file(1) magic for magic files 20781# 207820 string/t #\ Magic magic text file for file(1) cmd 207830 lelong 0xF11E041C magic binary file for file(1) cmd 20784>4 lelong x (version %d) (little endian) 207850 belong 0xF11E041C magic binary file for file(1) cmd 20786>4 belong x (version %d) (big endian) 20787#------------------------------------------------------------------------------ 20788# $File: mail.news,v 1.25 2019/06/21 20:06:05 christos Exp $ 20789# mail.news: file(1) magic for mail and news 20790# 20791# Unfortunately, saved netnews also has From line added in some news software. 20792#0 string From mail text 207930 string/t Relay-Version: old news text 20794!:mime message/rfc822 207950 string/t #!\ rnews batched news text 20796!:mime message/rfc822 207970 string/t N#!\ rnews mailed, batched news text 20798!:mime message/rfc822 207990 string/t Forward\ to mail forwarding text 20800!:mime message/rfc822 208010 string/t Pipe\ to mail piping text 20802!:mime message/rfc822 208030 string/tc delivered-to: SMTP mail text 20804!:mime message/rfc822 208050 string/tc return-path: SMTP mail text 20806!:mime message/rfc822 208070 string/t Path: news text 20808!:mime message/news 208090 string/t Xref: news text 20810!:mime message/news 208110 string/t From: news or mail text 20812!:mime message/rfc822 208130 string/t Article saved news text 20814!:mime message/news 20815# Reference: http://quimby.gnus.org/notes/BABYL 20816# Update: Joerg Jenderek 20817# Note: used by Rmail in Emacs version 22 and before 20818# is not text because of characters like Control-L Control-_ 208190 string/b BABYL\ OPTIONS: Emacs RMAIL 20820#0 string/t BABYL Emacs RMAIL text 20821# https://reposcope.com/mimetype/message/x-gnu-rmail 20822!:mime message/x-gnu-rmail 20823# ~/RMAIL 20824!:ext / 208250 string/t Received: RFC 822 mail text 20826!:mime message/rfc822 208270 string/t MIME-Version: MIME entity text 20828#0 string/t Content- MIME entity text 20829 20830# TNEF files... 208310 lelong 0x223E9F78 Transport Neutral Encapsulation Format 20832!:mime application/vnd.ms-tnef 20833 20834# From: Kevin Sullivan <ksulliva@psc.edu> 208350 string *mbx* MBX mail folder 20836 20837# From: Simon Matter <simon.matter@invoca.ch> 208380 string \241\002\213\015skiplist\ file\0\0\0 Cyrus skiplist DB 208390 string \241\002\213\015twoskip\ file\0\0\0\0 Cyrus twoskip DB 20840 20841# JAM(mbp) Fidonet message area databases 20842# JHR file 208430 string JAM\0 JAM message area header file 20844>12 leshort >0 (%d messages) 20845 20846# Squish Fidonet message area databases 20847# SQD file (requires at least one message in the area) 20848# XXX: Weak magic 20849#256 leshort 0xAFAE4453 Squish message area data file 20850#>4 leshort >0 (%d messages) 20851 20852#0 string \<!--\ MHonArc text/html; x-type=mhonarc 20853 20854# Cyrus: file(1) magic for compiled Cyrus sieve scripts 20855# URL: https://www.cyrusimap.org/docs/cyrus-imapd/2.4.6/internal/bytecode.php 20856# URL: http://git.cyrusimap.org/cyrus-imapd/tree/sieve/bytecode.h?h=master 20857# From: Philipp Hahn <hahn@univention.de> 20858 20859# Compiled Cyrus sieve script 208600 string CyrSBytecode Cyrus sieve bytecode data, 20861>12 belong =1 version 1, big-endian 20862>12 lelong =1 version 1, little-endian 20863>12 belong x version %d, network-endian 20864#------------------------------------------------------------------------------ 20865# $File: make,v 1.4 2018/05/29 17:26:02 christos Exp $ 20866# make: file(1) magic for makefiles 20867# 20868# URL: https://en.wikipedia.org/wiki/Make_(software) 208690 regex/100l \^CFLAGS makefile script text 20870!:mime text/x-makefile 208710 regex/100l \^VPATH makefile script text 20872!:mime text/x-makefile 208730 regex/100l \^LDFLAGS makefile script text 20874!:mime text/x-makefile 208750 regex/100l \^all: makefile script text 20876!:mime text/x-makefile 208770 regex/100l \^\\.PRECIOUS makefile script text 20878!:mime text/x-makefile 20879# Update: Joerg Jenderek 20880# Reference: https://www.freebsd.org/cgi/man.cgi?make(1) 20881# exclude grub-core\lib\libgcrypt\mpi\Makefile.am with "#BEGIN_ASM_LIST" 20882# by additional escaping point character 208830 regex/100l \^\\.BEGIN BSD makefile script text 20884!:mime text/x-makefile 20885!:ext /mk 20886!:strength +10 20887# exclude MS Windows help file CoNtenT with ":include FOOBAR.CNT" 20888# and NSIS script with "!include" by additional escaping point character 208890 regex/100l \^\\.include BSD makefile script text 20890!:mime text/x-makefile 20891!:ext /mk 20892!:strength +10 208930 regex/100l \^\\.endif BSD makefile script text 20894!:mime text/x-makefile 20895!:ext /mk 20896!:strength +10 208970 regex/100l \^SUBDIRS automake makefile script text 20898!:mime text/x-makefile 20899!:strength +10 20900 20901 20902#------------------------------------------------------------------------------ 20903# $File: map,v 1.8 2019/12/01 22:46:23 christos Exp $ 20904# map: file(1) magic for Map data 20905# 20906 20907# Garmin .FIT files https://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml 209088 string .FIT FIT Map data 20909>15 byte 0 20910>>35 belong x \b, unit id %d 20911>>39 lelong x \b, serial %u 20912# https://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml 20913# 20 years after unix epoch 20914# TZ=GMT date -d '1989-12-31 0:00' +%s 20915>>43 leldate+631065600 x \b, %s 20916 20917>>47 leshort x \b, manufacturer %d 20918>>47 leshort 1 \b (garmin) 20919>>49 leshort x \b, product %d 20920>>53 byte x \b, type %d 20921>>53 byte 1 \b (Device) 20922>>53 byte 2 \b (Settings) 20923>>53 byte 3 \b (Sports/Cycling) 20924>>53 byte 4 \b (Activity) 20925>>53 byte 8 \b (Elevations) 20926>>53 byte 10 \b (Totals) 20927 20928# Summary: Garmin map 20929# From: Joerg Jenderek 20930# URL: https://en.wikipedia.org/wiki/Garmin_.img 20931# Reference: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/IMG_File_Format 20932# sourceforge.net/projects/garmin-img/files/IMG%20File%20Format/1.0/imgformat-1.0.pdf 20933# GRR: similar to MBR boot sector handled by ./filesystems 209340x1FE leshort =0xAA55 20935# look for valid map signature 20936>0x13 string =IMG\0 20937>>0 use garmin-map 209380 name garmin-map 20939>0 ubyte x Garmin 20940!:mime application/x-garmin-map 20941# If non-zero, every byte of the entire .img file is to be XORed with this value 20942>0 ubyte !0 \b, 0x%x XORed 20943# goto block before FAT 20944>(0x40.b*512) ubyte x 20945# 1st fat name "DLLINFO TXT" only found for vpm 20946>>&512 string =DLLINFO\ TXT map (Voice Processing) 20947# there exist 2 other Garmin VPM formats; see ./audio 20948!:ext vpm 20949# Deutsch__Yannick_D4481-00_0210.vpm 20950#>>>512 search/0x0116da60/s RIFF \b; with 20951# determine type voice type by ./riff 20952#>>>>&0 indirect x \b 20953>>&512 string !DLLINFO\ TXT map 20954!:ext img 20955# 9 zeros 20956>1 ubelong !0 \b, zeroes 0x%x 20957# Map's version major 20958>8 ubyte x v%u 20959# Map's version minor 20960>9 ubyte x \b.%.2u 20961# Map description[20], 0x20 padded 20962>0x49 string x %.20s 20963# Map name, continued (0x20 padded, \0 terminated) 20964>0x65 string >\ \b%.31s 20965# Update year (+1900 for val >= 0x63, +2000 for val <= 0x62) 20966>0xB ubyte x \b, updated 20967>>0xB ubyte >0x62 20968>>>0xB ubyte-100 x 20%.2u 20969>>0xB ubyte <0x63 20970>>>0xB ubyte x 20%.2u 20971# Update month (0-11) 20972>0xA ubyte x \b-%.2u 20973# All zeroes 20974>0xc uleshort !0 \b, zeroes 0x%x 20975# Mapsource flag, 1 - file created by Mapsource, 0 - Garmin map visible in Basecamp and Homeport 20976#>0xE ubyte !0 \b, Mapsource flag 0x%x 20977>0xE ubyte 1 \b, Mapsource 20978# Checksum, sum of all bytes modulo 256 should be 0 20979#>0xF ubyte x \b, Checksum 0x%x 20980# Signature: DSKIMG 0x00 or DSDIMG 0x00 for demo map 20981>0x10 string !DSKIMG \b, signature "%.7s" 20982>0x39 use garmin-date 20983# Map file identifier like GARMIN\0 20984>0x41 string !GARMIN \b, id "%.7s" 20985# Block size exponent, E1; appears to always be 0x09; minimum block size 512 bytes 20986>0x61 ubyte !0x09 \b, E1=%u 20987# Block size exponent, E2 ; file blocksize=2**(E1+E2) 20988>>0x62 ubyte x \b, E2=%u 20989>0x61 ubyte =0x09 \b, blocksize 20990>>0x62 ubyte 0 512 20991>>0x62 ubyte 1 1024 20992>>0x62 ubyte 2 2048 20993>>0x62 ubyte 3 4096 20994>>0x62 ubyte 4 8192 20995>>0x62 ubyte 5 16384 20996>>0x62 default x 20997>>>0x62 ubyte x E2=%u 20998# MBR signature 20999>0x1FE leshort !0xAA55 \b, invalid MBR 21000# 512 zeros 21001>0x200 uquad !0 \b, zeroes 0x%llx 21002# First sub-file offset (absolute); sometimes NO/UNKNOWN sub file! 21003>0x40C ulelong >0 \b, at 0x%x 21004# sub-file Header length 21005#>>(0x40C.l) uleshort x \b, header len 0x%x 21006>>(0x40C.l) uleshort x %u bytes 21007# sub-file Type[10] like "GARMIN RGN" "GARMIN TRE", "GARMIN TYP", etc. 21008>>(0x40C.l+2) ubyte >0x1F 21009>>>(0x40C.l+2) ubyte <0xFF 21010>>>>(0x40C.l+2) string x "%.10s" 21011# 0x00 for most maps, 0x80 for locked maps (City Nav, City Select, etc.) 21012>>>>(0x40C.l+13) ubyte >0 \b, locked 0x%x 21013# Block sequence numbers like 0000 0100 0200 ... FFFF 21014# >0x420 ubequad >0 \b, seq. 0x%16.16llx 21015# >>0x428 ubequad >0 \b%16.16llx 21016# >>>0x430 ubequad >0 \b%16.16llx 21017# >>>>0x438 ubequad >0 \b%16.16llx 21018# >>>>>0x440 ubequad >0 \b%16.16llx 21019# >>>>>>0x448 ubequad >0 \b%16.16llx 21020# >>>>>>>0x450 ubequad >0 \b%16.16llx 21021# >>>>>>>>0x458 ubequad >0 \b%16.16llx 21022# >>>>>>>>>0x460 ubequad >0 \b%16.16llx 21023# >>>>>>>>>>0x468 ubequad >0 \b%16.16llx 21024# >>>>>>>>>>>0x470 ubequad >0 \b%16.16llx 21025# >>>>>>>>>>>>0x478 ubequad >0 \b%16.16llx 21026# >>>>>>>>>>>>>0x480 ubequad >0 \b%16.16llx 21027# >>>>>>>>>>>>>>0x488 ubequad >0 \b%16.16llx 21028# >>>>>>>>>>>>>>>0x490 ubequad >0 \b%16.16llx 21029# >>>>>>>>>>>>>>>>0x498 ubequad >0 \b%16.16llx 21030# >>>>>>>>>>>>>>>>>0x4A0 ubequad >0 \b%16.16llx 21031# >>>>>>>>>>>>>>>>>>0x4A8 ubequad >0 \b%16.16llx 21032# look for end of FAT 21033#>>0x420 search/512/s \xff\xff FAT END 21034# Physical block number of FAT header 21035#>0x40 ubyte x \b, FAT at phy. block %u 21036>0x40 ubyte x 21037>>(0x40.b*512) ubyte x 21038# 1st FAT block 21039>>>&511 use garmin-fat 21040# 2nd FAT block 21041>>>&1023 use garmin-fat 21042# 3th FAT block 21043>>>&1535 use garmin-fat 21044# 4th FAT block 21045>>>&2047 use garmin-fat 21046# ... xth FAT block 21047# 21048# 314 zeros but not in vpm and also gmaptz.img 21049>0x84 uquad !0 \b, at 0x84 0x%llx 21050# display FileAllocationTable block entry in garmin map 210510 name garmin-fat 21052>0 ubyte x \b; 21053# sub file part; 0x0003 seems to be garbage 21054>0x10 uleshort !0 next 0x%4.4x 21055>0x10 uleshort =0 21056# fat flag 0~dummy block 1~true sub file 21057>>0 ubyte !1 flag %u 21058>>0 ubyte =1 21059# sub-file name like MAKEGMAP 12345678 21060>>>0x1 string x %.8s 21061# sub-file typ like RGN TRE MDR LBL 21062>>>0x9 string x \b.%.3s 21063# size of sub file 21064>>>0xC ulelong x \b, %u bytes 21065# 32-bit block sequence numbers 21066#>>>0x20 ubequad x \b, seq. 0x%16.16llx 21067 21068# display date stored inside Garmin maps like yyyy-mm-dd h:mm:ss 210690 name garmin-date 21070# year like 2018 21071>0 uleshort x \b, created %u 21072# month (0-11) 21073>2 ubyte x \b-%.2u 21074# day (1-31) 21075>3 ubyte x \b-%.2u 21076# hour (0-23) 21077>4 ubyte x %u 21078# minute (0-59) 21079>5 ubyte x \b:%.2u 21080# second (0-59) 21081>6 ubyte x \b:%.2u 21082 21083# Summary: Garmin Map subfiles 21084# From: Joerg Jenderek 21085# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/IMG_File_Format 21086# Garmin Common Header 210872 string GARMIN\ 21088# skip ASCII text by checking for low header length 21089>0 uleshort <0x1000 Garmin map, 21090# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/GMP_Subfile_Format 21091>>9 string GMP subtile 21092!:mime application/x-garmin-gpm 21093!:ext gmp 21094# copyright message 21095>>>(0.s) string x %s 21096>>>0x0E use garmin-date 21097# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/MDR_Subfile_Format 21098# This contains the searchable address table used for finding routing destinations 21099>>9 string MDR address table 21100!:mime application/x-garmin-mdr 21101!:ext mdr 21102# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/NOD_Subfile_Format 21103# http://svn.parabola.me.uk/display/trunk/doc/nod.txt 21104# This contains the routing information 21105>>9 string NOD routing 21106!:mime application/x-garmin-nod 21107!:ext nod 21108>>>0x0E use garmin-date 21109#>>>0x15 ulelong x \b, at 0x%x 21110#>>>0x19 ulelong x 0x%x bytes NOD1 21111#>>>0x25 ulelong x \b, at 0x%x 21112#>>>0x29 ulelong x 0x%x bytes NOD2 21113#>>>0x31 ulelong x \b, at 0x%x 21114#>>>0x35 ulelong x 0x%x bytes NOD3 21115# URL: http://www.pinns.co.uk/osm/net.html 21116# routable highways (length, direction, allowed speed,house address information) 21117>>9 string NET highways 21118!:mime application/x-garmin-net 21119!:ext net 21120#>>>0x15 ulelong x \b, at 0x%x 21121#>>>0x19 ulelong x 0x%x bytes NET1 21122#>>>0x22 ulelong >0 21123#>>>>0x1E ulelong x \b, at 0x%x 21124#>>>>0x22 ulelong x 0x%x bytes NET2 21125#>>>0x2B ulelong >0 21126#>>>>0x27 ulelong x \b, at 0x%x 21127#>>>>0x2B ulelong x 0x%x bytes NET3 21128# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/LBL_Subfile_Format 21129>>9 string LBL labels 21130!:mime application/x-garmin-lbl 21131!:ext lbl 21132>>>(0.s) string x %s 21133# Label coding type 6h 9h and ah 21134>>>0x1E ubyte x \b, coding type 0x%x 21135#>>>0x15 ulelong x \b, at 0x%x 21136#>>>0x19 ulelong x 0x%x bytes LBL1 21137#>>>0x1F ulelong x \b, at 0x%x 21138#>>>0x23 ulelong x 0x%x bytes LBL2 21139#>>>0x2D ulelong x \b, at 0x%x 21140#>>>0x31 ulelong x 0x%x bytes LBL3 21141# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/SRT_Subfile_Format 21142# A lookup table of the chars in the map's codepage, and their collating sequence 21143>>9 string SRT sort table 21144!:mime application/x-garmin-srt 21145!:ext srt 21146>>>0x0E use garmin-date 21147# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/TRE_Subfile_Format 21148>>9 string TRE tree 21149!:mime application/x-garmin-tre 21150!:ext tre 21151# title like City Nav Europe NTU 2019.2 Basemap 21152# or OSM Street map 21153>>>(0.s) string x %s 21154# 2nd title like Copyright 1995-2018 by GARMIN Corporation. 21155# or http://www.openstreetmap.org/ 21156>>>>&1 string x %s 21157>>>0x0E use garmin-date 21158#>>>0x21 ulelong x \b, at 0x%x 21159#>>>0x25 ulelong x 0x%x bytes TRE1 21160#>>>0x29 ulelong x \b, at 0x%x 21161#>>>0x2D ulelong x 0x%x bytes TRE2 21162#>>>0x31 ulelong x \b, at 0x%x 21163#>>>0x35 ulelong x 0x%x bytes TRE3 21164# Copyright record size 21165#>>>0x39 uleshort x \b, copyright record size %u 21166# Map ID 21167>>>0x74 ulelong x \b, ID 0x%x 21168# URL: https://www.gpspower.net/garmin-tutorials/353310-basecamp-installing-free-desktop-map.html 21169# For road traffic information service (RDS/TMS/TMC). Commonly seen in City Navigator maps 21170>>9 string TRF traffic, 21171!:mime application/x-garmin-trf 21172!:ext trf 21173# city/region like Preitenegg 21174>>>(0.s+1) string x 1st %s 21175# highway part like L606/L148 21176>>>>&1 string x %s 21177# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/Format 21178# Reference: http://www.pinns.co.uk/osm/typformat.html 21179# customize the appearance of objects. For GPS and MapSource/Qlandkarte better looking maps 21180>>9 string TYP types 21181!:mime application/x-garmin-typ 21182!:ext typ 21183>>>0x0E use garmin-date 21184# character set 1252 65001~UTF8 21185>>>0x15 uleshort x \b, code page %u 21186# POIs 21187#>>>0x17 ulelong x \b, at 0x%x 21188#>>>0x1B ulelong x 0x%x bytes TYP1 21189# extra pois 21190#>>>0x5B ulelong x \b, at 0x%x 21191#>>>0x5F ulelong x 0x%x bytes TYP8 21192# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/RGN_Subfile_Format 21193# http://www.pinns.co.uk/osm/RGN.html 21194# region data used by the Garmin software 21195>>9 string RGN region 21196!:mime application/x-garmin-rgn 21197!:ext rgn 21198# POIs,Indexed POIs,Polylines or Polygons or first map level 21199#>>>0x15 ulelong x \b, at 0x%x 21200#>>>0x19 ulelong x 0x%x bytes RGN1 21201# polygons with extended types 21202#>>>0x21 ulelong >0 21203#>>>>0x1D ulelong x \b, at 0x%x 21204#>>>>0x21 ulelong x 0x%x bytes RGN2 21205# polylines with extended types 21206#>>>0x3D ulelong >0 21207#>>>>0x39 ulelong x \b, at 0x%x 21208#>>>>0x3D ulelong x 0x%x bytes RGN3 21209# extended POIs 21210#>>>0x59 ulelong >0 21211#>>>>0x55 ulelong x \b, at 0x%x 21212#>>>>0x59 ulelong x 0x%x bytes RGN3 21213#>>9 default x unknown map type 21214# Header length; GMP:31h 35h 3Dh,MDR:11Eh 238h 2C4h 310h,NOD:3Fh 7Fh,NET:64h, 21215# LBL:2A9h,SRT:1Dh 25h 27h,TRE:CFh 135h,TRF:5Ah,TYP:5Bh 6Eh 7Ch AEh,RGN:7Dh 21216>>0 uleshort x \b, header length 0x%x 21217 21218# URL: https://www.memotech.franken.de/FileFormats/ 21219# Reference: https://www.memotech.franken.de/FileFormats/Garmin_RGN_Format.pdf 21220# From: Joerg Jenderek 212210 string KpGr Garmin update 21222# format version like: 0064h~1.0 21223>0x4 uleshort !0x0064 21224>>4 uleshort/100 x \b, version %u 21225>>4 uleshort%100 x \b.%u 21226# 1st Garmin entry 21227>6 use garmin-entry 21228# 2nd Garmin entry 21229>(0x6.l+10) ubyte x 21230>>&0 use garmin-entry 21231# 3rd entry 21232>(0x6.l+10) ubyte x 21233>>&(&0.l+4) ubyte x 21234>>>&0 use garmin-entry 21235# look again at version to use default clause 21236>0x4 uleshort x 21237# test for region content by looking for 21238# Garmin *.srf by ./images with normal builder name "SQA" or longer "hales" 21239# 1 space after equal sign 21240>>0x3a search/5/s GARMIN\ BITMAP \b= 21241!:mime image/x-garmin-exe 21242!:ext exe 21243>>>&0 indirect x 21244# if not bitmap *.srf then region; 1 space after equal sign 21245>>0x3a default x \b= 21246!:mime application/x-garmin-rgn 21247!:ext rgn 21248# recursiv embedded 21249>>>0x3a search/5/s KpGrd 21250>>>>&0 indirect x 21251# look for ZIP or JAR archive by ./archive and ./zip 21252>>>0x3a search/5/s PK\003\004 21253>>>>&0 indirect x 21254# TODO: other garmin RGN record content like foo 21255#>>0x3a search/5/s bar BAR 21256# display information of Garmin RGN record 212570 name garmin-entry 21258# record length: 2 for Data, for Application often 1Bh sometimes 1Dh, "big" for Region 21259#>0 ulelong x \b, length 0x%x 21260# data record (ID='D') with version content like 0064h~1.0 21261>4 ubyte =0x44 21262>>5 uleshort !0x0064 \b; Data 21263>>>5 uleshort/100 x \b, version %u 21264>>>5 uleshort%100 x \b.%u 21265# Application Record (ID='A') 21266>4 ubyte =0x41 \b; App 21267# version content like 00c8h~2.0 21268>>5 uleshort !0x00C8 21269>>>5 uleshort/100 x \b, version %u 21270>>>5 uleshort%100 x \b.%u 21271# builder name like: SQA sqa build hales 21272>>7 string x \b, build by %s 21273# build date like: Oct 25 1999, Oct 1 2008, Feb 23 2009, Dec 15 2009 21274>>>&1 string x %s 21275# build time like: 11:26:12, 11:45:54, 14:16:13, 18:23:01 21276>>>>&1 string x %s 21277# region record (ID='R') 21278>4 ubyte =0x52 \b; Region 21279# region ID:14~fw_all.bin: 78~ZIP, RGN or SRF bitmap; 148~ZIP or JAR; 249~display firmware; 251~WiFi or GCD firmware; 255~ZIP 21280>>5 uleshort x ID=%u 21281# delay in ms: like 0, 500 21282>>7 ulelong !0 \b, %u ms 21283# region size (is record length - 10) 21284#>>11 ulelong x \b, length 0x%x 21285# region content like: 21286# "KpGr"~recursiv embedded,"GARMIN BITMAP"~Garmin Bitmap *.srf, "PK"~ZIP archive 21287#>>15 string x \b, content "%s" 21288>>15 ubequad x \b, content 0x%llx... 21289# This does NOT WORK! 21290#>>15 indirect x \b; contains 21291>4 default x \b; other 21292# garmin Record ID Identifies the record content like: D A R 21293>>4 ubyte x ID '%c' 21294 21295# TOM TOM GPS watches ttbin files: 21296# https://github.com/ryanbinns/ttwatch/tree/master/ttbin 21297# From: Daniel Lenski 212980 byte 0x20 21299>1 leshort 0x0007 21300>>0x76 byte 0x20 21301>>>0x77 leshort 0x0075 TomTom activity file, v7 21302>>>>8 leldate x (%s, 21303>>>>3 byte x device firmware %d. 21304>>>>4 byte x \b%d. 21305>>>>5 byte x \b%d, 21306>>>>6 leshort x product ID %04d) 21307 21308 21309#------------------------------------------------------------------------------ 21310# $File: maple,v 1.8 2017/03/17 21:35:28 christos Exp $ 21311# maple: file(1) magic for maple files 21312# "H. Nanosecond" <aldomel@ix.netcom.com> 21313# Maple V release 4, a multi-purpose math program 21314# 21315 21316# maple library .lib 213170 string \000MVR4\nI MapleVr4 library 21318 21319# .ind 21320# no magic for these :-( 21321# they are compiled indexes for maple files 21322 21323# .hdb 213240 string \000\004\000\000 Maple help database 21325 21326# .mhp 21327# this has the form <PACKAGE=name> 213280 string \<PACKAGE= Maple help file 213290 string \<HELP\ NAME= Maple help file 213300 string \n\<HELP\ NAME= Maple help file with extra carriage return at start (yuck) 21331#0 string #\ Newton Maple help file, old style 213320 string #\ daub Maple help file, old style 21333#0 string #=========== Maple help file, old style 21334 21335# .mws 213360 string \000\000\001\044\000\221 Maple worksheet 21337#this is anomalous 213380 string WriteNow\000\002\000\001\000\000\000\000\100\000\000\000\000\000 Maple worksheet, but weird 21339# this has the form {VERSION 2 3 "IBM INTEL NT" "2.3" }\n 21340# that is {VERSION major_version miunor_version computer_type version_string} 213410 string {VERSION\ Maple worksheet 21342>9 string >\0 version %.1s. 21343>>11 string >\0 %.1s 21344 21345# .mps 213460 string \0\0\001$ Maple something 21347# from byte 4 it is either 'nul E' or 'soh R' 21348# I think 'nul E' means a file that was saved as a different name 21349# a sort of revision marking 21350# 'soh R' means new 21351>4 string \000\105 An old revision 21352>4 string \001\122 The latest save 21353 21354# .mpl 21355# some of these are the same as .mps above 21356#0000000 000 000 001 044 000 105 same as .mps 21357#0000000 000 000 001 044 001 122 same as .mps 21358 213590 string #\n##\ <SHAREFILE= Maple something 213600 string \n#\n##\ <SHAREFILE= Maple something 213610 string ##\ <SHAREFILE= Maple something 213620 string #\r##\ <SHAREFILE= Maple something 213630 string \r#\r##\ <SHAREFILE= Maple something 213640 string #\ \r##\ <DESCRIBE> Maple something anomalous. 21365#-------------------------------------------- 21366# marc21: file(1) magic for MARC 21 Format 21367# 21368# Kevin Ford (kefo@loc.gov) 21369# 21370# MARC21 formats are for the representation and communication 21371# of bibliographic and related information in machine-readable 21372# form. For more info, see https://www.loc.gov/marc/ 21373 21374 21375# leader position 20-21 must be 45 21376# and 22-23 also 00 so far, but we check that later. 2137720 string 45 21378>0 search/2048 \x1e 21379 21380# leader starts with 5 digits, followed by codes specific to MARC format 21381>>0 regex/1l (^[0-9]{5})[acdnp][^bhlnqsu-z] MARC21 Bibliographic 21382!:mime application/marc 21383>>0 regex/1l (^[0-9]{5})[acdnosx][z] MARC21 Authority 21384!:mime application/marc 21385>>0 regex/1l (^[0-9]{5})[cdn][uvxy] MARC21 Holdings 21386!:mime application/marc 21387>>0 regex/1l (^[0-9]{5})[acdn][w] MARC21 Classification 21388!:mime application/marc 21389>>0 regex/1l (^[0-9]{5})[cdn][q] MARC21 Community 21390!:mime application/marc 21391 21392# leader position 22-23, should be "00" but is it? 21393>>0 regex/1l (^.{21})([^0]{2}) (non-conforming) 21394!:mime application/marc 21395 21396#------------------------------------------------------------------------------ 21397# $File: mathcad,v 1.5 2009/09/19 16:28:10 christos Exp $ 21398# mathcad: file(1) magic for Mathcad documents 21399# URL: http://www.mathsoft.com/ 21400# From: Josh Triplett <josh@freedesktop.org> 21401 214020 string .MCAD\t Mathcad document 21403 21404#------------------------------------------------------------------------------ 21405# $File: mathematica,v 1.9 2017/03/17 21:35:28 christos Exp $ 21406# mathematica: file(1) magic for mathematica files 21407# "H. Nanosecond" <aldomel@ix.netcom.com> 21408# Mathematica a multi-purpose math program 21409# versions 2.2 and 3.0 21410 21411#mathematica .mb 214120 string \064\024\012\000\035\000\000\000 Mathematica version 2 notebook 21413!:ext mb 214140 string \064\024\011\000\035\000\000\000 Mathematica version 2 notebook 21415!:ext mb 21416 21417# .ma 21418# multiple possibilites: 21419 214200 string (*^\n\n::[\011frontEndVersion\ =\ Mathematica notebook 21421#>41 string >\0 %s 21422!:ext mb 21423 21424#0 string (*^\n\n::[\011palette Mathematica notebook version 2.x 21425 21426#0 string (*^\n\n::[\011Information Mathematica notebook version 2.x 21427#>675 string >\0 %s #doesn't work well 21428 21429# there may be 'cr' instread of 'nl' in some does this matter? 21430 21431# generic: 214320 string (*^\r\r::[\011 Mathematica notebook version 2.x 21433!:ext mb 214340 string (*^\r\n\r\n::[\011 Mathematica notebook version 2.x 21435!:ext mb 214360 string (*^\015 Mathematica notebook version 2.x 21437!:ext mb 214380 string (*^\n\r\n\r::[\011 Mathematica notebook version 2.x 21439!:ext mb 214400 string (*^\r::[\011 Mathematica notebook version 2.x 21441!:ext mb 214420 string (*^\r\n::[\011 Mathematica notebook version 2.x 21443!:ext mb 214440 string (*^\n\n::[\011 Mathematica notebook version 2.x 21445!:ext mb 214460 string (*^\n::[\011 Mathematica notebook version 2.x 21447!:ext mb 21448 21449 21450# Mathematica .mx files 21451 21452#0 string (*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*) Mathematica binary file 214530 string (*This\ is\ a\ Mathematica\ binary\ Mathematica binary file 21454#>71 string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000 21455# >71... is optional 21456>88 string >\0 from %s 21457 21458 21459# Mathematica files PBF: 21460# 115 115 101 120 102 106 000 001 000 000 000 203 000 001 000 214610 string MMAPBF\000\001\000\000\000\203\000\001\000 Mathematica PBF (fonts I think) 21462 21463# .ml files These are menu resources I think 21464# these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\ 21465# how to put that into a magic rule? 214664 string \ A~ MAthematica .ml file 21467 21468# .nb files 21469#too long 0 string (***********************************************************************\n\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Mathematica-Compatible Notebook Mathematica 3.0 notebook 214700 string (*********************** Mathematica 3.0 notebook 21471 21472# other (* matches it is a comment start in these langs 21473# GRR: Too weak; also matches other languages e.g. ML 21474#0 string (* Mathematica, or Pascal, Modula-2 or 3 code text 21475 21476######################### 21477# MatLab v5 214780 string MATLAB Matlab v5 mat-file 21479>126 short 0x494d (big endian) 21480>>124 beshort x version 0x%04x 21481>126 short 0x4d49 (little endian) 21482>>124 leshort x version 0x%04x 21483 21484 21485#------------------------------------------------------------------------------ 21486# $File: matroska,v 1.9 2019/04/19 00:42:27 christos Exp $ 21487# matroska: file(1) magic for Matroska files 21488# 21489# See https://www.matroska.org/ 21490# 21491 21492# EBML id: 214930 belong 0x1a45dfa3 21494# DocType id: 21495>4 search/4096 \x42\x82 21496# DocType contents: 21497>>&1 string webm WebM 21498!:mime video/webm 21499>>&1 string matroska Matroska data 21500!:mime video/x-matroska 21501 21502#------------------------------------------------------------------------------ 21503# $File: mcrypt,v 1.5 2009/09/19 16:28:10 christos Exp $ 21504# Mavroyanopoulos Nikos <nmav@hellug.gr> 21505# mcrypt: file(1) magic for mcrypt 2.2.x; 215060 string \0m\3 mcrypt 2.5 encrypted data, 21507>4 string >\0 algorithm: %s, 21508>>&1 leshort >0 keysize: %d bytes, 21509>>>&0 string >\0 mode: %s, 21510 215110 string \0m\2 mcrypt 2.2 encrypted data, 21512>3 byte 0 algorithm: blowfish-448, 21513>3 byte 1 algorithm: DES, 21514>3 byte 2 algorithm: 3DES, 21515>3 byte 3 algorithm: 3-WAY, 21516>3 byte 4 algorithm: GOST, 21517>3 byte 6 algorithm: SAFER-SK64, 21518>3 byte 7 algorithm: SAFER-SK128, 21519>3 byte 8 algorithm: CAST-128, 21520>3 byte 9 algorithm: xTEA, 21521>3 byte 10 algorithm: TWOFISH-128, 21522>3 byte 11 algorithm: RC2, 21523>3 byte 12 algorithm: TWOFISH-192, 21524>3 byte 13 algorithm: TWOFISH-256, 21525>3 byte 14 algorithm: blowfish-128, 21526>3 byte 15 algorithm: blowfish-192, 21527>3 byte 16 algorithm: blowfish-256, 21528>3 byte 100 algorithm: RC6, 21529>3 byte 101 algorithm: IDEA, 21530>4 byte 0 mode: CBC, 21531>4 byte 1 mode: ECB, 21532>4 byte 2 mode: CFB, 21533>4 byte 3 mode: OFB, 21534>4 byte 4 mode: nOFB, 21535>5 byte 0 keymode: 8bit 21536>5 byte 1 keymode: 4bit 21537>5 byte 2 keymode: SHA-1 hash 21538>5 byte 3 keymode: MD5 hash 21539 21540#------------------------------------------------------------------------------ 21541# $File: measure,v 1.2 2018/06/23 16:13:15 christos Exp $ 21542# measure: file(1) magic for measurement data 21543 21544# DIY-Thermocam raw data 215450 name diy-thermocam-parser 21546>0 beshort x scale %d- 21547>2 beshort x \b%d, 21548>4 lefloat x spot sensor temperature %f, 21549>9 ubyte 0 unit celsius, 21550>9 ubyte 1 unit fahrenheit, 21551>8 ubyte x color scheme %d 21552>10 ubyte 1 \b, show spot sensor 21553>11 ubyte 1 \b, show scale bar 21554>12 ubyte &1 \b, minimum point enabled 21555>12 ubyte &2 \b, maximum point enabled 21556>13 lefloat x \b, calibration: offset %f, 21557>17 lefloat x slope %f 21558 215590 name diy-thermocam-checker 21560>9 ubyte <2 21561>>10 ubyte <2 21562>>>11 ubyte <2 21563>>>>12 ubyte <4 21564>>>>>17 lefloat >0.0001 DIY-Thermocam raw data 21565 21566# V2 and Leption 3.x: 2156738408 ubyte <19 21568>38400 use diy-thermocam-checker 21569>>38400 default x (Lepton 3.x), 21570>>>38400 use diy-thermocam-parser 21571 21572# V1 or Lepton 2.x 215739608 ubyte <19 21574>9600 use diy-thermocam-checker 21575>>9600 default x (Lepton 2.x), 21576>>>9600 use diy-thermocam-parser 21577 21578 21579#------------------------------------------------------------------------------ 21580# $File: mercurial,v 1.5 2019/04/19 00:42:27 christos Exp $ 21581# mercurial: file(1) magic for Mercurial changeset bundles 21582# https://www.selenic.com/mercurial/wiki/ 21583# 21584# Jesse Glick (jesse.glick@sun.com) 21585# 21586 215870 string HG10 Mercurial changeset bundle 21588>4 string UN (uncompressed) 21589>4 string GZ (gzip compressed) 21590>4 string BZ (bzip2 compressed) 21591 21592#------------------------------------------------------------------------------ 21593# $File: metastore,v 1.3 2019/04/19 00:42:27 christos Exp $ 21594# metastore: file(1) magic for metastore files 21595# From: Thomas Wissen 21596# see https://david.hardeman.nu/software.php#metastore 215970 string MeTaSt00r3 Metastore data file, 21598>10 bequad x version %0llx 21599 21600#------------------------------------------------------------------------------ 21601# $File: meteorological,v 1.2 2017/03/17 21:35:28 christos Exp $ 21602# rinex: file(1) magic for RINEX files 21603# http://igscb.jpl.nasa.gov/igscb/data/format/rinex210.txt 21604# ftp://cddis.gsfc.nasa.gov/pub/reports/formats/rinex300.pdf 21605# data for testing: ftp://cddis.gsfc.nasa.gov/pub/gps/data 2160660 string RINEX 21607>80 search/256 XXRINEXB RINEX Data, GEO SBAS Broadcast 21608>>&32 string x \b, date %15.15s 21609>>5 string x \b, version %6.6s 21610!:mime rinex/broadcast 21611>80 search/256 XXRINEXD RINEX Data, Observation (Hatanaka comp) 21612>>&32 string x \b, date %15.15s 21613>>5 string x \b, version %6.6s 21614!:mime rinex/observation 21615>80 search/256 XXRINEXC RINEX Data, Clock 21616>>&32 string x \b, date %15.15s 21617>>5 string x \b, version %6.6s 21618!:mime rinex/clock 21619>80 search/256 XXRINEXH RINEX Data, GEO SBAS Navigation 21620>>&32 string x \b, date %15.15s 21621>>5 string x \b, version %6.6s 21622!:mime rinex/navigation 21623>80 search/256 XXRINEXG RINEX Data, GLONASS Navigation 21624>>&32 string x \b, date %15.15s 21625>>5 string x \b, version %6.6s 21626!:mime rinex/navigation 21627>80 search/256 XXRINEXL RINEX Data, Galileo Navigation 21628>>&32 string x \b, date %15.15s 21629>>5 string x \b, version %6.6s 21630!:mime rinex/navigation 21631>80 search/256 XXRINEXM RINEX Data, Meteorological 21632>>&32 string x \b, date %15.15s 21633>>5 string x \b, version %6.6s 21634!:mime rinex/meteorological 21635>80 search/256 XXRINEXN RINEX Data, Navigation 21636>>&32 string x \b, date %15.15s 21637>>5 string x \b, version %6.6s 21638!:mime rinex/navigation 21639>80 search/256 XXRINEXO RINEX Data, Observation 21640>>&32 string x \b, date %15.15s 21641>>5 string x \b, version %6.6s 21642!:mime rinex/observation 21643 21644# https://en.wikipedia.org/wiki/GRIB 216450 string GRIB 21646>7 byte =1 Gridded binary (GRIB) version 1 21647>7 byte =2 Gridded binary (GRIB) version 2 21648 21649#------------------------------------------------------------------------------ 21650# $File: microfocus,v 1.3 2019/04/19 00:42:27 christos Exp $ 21651# Micro Focus COBOL data files. 21652 21653# https://documentation.microfocus.com/help/index.jsp?topic=\ 21654# %2FGUID-0E0191D8-C39A-44D1-BA4C-D67107BAF784%2FHRFLRHFILE05.html 21655# http://www.cobolproducts.com/datafile/data-viewer.html 21656# https://github.com/miracle2k/mfcobol-export 21657 216580 string \x30\x00\x00\x7C 21659>36 string \x00\x3E Micro Focus File with Header (DAT) 21660!:mime application/octet-stream 21661 216620 string \x30\x7E\x00\x00 21663>36 string \x00\x3E Micro Focus File with Header (DAT) 21664!:mime application/octet-stream 21665 2166639 string \x02 21667>136 string \x02\x02\x04\x04 Micro Focus Index File (IDX) 21668!:mime application/octet-stream 21669 21670#------------------------------------------------------------------------------ 21671# $File: mime,v 1.8 2017/03/17 22:20:22 christos Exp $ 21672# mime: file(1) magic for MIME encoded files 21673# 216740 string/t Content-Type:\040 21675>14 string >\0 %s 216760 string/t Content-Type: 21677>13 string >\0 %s 21678 21679#------------------------------------------------------------------------------ 21680# $File: mips,v 1.10 2014/04/30 21:41:02 christos Exp $ 21681# mips: file(1) magic for MIPS ECOFF and Ucode, as used in SGI IRIX 21682# and DEC Ultrix 21683# 216840 beshort 0x0160 MIPSEB ECOFF executable 21685>20 beshort 0407 (impure) 21686>20 beshort 0410 (swapped) 21687>20 beshort 0413 (paged) 21688>8 belong >0 not stripped 21689>8 belong 0 stripped 21690>22 byte x - version %d 21691>23 byte x \b.%d 21692# 216930 beshort 0x0162 MIPSEL-BE ECOFF executable 21694>20 beshort 0407 (impure) 21695>20 beshort 0410 (swapped) 21696>20 beshort 0413 (paged) 21697>8 belong >0 not stripped 21698>8 belong 0 stripped 21699>23 byte x - version %d 21700>22 byte x \b.%d 21701# 217020 beshort 0x6001 MIPSEB-LE ECOFF executable 21703>20 beshort 03401 (impure) 21704>20 beshort 04001 (swapped) 21705>20 beshort 05401 (paged) 21706>8 belong >0 not stripped 21707>8 belong 0 stripped 21708>23 byte x - version %d 21709>22 byte x \b.%d 21710# 217110 beshort 0x6201 MIPSEL ECOFF executable 21712>20 beshort 03401 (impure) 21713>20 beshort 04001 (swapped) 21714>20 beshort 05401 (paged) 21715>8 belong >0 not stripped 21716>8 belong 0 stripped 21717>23 byte x - version %d 21718>22 byte x \b.%d 21719# 21720# MIPS 2 additions 21721# 217220 beshort 0x0163 MIPSEB MIPS-II ECOFF executable 21723>20 beshort 0407 (impure) 21724>20 beshort 0410 (swapped) 21725>20 beshort 0413 (paged) 21726>8 belong >0 not stripped 21727>8 belong 0 stripped 21728>22 byte x - version %d 21729>23 byte x \b.%d 21730# 217310 beshort 0x0166 MIPSEL-BE MIPS-II ECOFF executable 21732>20 beshort 0407 (impure) 21733>20 beshort 0410 (swapped) 21734>20 beshort 0413 (paged) 21735>8 belong >0 not stripped 21736>8 belong 0 stripped 21737>22 byte x - version %d 21738>23 byte x \b.%d 21739# 217400 beshort 0x6301 MIPSEB-LE MIPS-II ECOFF executable 21741>20 beshort 03401 (impure) 21742>20 beshort 04001 (swapped) 21743>20 beshort 05401 (paged) 21744>8 belong >0 not stripped 21745>8 belong 0 stripped 21746>23 byte x - version %d 21747>22 byte x \b.%d 21748# 217490 beshort 0x6601 MIPSEL MIPS-II ECOFF executable 21750>20 beshort 03401 (impure) 21751>20 beshort 04001 (swapped) 21752>20 beshort 05401 (paged) 21753>8 belong >0 not stripped 21754>8 belong 0 stripped 21755>23 byte x - version %d 21756>22 byte x \b.%d 21757# 21758# MIPS 3 additions 21759# 217600 beshort 0x0140 MIPSEB MIPS-III ECOFF executable 21761>20 beshort 0407 (impure) 21762>20 beshort 0410 (swapped) 21763>20 beshort 0413 (paged) 21764>8 belong >0 not stripped 21765>8 belong 0 stripped 21766>22 byte x - version %d 21767>23 byte x \b.%d 21768# 217690 beshort 0x0142 MIPSEL-BE MIPS-III ECOFF executable 21770>20 beshort 0407 (impure) 21771>20 beshort 0410 (swapped) 21772>20 beshort 0413 (paged) 21773>8 belong >0 not stripped 21774>8 belong 0 stripped 21775>22 byte x - version %d 21776>23 byte x \b.%d 21777# 217780 beshort 0x4001 MIPSEB-LE MIPS-III ECOFF executable 21779>20 beshort 03401 (impure) 21780>20 beshort 04001 (swapped) 21781>20 beshort 05401 (paged) 21782>8 belong >0 not stripped 21783>8 belong 0 stripped 21784>23 byte x - version %d 21785>22 byte x \b.%d 21786# 217870 beshort 0x4201 MIPSEL MIPS-III ECOFF executable 21788>20 beshort 03401 (impure) 21789>20 beshort 04001 (swapped) 21790>20 beshort 05401 (paged) 21791>8 belong >0 not stripped 21792>8 belong 0 stripped 21793>23 byte x - version %d 21794>22 byte x \b.%d 21795# 217960 beshort 0x180 MIPSEB Ucode 217970 beshort 0x182 MIPSEL-BE Ucode 21798 21799#------------------------------------------------------------------------------ 21800# $File: mirage,v 1.7 2009/09/19 16:28:10 christos Exp $ 21801# mirage: file(1) magic for Mirage executables 21802# 21803# XXX - byte order? 21804# 218050 long 31415 Mirage Assembler m.out executable 21806 21807#----------------------------------------------------------------------------- 21808# $File: misctools,v 1.18 2019/04/19 00:42:27 christos Exp $ 21809# misctools: file(1) magic for miscellaneous UNIX tools. 21810# 218110 search/1 %%!! X-Post-It-Note text 218120 string/c BEGIN:VCALENDAR vCalendar calendar file 21813!:mime text/calendar 21814# updated by Joerg Jenderek at Apr 2015 21815# Extension: .vcf 21816# https://en.wikipedia.org/wiki/VCard 218170 string/c BEGIN:VCARD vCard visiting card 21818# deprecated 21819#!:mime text/x-vcard 21820!:mime text/vcard 21821# VERSION must come right after BEGIN for 3.0 or 4.0 except in 2.1 , where it can be anywhere 21822>12 search/14000/c VERSION: 21823# VERSION 2.1 , 3.0 or 4.0 21824>>&0 string x \b, version %-.3s 21825 21826# Summary: Libtool library file 21827# Extension: .la 21828# Submitted by: Tomasz Trojanowski <tomek@uninet.com.pl> 218290 search/80 .la\ -\ a\ libtool\ library\ file libtool library file 21830 21831# Summary: Libtool object file 21832# Extension: .lo 21833# Submitted by: Abel Cheung <abelcheung@gmail.com> 218340 search/80 .lo\ -\ a\ libtool\ object\ file libtool object file 21835 21836# From: Daniel Novotny <dnovotny@redhat.com> 21837# Update: Joerg Jenderek 21838# URL: https://en.wikipedia.org/wiki/Core_dump#User-mode_memory_dumps 21839# Reference: https://msdn.microsoft.com/en-us/library/ms680378%28VS.85%29.aspx 21840# 21841# "Windows Minidump" by TrID 21842# ./misctools (version 5.25) labeled the entry as "MDMP crash report data" 218430 string MDMP Mini DuMP crash report 21844# https://filext.com/file-extension/DMP 21845!:mime application/x-dmp 21846!:ext dmp/mdmp 21847# The high-order word is an internal value that is implementation specific. 21848# The low-order word is MINIDUMP_VERSION 0xA793 21849>4 ulelong&0x0000FFFF !0xA793 \b, version 0x%4.4x 21850# NumberOfStreams 8,9,10,13 21851>8 ulelong x \b, %d streams 21852# StreamDirectoryRva 0x20 21853>12 ulelong !0x20 \b, 0x%8.8x RVA 21854# CheckSum 0 21855>16 ulelong !0 \b, CheckSum 0x%8.8x 21856# Reserved or TimeDateStamp 21857>20 ledate x \b, %s 21858# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680519%28v=vs.85%29.aspx 21859# Flags MINIDUMP_TYPE enumeration type 0 0x121 0x800 21860>24 ulelong x \b, 0x%x type 21861# >24 ulelong >0 \b; include 21862# >>24 ulelong &0x00000001 \b data sections, 21863# >>24 ulelong &0x00000020 \b list of unloaded modules, 21864# >>24 ulelong &0x00000100 \b process and thread information, 21865# >>24 ulelong &0x00000800 \b memory information, 21866 21867# Summary: abook addressbook file 21868# Submitted by: Mark Schreiber <mark7@alumni.cmu.edu> 218690 string #\x20abook\x20addressbook\x20file abook address book 21870!:mime application/x-abook-addressbook 21871 21872#------------------------------------------------------------------------------ 21873# $File: mkid,v 1.6 2009/09/19 16:28:10 christos Exp $ 21874# mkid: file(1) magic for mkid(1) databases 21875# 21876# ID is the binary tags database produced by mkid(1). 21877# 21878# XXX - byte order? 21879# 218800 string \311\304 ID tags data 21881>2 short >0 version %d 21882 21883#------------------------------------------------------------------------------ 21884# $File: mlssa,v 1.4 2009/09/19 16:28:10 christos Exp $ 21885# mlssa: file(1) magic for MLSSA datafiles 21886# 218870 lelong 0xffffabcd MLSSA datafile, 21888>4 leshort x algorithm %d, 21889>10 lelong x %d samples 21890 21891#------------------------------------------------------------------------------ 21892# $File: mmdf,v 1.6 2009/09/19 16:28:10 christos Exp $ 21893# mmdf: file(1) magic for MMDF mail files 21894# 218950 string \001\001\001\001 MMDF mailbox 21896 21897#------------------------------------------------------------------------------ 21898# $File: modem,v 1.9 2019/04/19 00:42:27 christos Exp $ 21899# modem: file(1) magic for modem programs 21900# 21901# From: Florian La Roche <florian@knorke.saar.de> 219021 string PC\ Research,\ Inc Digifax-G3-File 21903>29 byte 1 \b, fine resolution 21904>29 byte 0 \b, normal resolution 21905 21906# Summary: CCITT Group 3 Facsimile in "raw" form (i.e. no header). 21907# Modified by: Joerg Jenderek 21908# URL: https://de.wikipedia.org/wiki/Fax 21909# Reference: https://web.archive.org/web/20020628195336/http://www.netnam.vn/unescocourse/computervision/104.htm 21910# GRR: EOL of G3 is too general as it catches also TrueType fonts, Postscript PrinterFontMetric, others 219110 short 0x0100 21912# 16 0-bits near beginning like True Type fonts *.ttf, Postscript PrinterFontMetric *.pfm, FTYPE.HYPERCARD, XFER 21913>2 search/9 \0\0 21914# maximal 7 0-bits for pixel sequences or 11 0-bits for EOL in G3 21915>2 default x 21916# skip IRCAM file (VAX big-endian) ./audio 21917>>0 belong !0x0001a364 21918# skip GEM Image data ./images 21919>>>2 beshort !0x0008 21920# look for first keyword of Panorama database *.pan 21921>>>>11 search/262 \x06DESIGN 21922# skip Panorama database 21923>>>>11 default x 21924# old Apple DreamWorld DreamGrafix *.3200 with keyword at end of g3 looking files 21925>>>>>27118 search/1864 DreamWorld 21926>>>>>27118 default x 21927# skip MouseTrap/Mt.Defaults with file size 16 found on Golden Orchard Apple II CD Rom 21928>>>>>>8 ubequad !0x2e01010454010203 21929# skip PICTUREH.SML found on Golden Orchard Apple II CD Rom 21930>>>>>>>8 ubequad !0x5dee74ad1aa56394 raw G3 (Group 3) FAX, byte-padded 21931# version 5.25 labeled the entry above "raw G3 data, byte-padded" 21932!:mime image/g3fax 21933#!:apple ????TIFF 21934!:ext g3 21935# unusual image starting with black pixel 21936#0 short 0x1300 raw G3 (Group 3) FAX 219370 short 0x1400 21938# 16 0-bits near beginning like PicturePuzzler found on Golden Orchard Apple CD Rom 21939>2 search/9 \0\0 21940# maximal 7 0-bits for pixel sequences or 11 0-bits for EOL in G3 21941>2 default x raw G3 (Group 3) FAX 21942# version 5.25 labeled the above entry as "raw G3 data" 21943!:mime image/g3fax 21944!:ext g3 21945# unusual image with black pixel near beginning 21946#0 short 0x1900 raw G3 (Group 3) FAX 21947 21948# 21949# Magic data for vgetty voice formats 21950# (Martin Seine & Marc Eberhard) 21951 21952# 21953# raw modem data version 1 21954# 219550 string RMD1 raw modem data 21956>4 string >\0 (%s / 21957>20 short >0 compression type 0x%04x) 21958 21959# 21960# portable voice format 1 21961# 219620 string PVF1\n portable voice format 21963>5 string >\0 (binary %s) 21964 21965# 21966# portable voice format 2 21967# 219680 string PVF2\n portable voice format 21969>5 string >\0 (ascii %s) 21970 21971# From: Bernd Nuernberger <bernd.nuernberger@web.de> 21972# Brooktrout G3 fax data incl. 128 byte header 21973# Common suffixes: 3??, BRK, BRT, BTR 219740 leshort 0x01bb 21975>2 leshort 0x0100 Brooktrout 301 fax image, 21976>>9 leshort x %d x 21977>>0x2d leshort x %d 21978>>6 leshort 200 \b, fine resolution 21979>>6 leshort 100 \b, normal resolution 21980>>11 byte 1 \b, G3 compression 21981>>11 byte 2 \b, G32D compression 21982 21983#------------------------------------------------------------------------------ 21984# $File: modulefile,v 1.1 2019/10/15 18:04:40 christos Exp $ 21985# modulefile: file(1) magic for user's environment modulefile 21986# URL: http://modules.sourceforge.net/ 21987# Reference: https://modules.readthedocs.io/en/stable/modulefile.html 21988# From: Xavier Delaruelle <xavier.delaruelle@cea.fr> 219890 string #%Module modulefile 21990!:mime text/x-modulefile 21991 21992#------------------------------------------------------------------------------ 21993# $File: motorola,v 1.11 2014/04/30 21:41:02 christos Exp $ 21994# motorola: file(1) magic for Motorola 68K and 88K binaries 21995# 21996# 68K 21997# 219980 beshort 0520 mc68k COFF 21999>18 beshort ^00000020 object 22000>18 beshort &00000020 executable 22001>12 belong >0 not stripped 22002>168 string .lowmem Apple toolbox 22003>20 beshort 0407 (impure) 22004>20 beshort 0410 (pure) 22005>20 beshort 0413 (demand paged) 22006>20 beshort 0421 (standalone) 220070 beshort 0521 mc68k executable (shared) 22008>12 belong >0 not stripped 220090 beshort 0522 mc68k executable (shared demand paged) 22010>12 belong >0 not stripped 22011# 22012# Motorola/UniSoft 68K Binary Compatibility Standard (BCS) 22013# 220140 beshort 0554 68K BCS executable 22015# 22016# 88K 22017# 22018# Motorola/88Open BCS 22019# 220200 beshort 0555 88K BCS executable 22021# 22022# Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de> 220230 string S0 Motorola S-Record; binary data in text format 22024 22025# ATARI ST relocatable PRG 22026# 22027# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 22028# (according to Roland Waldi, Oct 21, 1987) 22029# besides the magic 0x601a, the text segment size is checked to be 22030# not larger than 1 MB (which is a lot on ST). 22031# The additional 0x601b distinction I took from Doug Lee's magic. 220320 belong&0xFFFFFFF0 0x601A0000 Atari ST M68K contiguous executable 22033>2 belong x (txt=%d, 22034>6 belong x dat=%d, 22035>10 belong x bss=%d, 22036>14 belong x sym=%d) 220370 belong&0xFFFFFFF0 0x601B0000 Atari ST M68K non-contig executable 22038>2 belong x (txt=%d, 22039>6 belong x dat=%d, 22040>10 belong x bss=%d, 22041>14 belong x sym=%d) 22042 22043# Atari ST/TT... program format (sent by Wolfram Kleff <kleff@cs.uni-bonn.de>) 220440 beshort 0x601A Atari 68xxx executable, 22045>2 belong x text len %u, 22046>6 belong x data len %u, 22047>10 belong x BSS len %u, 22048>14 belong x symboltab len %u, 22049>18 belong 0 22050>22 belong &0x01 fastload flag, 22051>22 belong &0x02 may be loaded to alternate RAM, 22052>22 belong &0x04 malloc may be from alternate RAM, 22053>22 belong x flags: 0x%X, 22054>26 beshort 0 no relocation tab 22055>26 beshort !0 + relocation tab 22056>30 string SFX [Self-Extracting LZH SFX archive] 22057>38 string SFX [Self-Extracting LZH SFX archive] 22058>44 string ZIP! [Self-Extracting ZIP SFX archive] 22059 220600 beshort 0x0064 Atari 68xxx CPX file 22061>8 beshort x (version %04x) 22062 22063#------------------------------------------------------------------------------ 22064# $File: mozilla,v 1.10 2019/04/19 00:42:27 christos Exp $ 22065# mozilla: file(1) magic for Mozilla XUL fastload files 22066# (XUL.mfasl and XPC.mfasl) 22067# URL: https://www.mozilla.org/ 22068# From: Josh Triplett <josh@freedesktop.org> 22069 220700 string XPCOM\nMozFASL\r\n\x1A Mozilla XUL fastload data 22071# Probably the next magic line contains misspelled "mozLz40\0" 220720 string mozLz4a Mozilla lz4 compressed bookmark data 22073# From: Joerg Jenderek 22074# URL: https://lz4.github.io/lz4/ 22075# Reference: https://github.com/avih/dejsonlz4/archive/master.zip/ 22076# dejsonlz4-master\src\dejsonlz4.c 22077# Note: mostly JSON compressed with a non-standard LZ4 header 22078# can be unpacked by dejsonlz4 but not lz4 programm. 220790 string mozLz40\0 Mozilla lz4 compressed data 22080!:mime application/x-lz4+json 22081# mozlz4 extension seems to be used for search/store, while jsonlz4 for bookmarks 22082!:ext jsonlz4/mozlz4 22083# decomp_size 22084>8 ulelong x \b, originally %u bytes 22085# lz4 data 22086#>12 ubequad x \b, lz4 data 0x%16.16llx 22087 22088# From: Joerg Jenderek 22089# URL: https://en.wikipedia.org/wiki/Firefox_4 22090# Reference: https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT 22091# Note: Most ZIP utilities are able to extract such archives 22092# maybe only partly or after some warnings. Example: 22093# zip -FF omni.ja --out omni.zip 220944 string PK\001\002 Mozilla archive omni.ja 22095!:mime application/x-zip 22096!:ext ja 22097# TODO: 22098#>4 use zip-dir-entry 22099 22100#------------------------------------------------------------------------------ 22101# $File: msdos,v 1.137 2020/03/20 17:20:19 christos Exp $ 22102# msdos: file(1) magic for MS-DOS files 22103# 22104 22105# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com) 22106# updated by Joerg Jenderek at Oct 2008,Apr 2011 221070 string/t @ 22108>1 string/cW \ echo\ off DOS batch file text 22109!:mime text/x-msdos-batch 22110!:ext bat 22111>1 string/cW echo\ off DOS batch file text 22112!:mime text/x-msdos-batch 22113!:ext bat 22114>1 string/cW rem DOS batch file text 22115!:mime text/x-msdos-batch 22116!:ext bat 22117>1 string/cW set\ DOS batch file text 22118!:mime text/x-msdos-batch 22119!:ext bat 22120 22121 22122# OS/2 batch files are REXX. the second regex is a bit generic, oh well 22123# the matched commands seem to be common in REXX and uncommon elsewhere 22124100 search/0xffff rxfuncadd 22125>100 regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc OS/2 REXX batch file text 22126100 search/0xffff say 22127>100 regex/c =^[\ \t]{0,10}say\ ['"] OS/2 REXX batch file text 22128 22129# updated by Joerg Jenderek at Oct 2015 22130# https://de.wikipedia.org/wiki/Common_Object_File_Format 22131# http://www.delorie.com/djgpp/doc/coff/filhdr.html 22132# ./intel already labeled COFF type 0x14c=0514 as "80386 COFF executable" 22133#0 leshort 0x14c MS Windows COFF Intel 80386 object file 22134#>4 ledate x stamp %s 221350 leshort 0x166 MS Windows COFF MIPS R4000 object file 22136#>4 ledate x stamp %s 221370 leshort 0x184 MS Windows COFF Alpha object file 22138#>4 ledate x stamp %s 221390 leshort 0x268 MS Windows COFF Motorola 68000 object file 22140#>4 ledate x stamp %s 221410 leshort 0x1f0 MS Windows COFF PowerPC object file 22142#>4 ledate x stamp %s 221430 leshort 0x290 MS Windows COFF PA-RISC object file 22144#>4 ledate x stamp %s 22145 22146# Tests for various EXE types. 22147# 22148# Many of the compressed formats were extraced from IDARC 1.23 source code. 22149# 221500 string/b MZ 22151# All non-DOS EXE extensions have the relocation table more than 0x40 bytes into the file. 22152>0x18 leshort <0x40 MS-DOS executable 22153!:mime application/x-dosexec 22154# Windows and later versions of DOS will allow .EXEs to be named with a .COM 22155# extension, mostly for compatibility's sake. 22156!:ext exe/com 22157# These traditional tests usually work but not always. When test quality support is 22158# implemented these can be turned on. 22159#>>0x18 leshort 0x1c (Borland compiler) 22160#>>0x18 leshort 0x1e (MS compiler) 22161 22162# Maybe it's a PE? 22163>(0x3c.l) string PE\0\0 PE 22164!:mime application/x-dosexec 22165>>(0x3c.l+24) leshort 0x010b \b32 executable 22166>>(0x3c.l+24) leshort 0x020b \b32+ executable 22167>>(0x3c.l+24) leshort 0x0107 ROM image 22168>>(0x3c.l+24) default x Unknown PE signature 22169>>>&0 leshort x 0x%x 22170>>(0x3c.l+22) leshort&0x2000 >0 (DLL) 22171>>(0x3c.l+92) leshort 1 22172# Native PEs include ntoskrnl.exe, hal.dll, smss.exe, autochk.exe, and all the 22173# drivers in Windows/System32/drivers/*.sys. 22174>>>(0x3c.l+22) leshort&0x2000 >0 (native) 22175!:ext dll/sys 22176>>>(0x3c.l+22) leshort&0x2000 0 (native) 22177!:ext exe/sys 22178>>(0x3c.l+92) leshort 2 22179>>>(0x3c.l+22) leshort&0x2000 >0 (GUI) 22180# These could probably be at least partially distinguished from one another by 22181# looking for specific exported functions. 22182# CPL: Control Panel item 22183# TLB: Type library 22184# OCX: OLE/ActiveX control 22185# ACM: Audio compression manager codec 22186# AX: DirectShow source filter 22187# IME: Input method editor 22188!:ext dll/cpl/tlb/ocx/acm/ax/ime 22189>>>(0x3c.l+22) leshort&0x2000 0 (GUI) 22190# Screen savers typically include code from the scrnsave.lib static library, but 22191# that's not guaranteed. 22192!:ext exe/scr 22193>>(0x3c.l+92) leshort 3 22194>>>(0x3c.l+22) leshort&0x2000 >0 (console) 22195!:ext dll/cpl/tlb/ocx/acm/ax/ime 22196>>>(0x3c.l+22) leshort&0x2000 0 (console) 22197!:ext exe/com 22198# https://docs.microsoft.com/en-us/windows/win32/debug/pe-format 22199>>(0x3c.l+92) leshort 7 (POSIX) 22200>>(0x3c.l+92) leshort 9 (Windows CE) 22201>>(0x3c.l+92) leshort 10 (EFI application) 22202>>(0x3c.l+92) leshort 11 (EFI boot service driver) 22203>>(0x3c.l+92) leshort 12 (EFI runtime driver) 22204>>(0x3c.l+92) leshort 13 (EFI ROM) 22205>>(0x3c.l+92) leshort 14 (XBOX) 22206>>(0x3c.l+92) leshort 15 (Windows boot application) 22207>>(0x3c.l+92) default x (Unknown subsystem 22208>>>&0 leshort x 0x%x) 22209>>(0x3c.l+4) leshort 0x14c Intel 80386 22210>>(0x3c.l+4) leshort 0x166 MIPS R4000 22211>>(0x3c.l+4) leshort 0x168 MIPS R10000 22212>>(0x3c.l+4) leshort 0x184 Alpha 22213>>(0x3c.l+4) leshort 0x1a2 Hitachi SH3 22214>>(0x3c.l+4) leshort 0x1a3 Hitachi SH3 DSP 22215>>(0x3c.l+4) leshort 0x1a8 Hitachi SH5 22216>>(0x3c.l+4) leshort 0x169 MIPS WCE v2 22217>>(0x3c.l+4) leshort 0x1a6 Hitachi SH4 22218>>(0x3c.l+4) leshort 0x1c0 ARM 22219>>(0x3c.l+4) leshort 0x1c2 ARM Thumb 22220>>(0x3c.l+4) leshort 0x1c4 ARMv7 Thumb 22221>>(0x3c.l+4) leshort 0x1d3 Matsushita AM33 22222>>(0x3c.l+4) leshort 0x1f0 PowerPC 22223>>(0x3c.l+4) leshort 0x1f1 PowerPC with FPU 22224>>(0x3c.l+4) leshort 0x1f2 PowerPC (big-endian) 22225>>(0x3c.l+4) leshort 0x200 Intel Itanium 22226>>(0x3c.l+4) leshort 0x266 MIPS16 22227>>(0x3c.l+4) leshort 0x268 Motorola 68000 22228>>(0x3c.l+4) leshort 0x290 PA-RISC 22229>>(0x3c.l+4) leshort 0x366 MIPSIV 22230>>(0x3c.l+4) leshort 0x466 MIPS16 with FPU 22231>>(0x3c.l+4) leshort 0xebc EFI byte code 22232>>(0x3c.l+4) leshort 0x5032 RISC-V 32-bit 22233>>(0x3c.l+4) leshort 0x5064 RISC-V 64-bit 22234>>(0x3c.l+4) leshort 0x5128 RISC-V 128-bit 22235>>(0x3c.l+4) leshort 0x9041 Mitsubishi M32R 22236>>(0x3c.l+4) leshort 0x8664 x86-64 22237>>(0x3c.l+4) leshort 0xaa64 Aarch64 22238>>(0x3c.l+4) leshort 0xc0ee MSIL 22239>>(0x3c.l+4) default x Unknown processor type 22240>>>&0 leshort x 0x%x 22241>>(0x3c.l+22) leshort&0x0200 >0 (stripped to external PDB) 22242>>(0x3c.l+22) leshort&0x1000 >0 system file 22243>>(0x3c.l+24) leshort 0x010b 22244>>>(0x3c.l+232) lelong >0 Mono/.Net assembly 22245>>(0x3c.l+24) leshort 0x020b 22246>>>(0x3c.l+248) lelong >0 Mono/.Net assembly 22247 22248# hooray, there's a DOS extender using the PE format, with a valid PE 22249# executable inside (which just prints a message and exits if run in win) 22250>>(8.s*16) string 32STUB \b, 32rtm DOS extender 22251>>(8.s*16) string !32STUB \b, for MS Windows 22252>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed 22253>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed 22254>>(0x3c.l+0xf8) search/0x140 UPX2 22255>>>(&0x10.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) 22256>>(0x3c.l+0xf8) search/0x140 .idata 22257>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) 22258>>>(&0xe.l+(-4)) string ZZ0 \b, ZZip self-extracting archive 22259>>>(&0xe.l+(-4)) string ZZ1 \b, ZZip self-extracting archive 22260>>(0x3c.l+0xf8) search/0x140 .rsrc 22261>>>(&0x0f.l+(-4)) string a\\\4\5 \b, WinHKI self-extracting archive 22262>>>(&0x0f.l+(-4)) string Rar! \b, RAR self-extracting archive 22263>>>(&0x0f.l+(-4)) search/0x3000 MSCF \b, InstallShield self-extracting archive 22264>>>(&0x0f.l+(-4)) search/32 Nullsoft \b, Nullsoft Installer self-extracting archive 22265>>(0x3c.l+0xf8) search/0x140 .data 22266>>>(&0x0f.l) string WEXTRACT \b, MS CAB-Installer self-extracting archive 22267>>(0x3c.l+0xf8) search/0x140 .petite\0 \b, Petite compressed 22268>>>(0x3c.l+0xf7) byte x 22269>>>>(&0x104.l+(-4)) string =!sfx! \b, ACE self-extracting archive 22270>>(0x3c.l+0xf8) search/0x140 .WISE \b, WISE installer self-extracting archive 22271>>(0x3c.l+0xf8) search/0x140 .dz\0\0\0 \b, Dzip self-extracting archive 22272>>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip) 22273>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive 22274>>0x30 string Inno \b, InnoSetup self-extracting archive 22275 22276# If the relocation table is 0x40 or more bytes into the file, it's definitely 22277# not a DOS EXE. 22278>0x18 leshort >0x3f 22279 22280# Hmm, not a PE but the relocation table is too high for a traditional DOS exe, 22281# must be one of the unusual subformats. 22282>>(0x3c.l) string !PE\0\0 MS-DOS executable 22283!:mime application/x-dosexec 22284 22285>>(0x3c.l) string NE \b, NE 22286!:mime application/x-dosexec 22287>>>(0x3c.l+0x36) byte 1 for OS/2 1.x 22288>>>(0x3c.l+0x36) byte 2 for MS Windows 3.x 22289>>>(0x3c.l+0x36) byte 3 for MS-DOS 22290>>>(0x3c.l+0x36) byte 4 for Windows 386 22291>>>(0x3c.l+0x36) byte 5 for Borland Operating System Services 22292>>>(0x3c.l+0x36) default x 22293>>>>(0x3c.l+0x36) byte x (unknown OS %x) 22294>>>(0x3c.l+0x36) byte 0x81 for MS-DOS, Phar Lap DOS extender 22295>>>(0x3c.l+0x0c) leshort&0x8000 0x8000 (DLL or font) 22296# DRV: Driver 22297# 3GR: Grabber device driver 22298# CPL: Control Panel Item 22299# VBX: Visual Basic Extension 22300# FON: Bitmap font 22301# FOT: Font resource file 22302!:ext dll/drv/3gr/cpl/vbx/fon/fot 22303>>>(0x3c.l+0x0c) leshort&0x8000 0 (EXE) 22304!:ext exe/scr 22305>>>&(&0x24.s-1) string ARJSFX \b, ARJ self-extracting archive 22306>>>(0x3c.l+0x70) search/0x80 WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip) 22307 22308>>(0x3c.l) string LX\0\0 \b, LX 22309!:mime application/x-dosexec 22310>>>(0x3c.l+0x0a) leshort <1 (unknown OS) 22311>>>(0x3c.l+0x0a) leshort 1 for OS/2 22312>>>(0x3c.l+0x0a) leshort 2 for MS Windows 22313>>>(0x3c.l+0x0a) leshort 3 for DOS 22314>>>(0x3c.l+0x0a) leshort >3 (unknown OS) 22315>>>(0x3c.l+0x10) lelong&0x28000 =0x8000 (DLL) 22316>>>(0x3c.l+0x10) lelong&0x20000 >0 (device driver) 22317>>>(0x3c.l+0x10) lelong&0x300 0x300 (GUI) 22318>>>(0x3c.l+0x10) lelong&0x28300 <0x300 (console) 22319>>>(0x3c.l+0x08) leshort 1 i80286 22320>>>(0x3c.l+0x08) leshort 2 i80386 22321>>>(0x3c.l+0x08) leshort 3 i80486 22322>>>(8.s*16) string emx \b, emx 22323>>>>&1 string x %s 22324>>>&(&0x54.l-3) string arjsfx \b, ARJ self-extracting archive 22325 22326# MS Windows system file, supposedly a collection of LE executables 22327>>(0x3c.l) string W3 \b, W3 for MS Windows 22328!:mime application/x-dosexec 22329 22330>>(0x3c.l) string LE\0\0 \b, LE executable 22331!:mime application/x-dosexec 22332>>>(0x3c.l+0x0a) leshort 1 22333# some DOS extenders use LE files with OS/2 header 22334>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender 22335>>>>0x240 search/0x200 WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender 22336>>>>0x440 search/0x100 CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender 22337>>>>0x40 search/0x40 PMODE/W for MS-DOS, PMODE/W DOS extender 22338>>>>0x40 search/0x40 STUB/32A for MS-DOS, DOS/32A DOS extender (stub) 22339>>>>0x40 search/0x80 STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub) 22340>>>>0x40 search/0x80 DOS/32A for MS-DOS, DOS/32A DOS extender (embedded) 22341# this is a wild guess; hopefully it is a specific signature 22342>>>>&0x24 lelong <0x50 22343>>>>>(&0x4c.l) string \xfc\xb8WATCOM 22344>>>>>>&0 search/8 3\xdbf\xb9 \b, 32Lite compressed 22345# another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP 22346#>>>>(0x3c.l+0x1c) lelong >0x10000 for OS/2 22347# fails with DOS-Extenders. 22348>>>(0x3c.l+0x0a) leshort 2 for MS Windows 22349>>>(0x3c.l+0x0a) leshort 3 for DOS 22350>>>(0x3c.l+0x0a) leshort 4 for MS Windows (VxD) 22351# VXD: VxD for Windows 95/98/Me 22352# 386: VxD for Windows 2.10, 3.0, 3.1x 22353# PDR: Port driver 22354# MPD: Miniport driver (?) 22355!:ext vxd/386/pdr/mpd 22356>>>(&0x7c.l+0x26) string UPX \b, UPX compressed 22357>>>&(&0x54.l-3) string UNACE \b, ACE self-extracting archive 22358 22359# looks like ASCII, probably some embedded copyright message. 22360# and definitely not NE/LE/LX/PE 22361>>0x3c lelong >0x20000000 22362>>>(4.s*512) leshort !0x014c \b, MZ for MS-DOS 22363!:mime application/x-dosexec 22364!:ext exe/com 22365# header data too small for extended executable 22366>2 long !0 22367>>0x18 leshort <0x40 22368>>>(4.s*512) leshort !0x014c 22369 22370>>>>&(2.s-514) string !LE 22371>>>>>&-2 string !BW \b, MZ for MS-DOS 22372!:mime application/x-dosexec 22373>>>>&(2.s-514) string LE \b, LE 22374>>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender 22375# educated guess since indirection is still not capable enough for complex offset 22376# calculations (next embedded executable would be at &(&2*512+&0-2) 22377# I suspect there are only LE executables in these multi-exe files 22378>>>>&(2.s-514) string BW 22379>>>>>0x240 search/0x100 DOS/4G \b, LE for MS-DOS, DOS4GW DOS extender (embedded) 22380>>>>>0x240 search/0x100 !DOS/4G \b, BW collection for MS-DOS 22381 22382# This sequence skips to the first COFF segment, usually .text 22383>(4.s*512) leshort 0x014c \b, COFF 22384!:mime application/x-dosexec 22385>>(8.s*16) string go32stub for MS-DOS, DJGPP go32 DOS extender 22386>>(8.s*16) string emx 22387>>>&1 string x for DOS, Win or OS/2, emx %s 22388>>&(&0x42.l-3) byte x 22389>>>&0x26 string UPX \b, UPX compressed 22390# and yet another guess: small .text, and after large .data is unusal, could be 32lite 22391>>&0x2c search/0xa0 .text 22392>>>&0x0b lelong <0x2000 22393>>>>&0 lelong >0x6000 \b, 32lite compressed 22394 22395>(8.s*16) string $WdX \b, WDos/X DOS extender 22396 22397# By now an executable type should have been printed out. The executable 22398# may be a self-uncompressing archive, so look for evidence of that and 22399# print it out. 22400# 22401# Some signatures below from Greg Roelofs, newt@uchicago.edu. 22402# 22403>0x35 string \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed 22404>0xe7 string LH/2\ Self-Extract \b, %s 22405>0x1c string UC2X \b, UCEXE compressed 22406>0x1c string WWP\ \b, WWPACK compressed 22407>0x1c string RJSX \b, ARJ self-extracting archive 22408>0x1c string diet \b, diet compressed 22409>0x1c string LZ09 \b, LZEXE v0.90 compressed 22410>0x1c string LZ91 \b, LZEXE v0.91 compressed 22411>0x1c string tz \b, TinyProg compressed 22412>0x1e string Copyright\ 1989-1990\ PKWARE\ Inc. Self-extracting PKZIP archive 22413!:mime application/zip 22414# Yes, this really is "Copr", not "Corp." 22415>0x1e string PKLITE\ Copr. Self-extracting PKZIP archive 22416!:mime application/zip 22417# winarj stores a message in the stub instead of the sig in the MZ header 22418>0x20 search/0xe0 aRJsfX \b, ARJ self-extracting archive 22419>0x20 string AIN 22420>>0x23 string 2 \b, AIN 2.x compressed 22421>>0x23 string <2 \b, AIN 1.x compressed 22422>>0x23 string >2 \b, AIN 1.x compressed 22423>0x24 string LHa's\ SFX \b, LHa self-extracting archive 22424!:mime application/x-lha 22425>0x24 string LHA's\ SFX \b, LHa self-extracting archive 22426!:mime application/x-lha 22427>0x24 string \ $ARX \b, ARX self-extracting archive 22428>0x24 string \ $LHarc \b, LHarc self-extracting archive 22429>0x20 string SFX\ by\ LARC \b, LARC self-extracting archive 22430>0x40 string aPKG \b, aPackage self-extracting archive 22431>0x64 string W\ Collis\0\0 \b, Compack compressed 22432>0x7a string Windows\ self-extracting\ ZIP \b, ZIP self-extracting archive 22433>>&0xf4 search/0x140 \x0\x40\x1\x0 22434>>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive 22435>1638 string -lh5- \b, LHa self-extracting archive v2.13S 22436>0x17888 string Rar! \b, RAR self-extracting archive 22437 22438# Skip to the end of the EXE. This will usually work fine in the PE case 22439# because the MZ image is hardcoded into the toolchain and almost certainly 22440# won't match any of these signatures. 22441>(4.s*512) long x 22442>>&(2.s-517) byte x 22443>>>&0 string PK\3\4 \b, ZIP self-extracting archive 22444>>>&0 string Rar! \b, RAR self-extracting archive 22445>>>&0 string =!\x11 \b, AIN 2.x self-extracting archive 22446>>>&0 string =!\x12 \b, AIN 2.x self-extracting archive 22447>>>&0 string =!\x17 \b, AIN 1.x self-extracting archive 22448>>>&0 string =!\x18 \b, AIN 1.x self-extracting archive 22449>>>&7 search/400 **ACE** \b, ACE self-extracting archive 22450>>>&0 search/0x480 UC2SFX\ Header \b, UC2 self-extracting archive 22451 22452# a few unknown ZIP sfxes, no idea if they are needed or if they are 22453# already captured by the generic patterns above 22454>(8.s*16) search/0x20 PKSFX \b, ZIP self-extracting archive (PKZIP) 22455# TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive 22456# 22457 22458# TELVOX Teleinformatica CODEC self-extractor for OS/2: 22459>49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21 22460>>49824 leshort =1 \b, 1 file 22461>>49824 leshort >1 \b, %u files 22462 22463# added by Joerg Jenderek of https://www.freedos.org/software/?prog=kc 22464# and https://www.freedos.org/software/?prog=kpdos 22465# for FreeDOS files like KEYBOARD.SYS, KEYBRD2.SYS, KEYBRD3.SYS, *.KBD 224660 string/b KCF FreeDOS KEYBoard Layout collection 22467# only version=0x100 found 22468>3 uleshort x \b, version 0x%x 22469# length of string containing author,info and special characters 22470>6 ubyte >0 22471#>>6 pstring x \b, name=%s 22472>>7 string >\0 \b, author=%-.14s 22473>>7 search/254 \xff \b, info= 22474#>>>&0 string x \b%-s 22475>>>&0 string x \b%-.15s 22476# for FreeDOS *.KL files 224770 string/b KLF FreeDOS KEYBoard Layout file 22478# only version=0x100 or 0x101 found 22479>3 uleshort x \b, version 0x%x 22480# stringlength 22481>5 ubyte >0 22482>>8 string x \b, name=%-.2s 224830 string \xffKEYB\ \ \ \0\0\0\0 22484>12 string \0\0\0\0`\004\360 MS-DOS KEYBoard Layout file 22485 22486# DOS device driver updated by Joerg Jenderek at May 2011,Mar 2017 22487# https://amaus.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009 224880 ulequad&0x07a0ffffffff 0xffffffff 22489>0 use msdos-driver 224900 name msdos-driver DOS executable ( 22491#!:mime application/octet-stream 22492!:mime application/x-dosdriver 22493# also found FreeDOS print driver SPOOL.DEV and disc compression driver STACLOAD.BIN 22494!:ext sys/dev/bin 22495>40 search/7 UPX! \bUPX compressed 22496# DOS device driver attributes 22497>4 uleshort&0x8000 0x0000 \bblock device driver 22498# character device 22499>4 uleshort&0x8000 0x8000 \b 22500>>4 uleshort&0x0008 0x0008 \bclock 22501# fast video output by int 29h 22502>>4 uleshort&0x0010 0x0010 \bfast 22503# standard input/output device 22504>>4 uleshort&0x0003 >0 \bstandard 22505>>>4 uleshort&0x0001 0x0001 \binput 22506>>>4 uleshort&0x0003 0x0003 \b/ 22507>>>4 uleshort&0x0002 0x0002 \boutput 22508>>4 uleshort&0x8000 0x8000 \bcharacter device driver 22509>0 ubyte x 22510# upx compressed device driver has garbage instead of real in name field of header 22511>>40 search/7 UPX! 22512>>40 default x 22513# leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped 22514>>>12 ubyte >0x2E \b 22515>>>>10 ubyte >0x20 22516>>>>>10 ubyte !0x2E 22517>>>>>>10 ubyte !0x2A \b%c 22518>>>>11 ubyte >0x20 22519>>>>>11 ubyte !0x2E \b%c 22520>>>>12 ubyte >0x20 22521>>>>>12 ubyte !0x39 22522>>>>>>12 ubyte !0x2E \b%c 22523>>>13 ubyte >0x20 22524>>>>13 ubyte !0x2E \b%c 22525>>>>14 ubyte >0x20 22526>>>>>14 ubyte !0x2E \b%c 22527>>>>15 ubyte >0x20 22528>>>>>15 ubyte !0x2E \b%c 22529>>>>16 ubyte >0x20 22530>>>>>16 ubyte !0x2E 22531>>>>>>16 ubyte <0xCB \b%c 22532>>>>17 ubyte >0x20 22533>>>>>17 ubyte !0x2E 22534>>>>>>17 ubyte <0x90 \b%c 22535# some character device drivers like ASPICD.SYS, btcdrom.sys and Cr_atapi.sys contain only spaces or points in name field 22536>>>12 ubyte <0x2F 22537# they have their real name at offset 22 22538# also block device drivers like DUMBDRV.SYS 22539>>>>22 string >\056 %-.6s 22540>4 uleshort&0x8000 0x0000 22541# 32 bit sector addressing ( > 32 MB) for block devices 22542>>4 uleshort&0x0002 0x0002 \b,32-bit sector- 22543# support by driver functions 13h, 17h, 18h 22544>4 uleshort&0x0040 0x0040 \b,IOCTL- 22545# open, close, removable media support by driver functions 0Dh, 0Eh, 0Fh 22546>4 uleshort&0x0800 0x0800 \b,close media- 22547# output until busy support by int 10h for character device driver 22548>4 uleshort&0x8000 0x8000 22549>>4 uleshort&0x2000 0x2000 \b,until busy- 22550# direct read/write support by driver functions 03h,0Ch 22551>4 uleshort&0x4000 0x4000 \b,control strings- 22552>4 uleshort&0x8000 0x8000 22553>>4 uleshort&0x6840 >0 \bsupport 22554>4 uleshort&0x8000 0x0000 22555>>4 uleshort&0x4842 >0 \bsupport 22556>0 ubyte x \b) 22557# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header 225580 ulequad 0x0513c00000000012 22559>0 use msdos-driver 22560# DOS drivers DC2975.SYS, DUMBDRV.SYS, ECHO.SYS has also none 0xffffffff for pointer field 225610 ulequad 0x32f28000ffff0016 22562>0 use msdos-driver 225630 ulequad 0x007f00000000ffff 22564>0 use msdos-driver 225650 ulequad 0x001600000000ffff 22566>0 use msdos-driver 22567# DOS drivers LS120.SYS, MKELS120.SYS use reserved bits of attribute field 225680 ulequad 0x0bf708c2ffffffff 22569>0 use msdos-driver 225700 ulequad 0x07bd08c2ffffffff 22571>0 use msdos-driver 22572 22573# updated by Joerg Jenderek 22574# GRR: line below too general as it catches also 22575# rt.lib DYADISKS.PIC and many more 22576# start with assembler instruction MOV 225770 ubyte 0x8c 22578# skip "AppleWorks word processor data" like ARTICLE.1 ./apple 22579>4 string !O==== 22580# skip some unknown basic binaries like RocketRnger.SHR 22581>>5 string !MAIN 22582# skip "GPG symmetrically encrypted data" ./gnu 22583# skip "PGP symmetric key encrypted data" ./pgp 22584# openpgpdefs.h: fourth byte < 14 indicate cipher algorithm type 22585>>>4 ubyte >13 DOS executable (COM, 0x8C-variant) 22586# the remaining files should be DOS *.COM executables 22587# dosshell.COM 8cc0 2ea35f07 e85211 e88a11 b80058 cd 22588# hmload.COM 8cc8 8ec0 bbc02b 89dc 83c30f c1eb04 b4 22589# UNDELETE.COM 8cca 2e8916 6503 b430 cd21 8b 2e0200 8b 22590# BOOTFIX.COM 8cca 2e8916 9603 b430 cd21 8b 2e0200 8b 22591# RAWRITE3.COM 8cca 2e8916 d602 b430 cd21 8b 2e0200 8b 22592# SHARE.COM 8cca 2e8916 d602 b430 cd21 8b 2e0200 8b 22593# validchr.COM 8cca 2e8916 9603 b430 cd21 8b 2e028b1e 22594# devload.COM 8cca 8916ad01 b430 cd21 8b2e0200 892e 22595!:mime application/x-dosexec 22596!:ext com 22597 22598# updated by Joerg Jenderek at Oct 2008 225990 ulelong 0xffff10eb DR-DOS executable (COM) 22600# byte 0xeb conflicts with "sequent" magic leshort 0xn2eb 226010 ubeshort&0xeb8d >0xeb00 22602# DR-DOS STACKER.COM SCREATE.SYS missed 22603 226040 name msdos-com 22605>0 byte x DOS executable (COM) 22606!:mime application/x-dosexec 22607!:ext com 22608>6 string SFX\ of\ LHarc \b, %s 22609>0x1FE leshort 0xAA55 \b, boot code 22610>85 string UPX \b, UPX compressed 22611>4 string \ $ARX \b, ARX self-extracting archive 22612>4 string \ $LHarc \b, LHarc self-extracting archive 22613>0x20e string SFX\ by\ LARC \b, LARC self-extracting archive 22614 22615# JMP 8bit 226160 byte 0xeb 22617# allow forward jumps only 22618>1 byte >-1 22619# that offset must be accessible 22620>>(1.b+2) byte x 22621>>>0 use msdos-com 22622 22623# JMP 16bit 226240 byte 0xe9 22625# forward jumps 22626>1 short >-1 22627# that offset must be accessible 22628>>(1.s+3) byte x 22629>>>0 use msdos-com 22630# negative offset, must not lead into PSP 22631>1 short <-259 22632# that offset must be accessible 22633>>(1,s+65539) byte x 22634>>>0 use msdos-com 22635 22636# updated by Joerg Jenderek at Oct 2008,2015 22637# following line is too general 226380 ubyte 0xb8 22639# skip 2 linux kernels like memtest.bin with "\xb8\xc0\x07\x8e" in ./linux 22640>0 string !\xb8\xc0\x07\x8e 22641# modified by Joerg Jenderek 22642# syslinux COM32 or COM32R executable 22643>>1 lelong&0xFFFFFFFe 0x21CD4CFe COM executable (32-bit COMBOOT 22644# https://www.syslinux.org/wiki/index.php/Comboot_API 22645# Since version 5.00 c32 modules switched from the COM32 object format to ELF 22646!:mime application/x-c32-comboot-syslinux-exec 22647!:ext c32 22648# https://syslinux.zytor.com/comboot.php 22649# older syslinux version ( <4 ) 22650# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode 22651# start with assembler instructions mov eax,21cd4cffh 22652>>>1 lelong 0x21CD4CFf \b) 22653# syslinux:doc/comboot.txt 22654# A COM32R program must start with the byte sequence B8 FE 4C CD 21 (mov 22655# eax,21cd4cfeh) as a magic number. 22656# syslinux version (4.x) 22657# "COM executable (COM32R)" or "Syslinux COM32 module" by TrID 22658>>>1 lelong 0x21CD4CFe \b, relocatable) 22659# remaining are DOS COM executables starting with assembler instruction MOV 22660# like FreeDOS BANNER*.COM FINDDISK.COM GIF2RAW.COM WINCHK.COM 22661# MS-DOS SYS.COM RESTART.COM 22662# SYSLINUX.COM (version 1.40 - 2.13) 22663# GFXBOOT.COM (version 3.75) 22664# COPYBS.COM POWEROFF.COM INT18.COM 22665>>1 default x COM executable for DOS 22666!:mime application/x-dosexec 22667#!:mime application/x-ms-dos-executable 22668#!:mime application/x-msdos-program 22669!:ext com 22670 226710 string/b \x81\xfc 22672>4 string \x77\x02\xcd\x20\xb9 22673>>36 string UPX! FREE-DOS executable (COM), UPX compressed 22674!:mime application/x-dosexec 22675!:ext com 22676252 string Must\ have\ DOS\ version DR-DOS executable (COM) 22677!:mime application/x-dosexec 22678!:ext com 22679# added by Joerg Jenderek at Oct 2008 22680# GRR search is not working 22681#34 search/2 UPX! FREE-DOS executable (COM), UPX compressed 2268234 string UPX! FREE-DOS executable (COM), UPX compressed 22683!:mime application/x-dosexec 22684!:ext com 2268535 string UPX! FREE-DOS executable (COM), UPX compressed 22686!:mime application/x-dosexec 22687!:ext com 22688# GRR search is not working 22689#2 search/28 \xcd\x21 COM executable for MS-DOS 22690#WHICHFAT.cOM 226912 string \xcd\x21 COM executable for DOS 22692!:mime application/x-dosexec 22693!:ext com 22694#DELTREE.cOM DELTREE2.cOM 226954 string \xcd\x21 COM executable for DOS 22696!:mime application/x-dosexec 22697!:ext com 22698#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM 226995 string \xcd\x21 COM executable for DOS 22700!:mime application/x-dosexec 22701!:ext com 22702#DELTMP.COm HASFAT32.cOM 227037 string \xcd\x21 22704>0 byte !0xb8 COM executable for DOS 22705!:mime application/x-dosexec 22706!:ext com 22707#COMP.cOM MORE.COm 2270810 string \xcd\x21 22709>5 string !\xcd\x21 COM executable for DOS 22710!:mime application/x-dosexec 22711!:ext com 22712#comecho.com 2271313 string \xcd\x21 COM executable for DOS 22714!:mime application/x-dosexec 22715!:ext com 22716#HELP.COm EDIT.coM 2271718 string \xcd\x21 COM executable for MS-DOS 22718!:mime application/x-dosexec 22719!:ext com 22720#NWRPLTRM.COm 2272123 string \xcd\x21 COM executable for MS-DOS 22722!:mime application/x-dosexec 22723!:ext com 22724#LOADFIX.cOm LOADFIX.cOm 2272530 string \xcd\x21 COM executable for MS-DOS 22726!:mime application/x-dosexec 22727!:ext com 22728#syslinux.com 3.11 2272970 string \xcd\x21 COM executable for DOS 22730!:mime application/x-dosexec 22731!:ext com 22732# many compressed/converted COMs start with a copy loop instead of a jump 227330x6 search/0xa \xfc\x57\xf3\xa5\xc3 COM executable for MS-DOS 22734!:mime application/x-dosexec 22735!:ext com 227360x6 search/0xa \xfc\x57\xf3\xa4\xc3 COM executable for DOS 22737!:mime application/x-dosexec 22738!:ext com 22739>0x18 search/0x10 \x50\xa4\xff\xd5\x73 \b, aPack compressed 227400x3c string W\ Collis\0\0 COM executable for MS-DOS, Compack compressed 22741!:mime application/x-dosexec 22742!:ext com 22743# FIXME: missing diet .com compression 22744 22745# miscellaneous formats 227460 string/b LZ MS-DOS executable (built-in) 22747#0 byte 0xf0 MS-DOS program library data 22748# 22749 22750# AAF files: 22751# <stuartc@rd.bbc.co.uk> Stuart Cunningham 227520 string/b \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage 22753>30 byte 9 (512B sectors) 22754>30 byte 12 (4kB sectors) 227550 string/b \320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001 AAF file using MS Structured Storage 22756>30 byte 9 (512B sectors) 22757>30 byte 12 (4kB sectors) 22758 22759# Popular applications 22760# 22761# Update: Joerg Jenderek 22762# URL: http://fileformats.archiveteam.org/wiki/DOC 22763# Reference: https://web.archive.org/web/20170206041048/ 22764# http://www.msxnet.org/word2rtf/formats/ffh-dosword5 22765# wIdent+dty 227660 belong 0x31be0000 22767# skip droid skeleton like x-fmt-274-signature-id-488.doc 22768>128 ubyte >0 Microsoft 22769>>96 uleshort =0 Word 22770!:mime application/msword 22771!:apple MSWDWDBN 22772# DCX is used in the Unix version. 22773!:ext doc/dcx 22774>>>0x6E ulequad =0 1.0-4.0 22775>>>0x6E ulequad !0 5.0-6.0 22776>>>0x6E ulequad x (DOS) Document 22777# https://web.archive.org/web/20130831064118/http://msxnet.org/word2rtf/formats/write.txt 22778>>96 uleshort !0 Write 3.0 (Windows) Document 22779!:mime application/x-mswrite 22780!:apple MSWDWDBN 22781# sometimes also doc like in splitter.doc srchtest.doc 22782!:ext wri/doc 22783# wTool must be 0125400 octal 22784#>>4 uleshort !0xAB00 \b, wTool %o 22785# reserved; must be zero 22786#>>6 ulelong !0 \b, reserved %u 22787# block pointer to the block containing optional file manager information 22788#>>0x1C uleshort x \b, at 0x%x info block 22789# jump to File manager information block 22790>>(0x1C.s*128) uleshort x 22791# test for valid information start; maybe also 0012h 22792>>>&-2 uleshort =0x0014 22793# Document ASCIIZ name 22794>>>>&0x12 string x %s 22795# author name 22796>>>>>&1 string x \b, author %s 22797# reviser name 22798>>>>>>&1 string x \b, reviser %s 22799# keywords 22800>>>>>>>&1 string x \b, keywords %s 22801# comment 22802>>>>>>>>&1 string x \b, comment %s 22803# version number 22804>>>>>>>>>&1 string x \b, version %s 22805# date of last change MM/DD/YY 22806>>>>>>>>>>&1 string x \b, %-.8s 22807# creation date MM/DD/YY 22808>>>>>>>>>>&9 string x created %-.8s 22809# file name of print format like NORMAL.STY 22810>>0x1E string >0 \b, formatted by %-.66s 22811# count of pages in whole file for write variant; maybe some times wrong 22812>>96 uleshort >0 \b, %u pages 22813# name of the printer driver like HPLASMS 22814>>0x62 string >0 \b, %-.8s printer 22815# number of blocks used in the file; seems to be 0 for Word 4.0 and Write 3.0 22816>>0x6A uleshort >0 \b, %u blocks 22817# bit field for corrected text areas 22818#>>0x6C uleshort x \b, 0x%x bit field 22819# text of document; some times start with 4 non printable characters like CR LF 22820>>128 ubyte x \b, 22821>>>128 ubyte >0x1F 22822>>>>128 string x %s 22823>>>128 ubyte <0x20 22824>>>>129 ubyte >0x1F 22825>>>>>129 string x %s 22826>>>>129 ubyte <0x20 22827>>>>>130 ubyte >0x1F 22828>>>>>>130 string x %s 22829>>>>>130 ubyte <0x20 22830>>>>>>131 ubyte >0x1F 22831>>>>>>>131 string x %s 22832>>>>>>131 ubyte <0x20 22833>>>>>>>132 ubyte >0x1F 22834>>>>>>>>132 string x %s 22835>>>>>>>132 ubyte <0x20 22836>>>>>>>>133 ubyte >0x1F 22837>>>>>>>>>133 string x %s 22838# 228390 string/b PO^Q` Microsoft Word 6.0 Document 22840!:mime application/msword 22841# 228424 long 0 22843>0 belong 0xfe320000 Microsoft Word for Macintosh 1.0 22844!:mime application/msword 22845!:ext mcw 22846>0 belong 0xfe340000 Microsoft Word for Macintosh 3.0 22847!:mime application/msword 22848!:ext mcw 22849>0 belong 0xfe37001c Microsoft Word for Macintosh 4.0 22850!:mime application/msword 22851!:ext mcw 22852>0 belong 0xfe370023 Microsoft Word for Macintosh 5.0 22853!:mime application/msword 22854!:ext mcw 22855 228560 string/b \333\245-\0\0\0 Microsoft Word 2.0 Document 22857!:mime application/msword 22858!:ext doc 22859# Note: seems already recognized as "OLE 2 Compound Document" in ./ole2compounddocs 22860#512 string/b \354\245\301 Microsoft Word Document 22861#!:mime application/msword 22862 22863# 228640 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document 22865!:mime application/msword 22866# 228670 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document 22868!:mime application/msword 22869 22870# 228710 string/b \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet 22872!:mime application/vnd.ms-excel 22873# https://www.macdisk.com/macsigen.php 22874!:apple XCELXLS4 22875!:ext xls 22876# 22877# Update: Joerg Jenderek 22878# URL: https://en.wikipedia.org/wiki/Lotus_1-2-3 22879# Reference: http://www.aboutvb.de/bas/formate/pdf/wk3.pdf 22880# Note: newer Lotus versions >2 use longer BOF record 22881# record type (BeginningOfFile=0000h) + length (001Ah) 228820 belong 0x00001a00 22883# reserved should be 0h but 8c0dh for TUTMAC.WK3, 5h for SAMPADNS.WK3, 1h for a_readme.wk3, 1eh for K&G86.WK3 22884#>18 uleshort&0x73E0 0 22885# Lotus Multi Byte Character Set (LMBCS=1-31) 22886>20 ubyte >0 22887>>20 ubyte <32 Lotus 1-2-3 22888#!:mime application/x-123 22889!:mime application/vnd.lotus-1-2-3 22890!:apple ????L123 22891# (version 5.26) labeled the entry as "Lotus 1-2-3 wk3 document data" 22892>>>4 uleshort 0x1000 WorKsheet, version 3 22893!:ext wk3 22894# (version 5.26) labeled the entry as "Lotus 1-2-3 wk4 document data" 22895>>>4 uleshort 0x1002 WorKsheet, version 4 22896# also worksheet template 4 (.wt4) 22897!:ext wk4/wt4 22898# no example or documentation for wk5 22899#>>4 uleshort 0x???? WorKsheet, version 4 22900#!:ext wk5 22901# only MacrotoScript.123 example 22902>>>4 uleshort 0x1003 WorKsheet, version 97 22903# also worksheet template Smartmaster (.12M)? 22904!:ext 123 22905# only Set_Y2K.123 example 22906>>>4 uleshort 0x1005 WorKsheet, version 9.8 Millennium 22907!:ext 123 22908# no example for this version 22909>>>4 uleshort 0x8001 FoRMatting data 22910!:ext frm 22911# (version 5.26) labeled the entry as "Lotus 1-2-3 fm3 or fmb document data" 22912# TrID labeles the entry as "Formatting Data for Lotus 1-2-3 worksheet" 22913>>>4 uleshort 0x8007 ForMatting data, version 3 22914!:ext fm3 22915>>>4 default x unknown 22916# file revision sub code 0004h for worksheets 22917>>>>6 uleshort =0x0004 worksheet 22918!:ext wXX 22919>>>>6 uleshort !0x0004 formatting data 22920!:ext fXX 22921# main revision number 22922>>>>4 uleshort x \b, revision 0x%x 22923>>>6 uleshort =0x0004 \b, cell range 22924# active cellcoord range (start row, page,column ; end row, page, column) 22925# start values normally 0~1st sheet A1 22926>>>>8 ulelong !0 22927>>>>>10 ubyte >0 \b%d* 22928>>>>>8 uleshort x \b%d, 22929>>>>>11 ubyte x \b%d- 22930# end page mostly 0 22931>>>>14 ubyte >0 \b%d* 22932# end raw, column normally not 0 22933>>>>12 uleshort x \b%d, 22934>>>>15 ubyte x \b%d 22935# Lotus Multi Byte Character Set (1~cp850,2~cp851,...,16~japan,...,31~??) 22936>>>>20 ubyte >1 \b, character set 0x%x 22937# flags 22938>>>>21 ubyte x \b, flags 0x%x 22939>>>6 uleshort !0x0004 22940# record type (FONTNAME=00AEh) 22941>>>>30 search/29 \0\xAE 22942# variable length m (2) + entries (1) + ?? (1) + LCMBS string (n) 22943>>>>>&4 string >\0 \b, 1st font "%s" 22944# 22945# Update: Joerg Jenderek 22946# URL: http://fileformats.archiveteam.org/wiki/Lotus_1-2-3 22947# Reference: http://www.schnarff.com/file-formats/lotus-1-2-3/WSFF2.TXT 22948# Note: Used by both old Lotus 1-2-3 and Lotus Symphony (DOS) til version 2.x 22949# record type (BeginningOfFile=0000h) + length (0002h) 229500 belong 0x00000200 22951# GRR: line above is too general as it catches also MS Windows CURsor 22952# to display MS Windows cursor (strength=70) before Lotus 1-2-3 (strength=70-1) 22953!:strength -1 22954# skip Windows cursors with image height <256 and keep Lotus with low opcode 0001-0083h 22955>7 ubyte 0 22956# skip Windows cursors with image width 256 and keep Lotus with positiv opcode 22957>>6 ubyte >0 Lotus 22958# !:mime application/x-123 22959!:mime application/vnd.lotus-1-2-3 22960!:apple ????L123 22961# revision number (0404h = 123 1A, 0405h = Lotus Symphony , 0406h = 123 2.x wk1 , 8006h = fmt , ...) 22962# undocumented; (version 5.26) labeled the configurations as "Lotus 1-2-3" 22963>>>4 uleshort 0x0007 1-2-3 CoNFiguration, version 2.x (PGRAPH.CNF) 22964!:ext cnf 22965>>>4 uleshort 0x0C05 1-2-3 CoNFiguration, version 2.4J 22966!:ext cnf 22967>>>4 uleshort 0x0801 1-2-3 CoNFiguration, version 1-2.1 22968!:ext cnf 22969>>>4 uleshort 0x0802 Symphony CoNFiguration 22970!:ext cnf 22971>>>4 uleshort 0x0804 1-2-3 CoNFiguration, version 2.2 22972!:ext cnf 22973>>>4 uleshort 0x080A 1-2-3 CoNFiguration, version 2.3-2.4 22974!:ext cnf 22975>>>4 uleshort 0x1402 1-2-3 CoNFiguration, version 3.x 22976!:ext cnf 22977>>>4 uleshort 0x1450 1-2-3 CoNFiguration, version 4.x 22978!:ext cnf 22979# (version 5.26) labeled the entry as "Lotus 123" 22980# TrID labeles the entry as "Lotus 123 Worksheet (generic)" 22981>>>4 uleshort 0x0404 1-2-3 WorKSheet, version 1 22982# extension "wks" also for Microsoft Works document 22983!:ext wks 22984# (version 5.26) labeled the entry as "Lotus 123" 22985# TrID labeles the entry as "Lotus 123 Worksheet (generic)" 22986>>>4 uleshort 0x0405 Symphony WoRksheet, version 1.0 22987!:ext wrk/wr1 22988# (version 5.26) labeled the entry as "Lotus 1-2-3 wk1 document data" 22989# TrID labeles the entry as "Lotus 123 Worksheet (V2)" 22990>>>4 uleshort 0x0406 1-2-3/Symphony worksheet, version 2 22991# Symphony (.wr1) 22992!:ext wk1/wr1 22993# no example for this japan version 22994>>>4 uleshort 0x0600 1-2-3 WorKsheet, version 1.xJ 22995!:ext wj1 22996# no example or documentation for wk2 22997#>>>4 uleshort 0x???? 1-2-3 WorKsheet, version 2 22998#!:ext wk2 22999# undocumented japan version 23000>>>4 uleshort 0x0602 1-2-3 worksheet, version 2.4J 23001!:ext wj3 23002# (version 5.26) labeled the entry as "Lotus 1-2-3 fmt document data" 23003>>>4 uleshort 0x8006 1-2-3 ForMaTting data, version 2.x 23004# japan version 2.4J (fj3) 23005!:ext fmt/fj3 23006# no example for this version 23007>>>4 uleshort 0x8007 1-2-3 FoRMatting data, version 2.0 23008!:ext frm 23009# (version 5.26) labeled the entry as "Lotus 1-2-3" 23010>>>4 default x unknown worksheet or configuration 23011!:ext cnf 23012>>>>4 uleshort x \b, revision 0x%x 23013# 2nd record for most worksheets describes cells range 23014>>>6 use lotus-cells 23015# 3nd record for most japan worksheets describes cells range 23016>>>(8.s+10) use lotus-cells 23017# check and then display Lotus worksheet cells range 230180 name lotus-cells 23019# look for type (RANGE=0006h) + length (0008h) at record begin 23020>0 ubelong 0x06000800 \b, cell range 23021# cell range (start column, row, end column, row) start values normally 0,0~A1 cell 23022>>4 ulong !0 23023>>>4 uleshort x \b%d, 23024>>>6 uleshort x \b%d- 23025# end of cell range 23026>>8 uleshort x \b%d, 23027>>10 uleshort x \b%d 23028# EndOfLotus123 230290 string/b WordPro\0 Lotus WordPro 23030!:mime application/vnd.lotus-wordpro 230310 string/b WordPro\r\373 Lotus WordPro 23032!:mime application/vnd.lotus-wordpro 23033 23034 23035# Summary: Script used by InstallScield to uninstall applications 23036# Extension: .isu 23037# Submitted by: unknown 23038# Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry) 230390 string \x71\xa8\x00\x00\x01\x02 23040>12 string Stirling\ Technologies, InstallShield Uninstall Script 23041 23042# Winamp .avs 23043#0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player 230440 string/b Nullsoft\ AVS\ Preset\ Winamp plug in 23045 23046# Windows Metafile .WMF 230470 string/b \327\315\306\232 Windows metafile 23048!:mime image/wmf 23049!:ext wmf 230500 string/b \002\000\011\000 Windows metafile 23051!:mime image/wmf 23052!:ext wmf 230530 string/b \001\000\011\000 Windows metafile 23054!:mime image/wmf 23055!:ext wmf 23056 23057#tz3 files whatever that is (MS Works files) 230580 string/b \003\001\001\004\070\001\000\000 tz3 ms-works file 230590 string/b \003\002\001\004\070\001\000\000 tz3 ms-works file 230600 string/b \003\003\001\004\070\001\000\000 tz3 ms-works file 23061 23062# PGP sig files .sig 23063#0 string \211\000\077\003\005\000\063\237\127 065 to \027\266\151\064\005\045\101\233\021\002 PGP sig 230640 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig 230650 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig 230660 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig 230670 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig 230680 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig 230690 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig 23070 23071# windows zips files .dmf 230720 string/b MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file 23073 23074# Windows icons 23075# Update: Joerg Jenderek 23076# URL: https://en.wikipedia.org/wiki/CUR_(file_format) 23077# Note: similar to Windows CURsor. container for BMP (only DIB part) or PNG 230780 belong 0x00000100 23079>9 byte 0 23080>>0 byte x 23081>>0 use cur-ico-dir 23082>9 ubyte 0xff 23083>>0 byte x 23084>>0 use cur-ico-dir 23085# displays number of icons and information for icon or cursor 230860 name cur-ico-dir 23087# skip some Lotus 1-2-3 worksheets, CYCLE.PIC and keep Windows cursors with 23088# 1st data offset = dir header size + n * dir entry size = 6 + n * 10h = ?6h 23089>18 ulelong &0x00000006 23090# skip remaining worksheets, because valid only for DIB image (40) or PNG image (\x89PNG) 23091>>(18.l) ulelong x MS Windows 23092>>>0 ubelong 0x00000100 icon resource 23093# https://www.iana.org/assignments/media-types/image/vnd.microsoft.icon 23094!:mime image/vnd.microsoft.icon 23095#!:mime image/x-icon 23096!:ext ico 23097>>>>4 uleshort x - %d icon 23098# plural s 23099>>>>4 uleshort >1 \bs 23100# 1st icon 23101>>>>0x06 use ico-entry 23102# 2nd icon 23103>>>>4 uleshort >1 23104>>>>>0x16 use ico-entry 23105>>>0 ubelong 0x00000200 cursor resource 23106#!:mime image/x-cur 23107!:mime image/x-win-bitmap 23108!:ext cur 23109>>>>4 uleshort x - %d icon 23110>>>>4 uleshort >1 \bs 23111# 1st cursor 23112>>>>0x06 use cur-entry 23113#>>>>0x16 use cur-entry 23114# display information of one cursor entry 231150 name cur-entry 23116>0 use cur-ico-entry 23117>4 uleshort x \b, hotspot @%dx 23118>6 uleshort x \b%d 23119# display information of one icon entry 231200 name ico-entry 23121>0 use cur-ico-entry 23122# normally 0 1 but also found 14 23123>4 uleshort >1 \b, %d planes 23124# normally 0 1 but also found some 3, 4, some 6, 8, 24, many 32, two 256 23125>6 uleshort >1 \b, %d bits/pixel 23126# display shared information of cursor or icon entry 231270 name cur-ico-entry 23128>0 byte =0 \b, 256x 23129>0 byte !0 \b, %dx 23130>1 byte =0 \b256 23131>1 byte !0 \b%d 23132# number of colors in palette 23133>2 ubyte !0 \b, %d colors 23134# reserved 0 FFh 23135#>3 ubyte x \b, reserved %x 23136#>8 ulelong x \b, image size %d 23137# offset of PNG or DIB image 23138#>12 ulelong x \b, offset 0x%x 23139# PNG header (\x89PNG) 23140>(12.l) ubelong =0x89504e47 23141# 1 space char after "with" to get phrase "with PNG image" by magic in ./images 23142>>&-4 indirect x \b with 23143# DIB image 23144>(12.l) ubelong !0x89504e47 23145#>>&-4 use dib-image 23146 23147# Windows non-animated cursors 23148# Update: Joerg Jenderek 23149# URL: https://en.wikipedia.org/wiki/CUR_(file_format) 23150# Note: similar to Windows ICOn. container for BMP ( only DIB part) 23151# GRR: line below is too general as it catches also Lotus 1-2-3 files 231520 belong 0x00000200 23153>9 byte 0 23154>>0 use cur-ico-dir 23155>9 ubyte 0xff 23156>>0 use cur-ico-dir 23157 23158# .chr files 231590 string/b PK\010\010BGI Borland font 23160>4 string >\0 %s 23161# then there is a copyright notice 23162 23163 23164# .bgi files 231650 string/b pk\010\010BGI Borland device 23166>4 string >\0 %s 23167# then there is a copyright notice 23168 23169 23170# Windows Recycle Bin record file (named INFO2) 23171# By Abel Cheung (abelcheung AT gmail dot com) 23172# Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes 23173# Since Vista uses another structure, INFO2 structure probably won't change 23174# anymore. Detailed analysis in: 23175# http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf 231760 lelong 0x00000004 23177>12 lelong 0x00000118 Windows Recycle Bin INFO2 file (Win98 or below) 23178 231790 lelong 0x00000005 23180>12 lelong 0x00000320 Windows Recycle Bin INFO2 file (Win2k - WinXP) 23181 23182# From Doug Lee via a FreeBSD pr 231839 string GERBILDOC First Choice document 231849 string GERBILDB First Choice database 231859 string GERBILCLIP First Choice database 231860 string GERBIL First Choice device file 231879 string RABBITGRAPH RabbitGraph file 231880 string DCU1 Borland Delphi .DCU file 231890 string =!<spell> MKS Spell hash list (old format) 231900 string =!<spell2> MKS Spell hash list 23191# Too simple - MPi 23192#0 string AH Halo(TM) bitmapped font file 231930 lelong 0x08086b70 TurboC BGI file 231940 lelong 0x08084b50 TurboC Font file 23195 23196# Debian#712046: The magic below identifies "Delphi compiled form data". 23197# An additional source of information is available at: 23198# http://www.woodmann.com/fravia/dafix_t1.htm 231990 string TPF0 23200>4 pstring >\0 Delphi compiled form '%s' 23201 23202# tests for DBase files moved, updated and merged to database 23203 232040 string PMCC Windows 3.x .GRP file 232051 string RDC-meg MegaDots 23206>8 byte >0x2F version %c 23207>9 byte >0x2F \b.%c file 232080 lelong 0x4C 23209>4 lelong 0x00021401 Windows shortcut file 23210 23211# .PIF files added by Joerg Jenderek from https://smsoft.ru/en/pifdoc.htm 23212# only for windows versions equal or greater 3.0 232130x171 string MICROSOFT\ PIFEX\0 Windows Program Information File 23214!:mime application/x-dosexec 23215!:ext pif 23216#>2 string >\0 \b, Title:%.30s 23217>0x24 string >\0 \b for %.63s 23218>0x65 string >\0 \b, directory=%.64s 23219>0xA5 string >\0 \b, parameters=%.64s 23220#>0x181 leshort x \b, offset %x 23221#>0x183 leshort x \b, offsetdata %x 23222#>0x185 leshort x \b, section length %x 23223>0x187 search/0xB55 WINDOWS\ VMM\ 4.0\0 23224>>&0x5e ubyte >0 23225>>>&-1 string <PIFMGR.DLL \b, icon=%s 23226#>>>&-1 string PIFMGR.DLL \b, icon=%s 23227>>>&-1 string >PIFMGR.DLL \b, icon=%s 23228>>&0xF0 ubyte >0 23229>>>&-1 string <Terminal \b, font=%.32s 23230#>>>&-1 string =Terminal \b, font=%.32s 23231>>>&-1 string >Terminal \b, font=%.32s 23232>>&0x110 ubyte >0 23233>>>&-1 string <Lucida\ Console \b, TrueTypeFont=%.32s 23234#>>>&-1 string =Lucida\ Console \b, TrueTypeFont=%.32s 23235>>>&-1 string >Lucida\ Console \b, TrueTypeFont=%.32s 23236#>0x187 search/0xB55 WINDOWS\ 286\ 3.0\0 \b, Windows 3.X standard mode-style 23237#>0x187 search/0xB55 WINDOWS\ 386\ 3.0\0 \b, Windows 3.X enhanced mode-style 23238>0x187 search/0xB55 WINDOWS\ NT\ \ 3.1\0 \b, Windows NT-style 23239#>0x187 search/0xB55 WINDOWS\ NT\ \ 4.0\0 \b, Windows NT-style 23240>0x187 search/0xB55 CONFIG\ \ SYS\ 4.0\0 \b +CONFIG.SYS 23241#>>&06 string x \b:%s 23242>0x187 search/0xB55 AUTOEXECBAT\ 4.0\0 \b +AUTOEXEC.BAT 23243#>>&06 string x \b:%s 23244 23245# DOS EPS Binary File Header 23246# From: Ed Sznyter <ews@Black.Market.NET> 232470 belong 0xC5D0D3C6 DOS EPS Binary File 23248!:mime image/x-eps 23249>4 long >0 Postscript starts at byte %d 23250>>8 long >0 length %d 23251>>>12 long >0 Metafile starts at byte %d 23252>>>>16 long >0 length %d 23253>>>20 long >0 TIFF starts at byte %d 23254>>>>24 long >0 length %d 23255 23256# TNEF magic From "Joomy" <joomy@se-ed.net> 23257# Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF) 232580 lelong 0x223e9f78 TNEF 23259!:mime application/vnd.ms-tnef 23260 23261# Norton Guide (.NG , .HLP) files added by Joerg Jenderek from source NG2HTML.C 23262# of http://www.davep.org/norton-guides/ng2h-105.tgz 23263# https://en.wikipedia.org/wiki/Norton_Guides 232640 string NG\0\001 23265# only value 0x100 found at offset 2 23266>2 ulelong 0x00000100 Norton Guide 23267# Title[40] 23268>>8 string >\0 "%-.40s" 23269#>>6 uleshort x \b, MenuCount=%u 23270# szCredits[5][66] 23271>>48 string >\0 \b, %-.66s 23272>>114 string >\0 %-.66s 23273 23274# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS 23275# of https://www.4dos.info/ 23276# pointer,HelpID[8]=4DHnnnmm 232770 ulelong 0x48443408 4DOS help file 23278>4 string x \b, version %-4.4s 23279 23280# old binary Microsoft (.HLP) files added by Joerg Jenderek from http://file-extension.net/seeker/file_extension_hlp 232810 ulequad 0x3a000000024e4c MS Advisor help file 23282 23283# HtmlHelp files (.chm) 232840 string/b ITSF\003\000\000\000\x60\000\000\000 MS Windows HtmlHelp Data 23285 23286# GFA-BASIC (Wolfram Kleff) 232872 string/b GFA-BASIC3 GFA-BASIC 3 data 23288 23289#------------------------------------------------------------------------------ 23290# From Stuart Caie <kyzer@4u.net> (developer of cabextract) 23291# Update: Joerg Jenderek 23292# URL: https://en.wikipedia.org/wiki/Cabinet_(file_format) 23293# Reference: https://msdn.microsoft.com/en-us/library/bb267310.aspx 23294# Note: verified by `7z l *.cab` 23295# Microsoft Cabinet files 232960 string/b MSCF\0\0\0\0 Microsoft Cabinet archive data 23297# 23298# https://support.microsoft.com/en-us/help/973559/frequently-asked-questions-about-the-microsoft-support-diagnostic-tool 23299# CAB with *.{diagcfg,diagpkg} is used by Microsoft Support Diagnostic Tool MSDT.EXE 23300# because some archive does not have *.diag* as 1st or 2nd archive member like 23301# O15CTRRemove.diagcab or AzureStorageAnalyticsLogs_global.DiagCab 23302# brute looking after header for filenames with diagcfg or diagpkg extension in CFFILE section 23303>0x2c search/980/c .diag \b, Diagnostic 23304!:mime application/vnd.ms-cab-compressed 23305!:ext diagcab 23306# http://fileformats.archiveteam.org/wiki/PUZ 23307# Microsoft Publisher version about 2003 has a "Pack and Go" feature that 23308# bundles a Publisher document *PNG.pub with all links into a CAB 23309>0x2c search/300/c png.pub\0 \b, Publisher Packed and Go 23310!:mime application/vnd.ms-cab-compressed 23311!:ext puz 23312# ppz variant with Microsoft PowerPoint Viewer ppview32.exe to play PowerPoint presentation 23313>0x2c search/17/c ppview32.exe\0 \b, PowerPoint Viewer Packed and Go 23314!:mime application/vnd.ms-powerpoint 23315#!:mime application/mspowerpoint 23316!:ext ppz 23317# URL: https://en.wikipedia.org/wiki/Windows_Desktop_Gadgets 23318# Reference: https://docs.microsoft.com/en-us/previous-versions/windows/desktop/sidebar/ 23319# http://win10gadgets.com/download/273/ All_CPU_Meter1.zip/All_CPU_Meter_V4.7.3.gadget 23320>0x2c search/968/c gadget.xml \b, Windows Desktop Gadget 23321#!:mime application/vnd.ms-cab-compressed 23322# http://extension.nirsoft.net/gadget 23323!:mime application/x-windows-gadget 23324!:ext gadget 23325# http://www.incredimail.com/ 23326# IncrediMail CAB contains an initialisation file "content.ini" like in im2.ims 23327>0x2c search/3369/c content.ini\0 \b, IncrediMail 23328!:mime application/x-incredimail 23329# member Flavor.htm implies IncrediMail ecard like in tell_a_friend.imf 23330>>0x2c search/83/c Flavor.htm\0 ecard 23331!:ext imf 23332# member Macromedia Flash data *.swf implies IncrediMail skin like in im2.ims 23333>>0x2c search/211/c .swf\0 skin 23334!:ext ims 23335# member anim.im3 implies IncrediMail animation like in letter_fold.ima 23336>>0x2c search/92/c anim.im3\0 animation 23337!:ext ima 23338# other IncrediMail cab archive 23339>>0x2c default x 23340>>>0x2c search/116/c thumb ecard, image, notifier or skin 23341!:ext imf/imi/imn/ims 23342# http://file-extension.net/seeker/file_extension_ime 23343>>>0x2c default x emoticons or sound 23344!:ext ime/imw 23345# no Diagnostic, Packed and Go, Windows Desktop Gadget, IncrediMail 23346>0x2c default x 23347# look for 1st member name 23348>>(16.l+16) ubyte x 23349# https://en.wikipedia.org/wiki/SNP_file_format 23350>>>&-1 string/c _accrpt_.snp \b, Access report snapshot 23351!:mime application/msaccess 23352!:ext snp 23353# https://en.wikipedia.org/wiki/Microsoft_InfoPath 23354>>>&-1 string manifest.xsf \b, InfoPath Form Template 23355!:mime application/vnd.ms-cab-compressed 23356#!:mime application/vnd.ms-infopath 23357!:ext xsn 23358# https://www.cabextract.org.uk/wince_cab_format/ 23359# extension of DOS 8+3 name with ".000" of 1st archive member name implies Windows CE installer 23360>>>&7 string =.000 \b, WinCE install 23361!:mime application/vnd.ms-cab-compressed 23362!:ext cab 23363 23364# https://support.microsoft.com/kb/934307/en-US 23365# All inspected MSU contain a file with name WSUSSCAN.cab 23366# that is called "Windows Update meta data" by Microsoft 23367>>>&-1 string/c wsusscan.cab \b, Microsoft Standalone Update 23368!:mime application/vnd.ms-cab-compressed 23369!:ext msu 23370>>>&-1 default x 23371# look at point charcter of 1st archive member name for file name extension 23372>>>>&-1 search/255 . 23373# http://www.pptfaq.com/FAQ00164_What_is_a_PPZ_file-.htm 23374# PPZ were created using Pack & Go feature of PowerPoint versions 97 - 2002 23375# packs optional files, a PowerPoint presentation *.ppt with optional PLAYLIST.LST to CAB 23376>>>>>&0 string/c ppt\0 \b, PowerPoint Packed and Go 23377!:mime application/vnd.ms-powerpoint 23378#!:mime application/mspowerpoint 23379!:ext ppz 23380# https://msdn.microsoft.com/en-us/library/windows/desktop/bb773190(v=vs.85).aspx 23381# first member *.theme implies Windows 7 Theme Pack like in CommunityShowcaseAqua3.themepack 23382# or Windows 8 Desktop Theme Pack like in PanoramicGlaciers.deskthemepack 23383>>>>>&0 string/c theme \b, Windows 23384!:mime application/x-windows-themepack 23385# https://www.drewkeller.com/content/using-theme-both-windows-7-and-windows-8 23386# 1st member Panoramic.theme or Panoramas.theme implies Windows 8-10 Theme Pack 23387# with MTSM=RJSPBS in [MasterThemeSelector] inside *.theme 23388>>>>>>(16.l+16) string =Panoram 8 23389!:ext deskthemepack 23390>>>>>>(16.l+16) string !Panoram 7 or 8 23391!:ext themepack/deskthemepack 23392>>>>>>(16.l+16) ubyte x Theme Pack 23393>>>>>&0 default x 23394# look for null terminator of 1st member name 23395>>>>>>&0 search/255 \0 23396# 2nd member name WSUSSCAN.cab like in Microsoft-Windows-MediaFeaturePack-OOB-Package.msu 23397>>>>>>>&16 string/c wsusscan.cab \b, Microsoft Standalone Update 23398!:mime application/vnd.ms-cab-compressed 23399!:ext msu 23400>>>>>>>&16 default x 23401# archive with more then one file need some output in version 5.32 to avoid error message like 23402# Magdir/msdos, 1138: Warning: Current entry does not yet have a description for adding a MIME type 23403# Magdir/msdos, 1139: Warning: Current entry does not yet have a description for adding a EXTENSION type 23404# file: could not find any valid magic files! 23405>>>>>>>>28 uleshort >1 \b, many 23406!:mime application/vnd.ms-cab-compressed 23407!:ext cab 23408# remaining archives with just one file 23409>>>>>>>>28 uleshort =1 23410# neither extra bytes nor cab chain implies Windows 2000,XP setup files in directory i386 23411>>>>>>>>>30 uleshort =0x0000 \b, Windows 2000/XP setup 23412# cut of last char of source extension and add underscore to generate extension 23413# TERMCAP._ ... FXSCOUNT.H_ ... L3CODECA.AC_ ... NPDRMV2.ZI_ 23414!:mime application/vnd.ms-cab-compressed 23415!:ext _/?_/??_ 23416# archive need some output like "single" in version 5.32 to avoid error messages 23417>>>>>>>>>30 uleshort !0x0000 \b, single 23418!:mime application/vnd.ms-cab-compressed 23419!:ext cab 23420# TODO: additional extensions like 23421# .xtp InfoPath Template Part 23422# .lvf Logitech Video Effects Face Accessory 23423>8 ulelong x \b, %u bytes 23424>28 uleshort 1 \b, 1 file 23425>28 uleshort >1 \b, %u files 23426# Reserved fields, set to zero 23427#>4 belong !0 \b, reserved1 %x 23428#>12 belong !0 \b, reserved2 %x 23429# offset of the first CFFILE entry coffFiles: minimal 2Ch 23430>16 ulelong x \b, at 0x%x 23431>(16.l) use cab-file 23432# at least also 2nd member 23433>28 uleshort >1 23434>>(16.l+16) ubyte x 23435>>>&0 search/255 \0 23436# second member info 23437>>>>&0 use cab-file 23438#>20 belong !0 \b, reserved %x 23439# Cabinet file format version. Currently, versionMajor = 1 and versionMinor = 3 23440>24 ubeshort !0x0301 \b version 0x%x 23441# number of CFFOLDER entries 23442>26 uleshort >1 \b, %u cffolders 23443# cabinet file option indicators 1~PREVIOUS, 2~NEXT, 4~reserved fields 23444# only found for flags 0 1 2 3 4 not 7 23445>30 uleshort >0 \b, flags 0x%x 23446# Cabinet files have a 16-bit cabinet setID field that is designed for application use. 23447# default is zero, however, the -i option of cabarc can be used to set this field 23448>32 uleshort >0 \b, ID %u 23449# iCabinet is number of this cabinet file in a set, where 0 for the first cabinet 23450#>34 uleshort x \b, iCabinet %u 23451# add one for display because humans start numbering by 1 and also fit to name of disk szDisk* 23452>34 uleshort+1 x \b, number %u 23453>30 uleshort &0x0004 \b, extra bytes 23454# cbCFHeader optional size of per-cabinet reserved area 14h 1800h 23455>>36 uleshort >0 %u in head 23456# cbCFFolder is optional size of per-folder reserved area 23457>>38 ubyte >0 %u in folder 23458# cbCFData is optional size of per-datablock reserved area 23459>>39 ubyte >0 %u in data block 23460# optional per-cabinet reserved area abReserve[cbCFHeader] 23461>>36 uleshort >0 23462# 1st CFFOLDER after reserved area in header 23463>>>(36.s+40) use cab-folder 23464# no reserved area in header 23465>30 uleshort ^0x0004 23466# no previous and next cab archive 23467>>30 uleshort =0x0000 23468>>>36 use cab-folder 23469# only previous cab archive 23470>>30 uleshort =0x0001 \b, previous 23471>>>36 use cab-anchor 23472# only next cab archive 23473>>30 uleshort =0x0002 \b, next 23474>>>36 use cab-anchor 23475# previous+next cab archive 23476# can not use sub routine cab-anchor to display previous and next cabinet together 23477#>>>36 use cab-anchor 23478#>>>>&0 use cab-anchor 23479>>30 uleshort =0x0003 \b, previous 23480>>>36 string x %s 23481# optional name of previous disk szDisk* 23482>>>>&1 string x disk %s 23483>>>>>&1 string x \b, next %s 23484# optional name of previous disk szDisk* 23485>>>>>>&1 string x disk %s 23486>>>>>>>&1 use cab-folder 23487# display filename and disk name of previous or next cabinet 234880 name cab-anchor 23489# optional name of previous/next cabinet file szCabinet*[255] 23490>&0 string x %s 23491# optional name of previous/next disk szDisk*[255] 23492>>&1 string x disk %s 23493# display folder structure CFFOLDER information like compression of cabinet 234940 name cab-folder 23495# offset of the CFDATA block in this folder 23496#>0 ulelong x \b, coffCabStart 0x%x 23497# number of CFDATA blocks in folder 23498>4 uleshort x \b, %u datablock 23499# plural s 23500>4 uleshort >1 \bs 23501# compression typeCompress: 0~None 1~MSZIP 0x1503~LZX:21 0x1003~LZX:16 0x0f03~LZX:15 23502>6 uleshort x \b, 0x%x compression 23503# optional per-folder reserved area 23504#>8 ubequad x \b, abReserve 0x%llx 23505# display member structure CFFILE information like member name of cabinet 235060 name cab-file 23507# cbFile is uncompressed size of file in bytes 23508#>0 ulelong x \b, cbFile %u 23509# uoffFolderStart is uncompressed offset of file in folder 23510#>4 ulelong >0 \b, uoffFolderStart 0x%x 23511# iFolder is index into the CFFOLDER area. 0 indicates first folder in cabinet 23512# define ifoldCONTINUED_FROM_PREV (0xFFFD) 23513# define ifoldCONTINUED_TO_NEXT (0xFFFE) 23514# define ifoldCONTINUED_PREV_AND_NEXT (0xFFFF) 23515>8 uleshort >0 \b, iFolder 0x%x 23516# date stamp for file 23517#>10 uleshort x \b, date 0x%x 23518# time stamp for file 23519#>12 uleshort x \b, time 0x%x 23520# attribs is attribute flags for file 23521# define _A_RDONLY (0x01) file is read-only 23522# define _A_HIDDEN (0x02) file is hidden 23523# define _A_SYSTEM (0x04) file is a system file 23524# define _A_ARCH (0x20) file modified since last backup 23525# example http://sebastien.kirche.free.fr/pebuilder_plugins/depends.cab 23526# define _A_EXEC (0x40) run after extraction 23527# define _A_NAME_IS_UTF (0x80) szName[] contains UTF 23528# define UNKNOWN (0x0100) undocumented or accident 23529#>14 uleshort x \b, attribs 0x%x 23530>14 uleshort >0 + 23531>>14 uleshort &0x0001 \bR 23532>>14 uleshort &0x0002 \bH 23533>>14 uleshort &0x0004 \bS 23534>>14 uleshort &0x0020 \bA 23535>>14 uleshort &0x0040 \bX 23536>>14 uleshort &0x0080 \bUtf 23537# unknown 0x0100 flag found on one XP_CD:\I386\DRIVER.CAB 23538>>14 uleshort &0x0100 \b? 23539# szName is name of archive member 23540>16 string x "%s" 23541# next archive member name if more files 23542#>>&17 string >\0 \b, NEXT NAME %-.50s 23543 23544# InstallShield Cabinet files 235450 string/b ISc( InstallShield Cabinet archive data 23546>5 byte&0xf0 =0x60 version 6, 23547>5 byte&0xf0 !0x60 version 4/5, 23548>(12.l+40) lelong x %u files 23549 23550# Windows CE package files 235510 string/b MSCE\0\0\0\0 Microsoft WinCE install header 23552>20 lelong 0 \b, architecture-independent 23553>20 lelong 103 \b, Hitachi SH3 23554>20 lelong 104 \b, Hitachi SH4 23555>20 lelong 0xA11 \b, StrongARM 23556>20 lelong 4000 \b, MIPS R4000 23557>20 lelong 10003 \b, Hitachi SH3 23558>20 lelong 10004 \b, Hitachi SH3E 23559>20 lelong 10005 \b, Hitachi SH4 23560>20 lelong 70001 \b, ARM 7TDMI 23561>52 leshort 1 \b, 1 file 23562>52 leshort >1 \b, %u files 23563>56 leshort 1 \b, 1 registry entry 23564>56 leshort >1 \b, %u registry entries 23565 23566 23567# Windows Enhanced Metafile (EMF) 23568# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp 23569# for further information. 235700 ulelong 1 23571>40 string \ EMF Windows Enhanced Metafile (EMF) image data 23572>>44 ulelong x version 0x%x 23573 23574 235750 string/b \224\246\056 Microsoft Word Document 23576!:mime application/msword 23577 23578# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 23579# Magic type for Dell's BIOS .hdr files 23580# Dell's .hdr 235810 string/b $RBU 23582>23 string Dell %s system BIOS 23583>5 byte 2 23584>>48 byte x version %d. 23585>>49 byte x \b%d. 23586>>50 byte x \b%d 23587>5 byte <2 23588>>48 string x version %.3s 23589 23590# Type: Microsoft Document Imaging Format (.mdi) 23591# URL: https://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format 23592# From: Daniele Sempione <scrows@oziosi.org> 23593# Too weak (EP) 23594#0 short 0x5045 Microsoft Document Imaging Format 23595 23596# MS eBook format (.lit) 235970 string/b ITOLITLS Microsoft Reader eBook Data 23598>8 lelong x \b, version %u 23599!:mime application/x-ms-reader 23600 23601# Windows CE Binary Image Data Format 23602# From: Dr. Jesus <j@hug.gs> 236030 string/b B000FF\n Windows Embedded CE binary image 23604 23605# The second byte of these signatures is a file version; I don't know what, 23606# if anything, produced files with version numbers 0-2. 23607# From: John Elliott <johne@seasip.demon.co.uk> 236080 string \xfc\x03\x00 Mallard BASIC program data (v1.11) 236090 string \xfc\x04\x00 Mallard BASIC program data (v1.29+) 236100 string \xfc\x03\x01 Mallard BASIC protected program data (v1.11) 236110 string \xfc\x04\x01 Mallard BASIC protected program data (v1.29+) 23612 236130 string MIOPEN Mallard BASIC Jetsam data 236140 string Jetsam0 Mallard BASIC Jetsam index data 23615 23616# DOS backup 2.0 to 3.2 23617 23618# backupid.@@@ 23619 23620# plausibility check for date 236210x3 ushort >1979 23622>0x5 ubyte-1 <31 23623>>0x6 ubyte-1 <12 23624# actually 121 nul bytes 23625>>>0x7 string \0\0\0\0\0\0\0\0 23626>>>>0x1 ubyte x DOS 2.0 backup id file, sequence %d 23627!:ext @@@ 23628>>>>0x0 ubyte 0xff \b, last disk 23629 23630# backed up file 23631 23632# skip some AppleWorks word like Tomahawk.Awp, WIN98SE-DE.vhd 23633# by looking for trailing nul of maximal file name string 236340x52 ubyte 0 23635# test for flag byte: FFh~complete file, 00h~split file 23636# FFh -127 = -1 -127 = -128 23637# 00h -127 = 0 -127 = -127 23638>0 byte-127 <-126 23639# plausibility check for file name length 23640>>0x53 ubyte-1 <78 23641# looking for terminating nul of file name string 23642>>>(0x53.b+4) ubyte 0 23643# looking if last char of string is valid DOS file name 23644>>>>(0x53.b+3) ubyte >0x1F 23645# actually 44 nul bytes 23646# but sometimes garbage according to Ralf Quint. So can not be used as test 23647#>0x54 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 23648# first char of full file name is DOS (5Ch) or UNIX (2Fh) path separator 23649# only DOS variant found. UNIX variant according to V32SLASH.TXT in archive PD0315.EXE 23650>>>>>5 ubyte&0x8C 0x0C 23651# ./msdos (version 5.30) labeled the entry as 23652# "DOS 2.0 backed up file %s, split file, sequence %d" or 23653# "DOS 2.0 backed up file %s, complete file" 23654>>>>>>0 ubyte x DOS 2.0-3.2 backed up 23655#>>>>>>0 ubyte 0xff complete 23656>>>>>>0 ubyte 0 23657>>>>>>>1 uleshort x sequence %d of 23658# full file name with path but without drive letter and colon stored from 0x05 til 0x52 23659>>>>>>0x5 string x file %s 23660# backup name is original filename 23661#!:ext * 23662# magic/Magdir/msdos, 1169: Warning: EXTENSION type ` *' has bad char '*' 23663# file: line 1169: Bad magic entry ' *' 23664# after header original file content 23665>>>>>>128 indirect x \b; 23666 23667 23668# DOS backup 3.3 to 5.x 23669 23670# CONTROL.nnn files 236710 string \x8bBACKUP\x20 23672# actually 128 nul bytes 23673>0xa string \0\0\0\0\0\0\0\0 23674>>0x9 ubyte x DOS 3.3 backup control file, sequence %d 23675>>0x8a ubyte 0xff \b, last disk 23676 23677# NB: The BACKUP.nnn files consist of the files backed up, 23678# concatenated. 23679 23680#------------------------------------------------------------------------------ 23681# $File: msooxml,v 1.13 2019/11/27 13:12:55 christos Exp $ 23682# msooxml: file(1) magic for Microsoft Office XML 23683# From: Ralf Brown <ralf.brown@gmail.com> 23684 23685# .docx, .pptx, and .xlsx are XML plus other files inside a ZIP 23686# archive. The first member file is normally "[Content_Types].xml". 23687# but some libreoffice generated files put this later. Perhaps skip 23688# the "[Content_Types].xml" test? 23689# Since MSOOXML doesn't have anything like the uncompressed "mimetype" 23690# file of ePub or OpenDocument, we'll have to scan for a filename 23691# which can distinguish between the three types 23692 236930 name msooxml 23694>0 string word/ Microsoft Word 2007+ 23695!:mime application/vnd.openxmlformats-officedocument.wordprocessingml.document 23696>0 string ppt/ Microsoft PowerPoint 2007+ 23697!:mime application/vnd.openxmlformats-officedocument.presentationml.presentation 23698>0 string xl/ Microsoft Excel 2007+ 23699!:mime application/vnd.openxmlformats-officedocument.spreadsheetml.sheet 237000 string visio/ Microsoft Visio 2013+ 23701!:mime application/vnd.ms-visio.drawing.main+xml 23702 23703# start by checking for ZIP local file header signature 237040 string PK\003\004 23705!:strength +10 23706# make sure the first file is correct 23707>0x1E use msooxml 23708>0x1E regex \\[Content_Types\\]\\.xml|_rels/\\.rels|docProps 23709# skip to the second local file header 23710# since some documents include a 520-byte extra field following the file 23711# header, we need to scan for the next header 23712>>(18.l+49) search/6000 PK\003\004 23713# now skip to the *third* local file header; again, we need to scan due to a 23714# 520-byte extra field following the file header 23715>>>&26 search/6000 PK\003\004 23716# and check the subdirectory name to determine which type of OOXML 23717# file we have. Correct the mimetype with the registered ones: 23718# https://technet.microsoft.com/en-us/library/cc179224.aspx 23719>>>>&26 use msooxml 23720>>>>&26 default x 23721# OpenOffice/Libreoffice orders ZIP entry differently, so check the 4th file 23722>>>>>&26 search/6000 PK\003\004 23723>>>>>>&26 use msooxml 23724>>>>>>&26 default x Microsoft OOXML 23725>>>>>&26 default x Microsoft OOXML 23726 23727#------------------------------------------------------------------------------ 23728# $File: msvc,v 1.10 2018/10/01 19:14:03 christos Exp $ 23729# msvc: file(1) magic for msvc 23730# "H. Nanosecond" <aldomel@ix.netcom.com> 23731# Microsoft visual C 23732# 23733# I have version 1.0 23734 23735# .aps 237360 string HWB\000\377\001\000\000\000 Microsoft Visual C .APS file 23737 23738# .ide 23739#too long 0 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157\152\145\143\164\040\106\151\154\145\012\000\032\000\002\000\262\000\272\276\372\316 MSVC .ide 237400 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157 MSVC .ide 23741 23742# .res 237430 string \000\000\000\000\040\000\000\000\377 MSVC .res 237440 string \377\003\000\377\001\000\020\020\350 MSVC .res 237450 string \377\003\000\377\001\000\060\020\350 MSVC .res 23746 23747#.lib 237480 string \360\015\000\000 Microsoft Visual C library 237490 string \360\075\000\000 Microsoft Visual C library 237500 string \360\175\000\000 Microsoft Visual C library 23751 23752#.pch 237530 string DTJPCH0\000\022\103\006\200 Microsoft Visual C .pch 23754 23755# Summary: Symbol Table / Debug info used by Microsoft compilers 23756# URL: https://en.wikipedia.org/wiki/Program_database 23757# Reference: https://code.google.com/p/pdbparser/wiki/MSF_Format 23758# Update: Joerg Jenderek 23759# Note: test only for Windows XP+SP3 x86 , 8.1 x64 arm and 10.1 x86 23760# info does only applies partly for older files like msvbvm50.pdb about year 2001 237610 string Microsoft\ C/C++\040 23762# "Microsoft Program DataBase" by TrID 23763>24 search/14 \r\n\x1A MSVC program database 23764!:mime application/x-ms-pdb 23765!:ext pdb 23766# "MSF 7.00" "program database 2.00" for msvbvm50.pdb 23767>>16 regex \([0-9.]+\) ver %s 23768#>>>0x38 search/128123456 /LinkInfo \b with linkinfo 23769# "MSF 7.00" variant 23770>>0x1e leshort 0 23771# PageSize 400h 1000h 23772>>>0x20 lelong x \b, %d 23773# Page Count 23774>>>0x28 lelong x \b*%d bytes 23775# "program database 2.00" variant 23776>>0x1e leshort !0 23777# PageSize 400h 23778>>>0x2c lelong x \b, %d 23779# Page Count for msoo-dll.pdb 4379h 23780>>>0x32 leshort x \b*%d bytes 23781 23782# Reference: https://github.com/Microsoft/vstest/pull/856/commits/fdc7a9f074ca5a8dfeec83b1be9162bf0cf4000d 237830 string/c bsjb\001\000\001\000\000\000\000\000\f\000\000\000pdb\ v1.0 Microsoft Roslyn C# debugging symbols version 1.0 23784 23785#.sbr 237860 string \000\002\000\007\000 MSVC .sbr 23787>5 string >\0 %s 23788 23789#.bsc 237900 string \002\000\002\001 MSVC .bsc 23791 23792#.wsp 237930 string 1.00\ .0000.0000\000\003 MSVC .wsp version 1.0000.0000 23794# these seem to start with the version and contain menus 23795 23796#------------------------------------------------------------------------------ 23797# msx: file(1) magic for the MSX Home Computer 23798# v1.3 23799# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net> 23800 23801############## MSX Music file formats ############## 23802 23803# Gigamix MGSDRV music file 238040 string/b MGS MSX Gigamix MGSDRV3 music file, 23805>6 ubeshort 0x0D0A 23806>>3 byte x \bv%c 23807>>4 byte x \b.%c 23808>>5 byte x \b%c 23809>>8 string >\0 \b, title: %s 23810 238111 string/b mgs2\ MSX Gigamix MGSDRV2 music file 23812>6 uleshort 0x80 23813>>0x2E uleshort 0 23814>>>0x30 string >\0 \b, title: %s 23815 23816# KSS music file 238170 string/b KSCC KSS music file v1.03 23818>0xE byte 0 23819>>0xF byte&0x02 0 \b, soundchips: AY-3-8910, SCC(+) 23820>>0xF byte&0x02 2 \b, soundchip(s): SN76489 23821>>>0xF byte&0x04 4 stereo 23822>>0xF byte&0x01 1 \b, YM2413 23823>>0xF byte&0x08 8 \b, Y8950 23824 238250 string/b KSSX KSS music file v1.20 23826>0xE byte&0xEF 0 23827>>0xF byte&0x40 0x00 \b, 60Hz 23828>>0xF byte&0x40 0x40 \b, 50Hz 23829>>0xF byte&0x02 0 \b, soundchips: AY-3-8910, SCC(+) 23830>>0xF byte&0x02 0x02 \b, soundchips: SN76489 23831>>>0xF byte&0x04 0x04 stereo 23832>>0xF byte&0x01 0x01 \b, 23833>>>0xF byte&0x18 0x00 \bYM2413 23834>>>0xF byte&0x18 0x08 \bYM2413, Y8950 23835>>>0xF byte&0x18 0x18 \bYM2413+Y8950 pseudostereo 23836>>0xF byte&0x18 0x10 \b, Majyutsushi DAC 23837 23838# Moonblaster for Moonsound 238390 string/b MBMS 23840>4 byte 0x10 MSX Moonblaster for MoonSound music 23841 23842# Music Player K-kaz 238430 string/b MPK MSX Music Player K-kaz song 23844>6 ubeshort 0x0D0A 23845>>3 byte x v%c 23846>>4 byte x \b.%c 23847>>5 byte x \b%c 23848 23849# I don't know why these don't work 23850#0 search/0xFFFF \r\n.FM9 23851#>0 search/0xFFFF \r\n#FORMAT MSX Music Player K-kaz source MML file 23852#0 search/0xFFFF \r\nFM1\ \= 23853#>0 search/0xFFFF \r\nPSG1\= 23854#>>0 search/0xFFFF \r\nSCC1\= MSX MuSiCa MML source file 23855 23856# OPX Music file 238570x35 beshort 0x0d0a 23858>0x7B beshort 0x0d0a 23859>>0x7D byte 0x1a 23860>>>0x87 uleshort 0 MSX OPX Music file 23861>>>>0x86 byte 0 v1.5 23862>>>>>0 string >\32 \b, title: %s 23863>>>>0x86 byte 1 v2.4 23864>>>>>0 string >\32 \b, title: %s 23865 23866# SCMD music file 238670x8B string/b SCMD 23868>0xCE uleshort 0 MSX SCMD Music file 23869#>>-2 uleshort 0x6a71 ; The file must end with this value. How to code this here? 23870>>0x8F string >\0 \b, title: %s 23871 238720 search/0xFFFF \r\n@title 23873>&0 search/0xFFFF \r\n@m=[ MSX SCMD source MML file 23874 23875 23876############## MSX image file formats ############## 23877 23878# MSX raw VRAM dump 238790 ubyte 0xFE 23880>1 uleshort 0 23881>>5 uleshort 0 23882>>>3 uleshort 0x37FF MSX SC2/GRP raw image 23883>>>3 uleshort 0x6A00 MSX Graph Saurus SR5 raw image 23884>>>3 uleshort >0x769E 23885>>>>3 uleshort <0x8000 MSX GE5/GE6 raw image 23886>>>>>3 uleshort 0x7FFF \b, with sprite patterns 23887>>>3 uleshort 0xD3FF MSX screen 7-12 raw image 23888>>>3 uleshort 0xD400 MSX Graph Saurus SR7/SR8/SRS raw image 23889 23890# Graph Saurus compressed images 238910 ubyte 0xFD 23892>1 uleshort 0 23893>>5 uleshort 0 23894>>>3 uleshort >0x013D MSX Graph Saurus compressed image 23895 23896# MSX G9B image file 238970 string/b G9B 23898>1 uleshort 11 23899>>3 uleshort >10 23900>>>5 ubyte >0 MSX G9B image, depth=%d 23901>>>>8 uleshort x \b, %dx 23902>>>>10 uleshort x \b%d 23903>>>>5 ubyte <9 23904>>>>>6 ubyte 0 23905>>>>>>7 ubyte x \b, codec=%d RGB color palettes 23906>>>>>6 ubyte 64 \b, codec=RGB fixed color 23907>>>>>6 ubyte 128 \b, codec=YJK 23908>>>>>6 ubyte 192 \b, codec=YUV 23909>>>>5 ubyte >8 codec=RGB fixed color 23910>>>>12 ubyte 0 \b, raw 23911>>>>12 ubyte 1 \b, bitbuster compression 23912 23913############## Other MSX file formats ############## 23914 23915# MSX internal ROMs 239160 ubeshort 0xF3C3 23917>2 uleshort <0x4000 23918>>8 ubyte 0xC3 23919>>>9 uleshort <0x4000 23920>>>>0x0B ubeshort 0x00C3 23921>>>>>0x0D uleshort <0x4000 23922>>>>>>0x0F ubeshort 0x00C3 23923>>>>>>>0x11 uleshort <0x4000 23924>>>>>>>>0x13 ubeshort 0x00C3 23925>>>>>>>>>0x15 uleshort <0x4000 23926>>>>>>>>>>0x50 ubyte 0xC3 23927>>>>>>>>>>>0x51 uleshort <0x4000 23928>>>>>>>>>>>>(9.s) ubyte 0xC3 23929>>>>>>>>>>>>>&0 uleshort >0x4000 23930>>>>>>>>>>>>>>&0 ubyte 0xC3 MSX BIOS+BASIC 23931>>>>>>>>>>>>>>>0x002D ubyte+1 <3 \b. version=MSX%d 23932>>>>>>>>>>>>>>>0x002D ubyte 2 \b, version=MSX2+ 23933>>>>>>>>>>>>>>>0x002D ubyte 3 \b, version=MSX Turbo-R 23934>>>>>>>>>>>>>>>0x002D ubyte >3 \b, version=Unknown MSX %d version 23935>>>>>>>>>>>>>>>0x0006 ubyte x \b, VDP.DR=0x%2x 23936>>>>>>>>>>>>>>>0x0007 ubyte x \b, VDP.DW=0x%2x 23937>>>>>>>>>>>>>>>0x002B ubyte&0xF 0 \b, charset=Japanese 23938>>>>>>>>>>>>>>>0x002B ubyte&0xF 1 \b, charset=International 23939>>>>>>>>>>>>>>>0x002B ubyte&0xF 2 \b, charset=Korean 23940>>>>>>>>>>>>>>>0x002B ubyte&0xF >2 \b, charset=Unknown id:%d 23941>>>>>>>>>>>>>>>0x002B ubyte&0x70 0x00 \b, date format=Y-M-D 23942>>>>>>>>>>>>>>>0x002B ubyte&0x70 0x10 \b, date format=M-D-Y 23943>>>>>>>>>>>>>>>0x002B ubyte&0x70 0x20 \b, date format=D-M-Y 23944>>>>>>>>>>>>>>>0x002B ubyte&0x80 0x00 \b, vfreq=60Hz 23945>>>>>>>>>>>>>>>0x002B ubyte&0x80 0x80 \b, vfreq=50Hz 23946>>>>>>>>>>>>>>>0x002C ubyte&0x0F 0 \b, keyboard=Japanese 23947>>>>>>>>>>>>>>>0x002C ubyte&0x0F 1 \b, keyboard=International 23948>>>>>>>>>>>>>>>0x002C ubyte&0x0F 2 \b, keyboard=French 23949>>>>>>>>>>>>>>>0x002C ubyte&0x0F 3 \b, keyboard=UK 23950>>>>>>>>>>>>>>>0x002C ubyte&0x0F 4 \b, keyboard=German 23951>>>>>>>>>>>>>>>0x002C ubyte&0x0F 5 \b, keyboard=Unknown id:%d 23952>>>>>>>>>>>>>>>0x002C ubyte&0x0F 6 \b, keyboard=Spanish 23953>>>>>>>>>>>>>>>0x002C ubyte&0x0F >6 \b, keyboard=Unknown id:%d 23954>>>>>>>>>>>>>>>0x002C ubyte&0xF0 0x00 \b, basic=Japanese 23955>>>>>>>>>>>>>>>0x002C ubyte&0xF0 0x10 \b, basic=International 23956>>>>>>>>>>>>>>>0x002C ubyte&0xF0 >0x10 \b, basic=Unknown id:%d 23957>>>>>>>>>>>>>>>0x002E ubyte&1 1 \b, built-in MIDI 23958 23959 239600 string/b CD 23961>2 uleshort >0x10 23962>>2 uleshort <0x4000 23963>>>4 uleshort <0x4000 23964>>>>6 uleshort <0x4000 23965>>>>>8 ubyte 0xC3 23966>>>>>>9 uleshort <0x4000 23967>>>>>>>0x10 ubyte 0xC3 23968>>>>>>>>0x11 uleshort <0x4000 23969>>>>>>>>>0x14 ubyte 0xC3 23970>>>>>>>>>>0x15 uleshort <0x4000 MSX2/2+/TR SubROM 23971 239720 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 23973>0x5F0 ubequad 0x8282828244380000 23974>>0x150 ubyte 0x38 23975>>>0x170 string \20\20\20 23976>>>>0x1E32 string ()) 23977>>>>>0x2130 ubequad 0xA5A5594924231807 23978>>>>>0x2138 ubequad 0x4A4A3424488830C0 MSX Kanji Font 23979 23980 23981 23982# MSX extension ROMs 239830 string/b AB 23984>2 uleshort 0x0010 MSX ROM 23985>>2 uleshort x \b, init=0x%4x 23986>>4 uleshort >0 \b, stahdl=0x%4x 23987>>6 uleshort >0 \b, devhdl=0x%4x 23988>>8 uleshort >0 \b, bas=0x%4x 23989>2 uleshort 0x4010 MSX ROM 23990>>2 uleshort x \b, init=0x%04x 23991>>4 uleshort >0 \b, stahdl=0x%04x 23992>>6 uleshort >0 \b, devhdl=0x%04x 23993>>8 uleshort >0 \b, bas=0x%04x 23994>2 uleshort 0x8010 MSX ROM 23995>>2 uleshort x \b, init=0x%04x 23996>>4 uleshort >0 \b, stahdl=0x%04x 23997>>6 uleshort >0 \b, devhdl=0x%04x 23998>>8 uleshort >0 \b, bas=0x%04x 239990 string/b AB\0\0 24000>6 uleshort 0 24001>>4 uleshort >0x400F MSX-BASIC extension ROM 24002>>>4 uleshort >0 \b, stahdl=0x%04x 24003>>>6 uleshort >0 \b, devhdl=0x%04x 24004>>>0x1C string OPLL \b, MSX-Music 24005>>>>0x18 string PAC2 \b (external) 24006>>>>0x18 string APRL \b (internal) 24007 240080 string/b AB\0\0\0\0 24009>6 uleshort >0x400F MSX device BIOS 24010>>6 uleshort >0 \b, devhdl=0x%04x 24011 24012 240130 string/b AB 24014#>2 string 5JSuperLAYDOCK MSX Super Laydock ROM 24015#>3 string @HYDLIDE3MSX MSX Hydlide-3 ROM 24016#>3 string @3\x80IA862 Golvellius MSX1 ROM 24017>2 uleshort >15 24018>>2 uleshort <0xC000 24019>>>8 string \0\0\0\0\0\0\0\0 24020>>>>(2.s&0x3FFF) uleshort >0 MSX ROM 24021>>>>>0x10 string YZ\0\0\0\0 Konami Game Master 2 MSX ROM 24022>>>>>0x10 string CD \b, Konami RC- 24023>>>>>>0x12 ubyte x \b%d 24024>>>>>>0x13 ubyte/16 x \b%d 24025>>>>>>0x13 ubyte&0xF x \b%d 24026>>>>>0x10 string EF \b, Konami RC- 24027>>>>>>0x12 ubyte x \b%d 24028>>>>>>0x13 ubyte/16 x \b%d 24029>>>>>>0x13 ubyte&0xF x \b%d 24030>>>>>2 uleshort x \b, init=0x%04x 24031>>>>>4 uleshort >0 \b, stahdl=0x%04x 24032>>>>>6 uleshort >0 \b, devhdl=0x%04x 24033>>>>>8 uleshort >0 \b, bas=0x%04x 24034>>>2 uleshort 0 24035>>>>4 uleshort 0 24036>>>>>6 uleshort 0 24037>>>>>>8 uleshort >0 MSX BASIC program in ROM, bas=0x%04x 24038 240390x4000 string/b AB 24040>0x4002 uleshort >0x400F 24041>>0x400A string \0\0\0\0\0\0 MSX ROM with nonstandard page order 24042>>>0x4002 uleshort x \b, init=0x%04x 24043>>>0x4004 uleshort >0 \b, stahdl=0x%04x 24044>>>0x4006 uleshort >0 \b, devhdl=0x%04x 24045>>>0x4008 uleshort >0 \b, bas=0x%04x 24046 240470x8000 string/b AB 24048>0x8002 uleshort >0x400F 24049>>0x800A string \0\0\0\0\0\0 MSX ROM with nonstandard page order 24050>>>0x8002 uleshort x \b, init=0x%04x 24051>>>0x8004 uleshort >0 \b, stahdl=0x%04x 24052>>>0x8006 uleshort >0 \b, devhdl=0x%04x 24053>>>0x8008 uleshort >0 \b, bas=0x%04x 24054 24055 240560x3C000 string/b AB 24057>0x3C008 string \0\0\0\0\0\0\0\0 MSX MegaROM with nonstandard page order 24058>>0x3C002 uleshort x \b, init=0x%04x 24059>>0x3C004 uleshort >0 \b, stahdl=0x%04x 24060>>0x3C006 uleshort >0 \b, devhdl=0x%04x 24061>>0x3C008 uleshort >0 \b, bas=0x%04x 24062 24063# MSX BIN file 24064#0 byte 0xFE 24065#>1 uleshort >0x8000 24066#>>3 uleshort >0x8004 24067#>>>5 uleshort >0x8000 MSX BIN file 24068 24069# MSX-BASIC file 240700 byte 0xFF 24071>3 uleshort 0x000A 24072>>1 uleshort >0x8000 MSX-BASIC program 24073 24074# MSX .CAS file 240750 string/b \x1F\xA6\xDE\xBA\xCC\x13\x7D\x74 MSX cassette archive 24076 24077# Mega-Assembler file 240780 byte 0xFE 24079>1 uleshort 0x0001 24080>>5 uleshort 0xffff 24081>>>6 byte 0x0A MSX Mega-Assembler source 24082 24083# Execrom Patchfile 240840 string ExecROM\ patchfile\x1A MSX ExecROM patchfile 24085>0x12 ubyte/16 x v%d 24086>0x12 ubyte&0xF x \b.%d 24087>0x13 ubyte x \b, contains %d patches 24088 24089# Konami's King's Valley-2 custom stage (ELG file) 240904 uleshort 0x0900 24091>0xF byte 1 24092>>0x14 byte 0 24093>>>0x1E string \040\040\040 24094>>>>0x23 byte 1 24095>>>>>0x25 byte 0 24096>>>>>>0x15 string >\x30 24097>>>>>>>0x15 string <\x5A Konami King's Valley-2 custom stage, title: "%-8.8s" 24098>>>>>>>>0x1D byte <32 \b, theme: %d 24099 24100# Metal Gear 1 savegame 24101#0x4F string \x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF 24102#>>0x60 string \xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF 24103#>>>0x7B string \0x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\x00 Metal Gear 1 savegame 24104 24105# ------------------------------------------------------------------------ 24106# $File: mup,v 1.5 2017/03/17 21:35:28 christos Exp $ 24107# mup: file(1) magic for Mup (Music Publisher) input file. 24108# 24109# From: Abel Cheung <abel (@) oaka.org> 24110# 24111# NOTE: This header is mainly proposed in the Arkkra mailing list, 24112# and is not a mandatory header because of old mup input file 24113# compatibility. Noteedit also use mup format, but is not forcing 24114# user to use any header as well. 24115# 241160 search/1 //!Mup Mup music publication program input text 24117>6 string -Arkkra (Arkkra) 24118>>13 string - 24119>>>16 string . 24120>>>>14 string x \b, need V%.4s 24121>>>15 string . 24122>>>>14 string x \b, need V%.3s 24123>6 string - 24124>>9 string . 24125>>>7 string x \b, need V%.4s 24126>>8 string . 24127>>>7 string x \b, need V%.3s 24128#------------------------------------------------------------------------------ 24129# $File: music,v 1.1 2011/11/25 03:28:17 christos Exp $ 24130# music: file (1) magic for music formats 24131 24132# BWW format used by Bagpipe Music Writer Gold by Robert MacNeil Musicworks 24133# and Bagpipe Writer by Doug Wickstrom 24134# 241350 string Bagpipe Bagpipe 24136>8 string Reader Reader 24137>>15 string >\0 (version %.3s) 24138>8 string Music\ Writer Music Writer 24139>>20 string : 24140>>>21 string >\0 (version %.3s) 24141>>21 string Gold Gold 24142>>>25 string : 24143>>>>26 string >\0 (version %.3s) 24144 24145 24146#------------------------------------------------------------------------------ 24147# nasa: file(1) magic 24148 24149# From: Barry Carter <carter.barry@gmail.com> 241500 string DAF/SPK NASA SPICE file (binary format) 241510 string DAFETF\ NAIF\ DAF\ ENCODED NASA SPICE file (transfer format) 24152 24153#----------------------------------------------------------------------------- 24154# $File: natinst,v 1.6 2014/06/03 19:17:27 christos Exp $ 24155# natinst: file(1) magic for National Instruments Code Files 24156 24157# 24158# From <egamez@fcfm.buap.mx> Enrique Gamez-Flores 24159# version 1 24160# Many formats still missing, we use, for the moment LabVIEW 24161# We guess VXI format file. VISA, LabWindowsCVI, BridgeVIEW, etc, are missing 24162# 241630 string RSRC National Instruments, 24164# Check if it's a LabVIEW File 24165>8 string LV LabVIEW File, 24166# Check which kind of file it is 24167>>10 string SB Code Resource File, data 24168>>10 string IN Virtual Instrument Program, data 24169>>10 string AR VI Library, data 24170# This is for Menu Libraries 24171>8 string LMNULBVW Portable File Names, data 24172# This is for General Resources 24173>8 string rsc Resources File, data 24174# This is for VXI Package 241750 string VMAP National Instruments, VXI File, data 24176 24177#------------------------------------------------------------------------------ 24178# $File: ncr,v 1.8 2014/04/30 21:41:02 christos Exp $ 24179# ncr: file(1) magic for NCR Tower objects 24180# 24181# contributed by 24182# Michael R. Wayne *** TMC & Associates *** INTERNET: wayne@ford-vax.arpa 24183# uucp: {philabs | pyramid} !fmsrl7!wayne OR wayne@fmsrl7.UUCP 24184# 241850 beshort 000610 Tower/XP rel 2 object 24186>12 belong >0 not stripped 24187>20 beshort 0407 executable 24188>20 beshort 0410 pure executable 24189>22 beshort >0 - version %d 241900 beshort 000615 Tower/XP rel 2 object 24191>12 belong >0 not stripped 24192>20 beshort 0407 executable 24193>20 beshort 0410 pure executable 24194>22 beshort >0 - version %d 241950 beshort 000620 Tower/XP rel 3 object 24196>12 belong >0 not stripped 24197>20 beshort 0407 executable 24198>20 beshort 0410 pure executable 24199>22 beshort >0 - version %d 242000 beshort 000625 Tower/XP rel 3 object 24201>12 belong >0 not stripped 24202>20 beshort 0407 executable 24203>20 beshort 0410 pure executable 24204>22 beshort >0 - version %d 242050 beshort 000630 Tower32/600/400 68020 object 24206>12 belong >0 not stripped 24207>20 beshort 0407 executable 24208>20 beshort 0410 pure executable 24209>22 beshort >0 - version %d 242100 beshort 000640 Tower32/800 68020 24211>18 beshort &020000 w/68881 object 24212>18 beshort &040000 compatible object 24213>18 beshort &060000 object 24214>20 beshort 0407 executable 24215>20 beshort 0413 pure executable 24216>12 belong >0 not stripped 24217>22 beshort >0 - version %d 242180 beshort 000645 Tower32/800 68010 24219>18 beshort &040000 compatible object 24220>18 beshort &060000 object 24221>20 beshort 0407 executable 24222>20 beshort 0413 pure executable 24223>12 belong >0 not stripped 24224>22 beshort >0 - version %d 24225 24226#------------------------------------------------------------ 24227# $File: neko,v 1.2 2019/04/19 00:42:27 christos Exp $ 24228 24229# From: Mikhail Gusarov <dottedmag@dottedmag.net> 24230# NekoVM (https://nekovm.org/) bytecode 242310 string NEKO NekoVM bytecode 24232>4 lelong x (%d global symbols, 24233>8 lelong x %d global fields, 24234>12 lelong x %d bytecode ops) 24235!:mime application/x-nekovm-bytecode 24236 24237 24238#------------------------------------------------------------------------------ 24239# $File: netbsd,v 1.26 2019/01/01 03:11:23 christos Exp $ 24240# netbsd: file(1) magic for NetBSD objects 24241# 24242# All new-style magic numbers are in network byte order. 24243# The old-style magic numbers are indistinguishable from the same magic 24244# numbers used in other systems, and are handled, for all those systems, 24245# in aout. 24246# 24247 242480 name netbsd-detail 24249>20 lelong x @%#x 24250>4 lelong >0 \b+T=%d 24251>8 lelong >0 \b+D=%d 24252>12 lelong >0 \b+B=%d 24253>16 lelong >0 \b+S=%d 24254>24 lelong >0 \b+TR=%d 24255>28 lelong >0 \b+TD=%d 24256 242570 name netbsd-4096 24258>0 byte &0x80 24259>>20 lelong <4096 shared library 24260>>20 lelong =4096 dynamically linked executable 24261>>20 lelong >4096 dynamically linked executable 24262>0 byte ^0x80 executable 24263>16 lelong >0 not stripped 24264 242650 name netbsd-8192 24266>0 byte &0x80 24267>>20 lelong <8192 shared library 24268>>20 lelong =8192 dynamically linked executable 24269>>20 lelong >8192 dynamically linked executable 24270>0 byte ^0x80 executable 24271>16 lelong >0 not stripped 24272>0 use netbsd-detail 24273 242740 name netbsd-normal 24275>0 byte &0x80 dynamically linked executable 24276>0 byte ^0x80 24277>>0 byte &0x40 position independent 24278>>20 lelong !0 executable 24279>>20 lelong =0 object file 24280>16 lelong >0 not stripped 24281>0 use netbsd-detail 24282 242830 name netbsd-pure 24284>0 byte &0x80 dynamically linked executable 24285>0 byte ^0x80 executable 24286>16 lelong >0 not stripped 24287>0 use netbsd-detail 24288 242890 name netbsd-core 24290>12 string >\0 from '%s' 24291>32 lelong !0 (signal %d) 24292 242930 belong&0377777777 041400413 a.out NetBSD/i386 demand paged 24294>0 use netbsd-4096 24295 242960 belong&0377777777 041400410 a.out NetBSD/i386 pure 24297>0 use netbsd-pure 24298 242990 belong&0377777777 041400407 a.out NetBSD/i386 24300>0 use netbsd-normal 24301 243020 belong&0377777777 041400507 a.out NetBSD/i386 core 24303>0 use netbsd-core 24304 243050 belong&0377777777 041600413 a.out NetBSD/m68k demand paged 24306>0 use \^netbsd-8192 24307 243080 belong&0377777777 041600410 a.out NetBSD/m68k pure 24309>0 use \^netbsd-pure 24310 243110 belong&0377777777 041600407 a.out NetBSD/m68k 24312>0 use \^netbsd-normal 24313 243140 belong&0377777777 041600507 a.out NetBSD/m68k core 24315>0 use \^netbsd-core 24316 243170 belong&0377777777 042000413 a.out NetBSD/m68k4k demand paged 24318>0 use \^netbsd-4096 24319 243200 belong&0377777777 042000410 a.out NetBSD/m68k4k pure 24321>0 use \^netbsd-pure 24322 243230 belong&0377777777 042000407 a.out NetBSD/m68k4k 24324>0 use \^netbsd-normal 24325 243260 belong&0377777777 042000507 a.out NetBSD/m68k4k core 24327>0 use \^netbsd-core 24328 243290 belong&0377777777 042200413 a.out NetBSD/ns32532 demand paged 24330>0 use netbsd-4096 24331 243320 belong&0377777777 042200410 a.out NetBSD/ns32532 pure 24333>0 use netbsd-pure 24334 243350 belong&0377777777 042200407 a.out NetBSD/ns32532 24336>0 use netbsd-normal 24337 243380 belong&0377777777 042200507 a.out NetBSD/ns32532 core 24339>0 use netbsd-core 24340 243410 belong&0377777777 045200507 a.out NetBSD/powerpc core 24342>0 use netbsd-core 24343 243440 belong&0377777777 042400413 a.out NetBSD/SPARC demand paged 24345>0 use \^netbsd-8192 24346 243470 belong&0377777777 042400410 a.out NetBSD/SPARC pure 24348>0 use \^netbsd-pure 24349 243500 belong&0377777777 042400407 a.out NetBSD/SPARC 24351>0 use \^netbsd-normal 24352 243530 belong&0377777777 042400507 a.out NetBSD/SPARC core 24354>0 use \^netbsd-core 24355 243560 belong&0377777777 042600413 a.out NetBSD/pmax demand paged 24357>0 use netbsd-4096 24358 243590 belong&0377777777 042600410 a.out NetBSD/pmax pure 24360>0 use \^netbsd-pure 24361 243620 belong&0377777777 042600407 a.out NetBSD/pmax 24363>0 use netbsd-normal 24364 243650 belong&0377777777 042600507 a.out NetBSD/pmax core 24366>0 use netbsd-core 24367 243680 belong&0377777777 043000413 a.out NetBSD/vax 1k demand paged 24369>0 use netbsd-4096 24370 243710 belong&0377777777 043000410 a.out NetBSD/vax 1k pure 24372>0 use netbsd-pure 24373 243740 belong&0377777777 043000407 a.out NetBSD/vax 1k 24375>0 use netbsd-normal 24376 243770 belong&0377777777 043000507 a.out NetBSD/vax 1k core 24378>0 use netbsd-core 24379 243800 belong&0377777777 045400413 a.out NetBSD/vax 4k demand paged 24381>0 use netbsd-4096 24382 243830 belong&0377777777 045400410 a.out NetBSD/vax 4k pure 24384>0 use netbsd-pure 24385 243860 belong&0377777777 045400407 a.out NetBSD/vax 4k 24387>0 use netbsd-normal 24388 243890 belong&0377777777 045400507 a.out NetBSD/vax 4k core 24390>0 use netbsd-core 24391 24392# NetBSD/alpha does not support (and has never supported) a.out objects, 24393# so no rules are provided for them. NetBSD/alpha ELF objects are 24394# dealt with in "elf". 243950 lelong 0x00070185 ECOFF NetBSD/alpha binary 24396>10 leshort 0x0001 not stripped 24397>10 leshort 0x0000 stripped 243980 belong&0377777777 043200507 a.out NetBSD/alpha core 24399>12 string >\0 from '%s' 24400>32 lelong !0 (signal %d) 24401 244020 belong&0377777777 043400413 a.out NetBSD/mips demand paged 24403>0 use \^netbsd-8192 24404 24405>16 belong >0 not stripped 244060 belong&0377777777 043400410 a.out NetBSD/mips pure 24407>0 use netbsd-pure 24408 244090 belong&0377777777 043400407 a.out NetBSD/mips 24410>0 use netbsd-normal 24411 244120 belong&0377777777 043400507 a.out NetBSD/mips core 24413>0 use netbsd-core 24414 244150 belong&0377777777 043600413 a.out NetBSD/arm32 demand paged 24416>0 use netbsd-4096 24417 244180 belong&0377777777 043600410 a.out NetBSD/arm32 pure 24419>0 use netbsd-pure 24420 244210 belong&0377777777 043600407 a.out NetBSD/arm32 24422>0 use netbsd-normal 24423 24424# NetBSD/arm26 has always used ELF objects, but it shares a core file 24425# format with NetBSD/arm32. 244260 belong&0377777777 043600507 a.out NetBSD/arm core 24427>0 use netbsd-core 24428 24429# Kernel core dump format 244300 belong&0x0000ffff 0x00008fca NetBSD kernel core file 24431>0 belong&0x03ff0000 0x00000000 \b, Unknown 24432>0 belong&0x03ff0000 0x00010000 \b, sun 68010/68020 24433>0 belong&0x03ff0000 0x00020000 \b, sun 68020 24434>0 belong&0x03ff0000 0x00640000 \b, 386 PC 24435>0 belong&0x03ff0000 0x00860000 \b, i386 BSD 24436>0 belong&0x03ff0000 0x00870000 \b, m68k BSD (8K pages) 24437>0 belong&0x03ff0000 0x00880000 \b, m68k BSD (4K pages) 24438>0 belong&0x03ff0000 0x00890000 \b, ns32532 BSD 24439>0 belong&0x03ff0000 0x008a0000 \b, SPARC/32 BSD 24440>0 belong&0x03ff0000 0x008b0000 \b, pmax BSD 24441>0 belong&0x03ff0000 0x008c0000 \b, vax BSD (1K pages) 24442>0 belong&0x03ff0000 0x008d0000 \b, alpha BSD 24443>0 belong&0x03ff0000 0x008e0000 \b, mips BSD (Big Endian) 24444>0 belong&0x03ff0000 0x008f0000 \b, arm6 BSD 24445>0 belong&0x03ff0000 0x00900000 \b, m68k BSD (2K pages) 24446>0 belong&0x03ff0000 0x00910000 \b, sh3 BSD 24447>0 belong&0x03ff0000 0x00950000 \b, ppc BSD (Big Endian) 24448>0 belong&0x03ff0000 0x00960000 \b, vax BSD (4K pages) 24449>0 belong&0x03ff0000 0x00970000 \b, mips1 BSD 24450>0 belong&0x03ff0000 0x00980000 \b, mips2 BSD 24451>0 belong&0x03ff0000 0x00990000 \b, m88k BSD 24452>0 belong&0x03ff0000 0x00920000 \b, parisc BSD 24453>0 belong&0x03ff0000 0x009b0000 \b, sh5/64 BSD 24454>0 belong&0x03ff0000 0x009c0000 \b, SPARC/64 BSD 24455>0 belong&0x03ff0000 0x009d0000 \b, amd64 BSD 24456>0 belong&0x03ff0000 0x009e0000 \b, sh5/32 BSD 24457>0 belong&0x03ff0000 0x009f0000 \b, ia64 BSD 24458>0 belong&0x03ff0000 0x00b70000 \b, aarch64 BSD 24459>0 belong&0x03ff0000 0x00b80000 \b, or1k BSD 24460>0 belong&0x03ff0000 0x00b90000 \b, Risk-V BSD 24461>0 belong&0x03ff0000 0x00c80000 \b, hp200 BSD 24462>0 belong&0x03ff0000 0x012c0000 \b, hp300 BSD 24463>0 belong&0x03ff0000 0x020b0000 \b, hp800 HP-UX 24464>0 belong&0x03ff0000 0x020c0000 \b, hp200/hp300 HP-UX 24465>0 belong&0xfc000000 0x04000000 \b, CPU 24466>0 belong&0xfc000000 0x08000000 \b, DATA 24467>0 belong&0xfc000000 0x10000000 \b, STACK 24468>4 leshort x \b, (headersize = %d 24469>6 leshort x \b, segmentsize = %d 24470>8 lelong x \b, segments = %d) 24471 24472# little endian only for now. 244730 name ktrace 24474>4 leshort 7 24475>>6 leshort <3 NetBSD ktrace file version %d 24476>>>12 string x from %s 24477>>>56 string x \b, emulation %s 24478>>>8 lelong <65536 \b, pid=%d 24479 2448056 string netbsd 24481>0 use ktrace 2448256 string linux 24483>0 use ktrace 2448456 string sunos 24485>0 use ktrace 2448656 string hpux 24487>0 use ktrace 24488 24489#------------------------------------------------------------------------------ 24490# $File: netscape,v 1.8 2017/03/17 21:35:28 christos Exp $ 24491# netscape: file(1) magic for Netscape files 24492# "H. Nanosecond" <aldomel@ix.netcom.com> 24493# version 3 and 4 I think 24494# 24495 24496# Netscape Address book .nab 244970 string \000\017\102\104\000\000\000\000\000\000\001\000\000\000\000\002\000\000\000\002\000\000\004\000 Netscape Address book 24498 24499# Netscape Communicator address book 245000 string \000\017\102\111 Netscape Communicator address book 24501 24502# .snm Caches 245030 string #\ Netscape\ folder\ cache Netscape folder cache 245040 string \000\036\204\220\000 Netscape folder cache 24505# .n2p 24506# Net 2 Phone 24507#0 string 123\130\071\066\061\071\071\071\060\070\061\060\061\063\060 245080 string SX961999 Net2phone 24509 24510# 24511#This is files ending in .art, FIXME add more rules 245120 string JG\004\016\0\0\0\0 AOL ART image 245130 string JG\003\016\0\0\0\0 AOL ART image 24514 24515#------------------------------------------------------------------------------ 24516# $File: netware,v 1.4 2009/09/19 16:28:11 christos Exp $ 24517# netware: file(1) magic for NetWare Loadable Modules (NLMs) 24518# From: Mads Martin Joergensen <mmj@suse.de> 24519 245200 string NetWare\ Loadable\ Module NetWare Loadable Module 24521 24522#------------------------------------------------------------------------------ 24523# $File: news,v 1.6 2009/09/19 16:28:11 christos Exp $ 24524# news: file(1) magic for SunOS NeWS fonts (not "news" as in "netnews") 24525# 245260 string StartFontMetrics ASCII font metrics 245270 string StartFont ASCII font bits 245280 belong 0x137A2944 NeWS bitmap font 245290 belong 0x137A2947 NeWS font family 245300 belong 0x137A2950 scalable OpenFont binary 245310 belong 0x137A2951 encrypted scalable OpenFont binary 245328 belong 0x137A2B45 X11/NeWS bitmap font 245338 belong 0x137A2B48 X11/NeWS font family 24534 24535#------------------------------------------------------------------------------ 24536# $File: nitpicker,v 1.8 2019/04/19 00:42:27 christos Exp $ 24537# nitpicker: file(1) magic for Flowfiles. 24538# From: Christian Jachmann <C.Jachmann@gmx.net> https://www.nitpicker.de 245390 string NPFF NItpicker Flow File 24540>4 byte x V%d. 24541>5 byte x %d 24542>6 bedate x started: %s 24543>10 bedate x stopped: %s 24544>14 belong x Bytes: %u 24545>18 belong x Bytes1: %u 24546>22 belong x Flows: %u 24547>26 belong x Pkts: %u 24548 24549#------------------------------------------------------------------------------ 24550# $File: numpy,v 1.1 2019/05/09 16:24:36 christos Exp $ 24551# numpy: file(1) magic for NumPy array binary serialization format 24552# Reference: https://docs.scipy.org/doc/numpy/reference/generated/numpy.lib.format.html 245530 string \x93NUMPY NumPy array, 24554>6 ubyte x version %d 24555>7 ubyte x \b.%d, 24556>8 uleshort x header length %d 24557 24558#------------------------------------------------------------------------------ 24559# $File: oasis,v 1.2 2014/06/03 19:17:27 christos Exp $ 24560# OASIS 24561# Summary: OASIS stream file 24562# Long description: Open Artwork System Interchange Standard 24563# File extension: .oas 24564# Full name: Ben Cowley (bcowley@broadcom.com) 24565# Philip Dixon (pdixon@broadcom.com) 24566# Reference: http://www.wrcad.com/oasis/oasis-3626-042303-draft.pdf 24567# (see page 3) 245680 string %SEMI-OASIS\r\n OASIS Stream file 24569 24570#------------------------------------------------------------------------------ 24571# $File: ocaml,v 1.5 2010/09/20 18:55:20 rrt Exp $ 24572# ocaml: file(1) magic for Objective Caml files. 245730 string Caml1999 OCaml 24574>8 string X exec file 24575>8 string I interface file (.cmi) 24576>8 string O object file (.cmo) 24577>8 string A library file (.cma) 24578>8 string Y native object file (.cmx) 24579>8 string Z native library file (.cmxa) 24580>8 string M abstract syntax tree implementation file 24581>8 string N abstract syntax tree interface file 24582>9 string >\0 (Version %3.3s) 24583 24584#------------------------------------------------------------------------------ 24585# $File: octave,v 1.4 2009/09/19 16:28:11 christos Exp $ 24586# octave binary data file(1) magic, from Dirk Eddelbuettel <edd@debian.org> 245870 string Octave-1-L Octave binary data (little endian) 245880 string Octave-1-B Octave binary data (big endian) 24589 24590#------------------------------------------------------------------------------ 24591# $File: ole2compounddocs,v 1.8 2020/03/28 23:10:30 christos Exp $ 24592# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured 24593# storage (https://en.wikipedia.org/wiki/Compound_File_Binary_Format) 24594# Additional tests for OLE 2 Compound Documents should be under this recipe. 24595# reference: https://www.openoffice.org/sc/compdocfileformat.pdf 24596 245970 string \320\317\021\340\241\261\032\341 24598# https://digital-preservation.github.io/droid/ 24599# skip droid skeleton like fmt-39-signature-id-128.doc by valid version 24600>0x1A ushort !0xABAB OLE 2 Compound Document 24601#>0x1C uleshort x \b, endnian 0x%4.4x 24602# big endian not tested 24603>>0x1C ubeshort =0xfffe \b, big-endian 24604>>>546 string jbjb : Microsoft Word Document 24605!:mime application/msword 24606!:apple MSWDWDBN 24607!:ext doc 24608# Byte Order 0xFFFE means little-endian found in real world applications 24609#>>0x1C uleshort =0xfffe \b, little-endian 24610>>0x1C uleshort =0xfffe 24611# From: Joerg Jenderek 24612# Major Version 3 or 4 24613>>>0x1A uleshort x \b, v%u 24614# Minor Version 32h=50 3Bh=59 3Eh=62 24615>>>0x18 uleshort x \b.%u 24616# SecID of first sector of the directory stream is often 1 but high like 3144h 24617>>>48 ulelong x \b, SecID 0x%x 24618# Sector Shift Exponent in short-stream container stream: 6~64 bytes 24619>>>32 uleshort !6 \b, exponent of short stream %u 24620# total number of sectors used for the FAT 24621>>>44 ulelong >1 \b, %u FAT sectors 24622# SecID of first sector of the short-sector allocation table (Mini FAT) 24623# or -2 (End Of ChainSecID) if not extant 24624>>>60 ulelong !0xffFFffFE \b, Mini FAT start sector 0x%x 24625# total number of sectors used for the short-sector allocation table 24626>>>64 ulelong !1 \b, %u Mini FAT sector 24627# plural s 24628>>>>64 ulelong >1 \bs 24629# SecID of first sector of the master sector allocation table (DIFAT) 24630# or -2 (End Of Chain SecID) if no additional sectors used 24631>>>68 ulelong !0xffFFffFE \b, DIFAT start sector 0x%x 24632# total number of sectors used for the master sector allocation table (DIFAT) 24633>>>72 ulelong >0 \b, %u DIFAT sectors 24634# First part of the master sector allocation table (DIFAT) containing 109 SecIDs 24635#>>>76 ubequad x \b, DIFAT=0x%16.16llx 24636#>>>84 ubequad x \b%16.16llx... 24637# pointer to root entry only works with standard configuration for SecID ~< 800h 24638# Red-Carpet-presentation-1.0-1.sdd sg10.sdv 2000_GA_Annual_Review_Data.xls 24639# "ORLEN Factbook 2017.xls" XnView_metadata.doc 24640# "Barham, Lisa - Die Shopping-Prinzessinnen.doc" then not recognized 24641>>>48 ulelong >0x800 too big for FILE_BYTES_MAX = 1 MiB 24642# Sector Shift Exponent 9~512 for major version 3 or C~4096 for major version 4 24643>>>0x1E uleshort 0xc \b, blocksize 4096 24644# jump to one block (4096 bytes per block) before root storage block 24645>>>>(48.l*4096) ubyte x 24646>>>>>&4095 use ole2-directory 24647#>>>0x1E uleshort 9 \b, blocksize 512 24648>>>0x1E uleshort 9 24649# jump to one block (512 bytes per block) before root storage block 24650# in 5.37 only true for offset ~< FILE_BYTES_MAX=7 MiB defined in ../../src/file.h 24651>>>>(48.l*512) ubyte x 24652>>>>>&511 use ole2-directory 24653# check directory entry structure and display types by GUID 246540 name ole2-directory 24655# directory entry name like "Root Entry" 24656#>0 lestring16 x \b, 1st %.10s 24657# type of the entry; 5~Root storage 24658#>66 ubyte x \b, type %x 24659# node colour of the entry: 00H ~ Red 01H ~ Black 24660#>67 ubyte x \b, color %x 24661# the DirIDs of the child nodes. Should both be -1 in the root storage entry 24662#>68 bequad !0xffffffffffffffff \b, DirIDs %llx 24663# second directory entry name like VisioDocument Control000 24664#>128 lestring16 x \b, 2nd %.20s 24665# third directory entry like WordDocument 24666#>256 lestring16 x \b, 3rd %.20s 24667# forth 24668#>384 lestring16 x \b, 4th %.10s 24669# 5th 24670#>512 lestring16 x \b, 5th %.10s 24671# 6th 24672#>640 lestring16 x \b, 6th %.10s 24673# 7th 24674#>768 lestring16 x \b, 7th %.10s 24675# https://wikileaks.org/ciav7p1/cms/page_13762814.html 24676# https://m.blog.naver.com/superman4u/40047693679 24677# https://misc.daniel-marschall.de/projects/guid_analysis/guid.txt 24678# http://www.windowstricks.in/online-windows-guid-converter 24679#>80 ubequad !0 \b, clsid 0x%16.16llx 24680#>>88 ubequad x \b%16.16llx 24681# test for "Root Entry" inside directory by type 5 value 24682>66 ubyte 5 24683# look for CLSID GUID 0 24684>>88 ubequad 0x0 24685>>>80 ubequad 0x0 24686# - Microstation V8 DGN files (www.bentley.com) 24687# URL: https://en.wikipedia.org/wiki/MicroStation 24688# Last update on 10/23/2006 by Lester Hightower 24689# 07/24/2019 by Joerg Jenderek 24690# Second directory entry name like Dgn~H Dgn~S 24691>>>>128 lestring16 Dgn~ : Microstation V8 CAD 24692#!:mime application/x-ole-storage 24693!:mime application/x-bentley-dgn 24694# http://www.q-cad.com/files/samples_cad_files/1344468165.dgn 24695!:ext dgn 24696# 24697# URL: http://fileformats.archiveteam.org/wiki/WordPerfect 24698# Second directory entry name PerfectOffice_ 24699>>>>128 lestring16 PerfectOffice_ : WordPerfect 7-X3 presentations Master, Document or Graphic 24700!:mime application/vnd.wordperfect 24701# https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd 24702!:apple ????WPC7 24703!:ext mst/wpd/wpg 24704# 24705# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor 24706# Second directory entry name MatOST_ 24707>>>>128 lestring16 MatOST : Microsoft Works 3.0 document 24708!:mime application/vnd.ms-works 24709!:apple ????AWWP 24710!:ext wps 24711# 24712# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Spreadsheet 24713# 3rd directory entry name WksSSWorkBook 24714>>>>256 lestring16 WksSSWorkBook : Microsoft Works 6-9 spreadsheet 24715!:mime application/vnd.ms-works 24716!:apple ????AWSS 24717!:ext xlr 24718# 24719# URL: http://fileformats.archiveteam.org/wiki/XLS 24720# what is the difference to {00020820-0000-0000-c000-000000000046} ? 24721# Second directory entry name Workbook 24722>>>>128 lestring16 Workbook 24723>>>>>256 lestring16 !WksSSWorkBook : Microsoft Excel 97-2003 worksheet 0 clsid 24724!:mime application/vnd.ms-excel 24725# https://www.macdisk.com/macsigen.php XLS5 for Excel 5 24726!:apple ????XLS9 24727!:ext xls 24728# 24729# URL: http://fileformats.archiveteam.org/wiki/PPT 24730# Second directory entry name Object1 Object12 Object35 24731>>>>128 lestring16 Object : Microsoft PowerPoint 4 presentation 24732!:mime application/vnd.ms-powerpoint 24733# https://www.macdisk.com/macsigen.php 24734!:apple ????PPT3 24735!:ext ppt 24736# 24737# URL: https://www.msoutlook.info/question/164 24738# Second directory entry name __CollDataStm 24739>>>>128 lestring16 __CollDataStm : Microsoft Outlook Send Receive Settings 24740#!:mime application/vnd.ms-outlook 24741!:mime application/x-ms-srs 24742# %APPDATA%\Microsoft\Outlook\Outlook.srs 24743!:ext srs 24744# 24745# URL: https://www.file-extensions.org/cag-file-extension 24746# Second directory entry name Category 24747>>>>128 lestring16 Category : Microsoft Clip Art Gallery 24748#!:mime application/x-ole-storage 24749!:mime application/x-ms-cag 24750!:apple MScgCGdb 24751!:ext cag/ 24752# 24753# URL: https://www.filesuffix.com/de/extension/rra 24754# 3rd directory entry name StrIndex_StringTable 24755>>>>256 lestring16 StrIndex_StringTable : Windows temporarily installer 24756#!:mime application/x-ole-storage 24757!:mime application/x-ms-rra 24758!:ext rra 24759# 24760# URL: https://www.forensicswiki.org/wiki/Jump_Lists 24761# 3rd directory entry name DestList 24762>>>>256 lestring16 DestList : Windows jump list 24763#!:mime application/x-ole-storage 24764!:mime application/x-ms-jumplist 24765# %APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\*.automaticDestinations-ms 24766!:ext automaticDestinations-ms 24767# 24768# URL: https://en.wikipedia.org/wiki/Windows_thumbnail_cache 24769# Second directory entry name 256_ 24770>>>>128 lestring16 256_ : Windows thumbnail database 256 24771#!:mime application/x-ole-storage 24772!:mime application/x-ms-thumbnail 24773# Thumbs.db 24774!:ext db 24775>>>>128 lestring16 96_ : Windows thumbnail database 96 24776!:mime application/x-ms-thumbnail 24777!:ext db 24778# 3rd directory entry name Catalog_ 24779>>>>256 lestring16 Catalog : Windows thumbnail database 24780!:mime application/x-ms-thumbnail 24781!:ext db 24782# 24783# URL: https://support.microsoft.com/en-us/help/300887/how-to-use-system-information-msinfo32-command-line-tool-switches 24784# Note: older Microsoft Systeminfo (MSInfo Configuration File of msinfo32); newer use xml based 24785# Second directory entry name Control000 24786>>>>128 lestring16 Control000 : Microsoft old Systeminfo 24787#!:mime application/x-ole-storage 24788!:mime application/x-ms-info 24789!:ext nfo 24790# 24791# URL: http://fileformats.archiveteam.org/wiki/Corel_Print_House 24792# Second directory entry name Thumbnail 24793>>>>128 lestring16 Thumbnail : Corel PrintHouse image 24794#!:mime application/x-ole-storage 24795!:mime application/x-corel-cph 24796!:ext cph 24797# 3rd directory entry name Thumbnail 24798>>>>256 lestring16 Thumbnail : Corel PrintHouse image 24799!:mime application/x-corel-cph 24800!:ext cph 24801# 24802# URL: https://en.wikipedia.org/wiki/Hangul_(word_processor) 24803# Note: "HWP Document File" signature found in FileHeader 24804# Second directory entry name FileHeader hint for Thinkfree Office document 24805>>>>128 lestring16 FileHeader : Hangul (Korean) 5.0 Word Processor File 24806#!:mime application/haansofthwp 24807!:mime application/x-hwp 24808# https://example-files.online-convert.com/document/hwp/example.hwp 24809!:ext hwp 24810# 24811# URL: https://ask.libreoffice.org/en/question/26303/creating-new-themes-for-the-gallery-not-functioning/ 24812# Second directory entry name like dd2000 dd2001 dd2036 dd2060 dd2083 24813>>>>128 lestring16 dd2 : StarOffice Gallery view 24814#!:mime application/x-ole-storage 24815!:mime application/x-star-sdv 24816!:ext sdv 24817# URL: https://en.wikipedia.org/wiki/SoftMaker_Office 24818# second directory entry name Current User 24819>>>>128 lestring16 Current\ User : SoftMaker 24820# third directory entry name SMNativeObjData 24821>>>>>256 lestring16 SMNativeObjData 24822# 5th directory entry nane PowerPoint 24823>>>>>>512 lestring16 PowerPoint PowerPoint presentation or template 24824!:mime application/vnd.ms-powerpoint 24825!:ext ppt/pps/pot 24826# 4th directory entry name PowerPoint 24827>>>>>384 lestring16 PowerPoint Presentations or template 24828# http://extension.nirsoft.net/prv 24829!:mime application/vnd.softmaker.presentations 24830!:ext prd/prv 24831# third directory entry name like Current User 24832>>>>256 lestring16 Current\ User : SoftMaker 24833# 5th directory entry name PowerPoint 24834>>>>>512 lestring16 PowerPoint Presentations or template 24835# http://extension.nirsoft.net/prd 24836!:mime application/vnd.softmaker.presentations 24837!:ext prd/prv 24838# 2nd directory entry name Pictures 24839>>>>>>128 lestring16 Pictures with pictures 24840# remaining null clsid 24841>>>>128 default x : UNKNOWN 24842!:mime application/x-ole-storage 24843# look for known clsid GUID 24844# - Visio documents 24845# URL: http://fileformats.archiveteam.org/wiki/Visio 24846# Last update on 10/23/2006 by Lester Hightower, 07/20/2019 by Joerg Jenderek 24847>>88 ubequad 0xc000000000000046 : Microsoft 24848>>>80 ubequad 0x131a020000000000 Visio 2000-2002 Document, stencil or template 24849!:mime application/vnd.visio 24850# VSD~Drawing VSS~Stencil VST~Template 24851!:ext vsd/vss/vst 24852>>>80 ubequad 0x141a020000000000 Visio 2003-2010 Document, stencil or template 24853!:mime application/vnd.visio 24854!:ext vsd/vss/vst 24855# 24856# URL: http://fileformats.archiveteam.org/wiki/Windows_Installer 24857>>>80 ubequad 0x84100c0000000000 Windows Installer Package 24858!:mime application/x-msi 24859#!:mime application/x-ms-win-installer 24860!:ext msi 24861>>>80 ubequad 0x86100c0000000000 Windows Installer Patch 24862# ?? 24863!:mime application/x-wine-extension-msp 24864#!:mime application/x-ms-msp 24865!:ext msp 24866# 24867# URL: http://fileformats.archiveteam.org/wiki/DOC 24868>>>80 ubequad 0x0009020000000000 Word 6-95 document or template 24869!:mime application/msword 24870# for template MSWDW8TN 24871!:apple MSWDWDBN 24872!:ext doc/dot 24873>>>80 ubequad 0x0609020000000000 Word 97-2003 document or template 24874!:mime application/msword 24875!:apple MSWDWDBN 24876# dot for template; no extension on Macintosh 24877!:ext doc/dot/ 24878# 24879# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor 24880>>>80 ubequad 0x0213020000000000 Works 3-4 document or template 24881!:mime application/vnd.ms-works 24882!:apple ????AWWP 24883# ps for template https://filext.com/file-extension/PS bps for backup 24884!:ext wps/ps/bps 24885# 24886# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database 24887>>>80 ubequad 0x0313020000000000 Works 3-4 database or template 24888!:mime application/vnd.ms-works-db 24889# https://www.macdisk.com/macsigen.php 24890!:apple ????AWDB 24891# db for template www.file-extensions.org/db-file-extension-microsoft-works-data bdb for backup 24892!:ext wdb/db/bdb 24893# 24894# URL: https://en.wikipedia.org/wiki/Microsoft_Excel 24895>>>80 ubequad 0x1008020000000000 Excel 5-95 worksheet, addin or template 24896!:mime application/vnd.ms-excel 24897# https://www.macdisk.com/macsigen.php 24898!:apple ????XLS5 24899# worksheet/addin/template/no extension on Macintosh 24900!:ext xls/xla/xlt/ 24901# 24902>>>80 ubequad 0x2008020000000000 Excel 97-2003 24903!:mime application/vnd.ms-excel 24904# https://www.macdisk.com/macsigen.php XLS5 for Excel 5 24905!:apple ????XLS9 24906# 3nd directory entry name 24907>>>>256 lestring16 _VBA_PROJECT_CUR addin 24908!:ext xla/ 24909# 4th directory entry name 24910>>>>384 lestring16 _VBA_PROJECT_CUR addin 24911!:ext xla 24912#!:ext xla/ 24913>>>>256 default x worksheet or template 24914!:ext xls/xlt 24915#!:ext xls/xlt/ 24916# 24917# URL: http://fileformats.archiveteam.org/wiki/OLE2 24918>>>80 ubequad 0x0b0d020000000000 Outlook 97-2003 item 24919#>>>80 ubequad 0x0b0d020000000000 Outlook 97-2003 Message 24920#!:mime application/vnd.ms-outlook 24921!:mime application/x-ms-msg 24922!:ext msg 24923# URL: https://wiki.fileformat.com/email/oft/ 24924>>>80 ubequad 0x46f0060000000000 Outlook 97-2003 item template 24925#!:mime application/vnd.ms-outlook 24926!:mime application/x-ms-oft 24927!:ext oft 24928# 24929# URL: http://fileformats.archiveteam.org/wiki/PPT 24930>>>80 ubequad 0x5148040000000000 PowerPoint 4.0 presentation 24931!:mime application/vnd.ms-powerpoint 24932# https://www.macdisk.com/macsigen.php 24933!:apple ????PPT3 24934!:ext ppt 24935#?? 24936# URL: http://www.checkfilename.com/view-details/Microsoft-Works/RespageIndex/0/sTab/2/ 24937>>88 ubequad 0xa29a00aa004a1a72 : Microsoft 24938# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor 24939>>>80 ubequad 0xc2dbcd28e20ace11 Works 4 document 24940!:mime application/vnd.ms-works 24941!:apple ????AWWP 24942!:ext wps 24943# 24944# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database 24945>>>80 ubequad 0xc3dbcd28e20ace11 Works 4 database 24946!:mime application/vnd.ms-works-db 24947!:apple ????AWDB 24948!:ext wdb/bdb 24949#?? 24950>>88 ubequad 0xa40700c04fb932ba : Microsoft 24951# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor 24952>>>80 ubequad 0xb25aa40e0a9ed111 Works 5-6 document 24953!:mime application/vnd.ms-works 24954!:apple ????AWWP 24955!:ext wps 24956#?? 24957# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Publisher 24958>>88 ubequad 0x00c0000000000046 : Microsoft 24959>>>80 ubequad 0x0112020000000000 Publisher 24960!:mime application/vnd.ms-publisher 24961!:ext pub 24962# 24963# URL: http://fileformats.archiveteam.org/wiki/PPT 24964#?? 24965>>88 ubequad 0xa90300aa00510ea3 : Microsoft 24966>>>80 ubequad 0x70ae7bea3bfbcd11 PowerPoint 95 presentation 24967!:mime application/vnd.ms-powerpoint 24968# https://www.macdisk.com/macsigen.php 24969!:apple ????PPT3 24970!:ext ppt/pot 24971#?? 24972>>88 ubequad 0x86ea00aa00b929e8 : Microsoft 24973>>>80 ubequad 0x108d81649b4fcf11 PowerPoint 97-2003 presentation or template 24974!:mime application/vnd.ms-powerpoint 24975!:apple ????PPT3 24976# /autostart/template 24977!:ext ppt/pps/pot 24978# 24979# URL: https://en.wikipedia.org/wiki/Microsoft_Project 24980#?? 24981>>88 ubequad 0xbe1100c04fb6faf1 : Microsoft 24982>>>80 ubequad 0x3a8fb774c8c8d111 Project 24983!:mime application/vnd.ms-project 24984!:ext mpp 24985# 24986# URL: http://fileformats.archiveteam.org/wiki/SHW_(Corel) 24987#??? 24988>>88 ubequad 0x99ae04021c007002 : WordPerfect 24989>>>80 ubequad 0x62fe2e4099191b10 7-X3 presentation 24990!:mime application/x-corelpresentations 24991#!:mime application/x-shw-viewer 24992#!:mime image/x-presentations 24993!:ext shw 24994# 24995# URL: http://www.checkfilename.com/view-details/WordPerfect-Office-X3/RespageIndex/0/sTab/2/ 24996>>>80 ubequad 0x60fe2e4099191b10 9 Graphic 24997#!:mime application/x-wpg 24998#!:mime image/x-wordperfect-graphics 24999!:mime image/x-wpg 25000# https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd 25001!:apple ????WPC9 25002!:ext wpg 25003# 25004# URL: http://fileformats.archiveteam.org/wiki/StarOffice_binary_formats 25005>>88 ubequad 0x996104021c007002 : StarOffice 25006>>>80 ubequad 0x407e5cdc5cb31b10 StarWriter 3.0 document or template 25007# https://www.openoffice.org/framework/documentation/mimetypes/mimetypes.html 25008!:mime application/x-starwriter 25009!:ext sdw/vor 25010# 25011>>>80 ubequad 0xa03f543fa6b61b10 StarCalc 3.0 spreadsheet or template 25012!:mime application/x-starcalc 25013!:ext sdc/vor 25014# 25015>>>80 ubequad 0xe0aa10af6db31b10 StarDraw 3.0 drawing or template 25016!:mime application/x-starimpress 25017#!:mime application/x-stardraw 25018# sda ?? 25019!:ext sdd/sda/vor 25020#?? 25021>>88 ubequad 0x89cb008029e4b0b1 : StarOffice 25022>>>80 ubequad 0x41d461633542d011 StarCalc 4.0 spreadsheet or template 25023!:mime application/x-starcalc 25024!:ext sdc/vor 25025# 25026>>>80 ubequad 0x61b8a5c6d685d111 StarCalc 5.0 spreadsheet or template 25027!:mime application/vnd.stardivision.cal 25028!:ext sdc/vor 25029# 25030>>>80 ubequad 0xc03c2d011642d011 StarImpress 4.0 presentation or template 25031!:mime application/x-starimpress 25032!:ext sdd/vor 25033#?? 25034>>88 ubequad 0xb12a04021c007002 : StarOffice 25035>>>80 ubequad 0x600459d4fd351c10 StarMath 3.0 25036!:mime application/x-starmath 25037!:ext smf 25038#?? 25039>>88 ubequad 0x8e2c00001b4cc711 : StarOffice 25040>>>80 ubequad 0xe0999cfb6d2c1c10 StarChart 3.0 25041!:mime application/x-starchart 25042!:ext sds 25043#?? 25044>>88 ubequad 0xa45e00a0249d57b1 : StarOffice 25045>>>80 ubequad 0xb0e9048b0e42d011 StarWriter 4.0 document or template 25046!:mime application/x-starwriter 25047!:ext sdw/vor 25048#?? 25049>>88 ubequad 0x89ca008029e4b0b1 : StarOffice 25050>>>80 ubequad 0xe1b7b3022542d011 StarMath 4.0 25051!:mime application/x-starmath 25052!:ext smf 25053# 25054>>>80 ubequad 0xe0b7b3022542d011 StarChart 4.0 25055!:mime application/x-starchart 25056!:ext sds 25057#?? 25058>>88 ubequad 0xa53f00a0249d57b1 : StarOffice 25059>>>80 ubequad 0x70c90a340de3d011 Master 4.0 document 25060!:mime application/x-starwriter-global 25061!:ext sgl 25062#?? 25063>>88 ubequad 0x89d0008029e4b0b1 : StarOffice 25064>>>80 ubequad 0x40e6b5ffde85d111 StarMath 5.0 25065!:mime application/vnd.stardivision.math 25066!:ext smf 25067# 25068>>>80 ubequad 0xa005892ebd85d111 StarDraw 5.0 drawing or template 25069!:mime application/vnd.stardivision.draw 25070!:ext sda/vor 25071# 25072>>>80 ubequad 0x21725c56bc85d111 StarImpress 5.0 presentation or template 25073!:mime application/vnd.stardivision.impress 25074# sda is used for what? 25075!:ext sdd/vor/sda 25076# 25077>>>80 ubequad 0x214388bfdd85d111 StarChart 5.0 25078!:mime application/vnd.stardivision.chart 25079!:ext sds 25080# ?? 25081>>88 ubequad 0xaab4006097da561a : StarOffice 25082>>>80 ubequad 0xd1f90cc2ae85d111 StarWriter 5.0 document or template 25083!:mime application/vnd.stardivision.writer 25084!:ext sdw/vor 25085# 25086>>>80 ubequad 0xd3f90cc2ae85d111 Master 5.0 document 25087!:mime application/vnd.stardivision.writer-global 25088!:ext sgl 25089#?? 25090# URL: http://fileformats.archiveteam.org/wiki/FlashPix 25091>>88 ubequad 0x855300aa00a1f95b : Kodak 25092>>>80 ubequad 0x0067615654c1ce11 FlashPIX Image 25093!:mime image/vnd.fpx 25094!:apple ????FPix 25095!:ext fpx 25096# URL: https://en.wikipedia.org/wiki/SoftMaker_Office 25097>>88 ubequad 0x95f600a0cc3cca14 : PlanMaker 25098>>>80 ubequad 0x9174088a6452d411 document or template 25099!:mime application/vnd.softmaker.planmaker 25100# pmv for template https://www.file-extensions.org/pmv-file-extension 25101!:ext pmd/pmv 25102# remaining non null clsid 25103>>88 default x : UNKNOWN 25104!:mime application/x-ole-storage 25105>>>80 ubequad !0 \b, clsid 0x%16.16llx 25106>>>88 ubequad x \b%16.16llx 25107 25108 25109#------------------------------------------------------------------------------ 25110# $File: olf,v 1.4 2009/09/19 16:28:11 christos Exp $ 25111# olf: file(1) magic for OLF executables 25112# 25113# We have to check the byte order flag to see what byte order all the 25114# other stuff in the header is in. 25115# 25116# MIPS R3000 may also be for MIPS R2000. 25117# What're the correct byte orders for the nCUBE and the Fujitsu VPP500? 25118# 25119# Created by Erik Theisen <etheisen@openbsd.org> 25120# Based on elf from Daniel Quinlan <quinlan@yggdrasil.com> 251210 string \177OLF OLF 25122>4 byte 0 invalid class 25123>4 byte 1 32-bit 25124>4 byte 2 64-bit 25125>7 byte 0 invalid os 25126>7 byte 1 OpenBSD 25127>7 byte 2 NetBSD 25128>7 byte 3 FreeBSD 25129>7 byte 4 4.4BSD 25130>7 byte 5 Linux 25131>7 byte 6 SVR4 25132>7 byte 7 esix 25133>7 byte 8 Solaris 25134>7 byte 9 Irix 25135>7 byte 10 SCO 25136>7 byte 11 Dell 25137>7 byte 12 NCR 25138>5 byte 0 invalid byte order 25139>5 byte 1 LSB 25140>>16 leshort 0 no file type, 25141>>16 leshort 1 relocatable, 25142>>16 leshort 2 executable, 25143>>16 leshort 3 shared object, 25144# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de> 25145# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> 25146>>16 leshort 4 core file 25147>>>(0x38+0xcc) string >\0 of '%s' 25148>>>(0x38+0x10) lelong >0 (signal %d), 25149>>16 leshort &0xff00 processor-specific, 25150>>18 leshort 0 no machine, 25151>>18 leshort 1 AT&T WE32100 - invalid byte order, 25152>>18 leshort 2 SPARC - invalid byte order, 25153>>18 leshort 3 Intel 80386, 25154>>18 leshort 4 Motorola 68000 - invalid byte order, 25155>>18 leshort 5 Motorola 88000 - invalid byte order, 25156>>18 leshort 6 Intel 80486, 25157>>18 leshort 7 Intel 80860, 25158>>18 leshort 8 MIPS R3000_BE - invalid byte order, 25159>>18 leshort 9 Amdahl - invalid byte order, 25160>>18 leshort 10 MIPS R3000_LE, 25161>>18 leshort 11 RS6000 - invalid byte order, 25162>>18 leshort 15 PA-RISC - invalid byte order, 25163>>18 leshort 16 nCUBE, 25164>>18 leshort 17 VPP500, 25165>>18 leshort 18 SPARC32PLUS, 25166>>18 leshort 20 PowerPC, 25167>>18 leshort 0x9026 Alpha, 25168>>20 lelong 0 invalid version 25169>>20 lelong 1 version 1 25170>>36 lelong 1 MathCoPro/FPU/MAU Required 25171>8 string >\0 (%s) 25172>5 byte 2 MSB 25173>>16 beshort 0 no file type, 25174>>16 beshort 1 relocatable, 25175>>16 beshort 2 executable, 25176>>16 beshort 3 shared object, 25177>>16 beshort 4 core file, 25178>>>(0x38+0xcc) string >\0 of '%s' 25179>>>(0x38+0x10) belong >0 (signal %d), 25180>>16 beshort &0xff00 processor-specific, 25181>>18 beshort 0 no machine, 25182>>18 beshort 1 AT&T WE32100, 25183>>18 beshort 2 SPARC, 25184>>18 beshort 3 Intel 80386 - invalid byte order, 25185>>18 beshort 4 Motorola 68000, 25186>>18 beshort 5 Motorola 88000, 25187>>18 beshort 6 Intel 80486 - invalid byte order, 25188>>18 beshort 7 Intel 80860, 25189>>18 beshort 8 MIPS R3000_BE, 25190>>18 beshort 9 Amdahl, 25191>>18 beshort 10 MIPS R3000_LE - invalid byte order, 25192>>18 beshort 11 RS6000, 25193>>18 beshort 15 PA-RISC, 25194>>18 beshort 16 nCUBE, 25195>>18 beshort 17 VPP500, 25196>>18 beshort 18 SPARC32PLUS, 25197>>18 beshort 20 PowerPC or cisco 4500, 25198>>18 beshort 21 cisco 7500, 25199>>18 beshort 24 cisco SVIP, 25200>>18 beshort 25 cisco 7200, 25201>>18 beshort 36 cisco 12000, 25202>>18 beshort 0x9026 Alpha, 25203>>20 belong 0 invalid version 25204>>20 belong 1 version 1 25205>>36 belong 1 MathCoPro/FPU/MAU Required 25206 25207#------------------------------------------------------------------------------ 25208# $File: openfst,v 1.1 2019/09/30 15:58:24 christos Exp $ 25209# openfs: file(1) magic for OpenFST (Weighted finite-state tranducer library) 25210 252110 long 0x7eb2fdd6 OpenFst binary FST data 25212>&0 pstring/l x \b, fst type: %s 25213>>&0 pstring/l x \b, arc type: %s 25214>>>&0 long x \b, version: %d 25215>>>>&20 quad x \b, num states: %lld 25216>>>>>&0 quad >0 \b, num arcs: %lld 25217 252180 long 0x56515c OpenFst binary FAR data, far type: stlist 25219>4 long x \b, version: %d 25220 252210 long 0x7eb2f35c OpenFst binary FAR data, far type: sttable 25222>4 long x \b, version: %d 25223 25224#------------------------------------------------------------ 25225# $File: opentimestamps,v 1.1 2019/05/27 01:27:31 christos Exp $ 25226# OpenTimestamps related magic entries 25227# https://opentimestamps.org/ 25228# https://en.wikipedia.org/wiki/OpenTimestamps 25229# "Emanuele Cisbani" <emanuele.cisbani@gmail.com> 25230#------------------------------------------------------------ 25231 25232# OpenTimestamps Proof .ots format. 25233# Magic is defined here: 25234# https://github.com/opentimestamps/python-opentimestamps/\ 25235# blob/master/opentimestamps/core/timestamp.py#L273 25236 252370 string \x00\x4f\x70\x65\x6e\x54\x69\x6d\x65\x73\x74\x61\x6d\x70\x73\x00 OpenTimestamps 25238>16 string \x00\x50\x72\x6f\x6f\x66\x00\xbf\x89\xe2\xe8\x84\xe8\x92\x94\x01 Proof 25239 25240#------------------------------------------------------------------------------ 25241# $File: os2,v 1.10 2017/03/17 21:35:28 christos Exp $ 25242# os2: file(1) magic for OS/2 files 25243# 25244 25245# Provided 1998/08/22 by 25246# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net> 252471 search/100 InternetShortcut MS Windows 95 Internet shortcut text 25248>17 search/100 URL= (URL=< 25249>>&0 string x \b%s>) 25250 25251# OS/2 URL objects 25252# Provided 1998/08/22 by 25253# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net> 25254#0 string http: OS/2 URL object text 25255#>5 string >\ (WWW) <http:%s> 25256#0 string mailto: OS/2 URL object text 25257#>7 string >\ (email) <%s> 25258#0 string news: OS/2 URL object text 25259#>5 string >\ (Usenet) <%s> 25260#0 string ftp: OS/2 URL object text 25261#>4 string >\ (FTP) <ftp:%s> 25262#0 string file: OS/2 URL object text 25263#>5 string >\ (Local file) <%s> 25264 25265# >>>>> OS/2 INF/HLP <<<<< (source: Daniel Dissett ddissett@netcom.com) 25266# Carl Hauser (chauser.parc@xerox.com) and 25267# Marcus Groeber (marcusg@ph-cip.uni-koeln.de) 25268# list the following header format in inf02a.doc: 25269# 25270# int16 ID; // ID magic word (5348h = "HS") 25271# int8 unknown1; // unknown purpose, could be third letter of ID 25272# int8 flags; // probably a flag word... 25273# // bit 0: set if INF style file 25274# // bit 4: set if HLP style file 25275# // patching this byte allows reading HLP files 25276# // using the VIEW command, while help files 25277# // seem to work with INF settings here as well. 25278# int16 hdrsize; // total size of header 25279# int16 unknown2; // unknown purpose 25280# 252810 string HSP\x01\x9b\x00 OS/2 INF 25282>107 string >0 (%s) 252830 string HSP\x10\x9b\x00 OS/2 HLP 25284>107 string >0 (%s) 25285 25286# OS/2 INI (this is a guess) 252870 string \xff\xff\xff\xff\x14\0\0\0 OS/2 INI 25288 25289#------------------------------------------------------------------------------ 25290# $File: os400,v 1.5 2009/09/19 16:28:11 christos Exp $ 25291# os400: file(1) magic for IBM OS/400 files 25292# 25293# IBM OS/400 (i5/OS) Save file (SAVF) - gerardo.cacciari@gmail.com 25294# In spite of its quite variable format (due to internal memory page 25295# length differences between CISC and RISC versions of the OS) the 25296# SAVF structure hasn't suitable offsets to identify the catalog 25297# header in the first descriptor where there are some useful infos, 25298# so we must search in a somewhat large area for a particular string 25299# that represents the EBCDIC encoding of 'QSRDSSPC' (save/restore 25300# descriptor space) preceded by a two byte constant. 25301# 253021090 search/7393 \x19\xDB\xD8\xE2\xD9\xC4\xE2\xE2\xD7\xC3 IBM OS/400 save file data 25303>&212 byte 0x01 \b, created with SAVOBJ 25304>&212 byte 0x02 \b, created with SAVLIB 25305>&212 byte 0x07 \b, created with SAVCFG 25306>&212 byte 0x08 \b, created with SAVSECDTA 25307>&212 byte 0x0A \b, created with SAVSECDTA 25308>&212 byte 0x0B \b, created with SAVDLO 25309>&212 byte 0x0D \b, created with SAVLICPGM 25310>&212 byte 0x11 \b, created with SAVCHGOBJ 25311>&213 byte 0x44 \b, at least V5R4 to open 25312>&213 byte 0x43 \b, at least V5R3 to open 25313>&213 byte 0x42 \b, at least V5R2 to open 25314>&213 byte 0x41 \b, at least V5R1 to open 25315>&213 byte 0x40 \b, at least V4R5 to open 25316>&213 byte 0x3F \b, at least V4R4 to open 25317>&213 byte 0x3E \b, at least V4R3 to open 25318>&213 byte 0x3C \b, at least V4R2 to open 25319>&213 byte 0x3D \b, at least V4R1M4 to open 25320>&213 byte 0x3B \b, at least V4R1 to open 25321>&213 byte 0x3A \b, at least V3R7 to open 25322>&213 byte 0x35 \b, at least V3R6 to open 25323>&213 byte 0x36 \b, at least V3R2 to open 25324>&213 byte 0x34 \b, at least V3R1 to open 25325>&213 byte 0x31 \b, at least V3R0M5 to open 25326>&213 byte 0x30 \b, at least V2R3 to open 25327 25328#------------------------------------------------------------------------------ 25329# $File: os9,v 1.8 2017/03/17 21:35:28 christos Exp $ 25330# 25331# Copyright (c) 1996 Ignatios Souvatzis. All rights reserved. 25332# 25333# Redistribution and use in source and binary forms, with or without 25334# modification, are permitted provided that the following conditions 25335# are met: 25336# 1. Redistributions of source code must retain the above copyright 25337# notice, this list of conditions and the following disclaimer. 25338# 2. Redistributions in binary form must reproduce the above copyright 25339# notice, this list of conditions and the following disclaimer in the 25340# documentation and/or other materials provided with the distribution. 25341# 25342# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 25343# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 25344# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 25345# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 25346# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, 25347# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; 25348# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, 25349# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR 25350# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF 25351# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 25352# 25353# 25354# 25355# OS9/6809 module descriptions: 25356# 253570 beshort 0x87CD OS9/6809 module: 25358# 25359>6 byte&0x0f 0x00 non-executable 25360>6 byte&0x0f 0x01 machine language 25361>6 byte&0x0f 0x02 BASIC I-code 25362>6 byte&0x0f 0x03 Pascal P-code 25363>6 byte&0x0f 0x04 C I-code 25364>6 byte&0x0f 0x05 COBOL I-code 25365>6 byte&0x0f 0x06 Fortran I-code 25366# 25367>6 byte&0xf0 0x10 program executable 25368>6 byte&0xf0 0x20 subroutine 25369>6 byte&0xf0 0x30 multi-module 25370>6 byte&0xf0 0x40 data module 25371# 25372>6 byte&0xf0 0xC0 system module 25373>6 byte&0xf0 0xD0 file manager 25374>6 byte&0xf0 0xE0 device driver 25375>6 byte&0xf0 0xF0 device descriptor 25376# 25377# OS9/m68k stuff (to be continued) 25378# 253790 beshort 0x4AFC OS9/68K module: 25380# 25381# attr 25382>0x14 byte&0x80 0x80 re-entrant 25383>0x14 byte&0x40 0x40 ghost 25384>0x14 byte&0x20 0x20 system-state 25385# 25386# lang: 25387# 25388>0x13 byte 1 machine language 25389>0x13 byte 2 BASIC I-code 25390>0x13 byte 3 Pascal P-code 25391>0x13 byte 4 C I-code 25392>0x13 byte 5 COBOL I-code 25393>0x13 byte 6 Fortran I-code 25394# 25395# 25396# type: 25397# 25398>0x12 byte 1 program executable 25399>0x12 byte 2 subroutine 25400>0x12 byte 3 multi-module 25401>0x12 byte 4 data module 25402>0x12 byte 11 trap library 25403>0x12 byte 12 system module 25404>0x12 byte 13 file manager 25405>0x12 byte 14 device driver 25406>0x12 byte 15 device descriptor 25407 25408#------------------------------------------------------------------------------ 25409# $File: osf1,v 1.7 2009/09/19 16:28:11 christos Exp $ 25410# 25411# Mach magic number info 25412# 254130 long 0xefbe OSF/Rose object 25414# I386 magic number info 25415# 254160 short 0565 i386 COFF object 25417 25418#------------------------------------------------------------------------------ 25419# $File: palm,v 1.14 2019/04/19 00:42:27 christos Exp $ 25420# palm: file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks 25421# 25422# Brian Lalor <blalor@hcirisc.cs.binghamton.edu> 25423 25424# These are weak, byte 59 is not guaranteed to be 0 and there are 25425# 8 character identifiers at byte 60, one I found for appl is BIGb. 25426# What are the possibilities and where is this documented? 25427 25428# The common header format for PalmOS .pdb/.prc files is 25429# { 25430# char name[ 32 ]; 25431# Word attributes; 25432# Word version; 25433# DWord creationDate; 25434# DWord modificationDate; 25435# DWord lastBackupDate; 25436# DWord modificationNumber; 25437# DWord appInfoID; 25438# DWord sortInfoID; 25439# char type[4]; 25440# char creator[4]; 25441# DWord uniqueIDSeed; 25442# RecordListType recordList; 25443# }; 25444# 25445# Datestamps are unsigned seconds since the MacOS epoch (Jan 1, 1904), 25446# or Unix/POSIX time + 2082844800. 25447 254480 name aportisdoc 25449# date is supposed to be big-endian seconds since 1 Jan 1904, but many 25450# files contain the timestamp in little-endian or a completely 25451# nonsensical value... 25452#>36 bedate-2082844800 >0 \b, created %s 25453# compression: 1=uncomp, 2=orig, 0x4448=HuffDic 25454>(78.L) beshort =1 \b, uncompressed 25455# compressed 25456>(78.L) beshort >1 25457>>(78.L+4) belong x \b, %d bytes uncompressed 25458 25459# appl 25460#60 string appl PalmOS application 25461#>0 string >\0 "%s" 25462 25463# HACK 25464#60 string HACK HackMaster hack 25465#>0 string >\0 "%s" 25466 25467# iSiloX e-book 2546860 string SDocSilX iSiloX E-book 25469>0 string >\0 "%s" 25470 25471# Mobipocket (www.mobipocket.com), donated by Carl Witty 25472# expanded by Ralf Brown 2547360 string BOOKMOBI Mobipocket E-book 25474# MobiPocket stores a full title, pointed at by the belong at offset 25475# 0x54 in its header at (78.L), with length given by the belong at 25476# offset 0x58. 25477# there's no guarantee that the title string is null-terminated, but 25478# we currently can't specify a variable-length string where the length 25479# field is not at the start of the string; in practice, the data 25480# following the string always seems to start with a zero byte 25481>(78.L) belong x 25482>>&(&0x50.L-4) string >\0 "%s" 25483>0 use aportisdoc 25484>>(78.L+0x68) belong >0 \b, version %d 25485>>(78.L+0x1C) belong !0 \b, codepage %d 25486>>(78.L+0x0C) beshort >0 \b, encrypted (type %d) 25487 25488# AportisDoc/PalmDOC 2548960 string TEXtREAd AportisDoc/PalmDOC E-book 25490>0 string >\0 "%s" 25491>0 use aportisdoc 25492 25493# Variety of PalmOS document types 25494# Michael-John Turner <mj@debian.org> 25495# Thanks to Hasan Umit Ezerce <humit@tr-net.net.tr> for his DocType 2549660 string BVokBDIC BDicty PalmOS document 25497>0 string >\0 "%s" 2549860 string DB99DBOS DB PalmOS document 25499>0 string >\0 "%s" 2550060 string vIMGView FireViewer/ImageViewer PalmOS document 25501>0 string >\0 "%s" 2550260 string PmDBPmDB HanDBase PalmOS document 25503>0 string >\0 "%s" 2550460 string InfoINDB InfoView PalmOS document 25505>0 string >\0 "%s" 2550660 string ToGoToGo iSilo PalmOS document 25507>0 string >\0 "%s" 2550860 string JfDbJBas JFile PalmOS document 25509>0 string >\0 "%s" 2551060 string JfDbJFil JFile Pro PalmOS document 25511>0 string >\0 "%s" 2551260 string DATALSdb List PalmOS document 25513>0 string >\0 "%s" 2551460 string Mdb1Mdb1 MobileDB PalmOS document 25515>0 string >\0 "%s" 2551660 string PNRdPPrs PeanutPress PalmOS document 25517>0 string >\0 "%s" 2551860 string DataPlkr Plucker PalmOS document 25519>0 string >\0 "%s" 2552060 string DataSprd QuickSheet PalmOS document 25521>0 string >\0 "%s" 2552260 string SM01SMem SuperMemo PalmOS document 25523>0 string >\0 "%s" 2552460 string TEXtTlDc TealDoc PalmOS document 25525>0 string >\0 "%s" 2552660 string InfoTlIf TealInfo PalmOS document 25527>0 string >\0 "%s" 2552860 string DataTlMl TealMeal PalmOS document 25529>0 string >\0 "%s" 2553060 string DataTlPt TealPaint PalmOS document 25531>0 string >\0 "%s" 2553260 string dataTDBP ThinkDB PalmOS document 25533>0 string >\0 "%s" 2553460 string TdatTide Tides PalmOS document 25535>0 string >\0 "%s" 2553660 string ToRaTRPW TomeRaider PalmOS document 25537>0 string >\0 "%s" 25538 25539# A GutenPalm zTXT etext for use on Palm Pilots (http://gutenpalm.sf.net) 25540# For version 1.xx zTXTs, outputs version and numbers of bookmarks and 25541# annotations. 25542# For other versions, just outputs version. 25543# 2554460 string zTXT A GutenPalm zTXT e-book 25545>0 string >\0 "%s" 25546>(0x4E.L) byte 0 25547>>(0x4E.L+1) byte x (v0.%02d) 25548>(0x4E.L) byte 1 25549>>(0x4E.L+1) byte x (v1.%02d) 25550>>>(0x4E.L+10) beshort >0 25551>>>>(0x4E.L+10) beshort <2 - 1 bookmark 25552>>>>(0x4E.L+10) beshort >1 - %d bookmarks 25553>>>(0x4E.L+14) beshort >0 25554>>>>(0x4E.L+14) beshort <2 - 1 annotation 25555>>>>(0x4E.L+14) beshort >1 - %d annotations 25556>(0x4E.L) byte >1 (v%d. 25557>>(0x4E.L+1) byte x %02d) 25558 25559# Palm OS .prc file types 2556060 string libr 25561# flags, only bit 0 or bit 6 25562# https://en.wikipedia.org/wiki/PRC_%28Palm_OS%29 25563# https://web.mit.edu/tytso/www/pilot/prc-format.html 25564>0x20 beshort&0xffbe 0 25565>>0 string >\0 Palm OS dynamic library data "%s" 2556660 string ptch Palm OS operating system patch data 25567>0 string >\0 "%s" 25568 25569# Mobipocket (www.mobipocket.com), donated by Carl Witty 2557060 string BOOKMOBI Mobipocket E-book 25571>0 string >\0 "%s" 25572 25573#------------------------------------------------------------------------------ 25574# $File: parix,v 1.5 2020/03/08 22:18:32 christos Exp $ 25575# 25576# Parix COFF executables 25577# From: Ignatios Souvatzis <ignatios@cs.uni-bonn.de> 25578# 255790 beshort&0xefff 0x8ACE PARIX 25580>0 byte&0xf0 0x80 T800 25581>0 byte&0xf0 0x90 T9000 25582>19 byte&0x02 0x02 executable 25583>19 byte&0x02 0x00 object 25584>19 byte&0x0c 0x00 not stripped 25585#------------------------------------------------------------------------------ 25586# $File: parrot,v 1.2 2019/04/19 00:42:27 christos Exp $ 25587# parrot: file(1) magic for Parrot Virtual Machine 25588# URL: https://www.lua.org/ 25589# From: Lubomir Rintel <lkundrak@v3.sk> 25590 25591# Compiled Parrot byte code 255920 string \376PBC\r\n\032\n Parrot bytecode 25593>64 byte x %d. 25594>72 byte x \b%d, 25595>8 byte >0 %d byte words, 25596>16 byte 0 little-endian, 25597>16 byte 1 big-endian, 25598>32 byte 0 IEEE-754 8 byte double floats, 25599>32 byte 1 x86 12 byte long double floats, 25600>32 byte 2 IEEE-754 16 byte long double floats, 25601>32 byte 3 MIPS 16 byte long double floats, 25602>32 byte 4 AIX 16 byte long double floats, 25603>32 byte 5 4-byte floats, 25604>40 byte x Parrot %d. 25605>48 byte x \b%d. 25606>56 byte x \b%d 25607#------------------------------------------------------------------------------ 25608# $File: pascal,v 1.3 2020/06/07 18:10:26 christos Exp $ 25609# pascal: file(1) magic for Pascal source 25610# 256110 search/8192 (input, Pascal source text 25612!:mime text/x-pascal 25613#0 regex \^program Pascal source text 25614#!:mime text/x-pascal 25615#0 regex \^record Pascal source text 25616#!:mime text/x-pascal 25617 25618# Free Pascal 256190 string PPU Pascal unit 25620>3 string x \b, version %s 25621 25622#------------------------------------------------------------------------------ 25623# $File: pbf,v 1.3 2019/04/19 00:42:27 christos Exp $ 25624# file(1) magic(5) data for OpenStreetMap 25625 25626# OpenStreetMap Protocolbuffer Binary Format (.osm.pbf) 25627# https://wiki.openstreetmap.org/wiki/PBF_Format 25628# From: Markus Heidelberg <markus.heidelberg@web.de> 256290 belong&0xfffffff0 0 25630>4 beshort 0x0A09 25631>>6 string OSMHeader OpenStreetMap Protocolbuffer Binary Format 25632 25633#------------------------------------------------------------------------------ 25634# $File: pbm,v 1.6 2009/09/19 16:28:11 christos Exp $ 25635# pbm: file(1) magic for Portable Bitmap files 25636# 25637# XXX - byte order? 25638# 256390 short 0x2a17 "compact bitmap" format (Poskanzer) 25640#------------------------------------------------------------------------------ 25641# pc88: file(1) magic for the NEC Home Computer 25642# v1.0 25643# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net> 25644 25645# PC88 2D disk image 256460x20 ulelong&0xFFFFFEFF 0x2A0 25647>0x10 string \0\0\0\0\0\0\0\0\0\0 25648>>0x280 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 25649>>>0x1A ubyte&0xEF 0 25650>>>>0x1B ubyte&0x8F 0 25651>>>>>0x1B ubyte&70 <0x40 25652>>>>>>0x1C ulelong >0x21 25653>>>>>>>0 regex [[:print:]]* NEC PC-88 disk image, name=%s 25654>>>>>>>>0x1B ubyte 0 \b, media=2D 25655>>>>>>>>0x1B ubyte 0x10 \b, media=2DD 25656>>>>>>>>0x1B ubyte 0x20 \b, media=2HD 25657>>>>>>>>0x1B ubyte 0x30 \b, media=1D 25658>>>>>>>>0x1B ubyte 0x40 \b, media=1DD 25659>>>>>>>>0x1A ubyte 0x10 \b, write-protected 25660 25661 25662 25663 25664#------------------------------------------------------------------------------ 25665# pc98: file(1) magic for the MSX Home Computer 25666# v1.0 25667# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net> 25668 25669# Maki-chan v1 Graphic format 25670# The image resolution should be X=(44.L - 40.L) and Y=(46.L - 42.L), but I couldn't find a way to do so 25671# http://www.jisyo.com/viewer/faq/maki_tech.htm 256720 string/b MAKI01 Maki-chan v1. 25673>6 ubyte|0x20 x \b%c image 25674>8 ubelong >0x40404040 \b, system ID: 25675>>8 byte x %c 25676>>9 byte x \b%c 25677>>10 byte x \b%c 25678>>11 byte x \b%c 25679>44 ubeshort x \b, %dx 25680>46 ubeshort x \b%d 25681>38 ubeshort&2 0 \b, 16 paletted RGB colors 25682>38 ubeshort&2 2 \b, 8 fixed RGB colors 25683>38 ubeshort&1 1 \b, 2:1 dot aspect ratio 25684 25685# Maki-chan v2 Graphic format 25686# http://www.jisyo.com/viewer/faq/mag_tech.htm 25687# https://mooncore.eu/bunny/txt/makichan.htm 25688# http://metanest.jp/mag/mag.xhtml 256890 string/b MAKI02\ \ Maki-chan v2 image, 25690>8 byte x system ID: %c 25691>9 byte x \b%c 25692>10 byte x \b%c 25693>11 byte x \b%c, 25694>13 search/0x200 \x1A 25695#Maki-chan video modes are a bit messy and seems to have been expanded over the years without too much planing: 25696#1) When offset1(ubeshort) !=0x0344: 25697# 1.1) And offset3(ubyte).b7=0: 25698# - b0=pixel aspect ratio: 1=2:1 (note: this ignores that the machine's 1:1 pixel aspect ratio isn't really 1:1) 25699# - b1=number of colors: 0=16 colors, 1=8 colors 25700# - b2=Palette or fixed colors flag (called "analog" and "digital" in the doc): 0=Paletted, 1=Fixed colors encoded directly in the pixel data 25701# 1.2) And offset3(ubyte).B7=1: 25702# - b0=256 paletted colors 25703# - b1=256 fixed colors using the MSX SCR8 palette 25704#2) When offset1(ubeshort) =0x0344: 25705# - 256x212 image with 19268 YJK colors. The usual resolution and color information fields from the file must be ignored 25706>>&1 ubeshort 0x0344 256x212, 19268 fixed YJK colors 25707>>&1 ubeshort !0x0344 25708>>>&5 uleshort+1 x %dx 25709>>>&7 uleshort+1 x \b%d, 25710>>>&0 ubyte&0x86 0x00 16 paletted RGB colors 25711>>>&0 ubyte&0x86 0x02 8 paletted RGB colors 25712>>>&0 ubyte&0x86 0x04 16 fixed RGB colors 25713>>>&0 ubyte&0x86 0x06 8 fixed RGB colors 25714>>>&0 ubyte&0x81 0x80 256 paletted RGB colors 25715>>>&0 ubyte&0x81 0x81 256 fixed MSX-SCR8 colors 25716>>>&0 ubyte&0x01 1 \b, 2:1 dot aspect ratio 25717 25718# XLD4 (Q4) picture 2571911 string/b MAJYO XLD4(Q4) picture 25720 25721# Yanagisawa Pi picture 25722#0 string Pi\x1A\0 Yanagisawa Pi picture 25723#>3 search/0x200 \x04 257240 string Pi 25725>2 search/0x200 \x1A 25726>>&0 ubyte 0 25727>>>&3 ubyte 4 Yanagisawa Pi 16 color picture, 25728>>>&4 byte x system ID: %c 25729>>>&5 byte x \b%c 25730>>>&6 byte x \b%c 25731>>>&7 byte x \b%c, 25732>>>&10 ubeshort x %dx 25733>>>&12 ubeshort x \b%d 25734>>>&3 ubyte 8 Yanagisawa Pi 256 color picture 25735>>>&4 byte x system ID: %c 25736>>>&5 byte x \b%c 25737>>>&6 byte x \b%c 25738>>>&7 byte x \b%c, 25739>>>&10 ubeshort x %dx 25740>>>&12 ubeshort x \b%d 25741 25742#------------------------------------------------------------------------------ 25743# $File: pdf,v 1.12 2020/01/30 01:48:44 christos Exp $ 25744# pdf: file(1) magic for Portable Document Format 25745# 25746 257470 name pdf 25748>8 search/512 /Filter/FlateDecode/ (password protected) 25749 257500 string %PDF- PDF document 25751!:mime application/pdf 25752!:strength +60 25753>5 byte x \b, version %c 25754>7 byte x \b.%c 25755>0 use pdf 25756 257570 string \012%PDF- PDF document 25758!:mime application/pdf 25759!:strength +60 25760>6 byte x \b, version %c 25761>8 byte x \b.%c 25762>0 use pdf 25763 257640 string \xef\xbb\xbf%PDF- PDF document (UTF-8) 25765!:mime application/pdf 25766!:strength +60 25767>6 byte x \b, version %c 25768>8 byte x \b.%c 25769>0 use pdf 25770 25771# From: Nick Schmalenberger <nick@schmalenberger.us> 25772# Forms Data Format 257730 string %FDF- FDF document 25774!:mime application/vnd.fdf 25775!:strength +60 25776>5 byte x \b, version %c 25777>7 byte x \b.%c 25778 257790 search/256 %PDF- PDF document 25780!:mime application/pdf 25781!:strength +60 25782>&0 byte x \b, version %c 25783>&2 byte x \b.%c 25784>0 use pdf 25785 25786#------------------------------------------------------------------------------ 25787# $File: pdp,v 1.11 2017/03/17 21:35:28 christos Exp $ 25788# pdp: file(1) magic for PDP-11 executable/object and APL workspace 25789# 257900 lelong 0101555 PDP-11 single precision APL workspace 257910 lelong 0101554 PDP-11 double precision APL workspace 25792# 25793# PDP-11 a.out 25794# 257950 leshort 0407 PDP-11 executable 25796>8 leshort >0 not stripped 25797>15 byte >0 - version %d 25798 25799# updated by Joerg Jenderek at Mar 2013 25800# GRR: line below too general as it catches also Windows precompiled setup information *.PNF 258010 leshort 0401 25802# skip *.PNF with WinDirPathOffset 58h 25803>68 ulelong !0x00000058 PDP-11 UNIX/RT ldp 25804# skip *.PNF with high byte of InfVersionDatumCount zero 25805#>>15 byte !0 PDP-11 UNIX/RT ldp 258060 leshort 0405 PDP-11 old overlay 25807 258080 leshort 0410 PDP-11 pure executable 25809>8 leshort >0 not stripped 25810>15 byte >0 - version %d 25811 258120 leshort 0411 PDP-11 separate I&D executable 25813>8 leshort >0 not stripped 25814>15 byte >0 - version %d 25815 258160 leshort 0437 PDP-11 kernel overlay 25817 25818# These last three are derived from 2.11BSD file(1) 258190 leshort 0413 PDP-11 demand-paged pure executable 25820>8 leshort >0 not stripped 25821 258220 leshort 0430 PDP-11 overlaid pure executable 25823>8 leshort >0 not stripped 25824 258250 leshort 0431 PDP-11 overlaid separate executable 25826>8 leshort >0 not stripped 25827#------------------------------------------------------------------------------ 25828# $File: perl,v 1.26 2017/02/21 18:34:55 christos Exp $ 25829# perl: file(1) magic for Larry Wall's perl language. 25830# 25831# The `eval' lines recognizes an outrageously clever hack. 25832# Keith Waclena <keith@cerberus.uchicago.edu> 25833# Send additions to <perl5-porters@perl.org> 258340 search/1024 eval\ "exec\ perl Perl script text 25835!:mime text/x-perl 258360 search/1024 eval\ "exec\ /bin/perl Perl script text 25837!:mime text/x-perl 258380 search/1024 eval\ "exec\ /usr/bin/perl Perl script text 25839!:mime text/x-perl 258400 search/1024 eval\ "exec\ /usr/local/bin/perl Perl script text 25841!:mime text/x-perl 258420 search/1024 eval\ 'exec\ perl Perl script text 25843!:mime text/x-perl 258440 search/1024 eval\ 'exec\ /bin/perl Perl script text 25845!:mime text/x-perl 258460 search/1024 eval\ 'exec\ /usr/bin/perl Perl script text 25847!:mime text/x-perl 258480 search/1024 eval\ 'exec\ /usr/local/bin/perl Perl script text 25849!:mime text/x-perl 258500 search/1024 eval\ '(exit\ $?0)'\ &&\ eval\ 'exec Perl script text 25851!:mime text/x-perl 258520 string #!/usr/bin/env\ perl Perl script text executable 25853!:mime text/x-perl 258540 string #!\ /usr/bin/env\ perl Perl script text executable 25855!:mime text/x-perl 258560 string #! 25857>0 regex \^#!.*/bin/perl([[:space:]].*)*$ Perl script text executable 25858!:mime text/x-perl 25859 25860# by Dmitry V. Levin and Alexey Tourbin 25861# check the first line 258620 search/8192 package 25863>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; Perl5 module source text 25864!:strength + 40 25865# not 'p', check other lines 258660 search/8192 !p 25867>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; 25868>>0 regex \^1\ *;|\^(use|sub|my)\ .*[(;{=] Perl5 module source text 25869!:strength + 75 25870 25871# Perl POD documents 25872# From: Tom Hukins <tom@eborcom.com> 258730 search/1024/W \=pod\n Perl POD document text 258740 search/1024/W \n\=pod\n Perl POD document text 258750 search/1024/W \=head1\ Perl POD document text 258760 search/1024/W \n\=head1\ Perl POD document text 258770 search/1024/W \=head2\ Perl POD document text 258780 search/1024/W \n\=head2\ Perl POD document text 258790 search/1024/W \=encoding\ Perl POD document text 258800 search/1024/W \n\=encoding\ Perl POD document text 25881 25882 25883# Perl Storable data files. 258840 string perl-store perl Storable (v0.6) data 25885>4 byte >0 (net-order %d) 25886>>4 byte &01 (network-ordered) 25887>>4 byte =3 (major 1) 25888>>4 byte =2 (major 1) 25889 258900 string pst0 perl Storable (v0.7) data 25891>4 byte >0 25892>>4 byte &01 (network-ordered) 25893>>4 byte =5 (major 2) 25894>>4 byte =4 (major 2) 25895>>5 byte >0 (minor %d) 25896 25897# This is Debian #742949 by Zefram <zefram@fysh.org>: 25898# ----------------------------------------------------------- 25899# The Perl module Hash::SharedMem 25900# <https://metacpan.org/release/Hash-SharedMem> defines a file format 25901# for a key/value store. Details of the file format are in the "DESIGN" 25902# file in the module distribution. Magic: 259030 bequad =0xa58afd185cbf5af7 Hash::SharedMem master file, big-endian 25904>8 bequad <0x1000000 25905>>15 byte >2 \b, line size 2^%d byte 25906>>14 byte >2 \b, page size 2^%d byte 25907>>13 byte &1 25908>>>13 byte >1 \b, max fanout %d 259090 lequad =0xa58afd185cbf5af7 Hash::SharedMem master file, little-endian 25910>8 lequad <0x1000000 25911>>8 byte >2 \b, line size 2^%d byte 25912>>9 byte >2 \b, page size 2^%d byte 25913>>10 byte &1 25914>>>10 byte >1 \b, max fanout %d 259150 bequad =0xc693dac5ed5e47c2 Hash::SharedMem data file, big-endian 25916>8 bequad <0x1000000 25917>>15 byte >2 \b, line size 2^%d byte 25918>>14 byte >2 \b, page size 2^%d byte 25919>>13 byte &1 25920>>>13 byte >1 \b, max fanout %d 259210 lequad =0xc693dac5ed5e47c2 Hash::SharedMem data file, little-endian 25922>8 lequad <0x1000000 25923>>8 byte >2 \b, line size 2^%d byte 25924>>9 byte >2 \b, page size 2^%d byte 25925>>10 byte &1 25926>>>10 byte >1 \b, max fanout %d 25927 25928#------------------------------------------------------------------------------ 25929# $File: pgf,v 1.2 2017/03/17 21:35:28 christos Exp $ 25930# pgf: file(1) magic for Progressive Graphics File (PGF) 25931# 25932# <http://www.libpgf.org/uploads/media/PGF_Details_01.pdf> 25933# 2013 by Philipp Hahn <pmhahn debian org> 259340 string PGF Progressive Graphics image data, 25935!:mime image/x-pgf 25936>3 string 2 version %s, 25937>3 string 4 version %s, 25938>3 string 5 version %s, 25939>3 string 6 version %s, 25940# PGFPreHeader 25941#>>4 lelong x header size %d, 25942# PGFHeader 25943>>8 lelong x %d x 25944>>12 lelong x %d, 25945>>16 byte x %d levels, 25946>>17 byte x compression level %d, 25947>>18 byte x %d bpp, 25948>>19 byte x %d channels, 25949>>20 clear x 25950>>20 byte 0 bitmap, 25951>>20 byte 1 gray scale, 25952>>20 byte 2 indexed color, 25953>>20 byte 3 RGB color, 25954>>20 byte 4 CYMK color, 25955>>20 byte 5 HSL color, 25956>>20 byte 6 HSB color, 25957>>20 byte 7 multi-channel, 25958>>20 byte 8 duo tone, 25959>>20 byte 9 LAB color, 25960>>20 byte 10 gray scale 16, 25961>>20 byte 11 RGB color 48, 25962>>20 byte 12 LAB color 48, 25963>>20 byte 13 CYMK color 64, 25964>>20 byte 14 deep multi-channel, 25965>>20 byte 15 duo tone 16, 25966>>20 byte 17 RGBA color, 25967>>20 byte 18 gray scale 32, 25968>>20 byte 19 RGB color 12, 25969>>20 byte 20 RGB color 16, 25970>>20 byte 255 unknown format, 25971>>20 default x format 25972>>>20 byte x \b %d, 25973>>21 byte x %d bpc 25974# PGFPostHeader 25975# Level-Sizes 25976#>>(4.l+4) lelong x level 0 size: %d 25977#>>(4.l+8) lelong x level 1 size: %d 25978#>>(4.l+12) lelong x level 2 size: %d 25979 25980#------------------------------------------------------------------------------ 25981# $File: pgp,v 1.21 2020/03/20 17:11:05 christos Exp $ 25982# pgp: file(1) magic for Pretty Good Privacy 25983# see https://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html 25984# 25985# Update: Joerg Jenderek 25986# Note: verified by `gpg -v --debug 0x02 --list-packets < PUBRING263_10.PGP` 25987#0 byte 0x99 MAYBE PGP 0x99 259880 byte 0x99 25989# 99h~10;0110;01~2=old packet type;tag 6=Public-Key Packet;1=two-octet length 25990# A two-octet body header encodes packet lengths of 192~00C0h - 8383~20BFh 25991#>1 ubeshort x \b, body length 0x%.4x 25992# skip Basic.Image Beauty.320 Pic.Icons by looking for low version number 25993#>3 ubyte x \b, V=%u 25994#>3 ubyte <5 VERSION OK 25995>3 ubyte <5 25996# next packet type often b4h~(tag 13)~User ID Packet, b0h~(tag 12)~Trust packet 25997#>>(1.S+3) ubyte x \b, next packet type 0x%x 25998# skip 9900-v4.bin 9902-v4.bin by looking for valid second packet type (bit 7=1) 25999#>>(1.S+3) ubyte >0x7F TYPE OK, 26000>>(1.S+3) ubyte >0x7F 26001# old versions 2,3 implies Pretty Good Privacy 26002>>>3 ubyte <4 PGP key public ring (v%u) 26003!:mime application/pgp-keys 26004!:ext pgp/ASD 26005>>>>4 beldate x created %s 26006# days that this key is valid. If this number is zero, then it does not expire 26007>>>>8 ubeshort >0 \b, %u days valid 26008>>>>8 ubeshort =0 \b, not expire 26009# display key algorithm 1~RSA (Encrypt or Sign) 26010>>>>10 use key_algo 26011# Multiprecision Integers (MPI) size 26012>>>>11 ubeshort x %u bits 26013# MPI 26014>>>>13 ubequad x MPI=0x%16.16llx... 26015# new version implies Pretty Good Privacy (PGP) >= 5.0 or Gnu Privacy Guard (GPG) 26016>>>3 ubyte >3 PGP/GPG key public ring (v%u) 26017!:mime application/pgp-keys 26018!:ext pgp/gpg/pkr/asd 26019>>>>4 beldate x created %s 26020# display key algorithm 17~DSA 26021>>>>8 use key_algo 26022# Multiprecision Integers (MPI) size 26023>>>>9 ubeshort x %u bits 26024>>>>11 ubequad x MPI=0x%16.16llx... 26025 260260 beshort 0x9501 PGP key security ring 26027!:mime application/x-pgp-keyring 260280 beshort 0x9500 PGP key security ring 26029!:mime application/x-pgp-keyring 260300 beshort 0xa600 PGP encrypted data 26031#!:mime application/pgp-encrypted 26032#0 string -----BEGIN\040PGP text/PGP armored data 26033!:mime text/PGP # encoding: armored data 26034#>15 string PUBLIC\040KEY\040BLOCK- public key block 26035#>15 string MESSAGE- message 26036#>15 string SIGNED\040MESSAGE- signed message 26037#>15 string PGP\040SIGNATURE- signature 26038 26039# Update: Joerg Jenderek 26040# URL: http://en.wikipedia.org/wiki/Pretty_Good_Privacy 26041# Reference: https://reposcope.com/mimetype/application/pgp-keys 260422 string ---BEGIN\040PGP\040PRIVATE\040KEY\040BLOCK- PGP private key block 26043#!:mime text/PGP 26044!:mime application/pgp-keys 26045!:ext asc 260462 string ---BEGIN\040PGP\040PUBLIC\040KEY\040BLOCK- PGP public key block 26047!:mime application/pgp-keys 26048!:ext asc 26049>10 search/100 \n\n 26050>>&0 use pgp 260510 string -----BEGIN\040PGP\040MESSAGE- PGP message 26052# https://reposcope.com/mimetype/application/pgp-encrypted 26053#!:mime application/pgp 26054!:mime application/pgp-encrypted 26055!:ext asc 26056#!:ext asc/pgp/gpg 26057>10 search/100 \n\n 26058>>&0 use pgp 26059# Reference: https://www.gnupg.org/gph/en/manual/x135.html 260600 string -----BEGIN\040PGP\040SIGNED\040MESSAGE- PGP signed message 26061#!:mime text/plain 26062!:mime text/PGP 26063#!:mime application/pgp 26064!:ext asc 260650 string -----BEGIN\040PGP\040SIGNATURE- PGP signature 26066# https://reposcope.com/mimetype/application/pgp-signature 26067!:mime application/pgp-signature 26068!:ext asc 26069>10 search/100 \n\n 26070>>&0 use pgp 26071 26072# Decode the type of the packet based on it's base64 encoding. 26073# Idea from Mark Martinec 26074# The specification is in RFC 4880, section 4.2 and 4.3: 26075# https://tools.ietf.org/html/rfc4880#section-4.2 26076 260770 name pgp 26078>0 byte 0x67 Reserved (old) 26079>0 byte 0x68 Public-Key Encrypted Session Key (old) 26080>0 byte 0x69 Signature (old) 26081>0 byte 0x6a Symmetric-Key Encrypted Session Key (old) 26082>0 byte 0x6b One-Pass Signature (old) 26083>0 byte 0x6c Secret-Key (old) 26084>0 byte 0x6d Public-Key (old) 26085>0 byte 0x6e Secret-Subkey (old) 26086>0 byte 0x6f Compressed Data (old) 26087>0 byte 0x70 Symmetrically Encrypted Data (old) 26088>0 byte 0x71 Marker (old) 26089>0 byte 0x72 Literal Data (old) 26090>0 byte 0x73 Trust (old) 26091>0 byte 0x74 User ID (old) 26092>0 byte 0x75 Public-Subkey (old) 26093>0 byte 0x76 Unused (old) 26094>0 byte 0x77 26095>>1 byte&0xc0 0x00 Reserved 26096>>1 byte&0xc0 0x40 Public-Key Encrypted Session Key 26097>>1 byte&0xc0 0x80 Signature 26098>>1 byte&0xc0 0xc0 Symmetric-Key Encrypted Session Key 26099>0 byte 0x78 26100>>1 byte&0xc0 0x00 One-Pass Signature 26101>>1 byte&0xc0 0x40 Secret-Key 26102>>1 byte&0xc0 0x80 Public-Key 26103>>1 byte&0xc0 0xc0 Secret-Subkey 26104>0 byte 0x79 26105>>1 byte&0xc0 0x00 Compressed Data 26106>>1 byte&0xc0 0x40 Symmetrically Encrypted Data 26107>>1 byte&0xc0 0x80 Marker 26108>>1 byte&0xc0 0xc0 Literal Data 26109>0 byte 0x7a 26110>>1 byte&0xc0 0x00 Trust 26111>>1 byte&0xc0 0x40 User ID 26112>>1 byte&0xc0 0x80 Public-Subkey 26113>>1 byte&0xc0 0xc0 Unused [z%x] 26114>0 byte 0x30 26115>>1 byte&0xc0 0x00 Unused [0%x] 26116>>1 byte&0xc0 0x40 User Attribute 26117>>1 byte&0xc0 0x80 Sym. Encrypted and Integrity Protected Data 26118>>1 byte&0xc0 0xc0 Modification Detection Code 26119 26120# magic signatures to detect PGP crypto material (from stef) 26121# detects and extracts metadata from: 26122# - symmetric encrypted packet header 26123# - RSA (e=65537) secret (sub-)keys 26124 26125# 1024b RSA encrypted data 26126 261270 string \x84\x8c\x03 PGP RSA encrypted session key - 26128>3 belong x keyid: %08X 26129>7 belong x %08X 26130>11 byte 0x01 RSA (Encrypt or Sign) 1024b 26131>11 byte 0x02 RSA Encrypt-Only 1024b 26132>12 string \x04\x00 26133>12 string \x03\xff 26134>12 string \x03\xfe 26135>12 string \x03\xfd 26136>12 string \x03\xfc 26137>12 string \x03\xfb 26138>12 string \x03\xfa 26139>12 string \x03\xf9 26140>142 byte 0xd2 . 26141 26142# 2048b RSA encrypted data 26143 261440 string \x85\x01\x0c\x03 PGP RSA encrypted session key - 26145>4 belong x keyid: %08X 26146>8 belong x %08X 26147>12 byte 0x01 RSA (Encrypt or Sign) 2048b 26148>12 byte 0x02 RSA Encrypt-Only 2048b 26149>13 string \x08\x00 26150>13 string \x07\xff 26151>13 string \x07\xfe 26152>13 string \x07\xfd 26153>13 string \x07\xfc 26154>13 string \x07\xfb 26155>13 string \x07\xfa 26156>13 string \x07\xf9 26157>271 byte 0xd2 . 26158 26159# 3072b RSA encrypted data 26160 261610 string \x85\x01\x8c\x03 PGP RSA encrypted session key - 26162>4 belong x keyid: %08X 26163>8 belong x %08X 26164>12 byte 0x01 RSA (Encrypt or Sign) 3072b 26165>12 byte 0x02 RSA Encrypt-Only 3072b 26166>13 string \x0c\x00 26167>13 string \x0b\xff 26168>13 string \x0b\xfe 26169>13 string \x0b\xfd 26170>13 string \x0b\xfc 26171>13 string \x0b\xfb 26172>13 string \x0b\xfa 26173>13 string \x0b\xf9 26174>399 byte 0xd2 . 26175 26176# 4096b RSA encrypted data 26177 261780 string \x85\x02\x0c\x03 PGP RSA encrypted session key - 26179>4 belong x keyid: %08X 26180>8 belong x %08X 26181>12 byte 0x01 RSA (Encrypt or Sign) 4096b 26182>12 byte 0x02 RSA Encrypt-Only 4096b 26183>13 string \x10\x00 26184>13 string \x0f\xff 26185>13 string \x0f\xfe 26186>13 string \x0f\xfd 26187>13 string \x0f\xfc 26188>13 string \x0f\xfb 26189>13 string \x0f\xfa 26190>13 string \x0f\xf9 26191>527 byte 0xd2 . 26192 26193# 8192b RSA encrypted data 26194 261950 string \x85\x04\x0c\x03 PGP RSA encrypted session key - 26196>4 belong x keyid: %08X 26197>8 belong x %08X 26198>12 byte 0x01 RSA (Encrypt or Sign) 8192b 26199>12 byte 0x02 RSA Encrypt-Only 8192b 26200>13 string \x20\x00 26201>13 string \x1f\xff 26202>13 string \x1f\xfe 26203>13 string \x1f\xfd 26204>13 string \x1f\xfc 26205>13 string \x1f\xfb 26206>13 string \x1f\xfa 26207>13 string \x1f\xf9 26208>1039 byte 0xd2 . 26209 26210# 1024b Elgamal encrypted data 26211 262120 string \x85\x01\x0e\x03 PGP Elgamal encrypted session key - 26213>4 belong x keyid: %08X 26214>8 belong x %08X 26215>12 byte 0x10 Elgamal Encrypt-Only 1024b. 26216>13 string \x04\x00 26217>13 string \x03\xff 26218>13 string \x03\xfe 26219>13 string \x03\xfd 26220>13 string \x03\xfc 26221>13 string \x03\xfb 26222>13 string \x03\xfa 26223>13 string \x03\xf9 26224 26225# 2048b Elgamal encrypted data 26226 262270 string \x85\x02\x0e\x03 PGP Elgamal encrypted session key - 26228>4 belong x keyid: %08X 26229>8 belong x %08X 26230>12 byte 0x10 Elgamal Encrypt-Only 2048b. 26231>13 string \x08\x00 26232>13 string \x07\xff 26233>13 string \x07\xfe 26234>13 string \x07\xfd 26235>13 string \x07\xfc 26236>13 string \x07\xfb 26237>13 string \x07\xfa 26238>13 string \x07\xf9 26239 26240# 3072b Elgamal encrypted data 26241 262420 string \x85\x03\x0e\x03 PGP Elgamal encrypted session key - 26243>4 belong x keyid: %08X 26244>8 belong x %08X 26245>12 byte 0x10 Elgamal Encrypt-Only 3072b. 26246>13 string \x0c\x00 26247>13 string \x0b\xff 26248>13 string \x0b\xfe 26249>13 string \x0b\xfd 26250>13 string \x0b\xfc 26251>13 string \x0b\xfb 26252>13 string \x0b\xfa 26253>13 string \x0b\xf9 26254 26255# crypto algo mapper 26256 262570 name crypto 26258>0 byte 0x00 Plaintext or unencrypted data 26259>0 byte 0x01 IDEA 26260>0 byte 0x02 TripleDES 26261>0 byte 0x03 CAST5 (128 bit key) 26262>0 byte 0x04 Blowfish (128 bit key, 16 rounds) 26263>0 byte 0x07 AES with 128-bit key 26264>0 byte 0x08 AES with 192-bit key 26265>0 byte 0x09 AES with 256-bit key 26266>0 byte 0x0a Twofish with 256-bit key 26267 26268# hash algo mapper 26269 262700 name hash 26271>0 byte 0x01 MD5 26272>0 byte 0x02 SHA-1 26273>0 byte 0x03 RIPE-MD/160 26274>0 byte 0x08 SHA256 26275>0 byte 0x09 SHA384 26276>0 byte 0x0a SHA512 26277>0 byte 0x0b SHA224 26278 26279# display public key algorithms as human readable text 262800 name key_algo 26281>0 byte 0x01 RSA (Encrypt or Sign) 26282# keep old look of version 5.28 without parentheses 26283>0 byte 0x02 RSA Encrypt-Only 26284>0 byte 0x03 RSA (Sign-Only) 26285>0 byte 16 ElGamal (Encrypt-Only) 26286>0 byte 17 DSA 26287>0 byte 18 Elliptic Curve 26288>0 byte 19 ECDSA 26289>0 byte 20 ElGamal (Encrypt or Sign) 26290>0 byte 21 Diffie-Hellman 26291>0 default x 26292>>0 ubyte <22 unknown (pub %d) 26293# this should never happen 26294>>0 ubyte >21 invalid (%d) 26295 26296# pgp symmetric encrypted data 26297 262980 byte 0x8c PGP symmetric key encrypted data - 26299>1 byte 0x0d 26300>1 byte 0x0c 26301>2 byte 0x04 26302>3 use crypto 26303>4 byte 0x01 salted - 26304>>5 use hash 26305>>14 byte 0xd2 . 26306>>14 byte 0xc9 . 26307>4 byte 0x03 salted & iterated - 26308>>5 use hash 26309>>15 byte 0xd2 . 26310>>15 byte 0xc9 . 26311 26312# encrypted keymaterial needs s2k & can be checksummed/hashed 26313 263140 name chkcrypto 26315>0 use crypto 26316>1 byte 0x00 Simple S2K 26317>1 byte 0x01 Salted S2K 26318>1 byte 0x03 Salted&Iterated S2K 26319>2 use hash 26320 26321# all PGP keys start with this prolog 26322# containing version, creation date, and purpose 26323 263240 name keyprolog 26325>0 byte 0x04 26326>1 beldate x created on %s - 26327>5 byte 0x01 RSA (Encrypt or Sign) 26328>5 byte 0x02 RSA Encrypt-Only 26329 26330# end of secret keys known signature 26331# contains e=65537 and the prolog to 26332# the encrypted parameters 26333 263340 name keyend 26335>0 string \x00\x11\x01\x00\x01 e=65537 26336>5 use crypto 26337>5 byte 0xff checksummed 26338>>6 use chkcrypto 26339>5 byte 0xfe hashed 26340>>6 use chkcrypto 26341 26342# PGP secret keys contain also the public parts 26343# these vary by bitsize of the key 26344 263450 name x1024 26346>0 use keyprolog 26347>6 string \x03\xfe 26348>6 string \x03\xff 26349>6 string \x04\x00 26350>136 use keyend 26351 263520 name x2048 26353>0 use keyprolog 26354>6 string \x80\x00 26355>6 string \x07\xfe 26356>6 string \x07\xff 26357>264 use keyend 26358 263590 name x3072 26360>0 use keyprolog 26361>6 string \x0b\xfe 26362>6 string \x0b\xff 26363>6 string \x0c\x00 26364>392 use keyend 26365 263660 name x4096 26367>0 use keyprolog 26368>6 string \x10\x00 26369>6 string \x0f\xfe 26370>6 string \x0f\xff 26371>520 use keyend 26372 26373# \x00|\x1f[\xfe\xff]).{1024})' 263740 name x8192 26375>0 use keyprolog 26376>6 string \x20\x00 26377>6 string \x1f\xfe 26378>6 string \x1f\xff 26379>1032 use keyend 26380 26381# depending on the size of the pkt 26382# we branch into the proper key size 26383# signatures defined as x{keysize} 26384 26385>0 name pgpkey 26386>0 string \x01\xd8 1024b 26387>>2 use x1024 26388>0 string \x01\xeb 1024b 26389>>2 use x1024 26390>0 string \x01\xfb 1024b 26391>>2 use x1024 26392>0 string \x01\xfd 1024b 26393>>2 use x1024 26394>0 string \x01\xf3 1024b 26395>>2 use x1024 26396>0 string \x01\xee 1024b 26397>>2 use x1024 26398>0 string \x01\xfe 1024b 26399>>2 use x1024 26400>0 string \x01\xf4 1024b 26401>>2 use x1024 26402>0 string \x02\x0d 1024b 26403>>2 use x1024 26404>0 string \x02\x03 1024b 26405>>2 use x1024 26406>0 string \x02\x05 1024b 26407>>2 use x1024 26408>0 string \x02\x15 1024b 26409>>2 use x1024 26410>0 string \x02\x00 1024b 26411>>2 use x1024 26412>0 string \x02\x10 1024b 26413>>2 use x1024 26414>0 string \x02\x04 1024b 26415>>2 use x1024 26416>0 string \x02\x06 1024b 26417>>2 use x1024 26418>0 string \x02\x16 1024b 26419>>2 use x1024 26420>0 string \x03\x98 2048b 26421>>2 use x2048 26422>0 string \x03\xab 2048b 26423>>2 use x2048 26424>0 string \x03\xbb 2048b 26425>>2 use x2048 26426>0 string \x03\xbd 2048b 26427>>2 use x2048 26428>0 string \x03\xcd 2048b 26429>>2 use x2048 26430>0 string \x03\xb3 2048b 26431>>2 use x2048 26432>0 string \x03\xc3 2048b 26433>>2 use x2048 26434>0 string \x03\xc5 2048b 26435>>2 use x2048 26436>0 string \x03\xd5 2048b 26437>>2 use x2048 26438>0 string \x03\xae 2048b 26439>>2 use x2048 26440>0 string \x03\xbe 2048b 26441>>2 use x2048 26442>0 string \x03\xc0 2048b 26443>>2 use x2048 26444>0 string \x03\xd0 2048b 26445>>2 use x2048 26446>0 string \x03\xb4 2048b 26447>>2 use x2048 26448>0 string \x03\xc4 2048b 26449>>2 use x2048 26450>0 string \x03\xc6 2048b 26451>>2 use x2048 26452>0 string \x03\xd6 2048b 26453>>2 use x2048 26454>0 string \x05X 3072b 26455>>2 use x3072 26456>0 string \x05k 3072b 26457>>2 use x3072 26458>0 string \x05{ 3072b 26459>>2 use x3072 26460>0 string \x05} 3072b 26461>>2 use x3072 26462>0 string \x05\x8d 3072b 26463>>2 use x3072 26464>0 string \x05s 3072b 26465>>2 use x3072 26466>0 string \x05\x83 3072b 26467>>2 use x3072 26468>0 string \x05\x85 3072b 26469>>2 use x3072 26470>0 string \x05\x95 3072b 26471>>2 use x3072 26472>0 string \x05n 3072b 26473>>2 use x3072 26474>0 string \x05\x7e 3072b 26475>>2 use x3072 26476>0 string \x05\x80 3072b 26477>>2 use x3072 26478>0 string \x05\x90 3072b 26479>>2 use x3072 26480>0 string \x05t 3072b 26481>>2 use x3072 26482>0 string \x05\x84 3072b 26483>>2 use x3072 26484>0 string \x05\x86 3072b 26485>>2 use x3072 26486>0 string \x05\x96 3072b 26487>>2 use x3072 26488>0 string \x07[ 4096b 26489>>2 use x4096 26490>0 string \x07\x18 4096b 26491>>2 use x4096 26492>0 string \x07+ 4096b 26493>>2 use x4096 26494>0 string \x07; 4096b 26495>>2 use x4096 26496>0 string \x07= 4096b 26497>>2 use x4096 26498>0 string \x07M 4096b 26499>>2 use x4096 26500>0 string \x073 4096b 26501>>2 use x4096 26502>0 string \x07C 4096b 26503>>2 use x4096 26504>0 string \x07E 4096b 26505>>2 use x4096 26506>0 string \x07U 4096b 26507>>2 use x4096 26508>0 string \x07. 4096b 26509>>2 use x4096 26510>0 string \x07> 4096b 26511>>2 use x4096 26512>0 string \x07@ 4096b 26513>>2 use x4096 26514>0 string \x07P 4096b 26515>>2 use x4096 26516>0 string \x074 4096b 26517>>2 use x4096 26518>0 string \x07D 4096b 26519>>2 use x4096 26520>0 string \x07F 4096b 26521>>2 use x4096 26522>0 string \x07V 4096b 26523>>2 use x4096 26524>0 string \x0e[ 8192b 26525>>2 use x8192 26526>0 string \x0e\x18 8192b 26527>>2 use x8192 26528>0 string \x0e+ 8192b 26529>>2 use x8192 26530>0 string \x0e; 8192b 26531>>2 use x8192 26532>0 string \x0e= 8192b 26533>>2 use x8192 26534>0 string \x0eM 8192b 26535>>2 use x8192 26536>0 string \x0e3 8192b 26537>>2 use x8192 26538>0 string \x0eC 8192b 26539>>2 use x8192 26540>0 string \x0eE 8192b 26541>>2 use x8192 26542>0 string \x0eU 8192b 26543>>2 use x8192 26544>0 string \x0e. 8192b 26545>>2 use x8192 26546>0 string \x0e> 8192b 26547>>2 use x8192 26548>0 string \x0e@ 8192b 26549>>2 use x8192 26550>0 string \x0eP 8192b 26551>>2 use x8192 26552>0 string \x0e4 8192b 26553>>2 use x8192 26554>0 string \x0eD 8192b 26555>>2 use x8192 26556>0 string \x0eF 8192b 26557>>2 use x8192 26558>0 string \x0eV 8192b 26559>>2 use x8192 26560 26561# PGP RSA (e=65537) secret (sub-)key header 26562 265630 byte 0x95 PGP Secret Key - 26564>1 use pgpkey 265650 byte 0x97 PGP Secret Sub-key - 26566>1 use pgpkey 265670 byte 0x9d 26568# Update: Joerg Jenderek 26569# secret subkey packet (tag 7) with same structure as secret key packet (tag 5) 26570# skip Fetus.Sys16 CALIBUS.MAIN OrbFix.Sys16.Ex by looking for positive len 26571>1 ubeshort >0 26572#>1 ubeshort x \b, body length 0x%x 26573# next packet type often 88h,89h~(tag 2)~Signature Packet 26574#>>(1.S+3) ubyte x \b, next packet type 0x%x 26575# skip Dragon.SHR DEMO.INIT by looking for positive version 26576>>3 ubyte >0 26577# skip BUISSON.13 GUITAR1 by looking for low version number 26578>>>3 ubyte <5 PGP Secret Sub-key 26579# sub-key are normally part of secret key. So it does not occur as standalone file 26580#!:ext bin 26581# version 2,3~old 4~new . Comment following line for version 5.28 look 26582>>>>3 ubyte x (v%d) 26583>>>>3 ubyte x - 26584# old versions 2 or 3 but no real example found 26585>>>>3 ubyte <4 26586# 2 byte for key bits in version 5.28 look 26587>>>>>11 ubeshort x %db 26588>>>>>4 beldate x created on %s - 26589# old versions use 2 additional bytes after time stamp 26590#>>>>>8 ubeshort x 0x%x 26591# display key algorithm 1~RSA Encrypt|Sign - 21~Diffie-Hellman 26592>>>>>10 use key_algo 26593>>>>>(11.S/8) ubequad x 26594# look after first key 26595>>>>>>&5 use keyend 26596# new version 26597>>>>3 ubyte >3 26598>>>>>9 ubeshort x %db 26599>>>>>4 beldate x created on %s - 26600# display key algorithm 26601>>>>>8 use key_algo 26602>>>>>(9.S/8) ubequad x 26603# look after first key for something like s2k 26604>>>>>>&3 use keyend 26605 26606#------------------------------------------------------------------------------ 26607# $File: pkgadd,v 1.6 2009/09/19 16:28:11 christos Exp $ 26608# pkgadd: file(1) magic for SysV R4 PKG Datastreams 26609# 266100 string #\ PaCkAgE\ DaTaStReAm pkg Datastream (SVR4) 26611!:mime application/x-svr4-package 26612 26613#------------------------------------------------------------------------------ 26614# $File: plan9,v 1.5 2009/09/19 16:28:11 christos Exp $ 26615# plan9: file(1) magic for AT&T Bell Labs' Plan 9 executables 26616# From: "Stefan A. Haubenthal" <polluks@web.de> 26617# 266180 belong 0x00000107 Plan 9 executable, Motorola 68k 266190 belong 0x000001EB Plan 9 executable, Intel 386 266200 belong 0x00000247 Plan 9 executable, Intel 960 266210 belong 0x000002AB Plan 9 executable, SPARC 266220 belong 0x00000407 Plan 9 executable, MIPS R3000 266230 belong 0x0000048B Plan 9 executable, AT&T DSP 3210 266240 belong 0x00000517 Plan 9 executable, MIPS R4000 BE 266250 belong 0x000005AB Plan 9 executable, AMD 29000 266260 belong 0x00000647 Plan 9 executable, ARM 7-something 266270 belong 0x000006EB Plan 9 executable, PowerPC 266280 belong 0x00000797 Plan 9 executable, MIPS R4000 LE 266290 belong 0x0000084B Plan 9 executable, DEC Alpha 26630 26631#------------------------------------------------------------------------------ 26632# $File: plus5,v 1.6 2009/09/19 16:28:11 christos Exp $ 26633# plus5: file(1) magic for Plus Five's UNIX MUMPS 26634# 26635# XXX - byte order? Paging Hokey.... 26636# 266370 short 0x259 mumps avl global 26638>2 byte >0 (V%d) 26639>6 byte >0 with %d byte name 26640>7 byte >0 and %d byte data cells 266410 short 0x25a mumps blt global 26642>2 byte >0 (V%d) 26643>8 short >0 - %d byte blocks 26644>15 byte 0x00 - P/D format 26645>15 byte 0x01 - P/K/D format 26646>15 byte 0x02 - K/D format 26647>15 byte >0x02 - Bad Flags 26648 26649#------------------------------------------------------------------------------ 26650# $File: pmem,v 1.3 2019/06/13 11:45:44 christos Exp $ 26651# pmem: file(1) magic for Persistent Memory Development Kit pool files 26652# 266530 string PMEM 26654>4 string POOLSET Persistent Memory Poolset file 26655>>11 search REPLICA with replica 26656>4 regex LOG|BLK|OBJ Persistent Memory Pool file, type: %s, 26657>>8 lelong >0 version: 0x%x, 26658>>12 lelong x compat: 0x%x, 26659>>16 lelong x incompat: 0x%x, 26660>>20 lelong x ro_compat: 0x%x, 26661 26662 26663>>120 leqldate x crtime: %s, 26664>>128 lequad x alignment_desc: 0x%016llx, 26665 26666>>136 clear x 26667>>136 byte 2 machine_class: 64-bit, 26668>>136 default x machine_class: unknown 26669>>>136 byte x (0x%d), 26670 26671>>137 clear x 26672>>137 byte 1 data: little-endian, 26673>>137 byte 2 data: big-endian, 26674>>137 default x data: unknown 26675>>>137 byte x (0x%d), 26676 26677>>138 byte !0 reserved[0]: %d, 26678>>139 byte !0 reserved[1]: %d, 26679>>140 byte !0 reserved[2]: %d, 26680>>141 byte !0 reserved[3]: %d, 26681 26682>>142 clear x 26683>>142 leshort 62 machine: x86_64 26684>>142 leshort 183 machine: aarch64 26685>>142 default x machine: unknown 26686>>>142 leshort x (0x%d) 26687 26688>4 string BLK 26689>>4096 lelong x \b, blk.bsize: %d 26690 26691>4 string OBJ 26692>>4096 string >0 \b, obj.layout: '%s' 26693>>4096 string <0 \b, obj.layout: NULL 26694 26695#------------------------------------------------------------------------------ 26696# $File: polyml,v 1.2 2019/04/19 00:42:27 christos Exp $ 26697# polyml: file(1) magic for PolyML 26698# 26699# PolyML 26700# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8) 26701# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com) 26702 26703# [0]: https://www.polyml.org/ 26704# [1]: https://github.com/polyml/polyml/blob/master/\ 26705# libpolyml/savestate.cpp#L146-L147 26706# [2]: https://github.com/polyml/polyml/blob/master/\ 26707# libpolyml/savestate.cpp#L1262-L1263 26708 26709# Type: Poly/ML saved data 26710# From: Matthew Fernandez <matthew.fernandez@gmail.com> 26711 267120 string POLYSAVE Poly/ML saved state 26713>8 long x version %u 26714 267150 string POLYMODU Poly/ML saved module 26716>8 long x version %u 26717 26718#------------------------------------------------------------------------------ 26719# $File: printer,v 1.29 2019/04/19 00:42:27 christos Exp $ 26720# printer: file(1) magic for printer-formatted files 26721# 26722 26723# PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com) 267240 string %! PostScript document text 26725!:mime application/postscript 26726!:apple ASPSTEXT 26727>2 string PS-Adobe- conforming 26728>>11 string >\0 DSC level %.3s 26729>>>15 string EPS \b, type %s 26730>>>15 string Query \b, type %s 26731>>>15 string ExitServer \b, type %s 26732>>>15 search/1000 %%LanguageLevel:\040 26733>>>>&0 string >\0 \b, Level %s 26734# Some PCs have the annoying habit of adding a ^D as a document separator 267350 string \004%! PostScript document text 26736!:mime application/postscript 26737!:apple ASPSTEXT 26738>3 string PS-Adobe- conforming 26739>>12 string >\0 DSC level %.3s 26740>>>16 string EPS \b, type %s 26741>>>16 string Query \b, type %s 26742>>>16 string ExitServer \b, type %s 26743>>>16 search/1000 %%LanguageLevel:\040 26744>>>>&0 string >\0 \b, Level %s 267450 string \033%-12345X%!PS PostScript document 26746 26747# DOS EPS Binary File Header 26748# From: Ed Sznyter <ews@Black.Market.NET> 267490 belong 0xC5D0D3C6 DOS EPS Binary File 26750>4 long >0 Postscript starts at byte %d 26751>>8 long >0 length %d 26752>>>12 long >0 Metafile starts at byte %d 26753>>>>16 long >0 length %d 26754>>>20 long >0 TIFF starts at byte %d 26755>>>>24 long >0 length %d 26756 26757# Summary: Adobe's PostScript Printer Description File 26758# Extension: .ppd 26759# Reference: https://partners.adobe.com/public/developer/en/ps/5003.PPD_Spec_v4.3.pdf, Section 3.8 26760# Submitted by: Yves Arrouye <arrouye@marin.fdn.fr> 26761# 267620 string *PPD-Adobe:\x20 PPD file 26763>&0 string x \b, version %s 26764 26765# HP Printer Job Language 267660 string \033%-12345X@PJL HP Printer Job Language data 26767# HP Printer Job Language 26768# The header found on Win95 HP plot files is the "Silliest Thing possible" 26769# (TM) 26770# Every driver puts the language at some random position, with random case 26771# (LANGUAGE and Language) 26772# For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10 26773# From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de> 26774# 267750 string \033%-12345X@PJL HP Printer Job Language data 26776>&0 string >\0 %s 26777>>&0 string >\0 %s 26778>>>&0 string >\0 %s 26779>>>>&0 string >\0 %s 26780#>15 string \ ENTER\ LANGUAGE\ = 26781#>31 string PostScript PostScript 26782 26783# From: Stefan Thurner <thurners@nicsys.de> 267840 string \033%-12345X@PJL 26785>&0 search/10000 %! PJL encapsulated PostScript document text 26786 26787# Rick Richardson <rickrich@gmail.com> 26788 26789# For Fuji-Xerox Printers - HBPL stands for Host Based Printer Language 26790# For Oki Data Printers - HIPERC 26791# For Konica Minolta Printers - LAVAFLOW 26792# For Samsung Printers - QPDL 26793# For HP Printers - ZJS stands for Zenographics ZJStream 267940 string \033%-12345X@PJL HP Printer Job Language data 26795>0 search/10000 @PJL\ ENTER\ LANGUAGE=HBPL - HBPL 26796>0 search/10000 @PJL\ ENTER\ LANGUAGE=HIPERC - Oki Data HIPERC 26797>0 search/10000 @PJL\ ENTER\ LANGUAGE=LAVAFLOW - Konica Minolta LAVAFLOW 26798>0 search/10000 @PJL\ ENTER\ LANGUAGE=QPDL - Samsung QPDL 26799>0 search/10000 @PJL\ ENTER\ LANGUAGE\ =\ QPDL - Samsung QPDL 26800>0 search/10000 @PJL\ ENTER\ LANGUAGE=ZJS - HP ZJS 26801 26802 26803# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com) 268040 string \033E\033 HP PCL printer data 26805>3 string \&l0A - default page size 26806>3 string \&l1A - US executive page size 26807>3 string \&l2A - US letter page size 26808>3 string \&l3A - US legal page size 26809>3 string \&l26A - A4 page size 26810>3 string \&l80A - Monarch envelope size 26811>3 string \&l81A - No. 10 envelope size 26812>3 string \&l90A - Intl. DL envelope size 26813>3 string \&l91A - Intl. C5 envelope size 26814>3 string \&l100A - Intl. B5 envelope size 26815>3 string \&l-81A - No. 10 envelope size (landscape) 26816>3 string \&l-90A - Intl. DL envelope size (landscape) 26817 26818# IMAGEN printer-ready files: 268190 string @document( Imagen printer 26820# this only works if "language xxx" is first item in Imagen header. 26821>10 string language\ impress (imPRESS data) 26822>10 string language\ daisy (daisywheel text) 26823>10 string language\ diablo (daisywheel text) 26824>10 string language\ printer (line printer emulation) 26825>10 string language\ tektronix (Tektronix 4014 emulation) 26826# Add any other languages that your Imagen uses - remember 26827# to keep the word `text' if the file is human-readable. 26828# [GRR 950115: missing "postscript" or "ultrascript" (whatever it was called)] 26829# 26830# Now magic for IMAGEN font files... 268310 string Rast RST-format raster font data 26832>45 string >0 face %s 26833# From Jukka Ukkonen 268340 string \033[K\002\0\0\017\033(a\001\0\001\033(g Canon Bubble Jet BJC formatted data 26835 26836# From <mike@flyn.org> 26837# These are the /etc/magic entries to decode data sent to an Epson printer. 268380 string \x1B\x40\x1B\x28\x52\x08\x00\x00REMOTE1P Epson Stylus Color 460 data 26839 26840 26841#------------------------------------------------------------------------------ 26842# zenographics: file(1) magic for Zenographics ZjStream printer data 26843# Rick Richardson <rickrich@gmail.com> 268440 string JZJZ 26845>0x12 string ZZ Zenographics ZjStream printer data (big-endian) 268460 string ZJZJ 26847>0x12 string ZZ Zenographics ZjStream printer data (little-endian) 26848 26849 26850#------------------------------------------------------------------------------ 26851# Oak Technologies printer stream 26852# Rick Richardson <rickrich@gmail.com> 268530 string OAK 26854>0x07 byte 0 26855>0x0b byte 0 Oak Technologies printer stream 26856 26857# This would otherwise be recognized as PostScript - nick@debian.org 268580 string %!VMF SunClock's Vector Map Format data 26859 26860#------------------------------------------------------------------------------ 26861# HP LaserJet 1000 series downloadable firmware file 268620 string \xbe\xefABCDEFGH HP LaserJet 1000 series downloadable firmware 26863 26864# From: Paolo <oopla@users.sf.net> 26865# Epson ESC/Page, ESC/PageColor 268660 string \x1b\x01@EJL Epson ESC/Page language printer data 26867 26868#------------------------------------------------------------------------------ 26869# $File: project,v 1.5 2017/03/17 21:35:28 christos Exp $ 26870# project: file(1) magic for Project management 26871# 26872# Magic strings for ftnchek project files. Alexander Mai 268730 string FTNCHEK_\ P project file for ftnchek 26874>10 string 1 version 2.7 26875>10 string 2 version 2.8 to 2.10 26876>10 string 3 version 2.11 or later 26877 26878#------------------------------------------------------------------------------ 26879# $File: psdbms,v 1.8 2017/03/17 21:35:28 christos Exp $ 26880# psdbms: file(1) magic for psdatabase 26881# 26882# Update: Joerg Jenderek 26883# GRR: line below too general as it catches also some Panorama database *.pan , 26884# AppleWorks word processor 268850 belong&0xff00ffff 0x56000000 26886# assume version starts with digit 26887>1 regex/s =^[0-9] ps database 26888>>1 string >\0 version %s 26889# kernel name 26890>>4 string >\0 from kernel %s 26891 26892#------------------------------------------------------------------------------ 26893# $File: psl,v 1.3 2019/04/19 00:42:27 christos Exp $ 26894# psl: file(1) magic for Public Suffix List representations 26895# From: Daniel Kahn Gillmor <dkg@fifthhorseman.net> 26896# URL: https://publicsuffix.org 26897# see also: https://thread.gmane.org/gmane.network.dns.libpsl.bugs/162/focus=166 26898 268990 search/512 \n\n//\ ===BEGIN\ ICANN\ DOMAINS===\n\n Public Suffix List data 26900 269010 string .DAFSA@PSL_ 26902>15 string \n Public Suffix List data (optimized) 26903>>11 byte >0x2f 26904>>>11 byte <0x3a (Version %c) 26905 26906#------------------------------------------------------------------------------ 26907# $File: pulsar,v 1.5 2009/09/19 16:28:12 christos Exp $ 26908# pulsar: file(1) magic for Pulsar POP3 daemon binary files 26909# 26910# http://pulsar.sourceforge.net 26911# mailto:rok.papez@lugos.si 26912# 26913 269140 belong 0x1ee7f11e Pulsar POP3 daemon mailbox cache file. 26915>4 ubelong x Version: %d. 26916>8 ubelong x \b%d 26917 26918 26919#------------------------------------------------------------------------------ 26920# $File: pwsafe,v 1.2 2019/04/19 00:42:27 christos Exp $ 26921# pwsafe: file(1) magic for passwordsafe file 26922# 26923# Password Safe 26924# http://passwordsafe.sourceforge.net/ 26925# file format specs 26926# https://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV3.txt 26927# V2 https://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV2.txt 26928# V1 https://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/notes.txt 26929# V2 and V1 have no easy identifier that I can find 26930# .psafe3 269310 string PWS3 Password Safe V3 database 26932 26933#------------------------------------------------------------------------------ 26934# $File: pyramid,v 1.7 2009/09/19 16:28:12 christos Exp $ 26935# pyramid: file(1) magic for Pyramids 26936# 26937# XXX - byte order? 26938# 269390 long 0x50900107 Pyramid 90x family executable 269400 long 0x50900108 Pyramid 90x family pure executable 26941>16 long >0 not stripped 269420 long 0x5090010b Pyramid 90x family demand paged pure executable 26943>16 long >0 not stripped 26944 26945#------------------------------------------------------------------------------ 26946# $File: python,v 1.42 2020/06/04 00:22:50 christos Exp $ 26947# python: file(1) magic for python 26948# 26949# Outlook puts """ too for urgent messages 26950# From: David Necas <yeti@physics.muni.cz> 26951# often the module starts with a multiline string 269520 string/t """ Python script text executable 26953# MAGIC as specified in Python/import.c (1.0 to 3.7) 26954# two bytes of magic followed by "\r\n" in little endian order 269550 belong 0x02099900 python 1.0 byte-compiled 26956!:mime text/x-bytecode.python 269570 belong 0x03099900 python 1.1/1.2 byte-compiled 26958!:mime text/x-bytecode.python 269590 belong 0x892e0d0a python 1.3 byte-compiled 26960!:mime text/x-bytecode.python 269610 belong 0x04170d0a python 1.4 byte-compiled 26962!:mime text/x-bytecode.python 269630 belong 0x994e0d0a python 1.5 byte-compiled 26964!:mime text/x-bytecode.python 269650 belong 0xfcc40d0a python 1.6 byte-compiled 26966!:mime text/x-bytecode.python 269670 belong 0xfdc40d0a python 1.6 byte-compiled 26968!:mime text/x-bytecode.python 269690 belong 0x87c60d0a python 2.0 byte-compiled 26970!:mime text/x-bytecode.python 269710 belong 0x88c60d0a python 2.0 byte-compiled 26972!:mime text/x-bytecode.python 269730 belong 0x2aeb0d0a python 2.1 byte-compiled 26974!:mime text/x-bytecode.python 269750 belong 0x2beb0d0a python 2.1 byte-compiled 26976!:mime text/x-bytecode.python 269770 belong 0x2ded0d0a python 2.2 byte-compiled 26978!:mime text/x-bytecode.python 269790 belong 0x2eed0d0a python 2.2 byte-compiled 26980!:mime text/x-bytecode.python 269810 belong 0x3bf20d0a python 2.3 byte-compiled 26982!:mime text/x-bytecode.python 269830 belong 0x3cf20d0a python 2.3 byte-compiled 26984!:mime text/x-bytecode.python 269850 belong 0x45f20d0a python 2.3 byte-compiled 26986!:mime text/x-bytecode.python 269870 belong 0x59f20d0a python 2.4 byte-compiled 26988!:mime text/x-bytecode.python 269890 belong 0x63f20d0a python 2.4 byte-compiled 26990!:mime text/x-bytecode.python 269910 belong 0x6df20d0a python 2.4 byte-compiled 26992!:mime text/x-bytecode.python 269930 belong 0x6ef20d0a python 2.4 byte-compiled 26994!:mime text/x-bytecode.python 269950 belong 0x77f20d0a python 2.5 byte-compiled 26996!:mime text/x-bytecode.python 269970 belong 0x81f20d0a python 2.5 byte-compiled 26998!:mime text/x-bytecode.python 269990 belong 0x8bf20d0a python 2.5 byte-compiled 27000!:mime text/x-bytecode.python 270010 belong 0x8cf20d0a python 2.5 byte-compiled 27002!:mime text/x-bytecode.python 270030 belong 0x95f20d0a python 2.5 byte-compiled 27004!:mime text/x-bytecode.python 270050 belong 0x9ff20d0a python 2.5 byte-compiled 27006!:mime text/x-bytecode.python 270070 belong 0xa9f20d0a python 2.5 byte-compiled 27008!:mime text/x-bytecode.python 270090 belong 0xb3f20d0a python 2.5 byte-compiled 27010!:mime text/x-bytecode.python 270110 belong 0xb4f20d0a python 2.5 byte-compiled 27012!:mime text/x-bytecode.python 270130 belong 0xc7f20d0a python 2.6 byte-compiled 27014!:mime text/x-bytecode.python 270150 belong 0xd1f20d0a python 2.6 byte-compiled 27016!:mime text/x-bytecode.python 270170 belong 0xd2f20d0a python 2.6 byte-compiled 27018!:mime text/x-bytecode.python 270190 belong 0xdbf20d0a python 2.7 byte-compiled 27020!:mime text/x-bytecode.python 270210 belong 0xe5f20d0a python 2.7 byte-compiled 27022!:mime text/x-bytecode.python 270230 belong 0xeff20d0a python 2.7 byte-compiled 27024!:mime text/x-bytecode.python 270250 belong 0xf9f20d0a python 2.7 byte-compiled 27026!:mime text/x-bytecode.python 270270 belong 0x03f30d0a python 2.7 byte-compiled 27028!:mime text/x-bytecode.python 270290 belong 0x04f30d0a python 2.7 byte-compiled 27030!:mime text/x-bytecode.python 270310 belong 0xb80b0d0a python 3.0 byte-compiled 27032!:mime text/x-bytecode.python 270330 belong 0xc20b0d0a python 3.0 byte-compiled 27034!:mime text/x-bytecode.python 270350 belong 0xcc0b0d0a python 3.0 byte-compiled 27036!:mime text/x-bytecode.python 270370 belong 0xd60b0d0a python 3.0 byte-compiled 27038!:mime text/x-bytecode.python 270390 belong 0xe00b0d0a python 3.0 byte-compiled 27040!:mime text/x-bytecode.python 270410 belong 0xea0b0d0a python 3.0 byte-compiled 27042!:mime text/x-bytecode.python 270430 belong 0xf40b0d0a python 3.0 byte-compiled 27044!:mime text/x-bytecode.python 270450 belong 0xf50b0d0a python 3.0 byte-compiled 27046!:mime text/x-bytecode.python 270470 belong 0xff0b0d0a python 3.0 byte-compiled 27048!:mime text/x-bytecode.python 270490 belong 0x090c0d0a python 3.0 byte-compiled 27050!:mime text/x-bytecode.python 270510 belong 0x130c0d0a python 3.0 byte-compiled 27052!:mime text/x-bytecode.python 270530 belong 0x1d0c0d0a python 3.0 byte-compiled 27054!:mime text/x-bytecode.python 270550 belong 0x1f0c0d0a python 3.0 byte-compiled 27056!:mime text/x-bytecode.python 270570 belong 0x270c0d0a python 3.0 byte-compiled 27058!:mime text/x-bytecode.python 270590 belong 0x3b0c0d0a python 3.0 byte-compiled 27060!:mime text/x-bytecode.python 270610 belong 0x450c0d0a python 3.1 byte-compiled 27062!:mime text/x-bytecode.python 270630 belong 0x4f0c0d0a python 3.1 byte-compiled 27064!:mime text/x-bytecode.python 270650 belong 0x580c0d0a python 3.2 byte-compiled 27066!:mime text/x-bytecode.python 270670 belong 0x620c0d0a python 3.2 byte-compiled 27068!:mime text/x-bytecode.python 270690 belong 0x6c0c0d0a python 3.2 byte-compiled 27070!:mime text/x-bytecode.python 270710 belong 0x760c0d0a python 3.3 byte-compiled 27072!:mime text/x-bytecode.python 270730 belong 0x800c0d0a python 3.3 byte-compiled 27074!:mime text/x-bytecode.python 270750 belong 0x8a0c0d0a python 3.3 byte-compiled 27076!:mime text/x-bytecode.python 270770 belong 0x940c0d0a python 3.3 byte-compiled 27078!:mime text/x-bytecode.python 270790 belong 0x9e0c0d0a python 3.3 byte-compiled 27080!:mime text/x-bytecode.python 270810 belong 0xb20c0d0a python 3.4 byte-compiled 27082!:mime text/x-bytecode.python 270830 belong 0xbc0c0d0a python 3.4 byte-compiled 27084!:mime text/x-bytecode.python 270850 belong 0xc60c0d0a python 3.4 byte-compiled 27086!:mime text/x-bytecode.python 270870 belong 0xd00c0d0a python 3.4 byte-compiled 27088!:mime text/x-bytecode.python 270890 belong 0xda0c0d0a python 3.4 byte-compiled 27090!:mime text/x-bytecode.python 270910 belong 0xe40c0d0a python 3.4 byte-compiled 27092!:mime text/x-bytecode.python 270930 belong 0xee0c0d0a python 3.4 byte-compiled 27094!:mime text/x-bytecode.python 270950 belong 0xf80c0d0a python 3.5.1- byte-compiled 27096!:mime text/x-bytecode.python 270970 belong 0x020d0d0a python 3.5.1- byte-compiled 27098!:mime text/x-bytecode.python 270990 belong 0x0c0d0d0a python 3.5.1- byte-compiled 27100!:mime text/x-bytecode.python 271010 belong 0x160d0d0a python 3.5.1- byte-compiled 27102!:mime text/x-bytecode.python 271030 belong 0x170d0d0a python 3.5.2+ byte-compiled 27104!:mime text/x-bytecode.python 271050 belong 0x200d0d0a python 3.6 byte-compiled 27106!:mime text/x-bytecode.python 271070 belong 0x210d0d0a python 3.6 byte-compiled 27108!:mime text/x-bytecode.python 271090 belong 0x2a0d0d0a python 3.6 byte-compiled 27110!:mime text/x-bytecode.python 271110 belong 0x2b0d0d0a python 3.6 byte-compiled 27112!:mime text/x-bytecode.python 271130 belong 0x2c0d0d0a python 3.6 byte-compiled 27114!:mime text/x-bytecode.python 271150 belong 0x2d0d0d0a python 3.6 byte-compiled 27116!:mime text/x-bytecode.python 271170 belong 0x2f0d0d0a python 3.6 byte-compiled 27118!:mime text/x-bytecode.python 271190 belong 0x300d0d0a python 3.6 byte-compiled 27120!:mime text/x-bytecode.python 271210 belong 0x310d0d0a python 3.6 byte-compiled 27122!:mime text/x-bytecode.python 271230 belong 0x320d0d0a python 3.6 byte-compiled 27124!:mime text/x-bytecode.python 271250 belong 0x330d0d0a python 3.6 byte-compiled 27126!:mime text/x-bytecode.python 271270 belong 0x3e0d0d0a python 3.7 byte-compiled 27128!:mime text/x-bytecode.python 271290 belong 0x3f0d0d0a python 3.7 byte-compiled 27130!:mime text/x-bytecode.python 271310 belong 0x400d0d0a python 3.7 byte-compiled 27132!:mime text/x-bytecode.python 271330 belong 0x410d0d0a python 3.7 byte-compiled 27134!:mime text/x-bytecode.python 271350 belong 0x420d0d0a python 3.7 byte-compiled 27136!:mime text/x-bytecode.python 271370 belong 0x480d0d0a python 3.8 byte-compiled 27138!:mime text/x-bytecode.python 271390 belong 0x490d0d0a python 3.8 byte-compiled 27140!:mime text/x-bytecode.python 271410 belong 0x520d0d0a python 3.8 byte-compiled 27142!:mime text/x-bytecode.python 271430 belong 0x530d0d0a python 3.8 byte-compiled 27144!:mime text/x-bytecode.python 271450 belong 0x540d0d0a python 3.8 byte-compiled 27146!:mime text/x-bytecode.python 271470 belong 0x550d0d0a python 3.8 byte-compiled 27148!:mime text/x-bytecode.python 271490 belong 0x5c0d0d0a python 3.9 byte-compiled 27150!:mime text/x-bytecode.python 271510 belong 0x5d0d0d0a python 3.9 byte-compiled 27152!:mime text/x-bytecode.python 271530 belong 0x5e0d0d0a python 3.9 byte-compiled 27154!:mime text/x-bytecode.python 271550 belong 0x5f0d0d0a python 3.9 byte-compiled 27156!:mime text/x-bytecode.python 271570 belong 0x600d0d0a python 3.9 byte-compiled 27158!:mime text/x-bytecode.python 271590 belong 0x610d0d0a python 3.9 byte-compiled 27160!:mime text/x-bytecode.python 27161 271620 search/1/w #!\040/usr/bin/python Python script text executable 27163!:strength + 15 27164!:mime text/x-script.python 271650 search/1/w #!\040/usr/local/bin/python Python script text executable 27166!:strength + 15 27167!:mime text/x-script.python 271680 search/10/w #!\040/usr/bin/env\040python Python script text executable 27169!:strength + 15 27170!:mime text/x-script.python 27171 27172 27173# from module.submodule import func1, func2 271740 search/8192 import 27175>0 regex \^from[\040\t]+([A-Za-z0-9_]|\\.)+[\040\t]+import.*$ Python script text executable 27176!:strength + 15 27177!:mime text/x-script.python 27178 27179# def __init__ (self, ...): 271800 search/4096 def\ __init__ 27181>&0 search/64 self Python script text executable 27182!:strength + 15 27183!:mime text/x-script.python 27184 27185# if __name__ == "__main__": 271860 search/4096 if\ __name__ 27187>&0 search/64 '__main__' Python script text executable 27188>&0 search/64 "__main__" Python script text executable 27189!:strength + 15 27190!:mime text/x-script.python 27191 27192# import module [as abrev] 271930 search/8192 import 27194>0 regex \^import\ [_[:alpha:]]+\ as\ [[:alpha:]][[:space:]]*$ Python script text executable 27195!:mime text/x-script.python 27196 27197# comments 27198#0 search/4096 ''' 27199#>&0 regex .*'''$ Python script text executable 27200#!:mime text/x-script.python 27201 27202#0 search/4096 """ 27203#>&0 regex .*"""$ Python script text executable 27204#!:mime text/x-script.python 27205 27206# try: 27207# except: or finally: 27208# block 272090 search/4096 try: 27210>&0 regex \^[[:space:]]*except.*:$ Python script text executable 27211!:strength + 15 27212!:mime text/x-script.python 27213>&0 search/4096 finally: Python script text executable 27214!:mime text/x-script.python 27215 27216# class name[(base classes,)]: [pass] 272170 search/8192 class 27218>0 regex \^class\ [_[:alpha:]]+(\\(.*\\))?(\ )*:([\ \t]+pass)?$ Python script text executable 27219!:strength + 15 27220!:mime text/x-script.python 27221 27222# def name(*args, **kwargs): 272230 search/8192 def\ 27224>0 regex \^[[:space:]]{0,50}def\ {1,50}[_a-zA-Z]{1,100} 27225>>&0 regex \\(([[:alpha:]*_,\ ]){0,255}\\):$ Python script text executable 27226!:strength + 15 27227!:mime text/x-script.python 27228 27229# https://numpy.org/devdocs/reference/generated/numpy.lib.format.html 272300 string \223NUMPY NumPy data file 27231!:mime application/x-numpy-data 27232>6 byte x \b, version %d 27233>7 byte x \b.%d 27234#>8 leshort x \b, header length=%d 27235>10 string x \b, description %s 27236 27237#------------------------------------------------------------------------------ 27238# $File: qt,v 1.3 2019/04/19 00:42:27 christos Exp $ 27239# qt: file(1) magic for Qt 27240 27241# https://doc.qt.io/qt-5/resources.html 272420 string \<!DOCTYPE\040RCC\> Qt Resource Collection file 27243 27244# https://qt.gitorious.org/qt/qtbase/source/\ 27245# 5367fa356233da4c0f28172a8f817791525f5457:\ 27246# src/tools/rcc/rcc.cpp#L840 272470 string qres\0\0 Qt Binary Resource file 272480 search/1024 The\040Resource\040Compiler\040for\040Qt Qt C-code resource file 27249 27250# https://qt.gitorious.org/qt/qtbase/source/\ 27251# 5367fa356233da4c0f28172a8f817791525f5457:\ 27252# src/corelib/kernel/qtranslator.cpp#L62 272530 string \x3c\xb8\x64\x18\xca\xef\x9c\x95 27254>8 string \xcd\x21\x1c\xbf\x60\xa1\xbd\xdd Qt Translation file 27255 27256#------------------------------------------------------------------------------ 27257# $File: revision,v 1.11 2019/04/19 00:42:27 christos Exp $ 27258# file(1) magic for revision control files 27259# From Hendrik Scholz <hendrik@scholz.net> 272600 string/t /1\ :pserver: cvs password text file 27261 27262# Conary changesets 27263# From: Jonathan Smith <smithj@rpath.com> 272640 belong 0xea3f81bb Conary changeset data 27265 27266# Type: Git bundles (git-bundle) 27267# From: Josh Triplett <josh@freedesktop.org> 272680 string #\ v2\ git\ bundle\n Git bundle 27269 27270# Type: Git pack 27271# From: Adam Buchbinder <adam.buchbinder@gmail.com> 27272# Update: Joerg Jenderek 27273# URL: http://fileformats.archiveteam.org/wiki/Git 27274# reference: https://github.com/git/git/blob/master/Documentation/technical/pack-format.txt 27275# The actual magic is 'PACK', but that clashes with Doom/Quake packs. However, 27276# those have a little-endian offset immediately following the magic 'PACK', 27277# the first byte of which is never 0, while the first byte of the Git pack 27278# version, since it's a tiny number stored in big-endian format, is always 0. 272790 string PACK 27280# GRR: line above is too general as it matches also PackDir archive ./acorn 27281# test for major version. Git 2017 accepts version number 2 or 3 27282>4 ubelong <9 27283# Acorn PackDir with method 0 compression has root like ADFS::HardDisc4.$.AsylumSrc 27284# or SystemDevice::foobar 27285>>9 search/13 :: 27286# but in git binary 27287>>9 default x Git pack 27288!:mime application/x-git 27289!:ext pack 27290# 4 GB limit implies unsigned integer 27291>>>4 ubelong x \b, version %u 27292>>>8 ubelong x \b, %u objects 27293 27294# Type: Git pack index 27295# From: Adam Buchbinder <adam.buchbinder@gmail.com> 272960 string \377tOc Git pack index 27297>4 belong =2 \b, version 2 27298 27299# Type: Git index file 27300# From: Frederic Briare <fbriere@fbriere.net> 273010 string DIRC Git index 27302>4 belong >0 \b, version %d 27303>>8 belong >0 \b, %d entries 27304 27305# Type: Mercurial bundles 27306# From: Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr> 273070 string HG10 Mercurial bundle, 27308>4 string UN uncompressed 27309>4 string BZ bzip2 compressed 27310 27311# Type: Subversion (SVN) dumps 27312# From: Uwe Zeisberger <zeisberg@informatik.uni-freiburg.de> 273130 string SVN-fs-dump-format-version: Subversion dumpfile 27314>28 string >\0 (version: %s) 27315 27316# Type: Bazaar revision bundles and merge requests 27317# URL: https://www.bazaar-vcs.org/ 27318# From: Jelmer Vernooij <jelmer@samba.org> 273190 string #\ Bazaar\ revision\ bundle\ v Bazaar Bundle 273200 string #\ Bazaar\ merge\ directive\ format Bazaar merge directive 27321 27322#------------------------------------------------------------------------------ 27323# $File: riff,v 1.35 2020/06/05 17:15:03 christos Exp $ 27324# riff: file(1) magic for RIFF format 27325# See 27326# 27327# https://www.seanet.com/users/matts/riffmci/riffmci.htm 27328# http://www-mmsp.ece.mcgill.ca/Documents/AudioFormats/WAVE/Docs/riffmci.pdf 27329# 27330 27331# audio format tag. Assume limits: max 1024 bit, 128 channels, 1 MHz 273320 name riff-wave 27333>0 leshort 1 \b, Microsoft PCM 27334>>14 leshort >0 27335>>>14 leshort <1024 \b, %d bit 27336>0 leshort 2 \b, Microsoft ADPCM 27337>0 leshort 6 \b, ITU G.711 A-law 27338>0 leshort 7 \b, ITU G.711 mu-law 27339>0 leshort 8 \b, Microsoft DTS 27340>0 leshort 17 \b, IMA ADPCM 27341>0 leshort 20 \b, ITU G.723 ADPCM (Yamaha) 27342>0 leshort 49 \b, GSM 6.10 27343>0 leshort 64 \b, ITU G.721 ADPCM 27344>0 leshort 80 \b, MPEG 27345>0 leshort 85 \b, MPEG Layer 3 27346>0 leshort 0x2001 \b, DTS 27347>2 leshort =1 \b, mono 27348>2 leshort =2 \b, stereo 27349>2 leshort >2 27350>>2 leshort <128 \b, %d channels 27351>4 lelong >0 27352>>4 lelong <1000000 %d Hz 27353 27354# try to find "fmt " 273550 name riff-walk 27356>0 string fmt\x20 27357>>4 lelong <0x80 27358>>>8 use riff-wave 27359>0 string LIST 27360>>&(4.l+4) use riff-walk 27361>0 string DISP 27362>>&(4.l+4) use riff-walk 27363>0 string bext 27364>>&(4.l+4) use riff-walk 27365>0 string Fake 27366>>&(4.l+4) use riff-walk 27367>0 string fact 27368>>&(4.l+4) use riff-walk 27369>0 string VP8 27370>>11 byte 0x9d 27371>>>12 byte 0x01 27372>>>>13 byte 0x2a \b, VP8 encoding 27373>>>>>14 leshort&0x3fff x \b, %d 27374>>>>>16 leshort&0x3fff x \bx%d, Scaling: 27375>>>>>14 leshort&0xc000 0x0000 \b [none] 27376>>>>>14 leshort&0xc000 0x1000 \b [5/4] 27377>>>>>14 leshort&0xc000 0x2000 \b [5/3] 27378>>>>>14 leshort&0xc000 0x3000 \b [2] 27379>>>>>14 leshort&0xc000 0x0000 \bx[none] 27380>>>>>14 leshort&0xc000 0x1000 \bx[5/4] 27381>>>>>14 leshort&0xc000 0x2000 \bx[5/3] 27382>>>>>14 leshort&0xc000 0x3000 \bx[2] 27383>>>>>15 byte&0x80 =0x00 \b, YUV color 27384>>>>>15 byte&0x80 =0x80 \b, bad color specification 27385>>>>>15 byte&0x40 =0x40 \b, no clamping required 27386>>>>>15 byte&0x40 =0x00 \b, decoders should clamp 27387#>0 string x we got %s 27388#>>&(4.l+4) use riff-walk 27389 27390# AVI section extended by Patrik Radman <patrik+file-magic@iki.fi> 27391# 273920 string RIFF RIFF (little-endian) data 27393# RIFF Palette format 27394# Update: Joerg Jenderek 27395# URL: https://en.wikipedia.org/wiki/Resource_Interchange_File_Format 27396# Reference: https://worms2d.info/Palette_file 27397>8 string PAL\ \b, palette 27398!:mime application/x-riff 27399# color palette by Microsoft Corporation 27400!:ext pal 27401# file size = chunk size + 8 in most cases 27402>>4 ulelong+8 x \b, %u bytes 27403# Extended PAL Format 27404>>12 string plth \b, extended 27405# Simple PAL Format 27406>>12 string data 27407# data chunk size = color entries * 4 + 4 + sometimes extra (4) appended bytes 27408>>>16 ulelong x \b, data size %u 27409# palVersion is always 0x0300 27410#>>>20 leshort x \b, version 0x%4.4x 27411# palNumEntries specifies the number of palette color entries 27412>>>22 uleshort x \b, %u entries 27413# after palPalEntry sized (number of color entries * 4 ) vector 27414>>>(22.s*4) ubequad x 27415# jump relative 22 ( 8 + 16) bytes forward points after end of file or to 27416# appended extra bytes like in http://safecolours.rigdenage.com/set(ms).zip/Protan(MS).pal 27417>>>>&16 ubelong x \b, extra bytes 27418>>>>>&-4 ubelong >0 0x%8.8x 27419# RIFF Device Independent Bitmap format 27420>8 string RDIB \b, device-independent bitmap 27421>>16 string BM 27422>>>30 leshort 12 \b, OS/2 1.x format 27423>>>>34 leshort x \b, %d x 27424>>>>36 leshort x %d 27425>>>30 leshort 64 \b, OS/2 2.x format 27426>>>>34 leshort x \b, %d x 27427>>>>36 leshort x %d 27428>>>30 leshort 40 \b, Windows 3.x format 27429>>>>34 lelong x \b, %d x 27430>>>>38 lelong x %d x 27431>>>>44 leshort x %d 27432# RIFF MIDI format 27433>8 string RMID \b, MIDI 27434# RIFF Multimedia Movie File format 27435>8 string RMMP \b, multimedia movie 27436# RIFF wrapper for MP3 27437>8 string RMP3 \b, MPEG Layer 3 audio 27438# Microsoft WAVE format (*.wav) 27439>8 string WAVE \b, WAVE audio 27440!:mime audio/x-wav 27441>>12 string >\0 27442>>>12 use riff-walk 27443# Update: Joerg Jenderek 27444# lower case for Corel Draw version 8 Bidi 27445>8 string/c cdr 27446# skip Corel CCX Clipart 27447>>8 string !CDRXcont 27448# Corel Draw Picture 27449>>>0 use corel-draw 27450# URL: http://fileformats.archiveteam.org/wiki/CCX_(Corel) 27451# Reference: http://mark0.net/download/triddefs_xml.7z/defs/c/ccx-corel.trid.xml 27452>>8 string =CDRXcont \b, Corel Clipart 27453!:mime application/x-corel-ccx 27454!:ext ccx 27455# 3rd chunk data {Corel\040Binary\040Meta\040File} 27456#>>>20 string x \b, 3rd '%-s' 27457>>>4 ulelong+8 x \b, %u bytes 27458# From: Joerg Jenderek 27459# URL: https://en.wikipedia.org/wiki/CorelDRAW 27460# Reference: http://fileformats.archiveteam.org/wiki/CorelDRAW 27461# Picture templates created by newer software start with RIFF type CDT 27462>8 string CDT 27463>>0 use corel-draw 27464# Picture templates with version 4.4 27465>8 string CDST 27466>>0 use corel-draw 27467# pattern created by newer software start with RIFF type PAT 27468>8 string PAT 27469>>0 use corel-draw 27470>8 string NUNDROOT \b, Steinberg CuBase 27471# AVI == Audio Video Interleave 27472>8 string AVI\040 \b, AVI 27473!:mime video/x-msvideo 27474>>12 string LIST 27475>>>20 string hdrlavih 27476>>>>&36 lelong x \b, %u x 27477>>>>&40 lelong x %u, 27478>>>>&4 lelong >1000000 <1 fps, 27479>>>>&4 lelong 1000000 1.00 fps, 27480>>>>&4 lelong 500000 2.00 fps, 27481>>>>&4 lelong 333333 3.00 fps, 27482>>>>&4 lelong 250000 4.00 fps, 27483>>>>&4 lelong 200000 5.00 fps, 27484>>>>&4 lelong 166667 6.00 fps, 27485>>>>&4 lelong 142857 7.00 fps, 27486>>>>&4 lelong 125000 8.00 fps, 27487>>>>&4 lelong 111111 9.00 fps, 27488>>>>&4 lelong 100000 10.00 fps, 27489# ]9.9,10.1[ 27490>>>>&4 lelong <101010 27491>>>>>&-4 lelong >99010 27492>>>>>>&-4 lelong !100000 ~10 fps, 27493>>>>&4 lelong 83333 12.00 fps, 27494# ]11.9,12.1[ 27495>>>>&4 lelong <84034 27496>>>>>&-4 lelong >82645 27497>>>>>>&-4 lelong !83333 ~12 fps, 27498>>>>&4 lelong 66667 15.00 fps, 27499# ]14.9,15.1[ 27500>>>>&4 lelong <67114 27501>>>>>&-4 lelong >66225 27502>>>>>>&-4 lelong !66667 ~15 fps, 27503>>>>&4 lelong 50000 20.00 fps, 27504>>>>&4 lelong 41708 23.98 fps, 27505>>>>&4 lelong 41667 24.00 fps, 27506# ]23.9,24.1[ 27507>>>>&4 lelong <41841 27508>>>>>&-4 lelong >41494 27509>>>>>>&-4 lelong !41708 27510>>>>>>>&-4 lelong !41667 ~24 fps, 27511>>>>&4 lelong 40000 25.00 fps, 27512# ]24.9,25.1[ 27513>>>>&4 lelong <40161 27514>>>>>&-4 lelong >39841 27515>>>>>>&-4 lelong !40000 ~25 fps, 27516>>>>&4 lelong 33367 29.97 fps, 27517>>>>&4 lelong 33333 30.00 fps, 27518# ]29.9,30.1[ 27519>>>>&4 lelong <33445 27520>>>>>&-4 lelong >33223 27521>>>>>>&-4 lelong !33367 27522>>>>>>>&-4 lelong !33333 ~30 fps, 27523>>>>&4 lelong <32224 >30 fps, 27524##>>>>&4 lelong x (%lu) 27525##>>>>&20 lelong x %lu frames, 27526# Note: The tests below assume that the AVI has 1 or 2 streams, 27527# "vids" optionally followed by "auds". 27528# (Should cover 99.9% of all AVIs.) 27529# assuming avih length = 56 27530>>>88 string LIST 27531>>>>96 string strlstrh 27532>>>>>108 string vids video: 27533>>>>>>&0 lelong 0 uncompressed 27534# skip past vids strh 27535>>>>>>(104.l+108) string strf 27536>>>>>>>(104.l+132) lelong 1 RLE 8bpp 27537>>>>>>>(104.l+132) string/c cvid Cinepak 27538>>>>>>>(104.l+132) string/c i263 Intel I.263 27539>>>>>>>(104.l+132) string/c iv32 Indeo 3.2 27540>>>>>>>(104.l+132) string/c iv41 Indeo 4.1 27541>>>>>>>(104.l+132) string/c iv50 Indeo 5.0 27542>>>>>>>(104.l+132) string/c mp42 Microsoft MPEG-4 v2 27543>>>>>>>(104.l+132) string/c mp43 Microsoft MPEG-4 v3 27544>>>>>>>(104.l+132) string/c fmp4 FFMpeg MPEG-4 27545>>>>>>>(104.l+132) string/c mjpg Motion JPEG 27546>>>>>>>(104.l+132) string/c div3 DivX 3 27547>>>>>>>>112 string/c div3 Low-Motion 27548>>>>>>>>112 string/c div4 Fast-Motion 27549>>>>>>>(104.l+132) string/c divx DivX 4 27550>>>>>>>(104.l+132) string/c dx50 DivX 5 27551>>>>>>>(104.l+132) string/c xvid XviD 27552>>>>>>>(104.l+132) string/c h264 H.264 27553>>>>>>>(104.l+132) string/c wmv3 Windows Media Video 9 27554>>>>>>>(104.l+132) string/c h264 X.264 or H.264 27555>>>>>>>(104.l+132) lelong 0 27556##>>>>>>>(104.l+132) string x (%.4s) 27557# skip past first (video) LIST 27558>>>>(92.l+96) string LIST 27559>>>>>(92.l+104) string strlstrh 27560>>>>>>(92.l+116) string auds \b, audio: 27561# auds strh length = 56: 27562>>>>>>>(92.l+172) string strf 27563>>>>>>>>(92.l+180) leshort 0x0001 uncompressed PCM 27564>>>>>>>>(92.l+180) leshort 0x0002 ADPCM 27565>>>>>>>>(92.l+180) leshort 0x0006 aLaw 27566>>>>>>>>(92.l+180) leshort 0x0007 uLaw 27567>>>>>>>>(92.l+180) leshort 0x0050 MPEG-1 Layer 1 or 2 27568>>>>>>>>(92.l+180) leshort 0x0055 MPEG-1 Layer 3 27569>>>>>>>>(92.l+180) leshort 0x2000 Dolby AC3 27570>>>>>>>>(92.l+180) leshort 0x0161 DivX 27571##>>>>>>>>(92.l+180) leshort x (0x%.4x) 27572>>>>>>>>(92.l+182) leshort 1 (mono, 27573>>>>>>>>(92.l+182) leshort 2 (stereo, 27574>>>>>>>>(92.l+182) leshort >2 (%d channels, 27575>>>>>>>>(92.l+184) lelong x %d Hz) 27576# auds strh length = 64: 27577>>>>>>>(92.l+180) string strf 27578>>>>>>>>(92.l+188) leshort 0x0001 uncompressed PCM 27579>>>>>>>>(92.l+188) leshort 0x0002 ADPCM 27580>>>>>>>>(92.l+188) leshort 0x0055 MPEG-1 Layer 3 27581>>>>>>>>(92.l+188) leshort 0x2000 Dolby AC3 27582>>>>>>>>(92.l+188) leshort 0x0161 DivX 27583##>>>>>>>>(92.l+188) leshort x (0x%.4x) 27584>>>>>>>>(92.l+190) leshort 1 (mono, 27585>>>>>>>>(92.l+190) leshort 2 (stereo, 27586>>>>>>>>(92.l+190) leshort >2 (%d channels, 27587>>>>>>>>(92.l+192) lelong x %d Hz) 27588# Animated Cursor format 27589>8 string ACON \b, animated cursor 27590# SoundFont 2 <mpruett@sgi.com> 27591>8 string sfbk SoundFont/Bank 27592# MPEG-1 wrapped in a RIFF, apparently 27593>8 string CDXA \b, wrapped MPEG-1 (CDXA) 27594>8 string 4XMV \b, 4X Movie file 27595# AMV-type AVI file: https://wiki.multimedia.cx/index.php?title=AMV 27596>8 string AMV\040 \b, AMV 27597>8 string WEBP \b, Web/P image 27598!:mime image/webp 27599>>12 use riff-walk 27600# From: Joerg Jenderek 27601# URL: https://en.wikipedia.org/wiki/CorelDRAW 27602# Reference: http://fileformats.archiveteam.org/wiki/CorelDRAW 27603# Note: Since version 3 CorelDraw Pictures are RIFF based 27604# but data chunks remain proprietary. 27605# Since version 14 til 15 packed as "content/riffData.cdr" and 27606# since 16 "content/root.dat" in ZIP container 27607# TODO: distinguish templates with version 12.5 from Designer illustration 12 27608# display information of RIFF based Corel Draw pictures, templates and patterns 276090 name corel-draw 27610# display second chunk for debugging 27611#>8 string x \b, [8]=%.8s 27612>0 string x \b, Corel Draw 27613#!:mime image/x-coreldraw 27614!:mime application/vnd.corel-draw 27615# used by newer pictures templates 27616>>8 string CDT 27617# used by templates with newer versions since 16 27618>>>12 string =fver Picture template (root.dat) 27619!:ext dat 27620# used by templates with older versions with vrsn tag 27621>>>12 string !fver 27622# used by templates with older versions 14-15 27623>>>>11 string >E Picture template (riffData.cdr) 27624!:ext cdr 27625# used by templates with older versions 11-13 27626>>>>11 string <F Picture template 27627!:ext cdt/cdrt 27628# used by older templates with version 4.4 27629>>8 string CDST Picture template 27630!:ext cdt 27631# used by templates with version 12.5 27632>>8 string DESC Picture template 27633!:ext cdt 27634# used by newer patterns with version 22 27635>>8 string PAT Pattern 27636!:ext dat 27637# remaining older templates, patterns, drawings 27638>>8 default x 27639# pattern with old version 4.y 27640>>>26 ulelong =0x0000206C Pattern 27641!:ext pat 27642# pattern with newer versions 27643>>>26 ulelong =0x00000D2C Pattern 27644!:ext pat 27645# remaining older templates or pictures 27646>>>26 default x 27647# used by older versions 5 - 15 27648>>>>12 string =vrsn 27649# 4th chunk size unequal 282Ch only found for CDR 27650>>>>>26 ulelong !0x0000282c Picture 27651!:ext cdr 27652>>>>>26 default x Picture or template 27653!:ext cdr/cdt 27654# used by newer versions since 16 27655>>>>12 string =fver Picture (root.dat) 27656!:ext dat 27657# version marked by 1 ASCII char: space~3, ... , F~15, ... , N~22, ... R~22 template 27658>11 string x \b, version 27659>11 string >\040 '%-.1s' 27660>0 use corel-version 27661>4 ulelong+8 x \b, %u bytes 27662# 27663# display numeric version of RIFF based Corel after 3rd RIFF tag 276640 name corel-version 27665# for debugging purpose; vrsn for short content; fver for 16 byte size 27666#>12 string x \b, TAG "%-4.4s" 27667# 1st data chunk length 2 implies short content version 27668>16 ulelong 2 27669# vrsn chunk short content interpreted by MajorVersion * 100 + MinorVersion 27670>>20 uleshort/100 x %u 27671>>20 uleshort%100 >0 \b.%u 27672# for debugging purpose display next chunk like: DISP LIST 27673#>>22 string x \b, 4th "%-4.4s" 27674#>>26 ulelong x \b, 4th SIZE 0x%x 27675# for debugging purpose display 5th chunk like: LIST DISP ccmm osfp 27676#>>(26.l+30) string x \b, 5th "%-4.4s" 27677# 1st data chunk length 10h implies 16 byte content with version info 27678>16 ulelong 0x10 27679>>34 ubyte x %u 27680>>>33 ubyte >0 \b.%u 27681# 27682# XXX - some of the below may only appear in little-endian form. 27683# 27684# Also "MV93" appears to be for one form of Macromedia Director 27685# files, and "GDMF" appears to be another multimedia format. 27686# 276870 string RIFX RIFF (big-endian) data 27688# RIFF Palette format 27689>8 string PAL \b, palette 27690>>16 beshort x \b, version %d 27691>>18 beshort x \b, %d entries 27692# RIFF Device Independent Bitmap format 27693>8 string RDIB \b, device-independent bitmap 27694>>16 string BM 27695>>>30 beshort 12 \b, OS/2 1.x format 27696>>>>34 beshort x \b, %d x 27697>>>>36 beshort x %d 27698>>>30 beshort 64 \b, OS/2 2.x format 27699>>>>34 beshort x \b, %d x 27700>>>>36 beshort x %d 27701>>>30 beshort 40 \b, Windows 3.x format 27702>>>>34 belong x \b, %d x 27703>>>>38 belong x %d x 27704>>>>44 beshort x %d 27705# RIFF MIDI format 27706>8 string RMID \b, MIDI 27707# RIFF Multimedia Movie File format 27708>8 string RMMP \b, multimedia movie 27709# Microsoft WAVE format (*.wav) 27710>8 string WAVE \b, WAVE audio 27711>>20 leshort 1 \b, Microsoft PCM 27712>>>34 leshort >0 \b, %d bit 27713>>22 beshort =1 \b, mono 27714>>22 beshort =2 \b, stereo 27715>>22 beshort >2 \b, %d channels 27716>>24 belong >0 %d Hz 27717# Corel Draw Picture big endian not tested by real examples 27718#>8 string CDRA \b, Corel Draw Picture 27719#>8 string CDR6 \b, Corel Draw Picture, version 6 27720>8 string CDR 27721>>0 use \^corel-draw 27722 27723# AVI == Audio Video Interleave 27724>8 string AVI\040 \b, AVI 27725# Animated Cursor format 27726>8 string ACON \b, animated cursor 27727# Notation Interchange File Format (big-endian only) 27728>8 string NIFF \b, Notation Interchange File Format 27729# SoundFont 2 <mpruett@sgi.com> 27730>8 string sfbk SoundFont/Bank 27731 27732#------------------------------------------------------------------------------ 27733# Sony Wave64 27734# see http://www.vcs.de/fileadmin/user_upload/MBS/PDF/Whitepaper/Informations_about_Sony_Wave64.pdf 27735# 128 bit RIFF-GUID { 66666972-912E-11CF-A5D6-28DB04C10000 } in little-endian 277360 string riff\x2E\x91\xCF\x11\xA5\xD6\x28\xDB\x04\xC1\x00\x00 Sony Wave64 RIFF data 27737# 128 bit + total file size (64 bits) so 24 bytes 27738# then WAVE-GUID { 65766177-ACF3-11D3-8CD1-00C04F8EDB8A } 27739>24 string wave\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A \b, WAVE 64 audio 27740!:mime audio/x-w64 27741# FMT-GUID { 20746D66-ACF3-11D3-8CD1-00C04F8EDB8A } 27742>>40 search/256 fmt\x20\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A \b 27743>>>&10 leshort =1 \b, mono 27744>>>&10 leshort =2 \b, stereo 27745>>>&10 leshort >2 \b, %d channels 27746>>>&12 lelong >0 %d Hz 27747 27748#------------------------------------------------------------------------------ 27749# MBWF/RF64 27750# see EBU TECH 3306 https://tech.ebu.ch/docs/tech/tech3306-2009.pdf 277510 string RF64\xff\xff\xff\xffWAVEds64 MBWF/RF64 audio 27752!:mime audio/x-wav 27753>40 search/256 fmt\x20 \b 27754>>&6 leshort =1 \b, mono 27755>>&6 leshort =2 \b, stereo 27756>>&6 leshort >2 \b, %d channels 27757>>&8 lelong >0 %d Hz 27758 27759#------------------------------------------------------------------------------ 27760# $File: rpi,v 1.2 2019/10/02 02:07:30 christos Exp $ 27761# rpi: file(1) magic for Raspberry Pi images 27762-44 lelong 0 27763>4 lelong 0 27764>>8 lelong 1 27765>>12 lelong 4 27766>>>16 string 283x 27767>>>>20 lelong 1 27768>>>>>24 lelong 4 27769>>>>>>28 string DTOK 27770>>>>>>>32 lelong 44 27771>>>>>>>>36 lelong 4 27772>>>>>>>>>40 string RPTL Raspberry PI kernel image 27773 27774-56 lelong 0 27775>4 lelong 0 27776>>8 lelong 1 27777>>12 lelong 4 27778>>>16 string 283x 27779>>>>20 lelong 1 27780>>>>>24 lelong 4 27781>>>>>>28 string DTOK 27782>>>>>>>32 lelong 1 27783>>>>>>>>36 lelong 4 27784>>>>>>>>>40 string DDTK8 27785>>>>>>>>>>48 lelong 4 27786>>>>>>>>>>>52 string RPTL Raspberry PI kernel image 27787 27788#------------------------------------------------------------------------------ 27789# $File: rpm,v 1.12 2013/01/11 16:45:23 christos Exp $ 27790# 27791# RPM: file(1) magic for Red Hat Packages Erik Troan (ewt@redhat.com) 27792# 277930 belong 0xedabeedb RPM 27794!:mime application/x-rpm 27795>4 byte x v%d 27796>5 byte x \b.%d 27797>6 beshort 1 src 27798>6 beshort 0 bin 27799>>8 beshort 1 i386/x86_64 27800>>8 beshort 2 Alpha/Sparc64 27801>>8 beshort 3 Sparc 27802>>8 beshort 4 MIPS 27803>>8 beshort 5 PowerPC 27804>>8 beshort 6 68000 27805>>8 beshort 7 SGI 27806>>8 beshort 8 RS6000 27807>>8 beshort 9 IA64 27808>>8 beshort 10 Sparc64 27809>>8 beshort 11 MIPSel 27810>>8 beshort 12 ARM 27811>>8 beshort 13 MiNT 27812>>8 beshort 14 S/390 27813>>8 beshort 15 S/390x 27814>>8 beshort 16 PowerPC64 27815>>8 beshort 17 SuperH 27816>>8 beshort 18 Xtensa 27817>>8 beshort 255 noarch 27818>>10 string x %s 27819 27820#delta RPM Daniel Novotny (dnovotny@redhat.com) 278210 string drpm Delta RPM 27822!:mime application/x-rpm 27823>12 string x %s 27824>>8 beshort 11 MIPSel 27825>>8 beshort 12 ARM 27826>>8 beshort 13 MiNT 27827>>8 beshort 14 S/390 27828>>8 beshort 15 S/390x 27829>>8 beshort 16 PowerPC64 27830>>8 beshort 17 SuperH 27831>>8 beshort 18 Xtensa 27832>>10 string x %s 27833 27834#------------------------------------------------------------------------------ 27835# $File: rpmsg,v 1.1 2019/04/19 00:40:47 christos Exp $ 27836# rpmsg: file(1) magic for restricted-permission messages (or "rights-protected" messages) 27837# see https://en.wikipedia.org/wiki/Rpmsg 27838 278390 string \x76\xe8\x04\x60\xc4\x11\xe3\x86 rpmsg Restricted Permission Message 27840 27841#------------------------------------------------------------------------------ 27842# $File: rst,v 1.3 2020/04/27 01:50:36 christos Exp $ 27843# rst: ReStructuredText http://docutils.sourceforge.net/rst.html 278440 search/256 \=\= 27845!:strength + 30 27846>&0 regex/256 \^[\=]+$ 27847>>&0 search/512 :Author: ReStructuredText file 27848>>&0 default x 27849>>>&0 regex/512 \^\\.\\.[A-Za-z] ReStructuredText file 27850!:ext rst 27851 27852#------------------------------------------------------------------------------ 27853# $File: rtf,v 1.8 2020/05/17 19:28:49 christos Exp $ 27854# rtf: file(1) magic for Rich Text Format (RTF) 27855# 27856# Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk 27857# Update: Joerg Jenderek 27858# URL: https://en.wikipedia.org/wiki/Rich_Text_Format 27859# Reference: http://www.snake.net/software/RTF/RTF-Spec-1.7.rtf 27860# http://www.kleinlercher.at/tools/Windows_Protocols/Word2007RTFSpec9.pdf 278610 string {\\rtf 27862# skip DROID fmt-355-signature-id-522.rtf by looking for valid version 27863>5 ubyte !0xAB 27864# skip also \ in DROID fmt-50-signature-id-158.rtf by looking for valid version 27865>>5 ubyte !0x5C Rich Text Format data 27866!:mime text/rtf 27867!:apple ????RTF 27868!:ext rtf 27869>>>0 use rtf-info 27870# display information like version, language and code page of RTF 278710 name rtf-info 27872# 1 mostly, 2 for newer Pocket Word documents, space for test like fdo78502.rtf, { for some urtf 27873>5 ubyte !0x7b \b, version %c 27874# The word for character set must precede any text or most other control words 27875>6 string \\mac \b, Apple Macintosh 27876>6 string \\pc 27877# control word \pca 27878>>9 ubyte =0x61 \b, IBM PS/2, code page 850 27879>>9 ubyte !0x61 \b, IBM PC, code page 437 27880# unknown character set or ANSI later after control words like 27881# \adeflang1025 \info \title \author \category \manager 27882# "Burow, Steffanie - Im Tal des Schneeleoparden.rtf" 27883#>6 search/105 \\ansi \b, ANSI 27884>6 search/502 \\ansi \b, ANSI 27885>6 default x \b, unknown character set 27886# look for explict codepage keyword 27887# "Burow, Steffanie - Im Tal des Schneeleoparden.rtf" 27888#>5 search/110 \\ansicpg 27889>5 search/500 \\ansicpg 27890# skip unknown or buggy codepage string 0 like in fdo78502.rtf 27891>>&0 ubyte !0x30 \b, code page 27892# codepage string: 437~United States IBM, ..., 1252~WesternEuropean, ..., 57011~Punjabi 27893>>>&-1 string x %-.3s 27894# skip space or \ and display possible 4th digit of code page string 27895>>>&2 ubyte >0x2F 27896>>>>&-1 ubyte <0x3A \b%c 27897# possible 5th digit of code page string 27898>>>>>&0 ubyte >0x2F 27899>>>>>>&-1 ubyte <0x3A \b%c 27900# look again at version byte to use default clause 27901>5 ubyte x 27902# Default language ID for South Asian/Middle Eastern text 27903# language ID: 1025, ..., 1065~Persian, ..., 2057~English_UnitedKingdom, ..., 58380~French_NorthAfrica 27904# Readme-0.72-Persian.rtf 27905#>6 search/1 \\adeflang \b, default middle east language ID 27906>>6 search/497 \\adeflang \b, default middle east language ID 27907# https://docs.microsoft.com/en-us/openspecs/office_standards/ms-oe376/6c085406-a698-4e12-9d4d-c3b0ee3dbc4a 27908>>>&0 string x %.4s 27909# skip \ and NL and show possible 5th digit of language string 27910>>>&4 ubyte >0x2F 27911>>>>&-1 ubyte <0x3A \b%c 27912# else look for default language to be used when the \plain control word is encountered 27913>>6 default x 27914# "Burow, Steffanie - Im Tal des Schneeleoparden.rtf" 27915#>>>6 search/127 \\deflang 27916>>>6 search/505 \\deflang 27917>>>>&0 string >0 \b, default language ID %-.4s 27918# possible 5th digit of language string 27919>>>>&4 ubyte >0x2F 27920>>>>>&-1 ubyte <0x3A \b%c 27921 27922# Reference: http://latex2rtf.sourceforge.net/rtfspec_63.html 27923# Note: no real world example found 279240 string {\\urtf Rich Text Format unicoded data 27925!:mime text/rtf 27926#!:apple ????RTF 27927!:ext rtf 27928>1 use rtf-info 27929 27930# URL: https://en.wikipedia.org/wiki/Microsoft_Word 27931# Reference: http://fileformats.archiveteam.org/wiki/Microsoft_Word 27932# Note: called by TrID "Pocket Word document" 27933# by PlanMaker "Pocket Word-Handheld PC" for pwd 27934# by PlanMaker "Pocket Word-Pocket PC" for psw 279350 string {\\pwd Pocket Word document or template 27936# by SoftMaker Office http://extension.nirsoft.net/pwd 27937#!:mime application/msword 27938# https://reposcope.com/mimetype/application/x-pocket-word 27939!:mime application/x-pocket-word 27940# PWD for Handheld PC variant and PSW for Pocket PC variant 27941# PWT for template 27942!:ext pwd/psw/pwt 27943>0 use rtf-info 27944 27945 27946#------------------------------------------------------------------------------ 27947# $File: ruby,v 1.10 2019/07/21 09:40:17 christos Exp $ 27948# ruby: file(1) magic for Ruby scripting language 27949# URL: https://www.ruby-lang.org/ 27950# From: Reuben Thomas <rrt@sc3d.org> 27951 27952# Ruby scripts 279530 search/1/w #!\ /usr/bin/ruby Ruby script text executable 27954!:strength + 15 27955!:mime text/x-ruby 279560 search/1/w #!\ /usr/local/bin/ruby Ruby script text executable 27957!:strength + 15 27958!:mime text/x-ruby 279590 search/1 #!/usr/bin/env\ ruby Ruby script text executable 27960!:strength + 15 27961!:mime text/x-ruby 279620 search/1 #!\ /usr/bin/env\ ruby Ruby script text executable 27963!:strength + 15 27964!:mime text/x-ruby 27965 27966# What looks like ruby, but does not have a shebang 27967# (modules and such) 27968# From: Lubomir Rintel <lkundrak@v3.sk> 279690 search/8192 require 27970>0 regex \^[[:space:]]*require[[:space:]]'[A-Za-z_/.]+' 27971>>0 regex def\ [a-z]|\ do$ 27972>>>&0 regex \^[[:space:]]*end([[:space:]]+[;#].*)?$ Ruby script text 27973!:strength + 30 27974!:mime text/x-ruby 279750 regex \^[[:space:]]*(class|module)[[:space:]][A-Z] 27976>0 regex (modul|includ)e\ [A-Z]|def\ [a-z] 27977>>&0 regex \^[[:space:]]*end([[:space:]]+[;#].*)?$ Ruby script text 27978!:strength + 30 27979!:mime text/x-ruby 27980# Classes with no modules or defs, beats simple ASCII 279810 regex \^[[:space:]]*(class|module)[[:space:]][A-Z] 27982>&0 regex \^[[:space:]]*end([[:space:]]+[;#if].*)?$ Ruby script text 27983!:strength + 10 27984!:mime text/x-ruby 27985# Looks for function definition to balance python magic 27986# def name (args) 27987# end 279880 search/8192 def\ 27989>0 regex \^[[:space:]]*def\ [a-z]|def\ [[:alpha:]]+::[a-z] 27990>>&0 regex \^[[:space:]]*end([[:space:]]+[;#].*)?$ Ruby script text 27991!:strength + 10 27992!:mime text/x-ruby 27993 279940 search/8192 require 27995>0 regex \^[[:space:]]*require[[:space:]]'[A-Za-z_/.]+' Ruby script text 27996!:mime text/x-ruby 279970 search/8192 include 27998>0 regex \^[[:space:]]*include\ ([A-Z]+[a-z]*(::))+ Ruby script text 27999!:mime text/x-ruby 28000 28001#------------------------------------------------------------------------------ 28002# $File: sc,v 1.6 2009/09/19 16:28:12 christos Exp $ 28003# sc: file(1) magic for "sc" spreadsheet 28004# 2800538 string Spreadsheet sc spreadsheet file 28006!:mime application/x-sc 28007 28008#------------------------------------------------------------------------------ 28009# $File: sccs,v 1.7 2017/03/17 21:35:28 christos Exp $ 28010# sccs: file(1) magic for SCCS archives 28011# 28012# SCCS archive structure: 28013# \001h01207 28014# \001s 00276/00000/00000 28015# \001d D 1.1 87/09/23 08:09:20 ian 1 0 28016# \001c date and time created 87/09/23 08:09:20 by ian 28017# \001e 28018# \001u 28019# \001U 28020# ... etc. 28021# Now '\001h' happens to be the same as the 3B20's a.out magic number (0550). 28022# *Sigh*. And these both came from various parts of the USG. 28023# Maybe we should just switch everybody from SCCS to RCS! 28024# Further, you can't just say '\001h0', because the five-digit number 28025# is a checksum that could (presumably) have any leading digit, 28026# and we don't have regular expression matching yet. 28027# Hence the following official kludge: 280288 string \001s\ SCCS archive data 28029 28030#------------------------------------------------------------------------------ 28031# $File: scientific,v 1.13 2019/04/19 00:42:27 christos Exp $ 28032# scientific: file(1) magic for scientific formats 28033# 28034# From: Joe Krahn <krahn@niehs.nih.gov> 28035 28036######################################################## 28037# CCP4 data and plot files: 280380 string MTZ\040 MTZ reflection file 28039 2804092 string PLOT%%84 Plot84 plotting file 28041>52 byte 1 , Little-endian 28042>55 byte 1 , Big-endian 28043 28044######################################################## 28045# Electron density MAP/MASK formats 28046 280470 string EZD_MAP NEWEZD Electron Density Map 28048109 string MAP\040( Old EZD Electron Density Map 28049 280500 string/c :-)\040Origin BRIX Electron Density Map 28051>170 string >0 , Sigma:%.12s 28052#>4 string >0 %.178s 28053#>4 addr x %.178s 28054 280557 string 18\040!NTITLE XPLOR ASCII Electron Density Map 280569 string \040!NTITLE\012\040REMARK CNS ASCII electron density map 28057 28058208 string MAP\040 CCP4 Electron Density Map 28059# Assumes same stamp for float and double (normal case) 28060>212 byte 17 \b, Big-endian 28061>212 byte 34 \b, VAX format 28062>212 byte 68 \b, Little-endian 28063>212 byte 85 \b, Convex native 28064 28065############################################################ 28066# X-Ray Area Detector images 280670 string R-AXIS4\ \ \ R-Axis Area Detector Image: 28068>796 lelong <20 Little-endian, IP #%d, 28069>>768 lelong >0 Size=%dx 28070>>772 lelong >0 \b%d 28071>796 belong <20 Big-endian, IP #%d, 28072>>768 belong >0 Size=%dx 28073>>772 belong >0 \b%d 28074 280750 string RAXIS\ \ \ \ \ R-Axis Area Detector Image, Win32: 28076>796 lelong <20 Little-endian, IP #%d, 28077>>768 lelong >0 Size=%dx 28078>>772 lelong >0 \b%d 28079>796 belong <20 Big-endian, IP #%d, 28080>>768 belong >0 Size=%dx 28081>>772 belong >0 \b%d 28082 28083 280841028 string MMX\000\000\000\000\000\000\000\000\000\000\000\000\000 MAR Area Detector Image, 28085>1072 ulong >1 Compressed(%d), 28086>1100 ulong >1 %d headers, 28087>1104 ulong >0 %d x 28088>1108 ulong >0 %d, 28089>1120 ulong >0 %d bits/pixel 28090 28091# Type: GEDCOM genealogical (family history) data 28092# From: Giuseppe Bilotta 280930 search/1/c 0\ HEAD GEDCOM genealogy text 28094>&0 search 1\ GEDC 28095>>&0 search 2\ VERS version 28096>>>&1 string >\0 %s 28097# From: Phil Endecott <phil05@chezphil.org> 280980 string \000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data 280990 string \060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data 281000 string \376\377\000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data 281010 string \377\376\060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data 28102 28103# PDB: Protein Data Bank files 28104# Adam Buchbinder <adam.buchbinder@gmail.com> 28105# 28106# https://www.wwpdb.org/documentation/format32/sect2.html 28107# https://www.ch.ic.ac.uk/chemime/ 28108# 28109# The PDB file format is fixed-field, 80 columns. From the spec: 28110# 28111# COLS DATA 28112# 1 - 6 "HEADER" 28113# 11 - 50 String(40) 28114# 51 - 59 Date 28115# 63 - 66 IDcode 28116# 28117# Thus, positions 7-10, 60-62 and 67-80 are spaces. The Date must be in the 28118# format DD-MMM-YY, e.g., 01-JAN-70, and the IDcode consists of numbers and 28119# uppercase letters. However, examples have been seen without the date string, 28120# e.g., the example on the chemime site. 281210 string HEADER\ \ \ \040 28122>&0 regex/1l \^.{40} 28123>>&0 regex/1l [0-9]{2}-[A-Z]{3}-[0-9]{2}\ {3} 28124>>>&0 regex/1ls [A-Z0-9]{4}.{14}$ 28125>>>>&0 regex/1l [A-Z0-9]{4} Protein Data Bank data, ID Code %s 28126!:mime chemical/x-pdb 28127>>>>0 regex/1l [0-9]{2}-[A-Z]{3}-[0-9]{2} \b, %s 28128 28129# Type: GDSII Stream file 281300 belong 0x00060002 GDSII Stream file 28131>4 byte 0x00 28132>>5 byte x version %d.0 28133>4 byte >0x00 version %d 28134>>5 byte x \b.%d 28135 28136# Type: LXT (interLaced eXtensible Trace) 28137# chrysn <chrysn@fsfe.org> 281380 beshort 0x0138 interLaced eXtensible Trace (LXT) file 28139>2 beshort >0 (Version %u) 28140 28141#------------------------------------------------------------------------------ 28142# $File: securitycerts,v 1.4 2009/09/19 16:28:12 christos Exp $ 281430 search/1 -----BEGIN\ CERTIFICATE------ RFC1421 Security Certificate text 281440 search/1 -----BEGIN\ NEW\ CERTIFICATE RFC1421 Security Certificate Signing Request text 281450 belong 0xedfeedfe Sun 'jks' Java Keystore File data 28146 281470 string \0volume_key volume_key escrow packet 28148# Type: SE Linux policy modules *.pp reference policy 28149# for Fedora 5 to 9, RHEL5, and Debian Etch and Lenny. 28150# URL: https://doc.coker.com.au/computers/selinux-magic 28151# From: Russell Coker <russell@coker.com.au> 28152 281530 lelong 0xf97cff8f SE Linux modular policy 28154>4 lelong x version %d, 28155>8 lelong x %d sections, 28156>>(12.l) lelong 0xf97cff8d 28157>>>(12.l+27) lelong x mod version %d, 28158>>>(12.l+31) lelong 0 Not MLS, 28159>>>(12.l+31) lelong 1 MLS, 28160>>>(12.l+23) lelong 2 28161>>>>(12.l+47) string >\0 module name %s 28162>>>(12.l+23) lelong 1 base 28163 281641 string policy_module( SE Linux policy module source 281652 string policy_module( SE Linux policy module source 28166 281670 string ##\ <summary> SE Linux policy interface source 28168 28169#0 search gen_context( SE Linux policy file contexts 28170 28171#0 search gen_sens( SE Linux policy MLS constraints source 28172 28173#------------------------------------------------------------------------------ 28174# $File: sendmail,v 1.11 2019/04/19 00:42:27 christos Exp $ 28175# sendmail: file(1) magic for sendmail config files 28176# 28177# XXX - byte order? 28178# 28179# Update: Joerg Jenderek 28180# GRR: this test is too general as it catches also 28181# READ.ME.FIRST.AWP Sendmail frozen configuration 28182# - version ====|====|====|====|====|====|====|====|====|====|====|====|=== 28183# Email_23_f217153422.ts Sendmail frozen configuration 28184# - version \330jK\354 281850 byte 046 28186# https://www.sendmail.com/sm/open_source/docs/older_release_notes/ 28187# freezed configuration file (dbm format?) created from sendmal.cf with -bz 28188# by older sendmail. til version 8.6 support for frozen configuration files is removed 28189# valid version numbers look like "7.14.4" and should be similar to output of commands 28190# "sendmail -d0 -bt < /dev/null |grep -i Version" or "egrep '^DZ' /etc/sendmail.cf" 28191>16 regex/s =^[0-78][0-9.]{4} Sendmail frozen configuration 28192# normally only /etc/sendmail.fc or /var/adm/sendmail/sendmail.fc 28193!:ext fc 28194>>16 string >\0 - version %s 281950 short 0x271c 28196# look for valid version number 28197>16 regex/s =^[0-78][0-9.]{4} Sendmail frozen configuration 28198!:ext fc 28199>>16 string >\0 - version %s 28200 28201#------------------------------------------------------------------------------ 28202# sendmail: file(1) magic for sendmail m4(1) files 28203# 28204# From Hendrik Scholz <hendrik@scholz.net> 28205# i.e. files in /usr/share/sendmail/cf/ 28206# 282070 string divert(-1)\n sendmail m4 text file 28208 28209 28210#------------------------------------------------------------------------------ 28211# $File: sequent,v 1.14 2019/04/19 00:42:27 christos Exp $ 28212# sequent: file(1) magic for Sequent machines 28213# 28214# Sequent information updated by Don Dwiggins <atsun!dwiggins>. 28215# For Sequent's multiprocessor systems (incomplete). 282160 lelong 0x00ea BALANCE NS32000 .o 28217>16 lelong >0 not stripped 28218>124 lelong >0 version %d 282190 lelong 0x10ea BALANCE NS32000 executable (0 @ 0) 28220>16 lelong >0 not stripped 28221>124 lelong >0 version %d 282220 lelong 0x20ea BALANCE NS32000 executable (invalid @ 0) 28223>16 lelong >0 not stripped 28224>124 lelong >0 version %d 282250 lelong 0x30ea BALANCE NS32000 standalone executable 28226>16 lelong >0 not stripped 28227>124 lelong >0 version %d 28228# 28229# Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>. 28230# Symmetry magic nums will not be reached if DOS COM comes before them; 28231# byte 0xeb is matched before these get a chance. 282320 leshort 0x12eb SYMMETRY i386 .o 28233>16 lelong >0 not stripped 28234>124 lelong >0 version %d 282350 leshort 0x22eb SYMMETRY i386 executable (0 @ 0) 28236>16 lelong >0 not stripped 28237>124 lelong >0 version %d 282380 leshort 0x32eb SYMMETRY i386 executable (invalid @ 0) 28239>16 lelong >0 not stripped 28240>124 lelong >0 version %d 28241# https://en.wikipedia.org/wiki/Sequent_Computer_Systems 28242# below test line conflicts with MS-DOS 2.11 floppies and Acronis loader 28243#0 leshort 0x42eb SYMMETRY i386 standalone executable 282440 leshort 0x42eb 28245# skip unlike negative version 28246>124 lelong >-1 28247# assuming version 28867614 is very low probable 28248>>124 lelong !28867614 SYMMETRY i386 standalone executable 28249>>>16 lelong >0 not stripped 28250>>>124 lelong >0 version %d 28251 28252#------------------------------------------------------------------------------ 28253# $File: sereal,v 1.3 2015/02/05 19:14:45 christos Exp $ 28254# sereal: file(1) magic the Sereal binary serialization format 28255# 28256# From: Ævar Arnfjörð Bjarmason <avarab@gmail.com> 28257# 28258# See the specification of the format at 28259# https://github.com/Sereal/Sereal/blob/master/sereal_spec.pod#document-header-format 28260# 28261# I'd have liked to do the byte&0xF0 matching against 0, 1, 2 ... by 28262# doing (byte&0xF0)>>4 here, but unfortunately that's not 28263# supported. So when we print out a message about an unknown format 28264# we'll print out e.g. 0x30 instead of the more human-readable 28265# 0x30>>4. 28266# 28267# See https://github.com/Sereal/Sereal/commit/35372ae01d in the 28268# Sereal.git repository for test Sereal data. 282690 name sereal 28270>4 byte&0x0F x (version %d, 28271>4 byte&0xF0 0x00 uncompressed) 28272>4 byte&0xF0 0x10 compressed with non-incremental Snappy) 28273>4 byte&0xF0 0x20 compressed with incremental Snappy) 28274>4 byte&0xF0 >0x20 unknown subformat, flag: %d>>4) 28275 282760 string/b \=srl Sereal data packet 28277!:mime application/sereal 28278>&0 use sereal 282790 string/b \=\xF3rl Sereal data packet 28280!:mime application/sereal 28281>&0 use sereal 282820 string/b \=\xC3\xB3rl Sereal data packet, UTF-8 encoded 28283!:mime application/sereal 28284>&0 use sereal 28285 28286 28287#------------------------------------------------------------------------------ 28288# $File: sgi,v 1.23 2018/05/29 02:26:56 christos Exp $ 28289# sgi: file(1) magic for Silicon Graphics operating systems and applications 28290# 28291# Executable images are handled either in aout (for old-style a.out 28292# files for 68K; they are indistinguishable from other big-endian 32-bit 28293# a.out files) or in mips (for MIPS ECOFF and Ucode files) 28294# 28295 28296# kbd file definitions 282970 string kbd!map kbd map file 28298>8 byte >0 Ver %d: 28299>10 short >0 with %d table(s) 28300 283010 beshort 0x8765 disk quotas file 28302 283030 beshort 0x0506 IRIS Showcase file 28304>2 byte 0x49 - 28305>3 byte x - version %d 283060 beshort 0x0226 IRIS Showcase template 28307>2 byte 0x63 - 28308>3 byte x - version %d 283090 belong 0x5343464d IRIS Showcase file 28310>4 byte x - version %d 283110 belong 0x5443464d IRIS Showcase template 28312>4 byte x - version %d 283130 belong 0xdeadbabe IRIX Parallel Arena 28314>8 belong >0 - version %d 28315 28316# core files 28317# 28318# 32bit core file 283190 belong 0xdeadadb0 IRIX core dump 28320>4 belong 1 of 28321>16 string >\0 '%s' 28322# 64bit core file 283230 belong 0xdeadad40 IRIX 64-bit core dump 28324>4 belong 1 of 28325>16 string >\0 '%s' 28326# N32bit core file 283270 belong 0xbabec0bb IRIX N32 core dump 28328>4 belong 1 of 28329>16 string >\0 '%s' 28330# New style crash dump file 283310 string \x43\x72\x73\x68\x44\x75\x6d\x70 IRIX vmcore dump of 28332>36 string >\0 '%s' 28333 28334# Trusted IRIX info 283350 string SGIAUDIT SGI Audit file 28336>8 byte x - version %d 28337>9 byte x \b.%d 28338# 283390 string WNGZWZSC Wingz compiled script 283400 string WNGZWZSS Wingz spreadsheet 283410 string WNGZWZHP Wingz help file 28342# 283430 string #Inventor\040V IRIS Inventor 1.0 file 283440 string #Inventor\040V2 Open Inventor 2.0 file 28345# GLF is OpenGL stream encoding 283460 string glfHeadMagic(); GLF_TEXT 283474 belong 0x7d000000 GLF_BINARY_LSB_FIRST 28348!:strength -30 283494 belong 0x0000007d GLF_BINARY_MSB_FIRST 28350!:strength -30 28351# GLS is OpenGL stream encoding; GLS is the successor of GLF 283520 string glsBeginGLS( GLS_TEXT 283534 belong 0x10000000 GLS_BINARY_LSB_FIRST 28354!:strength -30 283554 belong 0x00000010 GLS_BINARY_MSB_FIRST 28356!:strength -30 28357 28358# Performance Co-Pilot file types 283590 string PmNs PCP compiled namespace (V.0) 283600 string PmN PCP compiled namespace 28361>3 string >\0 (V.%1.1s) 28362#3 lelong 0x84500526 PCP archive 283633 belong 0x84500526 PCP archive 28364>7 byte x (V.%d) 28365#>20 lelong -2 temporal index 28366#>20 lelong -1 metadata 28367#>20 lelong 0 log volume #0 28368#>20 lelong >0 log volume #%d 28369>20 belong -2 temporal index 28370>20 belong -1 metadata 28371>20 belong 0 log volume #0 28372>20 belong >0 log volume #%d 28373>24 string >\0 host: %s 283740 string PCPFolio PCP 28375>9 string Version: Archive Folio 28376>18 string >\0 (V.%s) 283770 string #pmchart PCP pmchart view 28378>9 string Version 28379>17 string >\0 (V%-3.3s) 283800 string #kmchart PCP kmchart view 28381>9 string Version 28382>17 string >\0 (V.%s) 283830 string pmview PCP pmview config 28384>7 string Version 28385>15 string >\0 (V%-3.3s) 283860 string #pmlogger PCP pmlogger config 28387>10 string Version 28388>18 string >\0 (V%1.1s) 283890 string #pmdahotproc PCP pmdahotproc config 28390>13 string Version 28391>21 string >\0 (V%-3.3s) 283920 string PcPh PCP Help 28393>4 string 1 Index 28394>4 string 2 Text 28395>5 string >\0 (V.%1.1s) 283960 string #pmieconf-rules PCP pmieconf rules 28397>16 string >\0 (V.%1.1s) 283983 string pmieconf-pmie PCP pmie config 28399>17 string >\0 (V.%1.1s) 284000 string MMV PCP memory mapped values 28401>4 long x (V.%d) 28402 28403# SpeedShop data files 284040 lelong 0x13130303 SpeedShop data file 28405 28406# mdbm files 284070 lelong 0x01023962 mdbm file, version 0 (obsolete) 284080 string mdbm mdbm file, 28409>5 byte x version %d, 28410>6 byte x 2^%d pages, 28411>7 byte x pagesize 2^%d, 28412>17 byte x hash %d, 28413>11 byte x dataformat %d 28414 28415# Alias Maya files 284160 string/t //Maya\040ASCII Alias Maya Ascii File, 28417>13 string >\0 version %s 284188 string MAYAFOR4 Alias Maya Binary File, 28419>32 string >\0 version %s scene 284208 string MayaFOR4 Alias Maya Binary File, 28421>32 string >\0 version %s scene 284228 string CIMG Alias Maya Image File 284238 string DEEP Alias Maya Image File 28424 28425#------------------------------------------------------------------------------ 28426# $File: sgml,v 1.41 2020/06/07 18:16:43 christos Exp $ 28427# Type: SVG Vectorial Graphics 28428# From: Noel Torres <tecnico@ejerciciosresueltos.com> 284290 string \<?xml\ version= 28430>14 regex ['"\ \t]*[0-9.]+['"\ \t]* 28431>>19 search/4096 \<svg SVG Scalable Vector Graphics image 28432!:mime image/svg+xml 28433>>19 search/4096 \<gnc-v2 GnuCash file 28434!:mime application/x-gnucash 284350 string \<svg SVG Scalable Vector Graphics image 28436!:mime image/svg+xml 28437 28438# Sitemap file 284390 string/t \<?xml\ version= 28440>14 regex ['"\ \t]*[0-9.]+['"\ \t]* 28441>>19 search/4096 \<urlset XML Sitemap document text 28442!:mime application/xml-sitemap 28443 28444# OpenStreetMap XML (.osm) 28445# https://wiki.openstreetmap.org/wiki/OSM_XML 28446# From: Markus Heidelberg <markus.heidelberg@web.de> 284470 string \<?xml\ version= 28448>14 regex ['"\ \t]*[0-9.]+['"\ \t]* 28449>>19 search/4096 \<osm OpenStreetMap XML data 28450 28451# xhtml 284520 string/t \<?xml\ version=" 28453>19 search/4096/cWbt \<!doctype\ html XHTML document text 28454>>15 string >\0 (version %.3s) 28455!:mime text/html 284560 string/t \<?xml\ version=' 28457>19 search/4096/cWbt \<!doctype\ html XHTML document text 28458>>15 string >\0 (version %.3s) 28459!:mime text/html 284600 string/t \<?xml\ version=" 28461>19 search/4096/cWbt \<html broken XHTML document text 28462>>15 string >\0 (version %.3s) 28463!:mime text/html 28464 28465#------------------------------------------------------------------------------ 28466# sgml: file(1) magic for Standard Generalized Markup Language 28467# HyperText Markup Language (HTML) is an SGML document type, 28468# from Daniel Quinlan (quinlan@yggdrasil.com) 28469# adapted to string extenstions by Anthon van der Neut <anthon@mnt.org) 284700 search/4096/cWt \<!doctype\ html HTML document text 28471!:mime text/html 28472!:strength + 5 28473 28474# SVG document 28475# https://www.w3.org/TR/SVG/single-page.html 284760 search/4096/cWbt \<!doctype\ svg SVG XML document 28477!:mime image/svg+xml 28478!:strength + 5 28479 284800 search/4096/cwt \<head\> HTML document text 28481!:mime text/html 28482!:strength + 5 284830 search/4096/cWt \<head\ HTML document text 28484!:mime text/html 28485!:strength + 5 284860 search/4096/cwt \<title\> HTML document text 28487!:mime text/html 28488!:strength + 5 284890 search/4096/cWt \<title\ HTML document text 28490!:mime text/html 28491!:strength + 5 284920 search/4096/cwt \<html\> HTML document text 28493!:mime text/html 28494!:strength + 5 284950 search/4096/cWt \<html\ HTML document text 28496!:mime text/html 28497!:strength + 5 284980 search/4096/cwt \<script\> HTML document text 28499!:mime text/html 28500!:strength + 5 285010 search/4096/cWt \<script\ HTML document text 28502!:mime text/html 28503!:strength + 5 285040 search/4096/cwt \<style\> HTML document text 28505!:mime text/html 28506!:strength + 5 285070 search/4096/cWt \<style\ HTML document text 28508!:mime text/html 28509!:strength + 5 285100 search/4096/cwt \<table\> HTML document text 28511!:mime text/html 28512!:strength + 5 285130 search/4096/cWt \<table\ HTML document text 28514!:mime text/html 28515!:strength + 5 28516 285170 search/4096/cwt \<a\ href= HTML document text 28518!:mime text/html 28519!:strength + 5 28520 28521# Extensible markup language (XML), a subset of SGML 28522# from Marc Prud'hommeaux (marc@apocalypse.org) 285230 search/1/cwt \<?xml XML document text 28524!:mime text/xml 28525!:strength + 5 285260 string/t \<?xml\ version\ " XML 28527!:mime text/xml 28528!:strength + 5 285290 string/t \<?xml\ version=" XML 28530!:mime text/xml 28531!:strength + 5 28532>15 string/t >\0 %.3s document text 28533>>23 search/1 \<xsl:stylesheet (XSL stylesheet) 28534>>24 search/1 \<xsl:stylesheet (XSL stylesheet) 285350 string/t \<?xml\ version=' XML 28536!:mime text/xml 28537!:strength + 5 28538>15 string/t >\0 %.3s document text 28539>>23 search/1 \<xsl:stylesheet (XSL stylesheet) 28540>>24 search/1 \<xsl:stylesheet (XSL stylesheet) 285410 search/1/wt \<?XML broken XML document text 28542!:mime text/xml 28543!:strength - 10 28544 28545 28546# SGML, mostly from rph@sq 285470 search/4096/cwt \<!doctype exported SGML document text 285480 search/4096/cwt \<!subdoc exported SGML subdocument text 285490 search/4096/cwt \<!-- exported SGML document text 28550!:strength - 10 28551 28552# Web browser cookie files 28553# (Mozilla, Galeon, Netscape 4, Konqueror..) 28554# Ulf Harnhammar <ulfh@update.uu.se> 285550 search/1 #\ HTTP\ Cookie\ File Web browser cookie text 285560 search/1 #\ Netscape\ HTTP\ Cookie\ File Netscape cookie text 285570 search/1 #\ KDE\ Cookie\ File Konqueror cookie text 28558 28559# XML-based format representing braille pages in a digital format. 28560# 28561# Specification: 28562# http://files.pef-format.org/specifications/pef-2008-1/pef-specification.html 28563# 28564# Simon Aittamaa <simon.aittamaa@gmail.com> 285650 string \<?xml\ version= 28566>14 regex ['"\ \t]*[0-9.]+['"\ \t]* 28567>>19 search/4096 \<pef Portable Embosser Format 28568!:mime application/x-pef+xml 28569 28570#------------------------------------------------------------------------ 28571# $File: sharc,v 1.8 2017/03/17 21:35:28 christos Exp $ 28572# file(1) magic for sharc files 28573# 28574# SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by 28575# FutureGroove Music (dsp@futuregroove.de) 28576 28577#------------------------------------------------------------------------ 28578#0 string Draw RiscOS Drawfile 28579#0 string PACK RiscOS PackdDir archive 28580 28581#------------------------------------------------------------------------ 28582# SHARC DSP stuff (based on the FGM SHARC DSP SDK) 28583 28584#0 string =! Assembler source 28585#0 string Analog ADi asm listing file 285860 string .SYSTEM SHARC architecture file 285870 string .system SHARC architecture file 28588 285890 leshort 0x521C SHARC COFF binary 28590>2 leshort >1 , %d sections 28591>>12 lelong >0 , not stripped 28592 28593#------------------------------------------------------------------------------ 28594# $File: sinclair,v 1.6 2015/11/14 13:38:35 christos Exp $ 28595# sinclair: file(1) sinclair QL 28596 28597# additions to /etc/magic by Thomas M. Ott (ThMO) 28598 28599# Sinclair QL floppy disk formats (ThMO) 286000 string =QL5 QL disk dump data, 28601>3 string =A 720 KB, 28602>3 string =B 1.44 MB, 28603>3 string =C 3.2 MB, 28604>4 string >\0 label:%.10s 28605 28606# Sinclair QL OS dump (ThMO) 286070 belong =0x30000 28608>49124 belong <47104 28609>>49128 belong <47104 28610>>>49132 belong <47104 28611>>>>49136 belong <47104 QL OS dump data, 28612>>>>>49148 string >\0 type %.3s, 28613>>>>>49142 string >\0 version %.4s 28614 28615# Sinclair QL firmware executables (ThMO) 286160 string NqNqNq`\004 QL firmware executable (BCPL) 28617 28618# Sinclair QL libraries (was ThMO) 286190 beshort 0xFB01 QDOS object 28620>2 pstring x '%s' 28621 28622# Sinclair QL executables (was ThMO) 286234 belong 0x4AFB QDOS executable 28624>9 pstring x '%s' 28625 28626# Sinclair QL ROM (ThMO) 286270 belong =0x4AFB0001 QL plugin-ROM data, 28628>9 pstring =\0 un-named 28629>9 pstring >\0 named: %s 28630# Type: SiSU Markup Language 28631# URL: http://www.sisudoc.org/ 28632# From: Ralph Amissah <ralph.amissah@gmail.com> 28633 286340 regex \^%?[\ \t]*SiSU[\ \t]+insert SiSU text insert 28635>5 regex [0-9.]+ %s 28636 286370 regex \^%[\ \t]+SiSU[\ \t]+master SiSU text master 28638>5 regex [0-9.]+ %s 28639 286400 regex \^%?[\ \t]*SiSU[\ \t]+text SiSU text 28641>5 regex [0-9.]+ %s 28642 286430 regex \^%?[\ \t]*SiSU[\ \t][0-9.]+ SiSU text 28644>5 regex [0-9.]+ %s 28645 286460 regex \^%*[\ \t]*sisu-[0-9.]+ SiSU text 28647>5 regex [0-9.]+ %s 28648 28649#------------------------------------------------------------------------------ 28650# $File: sketch,v 1.5 2017/03/17 21:35:28 christos Exp $ 28651# Sketch Drawings: http://sketch.sourceforge.net/ 28652# From: Edwin Mons <e@ik.nu> 286530 search/1 ##Sketch Sketch document text 28654 28655#----------------------------------------------- 28656# $File: smalltalk,v 1.5 2009/09/19 16:28:12 christos Exp $ 28657# GNU Smalltalk image, starting at version 1.6.2 28658# From: catull_us@yahoo.com 28659# 286600 string GSTIm\0\0 GNU SmallTalk 28661# little-endian 28662>7 byte&1 =0 LE image version 28663>>10 byte x %d. 28664>>9 byte x \b%d. 28665>>8 byte x \b%d 28666#>>12 lelong x , data: %ld 28667#>>16 lelong x , table: %ld 28668#>>20 lelong x , memory: %ld 28669# big-endian 28670>7 byte&1 =1 BE image version 28671>>8 byte x %d. 28672>>9 byte x \b%d. 28673>>10 byte x \b%d 28674#>>12 belong x , data: %ld 28675#>>16 belong x , table: %ld 28676#>>20 belong x , memory: %ld 28677 28678 28679 28680#------------------------------------------------------------------------------ 28681# $File: smile,v 1.1 2011/08/17 17:37:18 christos Exp $ 28682# smile: file(1) magic for Smile serialization 28683# 28684# The Smile serialization format uses a 4-byte header: 28685# 28686# Constant byte #0: 0x3A (ASCII ':') 28687# Constant byte #1: 0x29 (ASCII ')') 28688# Constant byte #2: 0x0A (ASCII linefeed, '\n') 28689# Variable byte #3, consisting of bits: 28690# Bits 4-7 (4 MSB): 4-bit version number 28691# Bits 3: Reserved 28692# Bit 2 (mask 0x04): Whether raw binary (unescaped 8-bit) values may be present in content 28693# Bit 1 (mask 0x02): Whether shared String value checking was enabled during encoding, default false 28694# Bit 0 (mask 0x01): Whether shared property name checking was enabled during encoding, default true 28695# 28696# Reference: http://wiki.fasterxml.com/SmileFormatSpec 28697# Created by: Pierre-Alexandre Meyer <pierre@mouraf.org> 28698 28699# Detection 287000 string :)\n Smile binary data 28701 28702# Versioning 28703>3 byte&0xF0 x version %d: 28704 28705# Properties 28706>3 byte&0x04 0x04 binary raw, 28707>3 byte&0x04 0x00 binary encoded, 28708>3 byte&0x02 0x02 shared String values enabled, 28709>3 byte&0x02 0x00 shared String values disabled, 28710>3 byte&0x01 0x01 shared field names enabled 28711>3 byte&0x01 0x00 shared field names disabled 28712 28713 28714#------------------------------------------------------------------------------ 28715# $File: sniffer,v 1.28 2020/03/13 16:47:29 christos Exp $ 28716# sniffer: file(1) magic for packet capture files 28717# 28718# From: guy@alum.mit.edu (Guy Harris) 28719# 28720 28721# 28722# Microsoft Network Monitor 1.x capture files. 28723# 287240 string RTSS NetMon capture file 28725>5 byte x - version %d 28726>4 byte x \b.%d 28727>6 leshort 0 (Unknown) 28728>6 leshort 1 (Ethernet) 28729>6 leshort 2 (Token Ring) 28730>6 leshort 3 (FDDI) 28731>6 leshort 4 (ATM) 28732>6 leshort >4 (type %d) 28733 28734# 28735# Microsoft Network Monitor 2.x capture files. 28736# 287370 string GMBU NetMon capture file 28738>5 byte x - version %d 28739>4 byte x \b.%d 28740>6 leshort 0 (Unknown) 28741>6 leshort 1 (Ethernet) 28742>6 leshort 2 (Token Ring) 28743>6 leshort 3 (FDDI) 28744>6 leshort 4 (ATM) 28745>6 leshort 5 (IP-over-IEEE 1394) 28746>6 leshort 6 (802.11) 28747>6 leshort 7 (Raw IP) 28748>6 leshort 8 (Raw IP) 28749>6 leshort 9 (Raw IP) 28750>6 leshort >9 (type %d) 28751 28752# 28753# Network General Sniffer capture files. 28754# Sorry, make that "Network Associates Sniffer capture files." 28755# Sorry, make that "Network General old DOS Sniffer capture files." 28756# 287570 string TRSNIFF\040data\040\040\040\040\032 Sniffer capture file 28758>33 byte 2 (compressed) 28759>23 leshort x - version %d 28760>25 leshort x \b.%d 28761>32 byte 0 (Token Ring) 28762>32 byte 1 (Ethernet) 28763>32 byte 2 (ARCNET) 28764>32 byte 3 (StarLAN) 28765>32 byte 4 (PC Network broadband) 28766>32 byte 5 (LocalTalk) 28767>32 byte 6 (Znet) 28768>32 byte 7 (Internetwork Analyzer) 28769>32 byte 9 (FDDI) 28770>32 byte 10 (ATM) 28771 28772# 28773# Cinco Networks NetXRay capture files. 28774# Sorry, make that "Network General Sniffer Basic capture files." 28775# Sorry, make that "Network Associates Sniffer Basic capture files." 28776# Sorry, make that "Network Associates Sniffer Basic, and Windows 28777# Sniffer Pro", capture files." 28778# Sorry, make that "Network General Sniffer capture files." 28779# Sorry, make that "NetScout Sniffer capture files." 28780# 287810 string XCP\0 NetXRay capture file 28782>4 string >\0 - version %s 28783>44 leshort 0 (Ethernet) 28784>44 leshort 1 (Token Ring) 28785>44 leshort 2 (FDDI) 28786>44 leshort 3 (WAN) 28787>44 leshort 8 (ATM) 28788>44 leshort 9 (802.11) 28789 28790# 28791# "libpcap" capture files. 28792# https://www.tcpdump.org/manpages/pcap-savefile.5.html 28793# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is 28794# the main program that uses that format, but there are other programs 28795# that use "libpcap", or that use the same capture file format.) 28796# 287970 name pcap-be 28798>4 beshort x - version %d 28799>6 beshort x \b.%d 28800# clear that continuation level match 28801>20 clear x 28802>20 belong&0x03FFFFFF 0 (No link-layer encapsulation 28803>20 belong&0x03FFFFFF 1 (Ethernet 28804>20 belong&0x03FFFFFF 2 (3Mb Ethernet 28805>20 belong&0x03FFFFFF 3 (AX.25 28806>20 belong&0x03FFFFFF 4 (ProNET 28807>20 belong&0x03FFFFFF 5 (CHAOS 28808>20 belong&0x03FFFFFF 6 (Token Ring 28809>20 belong&0x03FFFFFF 7 (BSD ARCNET 28810>20 belong&0x03FFFFFF 8 (SLIP 28811>20 belong&0x03FFFFFF 9 (PPP 28812>20 belong&0x03FFFFFF 10 (FDDI 28813>20 belong&0x03FFFFFF 11 (RFC 1483 ATM 28814>20 belong&0x03FFFFFF 12 (Raw IP 28815>20 belong&0x03FFFFFF 13 (BSD/OS SLIP 28816>20 belong&0x03FFFFFF 14 (BSD/OS PPP 28817>20 belong&0x03FFFFFF 19 (Linux ATM Classical IP 28818>20 belong&0x03FFFFFF 50 (PPP or Cisco HDLC 28819>20 belong&0x03FFFFFF 51 (PPP-over-Ethernet 28820>20 belong&0x03FFFFFF 99 (Symantec Enterprise Firewall 28821>20 belong&0x03FFFFFF 100 (RFC 1483 ATM 28822>20 belong&0x03FFFFFF 101 (Raw IP 28823>20 belong&0x03FFFFFF 102 (BSD/OS SLIP 28824>20 belong&0x03FFFFFF 103 (BSD/OS PPP 28825>20 belong&0x03FFFFFF 104 (BSD/OS Cisco HDLC 28826>20 belong&0x03FFFFFF 105 (802.11 28827>20 belong&0x03FFFFFF 106 (Linux Classical IP over ATM 28828>20 belong&0x03FFFFFF 107 (Frame Relay 28829>20 belong&0x03FFFFFF 108 (OpenBSD loopback 28830>20 belong&0x03FFFFFF 109 (OpenBSD IPsec encrypted 28831>20 belong&0x03FFFFFF 112 (Cisco HDLC 28832>20 belong&0x03FFFFFF 113 (Linux cooked v1 28833>20 belong&0x03FFFFFF 114 (LocalTalk 28834>20 belong&0x03FFFFFF 117 (OpenBSD PFLOG 28835>20 belong&0x03FFFFFF 119 (802.11 with Prism header 28836>20 belong&0x03FFFFFF 122 (RFC 2625 IP over Fibre Channel 28837>20 belong&0x03FFFFFF 123 (SunATM 28838>20 belong&0x03FFFFFF 127 (802.11 with radiotap header 28839>20 belong&0x03FFFFFF 129 (Linux ARCNET 28840>20 belong&0x03FFFFFF 130 (Juniper Multi-Link PPP 28841>20 belong&0x03FFFFFF 131 (Juniper Multi-Link Frame Relay 28842>20 belong&0x03FFFFFF 132 (Juniper Encryption Services PIC 28843>20 belong&0x03FFFFFF 133 (Juniper GGSN PIC 28844>20 belong&0x03FFFFFF 134 (Juniper FRF.16 Frame Relay 28845>20 belong&0x03FFFFFF 135 (Juniper ATM2 PIC 28846>20 belong&0x03FFFFFF 136 (Juniper Advanced Services PIC 28847>20 belong&0x03FFFFFF 137 (Juniper ATM1 PIC 28848>20 belong&0x03FFFFFF 138 (Apple IP over IEEE 1394 28849>20 belong&0x03FFFFFF 139 (SS7 MTP2 with pseudo-header 28850>20 belong&0x03FFFFFF 140 (SS7 MTP2 28851>20 belong&0x03FFFFFF 141 (SS7 MTP3 28852>20 belong&0x03FFFFFF 142 (SS7 SCCP 28853>20 belong&0x03FFFFFF 143 (DOCSIS 28854>20 belong&0x03FFFFFF 144 (Linux IrDA 28855>20 belong&0x03FFFFFF 147 (Private use 0 28856>20 belong&0x03FFFFFF 148 (Private use 1 28857>20 belong&0x03FFFFFF 149 (Private use 2 28858>20 belong&0x03FFFFFF 150 (Private use 3 28859>20 belong&0x03FFFFFF 151 (Private use 4 28860>20 belong&0x03FFFFFF 152 (Private use 5 28861>20 belong&0x03FFFFFF 153 (Private use 6 28862>20 belong&0x03FFFFFF 154 (Private use 7 28863>20 belong&0x03FFFFFF 155 (Private use 8 28864>20 belong&0x03FFFFFF 156 (Private use 9 28865>20 belong&0x03FFFFFF 157 (Private use 10 28866>20 belong&0x03FFFFFF 158 (Private use 11 28867>20 belong&0x03FFFFFF 159 (Private use 12 28868>20 belong&0x03FFFFFF 160 (Private use 13 28869>20 belong&0x03FFFFFF 161 (Private use 14 28870>20 belong&0x03FFFFFF 162 (Private use 15 28871>20 belong&0x03FFFFFF 163 (802.11 with AVS header 28872>20 belong&0x03FFFFFF 164 (Juniper Passive Monitor PIC 28873>20 belong&0x03FFFFFF 165 (BACnet MS/TP 28874>20 belong&0x03FFFFFF 166 (PPPD 28875>20 belong&0x03FFFFFF 167 (Juniper PPPoE 28876>20 belong&0x03FFFFFF 168 (Juniper PPPoE/ATM 28877>20 belong&0x03FFFFFF 169 (GPRS LLC 28878>20 belong&0x03FFFFFF 170 (GPF-T 28879>20 belong&0x03FFFFFF 171 (GPF-F 28880>20 belong&0x03FFFFFF 174 (Juniper PIC Peer 28881>20 belong&0x03FFFFFF 175 (Ethernet with Endace ERF header 28882>20 belong&0x03FFFFFF 176 (Packet-over-SONET with Endace ERF header 28883>20 belong&0x03FFFFFF 177 (Linux LAPD 28884>20 belong&0x03FFFFFF 178 (Juniper Ethernet 28885>20 belong&0x03FFFFFF 179 (Juniper PPP 28886>20 belong&0x03FFFFFF 180 (Juniper Frame Relay 28887>20 belong&0x03FFFFFF 181 (Juniper C-HDLC 28888>20 belong&0x03FFFFFF 182 (FRF.16 Frame Relay 28889>20 belong&0x03FFFFFF 183 (Juniper Voice PIC 28890>20 belong&0x03FFFFFF 184 (Arinc 429 28891>20 belong&0x03FFFFFF 185 (Arinc 653 Interpartition Communication 28892>20 belong&0x03FFFFFF 186 (USB with FreeBSD header 28893>20 belong&0x03FFFFFF 187 (Bluetooth HCI H4 28894>20 belong&0x03FFFFFF 188 (802.16 MAC Common Part Sublayer 28895>20 belong&0x03FFFFFF 189 (Linux USB 28896>20 belong&0x03FFFFFF 190 (Controller Area Network (CAN) v. 2.0B 28897>20 belong&0x03FFFFFF 191 (802.15.4 with Linux padding 28898>20 belong&0x03FFFFFF 192 (PPI 28899>20 belong&0x03FFFFFF 193 (802.16 MAC Common Part Sublayer plus radiotap header 28900>20 belong&0x03FFFFFF 194 (Juniper Integrated Service Module 28901>20 belong&0x03FFFFFF 195 (802.15.4 with FCS 28902>20 belong&0x03FFFFFF 196 (SITA 28903>20 belong&0x03FFFFFF 197 (Endace ERF 28904>20 belong&0x03FFFFFF 198 (Ethernet with u10 Networks pseudo-header 28905>20 belong&0x03FFFFFF 199 (IPMB 28906>20 belong&0x03FFFFFF 200 (Juniper Secure Tunnel 28907>20 belong&0x03FFFFFF 201 (Bluetooth HCI H4 with pseudo-header 28908>20 belong&0x03FFFFFF 202 (AX.25 with KISS header 28909>20 belong&0x03FFFFFF 203 (LAPD 28910>20 belong&0x03FFFFFF 204 (PPP with direction pseudo-header 28911>20 belong&0x03FFFFFF 205 (Cisco HDLC with direction pseudo-header 28912>20 belong&0x03FFFFFF 206 (Frame Relay with direction pseudo-header 28913>20 belong&0x03FFFFFF 209 (Linux IPMB 28914>20 belong&0x03FFFFFF 215 (802.15.4 with non-ASK PHY header 28915>20 belong&0x03FFFFFF 216 (Linux evdev events 28916>20 belong&0x03FFFFFF 219 (MPLS with label as link-layer header 28917>20 belong&0x03FFFFFF 220 (Memory-mapped Linux USB 28918>20 belong&0x03FFFFFF 221 (DECT 28919>20 belong&0x03FFFFFF 222 (AOS Space Data Link protocol 28920>20 belong&0x03FFFFFF 223 (Wireless HART 28921>20 belong&0x03FFFFFF 224 (Fibre Channel FC-2 28922>20 belong&0x03FFFFFF 225 (Fibre Channel FC-2 with frame delimiters 28923>20 belong&0x03FFFFFF 226 (Solaris IPNET 28924>20 belong&0x03FFFFFF 227 (SocketCAN 28925>20 belong&0x03FFFFFF 228 (Raw IPv4 28926>20 belong&0x03FFFFFF 229 (Raw IPv6 28927>20 belong&0x03FFFFFF 230 (802.15.4 without FCS 28928>20 belong&0x03FFFFFF 231 (D-Bus messages 28929>20 belong&0x03FFFFFF 232 (Juniper Virtual Server 28930>20 belong&0x03FFFFFF 233 (Juniper SRX E2E 28931>20 belong&0x03FFFFFF 234 (Juniper Fibre Channel 28932>20 belong&0x03FFFFFF 235 (DVB-CI 28933>20 belong&0x03FFFFFF 236 (MUX27010 28934>20 belong&0x03FFFFFF 237 (STANAG 5066 D_PDUs 28935>20 belong&0x03FFFFFF 238 (Juniper ATM CEMIC 28936>20 belong&0x03FFFFFF 239 (Linux netfilter log messages 28937>20 belong&0x03FFFFFF 240 (Hilscher netAnalyzer 28938>20 belong&0x03FFFFFF 241 (Hilscher netAnalyzer with delimiters 28939>20 belong&0x03FFFFFF 242 (IP-over-Infiniband 28940>20 belong&0x03FFFFFF 243 (MPEG-2 Transport Stream packets 28941>20 belong&0x03FFFFFF 244 (ng4t ng40 28942>20 belong&0x03FFFFFF 245 (NFC LLCP 28943>20 belong&0x03FFFFFF 246 (Packet filter state syncing 28944>20 belong&0x03FFFFFF 247 (InfiniBand 28945>20 belong&0x03FFFFFF 248 (SCTP 28946>20 belong&0x03FFFFFF 249 (USB with USBPcap header 28947>20 belong&0x03FFFFFF 250 (Schweitzer Engineering Laboratories RTAC packets 28948>20 belong&0x03FFFFFF 251 (Bluetooth Low Energy air interface 28949>20 belong&0x03FFFFFF 252 (Wireshark Upper PDU export 28950>20 belong&0x03FFFFFF 253 (Linux netlink 28951>20 belong&0x03FFFFFF 254 (Bluetooth Linux Monitor 28952>20 belong&0x03FFFFFF 255 (Bluetooth Basic Rate/Enhanced Data Rate baseband packets 28953>20 belong&0x03FFFFFF 256 (Bluetooth Low Energy air interface with pseudo-header 28954>20 belong&0x03FFFFFF 257 (PROFIBUS data link layer 28955>20 belong&0x03FFFFFF 258 (Apple DLT_PKTAP 28956>20 belong&0x03FFFFFF 259 (Ethernet with 802.3 Clause 65 EPON preamble 28957>20 belong&0x03FFFFFF 260 (IPMI trace packets 28958>20 belong&0x03FFFFFF 261 (Z-Wave RF profile R1 and R2 packets 28959>20 belong&0x03FFFFFF 262 (Z-Wave RF profile R3 packets 28960>20 belong&0x03FFFFFF 263 (WattStopper Digital Lighting Mngmt/Legrand Nitoo Open Proto 28961>20 belong&0x03FFFFFF 264 (ISO 14443 messages 28962>20 belong&0x03FFFFFF 265 (IEC 62106 Radio Data System groups 28963>20 belong&0x03FFFFFF 266 (USB with Darwin header 28964>20 belong&0x03FFFFFF 267 (OpenBSD DLT_OPENFLOW 28965>20 belong&0x03FFFFFF 268 (IBM SDLC frames 28966>20 belong&0x03FFFFFF 269 (TI LLN sniffer frames 28967>20 belong&0x03FFFFFF 271 (Linux vsock 28968>20 belong&0x03FFFFFF 272 (Nordic Semiconductor Bluetooth LE sniffer frames 28969>20 belong&0x03FFFFFF 273 (Excentis XRA-31 DOCSIS 3.1 RF sniffer frames 28970>20 belong&0x03FFFFFF 274 (802.3br mPackets 28971>20 belong&0x03FFFFFF 275 (DisplayPort AUX channel monitoring data 28972>20 belong&0x03FFFFFF 276 (Linux cooked v2 28973>20 belong&0x03FFFFFF 278 (OpenVizsla USB 28974>20 belong&0x03FFFFFF 279 (Elektrobit High Speed Capture and Replay (EBHSCR) 28975>20 belong&0x03FFFFFF 281 (Broadcom tag 28976>20 belong&0x03FFFFFF 282 (Broadcom tag (prepended) 28977>20 belong&0x03FFFFFF 284 (Marvell DSA 28978>20 belong&0x03FFFFFF 285 (Marvell EDSA 28979# print default match 28980>20 default x 28981>>20 belong x (linktype#%u 28982>16 belong x \b, capture length %u) 28983 28984# packets time stamps in seconds and microseconds. 289850 ubelong 0xa1b2c3d4 pcap capture file, microseconds ts (big-endian) 28986!:mime application/vnd.tcpdump.pcap 28987>0 use pcap-be 289880 ulelong 0xa1b2c3d4 pcap capture file, microsecond ts (little-endian) 28989!:mime application/vnd.tcpdump.pcap 28990>0 use \^pcap-be 28991 28992# packets time stamps in seconds and nanoseconds. 289930 ubelong 0xa1b23c4d pcap capture file, nanosecond ts (big-endian) 28994!:mime application/vnd.tcpdump.pcap 28995>0 use pcap-be 289960 ulelong 0xa1b23c4d pcap capture file, nanosecond ts (little-endian) 28997!:mime application/vnd.tcpdump.pcap 28998>0 use \^pcap-be 28999 29000# 29001# "libpcap"-with-Alexey-Kuznetsov's-patches capture files. 29002# 290030 ubelong 0xa1b2cd34 pcap capture file, microsecond ts, extensions (big-endian) 29004>0 use pcap-be 290050 ulelong 0xa1b2cd34 pcap capture file, microsecond ts, extensions (little-endian) 29006>0 use \^pcap-be 29007 29008# 29009# "pcapng" capture files. 29010# https://github.com/pcapng/pcapng 29011# Pcapng files can contain multiple sections. Printing the endianness, 29012# snaplen, or other information from the first SHB may be misleading. 29013# 290140 ubelong 0x0a0d0d0a 29015>8 ubelong 0x1a2b3c4d pcapng capture file 29016>>12 beshort x - version %d 29017>>14 beshort x \b.%d 290180 ulelong 0x0a0d0d0a 29019>8 ulelong 0x1a2b3c4d pcapng capture file 29020>>12 leshort x - version %d 29021>>14 leshort x \b.%d 29022 29023# 29024# AIX "iptrace" capture files. 29025# 290260 string iptrace\0401.0 AIX iptrace capture file 290270 string iptrace\0402.0 AIX iptrace capture file 29028 29029# 29030# Novell LANalyzer capture files. 29031# 290320 leshort 0x1001 Novell LANalyzer capture file 290330 leshort 0x1007 Novell LANalyzer capture file 29034 29035# 29036# HP-UX "nettl" capture files. 29037# 290380 string \x54\x52\x00\x64\x00 HP/UX nettl capture file 29039 29040# 29041# RADCOM WAN/LAN Analyzer capture files. 29042# 290430 string \x42\xd2\x00\x34\x12\x66\x22\x88 RADCOM WAN/LAN Analyzer capture file 29044 29045# 29046# NetStumbler log files. Not really packets, per se, but about as 29047# close as you can get. These are log files from NetStumbler, a 29048# Windows program, that scans for 802.11b networks. 29049# 290500 string NetS NetStumbler log file 29051>8 lelong x \b, %d stations found 29052 29053# 29054# *Peek tagged capture files. 29055# 290560 string \177ver EtherPeek/AiroPeek/OmniPeek capture file 29057 29058# 29059# Visual Networks traffic capture files. 29060# 290610 string \x05VNF Visual Networks traffic capture file 29062 29063# 29064# Network Instruments Observer capture files. 29065# 290660 string ObserverPktBuffe Network Instruments Observer capture file 29067 29068# 29069# Files from Accellent Group's 5View products. 29070# 290710 string \xaa\xaa\xaa\xaa 5View capture file 29072 29073#------------------------------------------------------------------------------ 29074# $File: softquad,v 1.13 2009/09/19 16:28:12 christos Exp $ 29075# softquad: file(1) magic for SoftQuad Publishing Software 29076# 29077# Author/Editor and RulesBuilder 29078# 29079# XXX - byte order? 29080# 290810 string \<!SQ\ DTD> Compiled SGML rules file 29082>9 string >\0 Type %s 290830 string \<!SQ\ A/E> A/E SGML Document binary 29084>9 string >\0 Type %s 290850 string \<!SQ\ STS> A/E SGML binary styles file 29086>9 string >\0 Type %s 290870 short 0xc0de Compiled PSI (v1) data 290880 short 0xc0da Compiled PSI (v2) data 29089>3 string >\0 (%s) 29090# Binary sqtroff font/desc files... 290910 short 0125252 SoftQuad DESC or font file binary 29092>2 short >0 - version %d 29093# Bitmaps... 290940 search/1 SQ\ BITMAP1 SoftQuad Raster Format text 29095#0 string SQ\ BITMAP2 SoftQuad Raster Format data 29096# sqtroff intermediate language (replacement for ditroff int. lang.) 290970 string X\ SoftQuad troff Context intermediate 29098>2 string 495 for AT&T 495 laser printer 29099>2 string hp for Hewlett-Packard LaserJet 29100>2 string impr for IMAGEN imPRESS 29101>2 string ps for PostScript 29102 29103# From: Michael Piefel <piefel@debian.org> 29104# sqtroff intermediate language (replacement for ditroff int. lang.) 291050 string X\ 495 SoftQuad troff Context intermediate for AT&T 495 laser printer 291060 string X\ hp SoftQuad troff Context intermediate for HP LaserJet 291070 string X\ impr SoftQuad troff Context intermediate for IMAGEN imPRESS 291080 string X\ ps SoftQuad troff Context intermediate for PostScript 29109 29110#------------------------------------------------------------------------------ 29111# $File: sosi,v 1.1 2019/05/20 17:25:09 christos Exp $ 29112# SOSI 29113# Summary: Systematic Organization of Spatial Information 29114# Long description: Norwegian text based map format 29115# File extension: .sos 29116# Full name: Petter Reinholdtsen (pere@hungry.com) 29117# Reference: https://en.wikipedia.org/wiki/SOSI 29118# 29119# Example SOSI files available from 29120# https://trac.osgeo.org/gdal/ticket/3638 29121# https://nedlasting.geonorge.no/geonorge/Basisdata/N50Kartdata/SOSI/ 29122# https://nedlasting.geonorge.no/geonorge/Samferdsel/Elveg/SOSI/ 29123# 29124# Start with optional comments (from "!" to the next line end) 29125# followed by ".HODE" and end with "\n.SLUTT" followed by an optional 29126# separator (any number of " ", "\t", "\n" or "\r"), might have BOM at 29127# the start and following ".HODE" near the start there is "..OMR=C3=85DE" 29128# (either UTF-8, ISO-8859-1 or some 7 bit Norwegian charset based on 29129# ASCII) , "..TRANSPAR", "..TEGNSETT " followed by the charset and a 29130# separator, as well as "..SOSI-VERSJON " followed by the format 29131# version and a separator. 29132# 29133# FIXME figure out how to accept any of [space], [tab], [newline] and 29134# [carrige return] as separators, not only line end. 29135 29136# Not searching for full "OMR=C3=85DE" to match also for non-UTF-8 29137# character sets 291380 search ..OMR 29139>0 search ..TRANSPAR 29140>>0 search .HODE SOSI map data 29141>>>&0 search ..SOSI-VERSJON 29142>>>>&1 string x \b, version %s 29143# FIXME could not figure out way to make a match for .SLUTT at the end required 29144#>-7 string \n.SLUTT slutt 29145#>-8 string \n.SLUTT\n slutt-nl 29146#>-9 string \n.SLUTT\r\n slutt-crnl2 29147!:mime text/vnd.sosi 29148!:ext sos 29149 29150#------------------------------------------------------------------------------ 29151# $File: spec,v 1.4 2009/09/19 16:28:12 christos Exp $ 29152# spec: file(1) magic for SPEC raw results (*.raw, *.rsf) 29153# 29154# Cloyce D. Spradling <cloyce@headgear.org> 29155 291560 string spec SPEC 29157>4 string .cpu CPU 29158>>8 string <: \b%.4s 29159>>12 string . raw result text 29160 2916117 string version=SPECjbb SPECjbb 29162>32 string <: \b%.4s 29163>>37 string <: v%.4s raw result text 29164 291650 string BEGIN\040SPECWEB SPECweb 29166>13 string <: \b%.2s 29167>>15 string _SSL \b_SSL 29168>>>20 string <: v%.4s raw result text 29169>>16 string <: v%.4s raw result text 29170 29171#------------------------------------------------------------------------------ 29172# $File: spectrum,v 1.8 2017/09/11 23:51:12 christos Exp $ 29173# spectrum: file(1) magic for Spectrum emulator files. 29174# 29175# John Elliott <jce@seasip.demon.co.uk> 29176 29177# 29178# Spectrum +3DOS header 29179# 291800 string PLUS3DOS\032 Spectrum +3 data 29181>15 byte 0 - BASIC program 29182>15 byte 1 - number array 29183>15 byte 2 - character array 29184>15 byte 3 - memory block 29185>>16 belong 0x001B0040 (screen) 29186>15 byte 4 - Tasword document 29187>15 string TAPEFILE - ZXT tapefile 29188# 29189# Tape file. This assumes the .TAP starts with a Spectrum-format header, 29190# which nearly all will. 29191# 29192# Update: Sanity-check string contents to be printable. 29193# -Adam Buchbinder <adam.buchbinder@gmail.com> 29194# 291950 string \023\000\000 29196>4 string >\0 29197>>4 string <\177 Spectrum .TAP data "%-10.10s" 29198>>>3 byte 0 - BASIC program 29199>>>3 byte 1 - number array 29200>>>3 byte 2 - character array 29201>>>3 byte 3 - memory block 29202>>>>14 belong 0x001B0040 (screen) 29203 29204# The following three blocks are from pak21-spectrum@srcf.ucam.org 29205# TZX tape images 292060 string ZXTape!\x1a Spectrum .TZX data 29207>8 byte x version %d 29208>9 byte x \b.%d 29209 29210# RZX input recording files 292110 string RZX! Spectrum .RZX data 29212>4 byte x version %d 29213>5 byte x \b.%d 29214 29215# Floppy disk images 292160 string MV\ -\ CPCEMU\ Disk-Fil Amstrad/Spectrum .DSK data 292170 string MV\ -\ CPC\ format\ Dis Amstrad/Spectrum DU54 .DSK data 292180 string EXTENDED\ CPC\ DSK\ Fil Amstrad/Spectrum Extended .DSK data 292190 string SINCLAIR Spectrum .SCL Betadisk image 29220 29221# Hard disk images 292220 string RS-IDE\x1a Spectrum .HDF hard disk image 29223>7 byte x \b, version 0x%02x 29224 29225# SZX snapshots (fuse and spectaculator) 29226# Martin M. S. Pedersen <martin@linux.com> 29227# http://www.spectaculator.com/docs/zx-state/header.shtml 29228# 292290 string ZXST zx-state snapshot 29230>4 byte x version %d 29231>5 byte x \b.%d 29232>>6 byte 0 16k ZX Spectrum 29233>>6 byte 1 48k ZX Spectrum/ZX Spectrum+ 29234>>6 byte 2 ZX Spectrum 128 29235>>6 byte 3 ZX Spectrum +2 29236>>6 byte 4 ZX Spectrum +2A/+2B 29237>>6 byte 5 ZX Spectrum +3 29238>>6 byte 6 ZX Spectrum +3e 29239>>6 byte 7 Pentagon 128 29240>>6 byte 8 Timex Sinclair TC2048 29241>>6 byte 9 Timex Sinclair TC2068 29242>>6 byte 10 Scorpion ZS-256 29243>>6 byte 11 ZX Spectrum SE 29244>>6 byte 12 Timex Sinclair TS2068 29245>>6 byte 13 Pentagon 512 29246>>6 byte 14 Pentagon 1024 29247>>6 byte 15 48k ZX Spectrum (NTSC) 29248>>6 byte 16 ZX Spectrum 12Ke 29249>>>7 byte 1 (alternate timings) 29250 29251#------------------------------------------------------------------------------ 29252# $File: sql,v 1.22 2019/04/19 00:42:27 christos Exp $ 29253# sql: file(1) magic for SQL files 29254# 29255# From: "Marty Leisner" <mleisner@eng.mc.xerox.com> 29256# Recognize some MySQL files. 29257# Elan Ruusamae <glen@delfi.ee>, added MariaDB signatures 29258# from https://bazaar.launchpad.net/~maria-captains/maria/5.5/view/head:/support-files/magic 29259# 292600 beshort 0xfe01 MySQL table definition file 29261>2 byte x Version %d 29262>3 byte 0 \b, type UNKNOWN 29263>3 byte 1 \b, type DIAM_ISAM 29264>3 byte 2 \b, type HASH 29265>3 byte 3 \b, type MISAM 29266>3 byte 4 \b, type PISAM 29267>3 byte 5 \b, type RMS_ISAM 29268>3 byte 6 \b, type HEAP 29269>3 byte 7 \b, type ISAM 29270>3 byte 8 \b, type MRG_ISAM 29271>3 byte 9 \b, type MYISAM 29272>3 byte 10 \b, type MRG_MYISAM 29273>3 byte 11 \b, type BERKELEY_DB 29274>3 byte 12 \b, type INNODB 29275>3 byte 13 \b, type GEMINI 29276>3 byte 14 \b, type NDBCLUSTER 29277>3 byte 15 \b, type EXAMPLE_DB 29278>3 byte 16 \b, type CSV_DB 29279>3 byte 17 \b, type FEDERATED_DB 29280>3 byte 18 \b, type BLACKHOLE_DB 29281>3 byte 19 \b, type PARTITION_DB 29282>3 byte 20 \b, type BINLOG 29283>3 byte 21 \b, type SOLID 29284>3 byte 22 \b, type PBXT 29285>3 byte 23 \b, type TABLE_FUNCTION 29286>3 byte 24 \b, type MEMCACHE 29287>3 byte 25 \b, type FALCON 29288>3 byte 26 \b, type MARIA 29289>3 byte 27 \b, type PERFORMANCE_SCHEMA 29290>3 byte 127 \b, type DEFAULT 29291>0x0033 ulong x \b, MySQL version %d 292920 belong&0xffffff00 0xfefe0500 MySQL ISAM index file 29293>3 byte x Version %d 292940 belong&0xffffff00 0xfefe0600 MySQL ISAM compressed data file 29295>3 byte x Version %d 292960 belong&0xffffff00 0xfefe0700 MySQL MyISAM index file 29297>3 byte x Version %d 29298>14 beshort x \b, %d key parts 29299>16 beshort x \b, %d unique key parts 29300>18 byte x \b, %d keys 29301>28 bequad x \b, %lld records 29302>36 bequad x \b, %lld deleted records 293030 belong&0xffffff00 0xfefe0800 MySQL MyISAM compressed data file 29304>3 byte x Version %d 293050 belong&0xffffff00 0xfefe0900 MySQL Maria index file 29306>3 byte x Version %d 293070 belong&0xffffff00 0xfefe0a00 MySQL Maria compressed data file 29308>3 byte x Version %d 293090 belong&0xffffff00 0xfefe0c00 29310>4 string MACF MySQL Maria control file 29311>>3 byte x Version %d 293120 string \376bin MySQL replication log, 29313>9 long x server id %d 29314>8 byte 1 29315>>13 long 69 \b, MySQL V3.2.3 29316>>>19 string x \b, server version %s 29317>>13 long 75 \b, MySQL V4.0.2-V4.1 29318>>>25 string x \b, server version %s 29319>8 byte 15 MySQL V5+, 29320>>25 string x server version %s 29321>4 string MARIALOG MySQL Maria transaction log file 29322>>3 byte x Version %d 29323 29324#------------------------------------------------------------------------------ 29325# iRiver H Series database file 29326# From Ken Guest <ken@linux.ie> 29327# As observed from iRivNavi.iDB and unencoded firmware 29328# 293290 string iRivDB iRiver Database file 29330>11 string >\0 Version %s 29331>39 string iHP-100 [H Series] 29332 29333#------------------------------------------------------------------------------ 29334# SQLite database files 29335# Ken Guest <ken@linux.ie>, Ty Sarna, Zack Weinberg 29336# 29337# Version 1 used GDBM internally; its files cannot be distinguished 29338# from other GDBM files. 29339# 29340# Version 2 used this format: 293410 string **\ This\ file\ contains\ an\ SQLite SQLite 2.x database 29342 29343# Version 3 of SQLite allows applications to embed their own "user version" 29344# number in the database at offset 60. Later, SQLite added an "application id" 29345# at offset 68 that is preferred over "user version" for indicating the 29346# associated application. 29347# 293480 string SQLite\ format\ 3 SQLite 3.x database 29349!:mime application/x-sqlite3 29350# seldom found extension sqlite3 like in SyncData.sqlite3 29351# db 29352# Avira Antivir use extension "dbe" like in avevtdb.dbe, avguard_tchk.dbe 29353# Unfortunately extension sqlite also used for other databases starting with string 29354# "TTCONTAINER" like in tracks.sqlite contentconsumer.sqlite contentproducerrepository.sqlite 29355# and with string "ZV-zlib" in like extra.sqlite 29356!:ext sqlite/sqlite3/db/dbe 29357>60 belong =0x5f4d544e (Monotone source repository) 29358>68 belong =0x0f055112 (Fossil checkout) 29359>68 belong =0x0f055113 (Fossil global configuration) 29360>68 belong =0x0f055111 (Fossil repository) 29361>68 belong =0x42654462 (Bentley Systems BeSQLite Database) 29362>68 belong =0x42654c6e (Bentley Systems Localization File) 29363>68 belong =0x47504b47 (OGC GeoPackage file) 29364>68 default x 29365>>68 belong !0 \b, application id %u 29366>>60 belong !0 \b, user version %d 29367>96 belong x \b, last written using SQLite version %d 29368 29369 29370# SQLite Write-Ahead Log from SQLite version >= 3.7.0 29371# https://www.sqlite.org/fileformat.html#walformat 293720 belong&0xfffffffe 0x377f0682 SQLite Write-Ahead Log, 29373!:ext sqlite-wal/db-wal 29374>4 belong x version %d 29375 29376# SQLite Rollback Journal 29377# https://www.sqlite.org/fileformat.html#rollbackjournal 293780 string \xd9\xd5\x05\xf9\x20\xa1\x63\xd7 SQLite Rollback Journal 29379 29380# Panasonic channel list database svl.bin or svl.db added by Joerg Jenderek 29381# https://github.com/PredatH0r/ChanSort 293820 string PSDB\0 Panasonic channel list DataBase 29383!:ext db/bin 29384#!:mime application/x-db-svl-panasonic 29385>126 string SQLite\ format\ 3 29386#!:mime application/x-panasonic-sqlite3 29387>>&-15 indirect x \b; contains 29388 29389# H2 Database from https://www.h2database.com/ 293900 string --\ H2\ 0.5/B\ --\ \n H2 Database file 29391# Type: OpenSSH key files 29392# From: Nicolas Collignon <tsointsoin@gmail.com> 29393 293940 string SSH\ PRIVATE\ KEY OpenSSH RSA1 private key, 29395>28 string >\0 version %s 293960 string -----BEGIN\ OPENSSH\ PRIVATE\ KEY----- OpenSSH private key 29397 293980 string ssh-dss\ OpenSSH DSA public key 293990 string ssh-rsa\ OpenSSH RSA public key 294000 string ecdsa-sha2-nistp256 OpenSSH ECDSA public key 294010 string ecdsa-sha2-nistp384 OpenSSH ECDSA public key 294020 string ecdsa-sha2-nistp521 OpenSSH ECDSA public key 294030 string ssh-ed25519 OpenSSH ED25519 public key 29404 294050 string SSHKRL\n\0 29406>8 ubelong 1 OpenSSH key/certificate revocation list, format %u 29407>>12 ubequad x \b, version %llx 29408>>>20 beqdate x \b, generated %s 29409 29410# From: Joerg Jenderek 29411# URL: https://en.wikipedia.org/wiki/PuTTY 29412# Reference: https://the.earth.li/~sgtatham/putty/latest/putty-0.73.tar.gz 29413# /sshpubk.c 294140 string PuTTY-User-Key-File- PuTTY Private Key File 29415#!:mime text/plain 29416# https://github.com/github/putty/blob/master/windows/installer.wxs 29417!:mime application/x-putty-private-key 29418!:ext ppk 29419# version 1 or 2 29420>20 string x \b, version %.1s 29421# name of the algorithm like: ssh-dss ssh-rsa ecdsa-sha2-nistp256 ssh-ed25519 29422>23 string x \b, algorithm %s 29423# next line says "Encryption: " plus an encryption type like aes256-cbc or none 29424>32 search/13 Encryption:\040 \b, Encryption 29425>>&0 string x %s 29426# next line says "Comment: " plus the comment string 29427>>>&0 search/3 Comment:\040 29428>>>>&0 string x "%s" 29429 29430 29431#------------------------------------------------------------------------------ 29432# $File: ssl,v 1.5 2017/12/29 04:00:07 christos Exp $ 29433# ssl: file(1) magic for SSL file formats 29434 29435# Type: OpenSSL certificates/key files 29436# From: Nicolas Collignon <tsointsoin@gmail.com> 29437 294380 string -----BEGIN\040CERTIFICATE----- PEM certificate 294390 string -----BEGIN\040CERTIFICATE\040REQ PEM certificate request 294400 string -----BEGIN\040RSA\040PRIVATE PEM RSA private key 294410 string -----BEGIN\040DSA\040PRIVATE PEM DSA private key 294420 string -----BEGIN\040EC\040PRIVATE PEM EC private key 294430 string -----BEGIN\040ECDSA\040PRIVATE PEM ECDSA private key 29444 29445# From Luc Gommans 29446# OpenSSL enc file (recognized by a magic string preceding the password's salt) 294470 string Salted__ openssl enc'd data with salted password 29448# Using the -a or -base64 option, OpenSSL will base64-encode the data. 294490 string U2FsdGVkX1 openssl enc'd data with salted password, base64 encoded 29450 29451#------------------------------------------------------------------------------ 29452# $File: sun,v 1.28 2019/04/19 00:42:27 christos Exp $ 29453# sun: file(1) magic for Sun machines 29454# 29455# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x 29456# releases. (5.x uses ELF.) Entries for executables without an 29457# architecture type, used before the 68020-based Sun-3's came out, 29458# are in aout, as they're indistinguishable from other big-endian 29459# 32-bit a.out files. 29460# 294610 belong&077777777 0600413 a.out SunOS SPARC demand paged 29462>0 byte &0x80 29463>>20 belong <4096 shared library 29464>>20 belong =4096 dynamically linked executable 29465>>20 belong >4096 dynamically linked executable 29466>0 byte ^0x80 executable 29467>16 belong >0 not stripped 29468 294690 belong&077777777 0600410 a.out SunOS SPARC pure 29470>0 byte &0x80 dynamically linked executable 29471>0 byte ^0x80 executable 29472>16 belong >0 not stripped 29473 294740 belong&077777777 0600407 a.out SunOS SPARC 29475>0 byte &0x80 dynamically linked executable 29476>0 byte ^0x80 executable 29477>16 belong >0 not stripped 29478 294790 belong&077777777 0400413 a.out SunOS mc68020 demand paged 29480>0 byte &0x80 29481>>20 belong <4096 shared library 29482>>20 belong =4096 dynamically linked executable 29483>>20 belong >4096 dynamically linked executable 29484>0 byte ^0x80 executable 29485>16 belong >0 not stripped 29486 294870 belong&077777777 0400410 a.out SunOS mc68020 pure 29488>0 byte &0x80 dynamically linked executable 29489>0 byte ^0x80 executable 29490>16 belong >0 not stripped 29491 294920 belong&077777777 0400407 a.out SunOS mc68020 29493>0 byte &0x80 dynamically linked executable 29494>0 byte ^0x80 executable 29495>16 belong >0 not stripped 29496 294970 belong&077777777 0200413 a.out SunOS mc68010 demand paged 29498>0 byte &0x80 29499>>20 belong <4096 shared library 29500>>20 belong =4096 dynamically linked executable 29501>>20 belong >4096 dynamically linked executable 29502>0 byte ^0x80 executable 29503>16 belong >0 not stripped 29504 295050 belong&077777777 0200410 a.out SunOS mc68010 pure 29506>0 byte &0x80 dynamically linked executable 29507>0 byte ^0x80 executable 29508>16 belong >0 not stripped 29509 295100 belong&077777777 0200407 a.out SunOS mc68010 29511>0 byte &0x80 dynamically linked executable 29512>0 byte ^0x80 executable 29513>16 belong >0 not stripped 29514 29515# 29516# Core files. "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC 29517# binary executed in compatibility mode under SunOS 5.x". 29518# 295190 belong 0x080456 SunOS core file 29520>4 belong 432 (SPARC) 29521>>132 string >\0 from '%s' 29522>>116 belong =3 (quit) 29523>>116 belong =4 (illegal instruction) 29524>>116 belong =5 (trace trap) 29525>>116 belong =6 (abort) 29526>>116 belong =7 (emulator trap) 29527>>116 belong =8 (arithmetic exception) 29528>>116 belong =9 (kill) 29529>>116 belong =10 (bus error) 29530>>116 belong =11 (segmentation violation) 29531>>116 belong =12 (bad argument to system call) 29532>>116 belong =29 (resource lost) 29533>>120 belong x (T=%dK, 29534>>124 belong x D=%dK, 29535>>128 belong x S=%dK) 29536>4 belong 826 (68K) 29537>>128 string >\0 from '%s' 29538>4 belong 456 (SPARC 4.x BCP) 29539>>152 string >\0 from '%s' 29540# Sun SunPC 295410 long 0xfa33c08e SunPC 4.0 Hard Disk 295420 string #SUNPC_CONFIG SunPC 4.0 Properties Values 29543# Sun snoop (see RFC 1761, which describes the capture file format, 29544# RFC 3827, which describes some additional datalink types, and 29545# https://www.iana.org/assignments/snoop-datalink-types/snoop-datalink-types.xml, 29546# which is the IANA registry of Snoop datalink types) 29547# 295480 string snoop Snoop capture file 29549>8 belong >0 - version %d 29550>12 belong 0 (IEEE 802.3) 29551>12 belong 1 (IEEE 802.4) 29552>12 belong 2 (IEEE 802.5) 29553>12 belong 3 (IEEE 802.6) 29554>12 belong 4 (Ethernet) 29555>12 belong 5 (HDLC) 29556>12 belong 6 (Character synchronous) 29557>12 belong 7 (IBM channel-to-channel adapter) 29558>12 belong 8 (FDDI) 29559>12 belong 9 (Other) 29560>12 belong 10 (type %d) 29561>12 belong 11 (type %d) 29562>12 belong 12 (type %d) 29563>12 belong 13 (type %d) 29564>12 belong 14 (type %d) 29565>12 belong 15 (type %d) 29566>12 belong 16 (Fibre Channel) 29567>12 belong 17 (ATM) 29568>12 belong 18 (ATM Classical IP) 29569>12 belong 19 (type %d) 29570>12 belong 20 (type %d) 29571>12 belong 21 (type %d) 29572>12 belong 22 (type %d) 29573>12 belong 23 (type %d) 29574>12 belong 24 (type %d) 29575>12 belong 25 (type %d) 29576>12 belong 26 (IP over Infiniband) 29577>12 belong >26 (type %d) 29578 29579#--------------------------------------------------------------------------- 29580# The following entries have been tested by Duncan Laurie <duncan@sun.com> (a 29581# lead Sun/Cobalt developer) who agrees that they are good and worthy of 29582# inclusion. 29583 29584# Boot ROM images for Sun/Cobalt Linux server appliances 295850 string Cobalt\ Networks\ Inc.\nFirmware\ v Paged COBALT boot rom 29586>38 string x V%.4s 29587 29588# New format for Sun/Cobalt boot ROMs is annoying, it stores the version code 29589# at the very end where file(1) can't get it. 295900 string CRfs COBALT boot rom data (Flat boot rom or file system) 29591 29592#------------------------------------------------------------------------------ 29593# $File: sylk,v 1.1 2020/04/05 22:18:34 christos Exp $ 29594# sylk: file(1) magic for SYLK text files 29595 29596# From: Joerg Jenderek 29597# URL: https://en.wikipedia.org/wiki/SYmbolic_LinK_%28SYLK%29 29598# http://fileformats.archiveteam.org/wiki/SYLK 29599# Note: called by TrID "SYLK - SYmbolic LinK data", 29600# by DROID "Microsoft Symbolic Link (SYLK) File" 29601# by FreeDesktop.org "spreadsheet interchange document" 296020 string ID;P 29603# skip short DROID x-fmt-106-signature-id-603.slk 29604>7 ubyte >0 spreadsheet interchange document 29605# https://reposcope.com/mimetype/text/spreadsheet 29606#!:mime text/spreadsheet 29607# https://reposcope.com/mimetype/application/x-sylk by Gnumeric 29608!:mime application/x-sylk 29609!:ext slk/sylk 29610>>4 ubyte >037 \b, created by 29611# Gnumeric, pmw~PlanMaker, CALCOOO32~LibreOffice OpenOffice, SCALC3~StarOffice 29612# MP~Multiplan, XL~Excel WXL~Excel Windows 29613>>>4 string Gnumeric Gnumeric 29614>>>4 string pmw PlanMaker 29615>>>4 string CALCOOO32 Libre/OpenOffice Calc 29616>>>4 string SCALC3 StarOffice Calc 29617>>>4 string XL Excel 29618# Excel, version probably running on Windows 29619>>>4 string WXL Excel 29620# not tested 29621>>>4 string MP Multiplan 29622# unknown spreadsheet software 29623>>>4 default x 29624>>>>4 string x %s 29625 29626 29627 29628#------------------------------------------------------------------------------ 29629# msx: file(1) magic for the SymbOS operating system 29630# http://www.symbos.de 29631# Fabio R. Schmidlin <frs@pop.com.br> 29632 29633# SymbOS EXE file 296340x30 string SymExe SymbOS executable 29635>0x36 ubyte x v%c 29636>0x37 ubyte x \b.%c 29637>0xF string x \b, name: %s 29638 29639# SymbOS DOX document 296400 string INFOq\0 SymbOS DOX document 29641 29642# Symbos driver 296430 string SMD1 SymbOS driver 29644>19 byte x \b, name: %c 29645>20 byte x \b%c 29646>21 byte x \b%c 29647>22 byte x \b%c 29648>23 byte x \b%c 29649>24 byte x \b%c 29650>25 byte x \b%c 29651>26 byte x \b%c 29652>27 byte x \b%c 29653>28 byte x \b%c 29654>29 byte x \b%c 29655>30 byte x \b%c 29656>31 byte x \b%c 29657 29658# Symbos video 296590 string SymVid SymbOS video 29660>6 ubyte x v%c 29661>7 ubyte x \b.%c 29662 29663# Soundtrakker 128 ST2 music 296640 byte 0 29665>0xC string \x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x40\x00 Soundtrakker 128 ST2 music, 29666>>1 string x name: %s 29667 29668 29669 29670#------------------------------------------------------------------------ 29671# $File: sysex,v 1.10 2019/04/19 00:42:27 christos Exp $ 29672# sysex: file(1) magic for MIDI sysex files 29673# 29674# GRR: original 1 byte test at offset was too general as it catches also many FATs of DOS filesystems 29675# where real SYStem EXclusive messages at offset 1 are limited to seven bits 29676# https://en.wikipedia.org/wiki/MIDI 296770 ubeshort&0xFF80 0xF000 SysEx File - 29678 29679# North American Group 29680>1 byte 0x01 Sequential 29681>1 byte 0x02 IDP 29682>1 byte 0x03 OctavePlateau 29683>1 byte 0x04 Moog 29684>1 byte 0x05 Passport 29685>1 byte 0x06 Lexicon 29686>1 byte 0x07 Kurzweil/Future Retro 29687>>3 byte 0x77 777 29688>>4 byte 0x00 Bank 29689>>4 byte 0x01 Song 29690>>5 byte 0x0f 16 29691>>5 byte 0x0e 15 29692>>5 byte 0x0d 14 29693>>5 byte 0x0c 13 29694>>5 byte 0x0b 12 29695>>5 byte 0x0a 11 29696>>5 byte 0x09 10 29697>>5 byte 0x08 9 29698>>5 byte 0x07 8 29699>>5 byte 0x06 7 29700>>5 byte 0x05 6 29701>>5 byte 0x04 5 29702>>5 byte 0x03 4 29703>>5 byte 0x02 3 29704>>5 byte 0x01 2 29705>>5 byte 0x00 1 29706>>5 byte 0x10 (ALL) 29707>>2 byte x \b, Channel %d 29708>1 byte 0x08 Fender 29709>1 byte 0x09 Gulbransen 29710>1 byte 0x0a AKG 29711>1 byte 0x0b Voyce 29712>1 byte 0x0c Waveframe 29713>1 byte 0x0d ADA 29714>1 byte 0x0e Garfield 29715>1 byte 0x0f Ensoniq 29716>1 byte 0x10 Oberheim 29717>>2 byte 0x06 Matrix 6 series 29718>>3 byte 0x0A Dump (All) 29719>>3 byte 0x01 Dump (Bank) 29720>>4 belong 0x0002040E Matrix 1000 29721>>>11 byte <2 User bank %d 29722>>>11 byte >1 Preset bank %d 29723>1 byte 0x11 Apple 29724>1 byte 0x12 GreyMatter 29725>1 byte 0x14 PalmTree 29726>1 byte 0x15 JLCooper 29727>1 byte 0x16 Lowrey 29728>1 byte 0x17 AdamsSmith 29729>1 byte 0x18 E-mu 29730>1 byte 0x19 Harmony 29731>1 byte 0x1a ART 29732>1 byte 0x1b Baldwin 29733>1 byte 0x1c Eventide 29734>1 byte 0x1d Inventronics 29735>1 byte 0x1f Clarity 29736 29737# European Group 29738>1 byte 0x21 SIEL 29739>1 byte 0x22 Synthaxe 29740>1 byte 0x24 Hohner 29741>1 byte 0x25 Twister 29742>1 byte 0x26 Solton 29743>1 byte 0x27 Jellinghaus 29744>1 byte 0x28 Southworth 29745>1 byte 0x29 PPG 29746>1 byte 0x2a JEN 29747>1 byte 0x2b SSL 29748>1 byte 0x2c AudioVertrieb 29749 29750>1 byte 0x2f ELKA 29751>>3 byte 0x09 EK-44 29752 29753>1 byte 0x30 Dynacord 29754>1 byte 0x31 Jomox 29755>1 byte 0x33 Clavia 29756>1 byte 0x39 Soundcraft 29757# Some Waldorf info from http://Stromeko.Synth.net/Downloads#WaldorfDocs 29758>1 byte 0x3e Waldorf 29759>>2 byte 0x00 microWave 29760>>2 byte 0x0E microwave2 / XT 29761>>2 byte 0x0F Q / Q+ 29762>>3 byte =0 (default id) 29763>>3 byte >0 ( 29764>>>3 byte <0x7F \bdevice %d) 29765>>>3 byte =0x7F \bbroadcast id) 29766>>3 byte 0x7f Microwave I 29767>>>4 byte 0x00 SNDR (Sound Request) 29768>>>4 byte 0x10 SNDD (Sound Dump) 29769>>>4 byte 0x20 SNDP (Sound Parameter Change) 29770>>>4 byte 0x30 SNDQ (Sound Parameter Inquiry) 29771>>>4 byte 0x70 BOOT (Sound Reserved) 29772>>>4 byte 0x01 MULR (Multi Request) 29773>>>4 byte 0x11 MULD (Multi Dump) 29774>>>4 byte 0x21 MULP (Multi Parameter Change) 29775>>>4 byte 0x31 MULQ (Multi Parameter Inquiry) 29776>>>4 byte 0x71 OS (Multi Reserved) 29777>>>4 byte 0x02 DRMR (Drum Map Request) 29778>>>4 byte 0x12 DRMD (Drum Map Dump) 29779>>>4 byte 0x22 DRMP (Drum Map Parameter Change) 29780>>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry) 29781>>>4 byte 0x72 BIN (Drum Map Reserved) 29782>>>4 byte 0x03 PATR (Sequencer Pattern Request) 29783>>>4 byte 0x13 PATD (Sequencer Pattern Dump) 29784>>>4 byte 0x23 PATP (Sequencer Pattern Parameter Change) 29785>>>4 byte 0x33 PATQ (Sequencer Pattern Parameter Inquiry) 29786>>>4 byte 0x73 AFM (Sequencer Pattern Reserved) 29787>>>4 byte 0x04 GLBR (Global Parameter Request) 29788>>>4 byte 0x14 GLBD (Global Parameter Dump) 29789>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) 29790>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) 29791>>>4 byte 0x07 MODR (Mode Parameter Request) 29792>>>4 byte 0x17 MODD (Mode Parameter Dump) 29793>>>4 byte 0x27 MODP (Mode Parameter Parameter Change) 29794>>>4 byte 0x37 MODQ (Mode Parameter Parameter Inquiry) 29795>>2 byte 0x10 microQ 29796>>>4 byte 0x00 SNDR (Sound Request) 29797>>>4 byte 0x10 SNDD (Sound Dump) 29798>>>4 byte 0x20 SNDP (Sound Parameter Change) 29799>>>4 byte 0x30 SNDQ (Sound Parameter Inquiry) 29800>>>4 byte 0x70 (Sound Reserved) 29801>>>4 byte 0x01 MULR (Multi Request) 29802>>>4 byte 0x11 MULD (Multi Dump) 29803>>>4 byte 0x21 MULP (Multi Parameter Change) 29804>>>4 byte 0x31 MULQ (Multi Parameter Inquiry) 29805>>>4 byte 0x71 OS (Multi Reserved) 29806>>>4 byte 0x02 DRMR (Drum Map Request) 29807>>>4 byte 0x12 DRMD (Drum Map Dump) 29808>>>4 byte 0x22 DRMP (Drum Map Parameter Change) 29809>>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry) 29810>>>4 byte 0x72 BIN (Drum Map Reserved) 29811>>>4 byte 0x04 GLBR (Global Parameter Request) 29812>>>4 byte 0x14 GLBD (Global Parameter Dump) 29813>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) 29814>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) 29815>>2 byte 0x11 rackAttack 29816>>>4 byte 0x00 SNDR (Sound Parameter Request) 29817>>>4 byte 0x10 SNDD (Sound Parameter Dump) 29818>>>4 byte 0x20 SNDP (Sound Parameter Parameter Change) 29819>>>4 byte 0x30 SNDQ (Sound Parameter Parameter Inquiry) 29820>>>4 byte 0x01 PRGR (Program Parameter Request) 29821>>>4 byte 0x11 PRGD (Program Parameter Dump) 29822>>>4 byte 0x21 PRGP (Program Parameter Parameter Change) 29823>>>4 byte 0x31 PRGQ (Program Parameter Parameter Inquiry) 29824>>>4 byte 0x71 OS (Program Parameter Reserved) 29825>>>4 byte 0x03 PATR (Pattern Parameter Request) 29826>>>4 byte 0x13 PATD (Pattern Parameter Dump) 29827>>>4 byte 0x23 PATP (Pattern Parameter Parameter Change) 29828>>>4 byte 0x33 PATQ (Pattern Parameter Parameter Inquiry) 29829>>>4 byte 0x04 GLBR (Global Parameter Request) 29830>>>4 byte 0x14 GLBD (Global Parameter Dump) 29831>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) 29832>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) 29833>>>4 byte 0x05 EFXR (FX Parameter Request) 29834>>>4 byte 0x15 EFXD (FX Parameter Dump) 29835>>>4 byte 0x25 EFXP (FX Parameter Parameter Change) 29836>>>4 byte 0x35 EFXQ (FX Parameter Parameter Inquiry) 29837>>>4 byte 0x07 MODR (Mode Command Request) 29838>>>4 byte 0x17 MODD (Mode Command Dump) 29839>>>4 byte 0x27 MODP (Mode Command Parameter Change) 29840>>>4 byte 0x37 MODQ (Mode Command Parameter Inquiry) 29841>>2 byte 0x03 Wave 29842>>>4 byte 0x00 SBPR (Soundprogram) 29843>>>4 byte 0x01 SAPR (Performance) 29844>>>4 byte 0x02 SWAVE (Wave) 29845>>>4 byte 0x03 SWTBL (Wave control table) 29846>>>4 byte 0x04 SVT (Velocity Curve) 29847>>>4 byte 0x05 STT (Tuning Table) 29848>>>4 byte 0x06 SGLB (Global Parameters) 29849>>>4 byte 0x07 SARRMAP (Performance Program Change Map) 29850>>>4 byte 0x08 SBPRMAP (Sound Program Change Map) 29851>>>4 byte 0x09 SBPRPAR (Sound Parameter) 29852>>>4 byte 0x0A SARRPAR (Performance Parameter) 29853>>>4 byte 0x0B SINSPAR (Instrument/External Parameter) 29854>>>4 byte 0x0F SBULK (Bulk Switch on/off) 29855 29856# Japanese Group 29857>1 byte 0x40 Kawai 29858>>3 byte 0x20 K1 29859>>3 byte 0x22 K4 29860 29861>1 byte 0x41 Roland 29862>>3 byte 0x14 D-50 29863>>3 byte 0x2b U-220 29864>>3 byte 0x02 TR-707 29865 29866>1 byte 0x42 Korg 29867>>3 byte 0x19 M1 29868 29869>1 byte 0x43 Yamaha 29870>1 byte 0x44 Casio 29871>1 byte 0x46 Kamiya 29872>1 byte 0x47 Akai 29873>1 byte 0x48 Victor 29874>1 byte 0x49 Mesosha 29875>1 byte 0x4b Fujitsu 29876>1 byte 0x4c Sony 29877>1 byte 0x4e Teac 29878>1 byte 0x50 Matsushita 29879>1 byte 0x51 Fostex 29880>1 byte 0x52 Zoom 29881>1 byte 0x54 Matsushita 29882>1 byte 0x57 Acoustic tech. lab. 29883# https://www.midi.org/techspecs/manid.php 29884>1 belong&0xffffff00 0x00007400 Ta Horng 29885>1 belong&0xffffff00 0x00007500 e-Tek 29886>1 belong&0xffffff00 0x00007600 E-Voice 29887>1 belong&0xffffff00 0x00007700 Midisoft 29888>1 belong&0xffffff00 0x00007800 Q-Sound 29889>1 belong&0xffffff00 0x00007900 Westrex 29890>1 belong&0xffffff00 0x00007a00 Nvidia* 29891>1 belong&0xffffff00 0x00007b00 ESS 29892>1 belong&0xffffff00 0x00007c00 Mediatrix 29893>1 belong&0xffffff00 0x00007d00 Brooktree 29894>1 belong&0xffffff00 0x00007e00 Otari 29895>1 belong&0xffffff00 0x00007f00 Key Electronics 29896>1 belong&0xffffff00 0x00010000 Shure 29897>1 belong&0xffffff00 0x00010100 AuraSound 29898>1 belong&0xffffff00 0x00010200 Crystal 29899>1 belong&0xffffff00 0x00010300 Rockwell 29900>1 belong&0xffffff00 0x00010400 Silicon Graphics 29901>1 belong&0xffffff00 0x00010500 Midiman 29902>1 belong&0xffffff00 0x00010600 PreSonus 29903>1 belong&0xffffff00 0x00010800 Topaz 29904>1 belong&0xffffff00 0x00010900 Cast Lightning 29905>1 belong&0xffffff00 0x00010a00 Microsoft 29906>1 belong&0xffffff00 0x00010b00 Sonic Foundry 29907>1 belong&0xffffff00 0x00010c00 Line 6 29908>1 belong&0xffffff00 0x00010d00 Beatnik Inc. 29909>1 belong&0xffffff00 0x00010e00 Van Koerving 29910>1 belong&0xffffff00 0x00010f00 Altech Systems 29911>1 belong&0xffffff00 0x00011000 S & S Research 29912>1 belong&0xffffff00 0x00011100 VLSI Technology 29913>1 belong&0xffffff00 0x00011200 Chromatic 29914>1 belong&0xffffff00 0x00011300 Sapphire 29915>1 belong&0xffffff00 0x00011400 IDRC 29916>1 belong&0xffffff00 0x00011500 Justonic Tuning 29917>1 belong&0xffffff00 0x00011600 TorComp 29918>1 belong&0xffffff00 0x00011700 Newtek Inc. 29919>1 belong&0xffffff00 0x00011800 Sound Sculpture 29920>1 belong&0xffffff00 0x00011900 Walker Technical 29921>1 belong&0xffffff00 0x00011a00 Digital Harmony 29922>1 belong&0xffffff00 0x00011b00 InVision 29923>1 belong&0xffffff00 0x00011c00 T-Square 29924>1 belong&0xffffff00 0x00011d00 Nemesys 29925>1 belong&0xffffff00 0x00011e00 DBX 29926>1 belong&0xffffff00 0x00011f00 Syndyne 29927>1 belong&0xffffff00 0x00012000 Bitheadz 29928>1 belong&0xffffff00 0x00012100 Cakewalk 29929>1 belong&0xffffff00 0x00012200 Staccato 29930>1 belong&0xffffff00 0x00012300 National Semicon. 29931>1 belong&0xffffff00 0x00012400 Boom Theory 29932>1 belong&0xffffff00 0x00012500 Virtual DSP Corp 29933>1 belong&0xffffff00 0x00012600 Antares 29934>1 belong&0xffffff00 0x00012700 Angel Software 29935>1 belong&0xffffff00 0x00012800 St Louis Music 29936>1 belong&0xffffff00 0x00012900 Lyrrus dba G-VOX 29937>1 belong&0xffffff00 0x00012a00 Ashley Audio 29938>1 belong&0xffffff00 0x00012b00 Vari-Lite 29939>1 belong&0xffffff00 0x00012c00 Summit Audio 29940>1 belong&0xffffff00 0x00012d00 Aureal Semicon. 29941>1 belong&0xffffff00 0x00012e00 SeaSound 29942>1 belong&0xffffff00 0x00012f00 U.S. Robotics 29943>1 belong&0xffffff00 0x00013000 Aurisis 29944>1 belong&0xffffff00 0x00013100 Nearfield Multimedia 29945>1 belong&0xffffff00 0x00013200 FM7 Inc. 29946>1 belong&0xffffff00 0x00013300 Swivel Systems 29947>1 belong&0xffffff00 0x00013400 Hyperactive 29948>1 belong&0xffffff00 0x00013500 MidiLite 29949>1 belong&0xffffff00 0x00013600 Radical 29950>1 belong&0xffffff00 0x00013700 Roger Linn 29951>1 belong&0xffffff00 0x00013800 Helicon 29952>1 belong&0xffffff00 0x00013900 Event 29953>1 belong&0xffffff00 0x00013a00 Sonic Network 29954>1 belong&0xffffff00 0x00013b00 Realtime Music 29955>1 belong&0xffffff00 0x00013c00 Apogee Digital 29956 29957>1 belong&0xffffff00 0x00202b00 Medeli Electronics 29958>1 belong&0xffffff00 0x00202c00 Charlie Lab 29959>1 belong&0xffffff00 0x00202d00 Blue Chip Music 29960>1 belong&0xffffff00 0x00202e00 BEE OH Corp 29961>1 belong&0xffffff00 0x00202f00 LG Semicon America 29962>1 belong&0xffffff00 0x00203000 TESI 29963>1 belong&0xffffff00 0x00203100 EMAGIC 29964>1 belong&0xffffff00 0x00203200 Behringer 29965>1 belong&0xffffff00 0x00203300 Access Music 29966>1 belong&0xffffff00 0x00203400 Synoptic 29967>1 belong&0xffffff00 0x00203500 Hanmesoft Corp 29968>1 belong&0xffffff00 0x00203600 Terratec 29969>1 belong&0xffffff00 0x00203700 Proel SpA 29970>1 belong&0xffffff00 0x00203800 IBK MIDI 29971>1 belong&0xffffff00 0x00203900 IRCAM 29972>1 belong&0xffffff00 0x00203a00 Propellerhead Software 29973>1 belong&0xffffff00 0x00203b00 Red Sound Systems 29974>1 belong&0xffffff00 0x00203c00 Electron ESI AB 29975>1 belong&0xffffff00 0x00203d00 Sintefex Audio 29976>1 belong&0xffffff00 0x00203e00 Music and More 29977>1 belong&0xffffff00 0x00203f00 Amsaro 29978>1 belong&0xffffff00 0x00204000 CDS Advanced Technology 29979>1 belong&0xffffff00 0x00204100 Touched by Sound 29980>1 belong&0xffffff00 0x00204200 DSP Arts 29981>1 belong&0xffffff00 0x00204300 Phil Rees Music 29982>1 belong&0xffffff00 0x00204400 Stamer Musikanlagen GmbH 29983>1 belong&0xffffff00 0x00204500 Soundart 29984>1 belong&0xffffff00 0x00204600 C-Mexx Software 29985>1 belong&0xffffff00 0x00204700 Klavis Tech. 29986>1 belong&0xffffff00 0x00204800 Noteheads AB 29987 299880 string T707 Roland TR-707 Data 29989#------------------------------------------------------------------------------ 29990# file: file(1) magic for Tcl scripting language 29991# URL: https://www.tcl.tk/ 29992# From: gustaf neumann 29993 29994# Tcl scripts 299950 search/1/w #!\ /usr/bin/tcl Tcl script text executable 29996!:mime text/x-tcl 299970 search/1/w #!\ /usr/local/bin/tcl Tcl script text executable 29998!:mime text/x-tcl 299990 search/1 #!/usr/bin/env\ tcl Tcl script text executable 30000!:mime text/x-tcl 300010 search/1 #!\ /usr/bin/env\ tcl Tcl script text executable 30002!:mime text/x-tcl 300030 search/1/w #!\ /usr/bin/wish Tcl/Tk script text executable 30004!:mime text/x-tcl 300050 search/1/w #!\ /usr/local/bin/wish Tcl/Tk script text executable 30006!:mime text/x-tcl 300070 search/1 #!/usr/bin/env\ wish Tcl/Tk script text executable 30008!:mime text/x-tcl 300090 search/1 #!\ /usr/bin/env\ wish Tcl/Tk script text executable 30010!:mime text/x-tcl 30011 30012# check the first line 300130 search/1 package\ req 30014>0 regex \^package[\ \t]+req Tcl script 30015# not 'p', check other lines 300160 search/1 !p 30017>0 regex \^package[\ \t]+req Tcl script 30018 30019#------------------------------------------------------------------------------ 30020# $File: teapot,v 1.4 2009/09/19 16:28:12 christos Exp $ 30021# teapot: file(1) magic for "teapot" spreadsheet 30022# 300230 string #!teapot\012xdr teapot work sheet (XDR format) 30024 30025#------------------------------------------------------------------------------ 30026# $File: terminfo,v 1.11 2019/04/19 00:42:27 christos Exp $ 30027# terminfo: file(1) magic for terminfo 30028# 30029# URL: https://invisible-island.net/ncurses/man/term.5.html 30030# URL: https://invisible-island.net/ncurses/man/scr_dump.5.html 30031# 30032# Workaround for Targa image type by Joerg Jenderek 30033# GRR: line below too general as it catches also 30034# Targa image type 1 with 26 long identification field 30035# and HELP.DSK 300360 string \032\001 30037# 5th character of terminal name list, but not Targa image pixel size (15 16 24 32) 30038>16 ubyte >32 30039# namelist, if more than 1 separated by "|" like "st|stterm| simpleterm 0.4.1" 30040>>12 regex \^[a-zA-Z0-9][a-zA-Z0-9.][^|]* Compiled terminfo entry "%-s" 30041!:mime application/x-terminfo 30042# no extension 30043#!:ext 30044# 30045#------------------------------------------------------------------------------ 30046# The following was added for ncurses6 development: 30047#------------------------------------------------------------------------------ 30048# 300490 string \036\002 30050# imitate the legacy compiled-format, to get the entry-name printed 30051>16 ubyte >32 30052# namelist, if more than 1 separated by "|" like "st|stterm| simpleterm 0. 4.1" 30053>>12 regex \^[a-zA-Z0-9][a-zA-Z0-9.][^|]* Compiled 32-bit terminfo entry "%-s" 30054!:mime application/x-terminfo2 30055# 30056# While the compiled terminfo uses little-endian format irregardless of 30057# platform, SystemV screen dumps do not. They came later, and that detail was 30058# overlooked. 30059# 30060# AIX and HPUX use the SVr4 big-endian format 30061# Solaris uses the SVr3 formats (sparc and x86 differ endian-ness) 300620 beshort 0433 SVr2 curses screen image, big-endian 300630 beshort 0434 SVr3 curses screen image, big-endian 300640 beshort 0435 SVr4 curses screen image, big-endian 30065# 300660 leshort 0433 SVr2 curses screen image, little-endian 300670 leshort 0434 SVr3 curses screen image, little-endian 300680 leshort 0435 SVr4 curses screen image, little-endian 30069# 30070# Rather than SVr4, Solaris "xcurses" writes this header: 300710 regex \^MAX=[0-9]+,[0-9]+$ 30072>1 regex \^BEG=[0-9]+,[0-9]+$ 30073>2 regex \^SCROLL=[0-9]+,[0-9]+$ 30074>3 regex \^VMIN=[0-9]+$ 30075>4 regex \^VTIME=[0-9]+$ 30076>5 regex \^FLAGS=0x[[:xdigit:]]+$ 30077>6 regex \^FG=[0-9],[0-9]+$ 30078>7 regex \^BG=[0-9]+,[0-9]+, Solaris xcurses screen image 30079# 30080# ncurses5 (and before) did not use a magic number, making screen dumps "data". 30081# ncurses6 (2015) uses this format, ignoring byte-order 300820 string \210\210\210\210ncurses ncurses6 screen image 30083# 30084# PDCurses added this in 2005 300850 string PDC\001 PDCurses screen image 30086 30087#------------------------------------------------------------------------------ 30088# $File: tex,v 1.21 2019/04/19 00:42:27 christos Exp $ 30089# tex: file(1) magic for TeX files 30090# 30091# XXX - needs byte-endian stuff (big-endian and little-endian DVI?) 30092# 30093# From <conklin@talisman.kaleida.com> 30094 30095# Although we may know the offset of certain text fields in TeX DVI 30096# and font files, we can't use them reliably because they are not 30097# zero terminated. [but we do anyway, christos] 300980 string \367\002 TeX DVI file 30099!:mime application/x-dvi 30100>16 string >\0 (%s) 301010 string \367\203 TeX generic font data 301020 string \367\131 TeX packed font data 30103>3 string >\0 (%s) 301040 string \367\312 TeX virtual font data 301050 search/1 This\ is\ TeX, TeX transcript text 301060 search/1 This\ is\ METAFONT, METAFONT transcript text 30107 30108# There is no way to detect TeX Font Metric (*.tfm) files without 30109# breaking them apart and reading the data. The following patterns 30110# match most *.tfm files generated by METAFONT or afm2tfm. 301112 string \000\021 TeX font metric data 30112!:mime application/x-tex-tfm 30113>33 string >\0 (%s) 301142 string \000\022 TeX font metric data 30115!:mime application/x-tex-tfm 30116>33 string >\0 (%s) 30117 30118# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com) 301190 search/1 \\input\ texinfo Texinfo source text 30120!:mime text/x-texinfo 301210 search/1 This\ is\ Info\ file GNU Info text 30122!:mime text/x-info 30123 30124# TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com) 301250 search/4096 \\input TeX document text 30126!:mime text/x-tex 30127!:strength + 15 301280 search/4096 \\begin LaTeX document text 30129!:mime text/x-tex 30130!:strength + 15 301310 search/4096 \\section LaTeX document text 30132!:mime text/x-tex 30133!:strength + 18 301340 search/4096 \\setlength LaTeX document text 30135!:mime text/x-tex 30136!:strength + 15 301370 search/4096 \\documentstyle LaTeX document text 30138!:mime text/x-tex 30139!:strength + 18 301400 search/4096 \\chapter LaTeX document text 30141!:mime text/x-tex 30142!:strength + 18 301430 search/4096 \\documentclass LaTeX 2e document text 30144!:mime text/x-tex 30145!:strength + 15 301460 search/4096 \\relax LaTeX auxiliary file 30147!:mime text/x-tex 30148!:strength + 15 301490 search/4096 \\contentsline LaTeX table of contents 30150!:mime text/x-tex 30151!:strength + 15 301520 search/4096 %\ -*-latex-*- LaTeX document text 30153!:mime text/x-tex 30154 30155# Tex document, from Hendrik Scholz <hendrik@scholz.net> 301560 search/1 \\ifx TeX document text 30157 30158# Index and glossary files 301590 search/4096 \\indexentry LaTeX raw index file 301600 search/4096 \\begin{theindex} LaTeX sorted index 301610 search/4096 \\glossaryentry LaTeX raw glossary 301620 search/4096 \\begin{theglossary} LaTeX sorted glossary 301630 search/4096 This\ is\ makeindex Makeindex log file 30164 30165# End of TeX 30166 30167#------------------------------------------------------------------------------ 30168# file(1) magic for BibTex text files 30169# From Hendrik Scholz <hendrik@scholz.net> 30170 301710 search/1/c @article{ BibTeX text file 301720 search/1/c @book{ BibTeX text file 301730 search/1/c @inbook{ BibTeX text file 301740 search/1/c @incollection{ BibTeX text file 301750 search/1/c @inproceedings{ BibTeX text file 301760 search/1/c @manual{ BibTeX text file 301770 search/1/c @misc{ BibTeX text file 301780 search/1/c @preamble{ BibTeX text file 301790 search/1/c @phdthesis{ BibTeX text file 301800 search/1/c @techreport{ BibTeX text file 301810 search/1/c @unpublished{ BibTeX text file 30182 3018373 search/1 %%%\ \ BibTeX-file{ BibTex text file (with full header) 30184 3018573 search/1 %%%\ \ @BibTeX-style-file{ BibTeX style text file (with full header) 30186 301870 search/1 %\ BibTeX\ standard\ bibliography\ BibTeX standard bibliography style text file 30188 301890 search/1 %\ BibTeX\ ` BibTeX custom bibliography style text file 30190 301910 search/1 @c\ @mapfile{ TeX font aliases text file 30192 301930 string #LyX LyX document text 30194 30195# ConTeXt documents 30196# https://wiki.contextgarden.net/ 301970 search/4096 \\setupcolors[ ConTeXt document text 30198!:strength + 15 301990 search/4096 \\definecolor[ ConTeXt document text 30200!:strength + 15 302010 search/4096 \\setupinteraction[ ConTeXt document text 30202!:strength + 15 302030 search/4096 \\useURL[ ConTeXt document text 30204!:strength + 15 302050 search/4096 \\setuppapersize[ ConTeXt document text 30206!:strength + 15 302070 search/4096 \\setuplayout[ ConTeXt document text 30208!:strength + 15 302090 search/4096 \\setupfooter[ ConTeXt document text 30210!:strength + 15 302110 search/4096 \\setupfootertexts[ ConTeXt document text 30212!:strength + 15 302130 search/4096 \\setuppagenumbering[ ConTeXt document text 30214!:strength + 15 302150 search/4096 \\setupbodyfont[ ConTeXt document text 30216!:strength + 15 302170 search/4096 \\setuphead[ ConTeXt document text 30218!:strength + 15 302190 search/4096 \\setupitemize[ ConTeXt document text 30220!:strength + 15 302210 search/4096 \\setupwhitespace[ ConTeXt document text 30222!:strength + 15 302230 search/4096 \\setupindenting[ ConTeXt document text 30224!:strength + 15 30225 30226#------------------------------------------------------------------------------ 30227# $File: tgif,v 1.7 2010/09/20 19:03:46 rrt Exp $ 30228# file(1) magic for tgif(1) files 30229# From Hendrik Scholz <hendrik@scholz.net> 302300 string %TGIF\ Tgif file version 30231>6 string x %s 30232 30233#------------------------------------------------------------------------------ 30234# $File: ti-8x,v 1.8 2020/02/12 22:13:01 christos Exp $ 30235# ti-8x: file(1) magic for the TI-8x and TI-9x Graphing Calculators. 30236# 30237# From: Ryan McGuire (rmcguire@freenet.columbus.oh.us). 30238# 30239# Update: Romain Lievin (roms@lpg.ticalc.org). 30240# 30241# NOTE: This list is not complete. 30242# Files for the TI-80 and TI-81 are pretty rare. I'm not going to put the 30243# program/group magic numbers in here because I cannot find any. 302440 string **TI80** TI-80 Graphing Calculator File. 302450 string **TI81** TI-81 Graphing Calculator File. 30246# 30247# Magic Numbers for the TI-73 30248# 302490 string **TI73** TI-73 Graphing Calculator 30250>0x00003B byte 0x00 (real number) 30251>0x00003B byte 0x01 (list) 30252>0x00003B byte 0x02 (matrix) 30253>0x00003B byte 0x03 (equation) 30254>0x00003B byte 0x04 (string) 30255>0x00003B byte 0x05 (program) 30256>0x00003B byte 0x06 (assembly program) 30257>0x00003B byte 0x07 (picture) 30258>0x00003B byte 0x08 (gdb) 30259>0x00003B byte 0x0C (complex number) 30260>0x00003B byte 0x0F (window settings) 30261>0x00003B byte 0x10 (zoom) 30262>0x00003B byte 0x11 (table setup) 30263>0x00003B byte 0x13 (backup) 30264 30265# Magic Numbers for the TI-82 30266# 302670 string **TI82** TI-82 Graphing Calculator 30268>0x00003B byte 0x00 (real) 30269>0x00003B byte 0x01 (list) 30270>0x00003B byte 0x02 (matrix) 30271>0x00003B byte 0x03 (Y-variable) 30272>0x00003B byte 0x05 (program) 30273>0x00003B byte 0x06 (protected prgm) 30274>0x00003B byte 0x07 (picture) 30275>0x00003B byte 0x08 (gdb) 30276>0x00003B byte 0x0B (window settings) 30277>0x00003B byte 0x0C (window settings) 30278>0x00003B byte 0x0D (table setup) 30279>0x00003B byte 0x0E (screenshot) 30280>0x00003B byte 0x0F (backup) 30281# 30282# Magic Numbers for the TI-83 30283# 302840 string **TI83** TI-83 Graphing Calculator 30285>0x00003B byte 0x00 (real) 30286>0x00003B byte 0x01 (list) 30287>0x00003B byte 0x02 (matrix) 30288>0x00003B byte 0x03 (Y-variable) 30289>0x00003B byte 0x04 (string) 30290>0x00003B byte 0x05 (program) 30291>0x00003B byte 0x06 (protected prgm) 30292>0x00003B byte 0x07 (picture) 30293>0x00003B byte 0x08 (gdb) 30294>0x00003B byte 0x0B (window settings) 30295>0x00003B byte 0x0C (window settings) 30296>0x00003B byte 0x0D (table setup) 30297>0x00003B byte 0x0E (screenshot) 30298>0x00003B byte 0x13 (backup) 30299# 30300# Magic Numbers for the TI-83+ 30301# 303020 string **TI83F* TI-83+ Graphing Calculator 30303>0x00003B byte 0x00 (real number) 30304>0x00003B byte 0x01 (list) 30305>0x00003B byte 0x02 (matrix) 30306>0x00003B byte 0x03 (equation) 30307>0x00003B byte 0x04 (string) 30308>0x00003B byte 0x05 (program) 30309>0x00003B byte 0x06 (assembly program) 30310>0x00003B byte 0x07 (picture) 30311>0x00003B byte 0x08 (gdb) 30312>0x00003B byte 0x0C (complex number) 30313>0x00003B byte 0x0F (window settings) 30314>0x00003B byte 0x10 (zoom) 30315>0x00003B byte 0x11 (table setup) 30316>0x00003B byte 0x13 (backup) 30317>0x00003B byte 0x15 (application variable) 30318>0x00003B byte 0x17 (group of variable) 30319 30320# 30321# Magic Numbers for the TI-85 30322# 303230 string **TI85** TI-85 Graphing Calculator 30324>0x00003B byte 0x00 (real number) 30325>0x00003B byte 0x01 (complex number) 30326>0x00003B byte 0x02 (real vector) 30327>0x00003B byte 0x03 (complex vector) 30328>0x00003B byte 0x04 (real list) 30329>0x00003B byte 0x05 (complex list) 30330>0x00003B byte 0x06 (real matrix) 30331>0x00003B byte 0x07 (complex matrix) 30332>0x00003B byte 0x08 (real constant) 30333>0x00003B byte 0x09 (complex constant) 30334>0x00003B byte 0x0A (equation) 30335>0x00003B byte 0x0C (string) 30336>0x00003B byte 0x0D (function GDB) 30337>0x00003B byte 0x0E (polar GDB) 30338>0x00003B byte 0x0F (parametric GDB) 30339>0x00003B byte 0x10 (diffeq GDB) 30340>0x00003B byte 0x11 (picture) 30341>0x00003B byte 0x12 (program) 30342>0x00003B byte 0x13 (range) 30343>0x00003B byte 0x17 (window settings) 30344>0x00003B byte 0x18 (window settings) 30345>0x00003B byte 0x19 (window settings) 30346>0x00003B byte 0x1A (window settings) 30347>0x00003B byte 0x1B (zoom) 30348>0x00003B byte 0x1D (backup) 30349>0x00003B byte 0x1E (unknown) 30350>0x00003B byte 0x2A (equation) 30351>0x000032 string ZS4 - ZShell Version 4 File. 30352>0x000032 string ZS3 - ZShell Version 3 File. 30353# 30354# Magic Numbers for the TI-86 30355# 303560 string **TI86** TI-86 Graphing Calculator 30357>0x00003B byte 0x00 (real number) 30358>0x00003B byte 0x01 (complex number) 30359>0x00003B byte 0x02 (real vector) 30360>0x00003B byte 0x03 (complex vector) 30361>0x00003B byte 0x04 (real list) 30362>0x00003B byte 0x05 (complex list) 30363>0x00003B byte 0x06 (real matrix) 30364>0x00003B byte 0x07 (complex matrix) 30365>0x00003B byte 0x08 (real constant) 30366>0x00003B byte 0x09 (complex constant) 30367>0x00003B byte 0x0A (equation) 30368>0x00003B byte 0x0C (string) 30369>0x00003B byte 0x0D (function GDB) 30370>0x00003B byte 0x0E (polar GDB) 30371>0x00003B byte 0x0F (parametric GDB) 30372>0x00003B byte 0x10 (diffeq GDB) 30373>0x00003B byte 0x11 (picture) 30374>0x00003B byte 0x12 (program) 30375>0x00003B byte 0x13 (range) 30376>0x00003B byte 0x17 (window settings) 30377>0x00003B byte 0x18 (window settings) 30378>0x00003B byte 0x19 (window settings) 30379>0x00003B byte 0x1A (window settings) 30380>0x00003B byte 0x1B (zoom) 30381>0x00003B byte 0x1D (backup) 30382>0x00003B byte 0x1E (unknown) 30383>0x00003B byte 0x2A (equation) 30384# 30385# Magic Numbers for the TI-89 30386# 303870 string **TI89** TI-89 Graphing Calculator 30388>0x000048 byte 0x00 (expression) 30389>0x000048 byte 0x04 (list) 30390>0x000048 byte 0x06 (matrix) 30391>0x000048 byte 0x0A (data) 30392>0x000048 byte 0x0B (text) 30393>0x000048 byte 0x0C (string) 30394>0x000048 byte 0x0D (graphic data base) 30395>0x000048 byte 0x0E (figure) 30396>0x000048 byte 0x10 (picture) 30397>0x000048 byte 0x12 (program) 30398>0x000048 byte 0x13 (function) 30399>0x000048 byte 0x14 (macro) 30400>0x000048 byte 0x1C (zipped) 30401>0x000048 byte 0x21 (assembler) 30402# 30403# Magic Numbers for the TI-92 30404# 304050 string **TI92** TI-92 Graphing Calculator 30406>0x000048 byte 0x00 (expression) 30407>0x000048 byte 0x04 (list) 30408>0x000048 byte 0x06 (matrix) 30409>0x000048 byte 0x0A (data) 30410>0x000048 byte 0x0B (text) 30411>0x000048 byte 0x0C (string) 30412>0x000048 byte 0x0D (graphic data base) 30413>0x000048 byte 0x0E (figure) 30414>0x000048 byte 0x10 (picture) 30415>0x000048 byte 0x12 (program) 30416>0x000048 byte 0x13 (function) 30417>0x000048 byte 0x14 (macro) 30418>0x000048 byte 0x1D (backup) 30419# 30420# Magic Numbers for the TI-92+/V200 30421# 304220 string **TI92P* TI-92+/V200 Graphing Calculator 30423>0x000048 byte 0x00 (expression) 30424>0x000048 byte 0x04 (list) 30425>0x000048 byte 0x06 (matrix) 30426>0x000048 byte 0x0A (data) 30427>0x000048 byte 0x0B (text) 30428>0x000048 byte 0x0C (string) 30429>0x000048 byte 0x0D (graphic data base) 30430>0x000048 byte 0x0E (figure) 30431>0x000048 byte 0x10 (picture) 30432>0x000048 byte 0x12 (program) 30433>0x000048 byte 0x13 (function) 30434>0x000048 byte 0x14 (macro) 30435>0x000048 byte 0x1C (zipped) 30436>0x000048 byte 0x21 (assembler) 30437# 30438# Magic Numbers for the TI-73/83+/89/92+/V200 FLASH upgrades 30439# 30440#0x0000016 string Advanced TI-XX Graphing Calculator (FLASH) 304410 string **TIFL** TI-XX Graphing Calculator (FLASH) 30442>8 byte >0 - Revision %d 30443>>9 byte x \b.%d, 30444>12 byte >0 Revision date %02x 30445>>13 byte x \b/%02x 30446>>14 beshort x \b/%04x, 30447>17 string >/0 name: '%s', 30448>48 byte 0x74 device: TI-73, 30449>48 byte 0x73 device: TI-83+, 30450>48 byte 0x98 device: TI-89, 30451>48 byte 0x88 device: TI-92+, 30452>49 byte 0x23 type: OS upgrade, 30453>49 byte 0x24 type: application, 30454>49 byte 0x25 type: certificate, 30455>49 byte 0x3e type: license, 30456>74 lelong >0 size: %d bytes 30457 30458# VTi & TiEmu skins (TI Graphing Calculators). 30459# From: Romain Lievin (roms@lpg.ticalc.org). 30460# Magic Numbers for the VTi skins 304610 string VTI Virtual TI skin 30462>3 string v - Version 30463>>4 byte >0 \b %c 30464>>6 byte x \b.%c 30465# Magic Numbers for the TiEmu skins 304660 string TiEmu TiEmu skin 30467>6 string v - Version 30468>>7 byte >0 \b %c 30469>>9 byte x \b.%c 30470>>10 byte x \b%c 30471 30472#------------------------------------------------------------------------------ 30473# $File: timezone,v 1.11 2009/09/19 16:28:12 christos Exp $ 30474# timezone: file(1) magic for timezone data 30475# 30476# from Daniel Quinlan (quinlan@yggdrasil.com) 30477# this should work on Linux, SunOS, and maybe others 30478# Added new official magic number for recent versions of the Olson code 304790 string TZif timezone data 30480>4 byte 0 \b, old version 30481>4 byte >0 \b, version %c 30482>20 belong 0 \b, no gmt time flags 30483>20 belong 1 \b, 1 gmt time flag 30484>20 belong >1 \b, %d gmt time flags 30485>24 belong 0 \b, no std time flags 30486>20 belong 1 \b, 1 std time flag 30487>24 belong >1 \b, %d std time flags 30488>28 belong 0 \b, no leap seconds 30489>28 belong 1 \b, 1 leap second 30490>28 belong >1 \b, %d leap seconds 30491>32 belong 0 \b, no transition times 30492>32 belong 1 \b, 1 transition time 30493>32 belong >1 \b, %d transition times 30494>36 belong 0 \b, no abbreviation chars 30495>36 belong 1 \b, 1 abbreviation char 30496>36 belong >1 \b, %d abbreviation chars 304970 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0 old timezone data 304980 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0 old timezone data 304990 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0 old timezone data 305000 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0 old timezone data 305010 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0 old timezone data 305020 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0 old timezone data 30503 30504#------------------------------------------------------------------------------ 30505# $File: tplink,v 1.5 2020/03/28 23:14:26 christos Exp $ 30506# tplink: File magic for openwrt firmware files 30507 30508# URL: https://wiki.openwrt.org/doc/techref/header 30509# Reference: https://git.openwrt.org/?p=openwrt.git;a=blob;f=tools/firmware-utils/src/mktplinkfw.c 30510# From: Joerg Jenderek 30511# check for valid header version 1 or 2 305120 ulelong <3 30513>0 ulelong !0 30514# test for header padding with nulls 30515>>0x100 long 0 30516# skip Norton Commander Cleanup Utility NCCLEAN.INI by looking for valid vendor 30517>>>4 ubelong >0x1F000000 30518# skip user.dbt by looking for positive hardware id 30519>>>>0x40 ubeshort >0 30520>>>>>0 use firmware-tplink 30521 305220 name firmware-tplink 30523>0 ubyte x firmware 30524!:mime application/x-tplink-bin 30525!:ext bin 30526# hardware id like 10430001 07410001 09410004 09410006 30527>0x40 ubeshort x %x 30528>0x42 ubeshort x v%x 30529# hardware revision like 1 30530>0x44 ubelong !1 (revision %u) 30531# vendor_name[24] like OpenWrt or TP-LINK Technologies 30532>4 string x %.24s 30533# fw_version[36] like r49389 or ver. 1.0 30534>0x1c string x %.36s 30535# header version 1 or 2 30536>0 ubyte !1 V%X 30537# ver_hi.ver_mid.ver_lo 30538>0x98 long !0 \b, version 30539>>0x98 ubeshort x %u 30540>>0x9A ubeshort x \b.%u 30541>>0x9C ubeshort x \b.%u 30542# region code 0~universal 1~US 30543>0x48 ubelong x 30544#>>0x48 ubelong 0 (universal) 30545>>0x48 ubelong 1 (US) 30546>>0x48 ubelong >1 (region %u) 30547# total length of the firmware. not always true 30548>0x7C ubelong x \b, %u bytes or less 30549# unknown 1 30550>0x48 ubelong !0 \b, UNKNOWN1 0x%x 30551# md5sum1[16] 30552#>0x4c ubequad x \b, MD5 %llx 30553#>>0x54 ubequad x \b%llx 30554# unknown 2 30555>0x5c ubelong !0 \b, UNKNOWN2 0x%x 30556# md5sum2[16] 30557#>0x60 ubequad !0 \b, 2nd MD5 %llx 30558#>>0x68 ubequad x \b%llx 30559# unknown 3 30560>0x70 ubelong !0 \b, UNKNOWN3 0x%x 30561# kernel load address 30562#>0x74 ubelong x \b, 0x%x load 30563# kernel entry point 30564#>0x78 ubelong x \b, 0x%x entry 30565# kernel data offset. 200h means direct after header 30566>0x80 ubelong x \b, at 0x%x 30567# kernel data length and 1 space 30568>0x84 ubelong x %u bytes 30569# look for kernel type (gzip compressed vmlinux.bin by ./compress) 30570>(0x80.L) indirect x 30571# root file system data offset 30572# WRONG in 5.35 with above indirect expression 30573>0x88 ubelong x \b, at 0x%x 30574# rootfs data length and 1 space 30575>0x8C ubelong x %u bytes 30576# in 5.32 only true for offset ~< FILE_BYTES_MAX=9 MB defined in ../../src/file.h 30577>(0x88.L) indirect x 30578# 'qshs' for wr940nv1_en_3_13_7_up(111228).bin 30579#>(0x88.L) string x \b, file system '%.4s' 30580#>(0x88.L) ubequad x \b, file system 0x%llx 30581# bootloader data offset 30582>0x90 ubelong !0 \b, at 0x%x 30583# bootloader data length only resonable if bootloader offset not null 30584>>0x94 ubelong !0 %u bytes 30585# pad[354] should be 354 null bytes. 30586#>0x9E ubequad !0 \b, padding 0x%llx 30587# But at 0x120 18 non null bytes in examples like 30588# wr940nv4_eu_3_16_9_up_boot(160620).bin 30589# wr940nv6_us_3_18_1_up_boot(171030).bin 30590#>0x120 ubequad !0 \b, other padding 0x%llx 30591 30592#------------------------------------------------------------------------------ 30593# $File: troff,v 1.13 2020/05/30 23:12:34 christos Exp $ 30594# troff: file(1) magic for *roff 30595# 30596# updated by Daniel Quinlan (quinlan@yggdrasil.com) 30597 30598# troff input 305990 search/1 .\\" troff or preprocessor input text 30600!:mime text/troff 306010 search/1 '\\" troff or preprocessor input text 30602!:mime text/troff 306030 search/1 '.\\" troff or preprocessor input text 30604!:mime text/troff 306050 search/1 \\" troff or preprocessor input text 30606!:mime text/troff 30607#0 search/1 ''' troff or preprocessor input text 30608#!:mime text/troff 306090 regex/20l \^\\.[A-Za-z][A-Za-z0-9][\ \t] troff or preprocessor input text 30610!:mime text/troff 306110 regex/20l \^\\.[A-Za-z][A-Za-z0-9]$ troff or preprocessor input text 30612!:mime text/troff 30613 30614# ditroff intermediate output text 306150 search/1 x\ T ditroff output text 30616>4 search/1 cat for the C/A/T phototypesetter 30617>4 search/1 ps for PostScript 30618>4 search/1 dvi for DVI 30619>4 search/1 ascii for ASCII 30620>4 search/1 lj4 for LaserJet 4 30621>4 search/1 latin1 for ISO 8859-1 (Latin 1) 30622>4 search/1 X75 for xditview at 75dpi 30623>>7 search/1 -12 (12pt) 30624>4 search/1 X100 for xditview at 100dpi 30625>>8 search/1 -12 (12pt) 30626 30627# output data formats 306280 string \100\357 very old (C/A/T) troff output data 30629 30630#------------------------------------------------------------------------------ 30631# $File: tuxedo,v 1.4 2009/09/19 16:28:13 christos Exp $ 30632# tuxedo: file(1) magic for BEA TUXEDO data files 30633# 30634# from Ian Springer <ispringer@hotmail.com> 30635# 306360 string \0\0\1\236\0\0\0\0\0\0\0\0\0\0\0\0 BEA TUXEDO DES mask data 30637 30638#------------------------------------------------------------------------------ 30639# $File: typeset,v 1.8 2009/09/19 16:28:13 christos Exp $ 30640# typeset: file(1) magic for other typesetting 30641# 306420 string Interpress/Xerox Xerox InterPress data 30643>16 string / (version 30644>>17 string >\0 %s) 30645 30646#------------------------------------------------------------------------------ 30647# $File: unicode,v 1.7 2019/02/19 20:34:42 christos Exp $ 30648# Unicode: BOM prefixed text files - Adrian Havill <havill@turbolinux.co.jp> 30649# These types are recognised in file_ascmagic so these encodings can be 30650# treated by text patterns. Missing types are already dealt with internally. 30651# 306520 string +/v8 Unicode text, UTF-7 306530 string +/v9 Unicode text, UTF-7 306540 string +/v+ Unicode text, UTF-7 306550 string +/v/ Unicode text, UTF-7 306560 string \335\163\146\163 Unicode text, UTF-8-EBCDIC 306570 string \000\000\376\377 Unicode text, UTF-32, big-endian 306580 string \377\376\000\000 Unicode text, UTF-32, little-endian 306590 string \016\376\377 Unicode text, SCSU (Standard Compression Scheme for Unicode) 30660 30661#------------------------------------------------------------------------------ 30662# $File: unisig,v 1.1 2020/04/09 19:05:44 christos Exp $ 30663# unisig: file(1) magic for files carrying a uniform signature (Unisig) 30664# From: Lassi Kortela, John Cowan 30665# URL: https://github.com/unisig 30666# 306670 string \xDC\xDC\x0D\x0A\x1A\x0A\x00 Unisig: 30668>7 ubyte =0 UUID 30669>>8 guid x %s 30670>7 ubyte >0 URI 30671>>7 pstring x %s 30672 30673#------------------------------------------------------------------------------ 30674# $File: unknown,v 1.8 2013/01/09 22:37:24 christos Exp $ 30675# unknown: file(1) magic for unknown machines 30676# 30677# 0x107 is 0407, 0x108 is 0410, and 0x109 is 0411; those are all PDP-11 30678# (executable, pure, and split I&D, respectively), but the PDP-11 version 30679# doesn't have the "version %ld", which may be a bogus COFFism (I don't 30680# think there was ever COFF for the PDP-11). 30681# 30682# 0x10B is 0413; that's VAX demand-paged, but this is a short, not a 30683# long, as it would be on a VAX. In any case, that could collide with 30684# VAX demand-paged files, as the magic number is little-endian on those 30685# binaries, so the first 16 bits of the file would contain 0x10B. 30686# 30687# Therefore, those entries are commented out. 30688# 30689# 0x10C is 0414 and 0x10E is 0416; those *are* unknown. 30690# 30691#0 short 0x107 unknown machine executable 30692#>8 short >0 not stripped 30693#>15 byte >0 - version %ld 30694#0 short 0x108 unknown pure executable 30695#>8 short >0 not stripped 30696#>15 byte >0 - version %ld 30697#0 short 0x109 PDP-11 separate I&D 30698#>8 short >0 not stripped 30699#>15 byte >0 - version %ld 30700#0 short 0x10b unknown pure executable 30701#>8 short >0 not stripped 30702#>15 byte >0 - version %ld 307030 long 0x10c unknown demand paged pure executable 30704>16 long >0 not stripped 307050 long 0x10e unknown readable demand paged pure executable 30706 30707#------------------------------------------------------------------------------ 30708# $File: usd,v 1.2 2020/05/21 22:17:00 christos Exp $ 30709# 30710# From Christian Schmidbauer 30711# 30712# https://github.com/PixarAnimationStudios/USD 30713 30714# USD crate file 30715# https://github.com/PixarAnimationStudios/USD/blob/ebac0a8b6703f4fa1c27115f1f013bb9819662f4/pxr/usd/usd/crateFile.h#L441-L450 307160 string PXR-USDC USD crate 30717>8 byte x \b, version %x. 30718>9 byte x \b%x. 30719>10 byte x \b%x 30720!:ext usd 30721 30722# USD ASCII file 307230 string #usda\040 USD ASCII 30724>6 string x \b, version %s 30725!:mime text/plain 30726!:ext usd 30727 30728#------------------------------------------------------------------------------ 30729# $File: uterus,v 1.3 2014/04/30 21:41:02 christos Exp $ 30730# file(1) magic for uterus files 30731# http://freecode.com/projects/uterus 30732# 307330 string UTE+ uterus file 30734>4 string v \b, version 30735>5 byte x %c 30736>6 string . \b. 30737>7 byte x \b%c 30738>8 string \<\> \b, big-endian 30739>>16 belong >0 \b, slut size %u 30740>8 string \>\< \b, litte-endian 30741>>16 lelong >0 \b, slut size %u 30742>10 byte &8 \b, compressed 30743 30744#------------------------------------------------------------------------------ 30745# $File: uuencode,v 1.8 2019/12/14 20:40:26 christos Exp $ 30746# uuencode: file(1) magic for ASCII-encoded files 30747# 30748 30749# GRR: the first line of xxencoded files is identical to that in uuencoded 30750# files, but the first character in most subsequent lines is 'h' instead of 30751# 'M'. (xxencoding uses lowercase letters in place of most of uuencode's 30752# punctuation and survives BITNET gateways better.) If regular expressions 30753# were supported, this entry could possibly be split into two with 30754# "begin\040\.\*\012M" or "begin\040\.\*\012h" (where \. and \* are REs). 307550 search/1 begin\ uuencoded or xxencoded text 30756 30757# btoa(1) is an alternative to uuencode that requires less space. 307580 search/1 xbtoa\ Begin btoa'd text 30759 30760# ship(1) is another, much cooler alternative to uuencode. 30761# Greg Roelofs, newt@uchicago.edu 307620 search/1 $\012ship ship'd binary text 30763 30764# bencode(8) is used to encode compressed news batches (Bnews/Cnews only?) 30765# Greg Roelofs, newt@uchicago.edu 307660 search/1 Decode\ the\ following\ with\ bdeco bencoded News text 30767 30768# GRR: handle BASE64 30769 30770#------------------------------------------------------------------------------ 30771# $File: vacuum-cleaner,v 1.1 2015/11/14 13:38:35 christos Exp $ 30772# vacuum cleaner magic by Thomas M. Ott (ThMO) 30773# 30774# navigation map for LG robot vacuum cleaner models VR62xx, VR64xx, VR63xx 30775# file: MAPDATAyyyymmddhhmmss_xxxxxx_cc.blk 30776# -> yyyymmdd: year, month, day of cleaning 30777# -> hhmmss: hour, minute, second of cleaning 30778# -> xxxxxx: 6 digits 30779# -> cc: cleaning runs counter 30780# size: 136044 bytes 30781# 30782# struct maphdr { 30783# int32_t map_cnt; /* 0: single map */ 30784# int32_t min_ceil; /* 4: 100 mm == 10 cm == min. ceil */ 30785# int32_t max_ceil; /* 8: 10000 mm == 100 m == max. ceil */ 30786# int32_t max_climb; /* 12: 50 mm = 5 cm == max. height to climb */ 30787# int32_t unknown; /* 16: 50000 ??? */ 30788# int32_t cell_bytes; /* 20: # of bytes for cells per block */ 30789# int32_t block_max; /* 24: 1000 == max. # of blocks */ 30790# int32_t route_max; /* 28: 1000 == max. # of routes */ 30791# int32_t used_blocks; /* 32: 5/45/33/... == # of block entries used! */ 30792# int32_t cell_dim; /* 36: 10 == cell dimension */ 30793# int32_t clock_tick; /* 40: 100 == clock ticks */ 30794# #if 0 30795# struct { /* 44: 1000 blocks for 10x10 cells */ 30796# int32_t yoffset; 30797# int32_t xoffset; 30798# int32_t posxy; 30799# int32_t timecode; 30800# } blocks[ 1000]; 30801# char cells[ 1000* 100]; /* 16044: 1000 10x10 cells */ 30802# int16_t routes[ 1000* 10]; /* 116044: 1000 10-routes */ 30803# #endif 30804# }; 30805 308060 lelong =1 30807>4 lelong =100 30808>>8 lelong =10000 30809>>>12 lelong =50 30810>>>>16 lelong =50000 30811>>>>>20 lelong =100 30812>>>>>>24 lelong =1000 30813>>>>>>>28 lelong =1000 30814>>>>>>>>36 lelong =10 30815>>>>>>>>>40 lelong =100 30816>>>>>>>>>>32 lelong x LG robot VR6[234]xx %dm^2 navigation 30817>>>>>>>>>>136040 lelong =-1 reuse map data 30818>>>>>>>>>>136040 lelong =0 map data 30819>>>>>>>>>>136040 lelong >0 spurious map data 30820>>>>>>>>>>136040 lelong <-1 spurious map data 30821 30822 30823 30824#------------------------------------------------------------------------------ 30825# $File: varied.out,v 1.23 2014/04/30 21:41:02 christos Exp $ 30826# varied.out: file(1) magic for various USG systems 30827# 30828# Herewith many of the object file formats used by USG systems. 30829# Most have been moved to files for a particular processor, 30830# and deleted if they duplicate other entries. 30831# 308320 short 0610 Perkin-Elmer executable 30833# AMD 29K 308340 beshort 0572 amd 29k coff noprebar executable 308350 beshort 01572 amd 29k coff prebar executable 308360 beshort 0160007 amd 29k coff archive 30837# Cray 308386 beshort 0407 unicos (cray) executable 30839# Ultrix 4.3 30840596 string \130\337\377\377 Ultrix core file 30841>600 string >\0 from '%s' 30842# BeOS and MAcOS PEF executables 30843# From: hplus@zilker.net (Jon Watte) 308440 string Joy!peffpwpc header for PowerPC PEF executable 30845# 30846# ava assembler/linker Uros Platise <uros.platise@ijs.si> 308470 string avaobj AVR assembler object code 30848>7 string >\0 version '%s' 30849# gnu gmon magic From: Eugen Dedu <dedu@ese-metz.fr> 308500 string gmon GNU prof performance data 30851>4 long x - version %d 30852# From: Dave Pearson <davep@davep.org> 30853# Harbour <URL:http://harbour-project.org/> HRB files. 308540 string \xc0HRB Harbour HRB file 30855>4 leshort x version %d 30856# Harbour HBV files 308570 string \xc0HBV Harbour variable dump file 30858>4 leshort x version %d 30859 30860# From: Alex Beregszaszi <alex@fsn.hu> 30861# 0 string exec BugOS executable 30862# 0 string pack BugOS archive 30863 30864# From: Jason Spence <jspence@lightconsulting.com> 30865# Generated by the "examples" in STM's ST40 devkit, and derived code. 308660 lelong 0x13a9f17e ST40 component image format 30867>4 string >\0 \b, name '%s' 30868 30869#------------------------------------------------------------------------------ 30870# $File: varied.script,v 1.13 2019/10/11 14:35:29 christos Exp $ 30871# varied.script: file(1) magic for various interpreter scripts 30872 308730 string/t #!\ / a 30874>3 string >\0 %s script text executable 30875!:strength / 2 30876 308770 string/b #!\ / a 30878>3 string >\0 %s script executable (binary data) 30879!:strength / 2 30880 308810 string/t #!\t/ a 30882>3 string >\0 %s script text executable 30883!:strength / 2 30884 308850 string/b #!\t/ a 30886>3 string >\0 %s script executable (binary data) 30887!:strength / 2 30888 308890 string/t #!/ a 30890>2 string >\0 %s script text executable 30891!:strength / 2 30892 308930 string/b #!/ a 30894>2 string >\0 %s script executable (binary data) 30895!:strength / 2 30896 308970 string/t #!\ script text executable 30898>3 string >\0 for %s 30899!:strength / 2 30900 309010 string/b #!\ script executable 30902>3 string >\0 for %s (binary data) 30903!:strength / 2 30904 30905# using env 309060 string/t #!/usr/bin/env a 30907>15 string/t >\0 %s script text executable 30908!:strength / 10 30909 309100 string/b #!/usr/bin/env a 30911>15 string/b >\0 %s script executable (binary data) 30912!:strength / 10 30913 309140 string/t #!\ /usr/bin/env a 30915>16 string/t >\0 %s script text executable 30916!:strength / 10 30917 309180 string/b #!\ /usr/bin/env a 30919>16 string/b >\0 %s script executable (binary data) 30920!:strength / 10 30921 30922# From: arno <arenevier@fdn.fr> 30923# mozilla xpconnect typelib 30924# see https://www.mozilla.org/scriptable/typelib_file.html 309250 string XPCOM\nTypeLib\r\n\032 XPConnect Typelib 30926>0x10 byte x version %d 30927>>0x11 byte x \b.%d 30928 30929#------------------------------------------------------------------------------ 30930# $File: vax,v 1.10 2019/10/04 18:07:46 christos Exp $ 30931# vax: file(1) magic for VAX executable/object and APL workspace 30932# 309330 lelong 0101557 VAX single precision APL workspace 309340 lelong 0101556 VAX double precision APL workspace 30935 30936# 30937# VAX a.out (BSD; others collide with 386 and other 32-bit little-endian 30938# executables, and are handled in aout) 30939# 309400 lelong 0420 a.out VAX demand paged (first page unmapped) pure executable 30941>16 lelong >0 not stripped 30942 30943# 30944# VAX COFF 30945# 30946# The `versions' were commented out, but have been un-commented out. 30947# (Was the problem just one of endianness?) 30948# 309490 leshort 0570 30950>2 uleshort <100 VAX COFF executable, sections %d 30951>>4 ledate x \b, created %s 30952>>12 lelong >0 \b, not stripped 30953>>22 leshort >0 \b, version %d 30954 309550 leshort 0575 30956>2 uleshort <100 VAX COFF pure executable, sections %d 30957>>4 ledate x \b, created %s 30958>>12 lelong >0 \b, not stripped 30959>>22 leshort >0 \b, version %d 30960 30961#------------------------------------------------------------------------------ 30962# $File: vicar,v 1.4 2009/09/19 16:28:13 christos Exp $ 30963# vicar: file(1) magic for VICAR files. 30964# 30965# From: Ossama Othman <othman@astrosun.tn.cornell.edu 30966# VICAR is JPL's in-house spacecraft image processing program 30967# VICAR image 309680 string LBLSIZE= VICAR image data 30969>32 string BYTE \b, 8 bits = VAX byte 30970>32 string HALF \b, 16 bits = VAX word = Fortran INTEGER*2 30971>32 string FULL \b, 32 bits = VAX longword = Fortran INTEGER*4 30972>32 string REAL \b, 32 bits = VAX longword = Fortran REAL*4 30973>32 string DOUB \b, 64 bits = VAX quadword = Fortran REAL*8 30974>32 string COMPLEX \b, 64 bits = VAX quadword = Fortran COMPLEX*8 30975# VICAR label file 3097643 string SFDU_LABEL VICAR label file 30977 30978#------------------------------------------------------------------------------ 30979# $File: virtual,v 1.12 2020/02/15 01:20:15 christos Exp $ 30980# From: James Nobis <quel@quelrod.net> 30981# Microsoft hard disk images for: 30982# Virtual Server 30983# Virtual PC 30984# VirtualBox 30985# URL: http://fileformats.archiveteam.org/wiki/VHD_(Virtual_Hard_Disk) 30986# Reference: https://download.microsoft.com/download/f/f/e/ffef50a5-07dd-4cf8-aaa3-442c0673a029/ 30987# Virtual%20Hard%20Disk%20Format%20Spec_10_18_06.doc 309880 string conectix Microsoft Disk Image, Virtual Server or Virtual PC 30989# alternative shorter names 30990#0 string conectix Microsoft Virtual Hard Disk image 30991#0 string conectix Microsoft Virtual HD image 30992!:mime application/x-virtualbox-vhd 30993!:ext vhd 30994# Features is a bit field used to indicate specific feature support 30995#>8 ubelong !0x00000002 \b, Features 0x%x 30996# Reserved. This bit must always be set to 1. 30997#>8 ubelong &0x00000002 \b, Reserved 0x%x 30998# File Format Version for the current specification 0x00010000 30999#>12 ubelong !0x00010000 \b, Version 0x%8.8x 31000# Data Offset only found 0x200 31001#>16 ubequad !0x200 \b, Data Offset 0x%llx 31002#>16 ubequad x \b, at 0x%llx 31003# Dynamic Disk Header cookie like cxsparse 31004#>(16.Q) string x "%-.8s" 31005# This field contains a Unicode string (UTF-16) of the parent hard disk filename 31006#>(16.Q+64) ubequad x \b, parent name 0x%llx 31007# Creator Application 31008# vpc~Microsoft Virtual PC, vs~Microsoft Virtual Server, vbox~VirtualBox, d2v~disk2vhd 31009>28 string x \b, Creator %-4.4s 31010# Creator Version: 0x00010000~Virtual Server 2004, 0x00050000~Virtual PC 2004 31011# holds the major/minor version of the application that created the image 31012>32 ubeshort x %x 31013>34 ubeshort x \b.%x 31014#>32 ubelong x \b, Version 0x%8.8x 31015# Creator Host OS: 0x5769326B~Windows (Wi2k), 0x4D616320~Macintosh (Mac) 31016>36 ubelong x ( 31017>>36 ubelong 0x5769326B \bW2k 31018>>36 ubelong 0x4D616320 \bMac 31019>>36 default x \b0x 31020>>>36 ubelong x \b%8.8x 31021# creation Time in seconds since 1 Jan 2000 UTC~946684800 sec. since Unix Epoch 31022>24 bedate+946684800 x \b) %s 31023# Original Size 31024#>40 ubequad x \b, o.-Size 0x%llx 31025# Current Size is same as original size, but change when disk is expanded 31026#>48 ubequad x \b, Size 0x%llx 31027>48 ubequad x \b, %llu bytes 31028# Disk Geometry: cylinder, heads, and sectors/track for hard disk 31029#>56 ubeshort x \b, Cylinder 0x%x 31030>56 ubeshort x \b, CHS %u 31031# Heads 31032#>58 ubyte x \b, Heads 0x%x 31033>58 ubyte x \b/%u 31034# Sectors per track 31035#>59 ubyte x \b, Sectors 0x%x 31036>59 ubyte x \b/%u 31037# Disk Type: 3~Dynamic hard disk 31038>60 ubelong !0x3 \b, type 0x%x 31039# Checksum 31040#>64 ubelong x \b, cksum 0x%x 31041# universally unique identifier (UUID) to associate a parent with its differencing image 31042#>68 ubequad x \b, id 0x%16.16llx 31043#>76 ubequad x \b-%16.16llx 31044# Saved State: 1~Saved State 31045>84 ubyte !0 \b, State 0x%x 31046# Reserved 427 bytes with nils 31047#>85 ubequad !0 \b, Reserved 0x%16.16llx 31048 31049# From: Joerg Jenderek 31050# URL: https://msdn.microsoft.com/en-us/library/mt740058.aspx 31051# Reference: https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/ 31052# MS-VHDX/[MS-VHDX].pdf 31053# Note: extends the VHD format with new capabilities, such as a 16TB maximum size 31054# TODO: find and display values like virtual size, disk size, cluster_size, etc 31055# display id in GUID format 31056# 31057# VHDX_FILE_IDENTIFIER signature 0x656C696678646876 310580 string vhdxfile 31059# VHDX_HEADER signature. 1 header is stored at offset 64KB and the other at 128KB 31060>0x10000 string head Microsoft Disk Image eXtended 31061#>0x20000 string head \b, 2nd header 31062#!:mime application/x-virtualbox-vhdx 31063!:ext vhdx 31064# Creator[256] like "QEMU v3.0.0", "Microsoft Windows 6.3.9600.18512" 31065>>8 lestring16 x \b, by %.256s 31066# The Checksum field is a CRC-32C hash over the entire 4 KB structure 31067#>>0x10004 ulelong x \b, CRC 0x%x 31068# SequenceNumber 31069>>0x10008 ulequad x \b, sequence 0x%llx 31070# FileWriteGuid 31071#>>0x10010 ubequad x \b, file id 0x%llx 31072#>>>0x10018 ubequad x \b-%llx 31073# DataWriteGuid 31074#>>0x10020 ubequad x \b, data id 0x%llx 31075#>>>0x10028 ubequad x \b-%llx 31076# LogGuid. If this field is zero, then the log is empty or has no valid entries 31077>>0x10030 ubequad >0 \b, log id 0x%llx 31078>>>0x10038 ubequad x \b-%llx 31079# LogVersion. If not 0 there is a log to replay 31080>>0x10040 uleshort >0 \b, LogVersion 0x%x 31081# Version. This field must be set to 1 31082>>0x10042 uleshort !1 \b, Version 0x%x 31083# LogLength must be multiples of 1 MB 31084>>0x10044 ulelong/1048576 >1 \b, LogLength %u MB 31085# LogOffset (normally 0x100000 when log direct after header); multiples of 1 MB 31086>>0x10048 ulequad !0x100000 \b, LogOffset 0x%llx 31087# Log Entry Signature must be 0x65676F6C~loge 31088>>(0x10048.q) ulelong !0x65676F6C \b, NO Log Signature 31089>>(0x10048.q) ulelong =0x65676F6C \b; LOG 31090# Log Entry Checksum 31091#>>>(0x10048.q+4) ulelong x \b, Log CRC 0x%x 31092# Log Entry Length must be a multiple of 4 KB 31093>>>(0x10048.q+8) ulelong/1024 >4 \b, EntryLength %u KB 31094# Log Entry Tail must be a multiple of 4 KB 31095#>>>(0x10048.q+12) ulelong x \b, Tail 0x%x 31096# Log Entry SequenceNumber 31097#>>>(0x10048.q+16) ulequad x \b, # 0x%llx 31098# Log Entry DescriptorCount may be zero. only 4 bytes in other docs instead 8 31099#>>>(0x10048.q+24) ulelong x \b, DescriptorCount 0x%llx 31100# Log Entry Reserved must be set to 0 31101>>>(0x10048.q+28) ulelong !0 \b, Reserved 0x%x 31102# Log Entry LogGuid 31103#>>>(0x10048.q+32) ubequad x \b, Log id 0x%llx 31104#>>>(0x10048.q+40) ubequad x \b-%llx 31105# Log Entry FlushedFileOffset should VHDX size when entry is written. 31106#>>>(0x10048.q+48) ulequad x \b, FlushedFileOffset %llu 31107# Log Entry LastFileOffset 31108#>>>(0x10048.q+56) ulequad x \b, LastFileOffset %llu 31109# filling 31110#>>>(0x10048.q+64) ulequad >0 \b, filling %llx 31111# Reserved[4016] 31112#>>0x10050 ulequad >0 \b, Reserved 0x%llx 31113# VHDX_REGION_TABLE_HEADER Signature 0x69676572~regi at offset 192 KB and 256 KB 31114>0x30000 ulelong !0x69676572 \b, 1st region INVALID 31115>0x30000 ulelong =0x69676572 \b; region 31116# region Checksum. CRC-32C hash over the entire 64-KB table 31117#>>0x30004 ulelong x \b, CRC 0x%x 31118# The EntryCount specifies number of valid entries; Found 2; This must be =< 2047. 31119>>0x30008 ulelong x \b, %u entries 31120# reserved must be zero 31121#>>0x3000C ulelong !0 \b, RESERVED 0x%x 31122# Region Table Entry starts with identifier for the object. often BAT id 31123>>0x30010 use vhdx-id 31124# FileOffset 31125>>0x30020 ulequad x \b, at 0x%llx 31126# Length. Specifies the length of the object within the file 31127#>>0x30028 ulelong x \b, Length 0x%x 31128# 1 means region entry is required. if region not recognized, then REFUSE to load VHDX 31129>>0x3002C ulelong x \b, Required %u 31130# 2nd region entry often metadata id 31131>>0x30030 use vhdx-id 31132# 2nd entry FileOffset 31133>>0x30040 ulequad x \b, at 0x%llx 31134# 1 means region entry is required. if region not recognized, then REFUSE to load VHDX 31135>>0x3004C ulelong x \b, Required %u 31136# 2nd region 31137>>0x40000 ulelong !0x69676572 \b, 2nd region INVALID 31138# check in vhdx images for known id and show names instead hexadecimal 311390 name vhdx-id 31140# https://www.windowstricks.in/online-windows-guid-converter 31141# 2DC27766-F623-4200-9D64-115E9BFD4A08 BAT GUID 31142# 6677C22D23F600429D64115E9BFD4A08 BAT ID 31143>0 ubequad =0x6677C22D23F60042 31144>>8 ubequad =0x9D64115E9BFD4A08 \b, id BAT 31145# no BAT id 31146>>8 default x 31147>>>0 use vhdx-id-hex 31148# 8B7CA206-4790-4B9A-B8FE-575F050F886E Metadata region GUID 31149# 06A27C8B90479A4BB8FE575F050F886E Metadata region ID 31150>0 ubequad =0x06A27C8B90479A4B 31151>>8 ubequad =0xB8FE575F050F886E \b, id Metadata 31152# no Metadata id 31153>>8 default x 31154>>>0 use vhdx-id-hex 31155# 2FA54224-CD1B-4876-B211-5DBED83BF4B8 Virtual Disk Size GUID 31156# 2442A52F1BCD7648B2115DBED83BF4B8 Virtual Disk Size ID 31157# value "virtual size" can be verified by command `qemu-img info ` 31158>0 ubequad =0x2442A52F1BCD7648 31159>>8 ubequad =0xB2115DBED83BF4B8 \b, id vsize 31160# no Virtual Disk Size ID 31161>>8 default x 31162>>>0 use vhdx-id-hex 31163# other ids 31164>0 default x 31165>>0 use vhdx-id-hex 31166# in vhdx images show id as hexadecimal 311670 name vhdx-id-hex 31168>0 ubequad x \b, ID 0x%16.16llx 31169>8 ubequad x \b-%16.16llx 31170# 31171# libvirt 31172# From: Philipp Hahn <hahn@univention.de> 311730 string LibvirtQemudSave Libvirt QEMU Suspend Image 31174>0x10 lelong x \b, version %u 31175>0x14 lelong x \b, XML length %u 31176>0x18 lelong 1 \b, running 31177>0x1c lelong 1 \b, compressed 31178 311790 string LibvirtQemudPart Libvirt QEMU partial Suspend Image 31180# From: Alex Beregszaszi <alex@fsn.hu> 311810 string/b COWD VMWare3 31182>4 byte 3 disk image 31183>>32 lelong x (%d/ 31184>>36 lelong x \b%d/ 31185>>40 lelong x \b%d) 31186>4 byte 2 undoable disk image 31187>>32 string >\0 (%s) 31188 311890 string/b VMDK VMware4 disk image 311900 string/b KDMV VMware4 disk image 31191 31192#-------------------------------------------------------------------- 31193# Qemu Emulator Images 31194# Lines written by Friedrich Schwittay (f.schwittay@yousable.de) 31195# Updated by Adam Buchbinder (adam.buchbinder@gmail.com) 31196# Made by reading sources, reading documentation, and doing trial and error 31197# on existing QCOW files 311980 string/b QFI\xFB 31199 31200# Uncomment the following line to display Magic (only used for debugging 31201# this magic number) 31202#>0 string/b x , Magic: %s 31203 31204# There are currently 2 Versions: "1" and "2". 31205# https://www.gnome.org/~markmc/qcow-image-format-version-1.html 31206>4 belong !1 QEMU QCOW2 Image 31207>4 belong 1 QEMU QCOW Image (v1) 31208 31209# Using the existence of the Backing File Offset to determine whether 31210# to read Backing File Information 31211>>12 belong >0 \b, has backing file ( 31212# Note that this isn't a null-terminated string; the length is actually 31213# (16.L). Assuming a null-terminated string happens to work usually, but it 31214# may spew junk until it reaches a \0 in some cases. 31215>>>(12.L) string >\0 \bpath %s 31216 31217# Modification time of the Backing File 31218# Really useful if you want to know if your backing 31219# file is still usable together with this image 31220>>>>20 bedate >0 \b, mtime %s) 31221>>>>20 default x \b) 31222 31223# Size is stored in bytes in a big-endian u64. 31224>>24 bequad x \b, %lld bytes 31225 31226# 1 for AES encryption, 0 for none. 31227>>36 belong 1 \b, AES-encrypted 31228 31229# https://www.gnome.org/~markmc/qcow-image-format.html 31230>4 belong 2 (v2) 31231# Using the existence of the Backing File Offset to determine whether 31232# to read Backing File Information 31233>>8 bequad >0 \b, has backing file 31234# Note that this isn't a null-terminated string; the length is actually 31235# (16.L). Assuming a null-terminated string happens to work usually, but it 31236# may spew junk until it reaches a \0 in some cases. Also, since there's no 31237# .Q modifier, we just use the bottom four bytes as an offset. Note that if 31238# the file is over 4G, and the backing file path is stored after the first 4G, 31239# the wrong filename will be printed. (This should be (8.Q), when that syntax 31240# is introduced.) 31241>>>(12.L) string >\0 (path %s) 31242>>24 bequad x \b, %lld bytes 31243>>32 belong 1 \b, AES-encrypted 31244 31245>4 belong 3 (v3) 31246# Using the existence of the Backing File Offset to determine whether 31247# to read Backing File Information 31248>>8 bequad >0 \b, has backing file 31249# Note that this isn't a null-terminated string; the length is actually 31250# (16.L). Assuming a null-terminated string happens to work usually, but it 31251# may spew junk until it reaches a \0 in some cases. Also, since there's no 31252# .Q modifier, we just use the bottom four bytes as an offset. Note that if 31253# the file is over 4G, and the backing file path is stored after the first 4G, 31254# the wrong filename will be printed. (This should be (8.Q), when that syntax 31255# is introduced.) 31256>>>(12.L) string >\0 (path %s) 31257>>24 bequad x \b, %lld bytes 31258>>32 belong 1 \b, AES-encrypted 31259 31260>4 default x (unknown version) 31261 312620 string/b QEVM QEMU suspend to disk image 31263 31264# QEMU QED Image 31265# https://wiki.qemu.org/Features/QED/Specification 312660 string/b QED\0 QEMU QED Image 31267 31268# VDI Image 31269# Sun xVM VirtualBox Disk Image 31270# From: Richard W.M. Jones <rich@annexia.org> 31271# VirtualBox Disk Image 312720x40 ulelong 0xbeda107f VirtualBox Disk Image 31273>0x44 uleshort >0 \b, major %u 31274>0x46 uleshort >0 \b, minor %u 31275>0 string >\0 (%s) 31276>368 lequad x \b, %lld bytes 31277 312780 string/b Bochs\ Virtual\ HD\ Image Bochs disk image, 31279>32 string x type %s, 31280>48 string x subtype %s 31281 312820 lelong 0x02468ace Bochs Sparse disk image 31283 31284 31285#------------------------------------------------------------------------------ 31286# $File: virtutech,v 1.4 2009/09/19 16:28:13 christos Exp $ 31287# Virtutech Compressed Random Access File Format 31288# 31289# From <gustav@virtutech.com> 312900 string \211\277\036\203 Virtutech CRAFF 31291>4 belong x v%d 31292>20 belong 0 uncompressed 31293>20 belong 1 bzipp2ed 31294>20 belong 2 gzipped 31295>24 belong 0 not clean 31296 31297#------------------------------------------------------------------------------ 31298# $File: visx,v 1.5 2009/09/19 16:28:13 christos Exp $ 31299# visx: file(1) magic for Visx format files 31300# 313010 short 0x5555 VISX image file 31302>2 byte 0 (zero) 31303>2 byte 1 (unsigned char) 31304>2 byte 2 (short integer) 31305>2 byte 3 (float 32) 31306>2 byte 4 (float 64) 31307>2 byte 5 (signed char) 31308>2 byte 6 (bit-plane) 31309>2 byte 7 (classes) 31310>2 byte 8 (statistics) 31311>2 byte 10 (ascii text) 31312>2 byte 15 (image segments) 31313>2 byte 100 (image set) 31314>2 byte 101 (unsigned char vector) 31315>2 byte 102 (short integer vector) 31316>2 byte 103 (float 32 vector) 31317>2 byte 104 (float 64 vector) 31318>2 byte 105 (signed char vector) 31319>2 byte 106 (bit plane vector) 31320>2 byte 121 (feature vector) 31321>2 byte 122 (feature vector library) 31322>2 byte 124 (chain code) 31323>2 byte 126 (bit vector) 31324>2 byte 130 (graph) 31325>2 byte 131 (adjacency graph) 31326>2 byte 132 (adjacency graph library) 31327>2 string .VISIX (ascii text) 31328 31329#------------------------------------------------------------------------------ 31330# $File: vms,v 1.10 2017/03/17 21:35:28 christos Exp $ 31331# vms: file(1) magic for VMS executables (experimental) 31332# 31333# VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu) 31334 31335# GRR 950122: I'm just guessing on these, based on inspection of the headers 31336# of three executables each for Alpha and VAX architectures. The VAX files 31337# all had headers similar to this: 31338# 31339# 00000 b0 00 30 00 44 00 60 00 00 00 00 00 30 32 30 35 ..0.D.`.....0205 31340# 00010 01 01 00 00 ff ff ff ff ff ff ff ff 00 00 00 00 ................ 31341# 313420 string \xb0\0\x30\0 VMS VAX executable 31343>44032 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption 31344# 31345# The AXP files all looked like this, except that the byte at offset 0x22 31346# was 06 in some of them and 07 in others: 31347# 31348# 00000 03 00 00 00 00 00 00 00 ec 02 00 00 10 01 00 00 ................ 31349# 00010 68 00 00 00 98 00 00 00 b8 00 00 00 00 00 00 00 h............... 31350# 00020 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 31351# 00030 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................ 31352# 00040 00 00 00 00 ff ff ff ff ff ff ff ff 02 00 00 00 ................ 31353# 31354# GRR this test is still too general as it catches example adressen.dbt 313550 belong 0x03000000 31356>8 ubelong 0xec020000 VMS Alpha executable 31357>>75264 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption 31358 31359#------------------------------------------------------------------------------ 31360# $File: vmware,v 1.8 2017/03/17 21:35:28 christos Exp $ 31361# VMware specific files (deducted from version 1.1 and log file entries) 31362# Anthon van der Neut (anthon@mnt.org) 313630 belong 0x4d52564e VMware nvram 31364 31365#------------------------------------------------------------------------------ 31366# $File: vorbis,v 1.24 2018/03/14 04:38:44 christos Exp $ 31367# vorbis: file(1) magic for Ogg/Vorbis files 31368# 31369# From Felix von Leitner <leitner@fefe.de> 31370# Extended by Beni Cherniavsky <cben@crosswinds.net> 31371# Further extended by Greg Wooledge <greg@wooledge.org> 31372# 31373# Most (everything but the number of channels and bitrate) is commented 31374# out with `##' as it's not interesting to the average user. The most 31375# probable things advanced users would want to uncomment are probably 31376# the number of comments and the encoder version. 31377# 31378# FIXME: The first match has been made a search, so that it can skip 31379# over prepended ID3 tags. This will work for MIME type detection, but 31380# won't work for detecting other properties of the file (they all need 31381# to be made relative to the search). In any case, if the file has ID3 31382# tags, the ID3 information will be printed, not the Ogg information, 31383# so until that's fixed, this doesn't matter. 31384# FIXME[2]: Disable the above for now, since search assumes text mode. 31385# 31386# --- Ogg Framing --- 31387#0 search/1000 OggS Ogg data 313880 string OggS Ogg data 31389>4 byte !0 UNKNOWN REVISION %u 31390##>4 byte 0 revision 0 31391>4 byte 0 31392##>>14 lelong x (Serial %lX) 31393# non-Vorbis content: FLAC (Free Lossless Audio Codec, http://flac.sourceforge.net) 31394>>28 string \x7fFLAC \b, FLAC audio 31395# non-Vorbis content: Theora 31396!:mime audio/ogg 31397>>28 string \x80theora \b, Theora video 31398!:mime video/ogg 31399# non-Vorbis content: Kate 31400>>28 string \x80kate\0\0\0\0 \b, Kate (Karaoke and Text) 31401!:mime application/ogg 31402>>>37 ubyte x v%u 31403>>>38 ubyte x \b.%u, 31404>>>40 byte 0 utf8 encoding, 31405>>>40 byte !0 unknown character encoding, 31406>>>60 string >\0 language %s, 31407>>>60 string \0 no language set, 31408>>>76 string >\0 category %s 31409>>>76 string \0 no category set 31410# non-Vorbis content: Skeleton 31411>>28 string fishead\0 \b, Skeleton 31412!:mime video/ogg 31413>>>36 leshort x v%u 31414>>>40 leshort x \b.%u 31415# non-Vorbis content: Speex 31416>>28 string Speex\ \ \ \b, Speex audio 31417!:mime audio/ogg 31418# non-Vorbis content: OGM 31419>>28 string \x01video\0\0\0 \b, OGM video 31420!:mime video/ogg 31421>>>37 string/c div3 (DivX 3) 31422>>>37 string/c divx (DivX 4) 31423>>>37 string/c dx50 (DivX 5) 31424>>>37 string/c xvid (XviD) 31425# --- First vorbis packet - general header --- 31426>>28 string \x01vorbis \b, Vorbis audio, 31427!:mime audio/ogg 31428>>>35 lelong !0 UNKNOWN VERSION %u, 31429##>>>35 lelong 0 version 0, 31430>>>35 lelong 0 31431>>>>39 ubyte 1 mono, 31432>>>>39 ubyte 2 stereo, 31433>>>>39 ubyte >2 %u channels, 31434>>>>40 lelong x %u Hz 31435# Minimal, nominal and maximal bitrates specified when encoding 31436>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff \b, 31437# The above tests if at least one of these is specified: 31438>>>>>52 lelong !-1 31439# Vorbis RC2 has a bug which puts -1000 in the min/max bitrate fields 31440# instead of -1. 31441# Vorbis 1.0 uses 0 instead of -1. 31442>>>>>>52 lelong !0 31443>>>>>>>52 lelong !-1000 31444>>>>>>>>52 lelong x <%u 31445>>>>>48 lelong !-1 31446>>>>>>48 lelong x ~%u 31447>>>>>44 lelong !-1 31448>>>>>>44 lelong !-1000 31449>>>>>>>44 lelong !0 31450>>>>>>>>44 lelong x >%u 31451>>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff bps 31452# -- Second vorbis header packet - the comments 31453# A kludge to read the vendor string. It's a counted string, not a 31454# zero-terminated one, so file(1) can't read it in a generic way. 31455# libVorbis is the only one existing currently, so I detect specifically 31456# it. The interesting value is the cvs date (8 digits decimal). 31457# Post-RC1 Ogg files have the second header packet (and thus the version) 31458# in a different place, so we must use an indirect offset. 31459>>>(84.b+85) string \x03vorbis 31460>>>>(84.b+96) string/c Xiphophorus\ libVorbis\ I \b, created by: Xiphophorus libVorbis I 31461>>>>>(84.b+120) string >00000000 31462# Map to beta version numbers: 31463>>>>>>(84.b+120) string <20000508 (<beta1, prepublic) 31464>>>>>>(84.b+120) string 20000508 (1.0 beta 1 or beta 2) 31465>>>>>>(84.b+120) string >20000508 31466>>>>>>>(84.b+120) string <20001031 (beta2-3) 31467>>>>>>(84.b+120) string 20001031 (1.0 beta 3) 31468>>>>>>(84.b+120) string >20001031 31469>>>>>>>(84.b+120) string <20010225 (beta3-4) 31470>>>>>>(84.b+120) string 20010225 (1.0 beta 4) 31471>>>>>>(84.b+120) string >20010225 31472>>>>>>>(84.b+120) string <20010615 (beta4-RC1) 31473>>>>>>(84.b+120) string 20010615 (1.0 RC1) 31474>>>>>>(84.b+120) string 20010813 (1.0 RC2) 31475>>>>>>(84.b+120) string 20010816 (RC2 - Garf tuned v1) 31476>>>>>>(84.b+120) string 20011014 (RC2 - Garf tuned v2) 31477>>>>>>(84.b+120) string 20011217 (1.0 RC3) 31478>>>>>>(84.b+120) string 20011231 (1.0 RC3) 31479# Some pre-1.0 CVS snapshots still had "Xiphphorus"... 31480>>>>>>(84.b+120) string >20011231 (pre-1.0 CVS) 31481# For the 1.0 release, Xiphophorus is replaced by Xiph.Org 31482>>>>(84.b+96) string/c Xiph.Org\ libVorbis\ I \b, created by: Xiph.Org libVorbis I 31483>>>>>(84.b+117) string >00000000 31484>>>>>>(84.b+117) string <20020717 (pre-1.0 CVS) 31485>>>>>>(84.b+117) string 20020717 (1.0) 31486>>>>>>(84.b+117) string 20030909 (1.0.1) 31487>>>>>>(84.b+117) string 20040629 (1.1.0 RC1) 31488>>>>>>(84.b+117) string 20050304 (1.1.2) 31489>>>>>>(84.b+117) string 20070622 (1.2.0) 31490>>>>>>(84.b+117) string 20090624 (1.2.2) 31491>>>>>>(84.b+117) string 20090709 (1.2.3) 31492>>>>>>(84.b+117) string 20100325 (1.3.1) 31493>>>>>>(84.b+117) string 20101101 (1.3.2) 31494>>>>>>(84.b+117) string 20120203 (1.3.3) 31495>>>>>>(84.b+117) string 20140122 (1.3.4) 31496>>>>>>(84.b+117) string 20150105 (1.3.5) 31497 31498# non-Vorbis content: Opus https://tools.ietf.org/html/draft-ietf-codec-oggopus-06#section-5 31499>>28 string OpusHead \b, Opus audio, 31500!:mime audio/ogg 31501>>>36 ubyte >0x0F UNKNOWN VERSION %u, 31502>>>36 ubyte &0x0F version 0.%d 31503>>>>46 ubyte >1 31504>>>>>46 ubyte !255 unknown channel mapping family %u, 31505>>>>>37 ubyte x %u channels 31506>>>>46 ubyte 0 31507>>>>>37 ubyte 1 mono 31508>>>>>37 ubyte 2 stereo 31509>>>>46 ubyte 1 31510>>>>>37 ubyte 1 mono 31511>>>>>37 ubyte 2 stereo 31512>>>>>37 ubyte 3 linear surround 31513>>>>>37 ubyte 4 quadraphonic 31514>>>>>37 ubyte 5 5.0 surround 31515>>>>>37 ubyte 6 5.1 surround 31516>>>>>37 ubyte 7 6.1 surround 31517>>>>>37 ubyte 8 7.1 surround 31518>>>>40 lelong !0 \b, %u Hz 31519 31520#------------------------------------------------------------------------------ 31521# $File: vxl,v 1.4 2009/09/19 16:28:13 christos Exp $ 31522# VXL: file(1) magic for VXL binary IO data files 31523# 31524# from Ian Scott <scottim@sf.net> 31525# 31526# VXL is a collection of C++ libraries for Computer Vision. 31527# See the vsl chapter in the VXL Book for more info 31528# http://www.isbe.man.ac.uk/public_vxl_doc/books/vxl/book.html 31529# http:/vxl.sf.net 31530 315312 lelong 0x472b2c4e VXL data file, 31532>0 leshort >0 schema version no %d 31533 31534#------------------------------------------------------------------------------ 31535# $File: warc,v 1.4 2019/04/19 00:42:27 christos Exp $ 31536# warc: file(1) magic for WARC files 31537 315380 string WARC/ WARC Archive 31539>5 string x version %.4s 31540!:mime application/warc 31541 31542#------------------------------------------------------------------------------ 31543# Arc File Format from Internet Archive 31544# see https://www.archive.org/web/researcher/ArcFileFormat.php 315450 string filedesc:// Internet Archive File 31546!:mime application/x-ia-arc 31547>11 search/256 \x0A \b 31548>>&0 ubyte >0 \b version %c 31549 31550#------------------------------------------------------------------------------ 31551# weak: file(1) magic for very weak magic entries, disabled by default 31552# 31553# These entries are so weak that they might interfere identification of 31554# other formats. Example include: 31555# - Only identify for 1 or 2 bytes 31556# - Match against very wide range of values 31557# - Match against generic word in some spoken languages (e.g. English) 31558 31559# Summary: Computer Graphics Metafile 31560# Extension: .cgm 31561#0 beshort&0xffe0 0x0020 binary Computer Graphics Metafile 31562#0 beshort 0x3020 character Computer Graphics Metafile 31563 31564#0 string =!! Bennet Yee's "face" format 31565 31566#------------------------------------------------------------------------------ 31567# $File: web,v 1.1 2020/05/17 19:14:28 christos Exp $ 31568 31569# http://www.rdfhdt.org/ 31570# From Christoph Biedl 31571# http://www.rdfhdt.org/hdt-internals/ 31572# https://github.com/rdfhdt/hdt-cpp 31573 315740 string $HDT\x01 HDT file (binary compressed indexed RDF triples) type 1 31575!:mime application/vnd.hdt 31576!:ext hdt 31577#------------------------------------------------------------------------------ 31578# $File: webassembly,v 1.3 2019/04/19 00:42:27 christos Exp $ 31579# webassembly: file(1) magic for WebAssembly modules 31580# 31581# WebAssembly is a virtual architecture developed by a W3C Community 31582# Group at https://webassembly.org/. The file extension is .wasm, and 31583# the MIME type is application/wasm. 31584# 31585# https://webassembly.org/docs/binary-encoding/ is the main 31586# document describing the binary format. 31587# From: Pip Cet <pipcet@gmail.com> and Joel Martin 31588 315890 string \0asm WebAssembly (wasm) binary module 31590>4 lelong =1 version %#x (MVP) 31591>4 lelong >1 version %#x 31592 31593#------------------------------------------------------------------------------ 31594# $File: windows,v 1.31 2020/03/15 16:44:37 christos Exp $ 31595# windows: file(1) magic for Microsoft Windows 31596# 31597# This file is mainly reserved for files where programs 31598# using them are run almost always on MS Windows 3.x or 31599# above, or files only used exclusively in Windows OS, 31600# where there is no better category to allocate for. 31601# For example, even though WinZIP almost run on Windows 31602# only, it is better to treat them as "archive" instead. 31603# For format usable in DOS, such as generic executable 31604# format, please specify under "msdos" file. 31605# 31606 31607 31608# Summary: Outlook Express DBX file 31609# Extension: .dbx 31610# Created by: Christophe Monniez 316110 string \xCF\xAD\x12\xFE MS Outlook Express DBX file 31612>4 byte =0xC5 \b, message database 31613>4 byte =0xC6 \b, folder database 31614>4 byte =0xC7 \b, account information 31615>4 byte =0x30 \b, offline database 31616 31617 31618# Summary: Windows crash dump 31619# Extension: .dmp 31620# Created by: Andreas Schuster (https://computer.forensikblog.de/) 31621# Reference (1): https://computer.forensikblog.de/en/2008/02/64bit_magic.html 31622# Modified by (1): Abel Cheung (Avoid match with first 4 bytes only) 316230 string PAGE 31624>4 string DUMP MS Windows 32bit crash dump 31625>>0x05c byte 0 \b, no PAE 31626>>0x05c byte 1 \b, PAE 31627>>0xf88 lelong 1 \b, full dump 31628>>0xf88 lelong 2 \b, kernel dump 31629>>0xf88 lelong 3 \b, small dump 31630>>0x068 lelong x \b, %d pages 31631>4 string DU64 MS Windows 64bit crash dump 31632>>0xf98 lelong 1 \b, full dump 31633>>0xf98 lelong 2 \b, kernel dump 31634>>0xf98 lelong 3 \b, small dump 31635>>0x090 lequad x \b, %lld pages 31636 31637 31638# Summary: Vista Event Log 31639# Extension: .evtx 31640# Created by: Andreas Schuster (https://computer.forensikblog.de/) 31641# Reference (1): https://computer.forensikblog.de/en/2007/05/some_magic.html 316420 string ElfFile\0 MS Windows Vista Event Log 31643>0x2a leshort x \b, %d chunks 31644>>0x10 lelong x \b (no. %d in use) 31645>0x18 lelong >1 \b, next record no. %d 31646>0x18 lelong =1 \b, empty 31647>0x78 lelong &1 \b, DIRTY 31648>0x78 lelong &2 \b, FULL 31649 31650# Summary: Windows System Deployment Image 31651# Created by: Joerg Jenderek 31652# URL: http://en.wikipedia.org/wiki/System_Deployment_Image 31653# Reference: http://skolk.livejournal.com/1320.html 316540 string $SDI 31655>4 string 0001 System Deployment Image 31656!:mime application/x-ms-sdi 31657#!:mime application/octet-stream 31658# \Boot\boot.sdi 31659!:ext sdi 31660# MDBtype: 0~Unspecified 1~RAM 2~ROM 31661>>8 ulequad !0 \b, MDBtype 0x%llx 31662# BootCodeOffset 31663>>16 ulequad !0 \b, BootCodeOffset 0x%llx 31664# BootCodeSize 31665>>24 ulequad !0 \b, BootCodeSize 0x%llx 31666# VendorID 31667>>32 ulequad !0 \b, VendorID 0x%llx 31668# DeviceID 31669>>40 ulequad !0 \b, DeviceID 0x%llx 31670# DeviceModel 31671>>48 ulequad !0 \b, DeviceModel 0x%llx 31672>>>56 ulequad !0 \b%llx 31673# DeviceRole 31674>>64 ulequad !0 \b, DeviceRole 0x%llx 31675# Reserved1; reserved fields and gaps between BLOBs are padded with \0 31676#>>72 ulequad !0 \b, Reserved1 0x%llx 31677# RuntimeGUID 31678>>80 ulequad !0 \b, RuntimeGUID 0x%llx 31679>>>88 ulequad !0 \b%llx 31680# RuntimeOEMrev 31681>>96 ulequad !0 \b, RuntimeOEMrev 0x%llx 31682# Reserved2 31683#>>104 ulequad !0 \b, Reserved2 0x%llx 31684# BLOB alignment value in pages, as specified in sdimgr /pack: 1~4K 2~8k 31685>>112 ulequad !0 \b, PageAlignment %llu 31686# Reserved3[48] 31687#>>120 ulequad !0 \b, Reserved3 0x%llx 31688# SDI checksum 39h 31689>>0x1f8 ulequad x \b, checksum 0x%llx 31690# BLOBtype[8] \0-padded: PART, WIM , BOOT, LOAD, DISK 31691>>0x400 string >\0 \b, type %-3.8s 31692# 0~non-filesystem 7~NTFS 6~BIGFAT 31693>>>0x420 ulequad !0 (0x%llx) 31694# ATTRibutes 31695>>>0x408 ulequad !0 0x%llx attributes 31696# Offset 31697>>>0x410 ulequad x at 0x%llx 31698# print 1 space after size and then handles NTFS boot sector by ./filesystems 31699>>>0x418 ulequad >0 %llu bytes 31700>>>>(0x410.l) indirect x 31701# 2nd BLOB: WIM 31702>>0x440 string >\0 \b, type %-3.8s 31703>>>0x428 ulequad !0 (0x%llx) 31704# ATTRibutes 31705>>>0x448 ulequad !0 0x%llx attributes 31706# Offset 31707>>>0x450 ulequad x at 0x%llx 31708>>>0x458 ulequad >0 %llu bytes 31709>>>>(0x450.l) indirect x 31710# 3rd BLOB 31711>>0x480 string >\0 \b, type %-3.8s 31712 31713# Summary: Windows boot status log BOOTSTAT.DAT 31714# From: Joerg Jenderek 31715# Reference: https://www.geoffchappell.com/notes/windows/boot/bsd.htm 31716# Note: mainly refers to older Windows Vista, sometimes 31717# BOOTSTAT.DAT only contains nulls or invalid data 31718# checking for valid version below 5 317190 ulelong <5 31720# skip many ISO images by checking for valid 64 KiB file size 31721>8 ulelong =0x00010000 31722>>0 use bootstat-dat 31723# display information of BOOTSTAT.DAT 317240 name bootstat-dat 31725>0 ulelong x Windows boot log 31726#!:mime application/octet-stream 31727!:mime application/x-ms-dat 31728# BOOTSTAT.DAT in BOOT subdirectory 31729!:ext dat 31730# apparently a version number: 2 for older like Vista, 3, 4 Windows 10 31731>0 ulelong >2 \b, version %u 31732# apparently the size of the header: often 10h in older Windows, 14h, 18h 31733>4 ulelong !0x10 \b, header size 0x%x 31734#>4 ulelong !0x10 \b, header size %u 31735# apparently the size of the file: always 0x00010000~64KiB 31736# the file is acceptable to BOOTMGR only if it is exactly 64 KiB 31737>8 ulelong !0x00010000 \b, file size 0x%x 31738# size of valid data, in bytes: C8h 50h 172h 5D5Ch 31739>0xc ulelong x \b, 0x%x valid bytes 31740# skip header and jump to first bootstat entry and display information 31741>(0x4.l-1) ubyte x 31742>>&0 use bootstat-entry 31743# jump to first entry again because pointer are bad after "use" 31744>(0x4.l-1) ubyte x 31745# by 1st entry size jump to 2nd entry and display information 31746>>&(&0x18.l-1) ubyte x 31747>>>&0 use bootstat-entry 31748# jump to possible 3rd boot entry and display information 31749# >(0x4.l-1) ubyte x 31750# >>&(&0x18.l-1) ubyte x 31751# >>>&(&0x18.l-1) ubyte x 31752# >>>>&0 use bootstat-entry 31753# display BOOTSTAT.DAT entry 317540 name bootstat-entry 31755#>0x00 ubequad x \b, ENTRY %16.16llx 31756# size of entry, in bytes: 40h(init) 78h(launced) 9Ch 31757#>0x18 ulelong x \b; entry size %u 31758>0x18 ulelong x \b; entry size 0x%x 31759# time stamp, in seconds 31760>0x00 ulelong x \b, 0x%x seconds 31761# always zero, significance unknown 31762>0x04 ulelong !0 \b, not null %u 31763# GUID of event source; but empty if event source is BOOTMGR 31764>0x08 ubequad !0 \b, GUID 0x%16.16llx 31765>>0x10 ubequad x \b%16.16llx 31766# severity code: 1~informational 3~errors 31767>0x1C ulelong !1 \b, severity 0x%x 31768# apparently a version number: 2 31769>0x20 ulelong !2 \b, version %u 31770# event identifier 1~log file initialised 11h~boot application launched 31771#>0x24 ulelong x \b, event 0x%x 31772>0x24 ulelong !1 31773>>0x24 ulelong !0x11 \b, event 0x%x 31774# entry data; size depends on event identifier 31775#>0x28 ubequad x \b, data 0x%16.16llx 31776>0x24 ulelong =0x1 \b, Init 31777# always 0, significance unknown 31778>>0x34 uleshort !0 \b, not null %u 31779# always 7, significance unknown 31780>>0x36 uleshort !7 \b, not seven %u 31781# year 31782>>0x28 uleshort x %u 31783# month 31784>>0x2A uleshort x \b-%u 31785# day 31786>>0x2C uleshort x \b-%u 31787# hour 31788>>0x2E uleshort x %u 31789# minute 31790>>0x30 uleshort x \b:%u 31791# second 31792>>0x32 uleshort x \b:%u 31793# boot application launched 31794>0x24 ulelong =0x11 \b, launched 31795# type of start: 0 normally, 1 or 2 maybe in a recovery sequence 31796>>0x38 uleshort !0 \b, type %u 31797# pathname of boot application, as null-terminated Unicode string; typically 31798# \Windows\system32\winload.exe \Windows\system32\winload.efi 31799>>0x3C lestring16 x %s 31800 31801# Summary: Windows Error Report text files 31802# URL: https://en.wikipedia.org/wiki/Windows_Error_Reporting 31803# Reference: https://www.nirsoft.net/utils/app_crash_view.html 31804# Created by: Joerg Jenderek 31805# Note: in directories %ProgramData%\Microsoft\Windows\WER\{ReportArchive,ReportQueue} 31806# %LOCALAPPDATA%\Microsoft\Windows\WER\{ReportArchive,ReportQueue} 318070 lestring16 Version= 31808>22 lestring16 EventType Windows Error Report 31809!:mime text/plain 31810# Report.wer 31811!:ext wer 31812 31813# Summary: Windows 3.1 group files 31814# Extension: .grp 31815# Created by: unknown 318160 string \120\115\103\103 MS Windows 3.1 group files 31817 31818 31819# Summary: Old format help files 31820# URL: https://en.wikipedia.org/wiki/WinHelp 31821# Reference: https://www.oocities.org/mwinterhoff/helpfile.htm 31822# Update: Joerg Jenderek 31823# Created by: Dirk Jagdmann <doj@cubic.org> 31824# 31825# check and then display version and date inside MS Windows HeLP file fragment 318260 name help-ver-date 31827# look for Magic of SYSTEMHEADER 31828>0 leshort 0x036C 31829# version Major 1 for right file fragment 31830>>4 leshort 1 Windows 31831# print non empty string above to avoid error message 31832# Warning: Current entry does not yet have a description for adding a MIME type 31833!:mime application/winhelp 31834!:ext hlp 31835# version Minor of help file format is hint for windows version 31836>>>2 leshort 0x0F 3.x 31837>>>2 leshort 0x15 3.0 31838>>>2 leshort 0x21 3.1 31839>>>2 leshort 0x27 x.y 31840>>>2 leshort 0x33 95 31841>>>2 default x y.z 31842>>>>2 leshort x 0x%x 31843# to complete message string like "MS Windows 3.x help file" 31844>>>2 leshort x help 31845# GenDate often older than file creation date 31846>>>6 ldate x \b, %s 31847# 31848# Magic for HeLP files 318490 lelong 0x00035f3f 31850# ./windows (version 5.25) labeled the entry as "MS Windows 3.x help file" 31851# file header magic 0x293B at DirectoryStart+9 31852>(4.l+9) uleshort 0x293B MS 31853# look for @VERSION bmf.. like IBMAVW.ANN 31854>>0xD4 string =\x62\x6D\x66\x01\x00 Windows help annotation 31855!:mime application/x-winhelp 31856!:ext ann 31857>>0xD4 string !\x62\x6D\x66\x01\x00 31858# "GID Help index" by TrID 31859>>>(4.l+0x65) string =|Pete Windows help Global Index 31860!:mime application/x-winhelp 31861!:ext gid 31862# HeLP Bookmark or 31863# "Windows HELP File" by TrID 31864>>>(4.l+0x65) string !|Pete 31865# maybe there exist a cleaner way to detect HeLP fragments 31866# brute search for Magic 0x036C with matching Major maximal 7 iterations 31867# discapp.hlp 31868>>>>16 search/0x49AF/s \x6c\x03 31869>>>>>&0 use help-ver-date 31870>>>>>&4 leshort !1 31871# putty.hlp 31872>>>>>>&0 search/0x69AF/s \x6c\x03 31873>>>>>>>&0 use help-ver-date 31874>>>>>>>&4 leshort !1 31875>>>>>>>>&0 search/0x49AF/s \x6c\x03 31876>>>>>>>>>&0 use help-ver-date 31877>>>>>>>>>&4 leshort !1 31878>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 31879>>>>>>>>>>>&0 use help-ver-date 31880>>>>>>>>>>>&4 leshort !1 31881>>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 31882>>>>>>>>>>>>>&0 use help-ver-date 31883>>>>>>>>>>>>>&4 leshort !1 31884>>>>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 31885>>>>>>>>>>>>>>>&0 use help-ver-date 31886>>>>>>>>>>>>>>>&4 leshort !1 31887>>>>>>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 31888# GCC.HLP is detected after 7 iterations 31889>>>>>>>>>>>>>>>>>&0 use help-ver-date 31890# this only happens if bigger hlp file is detected after used search iterations 31891>>>>>>>>>>>>>>>>>&4 leshort !1 Windows y.z help 31892!:mime application/winhelp 31893!:ext hlp 31894# repeat search again or following default line does not work 31895>>>>16 search/0x49AF/s \x6c\x03 31896# remaining files should be HeLP Bookmark WinHlp32.BMK (XP 32-bit) or WinHlp32 (Windows 8.1 64-bit) 31897>>>>16 default x Windows help Bookmark 31898!:mime application/x-winhelp 31899!:ext bmk 31900## FirstFreeBlock normally FFFFFFFFh 10h for *ANN 31901##>>8 lelong x \b, FirstFreeBlock 0x%8.8x 31902# EntireFileSize 31903>>12 lelong x \b, %d bytes 31904## ReservedSpace normally 042Fh AFh for *.ANN 31905#>>(4.l) lelong x \b, ReservedSpace 0x%8.8x 31906## UsedSpace normally 0426h A6h for *.ANN 31907#>>(4.l+4) lelong x \b, UsedSpace 0x%8.8x 31908## FileFlags normally 04... 31909#>>(4.l+5) lelong x \b, FileFlags 0x%8.8x 31910## file header magic 0x293B 31911#>>(4.l+9) uleshort x \b, file header magic 0x%4.4x 31912## file header Flags 0x0402 31913#>>(4.l+11) uleshort x \b, file header Flags 0x%4.4x 31914## file header PageSize 0400h 80h for *.ANN 31915#>>(4.l+13) uleshort x \b, PageSize 0x%4.4x 31916## Structure[16] z4 31917#>>(4.l+15) string >\0 \b, Structure_"%-.16s" 31918## MustBeZero 0 31919#>>(4.l+31) uleshort x \b, MustBeZero 0x%4.4x 31920## PageSplits 31921#>>(4.l+33) uleshort x \b, PageSplits 0x%4.4x 31922## RootPage 31923#>>(4.l+35) uleshort x \b, RootPage 0x%4.4x 31924## MustBeNegOne 0xffff 31925#>>(4.l+37) uleshort x \b, MustBeNegOne 0x%4.4x 31926## TotalPages 1 31927#>>(4.l+39) uleshort x \b, TotalPages 0x%4.4x 31928## NLevels 0x0001 31929#>>(4.l+41) uleshort x \b, NLevels 0x%4.4x 31930## TotalBtreeEntries 31931#>>(4.l+43) ulelong x \b, TotalBtreeEntries 0x%8.8x 31932## pages of the B+ tree 31933#>>(4.l+47) ubequad x \b, PageStart 0x%16.16llx 31934 31935# start with colon or semicolon for comment line like Back2Life.cnt 319360 regex \^(:|;) 31937# look for first keyword Base 31938>0 search/45 :Base 31939>>&0 use cnt-name 31940# only solution to search again from beginning , because relative offsets changes when use is called 31941>0 search/45 :Base 31942>0 default x 31943# look for other keyword Title like in putty.cnt 31944>>0 search/45 :Title 31945>>>&0 use cnt-name 31946# 31947# display mime type and name of Windows help Content source 319480 name cnt-name 31949# skip space at beginning 31950>0 string \040 31951# name without extension and greater character or name with hlp extension 31952>>1 regex/c \^([^\xd>]*|.*\.hlp) MS Windows help file Content, based "%s" 31953!:mime text/plain 31954!:apple ????TEXT 31955!:ext cnt 31956# 31957# Windows creates a full text search from hlp file, if the user clicks the "Find" tab and enables keyword indexing 319580 string tfMR MS Windows help Full Text Search index 31959!:mime application/x-winhelp-fts 31960!:ext fts 31961>16 string >\0 for "%s" 31962 31963# Summary: Hyper terminal 31964# Extension: .ht 31965# Created by: unknown 319660 string HyperTerminal\040 31967>15 string 1.0\ --\ HyperTerminal\ data\ file MS Windows HyperTerminal profile 31968 31969# https://ithreats.files.wordpress.com/2009/05/\040 31970# lnk_the_windows_shortcut_file_format.pdf 31971# Summary: Windows shortcut 31972# Extension: .lnk 31973# Created by: unknown 31974# 'L' + GUUID 319750 string \114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106 MS Windows shortcut 31976>20 lelong&1 1 \b, Item id list present 31977>20 lelong&2 2 \b, Points to a file or directory 31978>20 lelong&4 4 \b, Has Description string 31979>20 lelong&8 8 \b, Has Relative path 31980>20 lelong&16 16 \b, Has Working directory 31981>20 lelong&32 32 \b, Has command line arguments 31982>20 lelong&64 64 \b, Icon 31983>>56 lelong x \b number=%d 31984>24 lelong&1 1 \b, Read-Only 31985>24 lelong&2 2 \b, Hidden 31986>24 lelong&4 4 \b, System 31987>24 lelong&8 8 \b, Volume Label 31988>24 lelong&16 16 \b, Directory 31989>24 lelong&32 32 \b, Archive 31990>24 lelong&64 64 \b, Encrypted 31991>24 lelong&128 128 \b, Normal 31992>24 lelong&256 256 \b, Temporary 31993>24 lelong&512 512 \b, Sparse 31994>24 lelong&1024 1024 \b, Reparse point 31995>24 lelong&2048 2048 \b, Compressed 31996>24 lelong&4096 4096 \b, Offline 31997>28 leqwdate x \b, ctime=%s 31998>36 leqwdate x \b, mtime=%s 31999>44 leqwdate x \b, atime=%s 32000>52 lelong x \b, length=%u, window= 32001>60 lelong&1 1 \bhide 32002>60 lelong&2 2 \bnormal 32003>60 lelong&4 4 \bshowminimized 32004>60 lelong&8 8 \bshowmaximized 32005>60 lelong&16 16 \bshownoactivate 32006>60 lelong&32 32 \bminimize 32007>60 lelong&64 64 \bshowminnoactive 32008>60 lelong&128 128 \bshowna 32009>60 lelong&256 256 \brestore 32010>60 lelong&512 512 \bshowdefault 32011#>20 lelong&1 0 32012#>>20 lelong&2 2 32013#>>>(72.l-64) pstring/h x \b [%s] 32014#>20 lelong&1 1 32015#>>20 lelong&2 2 32016#>>>(72.s) leshort x 32017#>>>&75 pstring/h x \b [%s] 32018 32019# Summary: Outlook Personal Folders 32020# Created by: unknown 320210 lelong 0x4E444221 Microsoft Outlook email folder 32022>10 leshort 0x0e (<=2002) 32023>10 leshort 0x17 (>=2003) 32024 32025 32026# Summary: Windows help cache 32027# Created by: unknown 320280 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache 32029 32030 32031# Summary: IE cache file 32032# Created by: Christophe Monniez 320330 string Client\ UrlCache\ MMF Internet Explorer cache file 32034>20 string >\0 version %s 32035 32036 32037# Summary: Registry files 32038# Created by: unknown 32039# Modified by (1): Joerg Jenderek 320400 string regf MS Windows registry file, NT/2000 or above 320410 string CREG MS Windows 95/98/ME registry file 320420 string SHCC3 MS Windows 3.1 registry file 32043 32044 32045# Summary: Windows Registry text 32046# URL: https://en.wikipedia.org/wiki/Windows_Registry#.REG_files 32047# Reference: http://fileformats.archiveteam.org/wiki/Windows_Registry 32048# Submitted by: Abel Cheung <abelcheung@gmail.com> 32049# Update: Joerg Jenderek 32050# Windows 3-9X variant 320510 string REGEDIT 32052# skip ASCII text like "REGEDITor.txt" but match 32053# L1WMAP.REG with only 1 CRNL or org.gnome.gnumeric.reg with 2 NL 32054>7 search/3 \n Windows Registry text 32055!:mime text/x-ms-regedit 32056!:ext reg 32057# Windows 9X variant 32058>>0 string REGEDIT4 (Win95 or above) 32059# Windows 2K ANSI variant 320600 string Windows\ Registry\ Editor\ 32061>&0 string Version\ 5.00\r\n\r\n Windows Registry text (Win2K or above) 32062!:mime text/x-ms-regedit 32063!:ext reg 32064# Windows 2K UTF-16 variant 320652 lestring16 Windows\ Registry\ Editor\ 32066>0x32 lestring16 Version\ 5.00\r\n\r\n Windows Registry little-endian text (Win2K or above) 32067# relative offset not working 32068#>&0 lestring16 Version\ 5.00\r\n\r\n Windows Registry little-endian text (Win2K or above) 32069!:mime text/x-ms-regedit 32070!:ext reg 32071# WINE variant 32072# URL: https://en.wikipedia.org/wiki/Wine_(software) 32073# Reference: https://www.winehq.org/pipermail/wine-cvs/2005-October/018763.html 32074# Note: WINE use text based registry (system.reg,user.reg,userdef.reg) 32075# instead binary hiv structure like Windows 320760 string WINE\ REGISTRY\ Version\ WINE registry text 32077# version 2 32078>&0 string x \b, version %s 32079!:mime text/x-wine-extension-reg 32080!:ext reg 32081 32082# Windows *.INF *.INI files updated by Joerg Jenderek at Apr 2013, Feb 2018 32083# empty ,comment , section 32084# PR/383: remove unicode BOM because it is not portable across regex impls 32085#0 regex/s \\`(\\r\\n|;|[[]) 32086# empty line CRLF 320870 ubeshort 0x0D0A 32088>0 use ini-file 32089# comment line 320900 string ; 32091>0 use ini-file 32092# section line 320930 string [ 32094>0 use ini-file 32095# check and then display Windows INItialization configuration 320960 name ini-file 32097# look for left bracket in section line 32098>0 search/8192 [ 32099# https://en.wikipedia.org/wiki/Autorun.inf 32100# https://msdn.microsoft.com/en-us/library/windows/desktop/cc144200.aspx 32101# space after right bracket 32102# or AutoRun.Amd64 for 64 bit systems 32103# or only NL separator 32104>>&0 regex/c \^(autorun) 32105# but sometimes total commander directory tree file "treeinfo.wc" with lines like 32106# [AUTORUN] 32107# [boot] 32108>>>&0 string =]\r\n[ Total commander directory treeinfo.wc 32109!:mime text/plain 32110!:ext wc 32111# From: Pal Tamas <folti@balabit.hu> 32112# Autorun File 32113>>>&0 string !]\r\n[ Microsoft Windows Autorun file 32114!:mime application/x-setupscript 32115!:ext inf 32116# https://msdn.microsoft.com/en-us/library/windows/hardware/ff549520(v=vs.85).aspx 32117# version strings ASCII coded case-independent for Windows setup information script file 32118>>&0 regex/c \^(version|strings)] Windows setup INFormation 32119!:mime application/x-setupscript 32120#!:mime application/x-wine-extension-inf 32121!:ext inf 32122# NETCRC.INF OEMCPL.INF 32123>>&0 regex/c \^(WinsockCRCList|OEMCPL)] Windows setup INFormation 32124!:mime application/x-setupscript 32125!:ext inf 32126# http://www.winfaq.de/faq_html/Content/tip2500/onlinefaq.php?h=tip2653.htm 32127# https://msdn.microsoft.com/en-us/library/windows/desktop/cc144102.aspx 32128# .ShellClassInfo DeleteOnCopy LocalizedFileNames ASCII coded case-independent 32129>>&0 regex/c \^(\.ShellClassInfo|DeleteOnCopy|LocalizedFileNames)] Windows desktop.ini 32130!:mime application/x-wine-extension-ini 32131#!:mime text/plain 32132# https://support.microsoft.com/kb/84709/ 32133>>&0 regex/c \^(don't\ load)] Windows CONTROL.INI 32134!:mime application/x-wine-extension-ini 32135!:ext ini 32136>>&0 regex/c \^(ndishlp\\$|protman\\$|NETBEUI\\$)] Windows PROTOCOL.INI 32137!:mime application/x-wine-extension-ini 32138!:ext ini 32139# https://technet.microsoft.com/en-us/library/cc722567.aspx 32140# http://www.winfaq.de/faq_html/Content/tip0000/onlinefaq.php?h=tip0137.htm 32141>>&0 regex/c \^(windows|Compatibility|embedding)] Windows WIN.INI 32142!:mime application/x-wine-extension-ini 32143!:ext ini 32144# https://en.wikipedia.org/wiki/SYSTEM.INI 32145>>&0 regex/c \^(boot|386enh|drivers)] Windows SYSTEM.INI 32146!:mime application/x-wine-extension-ini 32147!:ext ini 32148# http://www.mdgx.com/newtip6.htm 32149>>&0 regex/c \^(SafeList)] Windows IOS.INI 32150!:mime application/x-wine-extension-ini 32151!:ext ini 32152# https://en.wikipedia.org/wiki/NTLDR Windows Boot Loader information 32153>>&0 regex/c \^(boot\x20loader)] Windows boot.ini 32154!:mime application/x-wine-extension-ini 32155!:ext ini 32156# https://en.wikipedia.org/wiki/CONFIG.SYS 32157>>&0 regex/c \^(menu)] MS-DOS CONFIG.SYS 32158# @CONFIG.UI configuration file of previous DOS version saved by Caldera OPENDOS INSTALL.EXE 32159# CONFIG.PSS saved version of file CONFIG.SYS created by %WINDIR%\SYSTEM\MSCONFIG.EXE 32160# CONFIG.TSH renamed file CONFIG.SYS.BAT by %WINDIR%\SYSTEM\MSCONFIG.EXE 32161# dos and w40 used in dual booting scene 32162!:ext sys/dos/w40 32163# https://support.microsoft.com/kb/118579/ 32164>>&0 regex/c \^(Paths)]\r\n MS-DOS MSDOS.SYS 32165!:ext sys/dos 32166# http://chmspec.nongnu.org/latest/INI.html#HHP 32167>>&0 regex/c \^(options)]\r\n Microsoft HTML Help Project 32168!:mime text/plain 32169!:ext hhp 32170# unknown keyword after opening bracket 32171>>&0 default x 32172#>>>&0 string/c x UNKNOWN [%s 32173# look for left bracket of second section 32174>>>&0 search/8192 [ 32175# version Strings FileIdentification 32176>>>>&0 string/c version Windows setup INFormation 32177!:mime application/x-setupscript 32178!:ext inf 32179# https://en.wikipedia.org/wiki/Initialization_file Windows Initialization File or other 32180>>>>&0 default x 32181>>>>>&0 ubyte x 32182# characters, digits, underscore and white space followed by right bracket 32183# terminated by CR implies section line to skip BOOTLOG.TXT DETLOG.TXT 32184>>>>>>&-1 regex \^([A-Za-z0-9_\(\)\ ]+)\]\r Generic INItialization configuration [%-.40s 32185# NETDEF.INF multiarc.ini 32186#!:mime application/x-setupscript 32187!:mime application/x-wine-extension-ini 32188#!:mime text/plain 32189!:ext ini/inf 32190# UTF-16 BOM followed by CR~0D00 , comment~semicolon~3B00 , section~bracket~5B00 321910 ubelong&0xFFff89FF =0xFFFE0900 32192# look for left bracket in section line 32193>2 search/8192 [ 32194# keyword without 1st letter which is maybe up-/down-case 32195>>&3 lestring16 ersion] Windows setup INFormation 32196!:mime application/x-setupscript 32197!:ext inf 32198>>&3 lestring16 trings] Windows setup INFormation 32199!:mime application/x-setupscript 32200!:ext inf 32201>>&3 lestring16 ourceDisksNames] Windows setup INFormation 32202!:mime application/x-setupscript 32203!:ext inf 32204# netnwcli.inf start with ;---[ NetNWCli.INX ] 32205>>&3 default x 32206# look for NL followed by left bracket 32207>>>&0 search/8192 \x0A\x00\x5b 32208>>>>&3 lestring16 ersion] Windows setup INFormation 32209!:mime application/x-setupscript 32210!:ext inf 32211 32212# Windows Precompiled INF files *.PNF added by Joerg Jenderek at Mar 2013 of _PNF_HEADER inf.h 32213# http://read.pudn.com/downloads3/sourcecode/windows/248345/win2k/private/windows/setup/setupapi/inf.h__.htm 32214# URL: http://fileformats.archiveteam.org/wiki/INF_(Windows) 32215# Reference: http://en.verysource.com/code/10350344_1/inf.h.html 32216# Note: stored in %Windir%\Inf %Windir%\System32\DriverStore\FileRepository 32217# check for valid major and minor versions: 101h - 303h 322180 leshort&0xFcFc =0x0000 32219# GRR: line above (strength 50) is too general as it catches also "PDP-11 UNIX/RT ldp" ./pdp 32220>0 leshort&0x0303 !0x0000 32221# test for valid InfStyles: 1 2 32222>>2 uleshort >0 32223>>>2 uleshort <3 32224# look for colon in WinDirPath after PNF header 32225#>>>>0x59 search/18 : 32226>>>>0 use PreCompiledInf 322270 name PreCompiledInf 32228>0 uleshort x Windows Precompiled iNF 32229!:mime application/x-pnf 32230!:ext pnf 32231# major version 1 for older Windows like XP and 3 since about Windows Vista 32232# 101h~98-XP; 301h~Windows Vista-7 ; 302h~Windows 10 14393; 303h~Windows 10 18362 32233>1 ubyte x \b, version %u 32234>0 ubyte x \b.%u 32235>0 uleshort =0x0101 (Windows 32236>>4 ulelong&0x00000001 !0x00000001 98) 32237>>4 ulelong&0x00000001 =0x00000001 XP) 32238>0 uleshort =0x0301 (Windows Vista-8.1) 32239>0 uleshort =0x0302 (Windows 10 older) 32240>0 uleshort =0x0303 (Windows 10) 32241# 1 ,2 (windows 98 SE) 32242>2 uleshort !2 \b, InfStyle %u 32243# PNF_FLAG_IS_UNICODE 0x00000001 32244# PNF_FLAG_HAS_STRINGS 0x00000002 32245# PNF_FLAG_SRCPATH_IS_URL 0x00000004 32246# PNF_FLAG_HAS_VOLATILE_DIRIDS 0x00000008 32247# PNF_FLAG_INF_VERIFIED 0x00000010 32248# PNF_FLAG_INF_DIGITALLY_SIGNED 0x00000020 32249# UNKNOWN8 0x00000080 32250# UNKNOWN 0x00000100 32251# UNKNOWN1 0x01000000 32252# UNKNOWN2 0x02000000 32253>4 ulelong&0x03000180 >0 \b, flags 32254>>4 ulelong x 0x%x 32255>4 ulelong&0x00000001 0x00000001 \b, unicoded 32256>4 ulelong&0x00000002 0x00000002 \b, has strings 32257>4 ulelong&0x00000004 0x00000004 \b, src URL 32258>4 ulelong&0x00000008 0x00000008 \b, volatile dir ids 32259>4 ulelong&0x00000010 0x00000010 \b, verified 32260>4 ulelong&0x00000020 0x00000020 \b, digitally signed 32261# >4 ulelong&0x00000080 0x00000080 \b, UNKNOWN8 32262# >4 ulelong&0x00000100 0x00000100 \b, UNKNOWN 32263# >4 ulelong&0x01000000 0x01000000 \b, UNKNOWN1 32264# >4 ulelong&0x02000000 0x02000000 \b, UNKNOWN2 32265#>8 ulelong x \b, InfSubstValueListOffset 0x%x 32266# many 0, 1 lmouusb.PNF, 2 linkfx10.PNF , f webfdr16.PNF 32267# , 6 bth.PNF, 9 usbport.PNF, d netnwifi.PNF, 10h nettcpip.PNF 32268#>12 uleshort x \b, InfSubstValueCount 0x%x 32269# only < 9 found: 8 hcw85b64.PNF 32270#>14 uleshort x \b, InfVersionDatumCount 0x%x 32271# only found values lower 0x0000ffff ?? 32272#>16 ulelong x \b, InfVersionDataSize 0x%x 32273# only found positive values lower 0x00ffFFff for InfVersionDataOffset 32274>20 ulelong x \b, at 0x%x 32275>4 ulelong&0x00000001 =0x00000001 32276# case independent: CatalogFile Class DriverVer layoutfile LayoutFile SetupClass signature Signature 32277>>(20.l) lestring16 x "%s" 32278>4 ulelong&0x00000001 !0x00000001 32279>>(20.l) string x "%s" 32280# FILETIME is number of 100-nanosecond intervals since 1 January 1601 32281#>24 ulequad x \b, InfVersionLastWriteTime %16.16llx 32282#>24 foodate-0xbar x \b, InfVersionLastWriteTime %s 32283# for Windows 98, XP 32284>0 uleshort <0x0102 32285# only found values lower 0x00ffFFff 32286# often 70 but also 78h for corelist.PNF 32287# >>32 ulelong x \b, StringTableBlockOffset 0x%x 32288# >>36 ulelong x \b, StringTableBlockSize 0x%x 32289# >>40 ulelong x \b, InfSectionCount 0x%x 32290# >>44 ulelong x \b, InfSectionBlockOffset 0x%x 32291# >>48 ulelong x \b, InfSectionBlockSize 0x%x 32292# >>52 ulelong x \b, InfLineBlockOffset 0x%x 32293# >>56 ulelong x \b, InfLineBlockSize 0x%x 32294# >>60 ulelong x \b, InfValueBlockOffset 0x%x 32295# >>64 ulelong x \b, InfValueBlockSize 0x%x 32296# WinDirPathOffset 32297# like 58h, which means direct after PNF header 32298#>>68 ulelong x \b, at 0x%x 32299>>68 ulelong x 32300>>>4 ulelong&0x00000001 =0x00000001 32301#>>>>(68.l) ubequad =0x43003a005c005700 32302# normally unicoded C:\Windows 32303#>>>>>(68.l) lestring16 x \b, WinDirPath "%s" 32304>>>>(68.l) ubequad !0x43003a005c005700 32305>>>>>(68.l) lestring16 x \b, WinDirPath "%s" 32306>>>4 ulelong&0x00000001 !0x00000001 32307# normally ASCII C:\WINDOWS 32308#>>>>(68.l) string =C:\\WINDOWS \b, WinDirPath "%s" 32309>>>>(68.l) string !C:\\WINDOWS 32310>>>>>(68.l) string x \b, WinDirPath "%s" 32311# found OsLoaderPathOffset values often 0 , once 70h corelist.PNF, once 68h ASCII machine.PNF 32312>>>72 ulelong >0 \b, 32313>>>>4 ulelong&0x00000001 =0x00000001 32314>>>>>(72.l) lestring16 x OsLoaderPath "%s" 32315>>>>4 ulelong&0x00000001 !0x00000001 32316# seldom C:\ instead empty 32317>>>>>(72.l) string x OsLoaderPath "%s" 32318# 1fdh 32319#>>>76 uleshort x \b, StringTableHashBucketCount 0x%x 32320# only 407h found 32321>>>78 uleshort !0x409 \b, LanguageID %x 32322#>>>78 uleshort =0x409 \b, LanguageID %x 32323# InfSourcePathOffset often 0 32324>>>80 ulelong >0 \b, at 0x%x 32325>>>>4 ulelong&0x00000001 =0x00000001 32326>>>>>(80.l) lestring16 x SourcePath "%s" 32327>>>>4 ulelong&0x00000001 !0x00000001 32328>>>>>(80.l) string >\0 SourcePath "%s" 32329# OriginalInfNameOffset often 0 32330>>>84 ulelong >0 \b, at 0x%x 32331>>>>4 ulelong&0x00000001 =0x00000001 32332>>>>>(84.l) lestring16 x InfName "%s" 32333>>>>4 ulelong&0x00000001 !0x00000001 32334>>>>>(84.l) string >\0 InfName "%s" 32335 32336# for newer Windows like Vista, 7 , 8.1 , 10 32337>0 uleshort >0x0101 32338>>80 ulelong x \b, at 0x%x WinDirPath 32339>>>4 ulelong&0x00000001 0x00000001 32340# normally unicoded C:\Windows 32341#>>>>(80.l) ubequad =0x43003a005c005700 32342#>>>>>(80.l) lestring16 x "%s" 32343>>>>(80.l) ubequad !0x43003a005c005700 32344>>>>>(80.l) lestring16 x "%s" 32345# language id: 0 407h~german 409h~English_US 32346>>90 uleshort !0x409 \b, LanguageID %x 32347#>>90 uleshort =0x409 \b, LanguageID %x 32348>>92 ulelong >0 \b, at 0x%x 32349>>>4 ulelong&0x00000001 0x00000001 32350# language string like: de-DE en-US 32351>>>>(92.l) lestring16 x language %s 32352 32353# Summary: backup file created with utility like NTBACKUP.EXE shipped with Windows NT/2K/XP/2003 32354# Extension: .bkf 32355# Created by: Joerg Jenderek 32356# URL: https://en.wikipedia.org/wiki/NTBackup 32357# Reference: http://laytongraphics.com/mtf/MTF_100a.PDF 32358# Descriptor BloCK name of Microsoft Tape Format 323590 string TAPE 32360# Format Logical Address is zero 32361>20 ulequad 0 32362# Reserved for MBC is zero 32363>>28 uleshort 0 32364# Control Block ID is zero 32365>>>36 ulelong 0 32366# BIT4-BIT15, BIT18-BIT31 of block attributes are unused 32367>>>>4 ulelong&0xFFfcFFe0 0 Windows NTbackup archive 32368#!:mime application/x-ntbackup 32369!:ext bkf 32370# OS ID 32371>>>>>10 ubyte 1 \b NetWare 32372>>>>>10 ubyte 13 \b NetWare SMS 32373>>>>>10 ubyte 14 \b NT 32374>>>>>10 ubyte 24 \b 3 32375>>>>>10 ubyte 25 \b OS/2 32376>>>>>10 ubyte 26 \b 95 32377>>>>>10 ubyte 27 \b Macintosh 32378>>>>>10 ubyte 28 \b UNIX 32379# OS Version (2) 32380#>>>>>11 ubyte x OS V=%x 32381# MTF_CONTINUATION Media Sequence Number > 1 32382#>>>>>4 ulelong&0x00000001 !0 \b, continued 32383# MTF_COMPRESSION 32384>>>>>4 ulelong&0x00000004 !0 \b, compressed 32385# MTF_EOS_AT_EOM End Of Medium was hit during end of set processing 32386>>>>>4 ulelong&0x00000008 !0 \b, End Of Medium hit 32387>>>>>4 ulelong&0x00020000 0 32388# MTF_SET_MAP_EXISTS A Media Based Catalog Set Map may exist on tape 32389>>>>>>4 ulelong&0x00010000 !0 \b, with catalog 32390# MTF_FDD_ALLOWED However File/Directory Detail can only exist if a Set Map is also present 32391>>>>>4 ulelong&0x00020000 !0 \b, with file catalog 32392# Offset To First Event 238h,240h,28Ch 32393#>>>>>8 uleshort x \b, event offset %4.4x 32394# Displayable Size (20e0230h 20e024ch 20e0224h) 32395#>>>>>8 ulequad x dis. size %16.16llx 32396# Media Family ID (455288C4h 4570BD1Ah 45708F2Fh 4570BBF5h) 32397#>>>>>52 ulelong x family ID %8.8x 32398# TAPE Attributes (3) 32399#>>>>>56 ulelong x TAPE %8.8x 32400# Media Sequence Number 32401>>>>>60 uleshort >1 \b, sequence %u 32402# Password Encryption Algorithm (3) 32403>>>>>62 uleshort >0 \b, 0x%x encrypted 32404# Soft Filemark Block Size * 512 (2) 32405#>>>>>64 uleshort =2 \b, soft size %u*512 32406>>>>>64 uleshort !2 \b, soft size %u*512 32407# Media Based Catalog Type (1,2) 32408#>>>>>66 uleshort x \b, catalog type %4.4x 32409# size of Media Name (66,68,6Eh) 32410>>>>>68 uleshort >0 32411# offset of Media Name (5Eh) 32412>>>>>>70 uleshort >0 32413# 0~, 1~ANSI, 2~UNICODE 32414>>>>>>>48 ubyte 1 32415# size terminated ansi coded string normally followed by "MTF Media Label" 32416>>>>>>>>(70.s) string >\0 \b, name: %s 32417>>>>>>>48 ubyte 2 32418# Not null, but size terminated unicoded string 32419>>>>>>>>(70.s) lestring16 x \b, name: %s 32420# size of Media Label (104h) 32421>>>>>72 uleshort >0 32422# offset of Media Label (C4h,C6h,CCh) 32423>>>>>74 uleshort >0 32424>>>>>>48 ubyte 1 32425#Tag|Version|Vendor|Vendor ID|Creation Time Stamp|Cartridge Label|Side|Media ID|Media Domain ID|Vendor Specific fields 32426>>>>>>>(74.s) string >\0 \b, label: %s 32427>>>>>>48 ubyte 2 32428>>>>>>>(74.s) lestring16 x \b, label: %s 32429# size of password name (0,1Ch) 32430#>>>>>76 uleshort >0 \b, password size %4.4x 32431# Software Vendor ID (CBEh) 32432>>>>>86 uleshort x \b, software (0x%x) 32433# size of Software Name (6Eh) 32434>>>>>80 uleshort >0 32435# offset of Software Name (1C8h,1CAh,1D0h) 32436>>>>>>82 uleshort >0 32437# 1~ANSI, 2~UNICODE 32438>>>>>>>48 ubyte 1 32439>>>>>>>>(82.s) string >\0 \b: %s 32440>>>>>>>48 ubyte 2 32441# size terminated unicoded coded string normally followed by "SPAD" 32442>>>>>>>>(82.s) lestring16 x \b: %s 32443# Format Logical Block Size (512,1024) 32444#>>>>>84 uleshort =1024 \b, block size %u 32445>>>>>84 uleshort !1024 \b, block size %u 32446# Media Date of MTF_DATE_TIME type with 5 bytes 32447#>>>>>>88 ubequad x DATE %16.16llx 32448# MTF Major Version (1) 32449#>>>>>>93 ubyte x \b, MFT version %x 32450# 32451 32452# URL: https://en.wikipedia.org/wiki/PaintShop_Pro 32453# Reference: https://www.cryer.co.uk/file-types/p/pal.htm 32454# Created by: Joerg Jenderek 32455# Note: there exist other color palette formats also with .pal extension 324560 string JASC-PAL\r\n PaintShop Pro color palette 32457#!:mime text/plain 32458# PspPalette extension is used by newer (probably 8) PaintShopPro versions 32459!:ext pal/PspPalette 32460# 2nd line contains palette file version. For example "0100" 32461>10 string !0100 \b, version %.4s 32462# third line contains the number of colours: 16 256 ... 32463>16 string x \b, %.3s colors 32464 32465# URL: https://en.wikipedia.org/wiki/Innosetup 32466# Reference: https://github.com/jrsoftware/issrc/blob/master/Projects/Undo.pas 32467# Created by: Joerg Jenderek 32468# Note: created by like "InnoSetup self-extracting archive" inside ./msdos 32469# TrID labeles the entry as "Inno Setup Uninstall Log" 32470# TUninstallLogID 324710 string Inno\ Setup\ Uninstall\ Log\ (b) InnoSetup Log 32472!:mime application/x-innosetup 32473# unins000.dat, unins001.dat, ... 32474!:ext dat 32475# " 64-bit" variant 32476>0x1c string >\0 \b%.7s 32477# AppName[0x80] like "Minimal SYStem", ClamWin Free Antivirus , ... 32478>0xc0 string x %s 32479# AppId[0x80] is similar to AppName or 32480# GUID like {4BB0DCDC-BC24-49EC-8937-72956C33A470} start with left brace 32481>0x40 ubyte 0x7b 32482>>0x40 string x %-.38s 32483# do not know how this log version correlates to program version 32484>0x140 ulelong x \b, version 0x%x 32485# NumRecs 32486#>0x144 ulelong x \b, 0x%4.4x records 32487# EndOffset means files size 32488>0x148 ulelong x \b, %u bytes 32489# Flags 5 25h 35h 32490#>0x14c ulelong x \b, flags %8.8x 32491# Reserved: array[0..26] of Longint 32492# the non Unicode HighestSupportedVersion may never become greater than or equal to 1000 32493>0x140 ulelong <1000 32494# hostname 32495>>0x1d6 pstring x \b, %s 32496# user name 32497>>>&0 pstring x \b\%s 32498# directory like C:\Program Files (x86)\GnuWin32 32499>>>>&0 pstring x \b, "%s" 32500# version 1000 or higher implies unicode 32501>0x140 ulelong >999 32502# hostname 32503>>0x1db lestring16 x \b, %-.9s 32504# utf string variant with prepending fe??ffFFff 32505>>0x1db search/43 \xFF\xFF\xFF 32506# user name 32507>>>&0 lestring16 x \b\%-.9s 32508>>>&0 search/43 \xFF\xFF\xFF 32509# directory like C:\Program Files\GIMP 2 32510>>>>&0 lestring16 x \b, %-.42s 32511 32512# Windows Imaging (WIM) Image 32513# Update: Joerg Jenderek at Mar 2019 32514# URL: https://en.wikipedia.org/wiki/Windows_Imaging_Format 32515# Reference: https://download.microsoft.com/download/f/e/f/ 32516# fefdc36e-392d-4678-9e4e-771ffa2692ab/Windows%20Imaging%20File%20Format.rtf 32517# Note: verified by like `7z t boot.wim` `wiminfo install.esd --header` 325180 string MSWIM\000\000\000 32519>0 use wim-archive 32520# https://wimlib.net/man1/wimoptimize.html 325210 string WLPWM\000\000\000 32522>0 use wim-archive 325230 name wim-archive 32524# _WIMHEADER_V1_PACKED ImageTag[8] 32525>0 string x Windows imaging 32526!:mime application/x-ms-wim 32527# TO avoid in file version 5.36 error like 32528# Magdir/windows, 760: Warning: Current entry does not yet have a description 32529# file: could not find any valid magic files! (No error) 32530# splitted WIM 32531>16 ulelong &0x00000008 (SWM 32532!:ext swm 32533# usPartNumber; 1, unless the file was split into multiple parts 32534>>40 uleshort x \b %u 32535# usTotalParts; The total number of WIM file parts in a spanned set 32536>>42 uleshort x \b of %u) image 32537# non splitted WIM 32538>16 ulelong ^0x00000008 32539# https://wimlib.net/man1/wimmount.html 32540# solid WIMs; version 3584; usually contain LZMS-compressed and the .esd extension 32541>>12 ulelong 3584 (ESD) image 32542!:ext esd 32543>>12 ulelong !3584 (WIM) image 32544!:ext wim 32545>0 string/b WLPWM\000\000\000 \b, wimlib pipable format 32546# cbSize size of the WIM header in bytes like 208 32547#>8 ulelong x \b, headersize %u 32548# dwVersion version of the WIM file 00010d00h~1.13 00000e00h~0.14 32549>14 uleshort x v%u 32550>13 ubyte x \b.%u 32551# dwImageCount; The number of images contained in the WIM file 32552>44 ulelong >1 \b, %u images 32553# dwBootIndex 32554# 1-based index of the bootable image of the WIM, or 0 if no image is bootable 32555>0x78 ulelong >0 \b, bootable no. %u 32556# dwFlags 32557#>16 ulelong x \b, flags 0x%8.8x 32558#define FLAG_HEADER_COMPRESSION 0x00000002 32559#define FLAG_HEADER_READONLY 0x00000004 32560#define FLAG_HEADER_SPANNED 0x00000008 32561#define FLAG_HEADER_RESOURCE_ONLY 0x00000010 32562#define FLAG_HEADER_METADATA_ONLY 0x00000020 32563#define FLAG_HEADER_WRITE_IN_PROGRESS 0x00000040 32564#define FLAG_HEADER_RP_FIX 0x00000080 reparse point fixup 32565#define FLAG_HEADER_COMPRESS_RESERVED 0x00010000 32566#define FLAG_HEADER_COMPRESS_XPRESS 0x00020000 32567#define FLAG_HEADER_COMPRESS_LZX 0x00040000 32568#define FLAG_HEADER_COMPRESS_LZMS 0x00080000 32569#define FLAG_HEADER_COMPRESS_XPRESS2 0x00100000 wimlib-1.13.0\include\wimlib\header.h 32570# XPRESS, with small chunk size 32571>16 ulelong &0x00100000 \b, XPRESS2 32572>16 ulelong &0x00080000 \b, LZMS 32573>16 ulelong &0x00040000 \b, LZX 32574>16 ulelong &0x00020000 \b, XPRESS 32575>16 ulelong &0x00000002 compressed 32576>16 ulelong &0x00000004 \b, read only 32577>16 ulelong &0x00000010 \b, resource only 32578>16 ulelong &0x00000020 \b, metadata only 32579>16 ulelong &0x00000080 \b, reparse point fixup 32580#>16 ulelong &0x00010000 \b, RESERVED 32581# dwCompressionSize; Uncompressed chunk size for resources or 0 if uncompressed 32582#>20 ulelong >0 \b, chunk size %u bytes 32583# gWIMGuid 32584#>24 ubequad x \b, GUID 0x%16.16llx 32585#>>32 ubequad x \b%16.16llx 32586# rhOffsetTable; the location of the resource lookup table 32587# wim_reshdr_disk[24]= u8 size_in_wim[7] + u8 flags + le64 offset_in_wim + le64 uncompressed_size 32588#>48 ubequad x \b, rhOffsetTable 0x%16.16llx 32589# rhXmlData; the location of the XML data 32590#>0x50 ulelong x \b, at 0x%8.8x 32591# NOT WORKING \xff\xfe<\0W\0I\0M\0 32592#>(0x50.l) ubequad x \b, xml=%16.16llx 32593# rhBootMetadata; the location of the metadata resource 32594#>0x60 ubequad x \b, rhBootMetadata 0x%16.16llx 32595# rhIntegrity; the location of integrity table used to verify files 32596#>0x7c ubequad x \b, rhIntegrity 0x%16.16llx 32597# Unused[60] 32598#>148 ubequad !0 \b,unused 0x%16.16llx 32599# 32600 32601# From: Joerg Jenderek 32602# URL: https://en.wikipedia.org/wiki/Windows_Easy_Transfer 32603# Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/mig.trid.xml 32604# Note: called "Windows Easy Transfer migration data" by TrID, 32605# "Migration Store" or "EasyTransfer file" by Microsoft 326060 string 1giM Windows Easy Transfer migration data 32607#!:mime application/octet-stream 32608!:mime application/x-ms-mig 32609!:ext mig 32610>0x18 string =MRTS without password 32611# data offset with 1 space at end 32612>>0x1c ulelong+0x38 x \b, at 0x%x 32613# look for zlib compressed data by ./compress 32614>>(0x1c.l+0x38) ubyte x 32615>>>&-1 indirect x 32616# in password protected examples MRTS comes some bytes further 32617>0x18 string !MRTS with password 32618# look for first MRTS tag 32619>0x18 search/29/b MRTS 32620# probably first file name length like 178, ... 32621#>>&0 ulelong x \b, 1st length %u 32622# URL like File\C:\Users\nutzer\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 32623>>&20 lestring16 x \b, 1st %-s 32624 32625# Microsoft SYLK 32626# https://en.wikipedia.org/wiki/SYmbolic_LinK_(SYLK) 32627# https://outflank.nl/upload/sylksum.txt 326280 string ID;P Microsoft SYLK program 32629>4 string >0 \b, created by %s 32630!:ext slk/sylk 32631 32632#------------------------------------------------------------------------------ 32633# $File: wireless,v 1.2 2009/09/19 16:28:13 christos Exp $ 32634# wireless-regdb: file(1) magic for CRDA wireless-regdb file format 32635# 326360 string RGDB CRDA wireless regulatory database file 32637>4 belong 19 (Version 1) 32638 32639#------------------------------------------------------------------------------ 32640# $File: wordprocessors,v 1.24 2020/05/22 19:28:47 christos Exp $ 32641# wordprocessors: file(1) magic fo word processors. 32642# 32643####### PWP file format used on Smith Corona Personal Word Processors: 326442 string \040\040\040\040\040\040\040\040\040\040\040ML4D\040'92 Smith Corona PWP 32645>24 byte 2 \b, single spaced 32646>24 byte 3 \b, 1.5 spaced 32647>24 byte 4 \b, double spaced 32648>25 byte 0x42 \b, letter 32649>25 byte 0x54 \b, legal 32650>26 byte 0x46 \b, A4 32651 32652# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor 32653# reference: http://mark0.net/download/triddefs_xml.7z 32654# /defs/w/wps-works-dos.trid.xml 32655# From: Joerg Jenderek 32656# Note: older non OLE 2 Compound based versions 326570 ubeshort =0x01FE 32658>112 ubeshort =0x0100 Microsoft Works 1-3 (DOS) or 2 (Windows) document 32659# title like THE GREAT KHAN GAME 32660>>0x100 string x %s 32661!:mime application/vnd-ms-works 32662#!:mime application/x-msworks 32663# https://www.macdisk.com/macsigen.php 32664!:apple ????AWWP 32665!:ext wps 32666 32667# Corel/WordPerfect 326680 string \xffWPC 32669# WordPerfect 32670>8 byte 1 32671>>9 byte 1 WordPerfect macro 32672>>9 byte 2 WordPerfect help file 32673>>9 byte 3 WordPerfect keyboard file 32674>>9 byte 10 WordPerfect document 32675>>9 byte 11 WordPerfect dictionary 32676>>9 byte 12 WordPerfect thesaurus 32677>>9 byte 13 WordPerfect block 32678>>9 byte 14 WordPerfect rectangular block 32679>>9 byte 15 WordPerfect column block 32680>>9 byte 16 WordPerfect printer data 32681>>9 byte 19 WordPerfect printer data 32682>>9 byte 20 WordPerfect driver resource data 32683>>9 byte 22 WordPerfect graphic image 32684>>9 byte 23 WordPerfect hyphenation code 32685>>9 byte 24 WordPerfect hyphenation data 32686>>9 byte 25 WordPerfect macro resource data 32687>>9 byte 27 WordPerfect hyphenation lex 32688>>9 byte 29 WordPerfect wordlist 32689>>9 byte 30 WordPerfect equation resource data 32690>>9 byte 33 WordPerfect spell rules 32691>>9 byte 34 WordPerfect dictionary rules 32692>>9 byte 39 WordPerfect spell rules (Microlytics) 32693>>9 byte 43 WordPerfect settings file 32694>>9 byte 44 WordPerfect 3.5 document 32695>>9 byte 45 WordPerfect 4.2 document 32696>>9 byte 69 WordPerfect dialog file 32697>>9 byte 76 WordPerfect button bar 32698>>9 default x 32699>>>9 byte x Corel WordPerfect: Unknown filetype %d 32700# Corel Shell 32701>8 byte 2 32702>>9 byte 1 Corel shell macro 32703>>9 byte 10 Corel shell definition 32704>>9 default x 32705>>>9 byte x Corel Shell: Unknown filetype %d 32706# Corel Notebook 32707>8 byte 3 32708>>9 byte 1 Corel Notebook macro 32709>>9 byte 2 Corel Notebook help file 32710>>9 byte 3 Corel Notebook keyboard file 32711>>9 byte 10 Corel Notebook definition 32712>>9 default x 32713>>>9 byte x Corel Notebook: Unknown filetype %d 32714# Corel Calculator 32715>8 byte 4 32716>>9 byte 2 Corel Calculator help file 32717>>9 default x 32718>>>9 byte x Corel Calculator: Unknown filetype %d 32719# Corel File Manager 32720>8 byte 5 32721>>9 default x 32722>>>9 byte x Corel File Manager: Unknown filetype %d 32723# Corel Calendar 32724>8 byte 6 32725>>9 byte 2 Corel Calendar help file 32726>>9 byte 10 Corel Calendar data file 32727>>9 default x 32728>>>9 byte x Corel Calendar: Unknown filetype %d 32729# Corel Program Editor/Ed Editor 32730>8 byte 7 32731>>9 byte 1 Corel Editor macro 32732>>9 byte 2 Corel Editor help file 32733>>9 byte 3 Corel Editor keyboard file 32734>>9 byte 25 Corel Editor macro resource file 32735>>9 default x 32736>>>9 byte x Corel Program Editor/Ed Editor: Unknown filetype %d 32737# Corel Macro Editor 32738>8 byte 8 32739>>9 byte 1 Corel Macro editor macro 32740>>9 byte 2 Corel Macro editor help file 32741>>9 byte 3 Corel Macro editor keyboard file 32742>>9 default x 32743>>>9 byte x Corel Macro Editor: Unknown filetype %d 32744# Corel Plan Perfect 32745>8 byte 9 32746>>9 default x 32747>>>9 byte x Corel Plan Perfect: Unknown filetype %d 32748# Corel DataPerfect 32749>8 byte 10 32750# CHECK: Don't these belong into product 9? 32751>>9 byte 1 Corel PlanPerfect macro 32752>>9 byte 2 Corel PlanPerfect help file 32753>>9 byte 3 Corel PlanPerfect keyboard file 32754>>9 byte 10 Corel PlanPerfect worksheet 32755>>9 byte 15 Corel PlanPerfect printer definition 32756>>9 byte 18 Corel PlanPerfect graphic definition 32757>>9 byte 19 Corel PlanPerfect data 32758>>9 byte 20 Corel PlanPerfect temporary printer 32759>>9 byte 25 Corel PlanPerfect macro resource data 32760>>9 default x 32761>>>9 byte x Corel DataPerfect: Unknown filetype %d 32762# Corel Mail 32763>8 byte 11 32764>>9 byte 2 Corel Mail help file 32765>>9 byte 5 Corel Mail distribution list 32766>>9 byte 10 Corel Mail out box 32767>>9 byte 11 Corel Mail in box 32768>>9 byte 20 Corel Mail users archived mailbox 32769>>9 byte 21 Corel Mail archived message database 32770>>9 byte 22 Corel Mail archived attachments 32771>>9 default x 32772>>>9 byte x Corel Mail: Unknown filetype %d 32773# Corel Printer 32774>8 byte 12 32775>>9 byte 11 Corel Printer temporary file 32776>>9 default x 32777>>>9 byte x Corel Printer: Unknown filetype %d 32778# Corel Scheduler 32779>8 byte 13 32780>>9 byte 2 Corel Scheduler help file 32781>>9 byte 10 Corel Scheduler in file 32782>>9 byte 11 Corel Scheduler out file 32783>>9 default x 32784>>>9 byte x Corel Scheduler: Unknown filetype %d 32785# Corel WordPerfect Office 32786>8 byte 14 32787>>9 byte 10 Corel GroupWise settings file 32788>>9 byte 17 Corel GroupWise directory services 32789>>9 byte 43 Corel GroupWise settings file 32790>>9 default x 32791>>>9 byte x Corel WordPerfect Office: Unknown filetype %d 32792# Corel DrawPerfect 32793>8 byte 15 32794>>9 default x 32795>>>9 byte x Corel DrawPerfect: Unknown filetype %d 32796# Corel LetterPerfect 32797>8 byte 16 32798>>9 default x 32799>>>9 byte x Corel LetterPerfect: Unknown filetype %d 32800# Corel Terminal 32801>8 byte 17 32802>>9 byte 10 Corel Terminal resource data 32803>>9 byte 11 Corel Terminal resource data 32804>>9 byte 43 Corel Terminal resource data 32805>>9 default x 32806>>>9 byte x Corel Terminal: Unknown filetype %d 32807# Corel loadable file 32808>8 byte 18 32809>>9 byte 10 Corel loadable file 32810>>9 byte 11 Corel GUI loadable text 32811>>9 byte 12 Corel graphics resource data 32812>>9 byte 13 Corel printer settings file 32813>>9 byte 14 Corel port definition file 32814>>9 byte 15 Corel print queue parameters 32815>>9 byte 16 Corel compressed file 32816>>9 default x 32817>>>9 byte x Corel loadable file: Unknown filetype %d 32818>>15 byte 0 \b, optimized for Intel 32819>>15 byte 1 \b, optimized for Non-Intel 32820# Network service 32821>8 byte 20 32822>>9 byte 10 Corel Network service msg file 32823>>9 byte 11 Corel Network service msg file 32824>>9 byte 12 Corel Async gateway login msg 32825>>9 byte 14 Corel GroupWise message file 32826>>9 default x 32827>>>9 byte x Corel Network service: Unknown filetype %d 32828# GroupWise 32829>8 byte 31 32830>>9 byte 20 GroupWise admin domain database 32831>>9 byte 21 GroupWise admin host database 32832>>9 byte 23 GroupWise admin remote host database 32833>>9 byte 24 GroupWise admin ADS deferment data file 32834>>9 default x 32835>>>9 byte x GroupWise: Unknown filetype %d 32836# IntelliTAG 32837>8 byte 33 32838>>9 byte 10 IntelliTAG (SGML) compiled DTD 32839>>9 default x 32840>>>9 byte x IntelliTAG: Unknown filetype %d 32841# everything else 32842>8 default x 32843>>8 byte x Unknown Corel/Wordperfect product %d, 32844>>>9 byte x file type %d 32845>10 byte 0 \b, v5. 32846>10 byte !0 \b, v%d. 32847>11 byte x \b%d 32848 32849# Hangul (Korean) Word Processor File 328500 string HWP\ Document\ File Hangul (Korean) Word Processor File 3.0 32851 32852# CosmicBook, from Benoit Rouits 328530 string CSBK Ted Neslson's CosmicBook hypertext file 32854 328552 string EYWR AmigaWriter file 32856 32857# chi: file(1) magic for ChiWriter files 328580 string \\1cw\ ChiWriter file 32859>5 string >\0 version %s 328600 string \\1cw ChiWriter file 32861 32862# Quark Express from https://www.garykessler.net/library/file_sigs.html 328632 string IIXPR3 Intel Quark Express Document (English) 328642 string IIXPRa Intel Quark Express Document (Korean) 328652 string MMXPR3 Motorola Quark Express Document (English) 32866!:mime application/x-quark-xpress-3 328672 string MMXPRa Motorola Quark Express Document (Korean) 32868 32869# adobe indesign (document, whatever...) from querkan 328700 belong 0x0606edf5 Adobe InDesign 32871>16 string DOCUMENT Document 32872 32873#------------------------------------------------------------------------------ 32874# ichitaro456: file(1) magic for Just System Word Processor Ichitaro 32875# 32876# Contributor kenzo-: 32877# Reversed-engineered JS Ichitaro magic numbers 32878# 32879 328800 string DOC 32881>43 byte 0x14 Just System Word Processor Ichitaro v4 32882!:mime application/x-ichitaro4 32883>144 string JDASH application/x-ichitaro4 32884 328850 string DOC 32886>43 byte 0x15 Just System Word Processor Ichitaro v5 32887!:mime application/x-ichitaro5 32888 328890 string DOC 32890>43 byte 0x16 Just System Word Processor Ichitaro v6 32891!:mime application/x-ichitaro6 32892 32893# Type: Freemind mindmap documents 32894# From: Jamie Thompson <debian-bugs@jamie-thompson.co.uk> 328950 string/w \<map\ version Freemind document 32896!:mime application/x-freemind 32897 32898# Type: Freeplane mindmap documents 32899# From: Felix Natter <fnatter@gmx.net> 329000 string/w \<map\ version="freeplane Freeplane document 32901!:mime application/x-freeplane 32902 32903# Type: Scribus 32904# From: Werner Fink <werner@suse.de> 329050 string \<SCRIBUSUTF8\ Version Scribus Document 329060 string \<SCRIBUSUTF8NEW\ Version Scribus Document 32907!:mime application/x-scribus 32908 32909# help files .hlp compiled from html and used by gfxboot added by Joerg Jenderek 32910# markups page=0x04,label=0x12, followed by strings like "opt" or "main" and title=0x14 329110 ulelong&0x8080FFFF 0x00001204 gfxboot compiled html help file 32912 32913# From: Joerg Jenderek 32914# URL: https://en.wikipedia.org/wiki/StarOffice 32915# Note: used in Star-, Open- and Libre-Office 32916# named as soffice.StarConfigFile.6 or OpenOffice.org configuration by others 329170 ubeshort 0x0400 32918#>(2.s+8) ubequad x \b, gap 0x%16.16llx 32919# test for null value in gap after theme name maybe unreliable 32920#>(2.s+9) ubyte 0 \b, 0-byte 32921# look for keyword GALRESRV near the end 32922# "C:\Program Files (x86)\StarOffice6.0\share\gallery\sg27.thm" Navigation, 238 objects 32923#>0 search/8415 GALRESRV \b, GALRESRV found 32924# "neues thema6.thm" MorePictures, 315 objects 32925#>0 search/19299 GALRESRV \b, GALRESRV FOUND 32926#>2 uleshort x \b, name length %u 32927# skip file2147.chk by check for positive name length like for sg16.thm "3D" 32928>2 uleshort >0 StarOffice Gallery theme 32929!:mime application/x-stargallery-thm 32930!:ext thm 32931# gallery name 32932>>2 pstring/h x %s 32933# number of objects 32934>>(2.s+4) ulelong x \b, %u object 32935# plural s 32936>>(2.s+4) ulelong !1 \bs 32937# if available then display first object name 32938>>(2.s+4) ulelong >0 32939# partial file name, URL or internal name like "dd2*" of 1st object or RESRV 32940>>>(2.s+11) pstring/h x \b, 1st %s 32941 32942# From: Joerg Jenderek 32943# URL: http://fileformats.archiveteam.org/wiki/StarOffice_Gallery 32944# Note: used in Star-, Open- and Libre-Office and found in directories like 32945# %APPDATA%\Roaming\LibreOffice\4\user\gallery 32946# $HOME/.config/libreoffice/4/user/gallery 329470 string SGA3 StarOffice Gallery thumbnails 32948# Unknown like 0x04000?0001000142 32949#>4 ubequad x \b, UNKNOWN 0x%16.16llx 32950#!:mime application/x-sdg 32951!:mime application/x-stargallery-sdg 32952!:ext sdg 32953# display image magic for debugging purpose like 'BM' 32954# looking like PC bitmap, Windows 3.x format with unknown compression 32955#>11 string x \b, image magic '%-.2s' 32956# inspect 1st GALLERY thumbnail magic by ./images with 1 space at end 32957#>11 indirect x \b; contains 32958 32959 32960#------------------------------------------------------------------------------ 32961# $File: wsdl,v 1.5 2019/04/19 00:42:27 christos Exp $ 32962# wsdl: PHP WSDL Cache, https://www.php.net/manual/en/book.soap.php 32963# Cache format extracted from source: 32964# https://svn.php.net/viewvc/php/php-src/trunk/ext/soap/php_sdl.c?revision=HEAD&view=markup 32965# Requires file >= 5.05 32966# By Elan Ruusamae <glen@delfi.ee>, Patryk Zawadzki <patrys@pld-linux.org>, 2010-2011 329670 string wsdl PHP WSDL cache, 32968>4 byte x version 0x%02x 32969>6 ledate x \b, created %s 32970 32971# uri 32972>10 lelong <0x7fffffff 32973>>10 pstring/l x \b, uri: "%s" 32974 32975# source 32976>>>&0 lelong <0x7fffffff 32977>>>>&-4 pstring/l x \b, source: "%s" 32978 32979# target_ns 32980>>>>>&0 lelong <0x7fffffff 32981>>>>>>&-4 pstring/l x \b, target_ns: "%s" 32982#------------------------------------------------------------------------------ 32983# x68000: file(1) magic for the Sharp Home Computer 32984# v1.0 32985# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net> 32986 32987# Yanagisawa PIC picture 329880 string PIC 32989>3 search/0x200 \x1A 32990>>&0 search/0x200 \x0 32991>>>&0 ubyte 0 Yanagisawa PIC image file, 32992>>>>&0 ubyte&15 0 model: X68000, 32993>>>>&0 ubyte&15 1 model: PC-88VA, 32994>>>>&0 ubyte&15 2 model: FM-TOWNS, 32995>>>>&0 ubyte&15 3 model: MAC, 32996>>>>&0 ubyte&15 15 model: Generic, 32997>>>>&3 ubeshort x %dx 32998>>>>&5 ubeshort x \b%d, 32999>>>>&1 ubeshort 4 colors: 16 33000>>>>&1 ubeshort 8 colors: 256 33001>>>>&1 ubeshort 12 colors: 4096 33002>>>>&1 ubeshort 15 colors: 32768 33003>>>>&1 ubeshort 16 colors: 65536 33004>>>>&1 ubeshort >16 colors: %d-bit 33005 33006 33007 33008#------------------------------------------------------------------------------ 33009# $File: xdelta,v 1.5 2011/08/08 09:01:05 christos Exp $ 33010# file(1) magic(5) data for xdelta Josh MacDonald <jmacd@CS.Berkeley.EDU> 33011# 330120 string %XDELTA% XDelta binary patch file 0.14 330130 string %XDZ000% XDelta binary patch file 0.18 330140 string %XDZ001% XDelta binary patch file 0.20 330150 string %XDZ002% XDelta binary patch file 1.0 330160 string %XDZ003% XDelta binary patch file 1.0.4 330170 string %XDZ004% XDelta binary patch file 1.1 33018 330190 string \xD6\xC3\xC4\x00 VCDIFF binary diff 33020 33021#------------------------------------------------------------------------------ 33022# $File: xenix,v 1.11 2017/03/17 21:35:28 christos Exp $ 33023# xenix: file(1) magic for Microsoft Xenix 33024# 33025# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small 33026# model" lifted from "magic.xenix", with comment "derived empirically; 33027# treat as folklore until proven" 33028# 33029# "small model", "large model", "huge model" stuff lifted from XXX 33030# 33031# XXX - "x.out" collides with PDP-11 archives 33032# 330330 string core core file (Xenix) 33034# URL: http://www.polarhome.com/service/man/?qf=86rel&tf=2&of=Xenix 33035# Reference: http://www.azillionmonkeys.com/qed/Omfg.pdf 33036# Update: Joerg Jenderek 33037# recordtype~TranslatorHEADerRecord 330380 byte 0x80 33039# GRR: line above is too general as it catches also Extensible storage engine DataBase 33040# skip examples like GENA.SND Switch.Snd by looking for record length maximal 1024-3 33041>1 uleshort <1022 33042# skip examples like GAME.PICTURE Strange.Pic by looking for positiv record length 33043>>1 uleshort >0 33044# skip examples like Xtable.Data FRACTAL.GEN SHR.VIEW by looking for positiv string length 33045>>>3 ubyte >0 33046# skip examples like OMBRE.6 with "UUUUUU" by looking for filename like "hello.c" 33047>>>>4 regex [a-zA-Z_/]{1,8}[.] 8086 relocatable (Microsoft) 33048#!:mime application/octet-stream 33049!:mime application/x-object 33050!:ext o/a 33051>>>>>3 pstring x \b, "%s" 33052# checksum 33053#>>>>>(3.b+4) ubyte x \b, checksum 0x%2.2x 330540 leshort 0xff65 x.out 33055>2 string __.SYMDEF randomized 33056>0 byte x archive 330570 leshort 0x206 Microsoft a.out 33058>8 leshort 1 Middle model 33059>0x1e leshort &0x10 overlay 33060>0x1e leshort &0x2 separate 33061>0x1e leshort &0x4 pure 33062>0x1e leshort &0x800 segmented 33063>0x1e leshort &0x400 standalone 33064>0x1e leshort &0x8 fixed-stack 33065>0x1c byte &0x80 byte-swapped 33066>0x1c byte &0x40 word-swapped 33067>0x10 lelong >0 not-stripped 33068>0x1e leshort ^0xc000 pre-SysV 33069>0x1e leshort &0x4000 V2.3 33070>0x1e leshort &0x8000 V3.0 33071>0x1c byte &0x4 86 33072>0x1c byte &0xb 186 33073>0x1c byte &0x9 286 33074>0x1c byte &0xa 386 33075>0x1f byte <0x040 small model 33076>0x1f byte =0x048 large model 33077>0x1f byte =0x049 huge model 33078>0x1e leshort &0x1 executable 33079>0x1e leshort ^0x1 object file 33080>0x1e leshort &0x40 Large Text 33081>0x1e leshort &0x20 Large Data 33082>0x1e leshort &0x120 Huge Objects Enabled 33083>0x10 lelong >0 not stripped 33084 330850 leshort 0x140 old Microsoft 8086 x.out 33086>0x3 byte &0x4 separate 33087>0x3 byte &0x2 pure 33088>0 byte &0x1 executable 33089>0 byte ^0x1 relocatable 33090>0x14 lelong >0 not stripped 33091 330920 lelong 0x206 b.out 33093>0x1e leshort &0x10 overlay 33094>0x1e leshort &0x2 separate 33095>0x1e leshort &0x4 pure 33096>0x1e leshort &0x800 segmented 33097>0x1e leshort &0x400 standalone 33098>0x1e leshort &0x1 executable 33099>0x1e leshort ^0x1 object file 33100>0x1e leshort &0x4000 V2.3 33101>0x1e leshort &0x8000 V3.0 33102>0x1c byte &0x4 86 33103>0x1c byte &0xb 186 33104>0x1c byte &0x9 286 33105>0x1c byte &0x29 286 33106>0x1c byte &0xa 386 33107>0x1e leshort &0x4 Large Text 33108>0x1e leshort &0x2 Large Data 33109>0x1e leshort &0x102 Huge Objects Enabled 33110 331110 leshort 0x580 XENIX 8086 relocatable or 80286 small model 33112 33113#------------------------------------------------------------------------------ 33114# $File: xilinx,v 1.8 2017/03/17 21:35:28 christos Exp $ 33115# This is Aaron's attempt at a MAGIC file for Xilinx .bit files. 33116# Xilinx-Magic@RevRagnarok.com 33117# Got the info from FPGA-FAQ 0026 33118# 33119# Rewritten to use pstring/H instead of hardcoded lengths by O. Freyermuth, 33120# fixes at least reading of bitfiles from Spartan 2, 3, 6. 33121# http://www.fpga-faq.com/FAQ_Pages/0026_Tell_me_about_bit_files.htm 33122# 33123# First there is the sync header and its length 331240 beshort 0x0009 33125>2 belong =0x0ff00ff0 33126>>&0 belong =0x0ff00ff0 33127>>>&0 byte =0x00 33128>>>&1 beshort =0x0001 33129>>>&3 string a Xilinx BIT data 33130# Next is a Pascal-style string with the NCD name. We want to capture that. 33131>>>>&0 pstring/H x - from %s 33132# And then 'b' 33133>>>>>&1 string b 33134# Then the model / part number: 33135>>>>>>&0 pstring/H x - for %s 33136# Then 'c' 33137>>>>>>>&1 string c 33138# Then the build-date 33139>>>>>>>>&0 pstring/H x - built %s 33140# Then 'd' 33141>>>>>>>>>&1 string d 33142# Then the build-time 33143>>>>>>>>>>&0 pstring/H x \b(%s) 33144# Then 'e' 33145>>>>>>>>>>>&1 string e 33146# And length of data 33147>>>>>>>>>>>>&0 belong x - data length 0x%x 33148 33149# Raw bitstream files 331500 long 0xffffffff 33151>&0 belong 0xaa995566 Xilinx RAW bitstream (.BIN) 33152 33153#------------------------------------------------------------------------------ 33154# $File: xo65,v 1.4 2009/09/19 16:28:13 christos Exp $ 33155# xo65 object files 33156# From: "Ullrich von Bassewitz" <uz@cc65.org> 33157# 331580 string \x55\x7A\x6E\x61 xo65 object, 33159>4 leshort x version %d, 33160>6 leshort&0x0001 =0x0001 with debug info 33161>6 leshort&0x0001 =0x0000 no debug info 33162 33163# xo65 library files 331640 string \x6E\x61\x55\x7A xo65 library, 33165>4 leshort x version %d 33166 33167# o65 object files 331680 string \x01\x00\x6F\x36\x35 o65 33169>6 leshort&0x1000 =0x0000 executable, 33170>6 leshort&0x1000 =0x1000 object, 33171>5 byte x version %d, 33172>6 leshort&0x8000 =0x8000 65816, 33173>6 leshort&0x8000 =0x0000 6502, 33174>6 leshort&0x2000 =0x2000 32 bit, 33175>6 leshort&0x2000 =0x0000 16 bit, 33176>6 leshort&0x4000 =0x4000 page reloc, 33177>6 leshort&0x4000 =0x0000 byte reloc, 33178>6 leshort&0x0003 =0x0000 alignment 1 33179>6 leshort&0x0003 =0x0001 alignment 2 33180>6 leshort&0x0003 =0x0002 alignment 4 33181>6 leshort&0x0003 =0x0003 alignment 256 33182 33183#------------------------------------------------------------------------------ 33184# $File: xwindows,v 1.11 2019/04/19 00:42:27 christos Exp $ 33185# xwindows: file(1) magic for various X/Window system file formats. 33186 33187# Compiled X Keymap 33188# XKM (compiled X keymap) files (including version and byte ordering) 331891 string mkx Compiled XKB Keymap: lsb, 33190>0 byte >0 version %d 33191>0 byte =0 obsolete 331920 string xkm Compiled XKB Keymap: msb, 33193>3 byte >0 version %d 33194>3 byte =0 obsolete 33195 33196# xfsdump archive 331970 string xFSdump0 xfsdump archive 33198>8 belong x (version %d) 33199 33200# Jaleo XFS files 332010 long 395726 Jaleo XFS file 33202>4 long x - version %d 33203>8 long x - [%d - 33204>20 long x \b%dx 33205>24 long x \b%dx 33206>28 long 1008 \bYUV422] 33207>28 long 1000 \bRGB24] 33208 33209# Xcursor data 33210# X11 mouse cursor format defined in libXcursor, see 33211# https://www.x.org/archive/X11R6.8.1/doc/Xcursor.3.html 33212# https://cgit.freedesktop.org/xorg/lib/libXcursor/tree/include/X11/Xcursor/Xcursor.h 332130 string Xcur Xcursor data 33214!:mime image/x-xcursor 33215>10 leshort x version %d 33216>>8 leshort x \b.%d 33217 33218 33219#------------------------------------------------------------------------------ 33220# $File: yara,v 1.3 2019/04/19 00:42:27 christos Exp $ 33221# yara: file(1) magic for https://virustotal.github.io/yara/ 33222# 33223 332240 string YARA 33225>4 lelong >2047 33226>8 byte <20 YARA 3.x compiled rule set 33227# version 33228>>8 clear x 33229>>8 byte 6 created with version 3.3.0 33230>>8 byte 8 created with version 3.4.0 33231>>8 byte 11 created with version 3.5.0 33232>>8 default x 33233>>>8 byte x development version 0x%02x 33234#------------------------------------------------------------------------------ 33235# zfs: file(1) magic for ZFS dumps 33236# 33237# From <rea-fbsd@codelabs.ru> 33238# ZFS dump header has the following structure (as per zfs_ioctl.h 33239# in FreeBSD with drr_type is set to DRR_BEGIN) 33240# 33241# enum { 33242# DRR_BEGIN, DRR_OBJECT, DRR_FREEOBJECTS, 33243# DRR_WRITE, DRR_FREE, DRR_END, 33244# } drr_type; 33245# uint32_t drr_pad; 33246# uint64_t drr_magic; 33247# uint64_t drr_version; 33248# uint64_t drr_creation_time; 33249# dmu_objset_type_t drr_type; 33250# uint32_t drr_pad; 33251# uint64_t drr_toguid; 33252# uint64_t drr_fromguid; 33253# char drr_toname[MAXNAMELEN]; 33254# 33255# Backup magic is 0x00000002f5bacbac (quad word) 33256# The drr_type is defined as 33257# typedef enum dmu_objset_type { 33258# DMU_OST_NONE, 33259# DMU_OST_META, 33260# DMU_OST_ZFS, 33261# DMU_OST_ZVOL, 33262# DMU_OST_OTHER, /* For testing only! */ 33263# DMU_OST_ANY, /* Be careful! */ 33264# DMU_OST_NUMTYPES 33265# } dmu_objset_type_t; 33266# 33267# Almost all uint64_t fields are printed as the 32-bit ones (with high 33268# 32 bits zeroed), because there is no simple way to print them as the 33269# full 64-bit values. 33270 33271# Big-endian values 332728 string \000\000\000\002\365\272\313\254 ZFS shapshot (big-endian machine), 33273>20 belong x version %u, 33274>32 belong 0 type: NONE, 33275>32 belong 1 type: META, 33276>32 belong 2 type: ZFS, 33277>32 belong 3 type: ZVOL, 33278>32 belong 4 type: OTHER, 33279>32 belong 5 type: ANY, 33280>32 belong >5 type: UNKNOWN (%u), 33281>40 byte x destination GUID: %02X 33282>41 byte x %02X 33283>42 byte x %02X 33284>43 byte x %02X 33285>44 byte x %02X 33286>45 byte x %02X 33287>46 byte x %02X 33288>47 byte x %02X, 33289>48 ulong >0 33290>>52 ulong >0 33291>>>48 byte x source GUID: %02X 33292>>>49 byte x %02X 33293>>>50 byte x %02X 33294>>>51 byte x %02X 33295>>>52 byte x %02X 33296>>>53 byte x %02X 33297>>>54 byte x %02X 33298>>>55 byte x %02X, 33299>56 string >\0 name: '%s' 33300 33301# Little-endian values 333028 string \254\313\272\365\002\000\000\000 ZFS shapshot (little-endian machine), 33303>16 lelong x version %u, 33304>32 lelong 0 type: NONE, 33305>32 lelong 1 type: META, 33306>32 lelong 2 type: ZFS, 33307>32 lelong 3 type: ZVOL, 33308>32 lelong 4 type: OTHER, 33309>32 lelong 5 type: ANY, 33310>32 lelong >5 type: UNKNOWN (%u), 33311>47 byte x destination GUID: %02X 33312>46 byte x %02X 33313>45 byte x %02X 33314>44 byte x %02X 33315>43 byte x %02X 33316>42 byte x %02X 33317>41 byte x %02X 33318>40 byte x %02X, 33319>48 ulong >0 33320>>52 ulong >0 33321>>>55 byte x source GUID: %02X 33322>>>54 byte x %02X 33323>>>53 byte x %02X 33324>>>52 byte x %02X 33325>>>51 byte x %02X 33326>>>50 byte x %02X 33327>>>49 byte x %02X 33328>>>48 byte x %02X, 33329>56 string >\0 name: '%s' 33330 33331#------------------------------------------------------------------------------ 33332# $File: zilog,v 1.7 2009/09/19 16:28:13 christos Exp $ 33333# zilog: file(1) magic for Zilog Z8000. 33334# 33335# Was it big-endian or little-endian? My Product Specification doesn't 33336# say. 33337# 333380 long 0xe807 object file (z8000 a.out) 333390 long 0xe808 pure object file (z8000 a.out) 333400 long 0xe809 separate object file (z8000 a.out) 333410 long 0xe805 overlay object file (z8000 a.out) 33342#------------------------------------------------------------------------------ 33343# $File: zip,v 1.4 2020/03/03 13:46:52 christos Exp $ 33344# zip: file(1) magic for zip files; this is not use 33345# Note the version of magic in archive is currently stronger, this is 33346# just an example until negative offsets are supported better 33347 33348# Zip Central Directory record 333490 name zipcd 33350>0 string PK\001\002 Zip archive data 33351>>4 leshort x \b, made by 33352>>4 use zipversion 33353>>4 use ziphost 33354>>6 leshort x \b, extract using at least 33355>>6 use zipversion 33356>>12 ledate x \b, last modified %s 33357>>24 lelong >0 \b, uncompressed size %d 33358>>10 leshort x \b, method= 33359>>10 use zipcompression 33360 33361# URL: https://en.wikipedia.org/wiki/Zip_(file_format) 33362# reference: https://pkware.cachefly.net/webdocs/APPNOTE/APPNOTE-6.3.6.TXT 33363# Zip known compressions 333640 name zipcompression 33365>0 leshort 0 \bstore 33366>0 leshort 1 \bShrinking 33367>0 leshort 6 \bImploding 33368>0 leshort 7 \bTokenizing 33369>0 leshort 8 \bdeflate 33370>0 leshort 9 \bdeflate64 33371>0 leshort 10 \bLibrary imploding 33372#>0 leshort 11 \bReserved by PKWARE 33373>0 leshort 12 \bbzip2 33374#>0 leshort 13 \bReserved by PKWARE 33375>0 leshort 14 \blzma 33376#>0 leshort 15 \bReserved by PKWARE 33377>0 leshort 16 \bCMPSC Compression 33378#>0 leshort 17 \bReserved by PKWARE 33379>0 leshort 18 \bIBM TERSE 33380>0 leshort 19 \bIBM LZ77 33381# https://support.winzip.com/hc/en-us/articles/115012122828-Compression-method-used-for-this-file-is-94 33382>0 leshort 94 \bMP3 33383>0 leshort 95 \bxz 33384>0 leshort 96 \bJpeg 33385>0 leshort 97 \bWavPack 33386>0 leshort 98 \bPPMd 33387>0 leshort 99 \bAES Encrypted 33388>0 default x 33389>>0 leshort x \b[%#x] 33390 33391# Zip known versions 333920 name zipversion 33393# The lower byte indicates the ZIP version of this file. The value/10 indicates 33394# the major version number, and the value mod 10 is the minor version number. 33395>0 ubyte/10 x v%u 33396>0 ubyte%10 x \b.%u 33397# >0 leshort 0x09 v0.9 33398# >0 leshort 0x0a v1.0 33399# >0 leshort 0x0b v1.1 33400# >0 leshort 0x14 v2.0 33401# >0 leshort 0x15 v2.1 33402# >0 leshort 0x19 v2.5 33403# >0 leshort 0x1b v2.7 33404# >0 leshort 0x2d v4.5 33405# >0 leshort 0x2e v4.6 33406# >0 leshort 0x32 v5.0 33407# >0 leshort 0x33 v5.1 33408# >0 leshort 0x34 v5.2 33409# >0 leshort 0x3d v6.1 33410# >0 leshort 0x3e v6.2 33411# >0 leshort 0x3f v6.3 33412# >0 default x 33413# >>0 leshort x v?[%#x] 33414 33415# display compatible host system name of ZIP archive 334160 name ziphost 33417# The upper byte indicates the compatibility of the file attribute information. 33418# If the file is compatible with MS-DOS (v 2.04g) then this value will be zero. 33419#>1 ubyte 0 DOS 33420>1 ubyte 1 Amiga 33421>1 ubyte 2 OpenVMS 33422>1 ubyte 3 UNIX 33423>1 ubyte 4 VM/CMS 33424>1 ubyte 6 OS/2 33425>1 ubyte 7 Macintosh 33426>1 ubyte 11 MVS 33427>1 ubyte 13 Acorn Risc 33428>1 ubyte 16 BeOS 33429>1 ubyte 17 Tandem 33430# 9 untested 33431>1 ubyte 5 Atari ST 33432>1 ubyte 8 Z-System 33433>1 ubyte 9 CP/M 33434>1 ubyte 10 Windows NTFS 33435>1 ubyte 12 VSE 33436>1 ubyte 14 VFAT 33437>1 ubyte 15 alternate MVS 33438>1 ubyte 18 OS/400 33439>1 ubyte 19 OS X 33440# unused 33441#>1 ubyte >19 unused 0x%x 33442 33443# Zip End Of Central Directory record 33444-22 string PK\005\006 33445#>4 leshort >1 \b, %d disks 33446#>6 leshort >1 \b, central directory disk %d 33447#>8 leshort >1 \b, %d central directories on this disk 33448#>10 leshort >1 \b, %d central directories 33449#>12 lelong x \b, %d central directory bytes 33450>(16.l) use zipcd 33451>>20 pstring/l >0 \b, %s 33452 33453#------------------------------------------------------------------------------ 33454# $File: zyxel,v 1.6 2009/09/19 16:28:13 christos Exp $ 33455# zyxel: file(1) magic for ZyXEL modems 33456# 33457# From <rob@pe1chl.ampr.org> 33458# These are the /etc/magic entries to decode datafiles as used for the 33459# ZyXEL U-1496E DATA/FAX/VOICE modems. (This header conforms to a 33460# ZyXEL-defined standard) 33461 334620 string ZyXEL\002 ZyXEL voice data 33463>10 byte 0 - CELP encoding 33464>10 byte&0x0B 1 - ADPCM2 encoding 33465>10 byte&0x0B 2 - ADPCM3 encoding 33466>10 byte&0x0B 3 - ADPCM4 encoding 33467>10 byte&0x0B 8 - New ADPCM3 encoding 33468>10 byte&0x04 4 with resync 33469
