1# Magic data for file(1) command.
2# Format is described in magic(files), where:
3# files is 5 on V7 and BSD, 4 on SV, and ?? on SVID.
4# Don't edit this file, edit /etc/magic or send your magic improvements
5# to the maintainers, at file@astron.com
6
7#------------------------------------------------------------------------------
8# Localstuff:  file(1) magic for locally observed files
9#
10# $File: Localstuff,v 1.5 2007/01/12 17:38:27 christos Exp $
11# Add any locally observed files here.  Remember:
12# text if readable, executable if runnable binary, data if unreadable.
13
14#------------------------------------------------------------------------------
15# $File: acorn,v 1.7 2019/04/19 00:42:27 christos Exp $
16# acorn:  file(1) magic for files found on Acorn systems
17#
18
19# RISC OS Chunk File Format
20# From RISC OS Programmer's Reference Manual, Appendix D
21# We guess the file type from the type of the first chunk.
220	lelong		0xc3cbc6c5	RISC OS Chunk data
23>12	string		OBJ_		\b, AOF object
24>12	string		LIB_		\b, ALF library
25
26# RISC OS AIF, contains "SWI OS_Exit" at offset 16.
2716	lelong		0xef000011	RISC OS AIF executable
28
29# RISC OS Draw files
30# From RISC OS Programmer's Reference Manual, Appendix E
310	string 		Draw		RISC OS Draw file data
32
33# RISC OS new format font files
34# From RISC OS Programmer's Reference Manual, Appendix E
350	string		FONT\0		RISC OS outline font data,
36>5	byte		x		version %d
370	string		FONT\1		RISC OS 1bpp font data,
38>5	byte		x		version %d
390	string		FONT\4		RISC OS 4bpp font data
40>5	byte		x		version %d
41
42# RISC OS Music files
43# From RISC OS Programmer's Reference Manual, Appendix E
440	string		Maestro\r	RISC OS music file
45>8	byte		x		version %d
46
47>8	byte		x		type %d
48
49# Digital Symphony data files
50# From: Bernard Jungen (bern8817@euphonynet.be)
510		string	\x02\x01\x13\x13\x13\x01\x0d\x10	Digital Symphony sound sample (RISC OS),
52>8		byte	x	version %d,
53>9		pstring	x	named "%s",
54>(9.b+19)	byte	=0	8-bit logarithmic
55>(9.b+19)	byte	=1	LZW-compressed linear
56>(9.b+19)	byte	=2	8-bit linear signed
57>(9.b+19)	byte	=3	16-bit linear signed
58>(9.b+19)	byte	=4	SigmaDelta-compressed linear
59>(9.b+19)	byte	=5	SigmaDelta-compressed logarithmic
60>(9.b+19)	byte	>5	unknown format
61
620	string	\x02\x01\x13\x13\x14\x12\x01\x0b	Digital Symphony song (RISC OS),
63>8	byte	x	version %d,
64>9	byte	=1	1 voice,
65>9	byte	!1	%d voices,
66>10	leshort	=1	1 track,
67>10	leshort	!1	%d tracks,
68>12	leshort	=1	1 pattern
69>12	leshort	!1	%d patterns
70
710	string	\x02\x01\x13\x13\x10\x14\x12\x0e
72>9	byte	=0	Digital Symphony sequence (RISC OS),
73>>8	byte	x	version %d,
74>>10	byte	=1	1 line,
75>>10	byte	!1	%d lines,
76>>11	leshort	=1	1 position
77>>11	leshort	!1	%d positions
78>9	byte	=1	Digital Symphony pattern data (RISC OS),
79>>8	byte	x	version %d,
80>>10	leshort	=1	1 pattern
81>>10	leshort	!1	%d patterns
82
83# From: Joerg Jenderek
84# URL: https://www.kyzer.me.uk/pack/xad/#PackDir
85# reference: https://www.kyzer.me.uk/pack/xad/xad_PackDir.lha/PackDir.c
86# GRR: line below is too general as it matches also "Git pack" in ./revision
870	string	PACK\0
88# check for valid compression method 0-4
89>5	ulelong	<5
90# https://www.riscosopen.org/wiki/documentation/show/Introduction%20To%20Filing%20Systems
91# To skip "Git pack" version 0 test for root directory object like
92# ADFS::RPC.$.websitezip.FONTFIX
93>>9	string	>ADFS\  PackDir archive (RISC OS)
94# TrID labels above as "Acorn PackDir compressed Archive"
95# compression mode y (0 - 4) for GIF LZW with a maximum n bits
96# (y~n,0~12,1~13,2~14,3~15,4~16)
97>>>5	ulelong+12 x	\b, LZW %u-bits compression
98# https://www.filebase.org.uk/filetypes
99# !Packdir compressed archive has three hexadecimal digits code 68E
100!:mime	application/x-acorn-68E
101!:ext	pkd/bin
102# null terminated root directory object like IDEFS::IDE-4.$.Apps.GRAPHICS.!XFMPdemo
103>>>9	string	x	\b, root "%s"
104# load address 0xFFFtttdd, ttt is the object filetype and dddddddddd is time
105>>>>&1	ulelong	x	\b, load address 0x%x
106# execution address 0xdddddddd dddddddddd is 40 bit unsigned centiseconds since 1.1.1900 UTC
107>>>>&5	ulelong	x	\b, exec address 0x%x
108# attributes (bits: 0~owner read,1~owner write,3~no delete,4~public read,5~public write)
109>>>>&9	ulelong	x	\b, attributes 0x%x
110# number of entries in this directory. for root dir 0
111#>>>&13	ulelong	x	\b, entries 0x%x
112# the entries start here with object name
113>>>>&17	string	x	\b, 1st object "%s"
114
115
116#------------------------------------------------------------------------------
117# $File: adi,v 1.4 2009/09/19 16:28:07 christos Exp $
118# adi: file(1) magic for ADi's objects
119# From Gregory McGarry <g.mcgarry@ieee.org>
120#
1210	leshort		0x521c		COFF DSP21k
122>18	lelong		&02		executable,
123>18	lelong		^02
124>>18	lelong		&01		static object,
125>>18	lelong		^01		relocatable object,
126>18	lelong		&010		stripped
127>18	lelong		^010		not stripped
128
129#------------------------------------------------------------------------------
130# $File: adventure,v 1.18 2019/04/19 00:42:27 christos Exp $
131# adventure: file(1) magic for Adventure game files
132#
133# from Allen Garvin <earendil@faeryland.tamu-commerce.edu>
134# Edited by Dave Chapeskie <dchapes@ddm.on.ca> Jun 28, 1998
135# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
136#
137# ALAN
138# I assume there are other, lower versions, but these are the only ones I
139# saw in the archive.
1400	beshort	0x0206	ALAN game data
141>2	byte	<10	version 2.6%d
142
143
144# Infocom (see z-machine)
145#------------------------------------------------------------------------------
146# Z-machine:  file(1) magic for Z-machine binaries.
147# Sanity checks by David Griffith <dave@661.org>
148# Updated by Adam Buchbinder <adam.buchbinder@gmail.com>
149#
150#http://www.gnelson.demon.co.uk/zspec/sect11.html
151#https://www.jczorkmid.net/~jpenney/ZSpec11-latest.txt
152#https://en.wikipedia.org/wiki/Z-machine
153# The first byte is the Z-machine revision; it is always between 1 and 8. We
154# had false matches (for instance, inbig5.ocp from the Omega TeX extension as
155# well as an occasional MP3 file), so we sanity-check the version number.
156#
157# It might be possible to sanity-check the release number as well, as it seems
158# (at least in classic Infocom games) to always be a relatively small number,
159# always under 150 or so, but as this isn't rigorous, we'll wait on that until
160# it becomes clear that it's needed.
161#
1620	ubyte			>0
163>0	ubyte			<9
164>>16	belong&0xfe00f0f0	0x3030
165>>>0	ubyte			< 10
166>>>>2	ubeshort		x
167>>>>>18	regex			[0-9][0-9][0-9][0-9][0-9][0-9]
168>>>>>>0	ubyte			< 10	Infocom (Z-machine %d
169>>>>>>>2	ubeshort	x 	\b, Release %d
170>>>>>>>>18	string		>\0	\b, Serial %.6s
171>>>>>>>>18	string		x	\b)
172!:strength + 40
173!:mime	application/x-zmachine
174
175#------------------------------------------------------------------------------
176# Glulx:  file(1) magic for Glulx binaries.
177#
178# David Griffith <dave@661.org>
179# I haven't checked for false matches yet.
180#
1810	string			Glul	Glulx game data
182>4	beshort			x	(Version %d
183>>6	byte			x	\b.%d
184>>8	byte			x	\b.%d)
185>36	string			Info	Compiled by Inform
186!:mime	application/x-glulx
187
188
189# For Quetzal and blorb magic see iff
190
191
192# TADS (Text Adventure Development System) version 2
193#  All files are machine-independent (games compile to byte-code) and are tagged
194#  with a version string of the form "V2.<digit>.<digit>\0".
195#  Game files start with "TADS2 bin\n\r\032\0" then the compiler version.
1960	string	TADS2\ bin	TADS
197>9	belong  !0x0A0D1A00	game data, CORRUPTED
198>9	belong	 0x0A0D1A00
199>>13	string	>\0		%s game data
200!:mime	application/x-tads
201#  Resource files start with "TADS2 rsc\n\r\032\0" then the compiler version.
2020	string	TADS2\ rsc	TADS
203>9	belong  !0x0A0D1A00	resource data, CORRUPTED
204>9	belong	 0x0A0D1A00
205>>13	string	>\0		%s resource data
206!:mime	application/x-tads
207#  Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian
208#  2-byte length N, the N-char name of the game file *without* a NUL (darn!),
209# "TADS2 save\n\r\032\0" and the interpreter version.
2100	string	TADS2\ save/g	TADS
211>12	belong	!0x0A0D1A00	saved game data, CORRUPTED
212>12	belong	 0x0A0D1A00
213>>(16.s+32) string >\0		%s saved game data
214!:mime	application/x-tads
215#  Other saved game files start with "TADS2 save\n\r\032\0" and the interpreter
216#  version.
2170	string	TADS2\ save	TADS
218>10	belong	!0x0A0D1A00	saved game data, CORRUPTED
219>10	belong	 0x0A0D1A00
220>>14	string	>\0		%s saved game data
221!:mime	application/x-tads
222
223# TADS (Text Adventure Development System) version 3
224#  Game files start with "T3-image\015\012\032"
2250	string	T3-image\015\012\032
226>11	leshort	x		TADS 3 game data (format version %d)
227#  Saved game files start with "T3-state-v####\015\012\032"
228#  where #### is a format version number
2290	string	T3-state-v
230>14	string	\015\012\032	TADS 3 saved game data (format version
231>>10	byte	x		%c
232>>11	byte	x		\b%c
233>>12	byte	x		\b%c
234>>13	byte	x		\b%c)
235!:mime	application/x-t3vm-image
236
237# edited by David Griffith <dave@661.org>
238# Danny Milosavljevic <danny.milo@gmx.net>
239# These are ADRIFT (adventure game standard) game files, extension .taf
240# Checked from source at (http://www.adrift.co/) and various taf files
241# found at the Interactive Fiction Archive (https://ifarchive.org/)
2420	belong  0x3C423FC9
243>4	belong  0x6A87C2CF	Adrift game file version
244>>8	belong  0x94453661	3.80
245>>8	belong  0x94453761	3.90
246>>8	belong  0x93453E61	4.0
247>>8	belong  0x92453E61	5.0
248>>8	default x		unknown
249!:mime	application/x-adrift
250
251#------------------------------------------------------------------------------
252# $File: aes,v 1.1 2020/08/18 21:20:22 christos Exp $
253#
254# aes: magic file for AES encrypted files
255
256# Summary:	AES Crypt Encrypted Data File
257# From:		Joerg Jenderek
258# URL:		https://en.wikipedia.org/wiki/Advanced_Encryption_Standard
259# Reference:	https://www.aescrypt.com/aes_file_format.html
2600	string		AES
261>3	ubyte		<3		AES encrypted data, version %u
262#!:mime	application/aes
263!:mime	application/x-aes-encrypted
264!:ext	aes
265# For Version 2 the encrypted file can have text tags
266>>3	ubyte		=2
267# length of an extension identifier and contents like: 0 24 33 38
268#>>5	ubeshort	x		\b, tag length %u
269#>>5	pstring/H	x		'%s'
270# standard extension tags like CREATED_BY
271>>>7	string		CREATED_BY	\b, created by
272# software product, manufacturer like "SharpAESCrypt v1.3.3.0" "aescrypt (Windows GUI) 3.10" ...
273>>>>&1	string		x		"%s"
274# TODO: more other tags
275# tag CREATED_DATE like YYYY-MM-DD
276# tag CREATED_TIME like HH:MM:SS
277#
278
279
280#------------------------------------------------------------------------------
281# $File: algol68,v 1.3 2018/10/19 01:04:21 christos Exp $
282# algol68:  file(1) magic for Algol 68 source
283#
2840	search/8192	(input,			Algol 68 source text
285!:mime	text/x-Algol68
2860	regex/1024	\^PROC			Algol 68 source text
287!:mime	text/x-Algol68
2880	regex/1024	\bMODE[\t\ ]		Algol 68 source text
289!:mime	text/x-Algol68
2900	regex/1024	\bREF[\t\ ]		Algol 68 source text
291!:mime	text/x-Algol68
2920	regex/1024	\bFLEX[\t\ ]\*\\[	Algol 68 source text
293!:mime	text/x-Algol68
294#0	regex          	[\t\ ]OD		Algol 68 source text
295#!:mime	text/x-Algol68
296#0	regex          	[\t\ ]FI		Algol 68 source text
297#!:mime	text/x-Algol68
298
299#------------------------------------------------------------------------------
300# $File: allegro,v 1.4 2009/09/19 16:28:07 christos Exp $
301# allegro:  file(1) magic for Allegro datafiles
302# Toby Deshane <hac@shoelace.digivill.net>
303#
3040 belong 0x736C6821   Allegro datafile (packed)
3050 belong 0x736C682E   Allegro datafile (not packed/autodetect)
3060 belong 0x736C682B   Allegro datafile (appended exe data)
307
308#------------------------------------------------------------------------------
309# $File: alliant,v 1.7 2009/09/19 16:28:07 christos Exp $
310# alliant:  file(1) magic for Alliant FX series a.out files
311#
312# If the FX series is the one that had a processor with a 68K-derived
313# instruction set, the "short" should probably become "beshort" and the
314# "long" should probably become "belong".
315# If it's the i860-based one, they should probably become either the
316# big-endian or little-endian versions, depending on the mode they ran
317# the 860 in....
318#
3190	short		0420		0420 Alliant virtual executable
320>2	short		&0x0020		common library
321>16	long		>0		not stripped
3220	short		0421		0421 Alliant compact executable
323>2	short		&0x0020		common library
324>16	long		>0		not stripped
325
326#------------------------------------------------------------------------------
327# $File: amanda,v 1.6 2017/03/17 21:35:28 christos Exp $
328# amanda:  file(1) magic for amanda file format
329#
3300	string	AMANDA:\ 		AMANDA
331>8	string	TAPESTART\ DATE		tape header file,
332>>23	string	X
333>>>25	string	>\ 			Unused %s
334>>23	string	>\ 			DATE %s
335>8	string	FILE\ 			dump file,
336>>13	string	>\ 			DATE %s
337
338#------------------------------------------------------------------------------
339# $File: amigaos,v 1.18 2020/08/02 16:42:00 christos Exp $
340# amigaos:  file(1) magic for AmigaOS binary formats:
341
342#
343# From ignatios@cs.uni-bonn.de (Ignatios Souvatzis)
344#
3450	belong		0x000003fa	AmigaOS shared library
3460	belong		0x000003f3	AmigaOS loadseg()ble executable/binary
3470	belong		0x000003e7	AmigaOS object/library data
348#
3490	beshort		0xe310		Amiga Workbench
350>2	beshort		1
351>>48	byte		1		disk icon
352>>48	byte		2		drawer icon
353>>48	byte		3		tool icon
354>>48	byte		4		project icon
355>>48	byte		5		garbage icon
356>>48	byte		6		device icon
357>>48	byte		7		kickstart icon
358>>48	byte		8		workbench application icon
359>2	beshort		>1		icon, vers. %d
360#
361# various sound formats from the Amiga
362# G=F6tz Waschk <waschk@informatik.uni-rostock.de>
363#
3640	string		FC14		Future Composer 1.4 Module sound file
3650	string		SMOD		Future Composer 1.3 Module sound file
3660	string		AON4artofnoise	Art Of Noise Module sound file
3671	string		MUGICIAN/SOFTEYES Mugician Module sound file
36858	string		SIDMON\ II\ -\ THE	Sidmon 2.0 Module sound file
3690	string		Synth4.0	Synthesis Module sound file
3700	string		ARP.		The Holy Noise Module sound file
3710	string		BeEp\0		JamCracker Module sound file
3720	string		COSO\0		Hippel-COSO Module sound file
373# Too simple (short, pure ASCII, deep), MPi
374#26	string		V.3		Brian Postma's Soundmon Module sound file v3
375#26	string		BPSM		Brian Postma's Soundmon Module sound file v3
376#26	string		V.2		Brian Postma's Soundmon Module sound file v2
377
378# The following are from: "Stefan A. Haubenthal" <polluks@web.de>
3790	beshort		0x0f00		AmigaOS bitmap font
3800	beshort		0x0f03		AmigaOS outline font
3810	belong		0x80001001	AmigaOS outline tag
3820	string		##\ version	catalog translation
3830	string		EMOD\0		Amiga E module
3848	string		ECXM\0		ECX module
3850	string/c	@database	AmigaGuide file
386
387# Amiga disk types
388#	display information like volume name of root block on Amiga (floppy) disk
3890	name   	adf-rootblock
390# block primary type = T_HEADER (value 2)
391>0x000	ubelong		!2		\b, type %u
392# header_key; unused in rootblock (value 0)
393>0x004	ubelong		!0		\b, header_key %u
394# high_seq; unused (value 0)
395>0x008	ubelong		!0		\b, high_seq %u
396# ht_size; hash table size; 0x48 for flopies
397>0x00c	ubelong		!0x48		\b, hash table size 0x%x
398# bm_flag; bitmap flag, -1 means VALID
399>0x138	belong		!-1		\b, bitmap flag 0x%x
400# bm_ext; first bitmap extension block (Hard disks only)
401>0x1A0	ubelong		!0		\b, bitmap extension block 0x%x
402# name_len; volume name length; diskname[30]; volume name
403>0x1B0	pstring		>\0		\b, "%s"
404# first directory cache block for FFS; otherwise 0
405>0x1F8	ubelong		!0		\b, directory cache block 0x%x
406# block secondary type = ST_ROOT (value 1)
407>0x1FC	ubelong		!1		\b, sec_type 0x%x
408#
4090	string		RDSK		Rigid Disk Block
410>160	string		x		on %.24s
411# URL:		http://fileformats.archiveteam.org/wiki/ADF_(Amiga)
412#		https://en.wikipedia.org/wiki/Amiga_Fast_File_System
413# Reference:	http://lclevy.free.fr/adflib/adf_info.html
414# Update:	Joerg Jenderek
415# Note:		created by ADFOpus.exe
416# 		and verified by `unadf -l TURBO_SILVER_SV.ADF`
4170	string		DOS
418# skip DOS Client Message Files like IPXODI.MSG DOSRQSTR.MSG
419>3	ubyte		<8		Amiga
420# https://reposcope.com/mimetype/application/x-amiga-disk-format
421!:mime	application/x-amiga-disk-format
422!:ext	adf
423>>3	ubyte		0		DOS disk
424>>3	ubyte		1		FFS disk
425>>3	ubyte		2		Inter DOS disk
426>>3	ubyte		3		Inter FFS disk
427# For Fastdir mode the international mode is also enabled,
428>>3	ubyte		4		Fastdir DOS disk
429>>3	ubyte		5		Fastdir FFS dis
430# called by TrID "Amiga Disk image File (OFS+INTL+DIRC)"
431>>3	ubyte		6		Inter Fastdir DOS disk
432# called by TrID "Amiga Disk image File (FFS+INTL+DIRC)"
433>>3	ubyte		7		Inter Fastdir FFS disk
434# but according to Wikipedia variants with long name support
435#>>3	ubyte		6		long name DOS disk
436#>>3	ubyte		7		long name FFS disk
437# DOES NOT only work! Partly for file size  ~< FILE_BYTES_MAX=1 MiB defined in ../../src/file.h
438#>>-0		offset	x		\b, %lld bytes
439# Correct file size, but next lines are NOT executed
440#>>-0		offset	901120		(DD 880 KiB floppy)
441# 880 KiB Double Density floppy disk by characteristic hash table size 0x48 and T_HEADER=2
442>>0x6E00C	ubelong	0x48
443>>>0x6E000	ubelong	2		(DD 880 KiB)
444# 1760 KiB High Density floppy disk (1802240 bytes) by characteristic hash table size 0x48
445>>0xDC00C	ubelong	0x48
446>>>0xDC000	ubelong	2		(HD 1760 KiB)
447# Chksum; special block checksum like: 0 0x44ccf4c0 0x51f32cac 0xe33d0e7d ...
448#>>4	ubelong		x		\b, CRC 0x%x
449# Rootblock: 0 880 (often for DD and HD) 1146049280 (IMAGINE_1_0_DISK_01.ADF TURBO_SILVER_SV.ADF)
450>>8	ubelong		>0		\b, probably root block %d
451# bootblock code
452>>12	quad		!0		\b, bootable
453# assembler instructions: lea exp(pc),a1; moveq 25h,d0; jsr -552(a6)
454>>>12	ubequad	=0x43fa003e70254eae	AmigaDOS 3.0
455>>>12	default	x
456>>>>12	ubequad	!0x43fa003e70254eae	0x%llx..
457# 880 KiB Double Density floppy disk (901120 bytes)
458>>0x6E00C	ubelong	0x48
459>>>0x6E000	ubelong	2
460>>>>0x6E000	use			adf-rootblock
461# 1760 KiB High Density floppy disk (1802240 bytes)
462>>0xDC00C	ubelong	0x48
463>>>0xDC000	ubelong	2
464>>>>0xDC000	use			adf-rootblock
465# 1 MiB hard disc by test for T_HEADER=2 and header_key=0=high_seq
466>>0x80000	ubelong	2
467>>>0x80004	quad	0
468>>>>0x80000	use			adf-rootblock
469# 2 MiB hard disc; only works if in ../../src/file.h FILE_BYTES_MAX is raised to 2 MiB
470#>>0x100000	ubelong	x		2 MiB TEST
471#>>0x100000	ubelong	2		\b, 2 MiB hard disc rootblock
472#>>>0x100000	use			adf-rootblock
4730	string		KICK		Kickstart disk
474
475# From: Alex Beregszaszi <alex@fsn.hu>
4760	string		LZX		LZX compressed archive (Amiga)
477
478# From: Przemek Kramarczyk <pkramarczyk@gmail.com>
4790	string 		.KEY		AmigaDOS script
4800	string 		.key		AmigaDOS script
481
482# AMOS Basic file formats
483# https://www.exotica.org.uk/wiki/AMOS_file_formats
4840	string		AMOS\040Basic\040 	AMOS Basic source code
485>11	byte		=0x56 			\b, tested
486>11	byte		=0x76 			\b, untested
4870 	string		AMOS\040Pro		AMOS Basic source code
488>11	byte		=0x56 			\b, tested
489>11	byte		=0x76 			\b, untested
4900	string		AmSp			AMOS Basic sprite bank
491>4	beshort		x			\b, %d sprites
4920	string		AmIc			AMOS Basic icon bank
493>4	beshort		x			\b, %d icons
4940	string		AmBk			AMOS Basic memory bank
495>4	beshort		x			\b, bank number %d
496>8	belong&0xFFFFFFF	x		\b, length %d
497>12	regex		.{8}			\b, type %s
4980	string		AmBs			AMOS Basic memory banks
499>4	beshort		x			\b, %d banks
500
501#------------------------------------------------------------
502# $File: android,v 1.18 2021/02/23 00:51:10 christos Exp $
503# Various android related magic entries
504#------------------------------------------------------------
505
506# Dalvik .dex format. http://retrodev.com/android/dexformat.html
507# From <mkf@google.com> "Mike Fleming"
508# Fixed to avoid regexec 17 errors on some dex files
509# From <diff@lookout.com> "Tim Strazzere"
5100	string	dex\n
511>0	regex	dex\n[0-9]{2}\0	Dalvik dex file
512>4	string	>000			version %s
5130	string	dey\n
514>0	regex	dey\n[0-9]{2}\0	Dalvik dex file (optimized for host)
515>4	string	>000			version %s
516
517# Android bootimg format
518# From https://android.googlesource.com/\
519# platform/system/core/+/master/mkbootimg/bootimg.h
520# https://github.com/djrbliss/loki/blob/master/loki.h#L43
5210		string	ANDROID!	Android bootimg
522>1024	string	LOKI		\b, LOKI'd
523>>1028	lelong	0			\b (boot)
524>>1028	lelong	1			\b (recovery)
525>8		lelong	>0			\b, kernel
526>>12	lelong	>0			\b (0x%x)
527>16		lelong	>0			\b, ramdisk
528>>20	lelong	>0			\b (0x%x)
529>24		lelong	>0			\b, second stage
530>>28	lelong	>0			\b (0x%x)
531>36		lelong	>0			\b, page size: %d
532>38		string	>0			\b, name: %s
533>64		string	>0		 	\b, cmdline (%s)
534
535# Android Backup archive
536# From: Ariel Shkedi
537# Update: Joerg Jenderek
538# URL: https://github.com/android/platform_frameworks_base/blob/\
539# 0bacfd2ba68d21a68a3df345b830bc2a1e515b5a/services/java/com/\
540# android/server/BackupManagerService.java#L2367
541# Reference: https://sourceforge.net/projects/adbextractor/
542#            android-backup-extractor/perl/backupencrypt.pl
543# Note:	only unix line feeds "\n" found
544# After the header comes a tar file
545# If compressed, the entire tar file is compressed with JAVA deflate
546#
547# Include the version number hardcoded with the magic string to avoid
548# false positives
5490	string/b	ANDROID\ BACKUP\n	Android Backup
550# maybe look for some more characteristics like linefeed '\n' or version
551#>16	string		\n
552# No mime-type defined officially
553!:mime	application/x-google-ab
554!:ext	ab
555# on 2nd line version (often 1, 2 on kitkat 4.4.3+, 4 on 7.1.2)
556>15	string		>\0			\b, version %s
557# "1" on 3rd line means compressed
558>17	string		0\n			\b, Not-Compressed
559>17	string		1\n			\b, Compressed
560# The 4th line is encryption "none" or "AES-256"
561# any string as long as it's not the word none (which is matched below)
562>19	string		none\n			\b, Not-Encrypted
563# look for backup content after line with encryption info
564#>>19	search/7	\n
565# data part after header for not encrypted Android Backup
566#>>>&0	ubequad		x	\b, content 0x%16.16llx...
567# look for zlib compressed by ./compress after message with 1 space at end
568#>>>&0	indirect	x	\b; contains
569# look for tar archive block by ./archive for package name manifest
570>>288	string		ustar	\b; contains
571>>>31	use	tar-file
572# look for zip/jar archive by ./archive ./zip after message with 1 space at end
573#>>2079	search/1025/s	PK\003\004	\b; contains
574#>>>&0	indirect	x
575>19	string		!none
576>>19    regex/1l	\^([^n\n]|n[^o]|no[^n]|non[^e]|none.+).*	\b, Encrypted (%s)
577# Commented out because they don't seem useful to print
578# (but they are part of the header - the tar file comes after them):
579# The 5th line is User Password Salt (128 Hex)
580# string length too high with standard src configuration
581#>>>&1		string	>\0	\b, PASSWORD salt: "%-128.128s"
582#>>>&1		regex/1l .*	\b, Password salt: %s
583# The 6th line is Master Key Checksum Salt (128 Hex)
584#>>>>&1		regex/1l .*	\b, Master salt: %s
585# The 7th line is Number of PBDKF2 Rounds (10000)
586#>>>>>&1	regex/1l .*	\b, PBKDF2 rounds: %s
587# The 8th line is User key Initialization Vector (IV) (32 Hex)
588#>>>>>>&1	regex/1l .*	\b, IV: %s
589#>>>>>>&1	regex/1l .*	\b, IV: %s
590# The 9th line is Master IV+Key+Checksum (192 Hex)
591#>>>>>>>&1	regex/1l .*	\b, Key: %s
592# look for new line separator char after line number 9
593#>>>0x204	ubyte	0x0a	NL found
594#>>>>&1		ubequad	x	\b, Content magic %16.16llx
595
596# *.pit files by Joerg Jenderek
597# https://forum.xda-developers.com/showthread.php?p=9122369
598# https://forum.xda-developers.com/showthread.php?t=816449
599# Partition Information Table for Samsung's smartphone with Android
600# used by flash software Odin
6010		ulelong			0x12349876
602# 1st pit entry marker
603>0x01C	ulequad&0xFFFFFFFCFFFFFFFC	=0x0000000000000000
604# minimal 13 and maximal 18 PIT entries found
605>>4		ulelong			<128	Partition Information Table for Samsung smartphone
606>>>4		ulelong			x	\b, %d entries
607# 1. pit entry
608>>>4		ulelong			>0	\b; #1
609>>>0x01C	use				PIT-entry
610>>>4		ulelong			>1	\b; #2
611>>>0x0A0	use				PIT-entry
612>>>4		ulelong			>2	\b; #3
613>>>0x124	use				PIT-entry
614>>>4		ulelong			>3	\b; #4
615>>>0x1A8	use				PIT-entry
616>>>4		ulelong			>4	\b; #5
617>>>0x22C	use				PIT-entry
618>>>4		ulelong			>5	\b; #6
619>>>0x2B0	use				PIT-entry
620>>>4		ulelong			>6	\b; #7
621>>>0x334	use				PIT-entry
622>>>4		ulelong			>7 	\b; #8
623>>>0x3B8	use				PIT-entry
624>>>4		ulelong			>8 	\b; #9
625>>>0x43C	use				PIT-entry
626>>>4		ulelong			>9	\b; #10
627>>>0x4C0	use				PIT-entry
628>>>4		ulelong			>10	\b; #11
629>>>0x544	use				PIT-entry
630>>>4		ulelong			>11	\b; #12
631>>>0x5C8	use				PIT-entry
632>>>4		ulelong			>12	\b; #13
633>>>>0x64C	use				PIT-entry
634# 14. pit entry
635>>>4		ulelong			>13	\b; #14
636>>>>0x6D0	use				PIT-entry
637>>>4		ulelong			>14	\b; #15
638>>>0x754	use				PIT-entry
639>>>4		ulelong			>15	\b; #16
640>>>0x7D8	use				PIT-entry
641>>>4		ulelong			>16	\b; #17
642>>>0x85C	use				PIT-entry
643# 18. pit entry
644>>>4		ulelong			>17	\b; #18
645>>>0x8E0	use				PIT-entry
646
6470	name			PIT-entry
648# garbage value implies end of pit entries
649>0x00		ulequad&0xFFFFFFFCFFFFFFFC	=0x0000000000000000
650# skip empty partition name
651>>0x24		ubyte				!0
652# partition name
653>>>0x24		string				>\0			%-.32s
654# flags
655>>>0x0C		ulelong&0x00000002		2			\b+RW
656# partition ID:
657# 0~IPL,MOVINAND,GANG;1~PIT,GPT;2~HIDDEN;3~SBL,HIDDEN;4~SBL2,HIDDEN;5~BOOT;6~kernel,RECOVER,misc;7~RECOVER
658# ;11~MODEM;20~efs;21~PARAM;22~FACTORY,SYSTEM;23~DBDATAFS,USERDATA;24~CACHE;80~BOOTLOADER;81~TZSW
659>>>0x08	ulelong		x			(0x%x)
660# filename
661>>>0x44		string				>\0			"%-.64s"
662#>>>0x18	ulelong				>0
663# blocksize in 512 byte units ?
664#>>>>0x18	ulelong				x			\b, %db
665# partition size in blocks ?
666#>>>>0x22	ulelong				x			\b*%d
667
668# Android sparse img format
669# From https://android.googlesource.com/\
670# platform/system/core/+/master/libsparse/sparse_format.h
6710		lelong	0xed26ff3a		Android sparse image
672>4		leshort	x			\b, version: %d
673>6		leshort	x			\b.%d
674>16		lelong	x			\b, Total of %d
675>12		lelong	x			\b %d-byte output blocks in
676>20		lelong	x			\b %d input chunks.
677
678# Android binary XML magic
679# In include/androidfw/ResourceTypes.h:
680# RES_XML_TYPE = 0x0003 followed by the size of the header (ResXMLTree_header),
681# which is 8 bytes (2 bytes type + 2 bytes header size + 4 bytes size).
6820	lelong	0x00080003	Android binary XML
683
684# Android cryptfs footer
685# From https://android.googlesource.com/\
686# platform/system/vold/+/refs/heads/master/cryptfs.h
6870	lelong	0xd0b5b1c4	Android cryptfs footer
688>4	leshort	x	\b, version: %d
689>6	leshort	x	\b.%d
690
691# Android Vdex format
692# From https://android.googlesource.com/\
693# platform/art/+/master/runtime/vdex_file.h
6940	string	vdex	Android vdex file,
695>4	string	>000	verifier deps version: %s,
696>8	string	>000	dex section version: %s,
697>12	lelong	>0	number of dex files: %d,
698>16	lelong	>0	verifier deps size: %d
699
700# Android Vdex format, dexfile is currently being updated
701# by android system
702# From https://android.googlesource.com/\
703# platform/art/+/master/dex2oat/dex2oat.cc
7040	string	wdex	Android vdex file, being processed by dex2oat,
705>4	string	>000	verifier deps version: %s,
706>8	string	>000	dex section version: %s,
707>12	lelong	>0	number of dex files: %d,
708>16	lelong	>0	verifier deps size: %d
709
710#------------------------------------------------------------------------------
711# $File: animation,v 1.85 2021/03/14 16:36:53 christos Exp $
712# animation:  file(1) magic for animation/movie formats
713#
714# animation formats
715# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)
716# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)
717
718# SGI and Apple formats
7190	string		MOVI		Silicon Graphics movie file
720!:mime	video/x-sgi-movie
7214       string          moov            Apple QuickTime
722!:mime	video/quicktime
723>12     string          mvhd            \b movie (fast start)
724>12     string          mdra            \b URL
725>12     string          cmov            \b movie (fast start, compressed header)
726>12     string          rmra            \b multiple URLs
7274       string          mdat            Apple QuickTime movie (unoptimized)
728!:mime	video/quicktime
729#4       string          wide            Apple QuickTime movie (unoptimized)
730#!:mime	video/quicktime
731#4       string          skip            Apple QuickTime movie (modified)
732#!:mime	video/quicktime
733#4       string          free            Apple QuickTime movie (modified)
734#!:mime	video/quicktime
7354       string          idsc            Apple QuickTime image (fast start)
736!:mime	image/x-quicktime
737#4       string          idat            Apple QuickTime image (unoptimized)
738#!:mime	image/x-quicktime
7394       string          pckg            Apple QuickTime compressed archive
740!:mime	application/x-quicktime-player
7414	string/W	jP		JPEG 2000 image
742!:mime	image/jp2
743
744#### MP4 ####
745# https://www.ftyps.com/ with local additions
746# https://cconcolato.github.io/mp4ra/filetype.html
7474	string		ftyp		ISO Media
748# https://aeroquartet.com/wordpress/2016/03/05/3-xavc-s/
749>8	string		XAVC		\b, MPEG v4 system, Sony XAVC Codec
750>>96	string		x		\b, Audio "%.4s"
751>>118	beshort		x		at %dHz
752>>140	string		x		\b, Video "%.4s"
753>>168	beshort		x		%d
754>>170	beshort		x		\bx%d
755>8	string		3g2		\b, MPEG v4 system, 3GPP2
756!:mime	video/3gpp2
757>>11	byte		4		\b v4 (H.263/AMR GSM 6.10)
758>>11	byte		5		\b v5 (H.263/AMR GSM 6.10)
759>>11	byte		6		\b v6 (ITU H.264/AMR GSM 6.10)
760# https://www.3gpp2.org/Public_html/Specs/C.S0050-B_v1.0_070521.pdf
761# Section 8.1.1, corresponds to a, b, c
762>>11	byte		0x61		\b C.S0050-0 V1.0
763>>11	byte		0x62		\b C.S0050-0-A V1.0.0
764>>11	byte		0x63		\b C.S0050-0-B V1.0
765>8	string		3ge		\b, MPEG v4 system, 3GPP
766!:mime	video/3gpp
767>>11	byte		6		\b, Release %d MBMS Extended Presentations
768>>11	byte		7		\b, Release %d MBMS Extended Presentations
769>>11	byte		9		\b, Release %d MBMS Extended Presentations
770>8	string		3gf		\b, MPEG v4 system, 3GPP
771>>11	byte		9		\b, Release %d File-delivery profile
772>8	string		3gg		\b, MPEG v4 system, 3GPP
773!:mime	video/3gpp
774>>11	byte		6		\b, Release %d General Profile
775>>11	byte		9		\b, Release %d General Profile
776>8	string		3gh		\b, MPEG v4 system, 3GPP
777!:mime	video/3gpp
778>>11	byte		9		\b, Release %d Adaptive Streaming Profile
779>8	string		3gm		\b, MPEG v4 system, 3GPP
780!:mime	video/3gpp
781>>11	byte		9		\b, Release %d Media Segment Profile
782>8	string		3gp		\b, MPEG v4 system, 3GPP
783!:mime	video/3gpp
784>>11	byte		1		\b, Release %d (non existent)
785>>11	byte		2		\b, Release %d (non existent)
786>>11	byte		3		\b, Release %d (non existent)
787>>11	byte		4		\b, Release %d
788>>11	byte		5		\b, Release %d
789>>11	byte		6		\b, Release %d
790>>11	byte		7		\b, Release %d Streaming Servers
791>8	string		3gr		\b, MPEG v4 system, 3GPP
792!:mime	video/3gpp
793>>11	byte		6		\b, Release %d Progressive Download Profile
794>>11	byte		9		\b, Release %d Progressive Download Profile
795>8	string		3gs		\b, MPEG v4 system, 3GPP
796!:mime	video/3gpp
797>>11	byte		6		\b, Release %d Streaming Servers
798>>11	byte		7		\b, Release %d Streaming Servers
799>>11	byte		9		\b, Release %d Streaming Servers
800>8	string		3gt		\b, MPEG v4 system, 3GPP
801!:mime	video/3gpp
802>>11	byte		8		\b, Release %d Media Stream Recording Profile
803>>11	byte		9		\b, Release %d Media Stream Recording Profile
804>8	string		ARRI		\b, MPEG v4 system, ARRI Digital Camera
805!:mime	video/mp4
806>8	string		avc1		\b, MPEG v4 system, 3GPP JVT AVC [ISO 14496-12:2005]
807!:mime	video/mp4
808>8	string		bbxm		\b, Blinkbox Master File: H.264 video/16-bit LE LPCM audio
809!:mime	video/mp4
810>8	string/W	qt		\b, Apple QuickTime movie
811!:mime	video/quicktime
812>8	string		CAEP		\b, Canon Digital Camera
813>8	string		caqv		\b, Casio Digital Camera
814>8	string		CDes		\b, Convergent Design
815>8	string		caaa		\b, CMAF Media Profile - AAC Adaptive Audio
816>8	string		caac		\b, CMAF Media Profile - AAC Core
817>8	string		caqv		\b, Casio Digital Camera	Casio
818>8	string		ccea		\b, CMAF Supplemental Data - CEA-608/708
819>8	string		ccff		\b, Common container file format
820>8	string		cfhd		\b, CMAF Media Profile - AVC HD
821>8	string		cfsd		\b, CMAF Media Profile - AVC SD
822>8	string		chd1		\b, CMAF Media Profile - HEVC HDR10
823>8	string		chdf		\b, CMAF Media Profile - AVC HDHF
824>8	string		chhd		\b, CMAF Media Profile - HEVC HHD8
825>8	string		chh1		\b, CMAF Media Profile - HEVC HHD10
826>8	string		clg1		\b, CMAF Media Profile - HEVC HLG10
827>8	string		cmfc		\b, CMAF Track Format
828>8	string		cmff		\b, CMAF Fragment Format
829>8	string		cmfl		\b, CMAF Chunk Format
830>8	string		cmfs		\b, CMAF Segment Format
831>8	string		cud1		\b, CMAF Media Profile - HEVC UHD10
832>8	string		cud8		\b, CMAF Media Profile - HEVC UHD8
833>8	string		cwvt		\b, CMAF Media Profile - WebVTT
834>8	string		da0a		\b, DMB MAF w/ MPEG Layer II aud, MOT slides, DLS, JPG/PNG/MNG
835>8	string		da0b		\b, DMB MAF, ext DA0A, with 3GPP timed text, DID, TVA, REL, IPMP
836>8	string		da1a		\b, DMB MAF audio with ER-BSAC audio, JPG/PNG/MNG images
837>8	string		da1b		\b, DMB MAF, ext da1a, with 3GPP timed text, DID, TVA, REL, IPMP
838>8	string		da2a		\b, DMB MAF aud w/ HE-AAC v2 aud, MOT slides, DLS, JPG/PNG/MNG
839>8	string		da2b		\b, DMB MAF, ext da2a, with 3GPP timed text, DID, TVA, REL, IPMP
840>8	string		da3a		\b, DMB MAF aud with HE-AAC aud, JPG/PNG/MNG images
841>8	string		da3b		\b, DMB MAF, ext da3a w/ BIFS, 3GPP, DID, TVA, REL, IPMP
842>8	string		dash		\b, MPEG v4 system, Dynamic Adaptive Streaming over HTTP
843!:mime	video/mp4
844>8	string		dby1		\b, MP4 files with Dolby content
845>8	string		dsms		\b, Media Segment DASH conformant
846>8	string		dts1		\b, MP4 track file with audio codecs dtsc dtsh or dtse
847>8	string		dts2		\b, MP4 track file with audio codec dtsx
848>8	string		dts3		\b, MP4 track file with audio codec dtsy
849>8	string		dxo$20		\b, DxO ONE camera
850>8	string		dmb1		\b, DMB MAF supporting all the components defined in the spec
851>8	string		dmpf		\b, Digital Media Project
852>8	string		drc1		\b, Dirac (wavelet compression), encap in ISO base media (MP4)
853>8	string		dv1a		\b, DMB MAF vid w/ AVC vid, ER-BSAC aud, BIFS, JPG/PNG/MNG, TS
854>8	string		dv1b		\b, DMB MAF, ext dv1a, with 3GPP timed text, DID, TVA, REL, IPMP
855>8	string		dv2a		\b, DMB MAF vid w/ AVC vid, HE-AAC v2 aud, BIFS, JPG/PNG/MNG, TS
856>8	string		dv2b		\b, DMB MAF, ext dv2a, with 3GPP timed text, DID, TVA, REL, IPMP
857>8	string		dv3a		\b, DMB MAF vid w/ AVC vid, HE-AAC aud, BIFS, JPG/PNG/MNG, TS
858>8	string		dv3b		\b, DMB MAF, ext dv3a, with 3GPP timed text, DID, TVA, REL, IPMP
859>8	string		dvr1		\b, DVB (.DVB) over RTP
860!:mime	video/vnd.dvb.file
861>8	string		dvt1		\b, DVB (.DVB) over MPEG-2 Transport Stream
862>8	string		emsg		\b, Event message box present
863!:mime	video/vnd.dvb.file
864>8	string		F4V		\b, Video for Adobe Flash Player 9+ (.F4V)
865!:mime	video/mp4
866>8	string		F4P		\b, Protected Video for Adobe Flash Player 9+ (.F4P)
867!:mime	video/mp4
868>8	string		F4A		\b, Audio for Adobe Flash Player 9+ (.F4A)
869!:mime	audio/mp4
870>8	string		F4B		\b, Audio Book for Adobe Flash Player 9+ (.F4B)
871!:mime	audio/mp4
872>8	string		ifrm		\b, Apple iFrame Specification, Version 8.1 Jan 2013
873>8	string		im1i		\b, CMAF Media Profile - IMSC1 Image
874>8	string		im1t		\b, CMAF Media Profile - IMSC1 Text
875>8	string		isc2		\b, ISMACryp 2.0 Encrypted File
876#	?/enc-isoff-generic
877>8	string		iso		\b, MP4 Base Media
878!:mime	video/mp4
879>>11	string		m 		v1 [ISO 14496-12:2003]
880>>11	string		2		v2 [ISO 14496-12:2005]
881>>11	string		4		v4
882>>11	string		5		v5
883>>11	string		6		v6
884>8	string		isml		\b, MP4 Base Media v2 [ISO 14496-12:2005]
885!:mime	video/mp4
886>8	string		J2P0		\b, JPEG2000 Profile 0
887>8	string		J2P1		\b, JPEG2000 Profile 1
888>8	string/W	jp2		\b, JPEG 2000
889!:mime	image/jp2
890>8	string		JP2		\b, JPEG 2000 Image (.JP2) [ISO 15444-1 ?]
891!:mime	image/jp2
892>8	string		JP20		\b, Unknown, from GPAC samples (prob non-existent)
893>8	string		jpm		\b, JPEG 2000 Compound Image (.JPM) [ISO 15444-6]
894!:mime	image/jpm
895>8	string		jpsi		\b, The JPSearch data interchange format
896>8	string		jpx		\b, JPEG 2000 w/ extensions (.JPX) [ISO 15444-2]
897!:mime	image/jpx
898>8	string		KDDI		\b, 3GPP2 EZmovie for KDDI 3G cellphones
899!:mime	video/3gpp2
900>8	string		LCAG		\b,  Leica digital camera
901>8	string		lmsg		\b, Last Media Segment indicator for ISO base media file format.
902>8	string		M4A 		\b, Apple iTunes ALAC/AAC-LC (.M4A) Audio
903!:mime	audio/x-m4a
904>8	string		M4B 		\b, Apple iTunes ALAC/AAC-LC (.M4B) Audio Book
905!:mime	audio/mp4
906>8	string		M4P 		\b, Apple iTunes ALAC/AAC-LC (.M4P) AES Protected Audio
907!:mime	video/mp4
908>8	string		M4V 		\b, Apple iTunes Video (.M4V) Video
909!:mime	video/x-m4v
910>8	string		M4VH		\b, Apple TV (.M4V)
911!:mime	video/x-m4v
912>8	string		M4VP		\b, Apple iPhone (.M4V)
913!:mime	video/x-m4v
914>8	string		mj2s		\b, Motion JPEG 2000 [ISO 15444-3] Simple Profile
915!:mime	video/mj2
916>8	string		mjp2		\b, Motion JPEG 2000 [ISO 15444-3] General Profile
917>8	string		MFSM		\b, Media File for Samsung video Metadata
918>8	string		MGSV		\b, Sony Home and Mobile Multimedia Platform (HMMP)
919!:mime	video/mj2
920>8	string		mmp4		\b, MPEG-4/3GPP Mobile Profile (.MP4 / .3GP) (for NTT)
921!:mime	video/mp4
922>8	string		mobi		\b, MPEG-4, MOBI format
923!:mime	video/mp4
924>8	string		mp21		\b, MPEG-21 [ISO/IEC 21000-9]
925>8	string		mp41		\b, MP4 v1 [ISO 14496-1:ch13]
926!:mime	video/mp4
927>8	string		mp42		\b, MP4 v2 [ISO 14496-14]
928!:mime	video/mp4
929>8	string		mp71		\b, MP4 w/ MPEG-7 Metadata [per ISO 14496-12]
930>8	string		mp7t		\b, MPEG v4 system, MPEG v7 XML
931>8	string		mp7b		\b, MPEG v4 system, MPEG v7 binary XML
932>8	string		mpuf		\b, Compliance with the MMT Processing Unit format
933>8	string		msdh		\b, Media Segment conforming to ISO base media file format.
934>8	string		msix		\b, Media Segment conforming to ISO base media file format.
935>8	string		mmp4		\b, MPEG v4 system, 3GPP Mobile
936!:mime	video/mp4
937>8	string		MPPI		\b, Photo Player, MAF [ISO/IEC 23000-3]
938>8	string		mqt		\b, Sony / Mobile QuickTime (.MQV) US Pat 7,477,830
939!:mime	video/quicktime
940>8	string		MSNV		\b, MPEG-4 (.MP4) for SonyPSP
941!:mime	audio/mp4
942>8	string		NDAS		\b, MP4 v2 [ISO 14496-14] Nero Digital AAC Audio
943!:mime	audio/mp4
944>8	string		NDSC		\b, MPEG-4 (.MP4) Nero Cinema Profile
945!:mime	video/mp4
946>8	string		NDSH		\b, MPEG-4 (.MP4) Nero HDTV Profile
947!:mime	video/mp4
948>8	string		NDSM		\b, MPEG-4 (.MP4) Nero Mobile Profile
949!:mime	video/mp4
950>8	string		NDSP		\b, MPEG-4 (.MP4) Nero Portable Profile
951!:mime	video/mp4
952>8	string		NDSS		\b, MPEG-4 (.MP4) Nero Standard Profile
953!:mime	video/mp4
954>8	string		NDXC		\b, H.264/MPEG-4 AVC (.MP4) Nero Cinema Profile
955!:mime	video/mp4
956>8	string		NDXH		\b, H.264/MPEG-4 AVC (.MP4) Nero HDTV Profile
957!:mime	video/mp4
958>8	string		NDXM		\b, H.264/MPEG-4 AVC (.MP4) Nero Mobile Profile
959!:mime	video/mp4
960>8	string		NDXP		\b, H.264/MPEG-4 AVC (.MP4) Nero Portable Profile
961!:mime	video/mp4
962>8	string		NDXS		\b, H.264/MPEG-4 AVC (.MP4) Nero Standard Profile
963>8	string		niko		\b, Nikon Digital Camera
964!:mime	video/mp4
965>8	string		odcf  		\b, OMA DCF DRM Format 2.0 (OMA-TS-DRM-DCF-V2_0-20060303-A)
966>8	string		opf2 		\b, OMA PDCF DRM Format 2.1 (OMA-TS-DRM-DCF-V2_1-20070724-C)
967>8	string		opx2  		\b, OMA PDCF DRM + XBS ext (OMA-TS-DRM_XBS-V1_0-20070529-C)
968>8	string		pana		\b, Panasonic Digital Camera
969>8	string		piff		\b, Protected Interoperable File Format
970>8	string		pnvi		]b, Panasonic Video Intercom
971>8	string		qt  		\b, Apple QuickTime (.MOV/QT)
972!:mime	video/quicktime
973# HEIF image format
974# see https://nokiatech.github.io/heif/technical.html
975>8	string		mif1		\b, HEIF Image
976!:mime image/heif
977>8	string		msf1		\b, HEIF Image Sequence
978!:mime image/heif-sequence
979>8	string		heic		\b, HEIF Image HEVC Main or Main Still Picture Profile
980!:mime image/heic
981>8	string		heix		\b, HEIF Image HEVC Main 10 Profile
982!:mime image/heic
983>8	string		hevc		\b, HEIF Image Sequenz HEVC Main or Main Still Picture Profile
984!:mime image/heic-sequence
985>8	string		hevx		\b, HEIF Image Sequence HEVC Main 10 Profile
986!:mime image/heic-sequence
987# following HEIF brands are not mentioned in the heif technical info currently (Oct 2017)
988# but used in the reference implementation:
989# https://github.com/nokiatech/heif/blob/d5e9a21c8ba8df712bdf643021dd9f6518134776/Srcs/reader/hevcimagefilereader.cpp
990>8	string		heim		\b, HEIF Image L-HEVC
991!:mime image/heif
992>8	string		heis		\b, HEIF Image L-HEVC
993!:mime image/heif
994>8	string		avic		\b, HEIF Image AVC
995!:mime image/heif
996>8	string		hevm		\b, HEIF Image Sequence L-HEVC
997!:mime image/heif-sequence
998>8	string		hevs		\b, HEIF Image Sequence L-HEVC
999!:mime image/heif-sequence
1000>8	string		avcs		\b, HEIF Image Sequence AVC
1001!:mime image/heif-sequence
1002# AVIF image format
1003# see https://aomediacodec.github.io/av1-avif/
1004>8	string		avif		\b, AVIF Image
1005!:mime image/avif
1006>8	string		avis		\b, AVIF Image Sequence
1007!:mime image/avif
1008>8	string		risx		\b, Representation Index Segment for MPEG-2 TS Segments
1009>8	string		ROSS		\b, Ross Video
1010>8	string		sdv		\b, SD Memory Card Video
1011>8	string		ssc1		\b, Samsung stereo, single stream (patent pending)
1012>8	string		ssc2		\b, Samsung stereo, dual stream (patent pending)
1013>8	string		SEAU		\b, Sony Home and Mobile Multimedia Platform (HMMP)
1014>8	string		SEBK		\b, Sony Home and Mobile Multimedia Platform (HMMP)
1015>8	string		senv		\b, Video contents Sony Entertainment Network
1016>8	string		sims		\b, Media Segment for Sub-Indexed Media Segment format
1017>8	string		sisx		\b, Single Index Segment forindex MPEG-2 TS
1018>8	string		ssss		\b, Subsegment Index Segment used to index MPEG-2 Segments
1019>8	string		uvvu		\b, UltraViolet file brand for DECE Common Format
1020
1021# MPEG sequences
1022# Scans for all common MPEG header start codes
10230	 belong		    0x00000001
1024>4	 byte&0x1F	    0x07	   JVT NAL sequence, H.264 video
1025>>5      byte               66             \b, baseline
1026>>5      byte               77             \b, main
1027>>5      byte               88             \b, extended
1028>>7      byte               x              \b @ L %u
10290        belong&0xFFFFFF00  0x00000100
1030>3       byte               0xBA           MPEG sequence
1031!:mime  video/mpeg
1032# http://fileformats.archiveteam.org/wiki/Enhanced_VOB
1033# https://reposcope.com/mimetype/video/mpeg
1034!:ext	vob/evo/mpg/mpeg
1035>>4      byte               &0x40          \b, v2, program multiplex
1036>>4      byte               ^0x40          \b, v1, system multiplex
1037>3       byte               0xBB           MPEG sequence, v1/2, multiplex (missing pack header)
1038>3       byte&0x1F          0x07           MPEG sequence, H.264 video
1039>>4      byte               66             \b, baseline
1040>>4      byte               77             \b, main
1041>>4      byte               88             \b, extended
1042>>6      byte               x              \b @ L %u
1043# GRR too general as it catches also FoxPro Memo example NG.FPT
1044>3       byte               0xB0           MPEG sequence, v4
1045# TODO: maybe this extra line exclude FoxPro Memo example NG.FPT starting with 000001b0 00000100 00000000
1046#>>4      byte               !0             MPEG sequence, v4
1047!:mime  video/mpeg4-generic
1048>>5      belong             0x000001B5
1049>>>9     byte               &0x80
1050>>>>10   byte&0xF0          16             \b, video
1051>>>>10   byte&0xF0          32             \b, still texture
1052>>>>10   byte&0xF0          48             \b, mesh
1053>>>>10   byte&0xF0          64             \b, face
1054>>>9     byte&0xF8          8              \b, video
1055>>>9     byte&0xF8          16             \b, still texture
1056>>>9     byte&0xF8          24             \b, mesh
1057>>>9     byte&0xF8          32             \b, face
1058>>4      byte               1              \b, simple @ L1
1059>>4      byte               2              \b, simple @ L2
1060>>4      byte               3              \b, simple @ L3
1061>>4      byte               4              \b, simple @ L0
1062>>4      byte               17             \b, simple scalable @ L1
1063>>4      byte               18             \b, simple scalable @ L2
1064>>4      byte               33             \b, core @ L1
1065>>4      byte               34             \b, core @ L2
1066>>4      byte               50             \b, main @ L2
1067>>4      byte               51             \b, main @ L3
1068>>4      byte               53             \b, main @ L4
1069>>4      byte               66             \b, n-bit @ L2
1070>>4      byte               81             \b, scalable texture @ L1
1071>>4      byte               97             \b, simple face animation @ L1
1072>>4      byte               98             \b, simple face animation @ L2
1073>>4      byte               99             \b, simple face basic animation @ L1
1074>>4      byte               100            \b, simple face basic animation @ L2
1075>>4      byte               113            \b, basic animation text @ L1
1076>>4      byte               114            \b, basic animation text @ L2
1077>>4      byte               129            \b, hybrid @ L1
1078>>4      byte               130            \b, hybrid @ L2
1079>>4      byte               145            \b, advanced RT simple @ L!
1080>>4      byte               146            \b, advanced RT simple @ L2
1081>>4      byte               147            \b, advanced RT simple @ L3
1082>>4      byte               148            \b, advanced RT simple @ L4
1083>>4      byte               161            \b, core scalable @ L1
1084>>4      byte               162            \b, core scalable @ L2
1085>>4      byte               163            \b, core scalable @ L3
1086>>4      byte               177            \b, advanced coding efficiency @ L1
1087>>4      byte               178            \b, advanced coding efficiency @ L2
1088>>4      byte               179            \b, advanced coding efficiency @ L3
1089>>4      byte               180            \b, advanced coding efficiency @ L4
1090>>4      byte               193            \b, advanced core @ L1
1091>>4      byte               194            \b, advanced core @ L2
1092>>4      byte               209            \b, advanced scalable texture @ L1
1093>>4      byte               210            \b, advanced scalable texture @ L2
1094>>4      byte               211            \b, advanced scalable texture @ L3
1095>>4      byte               225            \b, simple studio @ L1
1096>>4      byte               226            \b, simple studio @ L2
1097>>4      byte               227            \b, simple studio @ L3
1098>>4      byte               228            \b, simple studio @ L4
1099>>4      byte               229            \b, core studio @ L1
1100>>4      byte               230            \b, core studio @ L2
1101>>4      byte               231            \b, core studio @ L3
1102>>4      byte               232            \b, core studio @ L4
1103>>4      byte               240            \b, advanced simple @ L0
1104>>4      byte               241            \b, advanced simple @ L1
1105>>4      byte               242            \b, advanced simple @ L2
1106>>4      byte               243            \b, advanced simple @ L3
1107>>4      byte               244            \b, advanced simple @ L4
1108>>4      byte               245            \b, advanced simple @ L5
1109>>4      byte               247            \b, advanced simple @ L3b
1110>>4      byte               248            \b, FGS @ L0
1111>>4      byte               249            \b, FGS @ L1
1112>>4      byte               250            \b, FGS @ L2
1113>>4      byte               251            \b, FGS @ L3
1114>>4      byte               252            \b, FGS @ L4
1115>>4      byte               253            \b, FGS @ L5
1116>3       byte               0xB5           MPEG sequence, v4
1117!:mime  video/mpeg4-generic
1118>>4      byte               &0x80
1119>>>5     byte&0xF0          16             \b, video (missing profile header)
1120>>>5     byte&0xF0          32             \b, still texture (missing profile header)
1121>>>5     byte&0xF0          48             \b, mesh (missing profile header)
1122>>>5     byte&0xF0          64             \b, face (missing profile header)
1123>>4      byte&0xF8          8              \b, video (missing profile header)
1124>>4      byte&0xF8          16             \b, still texture (missing profile header)
1125>>4      byte&0xF8          24             \b, mesh (missing profile header)
1126>>4      byte&0xF8          32             \b, face (missing profile header)
1127>3       byte               0xB3           MPEG sequence
1128!:mime  video/mpeg
1129>>12     belong             0x000001B8     \b, v1, progressive Y'CbCr 4:2:0 video
1130>>12     belong             0x000001B2     \b, v1, progressive Y'CbCr 4:2:0 video
1131>>12     belong             0x000001B5     \b, v2,
1132>>>16    byte&0x0F          1              \b HP
1133>>>16    byte&0x0F          2              \b Spt
1134>>>16    byte&0x0F          3              \b SNR
1135>>>16    byte&0x0F          4              \b MP
1136>>>16    byte&0x0F          5              \b SP
1137>>>17    byte&0xF0          64             \b@HL
1138>>>17    byte&0xF0          96             \b@H-14
1139>>>17    byte&0xF0          128            \b@ML
1140>>>17    byte&0xF0          160            \b@LL
1141>>>17    byte               &0x08          \b progressive
1142>>>17    byte               ^0x08          \b interlaced
1143>>>17    byte&0x06          2              \b Y'CbCr 4:2:0 video
1144>>>17    byte&0x06          4              \b Y'CbCr 4:2:2 video
1145>>>17    byte&0x06          6              \b Y'CbCr 4:4:4 video
1146>>11     byte               &0x02
1147>>>75    byte               &0x01
1148>>>>140  belong             0x000001B8     \b, v1, progressive Y'CbCr 4:2:0 video
1149>>>>140  belong             0x000001B2     \b, v1, progressive Y'CbCr 4:2:0 video
1150>>>>140  belong             0x000001B5     \b, v2,
1151>>>>>144 byte&0x0F          1              \b HP
1152>>>>>144 byte&0x0F          2              \b Spt
1153>>>>>144 byte&0x0F          3              \b SNR
1154>>>>>144 byte&0x0F          4              \b MP
1155>>>>>144 byte&0x0F          5              \b SP
1156>>>>>145 byte&0xF0          64             \b@HL
1157>>>>>145 byte&0xF0          96             \b@H-14
1158>>>>>145 byte&0xF0          128            \b@ML
1159>>>>>145 byte&0xF0          160            \b@LL
1160>>>>>145 byte               &0x08          \b progressive
1161>>>>>145 byte               ^0x08          \b interlaced
1162>>>>>145 byte&0x06          2              \b Y'CbCr 4:2:0 video
1163>>>>>145 byte&0x06          4              \b Y'CbCr 4:2:2 video
1164>>>>>145 byte&0x06          6              \b Y'CbCr 4:4:4 video
1165>>76    belong             0x000001B8     \b, v1, progressive Y'CbCr 4:2:0 video
1166>>76    belong             0x000001B2     \b, v1, progressive Y'CbCr 4:2:0 video
1167>>76    belong             0x000001B5     \b, v2,
1168>>>80   byte&0x0F          1              \b HP
1169>>>80   byte&0x0F          2              \b Spt
1170>>>80   byte&0x0F          3              \b SNR
1171>>>80   byte&0x0F          4              \b MP
1172>>>80   byte&0x0F          5              \b SP
1173>>>81   byte&0xF0          64             \b@HL
1174>>>81   byte&0xF0          96             \b@H-14
1175>>>81   byte&0xF0          128            \b@ML
1176>>>81   byte&0xF0          160            \b@LL
1177>>>81   byte               &0x08          \b progressive
1178>>>81   byte               ^0x08          \b interlaced
1179>>>81   byte&0x06          2              \b Y'CbCr 4:2:0 video
1180>>>81   byte&0x06          4              \b Y'CbCr 4:2:2 video
1181>>>81   byte&0x06          6              \b Y'CbCr 4:4:4 video
1182>>4      belong&0xFFFFFF00  0x78043800     \b, HD-TV 1920P
1183>>>7     byte&0xF0          0x10           \b, 16:9
1184>>4      belong&0xFFFFFF00  0x50002D00     \b, SD-TV 1280I
1185>>>7     byte&0xF0          0x10           \b, 16:9
1186>>4      belong&0xFFFFFF00  0x30024000     \b, PAL Capture
1187>>>7     byte&0xF0          0x10           \b, 4:3
1188>>4      beshort&0xFFF0     0x2C00         \b, 4CIF
1189>>>5     beshort&0x0FFF     0x01E0         \b NTSC
1190>>>5     beshort&0x0FFF     0x0240         \b PAL
1191>>>7     byte&0xF0          0x20           \b, 4:3
1192>>>7     byte&0xF0          0x30           \b, 16:9
1193>>>7     byte&0xF0          0x40           \b, 11:5
1194>>>7     byte&0xF0          0x80           \b, PAL 4:3
1195>>>7     byte&0xF0          0xC0           \b, NTSC 4:3
1196>>4      belong&0xFFFFFF00  0x2801E000     \b, LD-TV 640P
1197>>>7     byte&0xF0          0x10           \b, 4:3
1198>>4      belong&0xFFFFFF00  0x1400F000     \b, 320x240
1199>>>7     byte&0xF0          0x10           \b, 4:3
1200>>4      belong&0xFFFFFF00  0x0F00A000     \b, 240x160
1201>>>7     byte&0xF0          0x10           \b, 4:3
1202>>4      belong&0xFFFFFF00  0x0A007800     \b, 160x120
1203>>>7     byte&0xF0          0x10           \b, 4:3
1204>>4      beshort&0xFFF0     0x1600         \b, CIF
1205>>>5     beshort&0x0FFF     0x00F0         \b NTSC
1206>>>5     beshort&0x0FFF     0x0120         \b PAL
1207>>>7     byte&0xF0          0x20           \b, 4:3
1208>>>7     byte&0xF0          0x30           \b, 16:9
1209>>>7     byte&0xF0          0x40           \b, 11:5
1210>>>7     byte&0xF0          0x80           \b, PAL 4:3
1211>>>7     byte&0xF0          0xC0           \b, NTSC 4:3
1212>>>5     beshort&0x0FFF     0x0240         \b PAL 625
1213>>>>7    byte&0xF0          0x20           \b, 4:3
1214>>>>7    byte&0xF0          0x30           \b, 16:9
1215>>>>7    byte&0xF0          0x40           \b, 11:5
1216>>4      beshort&0xFFF0     0x2D00         \b, CCIR/ITU
1217>>>5     beshort&0x0FFF     0x01E0         \b NTSC 525
1218>>>5     beshort&0x0FFF     0x0240         \b PAL 625
1219>>>7     byte&0xF0          0x20           \b, 4:3
1220>>>7     byte&0xF0          0x30           \b, 16:9
1221>>>7     byte&0xF0          0x40           \b, 11:5
1222>>4      beshort&0xFFF0     0x1E00         \b, SVCD
1223>>>5     beshort&0x0FFF     0x01E0         \b NTSC 525
1224>>>5     beshort&0x0FFF     0x0240         \b PAL 625
1225>>>7     byte&0xF0          0x20           \b, 4:3
1226>>>7     byte&0xF0          0x30           \b, 16:9
1227>>>7     byte&0xF0          0x40           \b, 11:5
1228>>7      byte&0x0F          1              \b, 23.976 fps
1229>>7      byte&0x0F          2              \b, 24 fps
1230>>7      byte&0x0F          3              \b, 25 fps
1231>>7      byte&0x0F          4              \b, 29.97 fps
1232>>7      byte&0x0F          5              \b, 30 fps
1233>>7      byte&0x0F          6              \b, 50 fps
1234>>7      byte&0x0F          7              \b, 59.94 fps
1235>>7      byte&0x0F          8              \b, 60 fps
1236>>11     byte               &0x04          \b, Constrained
1237
1238# MPEG ADTS Audio (*.mpx/mxa/aac)
1239# from dreesen@math.fu-berlin.de
1240# modified to fully support MPEG ADTS
1241
1242# MP3, M1A
1243# modified by Joerg Jenderek
1244# GRR the original test are too common for many DOS files
1245# so don't accept as MP3 until we've tested the rate
1246# But also beat GEMDOS fonts
12470       beshort&0xFFFE  0xFFFA
1248# rates
1249>2	byte&0xF0	!0
1250>>2	byte&0xF0	!0xF0		MPEG ADTS, layer III, v1
1251!:strength +20
1252!:mime	audio/mpeg
1253>2	byte&0xF0	0x10		\b, 32 kbps
1254>2	byte&0xF0	0x20		\b, 40 kbps
1255>2	byte&0xF0	0x30		\b, 48 kbps
1256>2	byte&0xF0	0x40		\b, 56 kbps
1257>2	byte&0xF0	0x50		\b, 64 kbps
1258>2	byte&0xF0	0x60		\b, 80 kbps
1259>2	byte&0xF0	0x70		\b, 96 kbps
1260>2	byte&0xF0	0x80		\b, 112 kbps
1261>2	byte&0xF0	0x90		\b, 128 kbps
1262>2	byte&0xF0	0xA0		\b, 160 kbps
1263>2	byte&0xF0	0xB0		\b, 192 kbps
1264>2	byte&0xF0	0xC0		\b, 224 kbps
1265>2	byte&0xF0	0xD0		\b, 256 kbps
1266>2	byte&0xF0	0xE0		\b, 320 kbps
1267# timing
1268>2	byte&0x0C	0x00		\b, 44.1 kHz
1269>2	byte&0x0C	0x04		\b, 48 kHz
1270>2	byte&0x0C	0x08		\b, 32 kHz
1271# channels/options
1272>3	byte&0xC0	0x00		\b, Stereo
1273>3	byte&0xC0	0x40		\b, JntStereo
1274>3	byte&0xC0	0x80		\b, 2x Monaural
1275>3	byte&0xC0	0xC0		\b, Monaural
1276#>1	byte		^0x01		\b, Data Verify
1277#>2	byte		&0x02		\b, Packet Pad
1278#>2	byte		&0x01		\b, Custom Flag
1279#>3	byte		&0x08		\b, Copyrighted
1280#>3	byte		&0x04		\b, Original Source
1281#>3	byte&0x03	1		\b, NR: 50/15 ms
1282#>3	byte&0x03	3		\b, NR: CCIT J.17
1283
1284# MP2, M1A
12850       beshort&0xFFFE  0xFFFC         MPEG ADTS, layer II, v1
1286!:mime	audio/mpeg
1287# rates
1288>2      byte&0xF0       0x10           \b,  32 kbps
1289>2      byte&0xF0       0x20           \b,  48 kbps
1290>2      byte&0xF0       0x30           \b,  56 kbps
1291>2      byte&0xF0       0x40           \b,  64 kbps
1292>2      byte&0xF0       0x50           \b,  80 kbps
1293>2      byte&0xF0       0x60           \b,  96 kbps
1294>2      byte&0xF0       0x70           \b, 112 kbps
1295>2      byte&0xF0       0x80           \b, 128 kbps
1296>2      byte&0xF0       0x90           \b, 160 kbps
1297>2      byte&0xF0       0xA0           \b, 192 kbps
1298>2      byte&0xF0       0xB0           \b, 224 kbps
1299>2      byte&0xF0       0xC0           \b, 256 kbps
1300>2      byte&0xF0       0xD0           \b, 320 kbps
1301>2      byte&0xF0       0xE0           \b, 384 kbps
1302# timing
1303>2      byte&0x0C       0x00           \b, 44.1 kHz
1304>2      byte&0x0C       0x04           \b, 48 kHz
1305>2      byte&0x0C       0x08           \b, 32 kHz
1306# channels/options
1307>3      byte&0xC0       0x00           \b, Stereo
1308>3      byte&0xC0       0x40           \b, JntStereo
1309>3      byte&0xC0       0x80           \b, 2x Monaural
1310>3      byte&0xC0       0xC0           \b, Monaural
1311#>1     byte            ^0x01          \b, Data Verify
1312#>2     byte            &0x02          \b, Packet Pad
1313#>2     byte            &0x01          \b, Custom Flag
1314#>3     byte            &0x08          \b, Copyrighted
1315#>3     byte            &0x04          \b, Original Source
1316#>3     byte&0x03       1              \b, NR: 50/15 ms
1317#>3     byte&0x03       3              \b, NR: CCIT J.17
1318
1319# MPA, M1A
1320# updated by Joerg Jenderek
1321# GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448
1322# GRR this test is still too general as it catches a BOM of UTF-16 files (0xFFFE)
1323# FIXME: Almost all little endian UTF-16 text with BOM are clobbered by these entries
1324#0	beshort&0xFFFE		0xFFFE
1325#>2	ubyte&0xF0	>0x0F
1326#>>2	ubyte&0xF0	<0xE1		MPEG ADTS, layer I, v1
1327## rate
1328#>>>2      byte&0xF0       0x10           \b,  32 kbps
1329#>>>2      byte&0xF0       0x20           \b,  64 kbps
1330#>>>2      byte&0xF0       0x30           \b,  96 kbps
1331#>>>2      byte&0xF0       0x40           \b, 128 kbps
1332#>>>2      byte&0xF0       0x50           \b, 160 kbps
1333#>>>2      byte&0xF0       0x60           \b, 192 kbps
1334#>>>2      byte&0xF0       0x70           \b, 224 kbps
1335#>>>2      byte&0xF0       0x80           \b, 256 kbps
1336#>>>2      byte&0xF0       0x90           \b, 288 kbps
1337#>>>2      byte&0xF0       0xA0           \b, 320 kbps
1338#>>>2      byte&0xF0       0xB0           \b, 352 kbps
1339#>>>2      byte&0xF0       0xC0           \b, 384 kbps
1340#>>>2      byte&0xF0       0xD0           \b, 416 kbps
1341#>>>2      byte&0xF0       0xE0           \b, 448 kbps
1342## timing
1343#>>>2      byte&0x0C       0x00           \b, 44.1 kHz
1344#>>>2      byte&0x0C       0x04           \b, 48 kHz
1345#>>>2      byte&0x0C       0x08           \b, 32 kHz
1346## channels/options
1347#>>>3      byte&0xC0       0x00           \b, Stereo
1348#>>>3      byte&0xC0       0x40           \b, JntStereo
1349#>>>3      byte&0xC0       0x80           \b, 2x Monaural
1350#>>>3      byte&0xC0       0xC0           \b, Monaural
1351##>1     byte            ^0x01          \b, Data Verify
1352##>2     byte            &0x02          \b, Packet Pad
1353##>2     byte            &0x01          \b, Custom Flag
1354##>3     byte            &0x08          \b, Copyrighted
1355##>3     byte            &0x04          \b, Original Source
1356##>3     byte&0x03       1              \b, NR: 50/15 ms
1357##>3     byte&0x03       3              \b, NR: CCIT J.17
1358
1359# MP3, M2A
13600       beshort&0xFFFE  0xFFF2         MPEG ADTS, layer III, v2
1361!:mime	audio/mpeg
1362# rate
1363>2      byte&0xF0       0x10           \b,   8 kbps
1364>2      byte&0xF0       0x20           \b,  16 kbps
1365>2      byte&0xF0       0x30           \b,  24 kbps
1366>2      byte&0xF0       0x40           \b,  32 kbps
1367>2      byte&0xF0       0x50           \b,  40 kbps
1368>2      byte&0xF0       0x60           \b,  48 kbps
1369>2      byte&0xF0       0x70           \b,  56 kbps
1370>2      byte&0xF0       0x80           \b,  64 kbps
1371>2      byte&0xF0       0x90           \b,  80 kbps
1372>2      byte&0xF0       0xA0           \b,  96 kbps
1373>2      byte&0xF0       0xB0           \b, 112 kbps
1374>2      byte&0xF0       0xC0           \b, 128 kbps
1375>2      byte&0xF0       0xD0           \b, 144 kbps
1376>2      byte&0xF0       0xE0           \b, 160 kbps
1377# timing
1378>2      byte&0x0C       0x00           \b, 22.05 kHz
1379>2      byte&0x0C       0x04           \b, 24 kHz
1380>2      byte&0x0C       0x08           \b, 16 kHz
1381# channels/options
1382>3      byte&0xC0       0x00           \b, Stereo
1383>3      byte&0xC0       0x40           \b, JntStereo
1384>3      byte&0xC0       0x80           \b, 2x Monaural
1385>3      byte&0xC0       0xC0           \b, Monaural
1386#>1     byte            ^0x01          \b, Data Verify
1387#>2     byte            &0x02          \b, Packet Pad
1388#>2     byte            &0x01          \b, Custom Flag
1389#>3     byte            &0x08          \b, Copyrighted
1390#>3     byte            &0x04          \b, Original Source
1391#>3     byte&0x03       1              \b, NR: 50/15 ms
1392#>3     byte&0x03       3              \b, NR: CCIT J.17
1393
1394# MP2, M2A
13950       beshort&0xFFFE  0xFFF4         MPEG ADTS, layer II, v2
1396!:mime	audio/mpeg
1397# rate
1398>2      byte&0xF0       0x10           \b,   8 kbps
1399>2      byte&0xF0       0x20           \b,  16 kbps
1400>2      byte&0xF0       0x30           \b,  24 kbps
1401>2      byte&0xF0       0x40           \b,  32 kbps
1402>2      byte&0xF0       0x50           \b,  40 kbps
1403>2      byte&0xF0       0x60           \b,  48 kbps
1404>2      byte&0xF0       0x70           \b,  56 kbps
1405>2      byte&0xF0       0x80           \b,  64 kbps
1406>2      byte&0xF0       0x90           \b,  80 kbps
1407>2      byte&0xF0       0xA0           \b,  96 kbps
1408>2      byte&0xF0       0xB0           \b, 112 kbps
1409>2      byte&0xF0       0xC0           \b, 128 kbps
1410>2      byte&0xF0       0xD0           \b, 144 kbps
1411>2      byte&0xF0       0xE0           \b, 160 kbps
1412# timing
1413>2      byte&0x0C       0x00           \b, 22.05 kHz
1414>2      byte&0x0C       0x04           \b, 24 kHz
1415>2      byte&0x0C       0x08           \b, 16 kHz
1416# channels/options
1417>3      byte&0xC0       0x00           \b, Stereo
1418>3      byte&0xC0       0x40           \b, JntStereo
1419>3      byte&0xC0       0x80           \b, 2x Monaural
1420>3      byte&0xC0       0xC0           \b, Monaural
1421#>1     byte            ^0x01          \b, Data Verify
1422#>2     byte            &0x02          \b, Packet Pad
1423#>2     byte            &0x01          \b, Custom Flag
1424#>3     byte            &0x08          \b, Copyrighted
1425#>3     byte            &0x04          \b, Original Source
1426#>3     byte&0x03       1              \b, NR: 50/15 ms
1427#>3     byte&0x03       3              \b, NR: CCIT J.17
1428
1429# MPA, M2A
14300       beshort&0xFFFE  0xFFF6         MPEG ADTS, layer I, v2
1431!:mime	audio/mpeg
1432# rate
1433>2      byte&0xF0       0x10           \b,  32 kbps
1434>2      byte&0xF0       0x20           \b,  48 kbps
1435>2      byte&0xF0       0x30           \b,  56 kbps
1436>2      byte&0xF0       0x40           \b,  64 kbps
1437>2      byte&0xF0       0x50           \b,  80 kbps
1438>2      byte&0xF0       0x60           \b,  96 kbps
1439>2      byte&0xF0       0x70           \b, 112 kbps
1440>2      byte&0xF0       0x80           \b, 128 kbps
1441>2      byte&0xF0       0x90           \b, 144 kbps
1442>2      byte&0xF0       0xA0           \b, 160 kbps
1443>2      byte&0xF0       0xB0           \b, 176 kbps
1444>2      byte&0xF0       0xC0           \b, 192 kbps
1445>2      byte&0xF0       0xD0           \b, 224 kbps
1446>2      byte&0xF0       0xE0           \b, 256 kbps
1447# timing
1448>2      byte&0x0C       0x00           \b, 22.05 kHz
1449>2      byte&0x0C       0x04           \b, 24 kHz
1450>2      byte&0x0C       0x08           \b, 16 kHz
1451# channels/options
1452>3      byte&0xC0       0x00           \b, Stereo
1453>3      byte&0xC0       0x40           \b, JntStereo
1454>3      byte&0xC0       0x80           \b, 2x Monaural
1455>3      byte&0xC0       0xC0           \b, Monaural
1456#>1     byte            ^0x01          \b, Data Verify
1457#>2     byte            &0x02          \b, Packet Pad
1458#>2     byte            &0x01          \b, Custom Flag
1459#>3     byte            &0x08          \b, Copyrighted
1460#>3     byte            &0x04          \b, Original Source
1461#>3     byte&0x03       1              \b, NR: 50/15 ms
1462#>3     byte&0x03       3              \b, NR: CCIT J.17
1463
1464# MP3, M25A
14650       beshort&0xFFFE  0xFFE2         MPEG ADTS, layer III,  v2.5
1466!:mime	audio/mpeg
1467# rate
1468>2      byte&0xF0       0x10           \b,   8 kbps
1469>2      byte&0xF0       0x20           \b,  16 kbps
1470>2      byte&0xF0       0x30           \b,  24 kbps
1471>2      byte&0xF0       0x40           \b,  32 kbps
1472>2      byte&0xF0       0x50           \b,  40 kbps
1473>2      byte&0xF0       0x60           \b,  48 kbps
1474>2      byte&0xF0       0x70           \b,  56 kbps
1475>2      byte&0xF0       0x80           \b,  64 kbps
1476>2      byte&0xF0       0x90           \b,  80 kbps
1477>2      byte&0xF0       0xA0           \b,  96 kbps
1478>2      byte&0xF0       0xB0           \b, 112 kbps
1479>2      byte&0xF0       0xC0           \b, 128 kbps
1480>2      byte&0xF0       0xD0           \b, 144 kbps
1481>2      byte&0xF0       0xE0           \b, 160 kbps
1482# timing
1483>2      byte&0x0C       0x00           \b, 11.025 kHz
1484>2      byte&0x0C       0x04           \b, 12 kHz
1485>2      byte&0x0C       0x08           \b, 8 kHz
1486# channels/options
1487>3      byte&0xC0       0x00           \b, Stereo
1488>3      byte&0xC0       0x40           \b, JntStereo
1489>3      byte&0xC0       0x80           \b, 2x Monaural
1490>3      byte&0xC0       0xC0           \b, Monaural
1491#>1     byte            ^0x01          \b, Data Verify
1492#>2     byte            &0x02          \b, Packet Pad
1493#>2     byte            &0x01          \b, Custom Flag
1494#>3     byte            &0x08          \b, Copyrighted
1495#>3     byte            &0x04          \b, Original Source
1496#>3     byte&0x03       1              \b, NR: 50/15 ms
1497#>3     byte&0x03       3              \b, NR: CCIT J.17
1498
1499# AAC (aka MPEG-2 NBC audio) and MPEG-4 audio
1500
1501# Stored AAC streams (instead of the MP4 format)
15020       string          ADIF           MPEG ADIF, AAC
1503!:mime	audio/x-hx-aac-adif
1504>4      byte            &0x80
1505>>13    byte            &0x10          \b, VBR
1506>>13    byte            ^0x10          \b, CBR
1507>>16    byte&0x1E       0x02           \b, single stream
1508>>16    byte&0x1E       0x04           \b, 2 streams
1509>>16    byte&0x1E       0x06           \b, 3 streams
1510>>16    byte            &0x08          \b, 4 or more streams
1511>>16    byte            &0x10          \b, 8 or more streams
1512>>4    byte            &0x80          \b, Copyrighted
1513>>13   byte            &0x40          \b, Original Source
1514>>13   byte            &0x20          \b, Home Flag
1515>4      byte            ^0x80
1516>>4     byte            &0x10          \b, VBR
1517>>4     byte            ^0x10          \b, CBR
1518>>7     byte&0x1E       0x02           \b, single stream
1519>>7     byte&0x1E       0x04           \b, 2 streams
1520>>7     byte&0x1E       0x06           \b, 3 streams
1521>>7     byte            &0x08          \b, 4 or more streams
1522>>7     byte            &0x10          \b, 8 or more streams
1523>>4    byte            &0x40          \b, Original Stream(s)
1524>>4    byte            &0x20          \b, Home Source
1525
1526# Live or stored single AAC stream (used with MPEG-2 systems)
15270       beshort&0xFFF6  0xFFF0         MPEG ADTS, AAC
1528!:mime	audio/x-hx-aac-adts
1529>1      byte            &0x08          \b, v2
1530>1      byte            ^0x08          \b, v4
1531# profile
1532>>2     byte            &0xC0          \b LTP
1533>2      byte&0xc0       0x00           \b Main
1534>2      byte&0xc0       0x40           \b LC
1535>2      byte&0xc0       0x80           \b SSR
1536# timing
1537>2      byte&0x3c       0x00           \b, 96 kHz
1538>2      byte&0x3c       0x04           \b, 88.2 kHz
1539>2      byte&0x3c       0x08           \b, 64 kHz
1540>2      byte&0x3c       0x0c           \b, 48 kHz
1541>2      byte&0x3c       0x10           \b, 44.1 kHz
1542>2      byte&0x3c       0x14           \b, 32 kHz
1543>2      byte&0x3c       0x18           \b, 24 kHz
1544>2      byte&0x3c       0x1c           \b, 22.05 kHz
1545>2      byte&0x3c       0x20           \b, 16 kHz
1546>2      byte&0x3c       0x24           \b, 12 kHz
1547>2      byte&0x3c       0x28           \b, 11.025 kHz
1548>2      byte&0x3c       0x2c           \b, 8 kHz
1549# channels
1550>2      beshort&0x01c0  0x0040         \b, monaural
1551>2      beshort&0x01c0  0x0080         \b, stereo
1552>2      beshort&0x01c0  0x00c0         \b, stereo + center
1553>2      beshort&0x01c0  0x0100         \b, stereo+center+LFE
1554>2      beshort&0x01c0  0x0140         \b, surround
1555>2      beshort&0x01c0  0x0180         \b, surround + LFE
1556>2      beshort         &0x01C0        \b, surround + side
1557#>1     byte            ^0x01           \b, Data Verify
1558#>2     byte            &0x02           \b, Custom Flag
1559#>3     byte            &0x20           \b, Original Stream
1560#>3     byte            &0x10           \b, Home Source
1561#>3     byte            &0x08           \b, Copyrighted
1562
1563# Live MPEG-4 audio streams (instead of RTP FlexMux)
15640       beshort&0xFFE0  0x56E0         MPEG-4 LOAS
1565!:mime	audio/x-mp4a-latm
1566#>1     beshort&0x1FFF  x              \b, %hu byte packet
1567>3      byte&0xE0       0x40
1568>>4     byte&0x3C       0x04           \b, single stream
1569>>4     byte&0x3C       0x08           \b, 2 streams
1570>>4     byte&0x3C       0x0C           \b, 3 streams
1571>>4     byte            &0x08          \b, 4 or more streams
1572>>4     byte            &0x20          \b, 8 or more streams
1573>3      byte&0xC0       0
1574>>4     byte&0x78       0x08           \b, single stream
1575>>4     byte&0x78       0x10           \b, 2 streams
1576>>4     byte&0x78       0x18           \b, 3 streams
1577>>4     byte            &0x20          \b, 4 or more streams
1578>>4     byte            &0x40          \b, 8 or more streams
1579# This magic isn't strong enough (matches plausible ISO-8859-1 text)
1580#0       beshort         0x4DE1         MPEG-4 LO-EP audio stream
1581#!:mime	audio/x-mp4a-latm
1582
1583# Summary: FLI animation format
1584# Created by: Daniel Quinlan <quinlan@yggdrasil.com>
1585# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection)
15864	leshort		0xAF11
1587# standard FLI always has 320x200 resolution and 8 bit color
1588>8	leshort		320
1589>>10	leshort		200
1590>>>12	leshort		8			FLI animation, 320x200x8
1591!:mime	video/x-fli
1592>>>>6	leshort		x			\b, %d frames
1593# frame speed is multiple of 1/70s
1594>>>>16	leshort		x			\b, %d/70s per frame
1595
1596# Summary: FLC animation format
1597# Created by: Daniel Quinlan <quinlan@yggdrasil.com>
1598# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection)
15994	leshort		0xAF12
1600# standard FLC always use 8 bit color
1601>12	leshort		8			FLC animation
1602!:mime	video/x-flc
1603>>8	leshort		x			\b, %d
1604>>10	leshort		x			\bx%dx8
1605>>6	uleshort	x			\b, %d frames
1606>>16	uleshort	x			\b, %dms per frame
1607
1608# DL animation format
1609# XXX - collision with most `mips' magic
1610#
1611# I couldn't find a real magic number for these, however, this
1612# -appears- to work.  Note that it might catch other files, too, so be
1613# careful!
1614#
1615# Note that title and author appear in the two 20-byte chunks
1616# at decimal offsets 2 and 22, respectively, but they are XOR'ed with
1617# 255 (hex FF)!  The DL format is really bad.
1618#
1619#0	byte	1	DL version 1, medium format (160x100, 4 images/screen)
1620#!:mime	video/x-unknown
1621#>42	byte	x	- %d screens,
1622#>43	byte	x	%d commands
1623#0	byte	2	DL version 2
1624#!:mime	video/x-unknown
1625#>1	byte	1	- large format (320x200,1 image/screen),
1626#>1	byte	2	- medium format (160x100,4 images/screen),
1627#>1	byte	>2	- unknown format,
1628#>42	byte	x	%d screens,
1629#>43	byte	x	%d commands
1630# Based on empirical evidence, DL version 3 have several nulls following the
1631# \003.  Most of them start with non-null values at hex offset 0x34 or so.
1632#0	string	\3\0\0\0\0\0\0\0\0\0\0\0	DL version 3
1633
1634# iso 13818 transport stream
1635#
1636# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1)
1637# syncbyte      8 bit	0x47
1638# error_ind     1 bit	-
1639# payload_start 1 bit	1
1640# priority      1 bit	-
1641# PID          13 bit	0x0000
1642# scrambling    2 bit	-
1643# adaptfld_ctrl 2 bit	1 or 3
1644# conti_count   4 bit	-
16450	belong&0xFF5FFF10	0x47400010
1646>188	byte			0x47		MPEG transport stream data
1647!:mime  video/MP2T
1648
1649# DIF digital video file format <mpruett@sgi.com>
16500	belong&0xffffff00	0x1f070000      DIF
1651>4	byte			&0x01		(DVCPRO) movie file
1652>4	byte			^0x01		(DV) movie file
1653>3	byte			&0x80		(PAL)
1654>3	byte			^0x80		(NTSC)
1655
1656# MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
16570	string			\x8aMNG		MNG video data,
1658!:mime	video/x-mng
1659>4	belong			!0x0d0a1a0a	CORRUPTED,
1660>4	belong			0x0d0a1a0a
1661>>16    belong	x				%d x
1662>>20    belong	x				%d
1663
1664# JNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
16650	string			\x8bJNG		JNG video data,
1666!:mime	video/x-jng
1667>4	belong			!0x0d0a1a0a	CORRUPTED,
1668>4	belong			0x0d0a1a0a
1669>>16    belong	x				%d x
1670>>20    belong	x				%d
1671
1672# Vivo video (Wolfram Kleff)
16733	string		\x0D\x0AVersion:Vivo	Vivo video data
1674
1675# ABC (alembic.io 3d models)
16760	string	0gawa		ABC 3d model
1677
1678# VRML (Virtual Reality Modelling Language)
16790       string/w        #VRML\ V1.0\ ascii	VRML 1 file
1680!:mime	model/vrml
16810	string/w	#VRML\ V2.0\ utf8	ISO/IEC 14772 VRML 97 file
1682!:mime	model/vrml
1683
1684# X3D (Extensible 3D) [https://www.web3d.org/specifications/x3d-3.0.dtd]
1685# From Michel Briand <michelbriand@free.fr>
1686# mimetype from https://www.iana.org/assignments/media-types/model/x3d+xml
1687# Example https://www.web3d.org/x3d/content/examples/Basic/course/CreateX3DFromStringRandomSpheres.x3d
16880	string/w	\<?xml\ version=
1689!:strength + 5
1690>20	search/1000/w	\<!DOCTYPE\ X3D		X3D (Extensible 3D) model xml text
1691!:mime model/x3d+xml
1692
1693#---------------------------------------------------------------------------
1694# HVQM4: compressed movie format designed by Hudson for Nintendo GameCube
1695# From Mark Sheppard <msheppard@climax.co.uk>, 2002-10-03
1696#
16970	string		HVQM4		%s
1698>6	string		>\0		v%s
1699>0	byte		x		GameCube movie,
1700>0x34	ubeshort	x		%d x
1701>0x36	ubeshort	x		%d,
1702>0x26	ubeshort	x		%dus,
1703>0x42	ubeshort	0		no audio
1704>0x42	ubeshort	>0		%dHz audio
1705
1706# From: Stefan A. Haubenthal <polluks@sdf.lonestar.org>
1707# Update: Joerg Jenderek
1708# URL: https://en.wikipedia.org/wiki/VOB
17090	string		DVDVIDEO-VTS	Video title set,
1710!:mime	video/x-ifo
1711!:ext	ifo/bup
1712>0x21	byte		x		v%x
17130	string		DVDVIDEO-VMG	Video manager,
1714!:mime	video/x-ifo
1715!:ext	ifo/bup
1716>0x21	byte		x		v%x
1717
1718# From: Stefan A. Haubenthal <polluks@sdf.lonestar.org>
17190 string xMovieSetter MovieSetter movie
17200 string xSceneEditor MovieSetter movie
1721
1722# From: Behan Webster <behanw@websterwood.com>
1723# NuppelVideo used by Mythtv (*.nuv)
1724# Note: there are two identical stanzas here differing only in the
1725# initial string matched. It used to be done with a regex, but we're
1726# trying to get rid of those.
17270	string		NuppelVideo	MythTV NuppelVideo
1728>12	string		x		v%s
1729>20	lelong		x		(%d
1730>24	lelong		x		\bx%d),
1731>36	string		P		\bprogressive,
1732>36	string		I		\binterlaced,
1733>40	ledouble	x		\baspect:%.2f,
1734>48	ledouble	x		\bfps:%.2f
17350	string		MythTV		MythTV NuppelVideo
1736>12	string		x		v%s
1737>20	lelong		x		(%d
1738>24	lelong		x		\bx%d),
1739>36	string		P		\bprogressive,
1740>36	string		I		\binterlaced,
1741>40	ledouble	x		\baspect:%.2f,
1742>48	ledouble	x		\bfps:%.2f
1743
1744#						MPEG file
1745# MPEG sequences
1746# FIXME: This section is from the old magic.mime file and needs
1747# integrating with the rest
1748#0       belong             0x000001BA
1749#>4      byte               &0x40
1750#!:mime	video/mp2p
1751#>4      byte               ^0x40
1752#!:mime	video/mpeg
1753#0       belong             0x000001BB
1754#!:mime	video/mpeg
1755#0       belong             0x000001B0
1756#!:mime	video/mp4v-es
1757#0       belong             0x000001B5
1758#!:mime	video/mp4v-es
1759#0       belong             0x000001B3
1760#!:mime	video/mpv
1761#0       belong&0xFF5FFF10  0x47400010
1762#!:mime	video/mp2t
1763#0       belong             0x00000001
1764#>4      byte&0x1F	   0x07
1765#!:mime	video/h264
1766
1767# Type: Bink Video
1768# Extension: .bik
1769# URL:  https://wiki.multimedia.cx/index.php?title=Bink_Container
1770# From: <hoehle@users.sourceforge.net>  2008-07-18
17710	name		bik
1772#>4	ulelong		x	size %d
1773>20	ulelong		x	\b, %d
1774>24	ulelong		x	\bx%d
1775>8	ulelong		x	\b, %d frames
1776>32	ulelong		x	at rate %d/
1777>28	ulelong		>1	\b%d
1778>40	ulelong		=0	\b, no audio
1779>40	ulelong		!0	\b, %d audio track
1780>>40	ulelong		!1	\bs
1781# follow properties of the first audio track only
1782>>48	uleshort	x	%dHz
1783>>51	byte&0x20	0	mono
1784>>51	byte&0x20	!0	stereo
1785#>>51	byte&0x10	0	FFT
1786#>>51	byte&0x10	!0	DCT
1787
17880	string		BIK
1789>3	regex		=[bdfghi]	Bink Video rev.%s
1790>>0	use		bik
1791
17920	string		KB2
1793>3	regex		=[adfghi]	Bink Video 2 rev.%s
1794>>0	use		bik
1795
1796# Type:	NUT Container
1797# URL:	https://wiki.multimedia.cx/index.php?title=NUT
1798# From:	Adam Buchbinder <adam.buchbinder@gmail.com>
17990	string	nut/multimedia\ container\0	NUT multimedia container
1800
1801# Type: Nullsoft Video (NSV)
1802# URL:  https://wiki.multimedia.cx/index.php?title=Nullsoft_Video
1803# From: Mike Melanson <mike@multimedia.cx>
18040	string	NSVf	Nullsoft Video
1805
1806# Type: REDCode Video
1807# URL:  https://www.red.com/ ; https://wiki.multimedia.cx/index.php?title=REDCode
1808# From: Mike Melanson <mike@multimedia.cx>
18094	string	RED1	REDCode Video
1810
1811# Type: MTV Multimedia File
1812# URL:  https://wiki.multimedia.cx/index.php?title=MTV
1813# From: Mike Melanson <mike@multimedia.cx>
18140	string	AMVS	MTV Multimedia File
1815
1816# Type: ARMovie
1817# URL:  https://wiki.multimedia.cx/index.php?title=ARMovie
1818# From: Mike Melanson <mike@multimedia.cx>
18190	string	ARMovie\012	ARMovie
1820
1821# Type: Interplay MVE Movie
1822# URL:  https://wiki.multimedia.cx/index.php?title=Interplay_MVE
1823# From: Mike Melanson <mike@multimedia.cx>
18240	string	Interplay\040MVE\040File\032	Interplay MVE Movie
1825
1826# Type: Windows Television DVR File
1827# URL:  https://wiki.multimedia.cx/index.php?title=WTV
1828# From: Mike Melanson <mike@mutlimedia.cx>
1829# This takes the form of a Windows-style GUID
18300	bequad	0xB7D800203749DA11
1831>8	bequad	0xA64E0007E95EAD8D	Windows Television DVR Media
1832
1833# Type: Sega FILM/CPK Multimedia
1834# URL:  https://wiki.multimedia.cx/index.php?title=Sega_FILM
1835# From: Mike Melanson <mike@multimedia.cx>
18360	string	FILM	Sega FILM/CPK Multimedia,
1837>32	belong	x	%d x
1838>28	belong	x	%d
1839
1840# Type: Nintendo THP Multimedia
1841# URL:  https://wiki.multimedia.cx/index.php?title=THP
1842# From: Mike Melanson <mike@multimedia.cx>
18430	string	THP\0	Nintendo THP Multimedia
1844
1845# Type: BBC Dirac Video
1846# URL:  https://wiki.multimedia.cx/index.php?title=Dirac
1847# From: Mike Melanson <mike@multimedia.cx>
18480	string	BBCD	BBC Dirac Video
1849
1850# Type: RAD Game Tools Smacker Multimedia
1851# URL:  https://wiki.multimedia.cx/index.php?title=Smacker
1852# From: Mike Melanson <mike@multimedia.cx>
18530	string	SMK	RAD Game Tools Smacker Multimedia
1854>3	byte	x	version %c,
1855>4	lelong	x	%d x
1856>8	lelong	x	%d,
1857>12	lelong	x	%d frames
1858
1859# Material Exchange Format
1860# More information:
1861# https://en.wikipedia.org/wiki/Material_Exchange_Format
1862# http://www.freemxf.org/
18630	string	\x06\x0e\x2b\x34\x02\x05\x01\x01\x0d\x01\x02\x01\x01\x02	Material exchange container format
1864!:ext	mxf
1865!:mime	application/mxf
1866
1867# Recognize LucasArts Smush video files (cf.
1868# https://wiki.multimedia.cx/index.php/Smush)
18690	string	ANIM
1870>8	string	AHDR	LucasArts Smush Animation Format (SAN) video
18710	string	SANM
1872>8	string	SHDR	LucasArts Smush v2 (SANM) video
1873
1874# Type: Scaleform video
1875# Extension: .usm
1876# URL:  https://wiki.multimedia.cx/index.php/USM
1877# From: David Korth <gerbilsoft@gerbilsoft.com>
18780	string	CRID
1879>32	string	@UTF	Scaleform video
1880
1881# http://www.jerrysguide.com/tips/demystify-tvs-file-format.html
18820	string	TVS\015\012
1883>&0	string	Version\040	TeamViewer Session File
1884>>&0	string	x		\b, version %s
1885
1886#------------------------------------------------------------------------------
1887# $File: aout,v 1.1 2013/01/09 22:37:23 christos Exp $
1888# aout:  file(1) magic for a.out executable/object/etc entries that
1889# handle executables on multiple platforms.
1890#
1891
1892#
1893# Little-endian 32-bit-int a.out, merged from bsdi (for BSD/OS, from
1894# BSDI), netbsd, and vax (for UNIX/32V and BSD)
1895#
1896# XXX - is there anything we can look at to distinguish BSD/OS 386 from
1897# NetBSD 386 from various VAX binaries?  The BSD/OS shared library flag
1898# works only for binaries using shared libraries.  Grabbing the entry
1899# point from the a.out header, using it to find the first code executed
1900# in the program, and looking at that might help.
1901#
19020	lelong		0407		a.out little-endian 32-bit executable
1903>16	lelong		>0		not stripped
1904>32	byte		0x6a		(uses BSD/OS shared libs)
1905
19060	lelong		0410		a.out little-endian 32-bit pure executable
1907>16	lelong		>0		not stripped
1908>32	byte		0x6a		(uses BSD/OS shared libs)
1909
19100	lelong		0413		a.out little-endian 32-bit demand paged pure executable
1911>16	lelong		>0		not stripped
1912>32	byte		0x6a		(uses BSD/OS shared libs)
1913
1914#
1915# Big-endian 32-bit-int a.out, merged from sun (for old 68010 SunOS a.out),
1916# mips (for old 68020(!) SGI a.out), and netbsd (for old big-endian a.out).
1917#
1918# XXX - is there anything we can look at to distinguish old SunOS 68010
1919# from old 68020 IRIX from old NetBSD?  Again, I guess we could look at
1920# the first instruction or instructions in the program.
1921#
19220	belong		0407		a.out big-endian 32-bit executable
1923>16	belong		>0		not stripped
1924
19250	belong		0410		a.out big-endian 32-bit pure executable
1926>16	belong		>0		not stripped
1927
19280	belong		0413		a.out big-endian 32-bit demand paged executable
1929>16	belong		>0		not stripped
1930
1931
1932#------------------------------------------------------------------------------
1933# $File: apache,v 1.1 2017/04/11 14:52:15 christos Exp $
1934# apache: file(1) magic for Apache Big Data formats
1935
1936# Avro files
19370	string		Obj		Apache Avro
1938>3	byte		x		version %d
1939
1940# ORC files
1941# Important information is in file footer, which we can't index to :(
19420	string		ORC		Apache ORC
1943
1944# Parquet files
19450	string		PAR1		Apache Parquet
1946
1947# Hive RC files
19480	string		RCF		Apache Hive RC file
1949>3	byte		x		version %d
1950
1951# Sequence files (and the careless first version of RC file)
1952
19530	string		SEQ
1954>3	byte		<6		Apache Hadoop Sequence file version %d
1955>3	byte		>6		Apache Hadoop Sequence file version %d
1956>3	byte		=6
1957>>5	string		org.apache.hadoop.hive.ql.io.RCFile$KeyBuffer  Apache Hive RC file version 0
1958>>3	default		x		Apache Hadoop Sequence file version 6
1959
1960#------------------------------------------------------------------------------
1961# $File: apl,v 1.6 2009/09/19 16:28:07 christos Exp $
1962# apl:  file(1) magic for APL (see also "pdp" and "vax" for other APL
1963#       workspaces)
1964#
19650	long		0100554		APL workspace (Ken's original?)
1966
1967#------------------------------------------------------------------------------
1968# $File: apple,v 1.44 2019/10/18 15:21:02 christos Exp $
1969# apple:  file(1) magic for Apple file formats
1970#
19710	search/1/t	FiLeStArTfIlEsTaRt	binscii (apple ][) text
19720	string		\x0aGL			Binary II (apple ][) data
19730	string		\x76\xff		Squeezed (apple ][) data
19740	string		NuFile			NuFile archive (apple ][) data
19750	string		N\xf5F\xe9l\xe5		NuFile archive (apple ][) data
19760	belong		0x00051600		AppleSingle encoded Macintosh file
19770	belong		0x00051607		AppleDouble encoded Macintosh file
1978
1979# Type: Apple Emulator WOZ format
1980# From: Greg Wildman <greg@apple2.org.za>
1981# Ref: https://applesaucefdc.com/woz/reference/
1982# Ref: https://applesaucefdc.com/woz/reference2/
1983#
1984# Note: The following test are mostly identical. I would rather not
1985# use a regex to identify the WOZ format number.
19860	string		WOZ1
1987>4	string		\xFF\x0A\x0D\x0A	Apple ][ WOZ 1.0 Disk Image
1988>12	string		INFO
1989>>21	byte		01			\b, 5.25 inch
1990>>21	byte		02			\b, 3.5 inch
1991>>22	byte		01			\b, write protected
1992>>23	byte		01			\b, cross track synchronized
1993>>25	string/T	x			\b, %.32s
19940	string		WOZ2
1995>4	string		\xFF\x0A\x0D\x0A	Apple ][ WOZ 2.0 Disk Image
1996>12	string		INFO
1997>>21	byte		01			\b, 5.25 inch
1998>>21	byte		02			\b, 3.5 inch
1999>>22	byte		01			\b, write protected
2000>>23	byte		01			\b, cross track synchronized
2001>>25	string/T	x			\b, %.32s
2002
2003# Type: Apple Emulator disk images
2004# From: Greg Wildman <greg@apple2.org.za>
2005# ProDOS boot loader?
20060		string	\x01\x38\xB0\x03\x4C	Apple ProDOS Image
2007# Detect Volume Directory block ($02)
2008>0x400		string	\x00\x00\x03\x00
2009>>0x404		byte	&0xF0
2010>>>0x405	string	x			\b, Volume /%s
2011>>>0x429	leshort	x			\b, %u Blocks
2012# ProDOS ordered ?
2013>0xb00		string	\x00\x00\x03\x00
2014>>0xb04		byte	&0xF0
2015>>>0xb05	string	x			\b, Volume /%s
2016>>>0xb29	leshort	x			\b, %u Blocks
2017#
2018# DOS3.3 boot loader?
20190		string	\x01\xA5\x27\xC9\x09\xD0\x18\xA5\x2B
2020>0x11001	string	\x11\x0F\x03	Apple DOS 3.3 Image
2021>>0x11006	byte	x		\b, Volume %u
2022>>0x11034	byte	x		\b, %u Tracks
2023>>0x11035	byte	x		\b, %u Sectors
2024>>0x11036	leshort	x		\b, %u bytes per sector
2025# DOS3.2 ?
2026>0x11001	string	\x11\x0C\x02	Apple DOS 3.2 Image
2027>>0x11006	byte	x		\b, Volume %u
2028>>0x11034	byte	x		\b, %u Tracks
2029>>0x11035	byte	x		\b, %u Sectors
2030>>0x11036	leshort	x		\b, %u bytes per sector
2031# DOS3.1 ?
2032>0x11001	string	\x11\x0C\x01
2033>>0x11c00	string	\x00\x11\x0B	Apple DOS 3.1 Image
2034#
2035# Pascal boot loader?
20360		string	\x01\xE0\x60\xF0\x03\x4C\xE3\x08\xAD
2037>0xd6		pstring SYSTEM.APPLE
2038>>0xb00		leshort	0x0000
2039>>>0xb04	leshort 0x0000		Apple Pascal Image
2040>>>>0xb06	pstring x		\b, Volume %s:
2041>>>>0xb0e	leshort x		\b, %u Blocks
2042>>>>0xb10	leshort x		\b, %u Files
2043#
2044# Diversi Dos boot loader?
20450		string	\x01\xA8\xAD\x81\xC0\xEE\x09\x08\xAD
2046>0x11001	string	\x11\x0F\x03	Apple Diversi Dos Image
2047>>0x11006	byte	x		\b, Volume %u
2048>>0x11034	byte	x		\b, %u Tracks
2049>>0x11035	byte	x		\b, %u Sectors
2050>>0x11036	leshort	x		\b, %u bytes per sector
2051
2052# Type: Apple Emulator 2IMG format
2053# From: Radek Vokal <rvokal@redhat.com>
2054# Update: Greg Wildman <greg@apple2.org.za>
20550		string	2IMG		Apple ][ 2IMG Disk Image
2056>4		clear	x
2057>4		string	XGS!		\b, XGS
2058>4		string	CTKG		\b, Catakig
2059>4		string	ShIm		\b, Sheppy's ImageMaker
2060>4		string	SHEP		\b, Sheppy's ImageMaker
2061>4		string	WOOF		\b, Sweet 16
2062>4		string	B2TR		\b, Bernie ][ the Rescue
2063>4		string	\!nfc		\b, ASIMOV2
2064>4		string	\>BD\<		\b, Brutal Deluxe's Cadius
2065>4		string	CdrP		\b, CiderPress
2066>4		string	Vi][		\b, Virtual ][
2067>4		string	PRFS		\b, ProFUSE
2068>4		string	FISH		\b, FishWings
2069>4		string	RVLW		\b, Revival for Windows
2070>4		default	x
2071>>4		string	x		\b, Creator tag "%-4.4s"
2072>0xc		byte	00		\b, DOS 3.3 sector order
2073>>0x10		byte	00		\b, Volume 254
2074>>0x10		byte&0x7f x		\b, Volume %u
2075>0xc		byte	01		\b, ProDOS sector order
2076# Detect Volume Directory block ($02) + 2mg header offset
2077>>0x440		string	\x00\x00\x03\x00
2078>>>0x444	byte	&0xF0
2079>>>>0x445	string	x		\b, Volume /%s
2080>>>>0x469	leshort	x		\b, %u Blocks
2081>0xc		byte	02		\b, NIB data
2082
2083# magic for Newton PDA package formats
2084# from Ruda Moura <ruda@helllabs.org>
20850	string	package0	Newton package, NOS 1.x,
2086>12	belong	&0x80000000	AutoRemove,
2087>12	belong	&0x40000000	CopyProtect,
2088>12	belong	&0x10000000	NoCompression,
2089>12	belong	&0x04000000	Relocation,
2090>12	belong	&0x02000000	UseFasterCompression,
2091>16	belong	x		version %d
2092
20930	string	package1	Newton package, NOS 2.x,
2094>12	belong	&0x80000000	AutoRemove,
2095>12	belong	&0x40000000	CopyProtect,
2096>12	belong	&0x10000000	NoCompression,
2097>12	belong	&0x04000000	Relocation,
2098>12	belong	&0x02000000	UseFasterCompression,
2099>16	belong	x		version %d
2100
21010	string	package4	Newton package,
2102>8	byte	8		NOS 1.x,
2103>8	byte	9		NOS 2.x,
2104>12	belong	&0x80000000	AutoRemove,
2105>12	belong	&0x40000000	CopyProtect,
2106>12	belong	&0x10000000	NoCompression,
2107
2108# The following entries for the Apple II are for files that have
2109# been transferred as raw binary data from an Apple, without having
2110# been encapsulated by any of the above archivers.
2111#
2112# In general, Apple II formats are hard to identify because Apple DOS
2113# and especially Apple ProDOS have strong typing in the file system and
2114# therefore programmers never felt much need to include type information
2115# in the files themselves.
2116#
2117# Eric Fischer <enf@pobox.com>
2118
2119# AppleWorks word processor:
2120# URL: https://en.wikipedia.org/wiki/AppleWorks
2121# Reference: http://www.gno.org/pub/apple2/doc/apple/filetypes/ftn.1a.xxxx
2122# Update: Joerg Jenderek
2123# NOTE:
2124# The "O" is really the magic number, but that's so common that it's
2125# necessary to check the tab stops that follow it to avoid false positives.
2126# and/or look for unused bits of booleans bytes like zoom, paginated, mail merge
2127# the newer AppleWorks is from claris with extension CWK
21284	string		O
2129# test for unused bits of zoom- , paginated-boolean bytes
2130>84	ubequad		^0x00Fe00000000Fe00
2131# look for tabstop definitions "=" no tab, "|" no tab
2132# "<" left tab,"^" center tab,">" right tab, "." decimal tab,
2133# unofficial "!" other , "\x8a" other
2134# official only if SFMinVers is nonzero
2135>>5	regex/s	[=.<>|!^\x8a]{79}	AppleWorks Word Processor
2136# AppleWorks Word Processor File (Apple II)
2137# ./apple (version 5.25) labeled the entry as "AppleWorks word processor data"
2138# application/x-appleworks is mime type for claris version with cwk extension
2139!:mime	application/x-appleworks3
2140# http://home.earthlink.net/~hughhood/appleiiworksenvoy/
2141# ('p' + 1-byte ProDOS File Type + 2-byte ProDOS Aux Type')
2142# $70 $1A $F8 $FF is this the apple type ?
2143#:apple pdosp^Z\xf8\xff
2144!:ext awp
2145# minimum version needed to read this files. SFMinVers (0 , 30~3.0 )
2146>>>183	ubyte		30	3.0
2147>>>183	ubyte		!30
2148>>>>183	ubyte		!0	0x%x
2149# usual tabstop start sequence "=====<"
2150>>>5	string		x	\b, tabstop ruler "%6.6s"
2151# tabstop ruler
2152#>>>5	string		>\0	\b, tabstops "%-79s"
2153# zoom switch
2154>>>85	  byte&0x01	>0	\b, zoomed
2155# whether paginated
2156>>>90	  byte&0x01	>0	\b, paginated
2157# contains any mail-merge commands
2158>>>92	  byte&0x01	>0	\b, with mail merge
2159# left margin in 1/10 inches ( normally 0 or 10 )
2160>>>91	ubyte		>0
2161>>>>91	ubyte		x	\b, %d/10 inch left margin
2162
2163# AppleWorks database:
2164#
2165# This isn't really a magic number, but it's the closest thing to one
2166# that I could find.  The 1 and 2 really mean "order in which you defined
2167# categories" and "left to right, top to bottom," respectively; the D and R
2168# mean that the cursor should move either down or right when you press Return.
2169
2170#30	string		\x01D	AppleWorks database data
2171#30	string		\x02D	AppleWorks database data
2172#30	string		\x01R	AppleWorks database data
2173#30	string		\x02R	AppleWorks database data
2174
2175# AppleWorks spreadsheet:
2176#
2177# Likewise, this isn't really meant as a magic number.  The R or C means
2178# row- or column-order recalculation; the A or M means automatic or manual
2179# recalculation.
2180
2181#131	string		RA	AppleWorks spreadsheet data
2182#131	string		RM	AppleWorks spreadsheet data
2183#131	string		CA	AppleWorks spreadsheet data
2184#131	string		CM	AppleWorks spreadsheet data
2185
2186# Applesoft BASIC:
2187#
2188# This is incredibly sloppy, but will be true if the program was
2189# written at its usual memory location of 2048 and its first line
2190# number is less than 256.  Yuck.
2191# update by Joerg Jenderek at Feb 2013
2192
2193# GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000)
2194#0       belong&0xff00ff 0x80000 Applesoft BASIC program data
21950	belong&0x00ff00ff	0x00080000
2196# assuming that line number must be positive
2197>2	leshort			>0		Applesoft BASIC program data, first line number %d
2198#>2     leshort         x       \b, first line number %d
2199
2200# ORCA/EZ assembler:
2201#
2202# This will not identify ORCA/M source files, since those have
2203# some sort of date code instead of the two zero bytes at 6 and 7
2204# XXX Conflicts with ELF
2205#4       belong&0xff00ffff       0x01000000      ORCA/EZ assembler source data
2206#>5      byte                    x               \b, build number %d
2207
2208# Broderbund Fantavision
2209#
2210# I don't know what these values really mean, but they seem to recur.
2211# Will they cause too many conflicts?
2212
2213# Probably :-)
2214#2	belong&0xFF00FF		0x040008	Fantavision movie data
2215
2216# Some attempts at images.
2217#
2218# These are actually just bit-for-bit dumps of the frame buffer, so
2219# there's really no reasonably way to distinguish them except for their
2220# address (if preserved) -- 8192 or 16384 -- and their length -- 8192
2221# or, occasionally, 8184.
2222#
2223# Nevertheless this will manage to catch a lot of images that happen
2224# to have a solid-colored line at the bottom of the screen.
2225
2226# GRR: Magic too weak
2227#8144	string	\x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F	Apple II image with white background
2228#8144	string	\x55\x2A\x55\x2A\x55\x2A\x55\x2A	Apple II image with purple background
2229#8144	string	\x2A\x55\x2A\x55\x2A\x55\x2A\x55	Apple II image with green background
2230#8144	string	\xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA	Apple II image with blue background
2231#8144	string	\xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5	Apple II image with orange background
2232
2233# Beagle Bros. Apple Mechanic fonts
2234
22350	belong&0xFF00FFFF	0x6400D000	Apple Mechanic font
2236
2237# Apple Universal Disk Image Format (UDIF) - dmg files.
2238# From Johan Gade.
2239# These entries are disabled for now until we fix the following issues.
2240#
2241# Note there might be some problems with the "VAX COFF executable"
2242# entry. Note this entry should be placed before the mac filesystem section,
2243# particularly the "Apple Partition data" entry.
2244#
2245# The intended meaning of these tests is, that the file is only of the
2246# specified type if both of the lines are correct - i.e. if the first
2247# line matches and the second doesn't then it is not of that type.
2248#
2249#0	long	0x7801730d
2250#>4	long	0x62626060	UDIF read-only zlib-compressed image (UDZO)
2251#
2252# Note that this entry is recognized correctly by the "Apple Partition
2253# data" entry - however since this entry is more specific - this
2254# information seems to be more useful.
2255#0	long	0x45520200
2256#>0x410	string	disk\ image	UDIF read/write image (UDRW)
2257
2258# From: Toby Peterson <toby@apple.com>
22590	string	bplist00	Apple binary property list
2260
2261# Apple binary property list (bplist)
2262#  Assumes version bytes are hex.
2263#  Provides content hints for version 0 files. Assumes that the root
2264#  object is the first object (true for CoreFoundation implementation).
2265# From: David Remahl <dremahl@apple.com>
22660		string	bplist
2267>6		byte	x	\bCoreFoundation binary property list data, version 0x%c
2268>>7		byte	x	\b%c
2269>6		string		00		\b
2270>>8		byte&0xF0	0x00	\b
2271>>>8	byte&0x0F	0x00	\b, root type: null
2272>>>8	byte&0x0F	0x08	\b, root type: false boolean
2273>>>8	byte&0x0F	0x09	\b, root type: true boolean
2274>>8		byte&0xF0	0x10	\b, root type: integer
2275>>8		byte&0xF0	0x20	\b, root type: real
2276>>8		byte&0xF0	0x30	\b, root type: date
2277>>8		byte&0xF0	0x40    \b, root type: data
2278>>8		byte&0xF0	0x50	\b, root type: ascii string
2279>>8		byte&0xF0	0x60	\b, root type: unicode string
2280>>8		byte&0xF0	0x80	\b, root type: uid (CORRUPT)
2281>>8		byte&0xF0	0xa0	\b, root type: array
2282>>8		byte&0xF0	0xd0	\b, root type: dictionary
2283
2284# Apple/NeXT typedstream data
2285#  Serialization format used by NeXT and Apple for various
2286#  purposes in YellowStep/Cocoa, including some nib files.
2287# From: David Remahl <dremahl@apple.com>
22882		string		typedstream	NeXT/Apple typedstream data, big endian
2289>0		byte		x		\b, version %d
2290>0		byte		<5		\b
2291>>13	byte		0x81	\b
2292>>>14	ubeshort	x		\b, system %d
22932		string		streamtyped NeXT/Apple typedstream data, little endian
2294>0		byte		x		\b, version %d
2295>0		byte		<5		\b
2296>>13	byte		0x81	\b
2297>>>14	uleshort	x		\b, system %d
2298
2299#------------------------------------------------------------------------------
2300# CAF: Apple CoreAudio File Format
2301#
2302# Container format for high-end audio purposes.
2303# From: David Remahl <dremahl@apple.com>
2304#
23050	string		caff		CoreAudio Format audio file
2306>4	beshort		<10		version %d
2307>6	beshort		x
2308
2309
2310#------------------------------------------------------------------------------
2311# Keychain database files
23120	string		kych		Mac OS X Keychain File
2313
2314#------------------------------------------------------------------------------
2315# Code Signing related file types
23160	belong		0xfade0c00	Mac OS X Code Requirement
2317>8	belong		1			(opExpr)
2318>4	belong		x			- %d bytes
2319
23200	belong		0xfade0c01	Mac OS X Code Requirement Set
2321>8	belong		>1			containing %d items
2322>4	belong		x			- %d bytes
2323
23240	belong		0xfade0c02	Mac OS X Code Directory
2325>8	belong		x			version %x
2326>12	belong		>0			flags 0x%x
2327>4	belong		x			- %d bytes
2328
23290	belong		0xfade0cc0	Mac OS X Detached Code Signature (non-executable)
2330>4	belong		x			- %d bytes
2331
23320	belong		0xfade0cc1	Mac OS X Detached Code Signature
2333>8	belong		>1			(%d elements)
2334>4	belong		x			- %d bytes
2335
2336# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
2337# .vdi
23384	string innotek\ VirtualBox\ Disk\ Image %s
2339
2340# Apple disk partition stuff
2341# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
2342# Reference: https://ftp.netbsd.org/pub/NetBSD/NetBSD-current/src/sys/sys/bootblock.h
2343# Update: Joerg Jenderek
2344# "ER" is APPLE_DRVR_MAP_MAGIC signature
23450	beshort	0x4552
2346# display Apple Driver Map (strength=50) after Syslinux bootloader (71)
2347#!:strength +0
2348# strengthen the magic by looking for used blocksizes 512 2048
2349>2	ubeshort&0xf1FF		0	Apple Driver Map
2350# last 6 bytes for padding found are 0 or end with 55AAh marker for MBR hybrid
2351#>>504	ubequad&0x0000FFffFFff0000	0
2352!:mime	application/x-apple-diskimage
2353!:apple	????devr
2354# https://en.wikipedia.org/wiki/Apple_Disk_Image
2355!:ext	dmg/iso
2356# sbBlkSize for driver descriptor map 512 2048
2357>>2	beshort	x			\b, blocksize %d
2358# sbBlkCount sometimes garbish like
2359# 0xb0200000 for unzlibed install_flash_player_19.0.0.245_osx.dmg
2360# 0xf2720100 for bunziped Firefox 48.0-2.dmg
2361# 0xeb02ffff for super_grub2_disk_hybrid_2.02s3.iso
2362# 0x00009090 by syslinux-6.03/utils/isohybrid.c
2363>>4	ubelong	x			\b, blockcount %u
2364# following device/driver information not very useful
2365# device type 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
2366>>8	ubeshort	x		\b, devtype %u
2367# device id 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
2368>>10	ubeshort	x		\b, devid %u
2369# driver data 0 (2425393296 garbage for super_grub2_disk_hybrid_2.02s3.iso)
2370>>12	ubelong		>0
2371>>>12	ubelong		x		\b, driver data %u
2372# number of driver descriptors sbDrvrCount <= 61
2373# (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
2374>>16	ubeshort	x		\b, driver count %u
2375# 61 * apple_drvr_descriptor[8]. information not very useful or same as in partition map
2376# >>18	use		apple-driver-map
2377# >>26	use		apple-driver-map
2378# # ...
2379# >>500	use		apple-driver-map
2380# number of partitions is always same in every partition (map block count)
2381#>>0x0204	ubelong		x	\b, %u partitions
2382>>0x0204	ubelong		>0	\b, contains[@0x200]:
2383>>>0x0200	use		apple-apm
2384>>0x0204	ubelong		>1	\b, contains[@0x400]:
2385>>>0x0400	use		apple-apm
2386>>0x0204	ubelong		>2	\b, contains[@0x600]:
2387>>>0x0600	use		apple-apm
2388>>0x0204	ubelong		>3	\b, contains[@0x800]:
2389>>>0x0800	use		apple-apm
2390>>0x0204	ubelong		>4	\b, contains[@0xA00]:
2391>>>0x0A00	use		apple-apm
2392>>0x0204	ubelong		>5	\b, contains[@0xC00]:
2393>>>0x0C00	use		apple-apm
2394>>0x0204	ubelong		>6	\b, contains[@0xE00]:
2395>>>0x0E00	use		apple-apm
2396>>0x0204	ubelong		>7	\b, contains[@0x1000]:
2397>>>0x1000	use		apple-apm
2398#	display apple driver descriptor map (start-block, # blocks in sbBlkSize sizes, type)
23990	name				apple-driver-map
2400>0	ubequad		!0
2401# descBlock first block of driver
2402>>0	ubelong	x			\b, driver start block %u
2403# descSize driver size in blocks
2404>>4	ubeshort	x		\b, size %u
2405# descType driver system type 1 701h F8FFh FFFFh
2406>>6	ubeshort	x		\b, type 0x%x
2407
2408# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
2409# Reference: https://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h
2410# Update: Joerg Jenderek
2411# Yes, the 3rd and 4th bytes pmSigPad are reserved, but we use them to make the
2412# magic stronger.
2413# for apple partition map stored as a single file
24140	belong	0x504d0000
2415# to display Apple Partition Map (strength=70) after Syslinux bootloader (71)
2416#!:strength +0
2417>0	use		apple-apm
2418# magic/Magdir/apple14.test, 365: Warning: Current entry does not yet have a description for adding a EXTENSION type
2419# file: could not find any valid magic files!
2420#!:ext	bin
2421#	display apple partition map. Normally called after Apple driver map
24220	name				apple-apm
2423>0	belong	0x504d0000		Apple Partition Map
2424# number of partitions
2425>>4	ubelong	x			\b, map block count %u
2426# logical block (512 bytes) start of partition
2427>>8	ubelong	x			\b, start block %u
2428>>12	ubelong	x			\b, block count %u
2429>>16	string >0			\b, name %s
2430>>48	string >0			\b, type %s
2431# processor type dpme_process_id[16] e.g. "68000" "68020"
2432>>120	string >0			\b, processor %s
2433# A/UX boot arguments BootArgs[128]
2434>>136	string >0			\b, boot arguments %s
2435# status of partition dpme_flags
2436>>88	belong	& 1			\b, valid
2437>>88	belong	& 2			\b, allocated
2438>>88	belong	& 4			\b, in use
2439>>88	belong	& 8			\b, has boot info
2440>>88	belong	& 16			\b, readable
2441>>88	belong	& 32			\b, writable
2442>>88	belong	& 64			\b, pic boot code
2443>>88	belong	& 128			\b, chain compatible driver
2444>>88	belong	& 256			\b, real driver
2445>>88	belong	& 512			\b, chain driver
2446# mount automatically at startup APPLE_PS_AUTO_MOUNT
2447>>88	ubelong	&0x40000000		\b, mount at startup
2448# is the startup partition APPLE_PS_STARTUP
2449>>88	ubelong	&0x80000000		\b, is the startup partition
2450
2451#https://wiki.mozilla.org/DS_Store_File_Format
2452#https://en.wikipedia.org/wiki/.DS_Store
24530	string	\0\0\0\1Bud1\0		Apple Desktop Services Store
2454
2455# HFS/HFS+ Resource fork files (andrew.roazen@nau.edu Apr 13 2015)
2456# Usually not in separate files, but have either filename rsrc with
2457# no extension, or a filename corresponding to another file, with
2458# extensions rsr/rsrc
24590	string  \000\000\001\000
2460>4	leshort 0
2461>>16	lelong  0			Apple HFS/HFS+ resource fork
2462
2463#https://en.wikipedia.org/wiki/AppleScript
24640	string	FasdUAS			AppleScript compiled
2465
2466# AppleWorks/ClarisWorks
2467# https://github.com/joshenders/appleworks_format
2468# http://fileformats.archiveteam.org/wiki/AppleWorks
24690	name			appleworks
2470>0	belong&0x00ffffff	0x07e100	AppleWorks CWK Document
2471>0	belong&0x00ffffff	0x008803	ClarisWorks CWK Document
2472>0	default			x
2473>>0	belong			x		AppleWorks/ClarisWorks CWK Document
2474>0	byte			x		\b, version %d
2475>30	beshort			x		\b, %d
2476>32	beshort			x		\bx%d
2477!:ext cwk
2478
24794	string	BOBO
2480>0	byte	>4
2481>>12	belong	0
2482>>>26	belong	0
2483>>>>0	use	appleworks
2484>0	belong	0x0481ad00
2485>>0	use 	appleworks
2486
2487# magic for Apple File System (APFS)
2488# from Alex Myczko <alex@aiei.ch>
248932		string	NXSB		Apple File System (APFS)
2490>36		ulelong	x		\b, blocksize %u
2491
2492# iTunes cover art (versions 1 and 2)
24934		string	itch
2494>24		string	artw
2495>>0x1e8		string	data		iTunes cover art
2496>>>0x1ed	string	PNG		(PNG)
2497>>>0x1ec	beshort 0xffd8		(JPEG)
2498
2499# MacPaint image
250065		string	PNTGMPNT	MacPaint image data
2501#0		belong	2		MacPaint image data
2502
2503#------------------------------------------------------------------------------
2504# $File: application,v 1.1 2016/10/17 12:13:01 christos Exp $
2505# application:  file(1) magic for applications on small devices
2506#
2507# Pebble Application
25080	string	PBLAPP\000\000	Pebble application
2509
2510#------------------------------------------------------------------------------
2511# $File: applix,v 1.5 2009/09/19 16:28:08 christos Exp $
2512# applix:  file(1) magic for Applixware
2513# From: Peter Soos <sp@osb.hu>
2514#
25150	string		*BEGIN		Applixware
2516>7	string		WORDS			Words Document
2517>7	string		GRAPHICS		Graphic
2518>7	string		RASTER			Bitmap
2519>7	string		SPREADSHEETS		Spreadsheet
2520>7	string		MACRO			Macro
2521>7	string		BUILDER			Builder Object
2522
2523#------------------------------------------------------------------------------
2524# $File: apt,v 1.1 2016/10/17 19:51:57 christos Exp $
2525# apt: file(1) magic for APT Cache files
2526# <http://www.fifi.org/doc/libapt-pkg-doc/cache.html/ch2.html>
2527# <https://anonscm.debian.org/cgit/apt/apt.git/tree/apt-pkg/pkgcache.h#n292>
2528
2529# before version 10 ("old format"), data was in arch-specific long/short
2530
2531# old format 64 bit
25320   	name		apt-cache-64bit-be
2533>12	beshort		1		\b, dirty
2534>40 	bequad		x		\b, %llu packages
2535>48 	bequad		x		\b, %llu versions
2536
2537# old format 32 bit
25380   	name    	apt-cache-32bit-be
2539>8  	beshort 	1		\b, dirty
2540>40 	belong  	x		\b, %u packages
2541>44 	belong  	x		\b, %u versions
2542
2543# new format
25440	name		apt-cache-be
2545>6	byte    	1		\b, dirty
2546>24	belong  	x		\b, %u packages
2547>28	belong		x		\b, %u versions
2548
25490	bequad		0x98FE76DC
2550>8	ubeshort	<10		APT cache data, version %u
2551>>10	beshort	    	x	  	\b.%u, 64 bit big-endian
2552>>0	use		apt-cache-64bit-be
2553
25540	lequad	    	0x98FE76DC
2555>8	uleshort    	<10		APT cache data, version %u
2556>>10	leshort		x		\b.%u, 64 bit little-endian
2557>>0	use		\^apt-cache-64bit-be
2558
25590	belong	    	0x98FE76DC
2560>4	ubeshort    	<10	 	APT cache data, version %u
2561>>6	ubeshort    	x		\b.%u, 32 bit big-endian
2562>>0	use  		apt-cache-32bit-be
2563>4	ubyte	    	>9		APT cache data, version %u
2564>>5	ubyte	    	x		\b.%u, big-endian
2565>>0	use 		apt-cache-be
2566
25670	lelong	    	0x98FE76DC
2568>4	uleshort    	<10		APT cache data, version %u
2569>>6	uleshort   	x		\b.%u, 32 bit little-endian
2570>>0	use 		\^apt-cache-32bit-be
2571>4	ubyte	    	>9		APT cache data, version %u
2572>>5	ubyte	    	x		\b.%u, little-endian
2573>>0	use		\^apt-cache-be
2574#------------------------------------------------------------------------------
2575# $File: archive,v 1.145 2021/01/03 20:58:47 christos Exp $
2576# archive:  file(1) magic for archive formats (see also "msdos" for self-
2577#           extracting compressed archives)
2578#
2579# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
2580# pre-POSIX "tar" archives are also handled in the C code ../../src/is_tar.c.
2581
2582# POSIX tar archives
2583# URL: https://en.wikipedia.org/wiki/Tar_(computing)
2584# Reference: https://www.freebsd.org/cgi/man.cgi?query=tar&sektion=5&manpath=FreeBSD+8-current
2585# header mainly padded with nul bytes
2586500	quad		0
2587!:strength /2
2588# filename or extended attribute printable strings in range space null til umlaut ue
2589>0	ubeshort	>0x1F00
2590>>0	ubeshort	<0xFCFD
2591# last 4 header bytes often null but tar\0 in gtarfail2.tar gtarfail.tar-bad
2592# at https://sourceforge.net/projects/s-tar/files/testscripts/
2593>>>508	ubelong&0x8B9E8DFF	0
2594# nul, space or ascii digit 0-7 at start of mode
2595>>>>100	ubyte&0xC8	=0
2596>>>>>101 ubyte&0xC8	=0
2597# nul, space at end of check sum
2598>>>>>>155 ubyte&0xDF	=0
2599# space or ascii digit 0 at start of check sum
2600>>>>>>>148	ubyte&0xEF	=0x20
2601>>>>>>>>0	use	tar-file
2602#	minimal check and then display tar archive information which can also be
2603#	embedded inside others like Android Backup, Clam AntiVirus database
26040	name		tar-file
2605>257	string		!ustar
2606# header padded with nuls
2607>>257	ulong		=0
2608# GNU tar version 1.29 with non pax format option without refusing
2609# creates misleading V7 header for Long path, Multi-volume, Volume type
2610>>>156	ubyte		0x4c		GNU tar archive
2611!:mime	application/x-gtar
2612!:ext	tar/gtar
2613>>>156	ubyte		0x4d		GNU tar archive
2614!:mime	application/x-gtar
2615!:ext	tar/gtar
2616>>>156	ubyte		0x56		GNU tar archive
2617!:mime	application/x-gtar
2618!:ext	tar/gtar
2619>>>156	default		x		tar archive (V7)
2620!:mime	application/x-tar
2621!:ext	tar
2622# other stuff in padding
2623# some implementations add new fields to the blank area at the end of the header record
2624# created for example by DOS TAR 3.20g 1994 Tim V.Shapore with -j option
2625>>257	ulong		!0		tar archive (old)
2626!:mime	application/x-tar
2627!:ext	tar
2628# magic in newer, GNU, posix variants
2629>257	string		=ustar
2630# 2 last char of magic and UStar version because string expression does not work
2631# 2 space characters followed by a null for GNU variant
2632>>261	ubelong		=0x72202000	POSIX tar archive (GNU)
2633!:mime	application/x-gtar
2634!:ext	tar/gtar
2635# UStar version with ASCII "00"
2636>>261	ubelong		0x72003030	POSIX
2637# gLOBAL and ExTENSION type only found in POSIX.1-2001 format
2638>>>156	ubyte		0x67		\b.1-2001
2639>>>156	ubyte		0x78		\b.1-2001
2640>>>156	ubyte		x		tar archive
2641!:mime	application/x-ustar
2642!:ext	tar/ustar
2643# version with 2 binary nuls embedded in Android Backup like com.android.settings.ab
2644>>261	ubelong		0x72000000	tar archive (ustar)
2645!:mime	application/x-ustar
2646!:ext	tar/ustar
2647# not seen ustar variant with garbish version
2648>>261	default		x		tar archive (unknown ustar)
2649!:mime	application/x-ustar
2650!:ext	tar/ustar
2651# type flag of 1st tar archive member
2652#>156	ubyte		x		\b, %c-type
2653>156	ubyte		x
2654>>156	ubyte		0		\b, file
2655>>156	ubyte		0x30		\b, file
2656>>156	ubyte		0x31		\b, hard link
2657>>156	ubyte		0x32		\b, symlink
2658>>156	ubyte		0x33		\b, char device
2659>>156	ubyte		0x34		\b, block device
2660>>156	ubyte		0x35		\b, directory
2661>>156	ubyte		0x36		\b, fifo
2662>>156	ubyte		0x37		\b, reserved
2663>>156	ubyte		0x4c		\b, long path
2664>>156	ubyte		0x4d		\b, multi volume
2665>>156	ubyte		0x56		\b, volume
2666>>156	ubyte		0x67		\b, global
2667>>156	ubyte		0x78		\b, extension
2668>>156	default		x		\b, type
2669>>>156	ubyte		x		'%c'
2670# name[100]
2671>0	string		>\0		%-.60s
2672# mode mainly stored as an octal number in ASCII null or space terminated
2673>100	string		>\0		\b, mode %-.7s
2674# user id mainly as octal numbers in ASCII null or space terminated
2675>108	string		>\0		\b, uid %-.7s
2676# group id mainly as octal numbers in ASCII null or space terminated
2677>116	string		>\0		\b, gid %-.7s
2678# size mainly as octal number in ASCII
2679>124	ubyte		<0x38
2680>>124	string		>\0		\b, size %-.12s
2681# coding indicated by setting the high-order bit of the leftmost byte
2682>124	ubyte		>0xEF		\b, size 0x
2683>>124	ubyte		!0xff		\b%2.2x
2684>>125	ubyte		!0xff		\b%2.2x
2685>>126	ubyte		!0xff		\b%2.2x
2686>>127	ubyte		!0xff		\b%2.2x
2687>>128	ubyte		!0xff		\b%2.2x
2688>>129	ubyte		!0xff		\b%2.2x
2689>>130	ubyte		!0xff		\b%2.2x
2690>>131	ubyte		!0xff		\b%2.2x
2691>>132	ubyte		!0xff		\b%2.2x
2692>>133	ubyte		!0xff		\b%2.2x
2693>>134	ubyte		!0xff		\b%2.2x
2694>>135	ubyte		!0xff		\b%2.2x
2695# seconds since 0:0:0 1 jan 1970 UTC as octal number mainly in ASCII null or space terminated
2696>136	string		>\0		\b, seconds %-.11s
2697# header checksum stored as an octal number in ASCII null or space terminated
2698#>148	string		x		\b, cksum %.7s
2699# linkname[100]
2700>157	string		>\0		\b, linkname %-.40s
2701# additional fields for ustar
2702>257	string		=ustar
2703# owner user name null terminated
2704>>265	string		>\0		\b, user %-.32s
2705# group name null terminated
2706>>297	string		>\0		\b, group %-.32s
2707# device major minor if not zero
2708>>329	ubequad&0xCFCFCFCFcFcFcFdf	!0
2709>>>329	string		x		\b, devmaj %-.7s
2710>>337	ubequad&0xCFCFCFCFcFcFcFdf	!0
2711>>>337	string		x		\b, devmin %-.7s
2712# prefix[155]
2713>>345	string		>\0		\b, prefix %-.155s
2714# old non ustar/POSIX tar
2715>257	string		!ustar
2716>>508	string		=tar\0
2717# padding[255] in old star
2718>>>257	string		>\0		\b, padding: %-.40s
2719>>508	default		x
2720# padding[255] in old tar sometimes comment field
2721>>>257	string		>\0		\b, comment: %-.40s
2722
2723# Incremental snapshot gnu-tar format from:
2724# https://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html
27250	string		GNU\ tar-	GNU tar incremental snapshot data
2726>&0	regex		[0-9]\.[0-9]+-[0-9]+	version %s
2727
2728# cpio archives
2729#
2730# Yes, the top two "cpio archive" formats *are* supposed to just be "short".
2731# The idea is to indicate archives produced on machines with the same
2732# byte order as the machine running "file" with "cpio archive", and
2733# to indicate archives produced on machines with the opposite byte order
2734# from the machine running "file" with "byte-swapped cpio archive".
2735#
2736# The SVR4 "cpio(4)" hints that there are additional formats, but they
2737# are defined as "short"s; I think all the new formats are
2738# character-header formats and thus are strings, not numbers.
27390	short		070707		cpio archive
2740!:mime	application/x-cpio
27410	short		0143561		byte-swapped cpio archive
2742!:mime	application/x-cpio # encoding: swapped
27430	string		070707		ASCII cpio archive (pre-SVR4 or odc)
27440	string		070701		ASCII cpio archive (SVR4 with no CRC)
27450	string		070702		ASCII cpio archive (SVR4 with CRC)
2746
2747#
2748# Various archive formats used by various versions of the "ar"
2749# command.
2750#
2751
2752#
2753# Original UNIX archive formats.
2754# They were written with binary values in host byte order, and
2755# the magic number was a host "int", which might have been 16 bits
2756# or 32 bits.  We don't say "PDP-11" or "VAX", as there might have
2757# been ports to little-endian 16-bit-int or 32-bit-int platforms
2758# (x86?) using some of those formats; if none existed, feel free
2759# to use "PDP-11" for little-endian 16-bit and "VAX" for little-endian
2760# 32-bit.  There might have been big-endian ports of that sort as
2761# well.
2762#
27630	leshort		0177555		very old 16-bit-int little-endian archive
27640	beshort		0177555		very old 16-bit-int big-endian archive
27650	lelong		0177555		very old 32-bit-int little-endian archive
27660	belong		0177555		very old 32-bit-int big-endian archive
2767
27680	leshort		0177545		old 16-bit-int little-endian archive
2769>2	string		__.SYMDEF	random library
27700	beshort		0177545		old 16-bit-int big-endian archive
2771>2	string		__.SYMDEF	random library
27720	lelong		0177545		old 32-bit-int little-endian archive
2773>4	string		__.SYMDEF	random library
27740	belong		0177545		old 32-bit-int big-endian archive
2775>4	string		__.SYMDEF	random library
2776
2777#
2778# From "pdp" (but why a 4-byte quantity?)
2779#
27800	lelong		0x39bed		PDP-11 old archive
27810	lelong		0x39bee		PDP-11 4.0 archive
2782
2783#
2784# XXX - what flavor of APL used this, and was it a variant of
2785# some ar archive format?  It's similar to, but not the same
2786# as, the APL workspace magic numbers in pdp.
2787#
27880	long		0100554		apl workspace
2789
2790#
2791# System V Release 1 portable(?) archive format.
2792#
27930	string		=<ar>		System V Release 1 ar archive
2794!:mime	application/x-archive
2795
2796#
2797# Debian package; it's in the portable archive format, and needs to go
2798# before the entry for regular portable archives, as it's recognized as
2799# a portable archive whose first member has a name beginning with
2800# "debian".
2801#
2802# Update: Joerg Jenderek
2803# URL: https://en.wikipedia.org/wiki/Deb_(file_format)
28040	string		=!<arch>\ndebian
2805# https://manpages.debian.org/testing/dpkg/dpkg-split.1.en.html
2806>14	string		-split	part of multipart Debian package
2807!:mime	application/vnd.debian.binary-package
2808# udeb is used for stripped down deb file
2809!:ext	deb/udeb
2810>14	string		-binary	Debian binary package
2811!:mime	application/vnd.debian.binary-package
2812# For ipk packager see also https://en.wikipedia.org/wiki/Opkg
2813!:ext	deb/udeb/ipk
2814# This should not happen
2815>14	default		x	Unknown Debian package
2816# NL terminated version; for most Debian cases this is 2.0 or 2.1 for split
2817>68	string		>\0		(format %s)
2818#>68	string		!2.0\n
2819#>>68	string		x		(format %.3s)
2820>68	string		=2.0\n
2821# 2nd archive name=control archive name like control.tar.gz or control.tar.xz
2822>>72	string		>\0		\b, with %.14s
2823# look for 3rd archive name=data archive name like data.tar.{gz,xz,bz2,lzma}
2824>>0	search/0x93e4f	data.tar.	\b, data compression
2825# the above line only works if FILE_BYTES_MAX in ../../src/file.h is raised
2826# for example like libreoffice-dev-doc_1%3a5.2.7-1+rpi1+deb9u3_all.deb
2827>>>&0	string		x		%.2s
2828# skip space (0x20 BSD) and slash (0x2f System V) character marking end of name
2829>>>&2	ubyte		!0x20
2830>>>>&-1	ubyte		!0x2f
2831# display 3rd character of file name extension like 2 of bz2 or m of lzma
2832>>>>>&-1	ubyte	x		\b%c
2833>>>>>>&0	ubyte	!0x20
2834>>>>>>>&-1	ubyte	!0x2f
2835# display 4th character of file name extension like a of lzma
2836>>>>>>>>&-1	ubyte	x		\b%c
2837# split debian package case
2838>68	string		=2.1\n
2839# dpkg-1.18.25/dpkg-split/info.c
2840# NL terminated ASCII package name like ckermit
2841>>&0	string		x		\b, %s
2842# NL terminated package version like 302-5.3
2843>>>&1	string		x		%s
2844# NL terminated MD5 checksum
2845>>>>&1	string		x		\b, MD5 %s
2846# NL terminated original package length
2847>>>>>&1	string		x		\b, unsplitted size %s
2848# NL terminated part length
2849>>>>>>&1	string	x		\b, part length %s
2850# NL terminated package part like n/m
2851>>>>>>>&1	string	x		\b, part %s
2852# NL terminated package architecture like armhf since dpkg 1.16.1 or later
2853>>>>>>>>&1	string	x		\b, %s
2854
2855#
2856# MIPS archive; they're in the portable archive format, and need to go
2857# before the entry for regular portable archives, as it's recognized as
2858# a portable archive whose first member has a name beginning with
2859# "__________E".
2860#
28610	string	=!<arch>\n__________E	MIPS archive
2862!:mime	application/x-archive
2863>20	string	U			with MIPS Ucode members
2864>21	string	L			with MIPSEL members
2865>21	string	B			with MIPSEB members
2866>19	string	L			and an EL hash table
2867>19	string	B			and an EB hash table
2868>22	string	X			-- out of date
2869
2870#
2871# BSD/SVR2-and-later portable archive formats.
2872#
2873# Update: Joerg Jenderek
2874# URL:		http://fileformats.archiveteam.org/wiki/AR
2875# Reference:	https://www.unix.com/man-page/opensolaris/3HEAD/ar.h/
2876# Note:		Mach-O universal binary in ./cafebabe is dependent
2877# TODO:		unify current ar archive, MIPS archive, Debian package
2878#		distinguish BSD, SVR; 32, 64 bit; HP from other 32-bit SVR;
2879#		*.ar packages from *.a libraries. handle empty archive
28800	string		=!<arch>\n		current ar archive
2881# print first and possibly second ar_name[16] for debugging purpose
2882#>8			string	x	\b, 1st "%.16s"
2883#>68			string	x	\b, 2nd "%.16s"
2884!:mime	application/x-archive
2885# a in most case for libraries; lib for Microsoft libraries; ar else cases
2886!:ext	a/lib/ar
2887>8	string		__.SYMDEF	random library
2888# first member with long marked name __.SYMDEF SORTED implies BSD library
2889>68	string		__.SYMDEF\ SORTED	random library
2890# Reference: https://parisc.wiki.kernel.org/images-parisc/b/b2/Rad_11_0_32.pdf
2891# "archive file" entry moved from ./hp
2892# LST header system_id 0210h~PA-RISC 1.1,... identifies the target architecture
2893# LST header a_magic 0619h~relocatable library
2894>68	belong 		0x020b0619	- PA-RISC1.0 relocatable library
2895>68	belong	 	0x02100619	- PA-RISC1.1 relocatable library
2896>68	belong 		0x02110619	- PA-RISC1.2 relocatable library
2897>68	belong 		0x02140619	- PA-RISC2.0 relocatable library
2898#EOF for common ar archives
2899
2900#
2901# "Thin" archive, as can be produced by GNU ar.
2902#
29030	string		=!<thin>\n	thin archive with
2904>68	belong		0		no symbol entries
2905>68	belong		1		%d symbol entry
2906>68	belong		>1		%d symbol entries
2907
29080	search/1	-h-		Software Tools format archive text
2909
2910# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
2911#
2912# The first byte is the magic (0x1a), byte 2 is the compression type for
2913# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
2914# filename of the first file (null terminated).  Since some types collide
2915# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),
2916# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%).  0x01 collides with terminfo.
29170	lelong&0x8080ffff	0x0000081a	ARC archive data, dynamic LZW
2918!:mime	application/x-arc
29190	lelong&0x8080ffff	0x0000091a	ARC archive data, squashed
2920!:mime	application/x-arc
29210	lelong&0x8080ffff	0x0000021a	ARC archive data, uncompressed
2922!:mime	application/x-arc
29230	lelong&0x8080ffff	0x0000031a	ARC archive data, packed
2924!:mime	application/x-arc
29250	lelong&0x8080ffff	0x0000041a	ARC archive data, squeezed
2926!:mime	application/x-arc
29270	lelong&0x8080ffff	0x0000061a	ARC archive data, crunched
2928!:mime	application/x-arc
2929# [JW] stuff taken from idarc, obviously ARC successors:
29300	lelong&0x8080ffff	0x00000a1a	PAK archive data
2931!:mime	application/x-arc
29320	lelong&0x8080ffff	0x0000141a	ARC+ archive data
2933!:mime	application/x-arc
29340	lelong&0x8080ffff	0x0000481a	HYP archive data
2935!:mime	application/x-arc
2936
2937# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
2938# I can't create either SPARK or ArcFS archives so I have not tested this stuff
2939# [GRR:  the original entries collide with ARC, above; replaced with combined
2940#  version (not tested)]
2941#0	byte		0x1a		RISC OS archive (spark format)
29420	string		\032archive	RISC OS archive (ArcFS format)
29430       string          Archive\000     RISC OS archive (ArcFS format)
2944
2945# All these were taken from idarc, many could not be verified. Unfortunately,
2946# there were many low-quality sigs, i.e. easy to trigger false positives.
2947# Please notify me of any real-world fishy/ambiguous signatures and I'll try
2948# to get my hands on the actual archiver and see if I find something better. [JW]
2949# probably many can be enhanced by finding some 0-byte or control char near the start
2950
2951# idarc calls this Crush/Uncompressed... *shrug*
29520	string	CRUSH Crush archive data
2953# Squeeze It (.sqz)
29540	string	HLSQZ Squeeze It archive data
2955# SQWEZ
29560	string	SQWEZ SQWEZ archive data
2957# HPack (.hpk)
29580	string	HPAK HPack archive data
2959# HAP
29600	string	\x91\x33HF HAP archive data
2961# MD/MDCD
29620	string	MDmd MDCD archive data
2963# LIM
29640	string	LIM\x1a LIM archive data
2965# SAR
29663	string	LH5 SAR archive data
2967# BSArc/BS2
29680	string	\212\3SB\020\0	BSArc/BS2 archive data
2969# Bethesda Softworks Archive (Oblivion)
29700	string	BSA\0 		BSArc archive data
2971>4	lelong	x		version %d
2972# MAR
29732	string	=-ah MAR archive data
2974# ACB
2975#0	belong&0x00f800ff	0x00800000 ACB archive data
2976# CPZ
2977# TODO, this is what idarc says: 0	string	\0\0\0 CPZ archive data
2978# JRC
29790	string	JRchive JRC archive data
2980# Quantum
29810	string	DS\0 Quantum archive data
2982# ReSOF
29830	string	PK\3\6 ReSOF archive data
2984# QuArk
29850	string	7\4 QuArk archive data
2986# YAC
298714	string	YC YAC archive data
2988# X1
29890	string	X1 X1 archive data
29900	string	XhDr X1 archive data
2991# CDC Codec (.dqt)
29920	belong&0xffffe000	0x76ff2000 CDC Codec archive data
2993# AMGC
29940	string	\xad6" AMGC archive data
2995# NuLIB
29960	string	N\xc3\xb5F\xc3\xa9lx\xc3\xa5 NuLIB archive data
2997# PakLeo
29980	string	LEOLZW PAKLeo archive data
2999# ChArc
30000	string	SChF ChArc archive data
3001# PSA
30020	string	PSA PSA archive data
3003# CrossePAC
30040	string	DSIGDCC CrossePAC archive data
3005# Freeze
30060	string	\x1f\x9f\x4a\x10\x0a Freeze archive data
3007# KBoom
30080	string	\xc2\xa8MP\xc2\xa8 KBoom archive data
3009# NSQ, must go after CDC Codec
30100	string	\x76\xff NSQ archive data
3011# DPA
30120	string	Dirk\ Paehl DPA archive data
3013# BA
3014# TODO: idarc says "bytes 0-2 == bytes 3-5"
3015# TTComp
3016# URL: http://fileformats.archiveteam.org/wiki/TTComp_archive
3017# Update: Joerg Jenderek
3018# GRR: line below is too general as it matches also Panorama database "TCDB 2003-10 demo.pan", others
30190	string	\0\6
3020# look for first keyword of Panorama database *.pan
3021>12	search/261	DESIGN
3022# skip keyword with low entropy
3023>12	default		x	TTComp archive, binary, 4K dictionary
3024# (version 5.25) labeled the above entry as "TTComp archive data"
3025# From:		Joerg Jenderek
3026# URL:		https://wiki.68kmla.org/DiskCopy_4.2_format_specification
3027# reference:	http://nulib.com/library/FTN.e00005.htm
30280x52	ubeshort	0x0100
3029# test for disk image size equal or above 400k
3030>0x40	ubelong		>409599
3031# test also for disk image size equal or below 1440k to skip
3032# windows7en.mbr UNICODE.DAT
3033>>0x40	ubelong		<1474561
3034# To skip Flags$StringJoiner.class with size 00106A61h test also for only 4 disk image sizes
3035# 00064000 for  400k GCR disks
3036# 000c8000 for  800k GCR disks
3037# 000b4000 for  720k MFM disks
3038# 00168000 for 1440k MFM disks
3039>>>0x40	ubelong&0xffE03fFF	0
3040>>>>0	use	dc42-floppy
3041#	display information of Apple DiskCopy 4.2 floppy image
30420	name		dc42-floppy
3043# image pascal name padded with NULs like Microsoft Mail
3044>00	pstring/B	x	Apple DiskCopy 4.2 image %s
3045#!:mime	application/octet-stream
3046!:mime	application/x-dc42-floppy-image
3047!:apple	dCpydImg
3048!:ext	image/dc42
3049# data size in bytes like 409600
3050>0x40	ubelong		x	\b, %u bytes
3051# for debugging purpose size in hexadecimal
3052#>0x40	ubelong		x	(0x%8.8x)
3053# tag size in bytes
3054>0x44	ubelong		>0	\b, 0x%x tag size
3055# data checksum
3056#>0x48	ubelong		x	\b, 0x%x checksum
3057# tag checksum
3058#>0x4c	ubelong		x	\b, 0x%x tag checksum
3059# disk encoding
3060>0x50	ubyte		0	\b, GCR CLV ssdd (400k)
3061>0x50	ubyte		1	\b, GCR CLV dsdd (800k)
3062>0x50	ubyte		2	\b, MFM CAV dsdd (720k)
3063>0x50	ubyte		3	\b, MFM CAV dshd (1440k)
3064>0x50	ubyte		>3	\b, 0x%x encoding
3065# format byte
3066>0x51	ubyte		x	\b, 0x%x format
3067#>0x54	ubequad		x	\b, data 0x%16.16llx
3068# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation?
30690	string	ESP ESP archive data
3070# ZPack
30710	string	\1ZPK\1 ZPack archive data
3072# Sky
30730	string	\xbc\x40 Sky archive data
3074# UFA
30750	string	UFA UFA archive data
3076# Dry
30770	string	=-H2O DRY archive data
3078# FoxSQZ
30790	string	FOXSQZ FoxSQZ archive data
3080# AR7
30810	string	,AR7 AR7 archive data
3082# PPMZ
30830	string	PPMZ PPMZ archive data
3084# MS Compress
3085# Update: Joerg Jenderek
3086# URL: http://fileformats.archiveteam.org/wiki/MS-DOS_installation_compression
3087# Reference: https://hwiegman.home.xs4all.nl/fileformats/compress/szdd_kwaj_format.html
3088# Note: use correct version of extracting tool like EXPAND, UNPACK, DECOMP or 7Z
30894	string	\x88\xf0\x27
3090#		KWAJ variant
3091>0	string	KWAJ		MS Compress archive data, KWAJ variant
3092!:mime	application/x-ms-compress-kwaj
3093# extension not working in version 5.32
3094# magic/Magdir/archive, 284: Warning: EXTENSION type ` ??_' has bad char '?'
3095# file: line 284: Bad magic entry '   ??_'
3096!:ext	??_
3097# compression method (0-4)
3098>>8	uleshort	x	\b, %u method
3099# offset of compressed data
3100>>10	uleshort	x	\b, 0x%x offset
3101#>>(10.s)	uleshort	x
3102#>>>&-6		string	x	\b, TEST extension %-.3s
3103# header flags to mark header extensions
3104>>12	uleshort	>0	\b, 0x%x flags
3105# 4 bytes: decompressed length of file
3106>>12	uleshort	&0x01
3107>>>14	ulelong		x	\b, original size: %u bytes
3108# 2 bytes: unknown purpose
3109# 2 bytes: length of unknown data + mentioned bytes
3110# 1-9 bytes: null-terminated file name
3111# 1-4 bytes: null-terminated file extension
3112>>12	uleshort	&0x08
3113>>>12	uleshort				^0x01
3114>>>>12		uleshort			^0x02
3115>>>>>12			uleshort		^0x04
3116>>>>>>12			uleshort	^0x10
3117>>>>>>>14				string	x	\b, %-.8s
3118>>>>>>12			uleshort	&0x10
3119>>>>>>>14				string	x	\b, %-.8s
3120>>>>>>>>&1				string	x	\b.%-.3s
3121>>>>>12			uleshort		&0x04
3122>>>>>>12			uleshort	^0x10
3123>>>>>>>(14.s)			uleshort	x
3124>>>>>>>>&14				string	x	\b, %-.8s
3125>>>>>>12			uleshort	&0x10
3126>>>>>>>(14.s)			uleshort	x
3127>>>>>>>>&14				string	x	\b, %-.8s
3128>>>>>>>>>&1				string	x	\b.%-.3s
3129>>>>12		uleshort			&0x02
3130>>>>>12			uleshort		^0x04
3131>>>>>>12			uleshort	^0x10
3132>>>>>>>16				string	x	\b, %-.8s
3133>>>>>>12			uleshort	&0x10
3134>>>>>>>16				string	x	\b, %-.8s
3135>>>>>>>>&1				string	x	\b.%-.3s
3136>>>>>12			uleshort		&0x04
3137>>>>>>12			uleshort	^0x10
3138>>>>>>>(16.s)			uleshort	x
3139>>>>>>>>&16				string	x	\b, %-.8s
3140>>>>>>12			uleshort	&0x10
3141>>>>>>>(16.s)			uleshort	x
3142>>>>>>>&16				string	x	%-.8s
3143>>>>>>>>&1				string	x	\b.%-.3s
3144>>>12	uleshort				&0x01
3145>>>>12		uleshort			^0x02
3146>>>>>12			uleshort		^0x04
3147>>>>>>12			uleshort	^0x10
3148>>>>>>>18				string	x	\b, %-.8s
3149>>>>>>12			uleshort	&0x10
3150>>>>>>>18				string	x	\b, %-.8s
3151>>>>>>>>&1				string	x	\b.%-.3s
3152>>>>>12			uleshort		&0x04
3153>>>>>>12			uleshort	^0x10
3154>>>>>>>(18.s)			uleshort	x
3155>>>>>>>>&18				string	x	\b, %-.8s
3156>>>>>>12			uleshort	&0x10
3157>>>>>>>(18.s)			uleshort	x
3158>>>>>>>>&18				string	x	\b, %-.8s
3159>>>>>>>>>&1				string	x	\b.%-.3s
3160>>>>12		uleshort			&0x02
3161>>>>>12			uleshort		^0x04
3162>>>>>>12			uleshort	^0x10
3163>>>>>>>20				string	x	\b, %-.8s
3164>>>>>>12			uleshort	&0x10
3165>>>>>>>20				string	x	\b, %-.8s
3166>>>>>>>>&1				string	x	\b.%-.3s
3167>>>>>12			uleshort		&0x04
3168>>>>>>12			uleshort	^0x10
3169>>>>>>>(20.s)			uleshort	x
3170>>>>>>>>&20				string	x	\b, %-.8s
3171>>>>>>12			uleshort	&0x10
3172>>>>>>>(20.s)			uleshort	x
3173>>>>>>>>&20				string	x	\b, %-.8s
3174>>>>>>>>>&1				string	x	\b.%-.3s
3175# 2 bytes: length of data + mentioned bytes
3176#
3177#		SZDD variant Haruhiko Okumura's LZSS or 7z type MsLZ
3178>0	string	SZDD		MS Compress archive data, SZDD variant
3179!:mime	application/x-ms-compress-szdd
3180!:ext	??_
3181# The character missing from the end of the filename (0=unknown)
3182>>9	string	>\0		\b, %-.1s is last character of original name
3183# https://www.betaarchive.com/forum/viewtopic.php?t=26161
3184# Compression mode: "A" (0x41) found but sometimes "B" in Windows 3.1 builds 026 and 034e
3185>>8	string	!A		\b, %-.1s method
3186>>10	ulelong	>0		\b, original size: %u bytes
3187#		QBasic SZDD variant
31883	string	\x88\xf0\x27
3189>0	string	SZ\x20		MS Compress archive data, QBasic variant
3190!:mime	application/x-ms-compress-sz
3191!:ext	??$
3192>>8	ulelong	>0		\b, original size: %u bytes
3193
3194# MP3 (archiver, not lossy audio compression)
31950	string	MP3\x1a MP3-Archiver archive data
3196# ZET
31970	string	OZ\xc3\x9d ZET archive data
3198# TSComp
31990	string	\x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data
3200# ARQ
32010	string	gW\4\1 ARQ archive data
3202# Squash
32033	string	OctSqu Squash archive data
3204# Terse
32050	string	\5\1\1\0 Terse archive data
3206# PUCrunch
32070	string	\x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data
3208# UHarc
32090	string	UHA UHarc archive data
3210# ABComp
32110	string	\2AB ABComp archive data
32120	string	\3AB2 ABComp archive data
3213# CMP
32140	string	CO\0 CMP archive data
3215# Splint
32160	string	\x93\xb9\x06 Splint archive data
3217# InstallShield
32180	string	\x13\x5d\x65\x8c InstallShield Z archive Data
3219# Gather
32201	string	GTH Gather archive data
3221# BOA
32220	string	BOA BOA archive data
3223# RAX
32240	string	ULEB\xa RAX archive data
3225# Xtreme
32260	string	ULEB\0 Xtreme archive data
3227# Pack Magic
32280	string	@\xc3\xa2\1\0 Pack Magic archive data
3229# BTS
32300	belong&0xfeffffff	0x1a034465 BTS archive data
3231# ELI 5750
32320	string	Ora\  ELI 5750 archive data
3233# QFC
32340	string	\x1aFC\x1a QFC archive data
32350	string	\x1aQF\x1a QFC archive data
3236# PRO-PACK
32370	string	RNC PRO-PACK archive data
3238# 777
32390	string	777 777 archive data
3240# LZS221
32410	string	sTaC LZS221 archive data
3242# HPA
32430	string	HPA HPA archive data
3244# Arhangel
32450	string	LG Arhangel archive data
3246# EXP1, uses bzip2
32470	string	0123456789012345BZh EXP1 archive data
3248# IMP
32490	string	IMP\xa IMP archive data
3250# NRV
32510	string	\x00\x9E\x6E\x72\x76\xFF NRV archive data
3252# Squish
32530	string	\x73\xb2\x90\xf4 Squish archive data
3254# Par
32550	string	PHILIPP Par archive data
32560	string	PAR Par archive data
3257# HIT
32580	string	UB HIT archive data
3259# SBX
32600	belong&0xfffff000	0x53423000 SBX archive data
3261# NaShrink
32620	string	NSK NaShrink archive data
3263# SAPCAR
32640	string	#\ CAR\ archive\ header SAPCAR archive data
32650	string	CAR\ 2.00RG SAPCAR archive data
3266# Disintegrator
32670	string	DST Disintegrator archive data
3268# ASD
32690	string	ASD ASD archive data
3270# InstallShield CAB
32710	string	ISc( InstallShield CAB
3272# TOP4
32730	string	T4\x1a TOP4 archive data
3274# BatComp left out: sig looks like COM executable
3275# so TODO: get real 4dos batcomp file and find sig
3276# BlakHole
32770	string	BH\5\7 BlakHole archive data
3278# BIX
32790	string	BIX0 BIX archive data
3280# ChiefLZA
32810	string	ChfLZ ChiefLZA archive data
3282# Blink
32830	string	Blink Blink archive data
3284# Logitech Compress
32850	string	\xda\xfa Logitech Compress archive data
3286# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE)
32871	string	(C)\ STEPANYUK ARS-Sfx archive data
3288# AKT/AKT32
32890	string	AKT32 AKT32 archive data
32900	string	AKT AKT archive data
3291# NPack
32920	string	MSTSM NPack archive data
3293# PFT
32940	string	\0\x50\0\x14 PFT archive data
3295# SemOne
32960	string	SEM SemOne archive data
3297# PPMD
32980	string	\x8f\xaf\xac\x84 PPMD archive data
3299# FIZ
33000	string	FIZ FIZ archive data
3301# MSXiE
33020	belong&0xfffff0f0	0x4d530000 MSXiE archive data
3303# DeepFreezer
33040	belong&0xfffffff0	0x797a3030 DeepFreezer archive data
3305# DC
33060	string	=<DC- DC archive data
3307# TPac
33080	string	\4TPAC\3 TPac archive data
3309# Ai
33100	string	Ai\1\1\0 Ai archive data
33110	string	Ai\1\0\0 Ai archive data
3312# Ai32
33130	string	Ai\2\0 Ai32 archive data
33140	string	Ai\2\1 Ai32 archive data
3315# SBC
33160	string	SBC SBC archive data
3317# Ybs
33180	string	YBS Ybs archive data
3319# DitPack
33200	string	\x9e\0\0 DitPack archive data
3321# DMS
33220	string	DMS! DMS archive data
3323# EPC
33240	string	\x8f\xaf\xac\x8c EPC archive data
3325# VSARC
33260	string	VS\x1a VSARC archive data
3327# PDZ
33280	string	PDZ PDZ archive data
3329# ReDuq
33300	string	rdqx ReDuq archive data
3331# GCA
33320	string	GCAX GCA archive data
3333# PPMN
33340	string	pN PPMN archive data
3335# WinImage
33363	string	WINIMAGE WinImage archive data
3337# Compressia
33380	string	CMP0CMP Compressia archive data
3339# UHBC
33400	string	UHB UHBC archive data
3341# WinHKI
33420	string	\x61\x5C\x04\x05 WinHKI archive data
3343# WWPack data file
33440	string	WWP WWPack archive data
3345# BSN (BSA, PTS-DOS)
33460	string	\xffBSG BSN archive data
33471	string	\xffBSG BSN archive data
33483	string	\xffBSG BSN archive data
33491	string	\0\xae\2 BSN archive data
33501	string	\0\xae\3 BSN archive data
33511	string	\0\xae\7 BSN archive data
3352# AIN
33530	string	\x33\x18 AIN archive data
33540	string	\x33\x17 AIN archive data
3355# XPA32 test moved and merged with XPA by Joerg Jenderek at Sep 2015
3356# SZip (TODO: doesn't catch all versions)
33570	string	SZ\x0a\4 SZip archive data
3358# XPack DiskImage
3359# *.XDI updated by Joerg Jenderek Sep 2015
3360# ftp://ftp.sac.sk/pub/sac/pack/0index.txt
3361# GRR: this test is still too general as it catches also text files starting with jm
33620	string	jm
3363# only found examples with this additional characteristic 2 bytes
3364>2	string	\x2\x4	Xpack DiskImage archive data
3365#!:ext xdi
3366# XPack Data
3367# *.xpa updated by Joerg Jenderek Sep 2015
3368# ftp://ftp.elf.stuba.sk/pub/pc/pack/
33690	string	xpa	XPA
3370!:ext	xpa
3371# XPA32
3372# ftp://ftp.elf.stuba.sk/pub/pc/pack/xpa32.zip
3373# created by XPA32.EXE version 1.0.2 for Windows
3374>0	string	xpa\0\1 \b32 archive data
3375# created by XPACK.COM version 1.67m or 1.67r with short 0x1800
3376>3	ubeshort	!0x0001	\bck archive data
3377# XPack Single Data
3378# changed by Joerg Jenderek Sep 2015 back to like in version 5.12
3379# letter 'I'+ acute accent is equivalent to \xcd
33800	string	\xcd\ jm	Xpack single archive data
3381#!:mime	application/x-xpa-compressed
3382!:ext xpa
3383
3384# TODO: missing due to unknown magic/magic at end of file:
3385#DWC
3386#ARG
3387#ZAR
3388#PC/3270
3389#InstallIt
3390#RKive
3391#RK
3392#XPack Diskimage
3393
3394# These were inspired by idarc, but actually verified
3395# Dzip archiver (.dz)
3396# Update: Joerg Jenderek
3397# URL: http://speeddemosarchive.com/dzip/
3398# reference: http://speeddemosarchive.com/dzip/dz29src.zip/main.c
3399# GRR: line below is too general as it matches also ASCII texts like Doszip commander help dz.txt
34000	string	DZ
3401# latest version is 2.9 dated 7 may 2003
3402>2	byte	<4 Dzip archive data
3403!:mime	application/x-dzip
3404!:ext	dz
3405>>2	byte	x \b, version %i
3406>>3	byte	x \b.%i
3407>>4	ulelong	x \b, offset 0x%x
3408>>8	ulelong	x \b, %u files
3409# ZZip archiver (.zz)
34100	string	ZZ\ \0\0 ZZip archive data
34110	string	ZZ0 ZZip archive data
3412# PAQ archiver (.paq)
34130	string	\xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data
34140	string	PAQ PAQ archive data
3415>3	byte&0xf0	0x30
3416>>3	byte	x (v%c)
3417# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP)
34180xe	string	\x1aJar\x1b JAR (ARJ Software, Inc.) archive data
34190	string	JARCS JAR (ARJ Software, Inc.) archive data
3420
3421# ARJ archiver (jason@jarthur.Claremont.EDU)
34220	leshort		0xea60		ARJ archive data
3423!:mime	application/x-arj
3424>5	byte		x		\b, v%d,
3425>8	byte		&0x04		multi-volume,
3426>8	byte		&0x10		slash-switched,
3427>8	byte		&0x20		backup,
3428>34	string		x		original name: %s,
3429>7	byte		0		os: MS-DOS
3430>7	byte		1		os: PRIMOS
3431>7	byte		2		os: Unix
3432>7	byte		3		os: Amiga
3433>7	byte		4		os: Macintosh
3434>7	byte		5		os: OS/2
3435>7	byte		6		os: Apple ][ GS
3436>7	byte		7		os: Atari ST
3437>7	byte		8		os: NeXT
3438>7	byte		9		os: VAX/VMS
3439>3	byte		>0		%d]
3440# [JW] idarc says this is also possible
34412	leshort		0xea60		ARJ archive data
3442
3443# HA archiver (Greg Roelofs, newt@uchicago.edu)
3444# This is a really bad format. A file containing HAWAII will match this...
3445#0	string		HA		HA archive data,
3446#>2	leshort		=1		1 file,
3447#>2	leshort		>1		%hu files,
3448#>4	byte&0x0f	=0		first is type CPY
3449#>4	byte&0x0f	=1		first is type ASC
3450#>4	byte&0x0f	=2		first is type HSC
3451#>4	byte&0x0f	=0x0e		first is type DIR
3452#>4	byte&0x0f	=0x0f		first is type SPECIAL
3453# suggestion: at least identify small archives (<1024 files)
34540  belong&0xffff00fc 0x48410000 HA archive data
3455>2	leshort		=1		1 file,
3456>2	leshort		>1		%u files,
3457>4	byte&0x0f	=0		first is type CPY
3458>4	byte&0x0f	=1		first is type ASC
3459>4	byte&0x0f	=2		first is type HSC
3460>4	byte&0x0f	=0x0e		first is type DIR
3461>4	byte&0x0f	=0x0f		first is type SPECIAL
3462
3463# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
34640	string		HPAK		HPACK archive data
3465
3466# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net
34670	string		\351,\001JAM\ 		JAM archive,
3468>7	string		>\0			version %.4s
3469>0x26	byte		=0x27			-
3470>>0x2b	string          >\0			label %.11s,
3471>>0x27	lelong		x			serial %08x,
3472>>0x36	string		>\0			fstype %.8s
3473
3474# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
3475# Update: Joerg Jenderek
3476# URL: https://en.wikipedia.org/wiki/LHA_(file_format)
3477# Reference: https://web.archive.org/web/20021005080911/http://www.osirusoft.com/joejared/lzhformat.html
3478#
3479#	check and display information of lharc (LHa,PMarc) file
34800	name				lharc-file
3481# check 1st character of method id like -lz4- -lh5- or -pm2-
3482>2	string		-
3483# check 5th character of method id
3484>>6	string		-
3485# check header level 0 1 2 3
3486>>>20	ubyte		<4
3487# check 2nd, 3th and 4th character of method id
3488>>>>3	regex		\^(lh[0-9a-ex]|lz[s2-8]|pm[012]|pc1)		\b
3489!:mime	application/x-lzh-compressed
3490# creator type "LHA "
3491!:apple	????LHA
3492# display archive type name like "LHa/LZS archive data" or "LArc archive"
3493>>>>>2	string		-lz		\b
3494!:ext	lzs
3495# already known  -lzs- -lz4- -lz5- with old names
3496>>>>>>2	string	-lzs		LHa/LZS archive data
3497>>>>>>3	regex	\^lz[45]	LHarc 1.x archive data
3498# missing -lz?- with wikipedia names
3499>>>>>>3	regex	\^lz[2378]	LArc archive
3500# display archive type name like "LHa (2.x) archive data"
3501>>>>>2	string		-lh		\b
3502# already known -lh0- -lh1- -lh2- -lh3-  -lh4- -lh5- -lh6- -lh7- -lhd- variants with old names
3503>>>>>>3	regex		\^lh[01]	LHarc 1.x/ARX archive data
3504# LHice archiver use ".ICE" as name extension instead usual one ".lzh"
3505# FOOBAR archiver use ".foo" as name extension instead usual one
3506# "Florain Orjanov's and Olga Bachetska's ARchiver" not found at the moment
3507>>>>>>>2	string	-lh1		\b
3508!:ext lha/lzh/ice
3509>>>>>>3	regex		\^lh[23d]	LHa 2.x? archive data
3510>>>>>>3	regex		\^lh[7]		LHa (2.x)/LHark archive data
3511>>>>>>3	regex		\^lh[456]	LHa (2.x) archive data
3512>>>>>>>2	string	-lh5		\b
3513# https://en.wikipedia.org/wiki/BIOS
3514# Some mainboard BIOS like Award use LHa compression. So archives with unusual extension are found like
3515# bios.rom , kd7_v14.bin, 1010.004, ...
3516!:ext lha/lzh/rom/bin
3517# missing -lh?- variants (Joe Jared)
3518>>>>>>3	regex		\^lh[89a-ce]	LHa (Joe Jared) archive
3519# UNLHA32 2.67a
3520>>>>>>2	string		-lhx		LHa (UNLHA32) archive
3521# lha archives with standard file name extensions ".lha" ".lzh"
3522>>>>>>3	regex		!\^(lh1|lh5)	\b
3523!:ext lha/lzh
3524# this should not happen if all -lh variants are described
3525>>>>>>2	default		x		LHa (unknown) archive
3526#!:ext	lha
3527# PMarc
3528>>>>>3	regex		\^pm[012]	PMarc archive data
3529!:ext pma
3530# append method id without leading and trailing minus character
3531>>>>>3	string		x		[%3.3s]
3532>>>>>>0	use	lharc-header
3533#
3534#	check and display information of lharc header
35350	name				lharc-header
3536# header size 0x4 , 0x1b-0x61
3537>0	ubyte		x
3538# compressed data size != compressed file size
3539#>7	ulelong		x		\b, data size %d
3540# attribute: 0x2~?? 0x10~symlink|target 0x20~normal
3541#>19	ubyte		x		\b, 19_0x%x
3542# level identifier 0 1 2 3
3543#>20	ubyte		x		\b, level %d
3544# time stamp
3545#>15		ubelong	x		DATE 0x%8.8x
3546# OS ID for level 1
3547>20	ubyte		1
3548# 0x20 types find for *.rom files
3549>>(21.b+24)	ubyte	<0x21		\b, 0x%x OS
3550# ascii type like M for MSDOS
3551>>(21.b+24)	ubyte	>0x20		\b, '%c' OS
3552# OS ID for level 2
3553>20	ubyte		2
3554#>>23	ubyte		x		\b, OS ID 0x%x
3555>>23	ubyte		<0x21		\b, 0x%x OS
3556>>23	ubyte		>0x20		\b, '%c' OS
3557# filename only for level 0 and 1
3558>20	ubyte		<2
3559# length of filename
3560>>21		ubyte	>0		\b, with
3561# filename
3562>>>21		pstring	x		"%s"
3563#
3564#2	string		-lh0-		LHarc 1.x/ARX archive data [lh0]
3565#!:mime	application/x-lharc
35662	string		-lh0-
3567>0	use	lharc-file
3568#2	string		-lh1-		LHarc 1.x/ARX archive data [lh1]
3569#!:mime	application/x-lharc
35702	string		-lh1-
3571>0	use	lharc-file
3572# NEW -lz2- ... -lz8-
35732	string		-lz2-
3574>0	use	lharc-file
35752	string		-lz3-
3576>0	use	lharc-file
35772	string		-lz4-
3578>0	use	lharc-file
35792	string		-lz5-
3580>0	use	lharc-file
35812	string		-lz7-
3582>0	use	lharc-file
35832	string		-lz8-
3584>0	use	lharc-file
3585#	[never seen any but the last; -lh4- reported in comp.compression:]
3586#2	string		-lzs-		LHa/LZS archive data [lzs]
35872	string		-lzs-
3588>0	use	lharc-file
3589# According to wikipedia and others such a version does not exist
3590#2	string		-lh\40-		LHa 2.x? archive data [lh ]
3591#2	string		-lhd-		LHa 2.x? archive data [lhd]
35922	string		-lhd-
3593>0	use	lharc-file
3594#2	string		-lh2-		LHa 2.x? archive data [lh2]
35952	string		-lh2-
3596>0	use	lharc-file
3597#2	string		-lh3-		LHa 2.x? archive data [lh3]
35982	string		-lh3-
3599>0	use	lharc-file
3600#2	string		-lh4-		LHa (2.x) archive data [lh4]
36012	string		-lh4-
3602>0	use	lharc-file
3603#2	string		-lh5-		LHa (2.x) archive data [lh5]
36042	string		-lh5-
3605>0	use	lharc-file
3606#2	string		-lh6-		LHa (2.x) archive data [lh6]
36072	string		-lh6-
3608>0	use	lharc-file
3609#2	string		-lh7-		LHa (2.x)/LHark archive data [lh7]
36102	string		-lh7-
3611# !:mime	application/x-lha
3612# >20	byte		x		- header level %d
3613>0	use	lharc-file
3614# NEW -lh8- ... -lhe- , -lhx-
36152	string		-lh8-
3616>0	use	lharc-file
36172	string		-lh9-
3618>0	use	lharc-file
36192	string		-lha-
3620>0	use	lharc-file
36212	string		-lhb-
3622>0	use	lharc-file
36232	string		-lhc-
3624>0	use	lharc-file
36252	string		-lhe-
3626>0	use	lharc-file
36272	string		-lhx-
3628>0	use	lharc-file
3629# taken from idarc [JW]
36302   string      -lZ         PUT archive data
3631# already done by LHarc magics
3632# this should never happen if all sub types of LZS archive are identified
3633#2   string      -lz         LZS archive data
36342   string      -sw1-       Swag archive data
3635
36360	name		rar-file-header
3637>24	byte		15		\b, v1.5
3638>24	byte		20		\b, v2.0
3639>24	byte		29		\b, v4
3640>15	byte		0		\b, os: MS-DOS
3641>15	byte		1		\b, os: OS/2
3642>15	byte		2		\b, os: Win32
3643>15	byte		3		\b, os: Unix
3644>15	byte		4		\b, os: Mac OS
3645>15	byte		5		\b, os: BeOS
3646
36470	name		rar-archive-header
3648>3	leshort&0x1ff	>0		\b, flags:
3649>>3	leshort		&0x01		ArchiveVolume
3650>>3	leshort		&0x02		Commented
3651>>3	leshort		&0x04		Locked
3652>>3	leshort		&0x10		NewVolumeNaming
3653>>3	leshort		&0x08		Solid
3654>>3	leshort		&0x20		Authenticated
3655>>3	leshort		&0x40		RecoveryRecordPresent
3656>>3	leshort		&0x80		EncryptedBlockHeader
3657>>3	leshort		&0x100		FirstVolume
3658
3659# RAR (Roshal Archive) archive
36600	string		Rar!\x1a\7\0		RAR archive data
3661!:mime	application/x-rar
3662!:ext	rar/cbr
3663# file header
3664>(0xc.l+9)	byte	0x74
3665>>(0xc.l+7)	use	rar-file-header
3666# subblock seems to share information with file header
3667>(0xc.l+9)	byte	0x7a
3668>>(0xc.l+7)	use	rar-file-header
3669>9		byte	0x73
3670>>7		use	rar-archive-header
3671
36720	string		Rar!\x1a\7\1\0		RAR archive data, v5
3673!:mime	application/x-rar
3674!:ext	rar
3675
3676# Very old RAR archive
3677# https://jasonblanks.com/wp-includes/images/papers/KnowyourarchiveRAR.pdf
36780	string		RE\x7e\x5e  RAR archive data (<v1.5)
3679!:mime	application/x-rar
3680!:ext	rar/cbr
3681
3682# SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
36830	string		SQSH		squished archive data (Acorn RISCOS)
3684
3685# UC2 archiver (Greg Roelofs, newt@uchicago.edu)
3686# [JW] see exe section for self-extracting version
36870	string		UC2\x1a		UC2 archive data
3688
3689# PKZIP multi-volume archive
36900	string		PK\x07\x08PK\x03\x04	Zip multi-volume archive data, at least PKZIP v2.50 to extract
3691!:mime	application/zip
3692!:ext zip/cbz
3693
3694# Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
36950	string		PK\005\006	Zip archive data (empty)
3696!:mime application/zip
3697!:ext zip/cbz
3698!:strength +1
36990	string		PK\003\004
3700!:strength +1
3701
3702# Specialised zip formats which start with a member named 'mimetype'
3703# (stored uncompressed, with no 'extra field') containing the file's MIME type.
3704# Check for have 8-byte name, 0-byte extra field, name "mimetype", and
3705#  contents starting with "application/":
3706>26	string		\x8\0\0\0mimetypeapplication/
3707
3708#  KOffice / OpenOffice & StarOffice / OpenDocument formats
3709#    From: Abel Cheung <abel@oaka.org>
3710
3711#   KOffice (1.2 or above) formats
3712#    (mimetype contains "application/vnd.kde.<SUBTYPE>")
3713>>50	string	vnd.kde.		KOffice (>=1.2)
3714>>>58	string	karbon			Karbon document
3715>>>58	string	kchart			KChart document
3716>>>58	string	kformula		KFormula document
3717>>>58	string	kivio			Kivio document
3718>>>58	string	kontour			Kontour document
3719>>>58	string	kpresenter		KPresenter document
3720>>>58	string	kspread			KSpread document
3721>>>58	string	kword			KWord document
3722
3723#   OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7)
3724#    (mimetype contains "application/vnd.sun.xml.<SUBTYPE>")
3725# URL:		https://en.wikipedia.org/wiki/OpenOffice.org_XML
3726# reference:	http://fileformats.archiveteam.org/wiki/OpenOffice.org_XML
3727>>50	string	vnd.sun.xml.		OpenOffice.org 1.x
3728>>>62	string	writer			Writer
3729>>>>68	byte	!0x2e			document
3730!:mime	application/vnd.sun.xml.writer
3731!:ext	sxw
3732>>>>68	string	.template		template
3733!:mime	application/vnd.sun.xml.writer.template
3734!:ext	stw
3735>>>>68	string	.web			Web template
3736!:mime	application/vnd.sun.xml.writer.web
3737!:ext	stw
3738>>>>68	string	.global			global document
3739!:mime	application/vnd.sun.xml.writer.global
3740!:ext	sxg
3741>>>62	string	calc			Calc
3742>>>>66	byte	!0x2e			spreadsheet
3743!:mime	application/vnd.sun.xml.calc
3744!:ext	sxc
3745>>>>66	string	.template		template
3746!:mime	application/vnd.sun.xml.calc.template
3747!:ext	stc
3748>>>62	string	draw			Draw
3749>>>>66	byte	!0x2e			document
3750!:mime	application/vnd.sun.xml.draw
3751!:ext	sxd
3752>>>>66	string	.template		template
3753!:mime	application/vnd.sun.xml.draw.template
3754!:ext	std
3755>>>62	string	impress			Impress
3756>>>>69	byte	!0x2e			presentation
3757!:mime	application/vnd.sun.xml.impress
3758!:ext	sxi
3759>>>>69	string	.template		template
3760!:mime	application/vnd.sun.xml.impress.template
3761!:ext	sti
3762>>>62	string	math			Math document
3763!:mime	application/vnd.sun.xml.math
3764!:ext	sxm
3765>>>62	string	base			Database file
3766!:mime	application/vnd.sun.xml.base
3767!:ext	sdb
3768
3769#   OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8)
3770#   URL: http://fileformats.archiveteam.org/wiki/OpenDocument
3771#    https://lists.oasis-open.org/archives/office/200505/msg00006.html
3772#    (mimetype contains "application/vnd.oasis.opendocument.<SUBTYPE>")
3773>>50	string	vnd.oasis.opendocument.	OpenDocument
3774>>>73	string	text
3775>>>>77	byte	!0x2d			Text
3776!:mime	application/vnd.oasis.opendocument.text
3777!:ext	odt
3778>>>>77	string	-template		Text Template
3779!:mime	application/vnd.oasis.opendocument.text-template
3780!:ext	ott
3781>>>>77	string	-web			HTML Document Template
3782!:mime	application/vnd.oasis.opendocument.text-web
3783!:ext	oth
3784>>>>77	string	-master			Master Document
3785!:mime	application/vnd.oasis.opendocument.text-master
3786!:ext	odm
3787>>>73	string	graphics
3788>>>>81	byte	!0x2d			Drawing
3789!:mime	application/vnd.oasis.opendocument.graphics
3790!:ext	odg
3791>>>>81	string	-template		Drawing Template
3792!:mime	application/vnd.oasis.opendocument.graphics-template
3793!:ext	otg
3794>>>73	string	presentation
3795>>>>85	byte	!0x2d			Presentation
3796!:mime	application/vnd.oasis.opendocument.presentation
3797!:ext	odp
3798>>>>85	string	-template		Presentation Template
3799!:mime	application/vnd.oasis.opendocument.presentation-template
3800!:ext	otp
3801>>>73	string	spreadsheet
3802>>>>84	byte	!0x2d			Spreadsheet
3803!:mime	application/vnd.oasis.opendocument.spreadsheet
3804!:ext	ods
3805>>>>84	string	-template		Spreadsheet Template
3806!:mime	application/vnd.oasis.opendocument.spreadsheet-template
3807!:ext	ots
3808>>>73	string	chart
3809>>>>78	byte	!0x2d			Chart
3810!:mime	application/vnd.oasis.opendocument.chart
3811!:ext	odc
3812>>>>78	string	-template		Chart Template
3813!:mime	application/vnd.oasis.opendocument.chart-template
3814!:ext	otc
3815>>>73	string	formula
3816>>>>80	byte	!0x2d			Formula
3817!:mime	application/vnd.oasis.opendocument.formula
3818!:ext	odf
3819>>>>80	string	-template		Formula Template
3820!:mime	application/vnd.oasis.opendocument.formula-template
3821!:ext	otf
3822# https://www.loc.gov/preservation/digital/formats/fdd/fdd000441.shtml
3823>>>73	string	database		Database
3824!:mime	application/vnd.oasis.opendocument.database
3825!:ext	odb
3826# Valid for LibreOffice Base 6.0.1.1 at least
3827>>>73	string	base 			Database
3828# https://bugs.documentfoundation.org/show_bug.cgi?id=45854
3829!:mime	application/vnd.oasis.opendocument.database
3830#!:mime	application/vnd.oasis.opendocument.base
3831!:ext	odb
3832>>>73	string	image
3833>>>>78	byte	!0x2d			Image
3834!:mime	application/vnd.oasis.opendocument.image
3835!:ext	odi
3836>>>>78	string	-template		Image Template
3837!:mime	application/vnd.oasis.opendocument.image-template
3838!:ext	oti
3839
3840#  EPUB (OEBPS) books using OCF (OEBPS Container Format)
3841#    https://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4.
3842#    From: Ralf Brown <ralf.brown@gmail.com>
3843>>50	string	epub+zip	EPUB document
3844!:mime application/epub+zip
3845
3846# From:	Joerg Jenderek
3847# URL:	http://en.wikipedia.org/wiki/CorelDRAW
3848# NOTE:	version; til 2 WL-based; from 3 til 13 by ./riff; from 14 zip based
3849>>50	string	x-vnd.corel.	 Corel
3850>>>62	string	draw.document+zip	Draw drawing, version 14-16
3851!:mime	application/x-vnd.corel.draw.document+zip
3852!:ext	cdr
3853>>>62	string	draw.template+zip	Draw template, version 14-16
3854!:mime	application/x-vnd.corel.draw.template+zip
3855!:ext	cdrt
3856>>>62	string	zcf.draw.document+zip	Draw drawing, version 17-22
3857!:mime	application/x-vnd.corel.zcf.draw.document+zip
3858!:ext	cdr
3859>>>62	string	zcf.draw.template+zip	Draw template, version 17-22
3860!:mime	application/x-vnd.corel.zcf.draw.template+zip
3861!:ext	cdt/cdrt
3862# URL:	http://product.corel.com/help/CorelDRAW/540240626/Main/EN/Doc/CorelDRAW-Other-file-formats.html
3863>>>62	string	zcf.pattern+zip		Draw pattern, version 22
3864!:mime	application/x-vnd.corel.zcf.pattern+zip
3865!:ext	pat
3866# URL:		https://en.wikipedia.org/wiki/Corel_Designer
3867# Reference:	http://fileformats.archiveteam.org/wiki/Corel_Designer
3868# Note:		called by TrID "Corel DESIGN graphics"
3869>>>62	string	designer.document+zip		DESIGNER graphics, version 14-16
3870!:mime	application/x-vnd.corel.designer.document+zip
3871!:ext	des
3872>>>62	string	zcf.designer.document+zip	DESIGNER graphics, version 17-21
3873!:mime	application/x-vnd.corel.zcf.designer.document+zip
3874!:ext	des
3875# URL:	http://product.corel.com/help/CorelDRAW/540223850/Main/EN/Documentation/
3876#	CorelDRAW-Corel-Symbol-Library-CSL.html
3877>>>62	string	symbol.library+zip		Symbol Library, version 6-16.3
3878!:mime	application/x-vnd.corel.symbol.library+zip
3879!:ext	csl
3880>>>62	string	zcf.symbol.library+zip		Symbol Library, version 17-22
3881!:mime	application/x-vnd.corel.zcf.symbol.library+zip
3882!:ext	csl
3883
3884#  Catch other ZIP-with-mimetype formats
3885#	In a ZIP file, the bytes immediately after a member's contents are
3886#	always "PK". The 2 regex rules here print the "mimetype" member's
3887#	contents up to the first 'P'. Luckily, most MIME types don't contain
3888#	any capital 'P's. This is a kludge.
3889#    (mimetype contains "application/<OTHER>")
3890>>50		default	x			Zip data
3891>>>38		regex	[!-OQ-~]+		(MIME type "%s"?)
3892!:mime	application/zip
3893#    (mimetype contents other than "application/*")
3894>26		string	\x8\0\0\0mimetype
3895>>38		string	!application/
3896>>>38		regex	[!-OQ-~]+		Zip data (MIME type "%s"?)
3897!:mime	application/zip
3898
3899# Java Jar files
3900>(26.s+30)	leshort	0xcafe		Java archive data (JAR)
3901!:mime	application/java-archive
3902
3903# iOS App
3904>(26.s+30)	leshort	!0xcafe
3905>>26		string	!\x8\0\0\0mimetype
3906>>>30		string	Payload/
3907>>>>38		search/64       .app/   iOS App
3908!:mime application/x-ios-app
3909
3910>30	search/100/b application/epub+zip	EPUB document
3911!:mime application/epub+zip
3912
3913# Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
3914#   Next line excludes specialized formats:
3915>(26.s+30)	leshort	!0xcafe
3916>>30	search/100/b !application/epub+zip
3917>>>26    string          !\x8\0\0\0mimetype	Zip archive data
3918!:mime	application/zip
3919>>>>4	beshort		x			\b, at least
3920>>>>4	use		zipversion
3921>>>>4	beshort		x			to extract
3922>>>>8	beshort		x			\b, compression method=
3923>>>>8	use		zipcompression
3924>>>>0x161	string		WINZIP		\b, WinZIP self-extracting
3925
3926# StarView Metafile
3927# From Pierre Ducroquet <pinaraf@pinaraf.info>
39280	string	VCLMTF	StarView MetaFile
3929>6	beshort	x	\b, version %d
3930>8	belong	x	\b, size %d
3931
3932# Zoo archiver
393320	lelong		0xfdc4a7dc	Zoo archive data
3934!:mime	application/x-zoo
3935>4	byte		>48		\b, v%c.
3936>>6	byte		>47		\b%c
3937>>>7	byte		>47		\b%c
3938>32	byte		>0		\b, modify: v%d
3939>>33	byte		x		\b.%d+
3940>42	lelong		0xfdc4a7dc	\b,
3941>>70	byte		>0		extract: v%d
3942>>>71	byte		x		\b.%d+
3943
3944# Shell archives
394510	string		#\ This\ is\ a\ shell\ archive	shell archive text
3946!:mime	application/octet-stream
3947
3948#
3949# LBR. NB: May conflict with the questionable
3950#          "binary Computer Graphics Metafile" format.
3951#
39520       string  \0\ \ \ \ \ \ \ \ \ \ \ \0\0    LBR archive data
3953#
3954# PMA (CP/M derivative of LHA)
3955# Update: Joerg Jenderek
3956# URL: https://en.wikipedia.org/wiki/LHA_(file_format)
3957#
3958#2       string          -pm0-           PMarc archive data [pm0]
39592	string		-pm0-
3960>0	use	lharc-file
3961#2       string          -pm1-           PMarc archive data [pm1]
39622	string		-pm1-
3963>0	use	lharc-file
3964#2       string          -pm2-           PMarc archive data [pm2]
39652	string		-pm2-
3966>0	use	lharc-file
39672       string          -pms-           PMarc SFX archive (CP/M, DOS)
3968#!:mime	application/x-foobar-exec
3969!:ext com
39705       string          -pc1-           PopCom compressed executable (CP/M)
3971#!:mime	application/x-
3972#!:ext com
3973
3974# From Rafael Laboissiere <rafael@laboissiere.net>
3975# The Project Revision Control System (see
3976# http://prcs.sourceforge.net) generates a packaged project
3977# file which is recognized by the following entry:
39780	leshort		0xeb81	PRCS packaged project
3979
3980# Microsoft cabinets
3981# by David Necas (Yeti) <yeti@physics.muni.cz>
3982#0	string	MSCF\0\0\0\0	Microsoft cabinet file data,
3983#>25	byte	x		v%d
3984#>24	byte	x		\b.%d
3985# MPi: All CABs have version 1.3, so this is pointless.
3986# Better magic in debian-additions.
3987
3988# GTKtalog catalogs
3989# by David Necas (Yeti) <yeti@physics.muni.cz>
39904	string	gtktalog\ 	GTKtalog catalog data,
3991>13	string	3		version 3
3992>>14	beshort	0x677a		(gzipped)
3993>>14	beshort	!0x677a		(not gzipped)
3994>13	string	>3		version %s
3995
3996############################################################################
3997# Parity archive reconstruction file, the 'par' file format now used on Usenet.
39980       string          PAR\0	PARity archive data
3999>48	leshort		=0	- Index file
4000>48	leshort		>0	- file number %d
4001
4002# Felix von Leitner <felix-file@fefe.de>
40030	string	d8:announce	BitTorrent file
4004!:mime	application/x-bittorrent
4005# Durval Menezes, <jmgthbfile at durval dot com>
40060	string	d13:announce-list	BitTorrent file
4007!:mime	application/x-bittorrent
40080	string	d7:comment	BitTorrent file
4009!:mime	application/x-bittorrent
40100	string	d4:info		BitTorrent file
4011!:mime	application/x-bittorrent
4012
4013# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi>
40140	beshort 0x0e0f		Atari MSA archive data
4015>2	beshort x		\b, %d sectors per track
4016>4	beshort 0		\b, 1 sided
4017>4	beshort 1		\b, 2 sided
4018>6	beshort x		\b, starting track: %d
4019>8	beshort x		\b, ending track: %d
4020
4021# Alternate ZIP string (amc@arwen.cs.berkeley.edu)
40220	string	PK00PK\003\004	Zip archive data
4023!:mime	application/zip
4024!:ext zip/cbz
4025
4026# ACE archive (from http://www.wotsit.org/download.asp?f=ace)
4027# by Stefan `Sec` Zehl <sec@42.org>
40287	string		**ACE**		ACE archive data
4029>15	byte	>0		version %d
4030>16	byte	=0x00		\b, from MS-DOS
4031>16	byte	=0x01		\b, from OS/2
4032>16	byte	=0x02		\b, from Win/32
4033>16	byte	=0x03		\b, from Unix
4034>16	byte	=0x04		\b, from MacOS
4035>16	byte	=0x05		\b, from WinNT
4036>16	byte	=0x06		\b, from Primos
4037>16	byte	=0x07		\b, from AppleGS
4038>16	byte	=0x08		\b, from Atari
4039>16	byte	=0x09		\b, from Vax/VMS
4040>16	byte	=0x0A		\b, from Amiga
4041>16	byte	=0x0B		\b, from Next
4042>14	byte	x		\b, version %d to extract
4043>5	leshort &0x0080		\b, multiple volumes,
4044>>17	byte	x		\b (part %d),
4045>5	leshort &0x0002		\b, contains comment
4046>5	leshort	&0x0200		\b, sfx
4047>5	leshort	&0x0400		\b, small dictionary
4048>5	leshort	&0x0800		\b, multi-volume
4049>5	leshort	&0x1000		\b, contains AV-String
4050>>30	string	\x16*UNREGISTERED\x20VERSION*	(unregistered)
4051>5	leshort &0x2000		\b, with recovery record
4052>5	leshort &0x4000		\b, locked
4053>5	leshort &0x8000		\b, solid
4054# Date in MS-DOS format (whatever that is)
4055#>18	lelong	x		Created on
4056
4057# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann
4058# <doj@cubic.org>
40590x1A	string	sfArk		sfArk compressed Soundfont
4060>0x15	string	2
4061>>0x1	string	>\0		Version %s
4062>>0x2A	string	>\0		: %s
4063
4064# DR-DOS 7.03 Packed File *.??_
4065# Reference: http://www.antonis.de/dos/dos-tuts/mpdostip/html/nwdostip.htm
4066# Note:	unpacked by PNUNPACK.EXE
40670	string	Packed\ File\
4068# by looking for Control-Z skip ASCII text starting with Packed File
4069>0x18	ubyte	0x1a		Personal NetWare Packed File
4070!:mime	application/x-novell-compress
4071!:ext	??_
4072>>12	string	x		\b, was "%.12s"
4073# 1 or 2
4074#>>0x19	ubyte	x		\b, at 0x19 %u
4075>>0x1b	ulelong	x		with %u bytes
4076
4077# EET archive
4078# From: Tilman Sauerbeck <tilman@code-monkey.de>
40790	belong	0x1ee7ff00	EET archive
4080!:mime	application/x-eet
4081
4082# rzip archives
40830	string	RZIP		rzip compressed data
4084>4	byte	x		- version %d
4085>5	byte	x		\b.%d
4086>6	belong	x		(%d bytes)
4087
4088# From:		Joerg Jenderek
4089# URL:		https://help.foxitsoftware.com/kb/install-fzip-file.php
4090# reference:	http://mark0.net/download/triddefs_xml.7z/
4091#		defs/f/fzip.trid.xml
4092# Note: unknown compression; No "PK" zip magic; normally in directory like
4093#	"%APPDATA%\Foxit Software\Addon\Foxit Reader\Install"
40940	ubequad	0x2506781901010000	Foxit add-on/update
4095!:mime	application/x-fzip
4096!:ext	fzip
4097
4098# From: "Robert Dale" <robdale@gmail.com>
40990	belong	123		dar archive,
4100>4	belong	x		label "%.8x
4101>>8	belong	x		%.8x
4102>>>12	beshort	x		%.4x"
4103>14	byte	0x54		end slice
4104>14	beshort	0x4e4e		multi-part
4105>14	beshort	0x4e53		multi-part, with -S
4106
4107# Symbian installation files
4108#  https://www.thouky.co.uk/software/psifs/sis.html
4109#  http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf
41108	lelong	0x10000419	Symbian installation file
4111!:mime	application/vnd.symbian.install
4112>4	lelong	0x1000006D	(EPOC release 3/4/5)
4113>4	lelong	0x10003A12	(EPOC release 6)
41140	lelong	0x10201A7A	Symbian installation file (Symbian OS 9.x)
4115!:mime	x-epoc/x-sisx-app
4116
4117# From "Nelson A. de Oliveira" <naoliv@gmail.com>
41180	string	MPQ\032		MoPaQ (MPQ) archive
4119
4120# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
4121# .kgb
41220	string KGB_arch		KGB Archiver file
4123>10	string x		with compression level %.1s
4124
4125# xar (eXtensible ARchiver) archive
4126# URL: https://en.wikipedia.org/wiki/Xar_(archiver)
4127# xar archive format: https://code.google.com/p/xar/
4128# From: "David Remahl" <dremahl@apple.com>
4129# Update: Joerg Jenderek
4130# TODO: lzma compression; X509Data for pkg and xip
4131# Note: verified by `xar --dump-header -f FullBundleUpdate.xar` or
4132# 7z t -txar Xcode_10.2_beta_4.xip`
41330	string	xar!		xar archive
4134!:mime	application/x-xar
4135# pkg for Mac OSX installer package like FullBundleUpdate.pkg
4136# xip for signed Apple software like Xcode_10.2_beta_4.xip
4137!:ext	xar/pkg/xip
4138# always 28 in older archives
4139>4	ubeshort >28		\b, header size %u
4140# currently there exit only version 1 since about 2014
4141>6	ubeshort >1		version %u,
4142>8	ubequad	x		compressed TOC: %llu,
4143#>16	ubequad	x		uncompressed TOC: %llu,
4144# cksum_alg 0-2 in older and also 3-4 in newer
4145>24	belong	0		no checksum
4146>24	belong	1		SHA-1 checksum
4147>24	belong	2		MD5 checksum
4148>24	belong	3		SHA-256 checksum
4149>24	belong	4		SHA-512 checksum
4150>24	belong	>4		unknown 0x%x checksum
4151#>24	belong	>4		checksum
4152#			For no compression jump 0 bytes
4153>24	belong	0
4154>>0		ubyte	x
4155# jump more bytes forward by header size
4156>>>&(4.S)	ubyte	x
4157# jump more bytes forward by compressed table of contents size
4158#>>>>&(8.Q)	ubequad	x	\b, heap data 0x%llx
4159>>>>&(8.Q)	ubyte	x
4160# look for data by ./compress after message with 1 space at end
4161>>>>>&-3	indirect x	\b, contains
4162#			For SHA-1 jump 20 minus 2 bytes
4163>24	belong	1
4164>>18		ubyte	x
4165# jump more bytes forward by header size
4166>>>&(4.S)	ubyte	x
4167# jump more bytes forward by compressed table of contents size
4168>>>>&(8.Q)	ubyte	x
4169# data compressed by gzip, bzip, lzma or none
4170>>>>>&-1	indirect x	\b, contains
4171#			For SHA-256 jump 32 minus 2 bytes
4172>24	belong	3
4173>>30		ubyte	x
4174# jump more bytes forward by header size
4175>>>&(4.S)	ubyte	x
4176# jump more bytes forward by compressed table of contents size
4177>>>>&(8.Q)	ubyte	x
4178>>>>>&-1	indirect x	\b, contains
4179#			For SHA-512 jump 64 minus 2 bytes
4180>24	belong	4
4181>>62		ubyte	x
4182# jump more bytes forward by header size
4183>>>&(4.S)	ubyte	x
4184# jump more bytes forward by compressed table of contents size
4185>>>>&(8.Q)	ubyte	x
4186>>>>>&-1	indirect x	\b, contains
4187
4188# Type: Parity Archive
4189# From: Daniel van Eeden <daniel_e@dds.nl>
41900	string	PAR2		Parity Archive Volume Set
4191
4192# Bacula volume format. (Volumes always start with a block header.)
4193# URL: https://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html
4194# From: Adam Buchbinder <adam.buchbinder@gmail.com>
419512	string	BB02		Bacula volume
4196>20	bedate	x		\b, started %s
4197
4198# ePub is XHTML + XML inside a ZIP archive.  The first member of the
4199#   archive must be an uncompressed file called 'mimetype' with contents
4200#   'application/epub+zip'
4201
4202
4203# From: "Michael Gorny" <mgorny@gentoo.org>
4204# ZPAQ: http://mattmahoney.net/dc/zpaq.html
42050	string	zPQ	ZPAQ stream
4206>3	byte	x	\b, level %d
4207# From: Barry Carter <carter.barry@gmail.com>
4208# https://encode.ru/threads/456-zpaq-updates/page32
42090	string	7kSt	ZPAQ file
4210
4211# BBeB ebook, unencrypted (LRF format)
4212# URL: https://www.sven.de/librie/Librie/LrfFormat
4213# From: Adam Buchbinder <adam.buchbinder@gmail.com>
42140	string	L\0R\0F\0\0\0	BBeB ebook data, unencrypted
4215>8	beshort	x		\b, version %d
4216>36	byte	1		\b, front-to-back
4217>36	byte	16		\b, back-to-front
4218>42	beshort	x		\b, (%dx,
4219>44	beshort	x		%d)
4220
4221# Symantec GHOST image by Joerg Jenderek at May 2014
4222# https://us.norton.com/ghost/
4223# https://www.garykessler.net/library/file_sigs.html
42240		ubelong&0xFFFFf7f0	0xFEEF0100	Norton GHost image
4225# *.GHO
4226>2		ubyte&0x08		0x00		\b, first file
4227# *.GHS or *.[0-9] with cns program option
4228>2		ubyte&0x08		0x08		\b, split file
4229# part of split index interesting for *.ghs
4230>>4		ubyte			x		id=0x%x
4231# compression tag minus one equals numeric compression command line switch z[1-9]
4232>3		ubyte			0		\b, no compression
4233>3		ubyte			2		\b, fast compression (Z1)
4234>3		ubyte			3		\b, medium compression (Z2)
4235>3		ubyte			>3
4236>>3		ubyte			<11		\b, compression (Z%d-1)
4237>2		ubyte&0x08		0x00
4238# ~ 30 byte password field only for *.gho
4239>>12		ubequad			!0		\b, password protected
4240>>44		ubyte			!1
4241# 1~Image All, sector-by-sector only for *.gho
4242>>>10		ubyte			1		\b, sector copy
4243# 1~Image Boot track only for *.gho
4244>>>43		ubyte			1		\b, boot track
4245# 1~Image Disc only for *.gho implies Image Boot track and sector copy
4246>>44		ubyte			1		\b, disc sector copy
4247# optional image description only *.gho
4248>>0xff		string			>\0		"%-.254s"
4249# look for DOS sector end sequence
4250>0xE08	search/7776		\x55\xAA
4251>>&-512	indirect		x		\b; contains
4252
4253# Google Chrome extensions
4254# https://developer.chrome.com/extensions/crx
4255# https://developer.chrome.com/extensions/hosting
42560	string	Cr24	Google Chrome extension
4257!:mime	application/x-chrome-extension
4258>4	ulong	x	\b, version %u
4259
4260# SeqBox - Sequenced container
4261# ext: sbx, seqbox
4262# Marco Pontello marcopon@gmail.com
4263# reference: https://github.com/MarcoPon/SeqBox
42640	string	SBx	SeqBox,
4265>3	byte	x	version %d
4266
4267# LyNX archive
426856	string	USE\040LYNX\040TO\040DISSOLVE\040THIS\040FILE	 LyNX archive
4269
4270# From: Joerg Jenderek
4271# URL: https://www.acronis.com/
4272# Reference: https://en.wikipedia.org/wiki/TIB_(file_format)
4273# Note: only tested with True Image 2013 Build 5962 and 2019 Build 14110
42740	ubequad		0xce24b9a220000000	Acronis True Image backup
4275!:mime	application/x-acronis-tib
4276!:ext	tib
4277# 01000000
4278#>20	ubelong		x			\b, at 20 0x%x
4279# 20000000
4280#>28	ubelong		x			\b, at 28 0x%x
4281# strings like "Generic- SD/MMC 1.00" "Unknown Disk" "Msft Virtual Disk 1.0"
4282# ???
4283# strings like "\Device\0000011e" "\Device\0000015a"
4284#>0	search/0x6852300/cs	\\Device\\
4285#>>&-1	pstring		x			\b, %s
4286# "\Device\HarddiskVolume30" "\Device\HarddiskVolume39"
4287#>>>&1	search/180/cs	\\Device\\
4288#>>>>&-1	pstring		x			\b, %s
4289#>>>>>&0	search/29/cs	\0\0\xc8\0
4290# disk label
4291#>>>>>>&10	lestring16	x		\b, disk label %11.11s
4292#>>>>>>&9	plestring16	x		\b, disk label "%11.11s"
4293#>>>>>>&10	ubequad	x			%16.16llx
4294
4295
4296# Gentoo XPAK binary package
4297# by Michal Gorny <mgorny@gentoo.org>
4298# https://gitweb.gentoo.org/proj/portage.git/tree/man/xpak.5
4299-4	string	STOP
4300>-16	string	XPAKSTOP	Gentoo binary package (XPAK)
4301
4302# From:		Joerg Jenderek
4303# URL:		https://kodi.wiki/view/TexturePacker
4304# Reference:	https://mirrors.kodi.tv/releases/source/17.3-Krypton.tar.gz
4305# /xbmc-Krypton/xbmc/guilib/XBTF.h
4306# /xbmc-Krypton/xbmc/guilib/XBTF.cpp
43070	string	XBTF
4308# skip ASCII text by looking for terminating \0 of path
4309>264	ubyte	0		XBMC texture package
4310!:mime	application/x-xbmc-xbt
4311!:ext	xbt
4312# XBTF_VERSION 2
4313>>4	string	!2		\b, version %-.1s
4314# nofFiles /xbmc-Krypton/xbmc/guilib/XBTFReader.cpp
4315>>5	ulelong	x		\b, %u file
4316# plural s
4317>>5	ulelong	>1		\bs
4318# path[CXBTFFile[MaximumPathLength=256]
4319>>9	string	x		\b, 1st %s
4320
4321# ALZIP archive
4322# by Hyungjun Park <hyungjun.park@worksmobile.com>, Hajin Jang <hajin_jang@worksmobile.com>
4323# http://kippler.com/win/unalz/
4324# https://salsa.debian.org/l10n-korean-team/unalz
43250	string	ALZ\001		ALZ archive data
4326!:ext   alz
4327
4328# https://cf-aldn.altools.co.kr/setup/EGG_Specification.zip
43290	string	EGGA		EGG archive data,
4330!:ext   egg
4331>5	byte	x		version %u
4332>4	byte	x		\b.%u
4333>>0x0E	ulelong	=0x08E28222
4334>>0x0E	ulelong	=0x24F5A262	\b, split
4335>>0x0E	ulelong	=0x24E5A060	\b, solid
4336>>0x0E	default	x		\b, unknown
4337
4338# PAQ9A archive
4339# URL: http://mattmahoney.net/dc/#paq9a
4340# Note: Line 1186 of paq9a.cpp gives the magic bytes
43410	string	pQ9\001		PAQ9A archive
4342
4343#------------------------------------------------------------------------------
4344# $File: asf,v 1.1 2019/12/26 02:07:53 christos Exp $
4345# asf:  file(1) magic for Microsoft Advanced Systems Format (ASF) files
4346# http://www.staroceans.org/e-book/ASF_Specification.pdf
4347
43480	name	asf-name
4349# ASF_Data_Object
4350#>0	guid	75B22636-668E-11CF-A6D9-00AA0062CE6C
4351#>16	lequad	>0
4352#>>(16.q)	use	asf-object
4353# ASF_Simple_Index_Object
4354>0	guid	33000890-E5B1-11CF-89F4-00A0C90349CB
4355>0	guid	D6E229D3-35DA-11D1-9034-00A0C90349BE ASF_Index_Object
4356>0	guid	FEB103F8-12AD-4C64-840F-2A1D2F7AD48C ASF_Media_Object_Index_Object
4357>0	guid	3CB73FD0-0C4A-4803-953D-EDF7B6228F0C ASF_Timecode_Index_Object
4358
4359# ASF_File_Properties_Object
4360>0	guid	8CABDCA1-A947-11CF-8EE4-00C00C205365
4361
4362# ASF_Stream_Properties_Object
4363>0	guid	B7DC0791-A9B7-11CF-8EE6-00C00C205365
4364#>>56	lequad	x		Time Offset %lld
4365#>>64	lelong	x		Type-Specicic Data Length %d
4366#>>68	lelong	x		Error Correction Data Length %d
4367#>>72	leshort	x		Flags 0x%x
4368#>>74	lelong	x		Reserved %x
4369# ASF_Audio_Media
4370>>24	guid	F8699E40-5B4D-11CF-A8FD-00805F5C442B \b, Audio Media (
4371>>>78	leshort	x	\bCodec Id %d
4372>>>80	leshort	x	\b, Number of channels %d
4373>>>82	lelong	x	\b, Samples Per Second %d
4374>>>86	lelong	x	\b, Average Number of Bytes Per Second %d
4375>>>90	lelong	x	\b, Block Alignment %d
4376>>>94	leshort	x	\b, Bits Per Sample %d
4377# ASF_Video_Media
4378>>24	guid	BC19EFC0-5B4D-11CF-A8FD-00805F5C442B \b, Video Media (
4379>>>78	lelong	x	\bEncoded Image Width %d
4380>>>82	lelong	x	\b, Encoded Image Height %d
4381#>>>85	leshort	x	\b, Format Data Size %x
4382>>>93	lelong	x	\b, Image Width %d
4383>>>97	lelong	x	\b, Image Height %d
4384#>>>101	leshort	x	\b, Reserved 0x%x
4385>>>103	leshort	x	\b, Bits Per Pixel Count %d
4386#>>>105	lelong	x 	\b, Compression ID %d
4387#>>>109	lelong	x	\b, Image Size %d
4388#>>>113	lelong	x	\b, Horizontal Pixels Per Meter %d
4389#>>>117	lelong	x	\b, Vertical Pixels Per Meter %d
4390#>>>121	lelong	x	\b, Colors Used Count %d
4391#>>>125	lelong	x	\b, Important Colors Count %d
4392>>0	lelong	x	\b, Error correction type
4393>>40	use	asf-name
4394>>0	lelong	x	\b)
4395#ASF_Header_Extension_Object
4396>0	guid	5FBF03B5-A92E-11CF-8EE3-00C00C205365
4397# ASF_Codec_List_Object
4398>0	guid	86D15240-311D-11D0-A3A4-00A0C90348F6
4399>0	guid	1EFB1A30-0B62-11D0-A39B-00A0C90348F6 ASF_Script_Command_Object
4400>0	guid	F487CD01-A951-11CF-8EE6-00C00C205365 ASF_Marker_Object
4401>0	guid	D6E229DC-35DA-11D1-9034-00A0C90349BE ASF_Bitrate_Mutual_Exclusion_Object
4402>0	guid	75B22635-668E-11CF-A6D9-00AA0062CE6C ASF_Error_Correction_Object
4403# ASF_Content_Description_Object
4404>0	guid	75B22633-668E-11CF-A6D9-00AA0062CE6C
4405#>>24	leshort	title length %d
4406#>>26	leshort	author length %d
4407#>>28	leshort	copyright length %d
4408#>>30	leshort	descriptor length %d
4409#>>32	leshort	rating length %d
4410>0	guid	D2D0A440-E307-11D2-97F0-00A0C95EA850 ASF_Extended_Content_Description_Object
4411>0	guid	2211B3FA-BD23-11D2-B4B7-00A0C955FC6E ASF_Content_Branding_Object
4412>0	guid	7BF875CE-468D-11D1-8D82-006097C9A2B2 ASF_Stream_Bitrate_Properties_Object
4413>0	guid	2211B3FB-BD23-11D2-B4B7-00A0C955FC6E ASF_Content_Encryption_Object
4414>0	guid	298AE614-2622-4C17-B935-DAE07EE9289C ASF_Extended_Content_Encryption_Object
4415>0	guid	2211B3FC-BD23-11D2-B4B7-00A0C955FC6E ASF_Digital_Signature_Object
4416# ASF_Padding_Object
4417>0	guid	1806D474-CADF-4509-A4BA-9AABCB96AAE8
4418>0	guid	14E6A5CB-C672-4332-8399-A96952065B5A ASF_Extended_Stream_Properties_Object
4419>0	guid	A08649CF-4775-4670-8A16-6E35357566CD ASF_Advanced_Mutual_Exclusion_Object
4420>0	guid	D1465A40-5A79-4338-B71B-E36B8FD6C249 ASF_Group_Mutual_Exclusion_Object
4421>0	guid	D4FED15B-88D3-454F-81F0-ED5C45999E24 ASF_Stream_Prioritization_Object
4422>0	guid	A69609E6-517B-11D2-B6AF-00C04FD908E9 ASF_Bandwidth_Sharing_Object
4423>0	guid	7C4346A9-EFE0-4BFC-B229-393EDE415C85 ASF_Language_List_Object
4424>0	guid	C5F8CBEA-5BAF-4877-8467-AA8C44FA4CCA ASF_Metadata_Object
4425>0	guid	44231C94-9498-49D1-A141-1D134E457054 ASF_Metadata_Library_Object
4426>0	guid	D6E229DF-35DA-11D1-9034-00A0C90349BE ASF_Index_Parameters_Object
4427>0	guid	6B203BAD-3F11-48E4-ACA8-D7613DE2CFA7 ASF_Media_Object_Index_Parameters_Object
4428>0	guid	F55E496D-9797-4B5D-8C8B-604DFE9BFB24 ASF_Timecode_Index_Parameters_Object
4429>0	guid	26F18B5D-4584-47EC-9F5F-0E651F0452C9 ASF_Compatibility_Object
4430>0	guid	43058533-6981-49E6-9B74-AD12CB86D58C ASF_Advanced_Content_Encryption_Object
4431>0	guid	59DACFC0-59E6-11D0-A3AC-00A0C90348F6 ASF_Command_Media
4432>0	guid	B61BE100-5B4E-11CF-A8FD-00805F5C44 ASF_JFIF_Media
4433>0	guid	35907DE0-E415-11CF-A917-00805F5C442B ASF_Degradable_JPEG_Media
4434>0	guid	91BD222C-F21C-497A-8B6D-5AA86BFC0185 ASF_File_Transfer_Media
4435>0	guid	3AFB65E2-47EF-40F2-AC2C-70A90D71D343 ASF_Binary_Media
4436>0	guid	776257D4-C627-41CB-8F81-7AC7FF1C40CC ASF_Web_Stream_Media_Subtype
4437>0	guid	DA1E6B13-8359-4050-B398-388E965BF00C ASF_Web_Stream_Format
4438>0	guid	20FB5700-5B55-11CF-A8FD-00805F5C442B ASF_No_Error_Correction
4439>0	guid	BFC3CD50-618F-11CF-8BB2-00AA00B4E220 ASF_Audio_Spread
4440>0	guid	ABD3D211-A9BA-11cf-8EE6-00C00C205365 ASF_Reserved_1
4441>0	guid	7A079BB6-DAA4-4e12-A5CA-91D38DC11A8D ASF_Content_Encryption_System_Windows_Media_DRM
4442# _Network_Devices
4443>0	guid	86D15241-311D-11D0-A3A4-00A0C90348F6 ASF_Reserved_2
4444>0	guid	4B1ACBE3-100B-11D0-A39B-00A0C90348F6 ASF_Reserved_3
4445>0	guid	4CFEDB20-75F6-11CF-9C0F-00A0C90349CB ASF_Reserved_4
4446>0	guid	D6E22A00-35DA-11D1-9034-00A0C90349BE ASF_Mutex_Language
4447>0	guid	D6E22A01-35DA-11D1-9034-00A0C90349BE ASF_Mutex_Bitrate
4448>0	guid	D6E22A02-35DA-11D1-9034-00A0C90349BE ASF_Mutex_Unknown
4449>0	guid	AF6060AA-5197-11D2-B6AF-00C04FD908E9 ASF_Bandwidth_Sharing_Exclusive
4450>0	guid	AF6060AB-5197-11D2-B6AF-00C04FD908E9 ASF_Bandwidth_Sharing_Partial
4451>0	guid	399595EC-8667-4E2D-8FDB-98814CE76C1E ASF_Payload_Extension_System_Timecode
4452>0	guid	E165EC0E-19ED-45D7-B4A7-25CBD1E28E9B ASF_Payload_Extension_System_File_Name
4453>0	guid	D590DC20-07BC-436C-9CF7-F3BBFBF1A4DC ASF_Payload_Extension_System_Content_Type
4454>0	guid	1B1EE554-F9EA-4BC8-821A-376B74E4C4B8 ASF_Payload_Extension_System_Pixel_Aspect_Ratio
4455>0	guid	C6BD9450-867F-4907-83A3-C77921B733AD ASF_Payload_Extension_System_Sample_Duration
4456>0	guid	6698B84E-0AFA-4330-AEB2-1C0A98D7A44D ASF_Payload_Extension_System_Encryption_Sample_ID
4457>0	guid	00E1AF06-7BEC-11D1-A582-00C04FC29CFB ASF_Payload_Extension_System_Degradable_JPEG
4458
44590	name	asf-object
4460>0	use	asf-name
4461#>>16	lequad	>0					(size %lld) [
4462>>16	lequad	>0
4463>>>(16.q)	use	asf-object
4464#>>16	lequad	0	]
4465
4466# Microsoft Advanced Streaming Format (ASF) <mpruett@sgi.com>
44670	guid	75B22630-668E-11CF-A6D9-00AA0062CE6C	Microsoft ASF
4468!:mime  video/x-ms-asf
4469#>16	lequad	>0					(size %lld
4470#>>24	lelong	x					\b, %d header objects)
4471>16	lequad	>0
4472>>30	use	asf-object
4473>>(16.q)	use	asf-object
4474#------------------------------------------------------------------------------
4475# $File: assembler,v 1.6 2013/12/11 14:14:20 christos Exp $
4476# make:  file(1) magic for assembler source
4477#
44780	regex	\^[\040\t]{0,50}\\.asciiz		assembler source text
4479!:mime	text/x-asm
44800	regex	\^[\040\t]{0,50}\\.byte		assembler source text
4481!:mime	text/x-asm
44820	regex	\^[\040\t]{0,50}\\.even		assembler source text
4483!:mime	text/x-asm
44840	regex	\^[\040\t]{0,50}\\.globl		assembler source text
4485!:mime	text/x-asm
44860	regex	\^[\040\t]{0,50}\\.text		assembler source text
4487!:mime	text/x-asm
44880	regex	\^[\040\t]{0,50}\\.file		assembler source text
4489!:mime	text/x-asm
44900	regex	\^[\040\t]{0,50}\\.type		assembler source text
4491!:mime	text/x-asm
4492
4493#------------------------------------------------------------------------------
4494# $File: asterix,v 1.5 2009/09/19 16:28:08 christos Exp $
4495# asterix:  file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character
4496# strings as "long" - we assume they're just strings:
4497# From: guy@netapp.com (Guy Harris)
4498#
44990	string		*STA		Aster*x
4500>7	string		WORD			Words Document
4501>7	string		GRAP			Graphic
4502>7	string		SPRE			Spreadsheet
4503>7	string		MACR			Macro
45040	string		2278		Aster*x Version 2
4505>29	byte		0x36			Words Document
4506>29	byte		0x35			Graphic
4507>29	byte		0x32			Spreadsheet
4508>29	byte		0x38			Macro
4509
4510
4511#------------------------------------------------------------------------------
4512# $File: att3b,v 1.10 2017/03/17 21:35:28 christos Exp $
4513# att3b:  file(1) magic for AT&T 3B machines
4514#
4515# The `versions' should be un-commented if they work for you.
4516# (Was the problem just one of endianness?)
4517#
4518# 3B20
4519#
4520# The 3B20 conflicts with SCCS.
4521#0	beshort		0550		3b20 COFF executable
4522#>12	belong		>0		not stripped
4523#>22	beshort		>0		- version %d
4524#0	beshort		0551		3b20 COFF executable (TV)
4525#>12	belong		>0		not stripped
4526#>22	beshort		>0		- version %d
4527#
4528# WE32K
4529#
45300	beshort		0560		WE32000 COFF
4531>18	beshort		^00000020	object
4532>18	beshort		&00000020	executable
4533>12	belong		>0		not stripped
4534>18	beshort		^00010000	N/A on 3b2/300 w/paging
4535>18	beshort		&00020000	32100 required
4536>18	beshort		&00040000	and MAU hardware required
4537>20	beshort		0407		(impure)
4538>20	beshort		0410		(pure)
4539>20	beshort		0413		(demand paged)
4540>20	beshort		0443		(target shared library)
4541>22	beshort		>0		- version %d
45420	beshort		0561		WE32000 COFF executable (TV)
4543>12	belong		>0		not stripped
4544#>18	beshort		&00020000	- 32100 required
4545#>18	beshort		&00040000	and MAU hardware required
4546#>22	beshort		>0		- version %d
4547#
4548# core file for 3b2
45490	string		\000\004\036\212\200	3b2 core file
4550>364	string		>\0		of '%s'
4551
4552#------------------------------------------------------------------------------
4553# $File: audio,v 1.120 2021/02/23 00:51:10 christos Exp $
4554# audio:  file(1) magic for sound formats (see also "iff")
4555#
4556# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
4557# and others
4558#
4559
4560# Sun/NeXT audio data
45610	string		.snd		Sun/NeXT audio data:
4562>12	belong		1		8-bit ISDN mu-law,
4563!:mime	audio/basic
4564>12	belong		2		8-bit linear PCM [REF-PCM],
4565!:mime	audio/basic
4566>12	belong		3		16-bit linear PCM,
4567!:mime	audio/basic
4568>12	belong		4		24-bit linear PCM,
4569!:mime	audio/basic
4570>12	belong		5		32-bit linear PCM,
4571!:mime	audio/basic
4572>12	belong		6		32-bit IEEE floating point,
4573!:mime	audio/basic
4574>12	belong		7		64-bit IEEE floating point,
4575!:mime	audio/basic
4576>12	belong		8		Fragmented sample data,
4577>12	belong		10		DSP program,
4578>12	belong		11		8-bit fixed point,
4579>12	belong		12		16-bit fixed point,
4580>12	belong		13		24-bit fixed point,
4581>12	belong		14		32-bit fixed point,
4582>12	belong		18		16-bit linear with emphasis,
4583>12	belong		19		16-bit linear compressed,
4584>12	belong		20		16-bit linear with emphasis and compression,
4585>12	belong		21		Music kit DSP commands,
4586>12	belong		23		8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.),
4587!:mime  audio/x-adpcm
4588>12	belong		24		compressed (8-bit CCITT G.722 ADPCM)
4589>12	belong		25		compressed (3-bit CCITT G.723.3 ADPCM),
4590>12	belong		26		compressed (5-bit CCITT G.723.5 ADPCM),
4591>12	belong		27		8-bit A-law (CCITT G.711),
4592>20	belong		1		mono,
4593>20	belong		2		stereo,
4594>20	belong		4		quad,
4595>16	belong		>0		%d Hz
4596
4597# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format
4598# that uses little-endian encoding and has a different magic number
45990	lelong		0x0064732E	DEC audio data:
4600>12	lelong		1		8-bit ISDN mu-law,
4601!:mime	audio/x-dec-basic
4602>12	lelong		2		8-bit linear PCM [REF-PCM],
4603!:mime	audio/x-dec-basic
4604>12	lelong		3		16-bit linear PCM,
4605!:mime	audio/x-dec-basic
4606>12	lelong		4		24-bit linear PCM,
4607!:mime	audio/x-dec-basic
4608>12	lelong		5		32-bit linear PCM,
4609!:mime	audio/x-dec-basic
4610>12	lelong		6		32-bit IEEE floating point,
4611!:mime	audio/x-dec-basic
4612>12	lelong		7		64-bit IEEE floating point,
4613!:mime	audio/x-dec-basic
4614>12	belong		8		Fragmented sample data,
4615>12	belong		10		DSP program,
4616>12	belong		11		8-bit fixed point,
4617>12	belong		12		16-bit fixed point,
4618>12	belong		13		24-bit fixed point,
4619>12	belong		14		32-bit fixed point,
4620>12	belong		18		16-bit linear with emphasis,
4621>12	belong		19		16-bit linear compressed,
4622>12	belong		20		16-bit linear with emphasis and compression,
4623>12	belong		21		Music kit DSP commands,
4624>12	lelong		23		8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.),
4625!:mime	audio/x-dec-basic
4626>12	belong		24		compressed (8-bit CCITT G.722 ADPCM)
4627>12	belong		25		compressed (3-bit CCITT G.723.3 ADPCM),
4628>12	belong		26		compressed (5-bit CCITT G.723.5 ADPCM),
4629>12	belong		27		8-bit A-law (CCITT G.711),
4630>20	lelong		1		mono,
4631>20	lelong		2		stereo,
4632>20	lelong		4		quad,
4633>16	lelong		>0		%d Hz
4634
4635# Creative Labs AUDIO stuff
46360	string	MThd			Standard MIDI data
4637!:mime	audio/midi
4638>8 	beshort	x			(format %d)
4639>10	beshort	x			using %d track
4640>10	beshort		>1		\bs
4641>12	beshort&0x7fff	x		at 1/%d
4642>12	beshort&0x8000	>0		SMPTE
4643
46440	string	CTMF			Creative Music (CMF) data
4645!:mime	audio/x-unknown
46460	string	SBI			SoundBlaster instrument data
4647!:mime	audio/x-unknown
46480	string	Creative\ Voice\ File	Creative Labs voice data
4649!:mime	audio/x-unknown
4650# is this next line right?  it came this way...
4651>19	byte	0x1A
4652>23	byte	>0			- version %d
4653>22	byte	>0			\b.%d
4654
4655# first entry is also the string "NTRK"
46560	belong		0x4e54524b	MultiTrack sound data
4657>4	belong		x		- version %d
4658
4659# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED
4660# [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi]
46610	string		EMOD		Extended MOD sound data,
4662>4	byte&0xf0	x		version %d
4663>4	byte&0x0f	x		\b.%d,
4664>45	byte		x		%d instruments
4665>83	byte		0		(module)
4666>83	byte		1		(song)
4667
4668# Real Audio (Magic .ra\0375)
46690	belong		0x2e7261fd	RealAudio sound file
4670!:mime	audio/x-pn-realaudio
46710	string		.RMF\0\0\0	RealMedia file
4672!:mime	application/vnd.rn-realmedia
4673#video/x-pn-realvideo
4674#video/vnd.rn-realvideo
4675#application/vnd.rn-realmedia
4676#	sigh, there are many mimes for that but the above are the most common.
4677
4678# MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net]
4679# Oct 31, 1995
4680# fixed by <doj@cubic.org> 2003-06-24
4681# Too short...
4682#0	string		MTM		MultiTracker Module sound file
4683#0	string		if		Composer 669 Module sound data
4684#0	string		JN		Composer 669 Module sound data (extended format)
46850	string		MAS_U		ULT(imate) Module sound data
4686
4687#0	string		FAR		Module sound data
4688#>4	string		>\15		Title: "%s"
4689
46900x2c	string		SCRM		ScreamTracker III Module sound data
4691>0	string		>\0		Title: "%s"
4692!:mime	audio/x-s3m
4693
4694# .stm before it got above .s3m extension
46950x16	string		\!Scream\!	ScreamTracker Module sound data
4696>0	string		>\0		Title: "%s"
4697
4698# Gravis UltraSound patches
4699# From <ache@nagual.ru>
4700
47010	string		GF1PATCH110\0ID#000002\0	GUS patch
47020	string		GF1PATCH100\0ID#000002\0	Old GUS	patch
4703
4704# mime types according to http://www.geocities.com/nevilo/mod.htm:
4705#	audio/it	.it
4706#	audio/x-zipped-it	.itz
4707#	audio/xm	fasttracker modules
4708#	audio/x-s3m	screamtracker modules
4709#	audio/s3m	screamtracker modules
4710#	audio/x-zipped-mod	mdz
4711#	audio/mod	mod
4712#	audio/x-mod	All modules (mod, s3m, 669, mtm, med, xm, it, mdz, stm, itz, xmz, s3z)
4713
4714#
4715# Taken from loader code from mikmod version 2.14
4716# by Steve McIntyre (stevem@chiark.greenend.org.uk)
4717# <doj@cubic.org> added title printing on 2003-06-24
47180	string	MAS_UTrack_V00
4719>14	string	>/0		ultratracker V1.%.1s module sound data
4720!:mime	audio/x-mod
4721#audio/x-tracker-module
4722
47230	string	UN05		MikMod UNI format module sound data
4724
47250	string	Extended\ Module: Fasttracker II module sound data
4726!:mime	audio/x-mod
4727#audio/x-tracker-module
4728>17	string	>\0		Title: "%s"
4729
473021	string/c	=!SCREAM!	Screamtracker 2 module sound data
4731!:mime	audio/x-mod
4732#audio/x-screamtracker-module
473321	string	BMOD2STM	Screamtracker 2 module sound data
4734!:mime	audio/x-mod
4735#audio/x-screamtracker-module
47361080	string	M.K.		4-channel Protracker module sound data
4737!:mime	audio/x-mod
4738#audio/x-protracker-module
4739>0	string	>\0		Title: "%s"
47401080	string	M!K!		4-channel Protracker module sound data
4741!:mime	audio/x-mod
4742#audio/x-protracker-module
4743>0	string	>\0		Title: "%s"
47441080	string	FLT4		4-channel Startracker module sound data
4745!:mime	audio/x-mod
4746#audio/x-startracker-module
4747>0	string	>\0		Title: "%s"
47481080	string	FLT8		8-channel Startracker module sound data
4749!:mime	audio/x-mod
4750#audio/x-startracker-module
4751>0	string	>\0		Title: "%s"
47521080	string	4CHN		4-channel Fasttracker module sound data
4753!:mime	audio/x-mod
4754#audio/x-fasttracker-module
4755>0	string	>\0		Title: "%s"
47561080	string	6CHN		6-channel Fasttracker module sound data
4757!:mime	audio/x-mod
4758#audio/x-fasttracker-module
4759>0	string	>\0		Title: "%s"
47601080	string	8CHN		8-channel Fasttracker module sound data
4761!:mime	audio/x-mod
4762#audio/x-fasttracker-module
4763>0	string	>\0		Title: "%s"
47641080	string	CD81		8-channel Octalyser module sound data
4765!:mime	audio/x-mod
4766#audio/x-octalysertracker-module
4767>0	string	>\0		Title: "%s"
47681080	string	OKTA		8-channel Octalyzer module sound data
4769!:mime	audio/x-mod
4770#audio/x-octalysertracker-module
4771>0	string	>\0		Title: "%s"
4772# Not good enough.
4773#1082	string	CH
4774#>1080	string	>/0		%.2s-channel Fasttracker "oktalyzer" module sound data
47751080	string	16CN		16-channel Taketracker module sound data
4776!:mime	audio/x-mod
4777#audio/x-taketracker-module
4778>0	string	>\0		Title: "%s"
47791080	string	32CN		32-channel Taketracker module sound data
4780!:mime	audio/x-mod
4781#audio/x-taketracker-module
4782>0	string	>\0		Title: "%s"
4783
4784# TOC sound files -Trevor Johnson <trevor@jpj.net>
4785#
47860       string          TOC             TOC sound file
4787
4788# sidfiles <pooka@iki.fi>
4789# added name,author,(c) and new RSID type by <doj@cubic.org> 2003-06-24
47900	string		SIDPLAY\ INFOFILE	Sidplay info file
4791
47920	string		PSID			PlaySID v2.2+ (AMIGA) sidtune
4793>4	beshort		>0			w/ header v%d,
4794>14	beshort		=1			single song,
4795>14	beshort		>1			%d songs,
4796>16	beshort		>0			default song: %d
4797>0x16	string		>\0			name: "%s"
4798>0x36	string		>\0			author: "%s"
4799>0x56	string		>\0			copyright: "%s"
4800
48010	string		RSID			RSID sidtune PlaySID compatible
4802>4	beshort		>0			w/ header v%d,
4803>14	beshort		=1			single song,
4804>14	beshort		>1			%d songs,
4805>16	beshort		>0			default song: %d
4806>0x16	string		>\0			name: "%s"
4807>0x36	string		>\0			author: "%s"
4808>0x56	string		>\0			copyright: "%s"
4809
4810# IRCAM sound files - Michael Pruett <michael@68k.org>
4811# http://www-mmsp.ece.mcgill.ca/documents/AudioFormats/IRCAM/IRCAM.html
48120	belong		0x64a30100		IRCAM file (VAX little-endian)
48130	belong		0x0001a364		IRCAM file (VAX big-endian)
48140	belong		0x64a30200		IRCAM file (Sun big-endian)
48150	belong		0x0002a364		IRCAM file (Sun little-endian)
48160	belong		0x64a30300		IRCAM file (MIPS little-endian)
48170	belong		0x0003a364		IRCAM file (MIPS big-endian)
48180	belong		0x64a30400		IRCAM file (NeXT big-endian)
48190	belong		0x64a30400		IRCAM file (NeXT big-endian)
48200	belong		0x0004a364		IRCAM file (NeXT little-endian)
4821
4822# NIST SPHERE <mpruett@sgi.com>
48230	string		NIST_1A\n\ \ \ 1024\n	NIST SPHERE file
4824
4825# Sample Vision <mpruett@sgi.com>
48260	string		SOUND\ SAMPLE\ DATA\ 	Sample Vision file
4827
4828# Audio Visual Research <tonigonenstein@users.sourceforge.net>
48290	string		2BIT			Audio Visual Research file,
4830>12	beshort		=0			mono,
4831>12	beshort		=-1			stereo,
4832>14	beshort		x			%d bits
4833>16	beshort		=0			unsigned,
4834>16	beshort		=-1			signed,
4835>22	belong&0x00ffffff	x		%d Hz,
4836>18	beshort		=0			no loop,
4837>18	beshort		=-1			loop,
4838>21	ubyte		<128			note %d,
4839>22	byte		=0			replay 5.485 KHz
4840>22	byte		=1			replay 8.084 KHz
4841>22	byte		=2			replay 10.971 KHz
4842>22	byte		=3			replay 16.168 KHz
4843>22	byte		=4			replay 21.942 KHz
4844>22	byte		=5			replay 32.336 KHz
4845>22	byte		=6			replay 43.885 KHz
4846>22	byte		=7			replay 47.261 KHz
4847
4848# SGI SoundTrack <mpruett@sgi.com>
48490	string		_SGI_SoundTrack		SGI SoundTrack project file
4850# ID3 version 2 tags <waschk@informatik.uni-rostock.de>
48510	string		ID3	Audio file with ID3 version 2
4852>3	byte		x	\b.%d
4853>4	byte		x	\b.%d
4854>>5	byte		&0x80	\b, unsynchronized frames
4855>>5	byte		&0x40	\b, extended header
4856>>5	byte		&0x20	\b, experimental
4857>>5	byte		&0x10	\b, footer present
4858>(6.I+10)	indirect	x	\b, contains:
4859
4860# NSF (NES sound file) magic
48610	string		NESM\x1a	NES Sound File
4862>14	string		>\0		("%s" by
4863>46	string		>\0		%s, copyright
4864>78	string		>\0		%s),
4865>5	byte		x		version %d,
4866>6	byte		x		%d tracks,
4867>122	byte&0x2	=1		dual PAL/NTSC
4868>122	byte&0x1	=1		PAL
4869>122	byte&0x1	=0		NTSC
4870
4871# NSFE (Extended NES sound file) magic
4872# http://slickproductions.org/docs/NSF/nsfespec.txt
4873# From: David Pflug <david@pflug.email>
48740	string		NSFE		Extended NES Sound File
4875>48	search/0x1000	auth
4876>>&0	string		>\0		("%s"
4877>>>&1	string		>\0		by %s
4878>>>>&1	string		>\0		\b, copyright %s
4879>>>>>&1	string		>\0		\b, ripped by %s
4880>20	byte		x		\b), %d tracks,
4881>18	byte&0x2	=1		dual PAL/NTSC
4882>18     byte&0x2	=0
4883>>18	byte&0x1	=1		PAL
4884>>18	byte&0x1	=0		NTSC
4885
4886# Type: SNES SPC700 sound files
4887# From: Josh Triplett <josh@freedesktop.org>
48880	string	SNES-SPC700\ Sound\ File\ Data\ v	SNES SPC700 sound file
4889>&0	string	0.30					\b, version %s
4890>>0x23	byte	0x1B					\b, without ID666 tag
4891>>0x23	byte	0x1A					\b, with ID666 tag
4892>>>0x2E	string	>\0					\b, song "%.32s"
4893>>>0x4E	string	>\0					\b, game "%.32s"
4894
4895# Impulse tracker module (audio/x-it)
48960	string		IMPM		Impulse Tracker module sound data -
4897!:mime	audio/x-mod
4898>4	string		>\0		"%s"
4899>40	leshort		!0		compatible w/ITv%x
4900>42	leshort		!0		created w/ITv%x
4901
4902# Imago Orpheus module (audio/x-imf)
490360	string		IM10		Imago Orpheus module sound data -
4904>0	string		>\0		"%s"
4905
4906# From <collver1@attbi.com>
4907# These are the /etc/magic entries to decode modules, instruments, and
4908# samples in Impulse Tracker's native format.
4909
49100	string		IMPS		Impulse Tracker Sample
4911>18	byte		&2		16 bit
4912>18	byte		^2		8 bit
4913>18	byte		&4		stereo
4914>18	byte		^4		mono
49150	string		IMPI		Impulse Tracker Instrument
4916>28	leshort		!0		ITv%x
4917>30	byte		!0		%d samples
4918
4919# Yamaha TX Wave:  file(1) magic for Yamaha TX Wave audio files
4920# From <collver1@attbi.com>
49210	string		LM8953		Yamaha TX Wave
4922>22	byte		0x49		looped
4923>22	byte		0xC9		non-looped
4924>23	byte		1		33kHz
4925>23	byte		2		50kHz
4926>23	byte		3		16kHz
4927
4928# scream tracker:  file(1) magic for Scream Tracker sample files
4929#
4930# From <collver1@attbi.com>
493176	string		SCRS		Scream Tracker Sample
4932>0	byte		1		sample
4933>0	byte		2		adlib melody
4934>0	byte		>2		adlib drum
4935>31	byte		&2		stereo
4936>31	byte		^2		mono
4937>31	byte		&4		16bit little endian
4938>31	byte		^4		8bit
4939>30	byte		0		unpacked
4940>30	byte		1		packed
4941
4942# audio
4943# From: Cory Dikkers <cdikkers@swbell.net>
49440	string		MMD0		MED music file, version 0
49450	string		MMD1		OctaMED Pro music file, version 1
49460	string		MMD3		OctaMED Soundstudio music file, version 3
49470	string		OctaMEDCmpr	OctaMED Soundstudio compressed file
49480	string		MED		MED_Song
49490	string		SymM		Symphonie SymMOD music file
4950#
4951# Track Length (TRL), Tracks (TRK), Samples (SMP), Subsongs (SS)
4952# http://lclevy.free.fr/exotica/ahx/ahxformat.txt
49530	string		THX		AHX version
4954>3	byte		=0		1 module data
4955>3	byte		=1		2 module data
4956>10	byte		x		TRL: %u
4957>11	byte		x		TRK: %u
4958>12	byte		x		SMP: %u
4959>13	byte		x		SS: %u
4960#
49610	string		OKTASONG	Oktalyzer module data
4962#
49630	string		DIGI\ Booster\ module\0	%s
4964>20	byte		>0		%c
4965>>21	byte		>0		\b%c
4966>>>22	byte		>0		\b%c
4967>>>>23	byte		>0		\b%c
4968>610	string		>\0		\b, "%s"
4969#
49700	string		DBM0	   	DIGI Booster Pro Module
4971>4	byte		>0		V%X.
4972>>5	byte		x		\b%02X
4973>16	string		>\0		\b, "%s"
4974#
49750	string		FTMN		FaceTheMusic module
4976>16	string		>\0d		\b, "%s"
4977
4978# From: <doj@cubic.org> 2003-06-24
49790	string		AMShdr\32	Velvet Studio AMS Module v2.2
49800	string		Extreme		Extreme Tracker AMS Module v1.3
49810	string		DDMF		Xtracker DMF Module
4982>4	byte		x		v%i
4983>0xD	string		>\0		Title: "%s"
4984>0x2B	string		>\0		Composer: "%s"
49850	string		DSM\32		Dynamic Studio Module DSM
49860	string		SONG		DigiTrekker DTM Module
49870	string		DMDL		DigiTrakker MDL Module
49880	string		PSM\32		Protracker Studio PSM Module
498944	string		PTMF		Poly Tracker PTM Module
4990>0	string		>\32		Title: "%s"
49910	string		MT20		MadTracker 2.0 Module MT2
49920	string		RAD\40by\40REALiTY!! RAD Adlib Tracker Module RAD
49930	string		RTMM		RTM Module
49940x426	string		MaDoKaN96	XMS Adlib Module
4995>0	string		>\0		Composer: "%s"
49960	string		AMF		AMF Module
4997>4	string		>\0		Title: "%s"
49980	string		MODINFO1	Open Cubic Player Module Information MDZ
49990	string		Extended\40Instrument: Fast Tracker II Instrument
5000
5001# From: Takeshi Hamasaki <hma@syd.odn.ne.jp>
5002# NOA Nancy Codec file
50030	string		\210NOA\015\012\032	NOA Nancy Codec Movie file
5004# Yamaha SMAF format
50050	string		MMMD		Yamaha SMAF file
5006# Sharp Jisaku Melody format for PDC
50070	string		\001Sharp\040JisakuMelody	SHARP Cell-Phone ringing Melody
5008>20	string		Ver01.00	Ver. 1.00
5009>>32	byte		x		, %d tracks
5010
5011# Free lossless audio codec <http://flac.sourceforge.net>
5012# From: Przemyslaw Augustyniak <silvathraec@rpg.pl>
50130	string			fLaC		FLAC audio bitstream data
5014!:mime	audio/flac
5015>4	byte&0x7f		>0		\b, unknown version
5016>4	byte&0x7f		0		\b
5017# some common bits/sample values
5018>>20	beshort&0x1f0		0x030		\b, 4 bit
5019>>20	beshort&0x1f0		0x050		\b, 6 bit
5020>>20	beshort&0x1f0		0x070		\b, 8 bit
5021>>20	beshort&0x1f0		0x0b0		\b, 12 bit
5022>>20	beshort&0x1f0		0x0f0		\b, 16 bit
5023>>20	beshort&0x1f0		0x170		\b, 24 bit
5024>>20	byte&0xe		0x0		\b, mono
5025>>20	byte&0xe		0x2		\b, stereo
5026>>20	byte&0xe		0x4		\b, 3 channels
5027>>20	byte&0xe		0x6		\b, 4 channels
5028>>20	byte&0xe		0x8		\b, 5 channels
5029>>20	byte&0xe		0xa		\b, 6 channels
5030>>20	byte&0xe		0xc		\b, 7 channels
5031>>20	byte&0xe		0xe		\b, 8 channels
5032# sample rates derived from known oscillator frequencies;
5033# 24.576 MHz (video/fs=48kHz), 22.5792 (audio/fs=44.1kHz) and
5034# 16.384 (other/fs=32kHz).
5035>>17	belong&0xfffff0       	0x02b110	\b, 11.025 kHz
5036>>17	belong&0xfffff0       	0x03e800	\b, 16 kHz
5037>>17	belong&0xfffff0       	0x056220	\b, 22.05 kHz
5038>>17	belong&0xfffff0       	0x05dc00	\b, 24 kHz
5039>>17	belong&0xfffff0       	0x07d000	\b, 32 kHz
5040>>17	belong&0xfffff0       	0x0ac440	\b, 44.1 kHz
5041>>17	belong&0xfffff0       	0x0bb800	\b, 48 kHz
5042>>17	belong&0xfffff0       	0x0fa000	\b, 64 kHz
5043>>17	belong&0xfffff0       	0x158880	\b, 88.2 kHz
5044>>17	belong&0xfffff0       	0x177000	\b, 96 kHz
5045>>17	belong&0xfffff0       	0x1f4000	\b, 128 kHz
5046>>17	belong&0xfffff0       	0x2b1100	\b, 176.4 kHz
5047>>17	belong&0xfffff0       	0x2ee000	\b, 192 kHz
5048>>17	belong&0xfffff0       	0x3e8000	\b, 256 kHz
5049>>17	belong&0xfffff0       	0x562200	\b, 352.8 kHz
5050>>17	belong&0xfffff0       	0x5dc000	\b, 384 kHz
5051>>21	byte&0xf		>0		\b, >4G samples
5052>>21	byte&0xf		0		\b
5053>>>22	belong			>0		\b, %u samples
5054>>>22	belong			0		\b, length unknown
5055
5056# (ISDN) VBOX voice message file (Wolfram Kleff)
50570       string          VBOX            VBOX voice message data
5058
5059# ReBorn Song Files (.rbs)
5060# David J. Singer <doc@deadvirgins.org.uk>
50618       string          RB40             RBS Song file
5062>29     string          ReBorn           created by ReBorn
5063>37     string          Propellerhead    created by ReBirth
5064
5065# Synthesizer Generator and Kimwitu share their file format
50660	string		A#S#C#S#S#L#V#3	    Synthesizer Generator or Kimwitu data
5067# Kimwitu++ uses a slightly different magic
50680	string		A#S#C#S#S#L#HUB	    Kimwitu++ data
5069
5070# From "Simon Hosie
50710       string  TFMX-SONG       TFMX module sound data
5072
5073# Monkey's Audio compressed audio format (.ape)
5074# From danny.milo@gmx.net (Danny Milosavljevic)
5075# New version from Abel Cheung <abel (@) oaka.org>
50760		string		MAC\040		Monkey's Audio compressed format
5077!:mime audio/x-ape
5078>4		uleshort	>0x0F8B		version %d
5079>>(0x08.l)	uleshort	=1000		with fast compression
5080>>(0x08.l)	uleshort	=2000		with normal compression
5081>>(0x08.l)	uleshort	=3000		with high compression
5082>>(0x08.l)	uleshort	=4000		with extra high compression
5083>>(0x08.l)	uleshort	=5000		with insane compression
5084>>(0x08.l+18)	uleshort	=1		\b, mono
5085>>(0x08.l+18)	uleshort	=2		\b, stereo
5086>>(0x08.l+20)	ulelong		x		\b, sample rate %d
5087>4		uleshort	<0x0F8C		version %d
5088>>6		uleshort	=1000		with fast compression
5089>>6		uleshort	=2000		with normal compression
5090>>6		uleshort	=3000		with high compression
5091>>6		uleshort	=4000		with extra high compression
5092>>6		uleshort	=5000		with insane compression
5093>>10		uleshort	=1		\b, mono
5094>>10		uleshort	=2		\b, stereo
5095>>12		ulelong		x		\b, sample rate %d
5096
5097# adlib sound files
5098# From: Alex Myczko <alex@aiei.ch>
5099
5100# https://github.com/rerrahkr/BambooTracker
51010	string		BambooTrackerMod	BambooTracker module
5102>22	byte	x	\b, version %u
5103>21	byte	x	\b.%u
5104>20	byte	x	\b.%u
5105
51060	string		BambooTrackerIst	BambooTracker instrument
5107>22	byte	x	\b, version %u
5108>21	byte	x	\b.%u
5109>20	byte	x	\b.%u
5110
51110	string		CC2x		CheeseCutter 2 song
5112
51130    	string		RAWADATA	RdosPlay RAW
5114
51151068	string		RoR		AMUSIC Adlib Tracker
5116
51170	string		JCH		EdLib
5118
51190	string		mpu401tr	MPU-401 Trakker
5120
51210	string		SAdT		Surprise! Adlib Tracker
5122>4	byte		x		Version %d
5123
51240	string		XAD!		eXotic ADlib
5125
51260	string		ofTAZ!		eXtra Simple Music
5127
51280	string		FMK!		FM Kingtracker Song
5129
51300	string		DFM		DFM Song
5131
51320	string		\<CUD-FM-File\>	CFF Song
5133
51340	string		_A2module	A2M Song
5135
5136# Spectrum 128 tunes (.ay files).
5137# From: Emanuel Haupt <ehaupt@critical.ch>
51380	string		ZXAYEMUL	Spectrum 128 tune
5139
51400	string		\0BONK		BONK,
5141#>5	byte		x		version %d
5142>14	byte		x		%d channel(s),
5143>15	byte		=1		lossless,
5144>15	byte		=0		lossy,
5145>16	byte		x		mid-side
5146
5147384	string		LockStream	LockStream Embedded file (mostly MP3 on old Nokia phones)
5148
5149# format VQF (proprietary codec for sound)
5150# some infos on the header file available at :
5151# http://www.twinvq.org/english/technology_format.html
51520	string		TWIN97012000	VQF data
5153>27	short		0		\b, Mono
5154>27	short		1		\b, Stereo
5155>31	short 		>0		\b, %d kbit/s
5156>35	short 		>0		\b, %d kHz
5157
5158# Nelson A. de Oliveira (naoliv@gmail.com)
5159# .eqf
51600	string	Winamp\ EQ\ library\ file	%s
5161# it will match only versions like v<digit>.<digit>
5162# Since I saw only eqf files with version v1.1 I think that it's OK
5163>23	string	x	\b%.4s
5164# .preset
51650	string	[Equalizer\ preset]	XMMS equalizer preset
5166# .m3u
51670	search/1	#EXTM3U 	M3U playlist text
5168# .pls
51690	search/1	[playlist]	PLS playlist text
5170# licq.conf
51711	string	[licq]			LICQ configuration file
5172
5173# Atari ST audio files by Dirk Jagdmann <doj@cubic.org>
5174# NOTE: Most SNDH music is packed using ICE, which has
5175# magic numbers "ICE!" and "Ice!". Some SNDH music is
5176# not packed, so we check for both packed and unpacked.
517712	string			SNDH	SNDH Atari ST music
51780	belong&0xFFDFDFFF	0x49434521
5179>14	search/40		NDH	SNDH Atari ST music
5180>14	search/40		TITL	SNDH Atari ST music
51810	string		SC68\ Music-file\ /\ (c)\ (BeN)jami	sc68 Atari ST music
5182
5183# musepak support From: "Jiri Pejchal" <jiri.pejchal@gmail.com>
51840       string          MP+     Musepack audio (MP+)
5185!:mime	audio/x-musepack
5186>3      byte            255     \b, SV pre8
5187>3      byte&0xF        0x6     \b, SV 6
5188>3      byte&0xF        0x8     \b, SV 8
5189>3      byte&0xF        0x7     \b, SV 7
5190>>3     byte&0xF0       0x0     \b.0
5191>>3     byte&0xF0       0x10    \b.1
5192>>3     byte&0xF0       240     \b.15
5193>>10    byte&0xF0       0x0     \b, no profile
5194>>10    byte&0xF0       0x10    \b, profile 'Unstable/Experimental'
5195>>10    byte&0xF0       0x50    \b, quality 0
5196>>10    byte&0xF0       0x60    \b, quality 1
5197>>10    byte&0xF0       0x70    \b, quality 2 (Telephone)
5198>>10    byte&0xF0       0x80    \b, quality 3 (Thumb)
5199>>10    byte&0xF0       0x90    \b, quality 4 (Radio)
5200>>10    byte&0xF0       0xA0    \b, quality 5 (Standard)
5201>>10    byte&0xF0       0xB0    \b, quality 6 (Xtreme)
5202>>10    byte&0xF0       0xC0    \b, quality 7 (Insane)
5203>>10    byte&0xF0       0xD0    \b, quality 8 (BrainDead)
5204>>10    byte&0xF0       0xE0    \b, quality 9
5205>>10    byte&0xF0       0xF0    \b, quality 10
5206>>27    byte            0x0     \b, Buschmann 1.7.0-9, Klemm 0.90-1.05
5207>>27    byte            102     \b, Beta 1.02
5208>>27    byte            104     \b, Beta 1.04
5209>>27    byte            105     \b, Alpha 1.05
5210>>27    byte            106     \b, Beta 1.06
5211>>27    byte            110     \b, Release 1.1
5212>>27    byte            111     \b, Alpha 1.11
5213>>27    byte            112     \b, Beta 1.12
5214>>27    byte            113     \b, Alpha 1.13
5215>>27    byte            114     \b, Beta 1.14
5216>>27    byte            115     \b, Alpha 1.15
5217
52180       string          MPCK    Musepack audio (MPCK)
5219!:mime	audio/x-musepack
5220
5221# IMY
5222# from http://filext.com/detaillist.php?extdetail=IMY
5223# https://cellphones.about.com/od/cellularfaqs/f/rf_imelody.htm
5224# http://download.ncl.ie/doc/api/ie/ncl/media/music/IMelody.html
5225# http://www.wx800.com/msg/download/irda/iMelody.pdf
52260	string	BEGIN:IMELODY	iMelody Ringtone Format
5227
5228# From: "Mateus Caruccio" <mateus@caruccio.com>
5229# guitar pro v3,4,5 from http://filext.com/file-extension/gp3
52300	string	\030FICHIER\ GUITAR\ PRO\ v3.	Guitar Pro Ver. 3 Tablature
5231
5232# From: "Leslie P. Polzer" <leslie.polzer@gmx.net>
523360	string	SONG		SoundFX Module sound file
5234
5235# Type: Adaptive Multi-Rate Codec
5236# URL:  http://filext.com/detaillist.php?extdetail=AMR
5237# From: Russell Coker <russell@coker.com.au>
52380	string	#!AMR		Adaptive Multi-Rate Codec (GSM telephony)
5239!:mime	audio/amr
5240!:ext  amr
5241
5242# Type: SuperCollider 3 Synth Definition File Format
5243# From: Mario Lang <mlang@debian.org>
52440	string	SCgf	SuperCollider3 Synth Definition file,
5245>4	belong	x	version %d
5246
5247# Type: True Audio Lossless Audio
5248# URL:  https://wiki.multimedia.cx/index.php?title=True_Audio
5249# From: Mike Melanson <mike@multimedia.cx>
52500	string	TTA1	True Audio Lossless Audio
5251
5252# Type: WavPack Lossless Audio
5253# URL:  https://wiki.multimedia.cx/index.php?title=WavPack
5254# From: Mike Melanson <mike@multimedia.cx>
52550	string	wvpk	WavPack Lossless Audio
5256
5257# From Fabio R. Schmidlin <frs@pop.com.br>
5258# VGM music file
52590	string		Vgm\040
5260>9	ubyte		>0	VGM Video Game Music dump v
5261!:mime	audio/x-vgm
5262!:ext	vgm
5263>>9	ubyte/16	>0	\b%d
5264>>9	ubyte&0x0F	x	\b%d
5265>>8	ubyte/16	x	\b.%d
5266>>8	ubyte&0x0F	>0	\b%d
5267#Get soundchips
5268>>8	ubyte		x	\b, soundchip(s)=
5269>>0x0C	ulelong		>0	SN76489 (PSG),
5270>>0x10	ulelong		>0	YM2413 (OPLL),
5271>>0x2C	ulelong		>0	YM2612 (OPN2),
5272>>0x30	ulelong		>0	YM2151 (OPM),
5273>>0x38	ulelong		>0	Sega PCM,
5274>>0x34	ulelong		>0xC
5275>>>0x40	ulelong		>0	RF5C68 (PCM),
5276>>0x34	ulelong		>0x10
5277>>>0x44	ulelong		>0	YM2203 (OPN),
5278>>0x34	ulelong		>0x14
5279>>>0x48	ulelong		>0	YM2608 (OPNA),
5280>>0x34	ulelong		>0x18
5281>>>0x4C	lelong		>0	YM2610 (OPNB),
5282>>>0x4C	lelong		<0	YM2610B (OPNB+2FM),
5283>>0x34	ulelong		>0x1C
5284>>>0x50	ulelong		>0	YM3812 (OPL2),
5285>>0x34	ulelong		>0x20
5286>>>0x54	ulelong		>0	YM3526 (OPL),
5287>>0x34	ulelong		>0x24
5288>>>0x58	ulelong		>0	Y8950 (MSX-Audio),
5289>>0x34	ulelong		>0x28
5290>>>0x5C	ulelong		>0	YMF262 (OPL3),
5291>>0x34	ulelong		>0x2C
5292>>>0x60	ulelong		>0	YMF278B (OPL4),
5293>>0x34	ulelong		>0x30
5294>>>0x64	ulelong		>0	YMF271 (OPX),
5295>>0x34	ulelong		>0x34
5296>>>0x68	ulelong		>0	YMZ280B (PCMD8),
5297>>0x34	ulelong		>0x38
5298>>>0x6C	ulelong		>0	RF5C164 (PCM),
5299>>0x34	ulelong		>0x3C
5300>>>0x70	ulelong		>0	PWM,
5301>>0x34	ulelong		>0x40
5302>>>0x74	ulelong		>0
5303>>>>0x78 ubyte		0x00	AY-3-8910,
5304>>>>0x78 ubyte		0x01	AY-3-8912,
5305>>>>0x78 ubyte		0x02	AY-3-8913,
5306>>>>0x78 ubyte		0x03	AY-3-8930,
5307>>>>0x78 ubyte		0x10	YM2149,
5308>>>>0x78 ubyte		0x11	YM3439,
5309>>>>0x78 ubyte		0x12	YMZ284,
5310>>>>0x78 ubyte		0x13	YMZ294,
5311# VGM 1.61
5312>>0x34	ulelong		>0x4C
5313>>>0x80	ulelong		>0	DMG,
5314>>0x34	ulelong		>0x50
5315>>>0x84	lelong		>0	NES APU,
5316>>>0x84	lelong		<0	NES APU with FDS,
5317>>0x34	ulelong		>0x54
5318>>>0x88	ulelong		>0	MultiPCM,
5319>>0x34	ulelong		>0x58
5320>>>0x8C	ulelong		>0	uPD7759 (ADPCM Speech),
5321>>0x34	ulelong		>0x5C
5322>>>0x90	ulelong		>0	OKIM6258 (ADPCM Speech),
5323>>0x34	ulelong		>0x64
5324>>>0x98	ulelong		>0	OKIM6295 (ADPCM),
5325>>0x34	ulelong		>0x68
5326>>>0x9C	ulelong		>0	K051649,
5327>>0x34	ulelong		>0x6C
5328>>>0xA0	ulelong		>0	K054539,
5329>>0x34	ulelong		>0x70
5330>>>0xA4	ulelong		>0	HuC6280,
5331>>0x34	ulelong		>0x74
5332>>>0xA8	ulelong		>0	C140,
5333>>0x34	ulelong		>0x78
5334>>>0xAC	ulelong		>0	K053260,
5335>>0x34	ulelong		>0x7C
5336>>>0xB0	ulelong		>0	Pokey,
5337>>0x34	ulelong		>0x80
5338>>>0xB4	ulelong		>0	QSound,
5339# VGM 1.71
5340>>0x34	ulelong		>0x84
5341>>>0xB8	ulelong		>0	SCSP,
5342>>0x34	ulelong		>0x8C
5343>>>0xC0	ulelong		>0	WonderSwan,
5344>>0x34	ulelong		>0x90
5345>>>0xC4	ulelong		>0	VSU,
5346>>0x34	ulelong		>0x94
5347>>>0xC8	ulelong		>0	SAA1099,
5348>>0x34	ulelong		>0x98
5349>>>0xCC	ulelong		>0	ES5503 (DOC),
5350>>0x34	ulelong		>0x9C
5351>>>0xD0	lelong		>0	ES5505 (OTIS),
5352>>>0xD0	lelong		<0	ES5506 (OTTO),
5353>>0x34	ulelong		>0xA4
5354>>>0xD8	ulelong		>0	X1-010,
5355>>0x34	ulelong		>0xA8
5356>>>0xDC	ulelong		>0	C352,
5357>>0x34	ulelong		>0xAC
5358>>>0xE0	ulelong		>0	GA20,
5359
5360# GVOX Encore file format
5361# Since this is a proprietary file format and there is no publicly available
5362# format specification, this is just based on induction
5363#
53640	string	SCOW
5365>4	byte	0xc4	GVOX Encore music, version 5.0 or above
5366>4	byte	0xc2	GVOX Encore music, version < 5.0
5367
53680	string	ZBOT
5369>4	byte	0xc5	GVOX Encore music, version < 5.0
5370
5371# Summary:	Garmin Voice Processing Module (WAVE audios)
5372# From:		Joerg Jenderek
5373# URL:		https://www.garmin.com/
5374# Reference:	http://www.poi-factory.com/node/19580
5375# NOTE:		there exist 2 other Garmin VPM formats
53760		string	AUDIMG
5377# skip text files starting with string "AUDIMG"
5378>13		ubyte		<13	Garmin Voice Processing Module
5379!:mime	audio/x-vpm-wav-garmin
5380!:ext	vpm
5381# 3 bytes indicating the voice version (200,220)
5382>>6		string		x	\b, version %3.3s
5383# day of release (01-31)
5384>>12		ubyte		x	\b, %.2d
5385# month of release (01-12)
5386>>13		ubyte		x	\b.%.2d
5387# year of release (like 2006, 2007, 2008)
5388>>14		uleshort	x	\b.%.4d
5389# hour of release (0-23)
5390>>11		ubyte		x	%.2d
5391# minute of release (0-59)
5392>>10		ubyte		x	\b:%.2d
5393# second of release (0-59)
5394>>9		ubyte		x	\b:%.2d
5395# if you select a language like german on your garmin device
5396# you can only select voice modules with corresponding language byte ID like 1
5397>>18		ubyte		x	\b, language ID %d
5398# structure for phrases/sentences?
5399# number of voice sample in the 1st phrase?
5400#>>19		uleshort		x	\b, 0x%x samples
5401#>>>21		uleshort		>0	\b, at 0x%4.4x
5402#>>>(21.s)	ubequad			x	0x%llx
5403# 2nd phrase?
5404#>>23		uleshort		x	\b, 0x%x samples
5405#>>>25		uleshort		>0	\b, at 0x%4.4x
5406#>>>(25.s)	ubequad			x	0x%llx
5407# pointer to 1st audio WAV sample
5408>>16		uleshort	>0
5409>>>(16.s)	ulelong		>0	\b, at 0x%x
5410# WAV length
5411# 1 space char after "bytes" to get phrase "bytes RIFF"
5412>>>>(16.s+4)	ulelong		>0	%u bytes
5413# look for magic
5414>>>>>(&-8.l)	string		RIFF
5415# determine type by ./riff
5416>>>>>>&-4	indirect	x
5417# 2 - ~ 131 WAV samples following same way
5418#
5419# Summary:	encrypted Garmin Voice Processing Module
5420# From:		Joerg Jenderek
5421# URL:		https://www.garmin.com/us/products/ontheroad/voicestudio
5422# NOTE:		Encrypted variant used in voices like DrNightmare, Elfred, Yeti.
5423#		There exist 2 other Garmin VPM formats
54240	ubequad		0xa141190fecc8ced6	Garmin Voice Processing Module (encrypted)
5425!:mime	audio/x-vpm-garmin
5426!:ext	vpm
5427
5428# From Martin Mueller Skarbiniks Pedersen
54290		string		GDM
5430>0x3		byte		0xFE	General Digital Music.
5431>0x4		string		>\0	title: "%s"
5432>0x24		string		>\0	musician: "%s"
5433>>0x44		beshort		0x0D0A
5434>>>0x46		byte		0x1A
5435>>>>0x47	string		GMFS	Version
5436>>>>0x4B	byte		x	%d.
5437>>>>0x4C	byte		x	\b%02d
5438>>>>0x4D	beshort		0x000	(2GDM v
5439>>>>0x4F	byte		x	\b%d.
5440>>>>>0x50	byte		x	\b%d)
5441
54420		string		MTM	Multitracker
5443>0x3		byte/16		x	Version %d.
5444>0x3		byte&0x0F	x	\b%02d
5445>>0x4		string		>\0	title: "%s"
5446
54470		string		HVL
5448>3		byte		<2	Hively Tracker Song
5449>3		byte		0	1 module data
5450>3		byte		1	2 module data
5451
54520		string		MO3
5453>3		ubyte		<6	MOdule with MP3
5454>>3		byte		0	Version	0	(With MP3 and lossless)
5455>>3		byte		1	Version	1	(With ogg and lossless)
5456>>3		byte		3	Version 2.2
5457>>3		byte		4	(With no LAME header)
5458>>3		byte		5	Version 2.4
5459
54600		string		ADRVPACK	AProSys	module
5461
5462# ftp://ftp.modland.com/pub/documents/format_documentation/\
5463# Art%20Of%20Noise%20(.aon).txt
54640		string		AON
5465>4		string		"ArtOfNoise by Bastian Spiegel(twice/lego)"
5466>0x2e		string		NAME	Art of Noise Tracker Song
5467>3		string		<9
5468>3		string		4	(4 voices)
5469>3		string		8	(8 voices)
5470>>0x36		string		>\0	Title: "%s"
5471
54720		string		FAR
5473>0x2c		byte		0x0d
5474>0x2d		byte		0x0a
5475>0x2e		byte		0x1a
5476>>0x3		byte		0xFE	Farandole Tracker Song
5477>>>0x31		byte/16		x	Version %d.
5478>>>0x31		byte&0x0F	x	\b%02d
5479>>>>0x4		string		>\0	\b, title: "%s"
5480
5481# magic for Klystrack, https://kometbomb.github.io/klystrack/
5482# from Alex Myczko <alex@aiei.ch>
54830	string	cyd!song	Klystrack song
5484>8	byte	>0		\b, version %u
5485>8	byte	>26
5486#>>9	byte	x		\b, channels %u
5487#>>10	leshort	x		\b, time signature %u
5488#>>12	leshort	x		\b, sequence step %u
5489#>>14	byte	x		\b, instruments %u
5490#>>15	leshort	x		\b, patterns %u
5491#>>17	leshort	x		\b, sequences %u
5492#>>19	leshort	x		\b, length %u
5493#>>21	leshort	x		\b, loop point %u
5494#>>23	byte	x		\b, master volume %u
5495#>>24	byte	x		\b, song speed %u
5496#>>25	byte	x		\b, song speed2 %u
5497#>>26	byte	x		\b, song rate %u
5498#>>27	belong	x		\b, flags %#x
5499#>>31	byte	x		\b, multiplex period %u
5500#>>32	byte	x		\b, pitch inaccuracy %u
5501>>149	pstring	x		\b, title %s
5502
55030	string	cyd!inst	Klystrack instrument
5504
5505# magic for WOPL instrument files, https://github.com/Wohlstand/OPL3BankEditor
5506# see Specifications/WOPL-and-OPLI-Specification.txt
5507
55080	string	WOPL3-INST\0	WOPL instrument
5509>11	leshort	x	\b, version %u
55100	string	WOPL3-BANK\0	WOPL instrument bank
5511>11	leshort	x	\b, version %u
5512
5513# AdLib/OPL instrument files. Format specifications on
5514#  http://www.shikadi.net/moddingwiki
55150	string	Junglevision\ Patch\ File	Junglevision instrument data
55160	string	#OPL_II#	DMX OP2 instrument data
55170	string	IBK\x1a		IBK instrument data
55180	string	2OP\x1a		IBK instrument data, 2 operators
55190	string	4OP\x1a		IBK instrument data, 4 operators
55202	string	ADLIB-		AdLib instrument data
5521>0	byte	x		\b, version %u
5522>1	byte	x		\b.%u
5523
5524# CRI ADX ADPCM audio
5525# Used by various Sega games.
5526# https://en.wikipedia.org/wiki/ADX_(file_format)
5527# https://wiki.multimedia.cx/index.php/CRI_ADX_file
5528# Added by David Korth <gerbilsoft@gerbilsoft.com>
55290x00		beshort		0x8000
5530>(2.S-2)	string		(c)CRI		CRI ADX ADPCM audio
5531!:ext adx
5532!:mime audio/x-adx
5533!:strength +50
5534>>0x12		byte		x		v%u
5535>>0x04		byte		0x02		\b, pre-set prediction coefficients
5536>>0x04		byte		0x03		\b, standard ADX
5537>>0x04		byte		0x04		\b, exponential scale
5538>>0x04		byte		0x10		\b, AHX (Dreamcast)
5539>>0x04		byte		0x11		\b, AHX
5540>>0x08		belong		x		\b, %u Hz
5541>>0x12		byte		0x03
5542>>>0x02		beshort		>0x2B
5543>>>>0x18	belong		!0		\b, looping
5544>>0x12		byte		0x04
5545>>>0x02		beshort		>0x37
5546>>>>0x24	belong		!0		\b, looping
5547>>0x13		byte&0x08	0x08		\b, encrypted
5548
5549# Lossless audio (.la) (http://www.lossless-audio.com/)
55500	string	LA
5551>2	string	03	Lossless audio version 0.3
5552>2	string	04	Lossless audio version 0.4
5553
5554# Sony PlayStation Audio (.xa)
55550	leshort 0x4158	Sony PlayStation Audio
5556
5557# Portable Sound Format
5558# Used for audio rips for various consoles.
5559# http://fileformats.archiveteam.org/wiki/Portable_Sound_Format
5560# Added by David Korth <gerbilsoft@gerbilsoft.com>
55610	string	PSF
5562>3	byte	0x01
5563>3	byte	0x02
5564>3	byte	0x11
5565>3	byte	0x12
5566>3	byte	0x13
5567>3	byte	0x21
5568>3	byte	0x22
5569>3	byte	0x23
5570>3	byte	0x41
5571>>0	string	PSF	Portable Sound Format
5572!:mime	audio/x-psf
5573>>>3	byte	0x01	(Sony PlayStation)
5574>>>3	byte	0x02	(Sony PlayStation 2)
5575>>>3	byte	0x11	(Sega Saturn)
5576>>>3	byte	0x12	(Sega Dreamcast)
5577>>>3	byte	0x13	(Sega Mega Drive)
5578>>>3	byte	0x21	(Nintendo 64)
5579>>>3	byte	0x22	(Game Boy Advance)
5580>>>3	byte	0x23	(Super NES)
5581>>>3	byte	0x41	(Capcom QSound)
5582
5583# Atari 8-bit SAP audio format
5584# http://asap.sourceforge.net/sap-format.html
5585# Added by David Korth <gerbilsoft@gerbilsoft.com>
55860	string		SAP\r\n	Atari 8-bit SAP audio file
5587!:mime	audio/x-sap
5588!:ext	sap
5589>5	search/1024	NAME
5590>>&1	string		x	\b: %s
5591>>5	search/1024	AUTHOR
5592>>>&1	string		x	by %s
5593
5594# Nintendo Wii BRSTM audio format (fields)
5595# NOTE: Assuming HEAD starts at 0x40.
5596# FIXME: Replace 0x48 with HEAD offset plus 8.
55970	name	nintendo-wii-brstm-fields
5598>(0x10.L)	string	HEAD	\b:
5599>>(0x10.L+0x0C)	belong	x
5600>>>(&-4.L+0x48)	belong	x
5601>>>>&-4		byte	0	PCM, signed 8-bit,
5602>>>>&-4		byte	1	PCM, signed 16-bit,
5603>>>>&-4		byte	2	THP ADPCM,
5604>>>>&-3		byte	!0	looping,
5605>>>>&-2		byte	1	mono
5606>>>>&-2		byte	2	stereo
5607>>>>&-2		byte	3	3 channels
5608>>>>&-2		byte	4	quad
5609>>>>&-2		byte	>4	%u channels
5610>>>>&0		beshort	!0	%u Hz
5611
5612# Nintendo Wii BRSTM audio format
5613# https://wiibrew.org/wiki/BRSTM_file
5614# Added by David Korth <gerbilsoft@gerbilsoft.com>
56150	string		RSTM	Nintendo Wii BRSTM audio file
5616!:mime	audio/x-brstm
5617!:ext	brstm
5618# Wii is big-endian, so default to BE.
5619>4	beshort		0xFEFF
5620>>0	use		nintendo-wii-brstm-fields
5621>4	leshort		0xFEFF
5622>>0	use		\^nintendo-wii-brstm-fields
5623
5624# Nintendo 3DS BCSTM audio format (fields)
56250	name	nintendo-3ds-bcstm-fields
5626>(0x18.l)	string	INFO	\b:
5627# INFO block: Stream information starts at 0x20 (minus 4 for the 'INFO' magic)
5628>>&0x1C		byte	0	PCM, signed 8-bit,
5629>>&0x1C		byte	1	PCM, signed 16-bit,
5630>>&0x1C		byte	2	DSP ADPCM,
5631>>&0x1C		byte	3	IMA ADPCM,
5632>>&0x1D		byte	!0	looping,
5633>>&0x1E		byte	1	mono
5634>>&0x1E		byte	2	stereo
5635>>&0x1E		byte	3	3 channels
5636>>&0x1E		byte	4	quad
5637>>&0x1E		byte	>4	%u channels
5638>>&0x20		lelong	!0	%u Hz
5639
5640# Nintendo 3DS BCSTM audio format
5641# https://www.3dbrew.org/wiki/BCSTM
5642# Added by David Korth <gerbilsoft@gerbilsoft.com>
56430	string		CSTM	Nintendo 3DS BCSTM audio file
5644!:mime	audio/x-bcstm
5645!:ext	bcstm
5646# 3DS is little-endian, so default to LE.
5647>4	leshort		0xFEFF
5648>>0	use		nintendo-3ds-bcstm-fields
5649>4	beshort		0xFEFF
5650>>0	use		\^nintendo-3ds-bcstm-fields
5651
5652# Nintendo Wii U BFSTM audio format
5653# http://mk8.tockdom.com/wiki/BFSTM_(File_Format)
5654# NOTE: This format is very similar to BCSTM.
5655# Added by David Korth <gerbilsoft@gerbilsoft.com>
56560	string		FSTM	Nintendo Wii U BFSTM audio file
5657!:mime	audio/x-bfstm
5658!:ext	bfstm
5659# BFSTM is used on both Wii U (BE) and Switch (LE),
5660# so default to LE.
5661>4	leshort		0xFEFF
5662>>0	use		nintendo-3ds-bcstm-fields
5663>4	beshort		0xFEFF
5664>>0	use		\^nintendo-3ds-bcstm-fields
5665
5666# Nintendo 3DS BCSTM audio format (fields)
56670	name	nintendo-3ds-bcwav-fields
5668>(0x18.l)	string	INFO	\b:
5669# INFO block (minus 4 for INFO magic)
5670>>&0x4		byte	0	PCM, signed 8-bit,
5671>>&0x4		byte	1	PCM, signed 16-bit,
5672>>&0x4		byte	2	DSP ADPCM,
5673>>&0x4		byte	3	IMA ADPCM,
5674>>&0x5		byte	!0	looping,
5675>>&0x8		lelong	x	stereo
5676>>&0x8		lelong	!0	%u Hz
5677
5678# Nintendo 3DS BCWAV audio format
5679# https://www.3dbrew.org/wiki/BCWAV
5680# Added by David Korth <gerbilsoft@gerbilsoft.com>
56810	string		CWAV	Nintendo 3DS BCWAV audio file
5682!:mime	audio/x-bcwav
5683!:ext	bcwav
5684# 3DS is little-endian, so default to LE.
5685>4	leshort		0xFEFF
5686>>0	use		nintendo-3ds-bcwav-fields
5687>4	beshort		0xFEFF
5688>>0	use		\^nintendo-3ds-bcwav-fields
5689
5690#------------------------------------------------------------------------------
5691# $File: avm,v 1.1 2020/08/28 20:37:58 christos Exp $
5692# avm:  file(1) magic for avm files; this is not use
5693
5694# Summary:	FRITZ!Box router configuration backup
5695# From:		Joerg Jenderek
5696# URL:		https://en.wikipedia.org/wiki/Fritz!Box
5697# Reference:	http://www.mengelke.de/Projekte/FritzBoxTools2
5698# Note:		only tested with models 4040 and 6490 Cable (lgi)
56990	string		****\ FRITZ!Box\ 	FRITZ!Box configuration backup
5700#!:mime	text/plain
5701!:mime	application/x-avm-export
5702!:ext	export
5703# router model name like "4040" , "6490 Cable (lgi)" followed by " CONFIGURATION EXPORT"
5704>15	string		x			of %-.4s
5705# on 2nd line hashed password
5706#>41	search/54	Password=		\b, password
5707# on 3rd line firmware version like: 141.06.24 141.06.50 141.07.10 ... 155.06.83
5708>41	search/172	FirmwareVersion=	\b, firmware version
5709>>&0	string		x			%s
5710# on 5th line oem like: avme lgi
5711>41	search/285	OEM=			\b, oem
5712>>&0	string		x			%s
5713# on 7th line language like: de en
5714>41	search/305	Language=		\b, language
5715>>&0	string		x			%s
5716# on 10th line cfg file name like: /var/tmp.cfg
5717>41	search/349	tmp.cfg
5718# on 11th line date inside c-comment like: Thu Jun  4 22:25:19 2015
5719>>&4	string		x			\b, %s
5720#
5721
5722
5723#----------------------------------------------------------------
5724# $File: basis,v 1.5 2019/04/19 00:42:27 christos Exp $
5725# basis: file(1) magic for BBx/Pro5-files
5726#      Oliver Dammer <dammer@olida.de>	 2005/11/07
5727# https://www.basis.com business-basic-files.
5728#
57290	string		\074\074bbx\076\076	BBx
5730>7	string		\000			indexed file
5731>7	string		\001			serial file
5732>7	string		\002			keyed file
5733>>13	short		0			(sort)
5734>7	string		\004			program
5735>>18	byte		x			(LEVEL %d)
5736>>>23	string		>\000			psaved
5737>7	string		\006			mkeyed file
5738>>13	short		0			(sort)
5739>>8	string		\000			(mkey)
5740#------------------------------------------------------------------------------
5741# $File: beetle,v 1.2 2018/02/05 23:42:17 rrt Exp $
5742# beetle:  file(1) magic for Beetle VM object files
5743# https://github.com/rrthomas/beetle/
5744
5745# Beetle object module
57460	string		BEETLE\000	Beetle VM object file
5747
5748#------------------------------------------------------------------------------
5749# $File: ber,v 1.2 2019/04/19 00:42:27 christos Exp $
5750# ber:  file(1) magic for several BER formats used in the mobile
5751# telecommunications industry (Georg Sauthoff)
5752
5753# The file formats are standardized by the GSMA (GSM association).
5754# They are specified via ASN.1 schemas and some prose. Basic encoding
5755# rules (BER) is the used encoding. The formats are used for exchanging
5756# call data records (CDRs) between mobile operators and associated
5757# parties for roaming clearing purposes and fraud detection.
5758
5759# The magic file covers:
5760
5761# - TAP files (TD.57) - CDR batches and notifications
5762# - RAP files (TD.32) - return batches and acknowledgements
5763# - NRT files (TD.35) - CDR batches for 'near real time' processing
5764
5765#
5766# TAP 3 Files
5767# TAP -> Transferred Account Procedure
5768# cf. https://www.gsma.com/newsroom/wp-content/uploads/TD.57-v32.31.pdf
5769# TransferBatch short tag
57700	byte	0x61
5771# BatchControlInfo short tag
5772>&1	search/b5	\x64
5773# Sender long tag #TAP 3.x (BER encoded)
5774>>&1	search/b8	\x5f\x81\x44
5775# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block
5776>>>&64	search/b64	\x5f\x81\x49\x01\x03\x5f\x81\x3d\x01
5777>>>>&0	byte	x	TAP 3.%d Batch (TD.57, Transferred Account)
5778
5779# Notification short tag
57800	byte	0x62
5781# Sender long tag
5782>2	search/b8	\x5f\x81\x44
5783# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block
5784>>&64	search/b64	\x5f\x81\x49\x01\x03\x5f\x81\x3d\x01
5785>>>&0	byte	x	TAP 3.%d Notification (TD.57, Transferred Account)
5786
5787
5788# NRT Files
5789# NRT a.k.a. NRTRDE
57900	byte	0x61
5791# <SpecificationVersionNumber>2</><ReleaseVersionNumber> block
5792>&1	search/b8 \x5f\x29\x01\x02\x5f\x25\x01
5793>>&0	byte	x	NRT 2.%d (TD.35, Near Real Time Roaming Data Exchange)
5794
5795# RAP Files
5796# cf. https://www.gsma.com/newsroom/wp-content/uploads/TD.32-v6.11.pdf
5797# Long ReturnBatch tag
57980	string	\x7f\x84\x16
5799# Long RapBatchControlInfo tag
5800>&1	search/b8	\x7f\x84\x19
5801# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block
5802>>&64	search/b64	\x5f\x81\x49\x01\x03\x5f\x81\x3d\x01
5803# <RapSpecificationVersionNumber>1</><RapReleaseVersionNumber> block
5804>>>&1	string/b	\x5f\x84\x20\x01\x01\x5f\x84\x1f\x01
5805>>>>&0	byte	x	RAP 1.%d Batch (TD.32, Returned Account Procedure),
5806>>>&0	byte	x	TAP 3.%d
5807
5808# Long Acknowledgement tag
58090	string \x7f\x84\x17
5810# Long Sender tag
5811>&1	search/b5	\x5f\x81\x44	RAP Acknowledgement (TD.32, Returned Account Procedure)
5812
5813#------------------------------------------------------------------------------
5814# $File: bflt,v 1.5 2014/04/30 21:41:02 christos Exp $
5815# bFLT: file(1) magic for BFLT uclinux binary files
5816#
5817# From Philippe De Muyter <phdm@macqel.be>
5818#
58190	string		bFLT		BFLT executable
5820>4	belong		x		- version %d
5821>4	belong		4
5822>>36	belong&0x1	0x1		ram
5823>>36	belong&0x2	0x2		gotpic
5824>>36	belong&0x4	0x4		gzip
5825>>36	belong&0x8	0x8		gzdata
5826
5827#------------------------------------------------------------------------------
5828# $File: bhl,v 1.1 2017/06/11 22:20:02 christos Exp $
5829# BlockHashLoc
5830# ext: bhl
5831# Marco Pontello marcopon@gmail.com
5832# reference: https://github.com/MarcoPon/BlockHashLoc
58330	string	BlockHashLoc\x1a	BlockHashLoc recovery info,
5834>13	byte	x			version %d
5835!:ext   bhl
5836
5837#------------------------------------------------------------------------------
5838# $File: bioinformatics,v 1.5 2019/04/19 00:42:27 christos Exp $
5839# bioinfomatics:  file(1) magic for Bioinfomatics file formats
5840
5841###############################################################################
5842# BGZF (Blocked GNU Zip Format) - gzip compatible, but also indexable
5843# used by SAMtools bgzip/tabix (http://samtools.sourceforge.net/tabix.shtml)
5844###############################################################################
58450	string		\037\213
5846>3	byte		&0x04
5847>>12	string		BC
5848>>>14	leshort		&0x02	Blocked GNU Zip Format (BGZF; gzip compatible)
5849>>>>16	leshort		x	\b, block length %d
5850!:mime	application/x-gzip
5851
5852
5853###############################################################################
5854# Tabix index file
5855# used by SAMtools bgzip/tabix (http://samtools.sourceforge.net/tabix.shtml)
5856###############################################################################
58570	string	TBI\1		SAMtools TBI (Tabix index format)
5858>0x04	lelong	=1		\b, with %d reference sequence
5859>0x04	lelong	>1		\b, with %d reference sequences
5860>0x08	lelong	&0x10000	\b, using half-closed-half-open coordinates (BED style)
5861>0x08	lelong	^0x10000
5862>>0x08	lelong	=0		\b, using closed and one based coordinates (GFF style)
5863>>0x08	lelong	=1		\b, using SAM format
5864>>0x08	lelong	=2		\b, using VCF format
5865>0x0c	lelong	x		\b, sequence name column: %d
5866>0x10	lelong	x		\b, region start column: %d
5867>0x08	lelong	=0
5868>>0x14	lelong	x		\b, region end column: %d
5869>0x18	byte	x		\b, comment character: %c
5870>0x1c	lelong	x		\b, skip line count: %d
5871
5872
5873###############################################################################
5874# BAM (Binary Sequence Alignment/Map format)
5875# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf)
5876# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
5877###############################################################################
58780	string	BAM\1	SAMtools BAM (Binary Sequence Alignment/Map)
5879>0x04	lelong	>0
5880>>&0x00 regex	=^[@]HD\t.*VN:		\b, with SAM header
5881>>>&0	regex	=[0-9.]+		\b version %s
5882>>&(0x04)	lelong	>0	\b, with %d reference sequences
5883
5884
5885###############################################################################
5886# BAI (BAM indexing format)
5887# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf)
5888###############################################################################
58890		string	BAI\1	SAMtools BAI (BAM indexing format)
5890>0x04		lelong	>0	\b, with %d reference sequences
5891
5892
5893###############################################################################
5894# CRAM (Binary Sequence Alignment/Map format)
5895###############################################################################
58960	string	CRAM	CRAM
5897>0x04	byte	>-1	version %d.
5898>0x05	byte	>-1	\b%d
5899>0x06	string	>\0	(identified as %s)
5900
5901
5902###############################################################################
5903# BCF (Binary Call Format), version 1
5904# used by SAMtools & VCFtools (http://vcftools.sourceforge.net/bcf.pdf)
5905# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
5906###############################################################################
59070		string	   BCF\4
5908# length of seqnm data in bytes is positive
5909>&0x00		lelong	  >0
5910# length of smpl data in bytes is positive
5911>>&(&-0x04)	lelong	  >0			SAMtools BCF (Binary Call Format)
5912# length of meta in bytes
5913>>>&(&-0x04)	lelong	  >0
5914# have meta text string
5915>>>>&0x00	search	  ##samtoolsVersion=
5916>>>>>&0x00	string	  x			\b, generated by SAMtools version %s
5917
5918
5919###############################################################################
5920# BCF (Binary Call Format), version 2.1
5921# used by SAMtools (https://samtools.github.io/hts-specs/BCFv2_qref.pdf)
5922# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
5923###############################################################################
59240		string	   BCF\2\1    Binary Call Format (BCF) version 2.1
5925# length of header text
5926>&0x00		lelong	  >0
5927# have header string
5928>>&0x00 search	  ##samtoolsVersion=
5929>>>&0x00	string	  x			\b, generated by SAMtools version %s
5930
5931
5932###############################################################################
5933# BCF (Binary Call Format), version 2.2
5934# used by SAMtools (https://samtools.github.io/hts-specs/BCFv2_qref.pdf)
5935# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
5936###############################################################################
59370		string	   BCF\2\2    Binary Call Format (BCF) version 2.2
5938# length of header text
5939>&0x00		lelong	  >0
5940# have header string
5941>>&0x00 search	  ##samtoolsVersion=
5942>>>&0x00	string	  x			\b, generated by SAMtools version %s
5943
5944###############################################################################
5945# VCF (Variant Call Format)
5946# used by VCFtools (http://vcftools.sourceforge.net/)
5947###############################################################################
59480      search	   ##fileformat=VCFv	Variant Call Format (VCF)
5949>&0    string	   x			\b version %s
5950
5951###############################################################################
5952# FASTQ
5953# used by MAQ (http://maq.sourceforge.net/fastq.shtml)
5954###############################################################################
5955# XXX Broken?
5956# @<seqname>
5957#0	regex	=^@[A-Za-z0-9_.:-]+\?\n
5958# <seq>
5959#>&1	regex	=^[A-Za-z\n.~]++
5960# +[<seqname>]
5961#>>&1	regex	=^[A-Za-z0-9_.:-]*\?\n
5962# <qual>
5963#>>>&1	regex	=^[!-~\n]+\n		FASTQ
5964
5965###############################################################################
5966# FASTA
5967# used by FASTA (https://fasta.bioch.virginia.edu/fasta_www2/fasta_guide.pdf)
5968###############################################################################
5969#0	byte	0x3e
5970# q>0	regex	=^[>][!-~\t\ ]+$
5971# Amino Acid codes: [A-IK-Z*-]+
5972#>>1	regex	!=[!-'Jj;:=?@^`|~\\]		FASTA
5973# IUPAC codes/gaps: [ACGTURYKMSWBDHVNX-]+
5974# not in IUPAC codes/gaps: [EFIJLOPQZ]
5975#>>>1	regex	!=[EFIJLOPQZefijlopqz]		\b, with IUPAC nucleotide codes
5976#>>>1	regex	=^[EFIJLOPQZefijlopqz]+$	\b, with Amino Acid codes
5977
5978###############################################################################
5979# SAM (Sequence Alignment/Map format)
5980# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf)
5981###############################################################################
5982# Short-cut version to recognise SAM files with (optional) header at beginning
5983###############################################################################
59840      string	   @HD\t
5985>4     search	   VN:		Sequence Alignment/Map (SAM), with header
5986>>&0   regex	   [0-9.]+	\b version %s
5987###############################################################################
5988# Longer version to recognise SAM alignment lines using (many) regexes
5989###############################################################################
5990# SAM Alignment QNAME
59910		regex	=^[!-?A-~]{1,255}(\t[^\t]+){11}
5992# SAM Alignment FLAG
5993>0		regex	=^([^\t]+\t){1}[0-9]{1,5}\t
5994# SAM Alignment RNAME
5995>>0		regex	=^([^\t]+\t){2}\\*|[^*=]*\t
5996# SAM Alignment POS
5997>>>0		regex	=^([^\t]+\t){3}[0-9]{1,9}\t
5998# SAM Alignment MAPQ
5999>>>>0		regex	=^([^\t]+\t){4}[0-9]{1,3}\t
6000# SAM Alignment CIGAR
6001>>>>>0		regex	=\t(\\*|([0-9]+[MIDNSHPX=])+)\t
6002# SAM Alignment RNEXT
6003>>>>>>0		regex	=\t(\\*|=|[!-()+->?-~][!-~]*)\t
6004# SAM Alignment PNEXT
6005>>>>>>>0	regex	=^([^\t]+\t){7}[0-9]{1,9}\t
6006# SAM Alignment TLEN
6007>>>>>>>>0	regex	=\t[+-]{0,1}[0-9]{1,9}\t.*\t
6008# SAM Alignment SEQ
6009>>>>>>>>>0	regex	=^([^\t]+\t){9}(\\*|[A-Za-z=.]+)\t
6010# SAM Alignment QUAL
6011>>>>>>>>>>0	regex	=^([^\t]+\t){10}[!-~]+	Sequence Alignment/Map (SAM)
6012>>>>>>>>>>>0	regex	=^[@]HD\t.*VN:		\b, with header
6013>>>>>>>>>>>>&0	regex	=[0-9.]+		\b version %s
6014
6015##############################################################################
6016#
6017#    Magic ids for biomedical signal file formats
6018#    Copyright (C) 2018 Alois Schloegl <alois.schloegl@gmail.com>
6019#
6020#    The list has been derived from biosig projects
6021#      http://biosig.sourceforge.net
6022#      https://pub.ist.ac.at/~schloegl/matlab/eeg/
6023#      https://pub.ist.ac.at/~schloegl/biosig/TESTED
6024#
6025##############################################################################
6026#
60270	string  ABF\x20					Biosig/Axon Binary format
6028!:mime biosig/abf2
60290	string  ABF2\0\0				Biosig/Axon Binary format
6030!:mime biosig/abf2
6031#
60320	string  ATES\x20MEDICA\x20SOFT.\x20EEG\x20for\x20Windows	Biosig/ATES MEDICA SOFT. EEG for Windows
6033!:mime biosig/ates
6034#
60350	string  ATF\x09					Biosig/Axon Text format
6036!:mime biosig/atf
6037#
60380	string  ADU1					Biosig/Axona file format
6039!:mime biosig/axona
60400	string  ADU2					Biosig/Axona file format
6041!:mime biosig/axona
6042#
60430	string  ALPHA-TRACE-MEDICAL			Biosig/alpha trace
6044!:mime biosig/alpha
6045#
60460       string  AxGr					Biosig/AXG
60470       string  axgx					Biosig/AXG
6048!:mime biosig/axg
6049#
60500	string  HeaderLen=				Biosig/BCI2000
60510	string  BCI2000V				Biosig/BCI2000
6052!:mime biosig/bci2000
6053#
6054### Specification: https://www.biosemi.com/faq/file_format.htm
60550	string  \xffBIOSEMI				Biosig/Biosemi data format
6056!:mime biosig/bdf
6057#
60580	string  Brain\x20Vision\x20Data\x20Exchange\x20Header\x20File			Biosig/Brainvision data file
60590	string  Brain\x20Vision\x20V-Amp\x20Data\x20Header\x20File\x20Version		Biosig/Brainvision V-Amp file
60600	string  Brain\x20Vision\x20Data\x20Exchange\x20Marker\x20File,\x20Version	Biosig/Brainvision Marker file
6061!:mime biosig/brainvision
6062#
60630	string  CEDFILE					Biosig/CFS: Cambridge Electronic devices File format
6064!:mime biosig/ced
6065#
6066### Specification: https://www.edfplus.info/specs/index.html
60670	string	0\x20\x20\x20\x20\x20\x20\x20		Biosig/EDF: European Data format
6068!:mime biosig/edf
6069#
6070### Specifications: https://arxiv.org/abs/cs/0608052
60710	string  GDF					Biosig/GDF: General data format for biosignals
6072!:mime biosig/gdf
6073#
60740	string  DATA\0\0\0\0				Biosig/Heka Patchmaster
60750	string  DAT1\0\0\0\0				Biosig/Heka Patchmaster
60760	string  DAT2\0\0\0\0				Biosig/Heka Patchmaster
6077!:mime biosig/heka
6078#
60790	string  (C)\x20CED\x2087			Biosig/CED SMR
6080!:mime biosig/ced-smr
6081#
60820	string  CFWB\1\0\0\0				Biosig/CFWB
6083!:mime biosig/cfwb
6084#
60850	string  DEMG					Biosig/DEMG
6086!:mime biosig/demg
6087#
60880	string  EBS\x94\x0a\x13\x1a\x0d			Biosig/EBS
6089!:mime biosig/ebs
6090#
60910	string  Embla\x20data\x20file			Biosig/Embla
6092!:mime biosig/embla
6093#
60940	string  Header\r\nFile Version			Biosig/ETG4000
6095!:mime biosig/etg4000
6096#
60970	string  GALILEO\x20EEG\x20TRACE\x20FILE		Biosig/Galileo
6098!:mime biosig/galileo
6099#
61000	string  IGOR					Biosig/IgorPro ITX file
6101!:mime biosig/igorpro
6102#
6103#	Specification: http://www.ampsmedical.com/uploads/2017-12-7/The_ISHNE_Format.pdf
61040	string  ISHNE1.0				Biosig/ISHNE
6105!:mime biosig/ishne
6106#
6107# 	CEN/ISO 11073/22077 series, http://www.mfer.org/en/document.htm
61080	string  @\x20\x20MFER\x20			Biosig/MFER
61090	string  @\x20MFR\x20				Biosig/MFER
6110!:mime biosig/mfer
6111#
61120	string  NEURALEV				Biosig/NEV
61130	string  N.EV.\0					Biosig/NEV
6114!:mime biosig/nev
6115#
61160	string  NEX1					Biosig/NEX
6117!:mime biosig/nex1
6118#
61190	string  PLEX 					Biosig/Plexon v1.0
612010	string  PLEXON 					Biosig/Plexon v2.0
6121!:mime biosig/plexon
6122#
61230	string  \x02\x27\x91\xC6			Biosig/RHD2000: Intan RHD2000 format
6124#
6125#	Specification: CEN 1064:2005/ISO 11073:91064
612616	string  SCPECG\0\0 				Biosig/SCP-ECG format CEN 1064:2005/ISO 11073:91064
6127!:mime biosig/scpecg
6128#
61290	string  IAvSFo									Biosig/SIGIF
6130!:mime biosig/sigif
6131#
61320	string  POLY\x20SAMPLE\x20FILEversion\x20					Biosig/TMS32
6133!:mime biosig/tms32
6134#
61350	string  FileId=TMSi\x20PortiLab\x20sample\x20log\x20file\x0a\x0dVersion=	Biosig/TMSiLOG
6136!:mime biosig/tmsilog
6137#
61384	string	Synergy\0\48\49\50\46\48\48\51\46\48\48\48\46\48\48\48\0\28\0\0\0\2\0\0\0
6139>63	string	CRawDataElement
6140>>85	string	CRawDataBuffer								Biosig/SYNERGY
6141!:mime biosig/synergy
6142#
61434	string	\40\0\4\1\44\1\102\2\146\3\44\0\190\3					Biosig/UNIPRO
6144!:mime biosig/unipro
6145#
61460	string	VER=9\r\nCTIME=								Biosig/WCP
6147!:mime biosig/wcp
6148#
61490	string	\xAF\xFE\xDA\xDA							Biosig/Walter Graphtek
61500	string	\xDA\xDA\xFE\xAF							Biosig/Walter Graphtek
61510	string	\x55\x55\xFE\xAF							Biosig/Walter Graphtek
6152!:mime biosig/walter-graphtek
6153#
61540	string  V3.0\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20
6155>32	string  [PatInfo]								Biosig/Sigma
6156!:mime biosig/sigma
6157#
61580	string  \067\069\078\013\010\0x1a\04\0x84					Biosig/File exchange format (FEF)
6159!:mime biosig/fef
61600	string  \67\69\78\0x13\0x10\0x1a\4\0x84						Biosig/File exchange format (FEF)
6161!:mime biosig/fef
6162#
61630	string  \0\0\0\x64\0\0\0\x1f\0\0\0\x14\0\0\0\0\0\1
6164>36  	string  \0\0\0\x65\0\0\0\3\0\0\0\4\0\0
6165>>56	string  \0\0\0\x6a\0\0\0\3\0\0\0\4\0\0\0\0\xff\xff\xff\xff\0\0			Biosig/FIFF
6166!:mime biosig/fiff
6167#
6168
6169#------------------------------------------------------------------------------
6170# $File: blackberry,v 1.2 2017/03/17 21:35:28 christos Exp $
6171# blackberry:  file(1) magic for BlackBerry file formats
6172#
61735	belong	0
6174>8	belong  010010010	BlackBerry RIM ETP file
6175>>22	string	x		\b for %s
6176# Berkeley Lab Checkpoint Restart (BLCR) checkpoint context files
6177# https://ftg.lbl.gov/checkpoint
61780	string	C\0\0\0R\0\0\0	BLCR
6179>16	lelong	1	x86
6180>16	lelong	3	alpha
6181>16	lelong	5	x86-64
6182>16	lelong	7	ARM
6183>8	lelong	x	context data (little endian, version %d)
6184# Uncomment the following only of your "file" program supports "search"
6185#>0	search/1024	VMA\06	for kernel
6186#>>&1	byte	x	%d.
6187#>>&2	byte	x	%d.
6188#>>&3	byte	x	%d
61890	string	\0\0\0C\0\0\0R	BLCR
6190>16	belong	2	SPARC
6191>16	belong	4	ppc
6192>16	belong	6	ppc64
6193>16	belong	7	ARMEB
6194>16	belong	8	SPARC64
6195>8	belong	x	context data (big endian, version %d)
6196# Uncomment the following only of your "file" program supports "search"
6197#>0	search/1024	VMA\06	for kernel
6198#>>&1	byte	x	%d.
6199#>>&2	byte	x	\b%d.
6200#>>&3	byte	x	\b%d
6201
6202#------------------------------------------------------------------------------
6203# $File: blender,v 1.8 2019/04/19 00:42:27 christos Exp $
6204# blender: file(1) magic for Blender 3D related files
6205#
6206# Native format rule v1.2. For questions use the developers list
6207# https://lists.blender.org/mailman/listinfo/bf-committers
6208# GLOB chunk was moved near start and provides subversion info since 2.42
6209
62100		string	=BLENDER	Blender3D,
6211>7		string	=_		saved as 32-bits
6212>>8		string	=v		little endian
6213>>>9		byte	x		with version %c.
6214>>>10		byte	x		\b%c
6215>>>11		byte	x		\b%c
6216>>>0x40		string	=GLOB		\b.
6217>>>>0x58	leshort	x		\b%.4d
6218>>8		string	=V		big endian
6219>>>9		byte	x		with version %c.
6220>>>10		byte	x		\b%c
6221>>>11		byte	x		\b%c
6222>>>0x40		string	=GLOB		\b.
6223>>>>0x58	beshort	x		\b%.4d
6224>7		string	=-		saved as 64-bits
6225>>8		string	=v		little endian
6226>>9		byte	x		with version %c.
6227>>10		byte	x		\b%c
6228>>11		byte	x		\b%c
6229>>0x44		string	=GLOB		\b.
6230>>>0x60		leshort	x		\b%.4d
6231>>8		string	=V		big endian
6232>>>9		byte	x		with version %c.
6233>>>10		byte	x		\b%c
6234>>>11		byte	x		\b%c
6235>>>0x44		string	=GLOB		\b.
6236>>>>0x60	beshort	x		\b%.4d
6237
6238# Scripts that run in the embedded Python interpreter
62390		string	#!BPY		Blender3D BPython script
6240
6241#------------------------------------------------------------------------------
6242# $File: blit,v 1.8 2009/09/19 16:28:08 christos Exp $
6243# blit:  file(1) magic for 68K Blit stuff as seen from 680x0 machine
6244#
6245# Note that this 0407 conflicts with several other a.out formats...
6246#
6247# XXX - should this be redone with "be" and "le", so that it works on
6248# little-endian machines as well?  If so, what's the deal with
6249# "VAX-order" and "VAX-order2"?
6250#
6251#0	long		0407		68K Blit (standalone) executable
6252#0	short		0407		VAX-order2 68K Blit (standalone) executable
62530	short		03401		VAX-order 68K Blit (standalone) executable
62540	long		0406		68k Blit mpx/mux executable
62550	short		0406		VAX-order2 68k Blit mpx/mux executable
62560	short		03001		VAX-order 68k Blit mpx/mux executable
6257# Need more values for WE32 DMD executables.
6258# Note that 0520 is the same as COFF
6259#0	short		0520		tty630 layers executable
6260
6261#------------------------------------------------------------------------------
6262# $File: bm,v 1.2 2021/03/14 16:56:51 christos Exp $
6263# bm:  file(1) magic for "Birtual Machine", cf. https://github.com/tsoding/bm
6264
62650	string	bm\001\244	Birtual Machine
6266>4	leshort	x		\b, version %d
6267>6	lelong	x		\b, program size %u
6268>14	lelong	x		\b, memory size %u
6269>22	lelong	x		\b, memory capacity %u
6270
6271#------------------------------------------------------------------------------
6272# $File: bout,v 1.5 2009/09/19 16:28:08 christos Exp $
6273# i80960 b.out objects and archives
6274#
62750	long		0x10d		i960 b.out relocatable object
6276>16	long		>0		not stripped
6277#
6278# b.out archive (hp-rt on i960)
62790	string		=!<bout>	b.out archive
6280>8	string		__.SYMDEF	random library
6281
6282#------------------------------------------------------------------------------
6283# $File: bsdi,v 1.7 2014/03/29 15:40:34 christos Exp $
6284# bsdi:  file(1) magic for BSD/OS (from BSDI) objects
6285# Some object/executable formats use the same magic numbers as are used
6286# in other OSes; those are handled by entries in aout.
6287#
6288
62890	lelong		0314		386 compact demand paged pure executable
6290>16	lelong		>0		not stripped
6291>32	byte		0x6a		(uses shared libs)
6292
6293# same as in SunOS 4.x, except for static shared libraries
62940	belong&077777777	0600413		SPARC demand paged
6295>0	byte		&0x80
6296>>20	belong		<4096		shared library
6297>>20	belong		=4096		dynamically linked executable
6298>>20	belong		>4096		dynamically linked executable
6299>0	byte		^0x80		executable
6300>16	belong		>0		not stripped
6301>36	belong		0xb4100001	(uses shared libs)
6302
63030	belong&077777777	0600410		SPARC pure
6304>0	byte		&0x80		dynamically linked executable
6305>0	byte		^0x80		executable
6306>16	belong		>0		not stripped
6307>36	belong		0xb4100001	(uses shared libs)
6308
63090	belong&077777777	0600407		SPARC
6310>0	byte		&0x80		dynamically linked executable
6311>0	byte		^0x80		executable
6312>16	belong		>0		not stripped
6313>36	belong		0xb4100001	(uses shared libs)
6314# Chiasmus is an encryption standard developed by the German Federal
6315# Office for Information Security (Bundesamt fuer Sicherheit in der
6316# Informationstechnik).
6317
6318# https://www.bsi.bund.de/EN/Topics/OtherTopics/Chiasmus/Chiasmus_node.html
63190	string		XIA1\r		Chiasmus Encrypted data
6320!:ext xia
6321
63220	string	XIS	Chiasmus key
6323!:ext xis
6324
6325#------------------------------------------------------------------------------
6326# $File: btsnoop,v 1.5 2009/09/19 16:28:08 christos Exp $
6327# BTSnoop:  file(1) magic for BTSnoop files
6328#
6329# From <marcel@holtmann.org>
63300	string		btsnoop\0		BTSnoop
6331>8	belong		x			version %d,
6332>12	belong		1001			Unencapsulated HCI
6333>12	belong		1002			HCI UART (H4)
6334>12	belong		1003			HCI BCSP
6335>12	belong		1004			HCI Serial (H5)
6336>>12	belong		x			type %d
6337
6338#------------------------------------------------------------------------------
6339# $File: c64,v 1.8 2020/12/20 16:17:43 christos Exp $
6340# c64:  file(1) magic for various commodore 64 related files
6341#
6342# From: Dirk Jagdmann <doj@cubic.org>
6343
63440x16500	belong		0x12014100	D64 Image
63450x16500	belong		0x12014180	D71 Image
63460x61800 belong		0x28034400	D81 Image
63470	string		C64\40CARTRIDGE	CCS C64 Emultar Cartridge Image
63480	belong		0x43154164	X64 Image
6349
63500	string		GCR-1541	GCR Image
6351>8	byte		x		version: %i
6352>9	byte		x		tracks: %i
6353
63549	string		PSUR		ARC archive (c64)
63552	string		-LH1-		LHA archive (c64)
6356
63570	string		C64File		PC64 Emulator file
6358>8	string		>\0		"%s"
63590	string		C64Image	PC64 Freezer Image
6360
63610	beshort		0x38CD		C64 PCLink Image
63620	string		CBM\144\0\0	Power 64 C64 Emulator Snapshot
6363
63640	belong		0xFF424CFF	WRAptor packer (c64)
6365
63660	string		C64S\x20tape\x20file	T64 tape Image
6367>32	leshort		x		Version:0x%x
6368>36	leshort		!0		Entries:%i
6369>40	string		x		Name:%.24s
6370
63710	string		C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0	T64 tape Image
6372>32	leshort		x		Version:0x%x
6373>36	leshort		!0		Entries:%i
6374>40	string		x		Name:%.24s
6375
63760	string		C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0	T64 tape Image
6377>32	leshort		x		Version:0x%x
6378>36	leshort		!0		Entries:%i
6379>40	string		x		Name:%.24s
6380
6381# Raw tape file format (.tap files)
6382# Esa Hyyti <esa@netlab.tkk.fi>
63830	string		C64-TAPE-RAW	C64 Raw Tape File (.tap),
6384>0x0c	byte		x		Version:%u,
6385>0x10	lelong		x		Length:%u cycles
6386
6387# magic for Goattracker2, http://covertbitops.c64.org/
6388# from Alex Myczko <alex@aiei.ch>
63890	string		GTS5		GoatTracker 2 song
6390>4	string		>\0		\b, "%s"
6391>36	string		>\0		\b by %s
6392>68	string		>\0		\b (C) %s
6393>100	byte		>0		\b, %u subsong(s)
6394
6395# CBM BASIC (cc65 compiled)
63960	leshort		0x0801
6397>2	leshort		0x080b
6398>6	string		\x9e		CBM BASIC
6399>7	string		>\0		\b, SYS %s
6400
6401#------------------------------------------------------------------------------
6402# $File: cad,v 1.25 2021/02/23 00:51:10 christos Exp $
6403# autocad:  file(1) magic for cad files
6404#
6405
6406# Microstation DGN/CIT Files (www.bentley.com)
6407# Last updated July 29, 2005 by Lester Hightower
6408# DGN is the default file extension of Microstation/Intergraph CAD files.
6409# CIT is the proprietary raster format (similar to TIFF) used to attach
6410# raster underlays to Microstation DGN (vector) drawings.
6411#
6412# http://www.wotsit.org/search.asp
6413# https://filext.com/detaillist.php?extdetail=DGN
6414# https://filext.com/detaillist.php?extdetail=CIT
6415#
6416# https://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2
6417# 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928
6418# https://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682
6419# 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F
6420#
6421# URL:		https://en.wikipedia.org/wiki/MicroStation
6422# reference:	http://dgnlib.maptools.org/dgn.html
6423#		http://dgnlib.maptools.org/dl/ref18.pdf
6424# Update:	Joerg Jenderek
6425# Note: verfied by command like `dgndump seed2d_b.dgn`
6426# test for level 8 and type 5 or 9
64270	beshort&0x3F73	0x0801
6428# level of element like 8
6429#>0	ubyte&0x3F	x			\b, level %u
6430#>0	ubyte		&0x80			\b, complex
6431#>0	ubyte		&0x40			\b, reserved
6432# type of element 9~TCB 8~Digitizer setup 5~Group Data Elements
6433#>1	ubyte&0x7F	x			\b, type %u
6434# words to follow in element: 17H~CEL library 2FEh~DGN 9FEh,DFEh~CIT
6435#>2	uleshort	x			\b, words 0x%4.4x to follow
6436# test for 3 reserved 0 bytes in CIT or "conversion" in ViewInfo structure (DGN CEL)
6437#>508	ubelong		x			\b, RESERVED %8.8x
6438>508	ubelong&0xFFffFF00	=0
6439# test for level 8 and type 9 for INGR raster image
6440>>0	beshort		0x0809
6441# test for length of 1st element is multiple of blocks a 512 bytes
6442>>>2	ubyte		0xfe
6443>>>>0 	use		ingr-image
6444# test for DGN or CEL by jump words (uleshort) forward to next element
6445>(2.s*2)	ulong		x
6446# 2nd element type: 8~Digitizer~DesiGNfile 1~library cell header other~CIT
6447#>>&1		ubyte&0x7F	x		\b, 2nd type %u
6448# DGN
6449>>&1		ubyte&0x7F	8
6450>>>2		uleshort	=0x02FE		Bentley/Intergraph Microstation CAD drawing
6451!:mime		application/x-bentley-dgn
6452!:ext		dgn
6453# The 0x40 bit of this byte is 1 if the file is 3D, otherwise 0
6454>>>>1214	ubyte  		&0x40		3D
6455>>>>1214	ubyte  		^0x40		2D
6456# 2 chars for name of subunits like ft FT in IN mu m mm '\0 '\040
6457>>>>1120	string		x		\b, units %-.2s
6458# 2 chars for name of master unit like IN in ML SU tn th TH HU mm "\0 "\040 \0\0
6459>>>>1122	string		>\0		%-.2s
6460#>>>>1120	ubelong		x		\b, units 0x%8.8x
6461# element range low,high x y z like xlow=0 08010000h 01080000h
6462#>>>>4		ubelong	  	!0		\b, xlow %8.8x
6463#>>>>8		ubelong	  	!0		\b, ylow %8.8x
6464#>>>>12		ubelong	  	!0		\b, zlow %8.8x
6465#>>>>16		ubelong	  	!0		\b, xhigh %8.8x
6466#>>>>20		ubelong	  	!0		\b, yhigh %8.8x
6467#>>>>24		ubelong	  	!0		\b, zhigh %8.8x
6468# graphic group number; all other elements in that group have same non-0 number
6469#>>>>28		leshort		x		\b, grphgrp 0x%4.4x
6470# words to optional attribute linkage
6471#>>>>30		ubyte		x		\b, attindx \%o
6472#>>>>31		ubyte		x		\b\%o
6473# >>30	string	\026\105			DGNFile
6474# >>30	string	\034\105			DGNFile
6475# >>30	string	\073\107			DGNFile
6476# >>30	string	\073\110			DGNFile
6477# >>30	string	\106\107			DGNFile
6478# >>30	string	\110\103			DGNFile
6479# >>30	string	\120\104			DGNFile
6480# >>30	string	\172\104			DGNFile
6481# >>30	string	\172\105			DGNFile
6482# >>30	string	\172\106			DGNFile
6483# >>30	string	\234\106			DGNFile
6484# >>30	string	\273\105			DGNFile
6485# >>30	string	\306\106			DGNFile
6486# >>30	string	\310\104			DGNFile
6487# >>30	string	\341\104			DGNFile
6488# >>30	string	\372\103			DGNFile
6489# >>30	string	\372\104			DGNFile
6490# >>30	string	\372\106			DGNFile
6491# >>30	string	\376\103			DGNFile
6492# elements properties indicator
6493#>>>>32		uleshort	!0		\b, properties 0x%4.4x
6494# class 0~Primary
6495#>>>>>32		uleshort&0x000F	!0		\b, class 0x%4.4x
6496# Symbology
6497#>>>>>34		uleshort	x		\b, Symbology 0x%4.4x
6498# test for 2nd element type 1~library cell header
6499>>&1		ubyte&0x7F	1
6500# test for 1st element with level 8 and type 5 for cell library
6501>>>0		beshort		0x0805		Bentley/Intergraph Microstation CAD cell library
6502!:mime		application/x-bentley-cel
6503!:ext		cel
6504#
6505# URL:		http://fileformats.archiveteam.org/wiki/Intergraph_Raster
6506# reference:	https://web.archive.org/web/20140903185431/
6507#		http://oreilly.com/www/centers/gff/formats/ingr/index.htm
6508# note:		verfied by command like `nconvert -fullinfo LONGLAT.CIT`
6509# display information for intergraph raster bitmap
65100	name	ingr-image
6511# in 5.37 "Microstation CITFile" "Bentley/Intergraph MicroStation CIT raster CAD"
6512# DataTypeCode indicates format, depth of the pixel data and used compression
6513>4	uleshort	x			Intergraph raster image
6514>>4	uleshort	0x0009			\b, Run-Length Encoded 1-bit
6515!:mime	image/x-intergraph-rle
6516!:ext	rel
6517>>4	uleshort	0x0018			\b, CCITT Group 4 1-bit
6518!:mime	image/x-intergraph-cit
6519!:ext	cit
6520>>4	uleshort	27			\b, Adaptive RLE RGB
6521!:mime	image/x-intergraph-rgb
6522!:ext	rgb
6523>>4	default		x
6524>>>4	uleshort	x			\b, Type %u
6525!:mime	image/x-intergraph
6526# TODO:
6527#>4	uleshort	0			\b, no data
6528# ...
6529#>4	uleshort	0x0045			\b, Continuous Tone CMKY (Uncompressed)
6530# ApplicationType: 0~generic raster image 3~drawing, scanning
6531# 8~I/IMAGE and MicroStation Imager 9~ModelView
6532>6	uleshort	!0			\b, ApplicationType %u
6533#>6	uleshort	x			\b, ApplicationType %u
6534# XViewOrigin; Raster grid data X origin
6535#>8	ulequad		!0			\b, XViewOrigin %llx
6536# PixelsPerLine is the number of pixels in a scan line of bitmapp
6537>184	ulelong		x			\b, %u x
6538# NumberOfLines is height of the raster data in scanlines
6539>188	ulelong		x			%u
6540# DeviceResolution; resolution of scanning device
6541# positive indicates number of micros between lines; negative indicates DPI
6542#>192	leshort		x			\b, DeviceResolution %d
6543# ScanlineOrient indicates the origin and the orientation of the scan lines
6544#>194	ubyte		x			\b, ScanlineOrient %x
6545>194	ubyte		x			\b, orientation
6546>194	ubyte		&0x01			right
6547>194	ubyte		^0x01			left
6548>194	ubyte		&0x02			down
6549>194	ubyte		^0x02			top
6550>194	ubyte		&0x04			horizontal
6551>194	ubyte		^0x04			vertical
6552# ScannableFlag; Scanline indexing method used
6553#>195	ubyte		!0			\b, ScannableFlag 0x%x
6554# RotationAngle; Rotation angle of raster data
6555#>196	ubequad		!0			\b, RotationAngle 0x%llx
6556# SkewAngle; Skew angle of raster data
6557#>204	ubequad		!0			\b, SkewAngle %llx
6558# DataTypeModifier; Additional raster data format info
6559#>212	uleshort	!0			\b, DataTypeModifier 0x%4.4x
6560# DesignFile[66]; Name of the design file
6561>214	string		>\0			\b, DesignFile %-.66s
6562# DatabaseFile[66]; Name of the database file
6563>280	string		>\0			\b, DatabaseFile %-.66s
6564# ParentGridFile[66]; Name of parent grid file
6565>346	string		>\0			\b, ParentGridFile %-.66s
6566# FileDescription[80]; Text description of file and contents
6567>412	string		>\0			\b, FileDescription %-.80s
6568# MinValue
6569#>492	ubequad		!0			\b, MinValue 0x%llx
6570# MaxValue
6571#>500	ubequad		!0			\b, MaxValue 0x%llx
6572# Reserved[3]; Unused (always 0)
6573#>508	ubelong&0xFFffFF00	x		\b, RESERVED %8.8x
6574# GridFileVersion; Grid File Version like 2 3
6575#>511	ubyte		x			\b, GridFileVersion %x
6576
6577# AutoCAD
6578# Merge of the different contributions and updates from https://en.wikipedia.org/wiki/Dwg
6579# and https://www.iana.org/assignments/media-types/image/vnd.dwg
65800	string	MC0.0	DWG AutoDesk AutoCAD Release 1.0
6581!:mime image/vnd.dwg
65820	string	AC1.2	DWG AutoDesk AutoCAD Release 1.2
6583!:mime image/vnd.dwg
65840	string	AC1.3	DWG AutoDesk AutoCAD Release 1.3
6585!:mime image/vnd.dwg
65860	string	AC1.40	DWG AutoDesk AutoCAD Release 1.40
6587!:mime image/vnd.dwg
65880	string	AC1.50	DWG AutoDesk AutoCAD Release 2.05
6589!:mime image/vnd.dwg
65900	string	AC2.10	DWG AutoDesk AutoCAD Release 2.10
6591!:mime image/vnd.dwg
65920	string	AC2.21	DWG AutoDesk AutoCAD Release 2.21
6593!:mime image/vnd.dwg
65940	string	AC2.22	DWG AutoDesk AutoCAD Release 2.22
6595!:mime image/vnd.dwg
65960	string	AC1001	DWG AutoDesk AutoCAD Release 2.22
6597!:mime image/vnd.dwg
65980	string	AC1002	DWG AutoDesk AutoCAD Release 2.50
6599!:mime image/vnd.dwg
66000	string	AC1003	DWG AutoDesk AutoCAD Release 2.60
6601!:mime image/vnd.dwg
66020	string	AC1004	DWG AutoDesk AutoCAD Release 9
6603!:mime image/vnd.dwg
66040	string	AC1006	DWG AutoDesk AutoCAD Release 10
6605!:mime image/vnd.dwg
66060	string	AC1009	DWG AutoDesk AutoCAD Release 11/12
6607!:mime image/vnd.dwg
6608# AutoCAD DWG versions R13/R14 (www.autodesk.com)
6609# Written December 01, 2003 by Lester Hightower
6610# Based on the DWG File Format Specifications at http://www.opendwg.org/
6611# AutoCad, from Nahuel Greco
6612# AutoCAD DWG versions R12/R13/R14 (www.autodesk.com)
66130	string	AC1012	DWG AutoDesk AutoCAD Release 13
6614!:mime image/vnd.dwg
66150	string	AC1013	DWG AutoDesk AutoCAD Release 13c3
6616!:mime image/vnd.dwg
66170	string	AC1014	DWG AutoDesk AutoCAD Release 14
6618!:mime image/vnd.dwg
66190	string	AC1015	DWG AutoDesk AutoCAD 2000
6620!:mime image/vnd.dwg
6621
6622# A new version of AutoCAD DWG
6623# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru,
6624# ICQ 358572321)
6625# From various sources like:
6626# https://autodesk.blogs.com/between_the_lines/autocad-release-history.html
66270	string	AC1018	DWG AutoDesk AutoCAD 2004/2005/2006
6628!:mime image/vnd.dwg
66290	string	AC1021	DWG AutoDesk AutoCAD 2007/2008/2009
6630!:mime image/vnd.dwg
66310	string	AC1024	DWG AutoDesk AutoCAD 2010/2011/2012
6632!:mime image/vnd.dwg
66330	string	AC1027	DWG AutoDesk AutoCAD 2013-2017
6634!:mime image/vnd.dwg
6635
6636# From GNU LibreDWG
66370	string	AC1032	DWG AutoDesk AutoCAD 2018/2019/2020
6638!:mime image/vnd.dwg
66390	string	AC1035	DWG AutoDesk AutoCAD 2021
6640!:mime image/vnd.dwg
6641
6642# KOMPAS 2D drawing from ASCON
6643# This is KOMPAS 2D drawing or fragment of drawing but is not detailed nor
6644# gathered nor specification
6645# ASCON https://ascon.net/main/ in English,
6646#	https://ascon.ru/ main site in Russian
6647# Extension is CDW for drawing and FRW for fragment of drawing
6648# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru,
6649# ICQ 358572321, https://vkontakte.ru/id16076543)
6650# From:
6651# https://sd.ascon.ru/otrs/customer.pl?Action=CustomerFAQ&CategoryID=4&ItemID=292
6652# (in russian) and my experiments
66530	string	KF
6654>2	belong	0x4E00000C	Kompas drawing 12.0 SP1
6655>2	belong	0x4D00000C	Kompas drawing 12.0
6656>2	belong	0x3200000B	Kompas drawing 11.0 SP1
6657>2	belong	0x3100000B	Kompas drawing 11.0
6658>2	belong	0x2310000A	Kompas drawing 10.0 SP1
6659>2	belong	0x2110000A	Kompas drawing 10.0
6660>2	belong	0x08000009	Kompas drawing 9.0 SP1
6661>2	belong	0x05000009	Kompas drawing 9.0
6662>2	belong	0x33010008	Kompas drawing 8+
6663>2	belong	0x1A000008	Kompas drawing 8.0
6664>2	belong	0x2C010107	Kompas drawing 7+
6665>2	belong	0x05000007	Kompas drawing 7.0
6666>2	belong	0x32000006	Kompas drawing 6+
6667>2	belong	0x09000006	Kompas drawing 6.0
6668>2	belong	0x5C009005	Kompas drawing 5.11R03
6669>2	belong	0x54009005	Kompas drawing 5.11R02
6670>2	belong	0x51009005	Kompas drawing 5.11R01
6671>2	belong	0x22009005	Kompas drawing 5.10R03
6672>2	belong	0x22009005	Kompas drawing 5.10R02 mar
6673>2	belong	0x21009005	Kompas drawing 5.10R02 febr
6674>2	belong	0x19009005	Kompas drawing 5.10R01
6675>2	belong	0xF4008005	Kompas drawing 5.9R01.003
6676>2	belong	0x1C008005	Kompas drawing 5.9R01.002
6677>2	belong	0x11008005	Kompas drawing 5.8R01.003
6678
6679# CAD: file(1) magic for computer aided design files
6680# Phillip Griffith <phillip dot griffith at gmail dot com>
6681# AutoCAD magic taken from the Open Design Alliance's OpenDWG specifications.
6682#
6683
6684# 3DS (3d Studio files)
66850	leshort		0x4d4d
6686>6	leshort		0x2
6687>>8	lelong		0xa
6688>>>16	leshort		0x3d3d	3D Studio model
6689!:mime	image/x-3ds
6690!:ext 3ds
6691
6692# MegaCAD 2D/3D drawing (.prt)
6693# https://megacad.de/
6694# From: Markus Heidelberg <markus.heidelberg@web.de>
66950	string	MegaCad23\0	MegaCAD 2D/3D drawing
6696
6697# Hoops CAD files
6698# https://docs.techsoft3d.com/visualize/3df/latest/build/general/hsf/\
6699# HSF_architecture.html
6700# Stephane Charette <stephane.charette@gmail.com>
67010	string	;;\020HSF\020V		OpenHSF (Hoops Stream Format)
6702>7	regex/9 V[.0-9]{4,5}\020	%s
6703!:ext hsf
6704
6705# AutoCAD Drawing Exchange Format
67060	regex		\^[\ \t]*0\r?\000$
6707>1	regex		\^[\ \t]*SECTION\r?$
6708>>2	regex		\^[\ \t]*2\r?$
6709>>>3	regex		\^[\ \t]*HEADER\r?$	AutoCAD Drawing Exchange Format
6710!:mime	application/x-dxf
6711!:ext	dxf
6712>>>>&1	search/8192	AC1006			\b, R10
6713>>>>&1	search/8192	AC1009			\b, R11/R12
6714>>>>&1	search/8192	AC1012			\b, R13
6715>>>>&1	search/8192	AC1013			\b, R13c3
6716>>>>&1	search/8192	AC1014			\b, R14
6717>>>>&1	search/8192	AC1015			\b, version 2000
6718>>>>&1	search/8192	AC1018			\b, version 2004
6719>>>>&1	search/8192	AC1021			\b, version 2007
6720>>>>&1	search/8192	AC1024			\b, version 2010
6721>>>>&1	search/8192	AC1027			\b, version 2013
6722>>>>&1	search/8192	AC1032			\b, version 2018
6723>>>>&1	search/8192	AC1035			\b, version 2021
6724
6725# The Sketchup 3D model format https://www.sketchup.com/
67260	string	\xff\xfe\xff\x0e\x53\x00\x6b\x00\x65\x00\x74\x00\x63\x00\x68\x00\x55\x00\x70\x00\x20\x00\x4d\x00\x6f\x00\x64\x00\x65\x00\x6c\x00	SketchUp Model
6727!:mime application/vnd.sketchup.skp
6728!:ext skp
6729
67304	regex/b	P[0-9][0-9]\\.[0-9][0-9][0-9][0-9]\\.[0-9][0-9][0-9][0-9]\\.[0-9]	NAXOS CAD System file from version %s
6731!:strength +40
6732
6733#------------------------------------------------------------------------------
6734# $File: cafebabe,v 1.26 2020/12/12 20:01:47 christos Exp $
6735# Cafe Babes unite!
6736#
6737# Since Java bytecode and Mach-O universal binaries have the same magic number,
6738# the test must be performed in the same "magic" sequence to get both right.
6739# The long at offset 4 in a Mach-O universal binary tells the number of
6740# architectures; the short at offset 4 in a Java bytecode file is the JVM minor
6741# version and the short at offset 6 is the JVM major version.  Since there are only
6742# only 18 labeled Mach-O architectures at current, and the first released
6743# Java class format was version 43.0, we can safely choose any number
6744# between 18 and 39 to test the number of architectures against
6745# (and use as a hack). Let's not use 18, because the Mach-O people
6746# might add another one or two as time goes by...
6747#
6748### JAVA START ###
6749# Reference:	http://en.wikipedia.org/wiki/Java_class_file
6750# Update:	Joerg Jenderek
67510	belong		0xcafebabe
6752>4	ubelong		>30		compiled Java class data,
6753!:mime	application/x-java-applet
6754#!:mime	application/java-byte-code
6755!:ext	class
6756>>6	ubeshort	x	        version %d.
6757>>4	ubeshort	x       	\b%d
6758# for debugging purpose version as hexadecimal to compare with Mach-O universal binary
6759#>>4	ubelong		x       	(0x%8.8x)
6760# Which is which?
6761# https://docs.oracle.com/javase/specs/jvms/se6/html/ClassFile.doc.html
6762#>>4	belong		0x002b		(Java 0.?)
6763#>>4	belong		0x032d		(Java 1.0)
6764#>>4	belong		0x032d		(Java 1.1)
6765>>4	belong		0x002e		(Java 1.2)
6766>>4	belong		0x002f		(Java 1.3)
6767>>4	belong		0x0030		(Java 1.4)
6768>>4	belong		0x0031		(Java 1.5)
6769>>4	belong		0x0032		(Java 1.6)
6770>>4	belong		0x0033		(Java 1.7)
6771>>4	belong		0x0034		(Java 1.8)
6772>>4	belong		0x0035		(Java SE 9)
6773>>4	belong		0x0036		(Java SE 10)
6774>>4	belong		0x0037		(Java SE 11)
6775>>4	belong		0x0038		(Java SE 12)
6776>>4	belong		0x0039		(Java SE 13)
6777>>4	belong		0x003A		(Java SE 14)
6778# pool count unequal zero
6779#>>8	beshort		x	        \b, pool count 0x%x
6780# pool table
6781#>>10	ubequad		x	        \b, pool 0x%16.16llx...
6782
67830	belong		0xcafed00d	JAR compressed with pack200,
6784>5	byte		x		version %d.
6785>4	byte		x		\b%d
6786!:mime	application/x-java-pack200
6787
6788
67890	belong		0xcafed00d	JAR compressed with pack200,
6790>5	byte		x		version %d.
6791>4	byte		x		\b%d
6792!:mime	application/x-java-pack200
6793
6794### JAVA END ###
6795### MACH-O START ###
6796# URL:		https://en.wikipedia.org/wiki/Mach-O
6797
67980	name		mach-o		\b [
6799# for debugging purpose CPU type as hexadecimal
6800#>0	ubequad		x		CPU=%16.16llx
6801# display CPU type as string like: i386 x86_64 ... armv7 armv7k ...
6802>0	use		mach-o-cpu	\b
6803# for debugging purpose print offset to 1st mach_header like:
6804# 1000h 4000h seldom 2d000h 88000h 5b000h 10e000 h
6805#>8	ubelong		x		at 0x%x offset
6806>(8.L)	indirect	x		\b:
6807>0	belong		x		\b]
6808
6809# Reference:	https://opensource.apple.com/source/cctools/cctools-949.0.1/
6810#		include/mach-o/fat.h
6811#		include/mach/machine.h
68120	belong		0xcafebabe
6813>4	belong		1		Mach-O universal binary with 1 architecture:
6814!:mime application/x-mach-binary
6815>>8	use		mach-o		\b
6816# nfat_arch; number of CPU architectures; highest is 18 for CPU_TYPE_POWERPC in 2020
6817>4	ubelong		>1
6818>>4	ubelong		<20		Mach-O universal binary with %d architectures:
6819!:mime application/x-mach-binary
6820>>>8	use		mach-o		\b
6821>>>4	ubelong		>1
6822>>>>28	use		mach-o		\b
6823>>>4	ubelong		>2
6824>>>>48	use		mach-o		\b
6825>>>4	ubelong		>3
6826>>>>68	use		mach-o		\b
6827>>>4	ubelong		>4
6828>>>>88	use		mach-o		\b
6829>>>4	ubelong		>5
6830>>>>108	use		mach-o		\b
6831
6832### MACH-O END ###
6833
6834#------------------------------------------------------------------------------
6835# $File: cbor,v 1.1 2015/01/28 01:05:21 christos Exp $
6836# cbor:  file(1) magic for CBOR files as defined in RFC 7049
6837
68380	string	\xd9\xd9\xf7 Concise Binary Object Representation (CBOR) container
6839!:mime	application/cbor
6840>3	ubyte	<0x20	(positive integer)
6841>3	ubyte	<0x40
6842>>3	ubyte	>0x1f	(negative integer)
6843>3	ubyte	<0x60
6844>>3	ubyte	>0x3f	(byte string)
6845>3	ubyte	<0x80
6846>>3	ubyte	>0x5f	(text string)
6847>3	ubyte	<0xa0
6848>3	ubyte	>0x7f	(array)
6849>3	ubyte	<0xc0
6850>>3	ubyte	>0x9f	(map)
6851>3	ubyte	<0xe0
6852>>3	ubyte	>0xbf	(tagged)
6853>3	ubyte	>0xdf	(other)
6854
6855#------------------------------------------------------------------------------
6856# $File: cddb,v 1.4 2009/09/19 16:28:08 christos Exp $
6857# CDDB: file(1) magic for CDDB(tm) format CD text data files
6858#
6859# From <steve@gracenote.com>
6860#
6861# This is the /etc/magic entry to decode datafiles as used by
6862# CDDB-enabled CD player applications.
6863#
6864
68650	search/1/w	#\040xmcd	CDDB(tm) format CD text data
6866
6867#------------------------------------------------------------------------------
6868# $File: chord,v 1.5 2010/09/20 19:19:16 rrt Exp $
6869# chord: file(1) magic for Chord music sheet typesetting utility input files
6870#
6871# From Philippe De Muyter <phdm@macqel.be>
6872# File format is actually free, but many distributed files begin with `{title'
6873#
68740	string		{title		Chord text file
6875
6876# Type:	PowerTab file format
6877# URL:	http://www.power-tab.net/
6878# From:	Jelmer Vernooij <jelmer@samba.org>
68790	string		ptab\003\000	Power-Tab v3 Tablature File
68800	string		ptab\004\000	Power-Tab v4 Tablature File
6881
6882#------------------------------------------------------------------------------
6883# $File: cisco,v 1.4 2009/09/19 16:28:08 christos Exp $
6884# cisco:  file(1) magic for cisco Systems routers
6885#
6886# Most cisco file-formats are covered by the generic elf code
6887#
6888# Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha.
68890	belong&0xffffff00	0x85011400  cisco IOS microcode
6890>7	string		>\0		    for '%s'
68910	belong&0xffffff00	0x8501cb00  cisco IOS experimental microcode
6892>7	string		>\0		    for '%s'
6893
6894#------------------------------------------------------------------------------
6895# $File: citrus,v 1.5 2021/01/04 19:48:31 christos Exp $
6896# citrus locale declaration
6897#
6898
68990	string		RuneCT		Citrus locale declaration for LC_CTYPE
69000	string		CtrsME		Citrus locale declaration for LC_MESSAGES
69010	string		CtrsMO		Citrus locale declaration for LC_MONETARY
69020	string		CtrsNU		Citrus locale declaration for LC_NUMERIC
69030	string		CtrsTI		Citrus locale declaration for LC_TIME
6904
6905#------------------------------------------------------------------------------
6906# $File: c-lang,v 1.28 2019/11/15 21:03:14 christos Exp $
6907# c-lang:  file(1) magic for C and related languages programs
6908#
6909# The strength is to beat standard HTML
6910
6911# BCPL
69120	search/8192	"libhdr"	BCPL source text
6913!:mime	text/x-bcpl
69140	search/8192	"LIBHDR"	BCPL source text
6915!:mime	text/x-bcpl
6916
6917# C
6918# Check for class if include is found, otherwise class is beaten by include because of lowered strength
69190	search/8192	#include
6920>0	regex	\^#include			C
6921>>0	regex	\^class[[:space:]]+
6922>>>&0	regex 	\\{[\.\*]\\}(;)?$			\b++
6923>>&0	clear	x				source text
6924!:strength + 13
6925!:mime	text/x-c
69260	search/8192	pragma
6927>0	regex	\^#[[:space:]]*pragma	C source text
6928!:mime	text/x-c
69290	search/8192	endif
6930>0	regex	\^#[[:space:]]*(if\|ifn)def
6931>>&0	regex	\^#[[:space:]]*endif$	C source text
6932!:mime	text/x-c
69330	search/8192	define
6934>0	regex	\^#[[:space:]]*(if\|ifn)def
6935>>&0	regex	\^#[[:space:]]*define	C source text
6936!:mime	text/x-c
69370	search/8192	char
6938>0	regex	\^[[:space:]]*char(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$			C source text
6939!:mime	text/x-c
69400	search/8192	double
6941>0	regex	\^[[:space:]]*double(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$			C source text
6942!:mime	text/x-c
69430	search/8192	extern
6944>0	regex	\^[[:space:]]*extern[[:space:]]+		C source text
6945!:mime	text/x-c
69460	search/8192	float
6947>0	regex	\^[[:space:]]*float(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$			C source text
6948!:mime	text/x-c
69490	search/8192	struct
6950>0	regex	\^struct[[:space:]]+		C source text
6951!:mime	text/x-c
69520	search/8192	union
6953>0	regex	\^union[[:space:]]+		C source text
6954!:mime	text/x-c
69550	search/8192	main(
6956>&0 regex	\\)[[:space:]]*\\{		C source text
6957!:mime	text/x-c
6958
6959# C++
6960# The strength of these rules is increased so they beat the C rules above
69610	search/8192	namespace
6962>0	regex	\^namespace[[:space:]]+[_[:alpha:]]{1,30}[[:space:]]*\\{	C++ source text
6963!:strength + 30
6964!:mime	text/x-c++
6965# using namespace [namespace] or using std::[lib]
69660	search/8192	using
6967>0	regex	\^using[[:space:]]+(namespace\ )?std(::)?[[:alpha:]]*[[:space:]]*;		C++ source text
6968!:strength + 30
6969!:mime	text/x-c++
69700	search/8192	template
6971>0	regex	\^[[:space:]]*template[[:space:]]*<.*>[[:space:]]*$	C++ source text
6972!:strength + 30
6973!:mime	text/x-c++
69740	search/8192	virtual
6975>0	regex	\^[[:space:]]*virtual[[:space:]]+.*[};][[:space:]]*$		C++ source text
6976!:strength + 30
6977!:mime	text/x-c++
6978# But class alone is reduced to avoid beating php (Jens Schleusener)
69790	search/8192	class
6980>0	regex	\^[[:space:]]*class[[:space:]]+[[:digit:][:alpha:]:_]+[[:space:]]*\\{(.*[\n]*)*\\}(;)?$		C++ source text
6981!:strength + 13
6982!:mime	text/x-c++
69830	search/8192	public
6984>0	regex	\^[[:space:]]*public:		C++ source text
6985!:strength + 30
6986!:mime	text/x-c++
69870	search/8192	private
6988>0	regex	\^[[:space:]]*private:		C++ source text
6989!:strength + 30
6990!:mime	text/x-c++
69910	search/8192	protected
6992>0	regex	\^[[:space:]]*protected:		C++ source text
6993!:strength + 30
6994!:mime	text/x-c++
6995
6996# Objective-C
69970	search/8192	#import
6998>0	regex	\^#import			Objective-C source text
6999!:strength + 25
7000!:mime	text/x-objective-c
7001
7002# From: Mikhail Teterin <mi@aldan.algebra.com>
70030	string		cscope		cscope reference data
7004>7	string		x		version %.2s
7005# We skip the path here, because it is often long (so file will
7006# truncate it) and mostly redundant.
7007# The inverted index functionality was added some time between
7008# versions 11 and 15, so look for -q if version is above 14:
7009>7	string		>14
7010>>10	search/100	\ -q\ 		with inverted index
7011>10	search/100	\ -c\ 		text (non-compressed)
7012
7013#------------------------------------------------------------------------------
7014# $File: clarion,v 1.5 2014/04/30 21:41:02 christos Exp $
7015# clarion:  file(1) magic for # Clarion Personal/Professional Developer
7016# (v2 and above)
7017# From: Julien Blache <jb@jblache.org>
7018
7019# Database files
7020# signature
70210	leshort	0x3343	Clarion Developer (v2 and above) data file
7022# attributes
7023>2	leshort	&0x0001	\b, locked
7024>2	leshort	&0x0004	\b, encrypted
7025>2	leshort	&0x0008	\b, memo file exists
7026>2	leshort	&0x0010	\b, compressed
7027>2	leshort	&0x0040	\b, read only
7028# number of records
7029>5	lelong	x	\b, %d records
7030
7031# Memo files
70320	leshort	0x334d	Clarion Developer (v2 and above) memo data
7033
7034# Key/Index files
7035# No magic? :(
7036
7037# Help files
70380	leshort	0x49e0	Clarion Developer (v2 and above) help data
7039
7040#------------------------------------------------------------------------------
7041# $File: claris,v 1.8 2016/07/18 19:23:38 christos Exp $
7042# claris:  file(1) magic for claris
7043# "H. Nanosecond" <aldomel@ix.netcom.com>
7044# Claris Works a word processor, etc.
7045# Version 3.0
7046
7047# .pct claris works clip art files
7048#0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
7049#*
7050#0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000
7051#null to byte 1000 octal
7052514	string	\377\377\377\377\000
7053>0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0	Claris clip art
7054514	string	\377\377\377\377\001
7055>0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0	Claris clip art
7056
7057# Claris works files
7058# .cwk
7059# Moved to Apple AppleWorks document
7060#0	string	\002\000\210\003\102\117\102\117\000\001\206 Claris works document
7061# .plt
70620	string	\020\341\000\000\010\010	Claris Works palette files .plt
7063
7064# .msp a dictionary file I am not sure about this I have only one .msp file
70650	string	\002\271\262\000\040\002\000\164	Claris works dictionary
7066
7067# .usp are user dictionary bits
7068# I am not sure about a magic header:
7069#0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151
7070#        soh   S   p   f   8   U   D  sp   ^   S  cr  nl   p   o   d   i
7071#0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043
7072#          a   t   r   i   s   t  sp   ^   S  cr  nl   d   i   v  sp   #
7073
7074# .mth Thesaurus
7075# starts with \0 but no magic header
7076
7077# .chy Hyphenation file
7078# I am not sure: 000 210 034 000 000
7079
7080# other claris files
7081#./windows/claris/useng.ndx: data
7082#./windows/claris/xtndtran.l32: data
7083#./windows/claris/xtndtran.lst: data
7084#./windows/claris/clworks.lbl: data
7085#./windows/claris/clworks.prf: data
7086#./windows/claris/userd.spl: data
7087
7088#------------------------------------------------------------------------------
7089# $File: clipper,v 1.9 2020/12/15 23:57:27 christos Exp $
7090# clipper:  file(1) magic for Intergraph (formerly Fairchild) Clipper.
7091#
7092# XXX - what byte order does the Clipper use?
7093#
7094# XXX - what's the "!" stuff:
7095#
7096# >18	short		!074000,000000	C1 R1
7097# >18	short		!074000,004000	C2 R1
7098# >18	short		!074000,010000	C3 R1
7099# >18	short		!074000,074000	TEST
7100#
7101# I shall assume it's ANDing the field with the first value and
7102# comparing it with the second, and rewrite it as:
7103#
7104# >18	short&074000	000000		C1 R1
7105# >18	short&074000	004000		C2 R1
7106# >18	short&074000	010000		C3 R1
7107# >18	short&074000	074000		TEST
7108#
7109# as SVR3.1's "file" doesn't support anything of the "!074000,000000"
7110# sort, nor does SunOS 4.x, so either it's something Intergraph added
7111# in CLIX, or something AT&T added in SVR3.2 or later, or something
7112# somebody else thought was a good idea; it's not documented in the
7113# man page for this version of "magic", nor does it appear to be
7114# implemented (at least not after I blew off the bogus code to turn
7115# old-style "&"s into new-style "&"s, which just didn't work at all).
7116#
71170	short		0575		CLIPPER COFF executable (VAX #)
7118>20	short		0407		(impure)
7119>20	short		0410		(5.2 compatible)
7120>20	short		0411		(pure)
7121>20	short		0413		(demand paged)
7122>20	short		0443		(target shared library)
7123>12	long		>0		not stripped
7124>22	short		>0		- version %d
71250	short		0577		CLIPPER COFF executable
7126>18	short&074000	000000		C1 R1
7127>18	short&074000	004000		C2 R1
7128>18	short&074000	010000		C3 R1
7129>18	short&074000	074000		TEST
7130>20	short		0407		(impure)
7131>20	short		0410		(pure)
7132>20	short		0411		(separate I&D)
7133>20	short		0413		(paged)
7134>20	short		0443		(target shared library)
7135>12	long		>0		not stripped
7136>22	short		>0		- version %d
7137>48	long&01		01		alignment trap enabled
7138>52	byte		1		-Ctnc
7139>52	byte		2		-Ctsw
7140>52	byte		3		-Ctpw
7141>52	byte		4		-Ctcb
7142>53	byte		1		-Cdnc
7143>53	byte		2		-Cdsw
7144>53	byte		3		-Cdpw
7145>53	byte		4		-Cdcb
7146>54	byte		1		-Csnc
7147>54	byte		2		-Cssw
7148>54	byte		3		-Cspw
7149>54	byte		4		-Cscb
7150#4	string		pipe		CLIPPER instruction trace
7151#4	string		prof		CLIPPER instruction profile
7152#------------------------------------------------------------------------------
7153# file:  file(1) magic for Clojure
7154# URL:  https://clojure.org/
7155# From: Jason Felice <jason.m.felice@gmail.com>
7156
71570	string/w	#!\ /usr/bin/clj	Clojure script text executable
7158!:mime	text/x-clojure
71590	string/w	#!\ /usr/local/bin/clj	Clojure script text executable
7160!:mime	text/x-clojure
71610	string/w	#!\ /usr/bin/clojure	Clojure script text executable
7162!:mime	text/x-clojure
71630	string/w	#!\ /usr/local/bin/clojure	Clojure script text executable
7164!:mime	text/x-clojure
71650	string/W	#!/usr/bin/env\ clj	Clojure script text executable
7166!:mime	text/x-clojure
71670	string/W	#!/usr/bin/env\ clojure	Clojure script text executable
7168!:mime	text/x-clojure
71690	string/W	#!\ /usr/bin/env\ clj	Clojure script text executable
7170!:mime	text/x-clojure
71710	string/W	#!\ /usr/bin/env\ clojure	Clojure script text executable
7172!:mime	text/x-clojure
7173
71740	regex	\^\\\(ns[[:space:]]+[a-z]	Clojure module source text
7175!:mime	text/x-clojure
7176
71770	regex	\^\\\(ns[[:space:]]+\\\^\\{:	Clojure module source text
7178!:mime	text/x-clojure
7179
71800	regex	\^\\\(defn-?[[:space:]]	Clojure module source text
7181!:mime	text/x-clojure
7182
7183#------------------------------------------------------------------------------
7184# $File: coff,v 1.4 2021/02/10 00:37:02 christos Exp $
7185# coff: file(1) magic for Common Object Files not specific to known cpu types or manufactures
7186#
7187# COFF
7188#
7189# by Joerg Jenderek at Oct 2015, Feb 2021
7190# https://en.wikipedia.org/wiki/COFF
7191# https://de.wikipedia.org/wiki/Common_Object_File_Format
7192# http://www.delorie.com/djgpp/doc/coff/filhdr.html
7193
7194# display name+variables+flags of Common Object Files Format (32bit)
7195# Maybe used also in adi,att3b,clipper,hitachi-sh,hp,ibm6000,intel,
7196# mips,motorola,msdos,osf1,sharc,varied.out,vax
71970	name				display-coff
7198# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags
7199>18	uleshort&0x8E80	0
7200# skip DOCTOR.DAILY READER.NDA REDBOX.ROOT by looking for positive number of sections
7201>>2	uleshort	>0
7202# skip ega80woa.fnt svgafix.fnt HP3FNTS1.DAT HP3FNTS2.DAT INTRO.ACT LEARN.PIF by looking for low number of sections
7203>>>2	uleshort	<4207
7204>>>>0	clear		x
7205# f_magic - magic number
7206# DJGPP, 80386 COFF executable, MS Windows COFF Intel 80386 object file (./intel)
7207>>>>0	uleshort	0x014C		Intel 80386
7208# Hitachi SH big-endian COFF (./hitachi-sh)
7209>>>>0	uleshort	0x0500		Hitachi SH big-endian
7210# Hitachi SH little-endian COFF (./hitachi-sh)
7211>>>>0	uleshort	0x0550		Hitachi SH little-endian
7212# executable (RISC System/6000 V3.1) or obj module (./ibm6000)
7213#>>>>0	uleshort	0x01DF
7214# MS Windows COFF Intel Itanium, AMD64
7215# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680313(v=vs.85).aspx
7216>>>>0	uleshort	0x0200		Intel ia64
7217>>>>0	uleshort	0x8664		Intel amd64
7218# TODO for other COFFs
7219#>>>>0	uleshort	0xABCD		COFF_TEMPLATE
7220>>>>0	default		x
7221>>>>>0	uleshort	x		type 0x%04x
7222>>>>0	uleshort	x		COFF
7223# F_EXEC flag bit
7224>>>>18	leshort		^0x0002		object file
7225!:mime	application/x-coff
7226!:ext	o/obj/lib
7227# no cof sample found
7228#!:ext	cof/o/obj/lib
7229>>>>18	leshort		&0x0002		executable
7230#!:mime	application/x-coffexec
7231# F_RELFLG flag bit,static object
7232>>>>18	leshort		&0x0001		\b, no relocation info
7233# F_LNNO flag bit
7234>>>>18	leshort		&0x0004		\b, no line number info
7235# F_LSYMS flag bit
7236>>>>18	leshort		&0x0008		\b, stripped
7237>>>>18	leshort		^0x0008		\b, not stripped
7238# flags in other COFF versions
7239#0x0010    F_FDPR_PROF
7240#0x0020    F_FDPR_OPTI
7241#0x0040    F_DSA
7242# F_AR32WR flag bit
7243#>>>>18	leshort		&0x0100		\b, 32 bit little endian
7244#0x1000    F_DYNLOAD
7245#0x2000    F_SHROBJ
7246#0x4000    F_LOADONLY
7247# f_nscns - number of sections like: 1 2 3 4 5 7 8 9 11 12 15 16 19 20 21 22 26 30 36 40 42 56 80 89 96 124
7248>>>>2	uleshort	<2		\b, %u section
7249>>>>2	uleshort	>1		\b, %u sections
7250# f_symptr - symbol table pointer, only for not stripped
7251# like: 0 0x7c 0xf4 0x104 0x182 0x1c2 0x1c6 0x468 0x948 0x416e 0x149a6 0x1c9d8 0x23a68 0x35120 0x7afa0
7252>>>>8	ulelong		>0		\b, symbol offset=0x%x
7253# f_nsyms - number of symbols, only for not stripped
7254# like: 0 2 7 9 10 11 20 35 41 63 71 80 105 146 153 158 170 208 294 572 831 1546
7255>>>>12	ulelong		>0		\b, %d symbols
7256# f_opthdr - optional header size. An object file should have a value of 0
7257>>>>16	uleshort	>0		\b, optional header size %u
7258# f_timdat - file time & date stamp only for little endian
7259>>>>4	ledate		>0		\b, created %s
7260# at offset 20 can be optional header, extra bytes FILHSZ-20 because
7261# do not rely on sizeof(FILHDR) to give the correct size for header.
7262# or first section header
7263# additional variables for other COFF files
7264>>>>16	uleshort	=0
7265# first section name s_name[8] like: .text .data .debug$S .drectve .testseg
7266>>>>>20	string		x		\b, 1st section name "%.8s"
7267# >20	beshort		0407		(impure)
7268# >20	beshort		0410		(pure)
7269# >20	beshort		0413		(demand paged)
7270# >20	beshort		0421		(standalone)
7271# >22	leshort		>0		- version %d
7272# >168	string		.lowmem		Apple toolbox
7273
7274
7275#------------------------------------------------------------------------------
7276# $File: commands,v 1.63 2020/06/06 15:36:30 christos Exp $
7277# commands:  file(1) magic for various shells and interpreters
7278#
7279#0	string/w	:			shell archive or script for antique kernel text
72800	string/wt	#!\ /bin/sh		POSIX shell script text executable
7281!:mime	text/x-shellscript
72820	string/wb	#!\ /bin/sh		POSIX shell script executable (binary data)
7283!:mime	text/x-shellscript
7284
72850	string/wt	#!\ /bin/csh		C shell script text executable
7286!:mime	text/x-shellscript
7287
7288# korn shell magic, sent by George Wu, gwu@clyde.att.com
72890	string/wt	#!\ /bin/ksh		Korn shell script text executable
7290!:mime	text/x-shellscript
72910	string/wb	#!\ /bin/ksh		Korn shell script executable (binary data)
7292!:mime	text/x-shellscript
7293
72940	string/wt 	#!\ /bin/tcsh		Tenex C shell script text executable
7295!:mime	text/x-shellscript
72960	string/wt	#!\ /usr/bin/tcsh	Tenex C shell script text executable
7297!:mime	text/x-shellscript
72980	string/wt 	#!\ /usr/local/tcsh	Tenex C shell script text executable
7299!:mime	text/x-shellscript
73000	string/wt	#!\ /usr/local/bin/tcsh	Tenex C shell script text executable
7301!:mime	text/x-shellscript
7302
7303#
7304# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson)
73050	string/wt	#!\ /bin/zsh		Paul Falstad's zsh script text executable
7306!:mime	text/x-shellscript
73070	string/wt	#!\ /usr/bin/zsh	Paul Falstad's zsh script text executable
7308!:mime	text/x-shellscript
73090	string/wt	#!\ /usr/local/bin/zsh	Paul Falstad's zsh script text executable
7310!:mime	text/x-shellscript
73110	search/1	#!/usr/bin/env\ zsh	Paul Falstad's zsh script text executable
7312!:mime	text/x-shellscript
7313
73140	string/wt	#!\ /usr/local/bin/ash	Neil Brown's ash script text executable
7315!:mime	text/x-shellscript
73160	string/wt	#!\ /usr/local/bin/ae	Neil Brown's ae script text executable
7317!:mime	text/x-shellscript
73180	string/wt	#!\ /bin/nawk		new awk script text executable
7319!:mime	text/x-nawk
73200	string/wt	#!\ /usr/bin/nawk	new awk script text executable
7321!:mime	text/x-nawk
73220	string/wt	#!\ /usr/local/bin/nawk	new awk script text executable
7323!:mime	text/x-nawk
73240	string/wt	#!\ /bin/gawk		GNU awk script text executable
7325!:mime	text/x-gawk
73260	string/wt	#!\ /usr/bin/gawk	GNU awk script text executable
7327!:mime	text/x-gawk
73280	string/wt	#!\ /usr/local/bin/gawk	GNU awk script text executable
7329!:mime	text/x-gawk
7330#
73310	string/wt	#!\ /bin/awk		awk script text executable
7332!:mime	text/x-awk
73330	string/wt	#!\ /usr/bin/awk	awk script text executable
7334!:mime	text/x-awk
73350	regex/4096	=^[\040\t\f\r\n]{0,100}BEGIN[\040\t\f\r\n]{0,100}[{]	awk or perl script text
7336
7337# AT&T Bell Labs' Plan 9 shell
73380	string/wt	#!\ /bin/rc	Plan 9 rc shell script text executable
7339
7340# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)
73410	string/wt	#!\ /bin/bash	Bourne-Again shell script text executable
7342!:mime	text/x-shellscript
73430	string/wb	#!\ /bin/bash	Bourne-Again shell script executable (binary data)
7344!:mime	text/x-shellscript
73450	string/wt	#!\ /usr/bin/bash	Bourne-Again shell script text executable
7346!:mime	text/x-shellscript
73470	string/wb	#!\ /usr/bin/bash	Bourne-Again shell script executable (binary data)
7348!:mime	text/x-shellscript
73490	string/wt	#!\ /usr/local/bash	Bourne-Again shell script text executable
7350!:mime	text/x-shellscript
73510	string/wb	#!\ /usr/local/bash	Bourne-Again shell script executable (binary data)
7352!:mime	text/x-shellscript
73530	string/wt	#!\ /usr/local/bin/bash	Bourne-Again shell script text executable
7354!:mime	text/x-shellscript
73550	string/wb	#!\ /usr/local/bin/bash	Bourne-Again shell script executable (binary data)
7356!:mime	text/x-shellscript
73570	string/wt	#!\ /usr/bin/env\ bash	Bourne-Again shell script text executable
7358!:mime	text/x-shellscript
7359
7360# Fish shell magic
7361# From: Benjamin Lowry <ben@ben.gmbh>
73620	string/wt	#!\ /usr/local/bin/fish		fish shell script text executable
7363!:mime	text/x-shellscript
73640	string/wt	#!\ /usr/bin/fish		fish shell script text executable
7365!:mime	text/x-shellscript
73660	string/wt	#!\ /usr/bin/env\ fish		fish shell script text executable
7367!:mime	text/x-shellscript
7368
7369
73700	search/1/wt	#!\ /usr/bin/tclsh	Tcl/Tk script text executable
7371!:mime  text/x-tcl
7372
73730	search/1/wt	#!\ /usr/bin/texlua	LuaTex script text executable
7374!:mime	text/x-luatex
7375
73760	search/1/wt	#!\ /usr/bin/luatex	LuaTex script text executable
7377!:mime	text/x-luatex
7378
73790	search/1/wt	#!\ /usr/bin/stap	Systemtap script text executable
7380!:mime  text/x-systemtap
7381
7382
7383
7384# PHP scripts
7385# Ulf Harnhammar <ulfh@update.uu.se>
73860	search/1/c	=<?php			PHP script text
7387!:strength + 30
7388!:mime	text/x-php
73890	search/1	=<?\n			PHP script text
7390!:mime	text/x-php
73910	search/1	=<?\r			PHP script text
7392!:mime	text/x-php
73930	search/1/w	#!\ /usr/local/bin/php	PHP script text executable
7394!:strength + 10
7395!:mime	text/x-php
73960	search/1/w	#!\ /usr/bin/php	PHP script text executable
7397!:strength + 10
7398!:mime	text/x-php
7399# Smarty compiled template, https://www.smarty.net/
7400# Elan Ruusamae <glen@delfi.ee>
74010	string	=<?php
7402>5	regex	[\ \n]
7403>>6	string	/*\ Smarty\ version		Smarty compiled template
7404>>>24	regex	[0-9.]+				\b, version %s
7405!:mime	text/x-php
7406
74070	string		Zend\x00		PHP script Zend Optimizer data
7408
74090	string/t	$!			DCL command file
7410
7411# Type: Pdmenu
7412# URL:  https://packages.debian.org/pdmenu
7413# From: Edward Betts <edward@debian.org>
74140	string		#!/usr/bin/pdmenu	Pdmenu configuration file text
7415
7416# From Danny Weldon
74170	string	\x0b\x13\x08\x00
7418>0x04   uleshort	<4      ksh byte-code version %d
7419
7420#----------------------------------------------------------------------------
7421# $File: communications,v 1.5 2009/09/19 16:28:08 christos Exp $
7422# communication
7423
7424# TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3.
7425# It is used for conformance testing of communication protocols.
7426# Added by W. Borgert <debacle@debian.org>.
74270	string		$Suite			TTCN Abstract Test Suite
7428>&1	string		$SuiteId
7429>>&1	string		>\n			%s
7430>&2	string		$SuiteId
7431>>&1	string		>\n			%s
7432>&3	string		$SuiteId
7433>>&1	string		>\n			%s
7434
7435# MSC (message sequence charts) are a formal description technique,
7436# described in ITU-T Z.120, mainly used for communication protocols.
7437# Added by W. Borgert <debacle@debian.org>.
74380	string		mscdocument	Message Sequence Chart (document)
74390	string		msc		Message Sequence Chart (chart)
74400	string		submsc		Message Sequence Chart (subchart)
7441#------------------------------------------------------------------------------
7442# $File: compress,v 1.81 2021/04/19 17:01:45 christos Exp $
7443# compress:  file(1) magic for pure-compression formats (no archives)
7444#
7445# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
7446#
7447# Formats for various forms of compressed data
7448# Formats for "compress" proper have been moved into "compress.c",
7449# because it tries to uncompress it to figure out what's inside.
7450
7451# standard unix compress
74520	string		\037\235	compress'd data
7453!:mime	application/x-compress
7454!:apple	LZIVZIVU
7455>2	byte&0x80	>0		block compressed
7456>2	byte&0x1f	x		%d bits
7457
7458# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver)
7459# URL: https://en.wikipedia.org/wiki/Gzip
7460# Reference: https://tools.ietf.org/html/rfc1952
7461# Update: Joerg Jenderek, Apr 2019
7462#   Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
7463#	* Original filename is only at offset 10 if "extra field" absent
7464#	* Produce shorter output - notably, only report compression methods
7465#         other than 8 ("deflate", the only method defined in RFC 1952).
7466# Note: find defs -iname '*.trid.xml' -exec grep -q '<Bytes>1F8B08' {} \; -ls
7467# TODO:
7468# FBR	Blueberry FlashBack screen Record	https://www.flashbackrecorder.com/
7469# KPR	KOffice/Calligra KPresenter		application/x-kpresenter
7470# KPT	KOffice/Calligra KPresenter template?	application/x-kpresenter
7471# SAV	Diggles Saved Game File			http://www.innonics.com
7472# SAV	FarCry (demo) saved game		http://www.farcry-thegame.com
7473# DAT	ZOAGZIP game data format		http://en.wikipedia.org/wiki/SD_Gundam_Capsule_Fighter
74740       string          \037\213
7475# to display gzip compressed (strength=100=2*50) before other (strength=50)?
7476#!:strength * 2
7477# no FNAME and FCOMMENT bit implies no file name/comment. That means only binary
7478>3	byte&0x18	=0
7479# For binary gzipped no ASCII text should occur
7480#	mcd-monu-cad.trid.xml
7481>>10	string		MCD			Monu-Cad Drawing, Component or Font
7482#>>36	string		Created\ with\ MONU-CAD
7483#!:mime	application/octet-stream
7484# http://fileformats.archiveteam.org/wiki/Monu-CAD
7485#	http://www.monucad.com/downloads/FullDemo-2005.EXE
7486#	/HANDS96.MCC	Component
7487#	/DEMO_DD01.MCD	Drawing
7488#	/MCALF020.FNT	Font
7489!:ext	mcc/mcd/fnt
7490# http://www.generalcadd.com
7491>>10	string		GXD			General CADD, Drawing or Component
7492#!:mime	application/octet-stream
7493#	/gxc/BUILDINGEDGE.gxc			Component
7494#	/gxd/HOCKETT-STPAUL-WRHSE.gxd		Drawing
7495#	/gxd/POWERLAND-MILL-ADD-11.gxd		Drawing		v9.1.06
7496!:ext	gxc/gxd
7497#>>>13	ubyte		0			\b, version 0
7498>>>13	string		09			\b, version 9
7499# other gzipped binary like gzipped tar, VirtualBox extension package,...
7500>>10	default		x		gzip compressed data
7501!:mime	application/gzip
7502>>>0	use	gzip-info
7503# size of the original (uncompressed) input data modulo 2^32
7504>>-0	offset		>48
7505>>>-4	ulelong		x		\b, original size modulo 2^32 %u
7506>>-0	offset		<48		\b, truncated
7507# gzipped TAR or VirtualBox extension package
7508#!:mime	application/x-compressed-tar
7509#!:mime	application/x-virtualbox-vbox-extpack
7510# https://www.w3.org/TR/SVG/mimereg.html
7511#!:mime	image/image/svg+xml-compressed
7512#	zlib.3.gz
7513#	microcode-20180312.tgz
7514#	tpz same as tgz
7515#	lua-md5_1.2-1_i386_i486.ipk	https://en.wikipedia.org/wiki/Opkg
7516#	Oracle_VM_VirtualBox_Extension_Pack-5.0.12-104815.vbox-extpack
7517!:ext	gz/tgz/tpz/ipk/vbox-extpack/svgz
7518# FNAME/FCOMMENT bit implies file name/comment as iso-8859-1 text
7519>3	byte&0x18	>0		gzip compressed data
7520!:mime	application/gzip
7521# gzipped tar, gzipped Abiword document
7522#!:mime	application/x-compressed-tar
7523#!:mime	application/x-abiword-compressed
7524#!:mime	image/image/svg+xml-compressed
7525#	kleopatra_splashscreen.svgz	gzipped .svg
7526!:ext	gz/tgz/tpz/zabw/svgz
7527>>0	use	gzip-info
7528# size of the original (uncompressed) input data modulo 2^32
7529>>-0	offset		>48
7530>>>-4	ulelong		x		\b, original size modulo 2^32 %u
7531>>-0	offset		<48		\b, truncated
7532#	display information of gzip compressed files
75330	name				gzip-info
7534#>2	byte		x		THIS iS GZIP
7535>2	byte		<8		\b, reserved method
7536>2	byte		>8		\b, unknown method
7537>3	byte		&0x01		\b, ASCII
7538>3	byte		&0x02		\b, has CRC
7539>3	byte		&0x04		\b, extra field
7540>3	byte&0xC	=0x08
7541>>10	string		x		\b, was "%s"
7542>3	byte		&0x10		\b, has comment
7543>3	byte		&0x20		\b, encrypted
7544>4	ledate		>0		\b, last modified: %s
7545>8	byte		2		\b, max compression
7546>8	byte		4		\b, max speed
7547>9	byte		=0x00		\b, from FAT filesystem (MS-DOS, OS/2, NT)
7548>9	byte		=0x01		\b, from Amiga
7549>9	byte		=0x02		\b, from VMS
7550>9	byte		=0x03		\b, from Unix
7551>9	byte		=0x04		\b, from VM/CMS
7552>9	byte		=0x05		\b, from Atari
7553>9	byte		=0x06		\b, from HPFS filesystem (OS/2, NT)
7554>9	byte		=0x07		\b, from MacOS
7555>9	byte		=0x08		\b, from Z-System
7556>9	byte		=0x09		\b, from CP/M
7557>9	byte		=0x0A		\b, from TOPS/20
7558>9	byte		=0x0B		\b, from NTFS filesystem (NT)
7559>9	byte		=0x0C		\b, from QDOS
7560>9	byte		=0x0D		\b, from Acorn RISCOS
7561# size of the original (uncompressed) input data modulo 2^32
7562#>-4	ulelong		x		\b, original size modulo 2^32 %u
7563#ERROR: line 114: non zero offset 1048572 at level 1
7564
7565# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis
75660	string		\037\036	packed data
7567!:mime	application/octet-stream
7568>2	belong		>1		\b, %d characters originally
7569>2	belong		=1		\b, %d character originally
7570#
7571# This magic number is byte-order-independent.
75720	short		0x1f1f		old packed data
7573!:mime	application/octet-stream
7574
7575# XXX - why *two* entries for "compacted data", one of which is
7576# byte-order independent, and one of which is byte-order dependent?
7577#
75780	short		0x1fff		compacted data
7579!:mime	application/octet-stream
7580# This string is valid for SunOS (BE) and a matching "short" is listed
7581# in the Ultrix (LE) magic file.
75820	string		\377\037	compacted data
7583!:mime	application/octet-stream
75840	short		0145405		huf output
7585!:mime	application/octet-stream
7586
7587# bzip2
75880	string		BZh		bzip2 compressed data
7589!:mime	application/x-bzip2
7590>3	byte		>47		\b, block size = %c00k
7591
7592# bzip	a block-sorting file compressor
7593#	by Julian Seward <sewardj@cs.man.ac.uk> and others
75940	string		BZ0		bzip compressed data
7595!:mime	application/x-bzip
7596>3	byte		>47		\b, block size = %c00k
7597
7598# lzip
75990	string		LZIP		lzip compressed data
7600!:mime application/x-lzip
7601>4	byte		x		\b, version: %d
7602
7603# squeeze and crunch
7604# Michael Haardt <michael@cantor.informatik.rwth-aachen.de>
76050	beshort		0x76FF		squeezed data,
7606>4	string		x		original name %s
76070	beshort		0x76FE		crunched data,
7608>2	string		x		original name %s
76090	beshort		0x76FD		LZH compressed data,
7610>2	string		x		original name %s
7611
7612# Freeze
76130	string		\037\237	frozen file 2.1
76140	string		\037\236	frozen file 1.0 (or gzip 0.5)
7615
7616# SCO compress -H (LZH)
76170	string		\037\240	SCO compress -H (LZH) data
7618
7619# European GSM 06.10 is a provisional standard for full-rate speech
7620# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse
7621# excitation/long term prediction) coding at 13 kbit/s.
7622#
7623# There's only a magic nibble (4 bits); that nibble repeats every 33
7624# bytes.  This isn't suited for use, but maybe we can use it someday.
7625#
7626# This will cause very short GSM files to be declared as data and
7627# mismatches to be declared as data too!
7628#0	byte&0xF0	0xd0		data
7629#>33	byte&0xF0	0xd0
7630#>66	byte&0xF0	0xd0
7631#>99	byte&0xF0	0xd0
7632#>132	byte&0xF0	0xd0		GSM 06.10 compressed audio
7633
7634# lzop from <markus.oberhumer@jk.uni-linz.ac.at>
76350	string		\x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a	lzop compressed data
7636>9	beshort		<0x0940
7637>>9	byte&0xf0	=0x00		- version 0.
7638>>9	beshort&0x0fff	x		\b%03x,
7639>>13	byte		1		LZO1X-1,
7640>>13	byte		2		LZO1X-1(15),
7641>>13	byte		3		LZO1X-999,
7642## >>22	bedate		>0		last modified: %s,
7643>>14	byte		=0x00		os: MS-DOS
7644>>14	byte		=0x01		os: Amiga
7645>>14	byte		=0x02		os: VMS
7646>>14	byte		=0x03		os: Unix
7647>>14	byte		=0x05		os: Atari
7648>>14	byte		=0x06		os: OS/2
7649>>14	byte		=0x07		os: MacOS
7650>>14	byte		=0x0A		os: Tops/20
7651>>14	byte		=0x0B		os: WinNT
7652>>14	byte		=0x0E		os: Win32
7653>9	beshort		>0x0939
7654>>9	byte&0xf0	=0x00		- version 0.
7655>>9	byte&0xf0	=0x10		- version 1.
7656>>9	byte&0xf0	=0x20		- version 2.
7657>>9	beshort&0x0fff	x		\b%03x,
7658>>15	byte		1		LZO1X-1,
7659>>15	byte		2		LZO1X-1(15),
7660>>15	byte		3		LZO1X-999,
7661## >>25	bedate		>0		last modified: %s,
7662>>17	byte		=0x00		os: MS-DOS
7663>>17	byte		=0x01		os: Amiga
7664>>17	byte		=0x02		os: VMS
7665>>17	byte		=0x03		os: Unix
7666>>17	byte		=0x05		os: Atari
7667>>17	byte		=0x06		os: OS/2
7668>>17	byte		=0x07		os: MacOS
7669>>17	byte		=0x0A		os: Tops/20
7670>>17	byte		=0x0B		os: WinNT
7671>>17	byte		=0x0E		os: Win32
7672
7673# 4.3BSD-Quasijarus Strong Compression
7674# https://minnie.tuhs.org/Quasijarus/compress.html
76750	string		\037\241	Quasijarus strong compressed data
7676
7677# From: Cory Dikkers <cdikkers@swbell.net>
76780	string		XPKF		Amiga xpkf.library compressed data
76790	string		PP11		Power Packer 1.1 compressed data
76800	string		PP20		Power Packer 2.0 compressed data,
7681>4	belong		0x09090909	fast compression
7682>4	belong		0x090A0A0A	mediocre compression
7683>4	belong		0x090A0B0B	good compression
7684>4	belong		0x090A0C0C	very good compression
7685>4	belong		0x090A0C0D	best compression
7686
7687# 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at)
7688# https://www.7-zip.org or DOC/7zFormat.txt
7689#
76900	string		7z\274\257\047\034	7-zip archive data,
7691>6	byte		x			version %d
7692>7	byte		x			\b.%d
7693!:mime	application/x-7z-compressed
7694!:ext 7z/cb7
7695
7696# Type: LZMA
76970	lelong&0xffffff	=0x5d
7698>12	leshort		0xff			LZMA compressed data,
7699!:mime	application/x-lzma
7700>>5	lequad		=0xffffffffffffffff	streamed
7701>>5	lequad		!0xffffffffffffffff	non-streamed, size %lld
7702>12	leshort		0			LZMA compressed data,
7703>>5	lequad		=0xffffffffffffffff	streamed
7704>>5	lequad		!0xffffffffffffffff	non-streamed, size %lld
7705
7706# http://tukaani.org/xz/xz-file-format.txt
77070	ustring		\xFD7zXZ\x00		XZ compressed data, checksum
7708!:strength * 2
7709!:mime	application/x-xz
7710>7	byte&0xf	0x0			NONE
7711>7	byte&0xf	0x1			CRC32
7712>7	byte&0xf	0x4			CRC64
7713>7	byte&0xf	0xa			SHA-256
7714
7715# https://github.com/ckolivas/lrzip/blob/master/doc/magic.header.txt
77160	string		LRZI			LRZIP compressed data
7717>4	byte		x			- version %d
7718>5	byte		x			\b.%d
7719!:mime	application/x-lrzip
7720
7721# https://fastcompression.blogspot.fi/2013/04/lz4-streaming-format-final.html
77220	lelong		0x184d2204	LZ4 compressed data (v1.4+)
7723!:mime	application/x-lz4
7724# Added by osm0sis@xda-developers.com
77250 	lelong		0x184c2103	LZ4 compressed data (v1.0-v1.3)
7726!:mime	application/x-lz4
77270	lelong		0x184c2102	LZ4 compressed data (v0.1-v0.9)
7728!:mime	application/x-lz4
7729
7730# Zstandard/LZ4 skippable frames
7731# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md
77320         lelong&0xFFFFFFF0  0x184D2A50
7733>(4.l+8)  indirect	x
7734
7735# Zstandard Dictionary ID subroutine
77360     name        zstd-dictionary-id
7737# Single Segment = True
7738>0    byte        &0x20   \b, Dictionary ID:
7739>>0   byte&0x03   0       None
7740>>0   byte&0x03   1
7741>>>1  byte        x       %u
7742>>0   byte&0x03   2
7743>>>1  leshort     x       %u
7744>>0   byte&0x03   3
7745>>>1  lelong      x       %u
7746# Single Segment = False
7747>0    byte        ^0x20   \b, Dictionary ID:
7748>>0   byte&0x03   0       None
7749>>0   byte&0x03   1
7750>>>2  byte        x       %u
7751>>0   byte&0x03   2
7752>>>2  leshort     x       %u
7753>>0   byte&0x03   3
7754>>>2  lelong      x       %u
7755
7756# Zstandard compressed data
7757# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md
77580     lelong       0xFD2FB522  Zstandard compressed data (v0.2)
7759!:mime  application/zstd
77600     lelong       0xFD2FB523  Zstandard compressed data (v0.3)
7761!:mime  application/zstd
77620     lelong       0xFD2FB524  Zstandard compressed data (v0.4)
7763!:mime  application/zstd
77640     lelong       0xFD2FB525  Zstandard compressed data (v0.5)
7765!:mime  application/zstd
77660     lelong       0xFD2FB526  Zstandard compressed data (v0.6)
7767!:mime  application/zstd
77680     lelong       0xFD2FB527  Zstandard compressed data (v0.7)
7769!:mime  application/zstd
7770>4    use          zstd-dictionary-id
77710     lelong       0xFD2FB528  Zstandard compressed data (v0.8+)
7772!:mime  application/zstd
7773>4    use          zstd-dictionary-id
7774
7775# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md
77760  lelong    0xEC30A437  Zstandard dictionary
7777!:mime  application/x-std-dictionary
7778>4 lelong    x           (ID %u)
7779
7780# AFX compressed files (Wolfram Kleff)
77812	string		-afx-		AFX compressed file data
7782
7783# Supplementary magic data for the file(1) command to support
7784# rzip(1).  The format is described in magic(5).
7785#
7786# Copyright (C) 2003 by Andrew Tridgell.  You may do whatever you want with
7787# this file.
7788#
77890	string		RZIP		rzip compressed data
7790>4	byte		x		- version %d
7791>5	byte		x		\b.%d
7792>6	belong		x		(%d bytes)
7793
77940	string		ArC\x01		FreeArc archive <http://freearc.org>
7795
7796# Type:	DACT compressed files
77970	long	0x444354C3	DACT compressed data
7798>4	byte	>-1		(version %i.
7799>5	byte	>-1		%i.
7800>6	byte	>-1		%i)
7801>7	long	>0		, original size: %i bytes
7802>15	long	>30		, block size: %i bytes
7803
7804# Valve Pack (VPK) files
78050	lelong	0x55aa1234	Valve Pak file
7806>0x4	lelong	x		\b, version %u
7807>0x8	lelong	x		\b, %u entries
7808
7809# Snappy framing format
7810# https://code.google.com/p/snappy/source/browse/trunk/framing_format.txt
78110	string	\377\006\0\0sNaPpY	snappy framed data
7812!:mime	application/x-snappy-framed
7813
7814# qpress, https://www.quicklz.com/
78150	string	qpress10	qpress compressed data
7816!:mime	application/x-qpress
7817
7818# Zlib https://www.ietf.org/rfc/rfc6713.txt
78190	string/b	x
7820>0	beshort%31	=0
7821>>0	byte&0xf	=8
7822>>>0	byte&0x80 	=0	zlib compressed data
7823!:mime	application/zlib
7824
7825# BWC compression
78260	string		BWC
7827>3	byte		0	BWC compressed data
7828
7829# UCL compression
78300	bequad		0x00e955434cff011a	UCL compressed data
7831
7832# Softlib archive
78330	string		SLIB	Softlib archive
7834>4	leshort		x	\b, version %d
7835>6	leshort		x	(contains %d files)
7836
7837# URL:  https://github.com/lzfse/lzfse/blob/master/src/lzfse_internal.h#L276
7838# From: Eric Hall <eric.hall@darkart.com>
78390	string	bvx-	lzfse encoded, no compression
78400	string	bvx1	lzfse compressed, uncompressed tables
78410	string	bvx2	lzfse compressed, compressed tables
78420	string	bvxn	lzfse encoded, lzvn compressed
7843
7844# pcxLib.exe compression program
7845# http://www.shikadi.net/moddingwiki/PCX_Library
78460	string/b	pcxLib
7847>0x0A	string/b	Copyright\020(c)\020Genus\020Microprogramming,\020Inc.	pcxLib compressed
7848
7849#------------------------------------------------------------------------------
7850# $File: console,v 1.62 2021/02/05 21:51:06 christos Exp $
7851# Console game magic
7852# Toby Deshane <hac@shoelace.digivill.net>
7853
7854# ines: file(1) magic for Marat's iNES Nintendo Entertainment System ROM dump format
7855# Updated by David Korth <gerbilsoft@gerbilsoft.com>
7856# References:
7857# - https://wiki.nesdev.com/w/index.php/INES
7858# - https://wiki.nesdev.com/w/index.php/NES_2.0
7859
7860# Common header for iNES, NES 2.0, and Wii U iNES.
78610	name		nes-rom-image-ines
7862>7	byte&0x0C	=0x8		(NES 2.0)
7863>4	byte		x		\b: %ux16k PRG
7864>5	byte		x		\b, %ux8k CHR
7865>6	byte&0x08	=0x8		[4-Scr]
7866>6	byte&0x09	=0x0		[H-mirror]
7867>6	byte&0x09	=0x1		[V-mirror]
7868>6	byte&0x02	=0x2		[SRAM]
7869>6	byte&0x04	=0x4		[Trainer]
7870>7	byte&0x03	=0x2		[PC10]
7871>7	byte&0x03	=0x1		[VS]
7872>>7	byte&0x0C	=0x8
7873# NES 2.0: VS PPU
7874>>>13	byte&0x0F	=0x0		\b, RP2C03B
7875>>>13	byte&0x0F	=0x1		\b, RP2C03G
7876>>>13	byte&0x0F	=0x2		\b, RP2C04-0001
7877>>>13	byte&0x0F	=0x3		\b, RP2C04-0002
7878>>>13	byte&0x0F	=0x4		\b, RP2C04-0003
7879>>>13	byte&0x0F	=0x5		\b, RP2C04-0004
7880>>>13	byte&0x0F	=0x6		\b, RP2C03B
7881>>>13	byte&0x0F	=0x7		\b, RP2C03C
7882>>>13	byte&0x0F	=0x8		\b, RP2C05-01
7883>>>13	byte&0x0F	=0x9		\b, RP2C05-02
7884>>>13	byte&0x0F	=0xA		\b, RP2C05-03
7885>>>13	byte&0x0F	=0xB		\b, RP2C05-04
7886>>>13	byte&0x0F	=0xC		\b, RP2C05-05
7887# TODO: VS protection hardware?
7888>>7	byte		x		\b]
7889# NES 2.0-specific flags.
7890>7	byte&0x0C	=0x8
7891>>12	byte&0x03	=0x0		[NTSC]
7892>>12	byte&0x03	=0x1		[PAL]
7893>>12	byte&0x02	=0x2		[NTSC+PAL]
7894
7895# Standard iNES ROM header.
78960	string		NES\x1A		NES ROM image (iNES)
7897!:mime	application/x-nes-rom
7898>0	use		nes-rom-image-ines
7899
7900# Wii U Virtual Console iNES ROM header.
79010	belong		0x4E455300	NES ROM image (Wii U Virtual Console)
7902!:mime	application/x-nes-rom
7903>0	use		nes-rom-image-ines
7904
7905#------------------------------------------------------------------------------
7906# unif: file(1) magic for UNIF-format Nintendo Entertainment System ROM images
7907# Reference: https://wiki.nesdev.com/w/index.php/UNIF
7908# From: David Korth <gerbilsoft@gerbilsoft.com>
7909#
7910# NOTE: The UNIF format uses chunks instead of a fixed header,
7911# so most of the data isn't easily parseable.
7912#
79130	string	UNIF
7914>4	lelong	<16	NES ROM image (UNIF v%d format)
7915!:mime	application/x-nes-rom
7916
7917#------------------------------------------------------------------------------
7918# fds: file(1) magic for Famciom Disk System disk images
7919# Reference: https://wiki.nesdev.com/w/index.php/Family_Computer_Disk_System#.FDS_format
7920# From: David Korth <gerbilsoft@gerbilsoft.com>
7921# TODO: Check "Disk info block" and get info from that in addition to the optional header.
7922
7923# Disk info block. (block 1)
79240	name	nintendo-fds-disk-info-block
7925>23	byte	!1		FMC-
7926>23	byte	1		FSC-
7927>16	string	x		\b%.3s
7928>15	byte	x		\b, mfr %02X
7929>20	byte	x		(Rev.%02u)
7930
7931# Headered version.
79320	string	FDS\x1A
7933>0x11	string	*NINTENDO-HVC*	Famicom Disk System disk image:
7934!:mime	application/x-fds-disk
7935>>0x10	use	nintendo-fds-disk-info-block
7936>4	byte	1	(%u side)
7937>4	byte	!1	(%u sides)
7938
7939# Unheadered version.
79401	string	*NINTENDO-HVC*	Famicom Disk System disk image:
7941!:mime	application/x-fds-disk
7942>0	use	nintendo-fds-disk-info-block
7943
7944#------------------------------------------------------------------------------
7945# tnes: file(1) magic for TNES-format Nintendo Entertainment System ROM images
7946# Used by Nintendo 3DS NES Virtual Console games.
7947# From: David Korth <gerbilsoft@gerbilsoft.com>
7948#
79490		string	TNES	NES ROM image (Nintendo 3DS Virtual Console)
7950!:mime		application/x-nes-rom
7951>4		byte	100	\b: FDS,
7952>>0x2010	use	nintendo-fds-disk-info-block
7953>4		byte	!100	\b: TNES mapper %u
7954>>5	byte		x		\b, %ux8k PRG
7955>>6	byte		x		\b, %ux8k CHR
7956>>7	byte&0x08	=1		[WRAM]
7957>>8	byte&0x09	=1		[H-mirror]
7958>>8	byte&0x09	=2		[V-mirror]
7959>>8	byte&0x02	=3		[VRAM]
7960
7961#------------------------------------------------------------------------------
7962# gameboy: file(1) magic for the Nintendo (Color) Gameboy raw ROM format
7963# Reference: http://gbdev.gg8.se/wiki/articles/The_Cartridge_Header
7964#
79650x104		bequad		0xCEED6666CC0D000B	Game Boy ROM image
7966# TODO: application/x-gameboy-color-rom for GBC.
7967!:mime		application/x-gameboy-rom
7968>0x143		byte&0x80	0x80
7969>>0x134		string		>\0			\b: "%.15s"
7970>0x143		byte&0x80	!0x80
7971>>0x134		string		>\0			\b: "%.16s"
7972>0x14c		byte		x			(Rev.%02u)
7973
7974# Machine type. (SGB, CGB, SGB+CGB)
7975# Old licensee code 0x33 is required for SGB, but not CGB.
7976>0x14b		byte		0x33
7977>>0x146		byte		0x03
7978>>>0x143	byte&0x80	0x80	[SGB+CGB]
7979>>>0x143	byte&0x80	!0x80	[SGB]
7980>>0x146		byte		!0x03
7981>>>0x143	byte&0xC0	0x80	[CGB]
7982>>>0x143	byte&0xC0	0xC0	[CGB ONLY]
7983>0x14b		byte		!0x33
7984>>0x143		byte&0xC0	0x80	[CGB]
7985>>0x143		byte&0xC0	0xC0	[CGB ONLY]
7986
7987# Mapper.
7988>0x147 byte 0x00  [ROM ONLY]
7989>0x147 byte 0x01  [MBC1]
7990>0x147 byte 0x02  [MBC1+RAM]
7991>0x147 byte 0x03  [MBC1+RAM+BATT]
7992>0x147 byte 0x05  [MBC2]
7993>0x147 byte 0x06  [MBC2+BATTERY]
7994>0x147 byte 0x08  [ROM+RAM]
7995>0x147 byte 0x09  [ROM+RAM+BATTERY]
7996>0x147 byte 0x0B  [MMM01]
7997>0x147 byte 0x0C  [MMM01+SRAM]
7998>0x147 byte 0x0D  [MMM01+SRAM+BATT]
7999>0x147 byte 0x0F  [MBC3+TIMER+BATT]
8000>0x147 byte 0x10  [MBC3+TIMER+RAM+BATT]
8001>0x147 byte 0x11  [MBC3]
8002>0x147 byte 0x12  [MBC3+RAM]
8003>0x147 byte 0x13  [MBC3+RAM+BATT]
8004>0x147 byte 0x19  [MBC5]
8005>0x147 byte 0x1A  [MBC5+RAM]
8006>0x147 byte 0x1B  [MBC5+RAM+BATT]
8007>0x147 byte 0x1C  [MBC5+RUMBLE]
8008>0x147 byte 0x1D  [MBC5+RUMBLE+SRAM]
8009>0x147 byte 0x1E  [MBC5+RUMBLE+SRAM+BATT]
8010>0x147 byte 0xFC  [Pocket Camera]
8011>0x147 byte 0xFD  [Bandai TAMA5]
8012>0x147 byte 0xFE  [Hudson HuC-3]
8013>0x147 byte 0xFF  [Hudson HuC-1]
8014
8015# ROM size.
8016>0x148 byte 0     \b, ROM: 256Kbit
8017>0x148 byte 1     \b, ROM: 512Kbit
8018>0x148 byte 2     \b, ROM: 1Mbit
8019>0x148 byte 3     \b, ROM: 2Mbit
8020>0x148 byte 4     \b, ROM: 4Mbit
8021>0x148 byte 5     \b, ROM: 8Mbit
8022>0x148 byte 6     \b, ROM: 16Mbit
8023>0x148 byte 7     \b, ROM: 32Mbit
8024>0x148 byte 0x52  \b, ROM: 9Mbit
8025>0x148 byte 0x53  \b, ROM: 10Mbit
8026>0x148 byte 0x54  \b, ROM: 12Mbit
8027
8028# RAM size.
8029>0x149 byte 1     \b, RAM: 16Kbit
8030>0x149 byte 2     \b, RAM: 64Kbit
8031>0x149 byte 3     \b, RAM: 256Kbit
8032>0x149 byte 4     \b, RAM: 1Mbit
8033>0x149 byte 5     \b, RAM: 512Kbit
8034
8035#------------------------------------------------------------------------------
8036# genesis: file(1) magic for various Sega Mega Drive / Genesis ROM image and disc formats
8037# Updated by David Korth <gerbilsoft@gerbilsoft.com>
8038# References:
8039# - https://www.retrodev.com/segacd.html
8040# - http://devster.monkeeh.com/sega/32xguide1.txt
8041#
8042
8043# Common Sega Mega Drive header format.
8044# FIXME: Name fields are 48 bytes, but have spaces for padding instead of 00s.
80450		name	sega-mega-drive-header
8046# ROM title. (Use domestic if present; if not, use international.)
8047>0x120		byte	>0x20
8048>>0x120		string	>\0	\b: "%.16s"
8049>0x120		byte	<0x21
8050>>0x150		string	>\0	\b: "%.16s"
8051# Other information.
8052>0x180		string	>\0	(%.14s
8053>>0x110		string  >\0	\b, %.16s
8054>0x180		byte	0
8055>>0x110		string  >\0	(%.16s
8056>0		byte	x	\b)
8057
8058# TODO: Check for 32X CD?
8059# Sega Mega CD disc images: 2048-byte sectors.
80600	string	SEGADISCSYSTEM\ \ 	Sega Mega CD disc image
8061!:mime	application/x-sega-cd-rom
8062>0	use	sega-mega-drive-header
8063>0	byte	x			\b, 2048-byte sectors
80640	string	SEGABOOTDISC\ \ \ \ 	Sega Mega CD disc image
8065!:mime	application/x-sega-cd-rom
8066>0	use	sega-mega-drive-header
8067>0	byte	x			\b, 2048-byte sectors
8068# Sega Mega CD disc images: 2352-byte sectors.
80690x10	string	SEGADISCSYSTEM\ \ 	Sega Mega CD disc image
8070!:mime	application/x-sega-cd-rom
8071>0x10	use	sega-mega-drive-header
8072>0	byte	x			\b, 2352-byte sectors
80730x10	string	SEGABOOTDISC\ \ \ \ 	Sega Mega CD disc image
8074!:mime	application/x-sega-cd-rom
8075>0x10	use	sega-mega-drive-header
8076>0	byte	x			\b, 2352-byte sectors
8077
8078# Sega Mega Drive, 32X, Pico, and Mega CD Boot ROM images.
80790x100		string	SEGA
8080>0x3C0		bequad	0x4D41525320434845	Sega 32X ROM image
8081!:mime		application/x-genesis-32x-rom
8082>>0		use	sega-mega-drive-header
8083>0x3C0		bequad	!0x4D41525320434845
8084>>0x105		belong	0x5049434F	Sega Pico ROM image
8085!:mime		application/x-sega-pico-rom
8086>>>0		use	sega-mega-drive-header
8087>>0x105		belong	!0x5049434F
8088>>>0x180	beshort	0x4252		Sega Mega CD Boot ROM image
8089!:mime		application/x-genesis-rom
8090>>>0x180	beshort	!0x4252		Sega Mega Drive / Genesis ROM image
8091!:mime		application/x-genesis-rom
8092>>>0		use	sega-mega-drive-header
8093
8094#------------------------------------------------------------------------------
8095# genesis: file(1) magic for the Super MegaDrive ROM dump format
8096#
8097
8098# NOTE: Due to interleaving, we can't display anything
8099# other than the copier header information.
81000      name    sega-genesis-smd-header
8101>0     byte    x       %dx16k blocks
8102>2     byte    0       \b, last in series or standalone
8103>2     byte    >0      \b, split ROM
8104
8105# "Sega Genesis" header.
81060x280	string EAGN
8107>8	beshort	0xAABB	Sega Mega Drive / Genesis ROM image (SMD format):
8108!:mime	application/x-genesis-rom
8109>>0	use     sega-genesis-smd-header
8110
8111# "Sega Mega Drive" header.
81120x280	string EAMG
8113>8	beshort	0xAABB	Sega Mega Drive / Genesis ROM image (SMD format):
8114!:mime	application/x-genesis-rom
8115>>0	use     sega-genesis-smd-header
8116
8117#------------------------------------------------------------------------------
8118# smsgg:  file(1) magic for Sega Master System and Game Gear ROM images
8119# Detects all Game Gear and export Sega Master System ROM images,
8120# and some Japanese Sega Master System ROM images.
8121# From: David Korth <gerbilsoft@gerbilsoft.com>
8122# Reference: https://www.smspower.org/Development/ROMHeader
8123#
8124
8125# General SMS header rule.
8126# The SMS boot ROM checks the header at three locations.
81270	name	sega-master-system-rom-header
8128# Machine type.
8129>0x0F	byte&0xF0	0x30	Sega Master System
8130!:mime	application/x-sms-rom
8131>0x0F	byte&0xF0	0x40	Sega Master System
8132!:mime	application/x-sms-rom
8133>0x0F	byte&0xF0	0x50	Sega Game Gear
8134!:mime	application/x-gamegear-rom
8135>0x0F	byte&0xF0	0x60	Sega Game Gear
8136!:mime	application/x-gamegear-rom
8137>0x0F	byte&0xF0	0x70	Sega Game Gear
8138!:mime	application/x-gamegear-rom
8139>0x0F	default		x	Sega Master System / Game Gear
8140!:mime	application/x-sms-rom
8141>0	byte		x	ROM image:
8142# Product code.
8143>0x0E	byte&0xF0	0x10	1
8144>0x0E	byte&0xF0	0x20	2
8145>0x0E	byte&0xF0	0x30	3
8146>0x0E	byte&0xF0	0x40	4
8147>0x0E	byte&0xF0	0x50	5
8148>0x0E	byte&0xF0	0x60	6
8149>0x0E	byte&0xF0	0x70	7
8150>0x0E	byte&0xF0	0x80	8
8151>0x0E	byte&0xF0	0x90	9
8152>0x0E	byte&0xF0	0xA0	10
8153>0x0E	byte&0xF0	0xB0	11
8154>0x0E	byte&0xF0	0xC0	12
8155>0x0E	byte&0xF0	0xD0	13
8156>0x0E	byte&0xF0	0xE0	14
8157>0x0E	byte&0xF0	0xF0	15
8158# If the product code is 5 digits, we'll need to backspace here.
8159>0x0E	byte&0xF0	!0
8160>>0x0C	leshort		x	\b%04x
8161>0x0E	byte&0xF0	0
8162>>0x0C	leshort		x	%04x
8163# Revision.
8164>0x0E	byte&0x0F	x	(Rev.%02d)
8165# ROM size. (Used for the boot ROM checksum routine.)
8166>0x0F	byte&0x0F	0x0A	(8 KB)
8167>0x0F	byte&0x0F	0x0B	(16 KB)
8168>0x0F	byte&0x0F	0x0C	(32 KB)
8169>0x0F	byte&0x0F	0x0D	(48 KB)
8170>0x0F	byte&0x0F	0x0E	(64 KB)
8171>0x0F	byte&0x0F	0x0F	(128 KB)
8172>0x0F	byte&0x0F	0x00	(256 KB)
8173>0x0F	byte&0x0F	0x01	(512 KB)
8174>0x0F	byte&0x0F	0x02	(1 MB)
8175
8176# SMS/GG header locations.
81770x7FF0	string	TMR\ SEGA
8178>0x7FF0	use	sega-master-system-rom-header
81790x3FF0	string	TMR\ SEGA
8180>0x3FF0	use	sega-master-system-rom-header
81810x1FF0	string	TMR\ SEGA
8182>0x1FF0	use	sega-master-system-rom-header
8183
8184#------------------------------------------------------------------------------
8185# saturn: file(1) magic for the Sega Saturn disc image format.
8186# From: David Korth <gerbilsoft@gerbilsoft.com>
8187#
8188
8189# Common Sega Saturn disc header format.
8190# NOTE: Title is 112 bytes, but we're only showing 32 due to space padding.
8191# TODO: Release date, device information, region code, others?
81920	name	sega-saturn-disc-header
8193>0x60	string	>\0	\b: "%.32s"
8194>0x20	string	>\0	(%.10s
8195>>0x2A	string	>\0	\b, %.6s)
8196>>0x2A	byte	0	\b)
8197
8198# 2048-byte sector version.
81990	string	SEGA\ SEGASATURN\ 	Sega Saturn disc image
8200!:mime	application/x-saturn-rom
8201>0	use	sega-saturn-disc-header
8202>0	byte	x			(2048-byte sectors)
8203# 2352-byte sector version.
82040x10	string	SEGA\ SEGASATURN\ 	Sega Saturn disc image
8205!:mime	application/x-saturn-rom
8206>0x10	use	sega-saturn-disc-header
8207>0	byte	x			(2352-byte sectors)
8208
8209#------------------------------------------------------------------------------
8210# dreamcast: file(1) magic for the Sega Dreamcast disc image format.
8211# From: David Korth <gerbilsoft@gerbilsoft.com>
8212# Reference: https://mc.pp.se/dc/ip0000.bin.html
8213#
8214
8215# Common Sega Dreamcast disc header format.
8216# NOTE: Title is 128 bytes, but we're only showing 32 due to space padding.
8217# TODO: Release date, device information, region code, others?
82180	name	sega-dreamcast-disc-header
8219>0x80	string	>\0	\b: "%.32s"
8220>0x40	string	>\0	(%.10s
8221>>0x4A	string	>\0	\b, %.6s)
8222>>0x4A	byte	0	\b)
8223
8224# 2048-byte sector version.
82250	string	SEGA\ SEGAKATANA\ 	Sega Dreamcast disc image
8226!:mime	application/x-dc-rom
8227>0	use	sega-dreamcast-disc-header
8228>0	byte	x			(2048-byte sectors)
8229# 2352-byte sector version.
82300x10	string	SEGA\ SEGAKATANA\ 	Sega Dreamcast disc image
8231!:mime	application/x-dc-rom
8232>0x10	use	sega-dreamcast-disc-header
8233>0	byte	x			(2352-byte sectors)
8234
8235#------------------------------------------------------------------------------
8236# dreamcast:  file(1) uncertain magic for the Sega Dreamcast VMU image format
8237#
82380 belong 0x21068028   Sega Dreamcast VMU game image
82390 string LCDi         Dream Animator file
8240
8241#------------------------------------------------------------------------------
8242# z64: file(1) magic for the Z64 format N64 ROM dumps
8243# Reference: http://forum.pj64-emu.com/showthread.php?t=2239
8244# From: David Korth <gerbilsoft@gerbilsoft.com>
8245#
82460	bequad	0x803712400000000F	Nintendo 64 ROM image
8247!:mime	application/x-n64-rom
8248>0x20	string	>\0	\b: "%.20s"
8249>0x3B	string	x	(%.4s
8250>0x3F	byte	x	\b, Rev.%02u)
8251
8252#------------------------------------------------------------------------------
8253# v64: file(1) magic for the V64 format N64 ROM dumps
8254# Same as z64 format, but with 16-bit byteswapping.
8255#
82560	bequad	0x3780401200000F00	Nintendo 64 ROM image (V64)
8257!:mime	application/x-n64-rom
8258
8259#------------------------------------------------------------------------------
8260# n64-swap2: file(1) magic for the swap2 format N64 ROM dumps
8261# Same as z64 format, but with swapped 16-bit words.
8262#
82630	bequad	0x12408037000F0000	Nintendo 64 ROM image (wordswapped)
8264!:mime	application/x-n64-rom
8265
8266#------------------------------------------------------------------------------
8267# n64-le32: file(1) magic for the 32-bit byteswapped format N64 ROM dumps
8268# Same as z64 format, but with 32-bit byteswapping.
8269#
82700	bequad	0x401237800F000000	Nintendo 64 ROM image (32-bit byteswapped)
8271!:mime	application/x-n64-rom
8272
8273#------------------------------------------------------------------------------
8274# gba: file(1) magic for the Nintendo Game Boy Advance raw ROM format
8275# Reference: https://problemkaputt.de/gbatek.htm#gbacartridgeheader
8276#
8277# Original version from: "Nelson A. de Oliveira" <naoliv@gmail.com>
8278# Updated version from: David Korth <gerbilsoft@gerbilsoft.com>
8279#
82804	bequad	0x24FFAE51699AA221	Game Boy Advance ROM image
8281!:mime	application/x-gba-rom
8282>0xA0	string	>\0	\b: "%.12s"
8283>0xAC	string	x	(%.6s
8284>0xBC	byte	x	\b, Rev.%02u)
8285
8286#------------------------------------------------------------------------------
8287# nds: file(1) magic for the Nintendo DS(i) raw ROM format
8288# Reference: https://problemkaputt.de/gbatek.htm#dscartridgeheader
8289#
8290# Original version from: "Nelson A. de Oliveira" <naoliv@gmail.com>
8291# Updated version from: David Korth <gerbilsoft@gerbilsoft.com>
8292#
82930xC0	bequad	0x24FFAE51699AA221	Nintendo DS ROM image
8294!:mime	application/x-nintendo-ds-rom
8295>0x00	string	>\0		\b: "%.12s"
8296>0x0C	string	x		(%.6s
8297>0x1E	byte	x		\b, Rev.%02u)
8298>0x12	byte	2		(DSi enhanced)
8299>0x12	byte	3		(DSi only)
8300# Secure Area check.
8301>0x20		lelong	<0x4000		(homebrew)
8302>0x20		lelong	>0x3FFF
8303>>0x4000	lequad	0x0000000000000000	(multiboot)
8304>>0x4000	lequad	!0x0000000000000000
8305>>>0x4000	lequad	0xE7FFDEFFE7FFDEFF	(decrypted)
8306>>>0x4000	lequad	!0xE7FFDEFFE7FFDEFF
8307>>>>0x1000	lequad	0x0000000000000000	(encrypted)
8308>>>>0x1000	lequad	!0x0000000000000000	(mask ROM)
8309
8310#------------------------------------------------------------------------------
8311# nds_passme: file(1) magic for Nintendo DS ROM images for GBA cartridge boot.
8312# This is also used for loading .nds files using the MSET exploit on 3DS.
8313# Reference: https://github.com/devkitPro/ndstool/blob/master/source/ndscreate.cpp
83140xC0	bequad	0xC8604FE201708FE2	Nintendo DS Slot-2 ROM image (PassMe)
8315!:mime	application/x-nintendo-ds-rom
8316
8317#------------------------------------------------------------------------------
8318# ngp: file(1) magic for the Neo Geo Pocket (Color) raw ROM format.
8319# From: David Korth <gerbilsoft@gerbilsoft.com>
8320# References:
8321# - https://neogpc.googlecode.com/svn-history/r10/trunk/src/core/neogpc.cpp
8322# - https://www.devrs.com/ngp/files/ngpctech.txt
8323#
83240x0A	string	BY\ SNK\ CORPORATION	Neo Geo Pocket
8325!:mime	application/x-neo-geo-pocket-rom
8326>0x23	byte	0x10			Color
8327>0	byte	x			ROM image
8328>0x24	string	>\0			\b: "%.12s"
8329>0x1F	byte	0xFF			(debug mode enabled)
8330
8331#------------------------------------------------------------------------------
8332# msx: file(1) magic for MSX game cartridge dumps
8333# Too simple - MPi
8334#0 beshort 0x4142 MSX game cartridge dump
8335
8336#------------------------------------------------------------------------------
8337# Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) :
83380	string	PS-X\ EXE	Sony Playstation executable
8339>16	lelong	x		PC=0x%08x,
8340>20	lelong	!0		GP=0x%08x,
8341>24	lelong	!0		.text=[0x%08x,
8342>>28	lelong	x		\b0x%x],
8343>32	lelong	!0		.data=[0x%08x,
8344>>36	lelong	x		\b0x%x],
8345>40	lelong	!0		.bss=[0x%08x,
8346>>44	lelong	x		\b0x%x],
8347>48	lelong	!0		Stack=0x%08x,
8348>48	lelong	=0		No Stack!,
8349>52	lelong	!0		StackSize=0x%x,
8350#>76	string	>\0		(%s)
8351#  Area:
8352>113	string	x		(%s)
8353
8354# CPE executables
83550	string	CPE		CPE executable
8356>3	byte	x		(version %d)
8357
8358#------------------------------------------------------------------------------
8359# Microsoft Xbox executables .xbe (Esa Hyytia <ehyytia@cc.hut.fi>)
83600	string	XBEH	Microsoft Xbox executable
8361!:mime	audio/x-xbox-executable
8362!:ext	xbe
8363# expect base address of 0x10000
8364>0x0104                 ulelong =0x10000
8365>>(0x0118.l-0x0FFF4)    lestring16 x       \b: "%.40s"
8366>>(0x0118.l-0x0FFF5)    byte     x         (%c
8367>>(0x0118.l-0x0FFF6)    byte     x         \b%c-
8368>>(0x0118.l-0x0FFF8)    uleshort x         \b%03u)
8369>>(0x0118.l-0x0FF60)    ulelong&0x80000007  0x80000007 \b, all regions
8370>>(0x0118.l-0x0FF60)    ulelong&0x80000007  !0x80000007
8371>>>(0x0118.l-0x0FF60)   ulelong >0           (regions:
8372>>>>(0x0118.l-0x0FF60)  ulelong &0x00000001  NA
8373>>>>(0x0118.l-0x0FF60)  ulelong &0x00000002  Japan
8374>>>>(0x0118.l-0x0FF60)  ulelong &0x00000004  Rest_of_World
8375>>>>(0x0118.l-0x0FF60)  ulelong &0x80000000  Manufacturer
8376>>>(0x0118.l-0x0FF60)   ulelong >0           \b)
8377# probabilistic checks whether signed or not
8378>0x0004 ulelong =0x0
8379>>&2    ulelong =0x0
8380>>>&2   ulelong =0x0  \b, not signed
8381>0x0004 ulelong >0
8382>>&2    ulelong >0
8383>>>&2   ulelong >0    \b, signed
8384
8385# --------------------------------
8386# Microsoft Xbox data file formats
83870       string          XIP0            XIP, Microsoft Xbox data
83880       string          XTF0            XTF, Microsoft Xbox data
8389
8390#------------------------------------------------------------------------------
8391# Microsoft Xbox 360 executables (.xex)
8392# From: David Korth <gerbilsoft@gerbilsoft.com>
8393# References:
8394# - https://free60project.github.io/wiki/XEX.html
8395# - https://github.com/xenia-project/xenia/blob/HEAD/src/xenia/kernel/util/xex2_info.h
8396
8397# Title ID (part of Execution ID section)
83980		name	xbox-360-xex-execution-id
8399>(0.L+0xC)	byte	x	(%c
8400>(0.L+0xD)	byte	x	\b%c
8401>(0.L+0xE)	beshort	x	\b-%04u, media ID:
8402>(0.L)		belong	x	%08X)
8403
8404# Region code (part of Security Info)
84050	name	xbox-360-xex-region-code
8406>0	ubelong	0xFFFFFFFF	\b, all regions
8407>0	ubelong	!0xFFFFFFFF
8408>>0	ubelong	>0		(regions:
8409>>0	ubelong&0x000000FF	0x000000FF	USA
8410>>0	ubelong&0x00000100	0x00000100	Japan
8411>>0	ubelong&0x00000200	0x00000200	China
8412>>0	ubelong&0x0000FC00	0x0000FC00	Asia
8413>>0	ubelong&0x00FF0000	0x00FF0000	PAL
8414>>0	ubelong&0x00FF0000	0x00FE0000	PAL [except AU/NZ]
8415>>0	ubelong&0x00FF0000	0x00010000	AU/NZ
8416>>0	ubelong&0xFF000000	0xFF000000	Other
8417>>0	ubelong	>0		\b)
8418
84190	string	XEX2	Microsoft Xbox 360 executable
8420!:mime	audio/x-xbox360-executable
8421!:ext	xex
8422>0x18	search/0x100	\x00\x04\x00\x06
8423>>&0	use	xbox-360-xex-execution-id
8424>(0x010.L+0x178)	use	xbox-360-xex-region-code
8425
84260	string	XEX1	Microsoft Xbox 360 executable (XEX1)
8427!:mime	audio/x-xbox360-executable
8428!:ext	xex
8429>0x18	search/0x100	\x00\x04\x00\x06
8430>>&0	use	xbox-360-xex-execution-id
8431>(0x010.L+0x154)	use	xbox-360-xex-region-code
8432
8433#------------------------------------------------------------------------------
8434# Microsoft Xbox 360 packages
8435# From: David Korth <gerbilsoft@gerbilsoft.com>
8436# References:
8437# - https://free60project.github.io/wiki/STFS.html
8438# - https://github.com/xenia-project/xenia/blob/HEAD/src/xenia/kernel/util/xex2_info.h
8439
8440# TODO: More information for console-signed packages.
8441
84420	name	xbox-360-package
8443>0x360	byte	x	(%c
8444>0x361	byte	x	\b%c
8445>0x362	beshort	x	\b-%04u, media ID:
8446>0x354	belong	x	%08X)
8447>0x344	belong	x	\b, content type:
8448>>0x344	belong	0x1		Saved Game
8449>>0x344	belong	0x2		Marketplace Content
8450>>0x344	belong	0x3		Publisher
8451>>0x344	belong	0x1000		Xbox 360 Title
8452>>0x344	belong	0x2000		IPTV Pause Buffer
8453>>0x344	belong	0x4000		Installed Game
8454>>0x344	belong	0x5000		Original Xbox Game
8455>>0x344	belong	0x9000		Avatar Item
8456>>0x344	belong	0x10000		Profile
8457>>0x344	belong	0x20000		Gamer Picture
8458>>0x344	belong	0x30000		Theme
8459>>0x344	belong	0x40000		Cache File
8460>>0x344	belong	0x50000		Storage Download
8461>>0x344	belong	0x60000		Xbox Saved Game
8462>>0x344	belong	0x70000		Xbox Download
8463>>0x344	belong	0x80000		Game Demo
8464>>0x344	belong	0x90000		Video
8465>>0x344	belong	0xA0000		Game
8466>>0x344	belong	0xB0000		Installer
8467>>0x344	belong	0xC0000		Game Trailer
8468>>0x344	belong	0xD0000		Arcade Title
8469>>0x344	belong	0xE0000		XNA
8470>>0x344	belong	0xF0000		License Store
8471>>0x344	belong	0x100000	Movie
8472>>0x344	belong	0x200000	TV
8473>>0x344	belong	0x300000	Music Video
8474>>0x344	belong	0x400000	Game Video
8475>>0x344	belong	0x500000	Podcast Video
8476>>0x344	belong	0x600000	Viral Video
8477>>0x344	belong	0x2000000	Community Game
8478
84790	string	CON\x20	Microsoft Xbox 360 package (console-signed)
8480>0	use	xbox-360-package
84810	string	PIRS
8482>0	belong	0	Microsoft Xbox 360 package (non-Xbox Live)
8483>>0	use	xbox-360-package
84840	string	LIVE
8485>0x104	belong	0	Microsoft Xbox 360 package (Xbox Live)
8486>>0	use	xbox-360-package
8487
8488# Atari Lynx cartridge dump (EXE/BLL header)
8489# From: "Stefan A. Haubenthal" <polluks@web.de>
8490
8491# Double-check that the image type matches too, 0x8008 conflicts with
8492# 8 character OMF-86 object file headers.
84930	beshort		0x8008
8494>6	string		BS93		Lynx homebrew cartridge
8495!:mime	application/x-atari-lynx-rom
8496>>2	beshort		x		\b, RAM start $%04x
8497>6	string		LYNX		Lynx cartridge
8498!:mime	application/x-atari-lynx-rom
8499>>2	beshort		x		\b, RAM start $%04x
8500
8501# Opera file system that is used on the 3DO console
8502# From: Serge van den Boom <svdb@stack.nl>
85030	string		\x01ZZZZZ\x01	3DO "Opera" file system
8504
8505# From: Alex Myczko <alex@aiei.ch>
8506# From: David Pflug <david@pflug.email>
8507# is the offset 12 or the offset 16 correct?
8508# GBS (Game Boy Sound) magic
8509# ftp://ftp.modland.com/pub/documents/format_documentation/\
8510# Gameboy%20Sound%20System%20(.gbs).txt
85110	string		GBS		Nintendo Gameboy Music/Audio Data
8512#12	string		GameBoy\ Music\ Module	Nintendo Gameboy Music Module
8513>16	string		>\0	("%.32s" by
8514>48	string		>\0	%.32s, copyright
8515>80	string		>\0	%.32s),
8516>3	byte		x	version %u,
8517>4	byte		x	%u tracks
8518
8519# IPS Patch Files from: From: Thomas Klausner <tk@giga.or.at>
8520# see https://zerosoft.zophar.net/ips.php
85210	string	PATCH			IPS patch file
8522!:ext	ips
8523
8524# BPS Patch Files - from: David Korth <gerbilsoft@gerbilsoft.com>
8525# Reference: https://www.romhacking.net/documents/746/
85260	string	BPS1			BPS patch file
8527!:ext	bps
8528
8529# APS Patch Files - from: David Korth <gerbilsoft@gerbilsoft.com>
8530# Reference: https://github.com/btimofeev/UniPatcher/wiki/APS-(N64)
85310	string	APS10			APS patch file
8532!:ext	aps
8533>5	byte	0			\b, simple patch
8534>5	byte	1			\b, N64-specific patch for
8535>>58	byte	x			N%c
8536>>59	byte	x			\b%c
8537>>60	byte	x			\b%c
8538>7	byte	!0x20
8539# FIXME: /T specifier isn't working with a fixed-length string.
8540>>7	string	x			\b: "%.50s"
8541
8542# UPS Patch Files - from: David Korth <gerbilsoft@gerbilsoft.com>
8543# Reference: http://fileformats.archiveteam.org/wiki/UPS_(binary_patch_format)
85440	string	UPS1			UPS patch file
8545!:ext	ups
8546
8547# Playstations Patch Files from: From: Thomas Klausner <tk@giga.or.at>
85480	string	PPF30			Playstation Patch File version 3.0
8549>5	byte	0			\b, PPF 1.0 patch
8550>5	byte	1			\b, PPF 2.0 patch
8551>5	byte	2			\b, PPF 3.0 patch
8552>>56	byte	0			\b, Imagetype BIN (any)
8553>>56	byte	1			\b, Imagetype GI (PrimoDVD)
8554>>57	byte	0			\b, Blockcheck disabled
8555>>57	byte	1			\b, Blockcheck enabled
8556>>58	byte	0			\b, Undo data not available
8557>>58	byte	1			\b, Undo data available
8558>6	string	x			\b, description: %s
8559
85600	string	PPF20			Playstation Patch File version 2.0
8561>5	byte	0			\b, PPF 1.0 patch
8562>5	byte	1			\b, PPF 2.0 patch
8563>>56	lelong	>0			\b, size of file to patch %d
8564>6	string	x			\b, description: %s
8565
85660	string	PPF10			Playstation Patch File version 1.0
8567>5	byte	0			\b, Simple Encoding
8568>6	string	x			\b, description: %s
8569
8570# From: Daniel Dawson <ddawson@icehouse.net>
8571# SNES9x .smv "movie" file format.
85720		string		SMV\x1A	SNES9x input recording
8573>0x4		lelong		x	\b, version %d
8574# version 4 is latest so far
8575>0x4		lelong		<5
8576>>0x8		ledate		x	\b, recorded at %s
8577>>0xc		lelong		>0	\b, rerecorded %d times
8578>>0x10		lelong		x	\b, %d frames long
8579>>0x14		byte		>0	\b, data for controller(s):
8580>>>0x14		byte		&0x1	#1
8581>>>0x14		byte		&0x2	#2
8582>>>0x14		byte		&0x4	#3
8583>>>0x14		byte		&0x8	#4
8584>>>0x14		byte		&0x10	#5
8585>>0x15		byte		^0x1	\b, begins from snapshot
8586>>0x15		byte		&0x1	\b, begins from reset
8587>>0x15		byte		^0x2	\b, NTSC standard
8588>>0x15		byte		&0x2	\b, PAL standard
8589>>0x17		byte		&0x1    \b, settings:
8590# WIP1Timing not used as of version 4
8591>>>0x4		lelong		<4
8592>>>>0x17	byte		&0x2	WIP1Timing
8593>>>0x17		byte		&0x4	Left+Right
8594>>>0x17		byte		&0x8	VolumeEnvX
8595>>>0x17		byte		&0x10	FakeMute
8596>>>0x17		byte		&0x20	SyncSound
8597# New flag as of version 4
8598>>>0x4		lelong		>3
8599>>>>0x17	byte		&0x80	NoCPUShutdown
8600>>0x4		lelong		<4
8601>>>0x18		lelong		>0x23
8602>>>>0x20	leshort		!0
8603>>>>>0x20	lestring16	x	\b, metadata: "%s"
8604>>0x4		lelong		>3
8605>>>0x24		byte		>0	\b, port 1:
8606>>>>0x24	byte		1	joypad
8607>>>>0x24	byte		2	mouse
8608>>>>0x24	byte		3	SuperScope
8609>>>>0x24	byte		4	Justifier
8610>>>>0x24	byte		5	multitap
8611>>>0x24		byte		>0	\b, port 2:
8612>>>>0x25	byte		1	joypad
8613>>>>0x25	byte		2	mouse
8614>>>>0x25	byte		3	SuperScope
8615>>>>0x25	byte		4	Justifier
8616>>>>0x25	byte		5	multitap
8617>>>0x18		lelong		>0x43
8618>>>>0x40	leshort		!0
8619>>>>>0x40	lestring16	x	\b, metadata: "%s"
8620>>0x17		byte		&0x40   \b, ROM:
8621>>>(0x18.l-26)	lelong		x	CRC32 0x%08x
8622>>>(0x18.l-23)	string		x	"%s"
8623
8624# Type: scummVM savegame files
8625# From: Sven Hartge <debian@ds9.argh.org>
86260	string	SCVM	ScummVM savegame
8627>12	string	>\0	"%s"
8628
8629#------------------------------------------------------------------------------
8630# Nintendo GameCube / Wii file formats.
8631#
8632
8633# Type: Nintendo GameCube/Wii common disc header data.
8634# From: David Korth <gerbilsoft@gerbilsoft.com>
8635# Reference: https://wiibrew.org/wiki/Wii_Disc
86360	name	nintendo-gcn-disc-common
8637>0x20	string	x	"%.64s"
8638>0x00	string	x	(%.6s
8639>0x06	byte	>0
8640>>0x06	byte	1	\b, Disc 2
8641>>0x06	byte	2	\b, Disc 3
8642>>0x06	byte	3	\b, Disc 4
8643>0x07	byte	x	\b, Rev.%02u)
8644>0x18	belong	0x5D1C9EA3
8645>>0x60	beshort	0x0101	\b (Unencrypted)
8646>0x200	string	NKIT	\b (NKit compressed)
8647
8648
8649# Type: Nintendo GameCube disc image
8650# From: David Korth <gerbilsoft@gerbilsoft.com>
8651# Reference: https://wiibrew.org/wiki/Wii_Disc
86520x1C	belong	0xC2339F3D	Nintendo GameCube disc image:
8653!:mime	application/x-gamecube-rom
8654>0	use	nintendo-gcn-disc-common
8655
8656# Type: Nintendo GameCube embedded disc image
8657# Commonly found on demo discs.
8658# From: David Korth <gerbilsoft@gerbilsoft.com>
8659# Reference: http://hitmen.c02.at/files/yagcd/yagcd/index.html#idx14.8
86600		belong	0xAE0F38A2
8661>0x0C		belong	0x00100000
8662>>(8.L+0x1C)	belong	0xC2339F3D	Nintendo GameCube embedded disc image:
8663!:mime	application/x-gamecube-rom
8664>>>(8.L)	use	nintendo-gcn-disc-common
8665
8666# Type: Nintendo Wii disc image
8667# From: David Korth <gerbilsoft@gerbilsoft.com>
8668# Reference: https://wiibrew.org/wiki/Wii_Disc
86690x18	belong	0x5D1C9EA3	Nintendo Wii disc image:
8670>0	use	nintendo-gcn-disc-common
8671
8672# Type: Nintendo Wii disc image (WBFS format)
8673# From: David Korth <gerbilsoft@gerbilsoft.com>
8674# Reference: https://wiibrew.org/wiki/Wii_Disc
86750	string	WBFS
8676>0x218	belong	0x5D1C9EA3	Nintendo Wii disc image (WBFS format):
8677!:mime	application/x-wii-rom
8678>>0x200	use	nintendo-gcn-disc-common
8679
8680# Type: Nintendo GameCube/Wii disc image (CISO format)
8681# NOTE: This is NOT the same as Compact ISO or PSP CISO,
8682# though it has the same magic number.
86830		string	CISO
8684# Other fields are used to determine what type of CISO this is:
8685# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size)
8686# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size)
8687# - None of the above: Compact ISO.
8688>4		lelong	0x200000
8689>>8		byte	1
8690>>>0x801C	belong	0xC2339F3D	Nintendo GameCube disc image (CISO format):
8691!:mime	application/x-wii-rom
8692>>>>0x8000	use	nintendo-gcn-disc-common
8693>>>0x8018	belong	0x5D1C9EA3	Nintendo Wii disc image (CISO format):
8694!:mime	application/x-wii-rom
8695>>>>0x8000	use	nintendo-gcn-disc-common
8696
8697# Type: Nintendo GameCube/Wii disc image (GCZ format)
8698# Due to zlib compression, we can't get the actual disc information.
86990	lelong	0xB10BC001
8700>4	lelong	0		Nintendo GameCube disc image (GCZ format)
8701!:mime	application/x-gamecube-rom
8702>4	lelong	1		Nintendo Wii disc image (GCZ format)
8703!:mime	application/x-wii-rom
8704>4	default	x		Nintendo GameCube/Wii disc image (GCZ format)
8705
8706# Type: Nintendo GameCube/Wii disc image (WDF format)
87070		string	WII\001DISC
8708>8		belong	1
8709# WDFv1
8710>>0x54		belong	0xC2339F3D	Nintendo GameCube disc image (WDFv1 format):
8711!:mime	application/x-gamecube-rom
8712>>>0x38		use	nintendo-gcn-disc-common
8713>>0x58		belong	0x5D1C9EA3	Nintendo Wii disc image (WDFv1 format):
8714!:mime	application/x-wii-rom
8715>>>0x38		use	nintendo-gcn-disc-common
8716>8		belong	2
8717# WDFv2
8718>>(12.L+0x1C)	belong	0xC2339F3D	Nintendo GameCube disc image (WDFv2 format):
8719!:mime	application/x-gamecube-rom
8720>>>(12.L)	use	nintendo-gcn-disc-common
8721>>(12.L+0x18)	belong	0x5D1C9EA3	Nintendo Wii disc image (WDFv2 format):
8722!:mime	application/x-wii-rom
8723>>>(12.L)	use	nintendo-gcn-disc-common
8724
8725# Type: Nintendo GameCube/Wii disc image (WIA format)
87260	string	WIA\001	Nintendo
8727>0x48	belong	1	GameCube
8728!:mime	application/x-gamecube-rom
8729>0x48	belong	2	Wii
8730!:mime	application/x-wii-rom
8731>0x48	default	x	GameCube/Wii
8732>0x48	belong	x	disc image (WIA format):
8733>>0x58	use	nintendo-gcn-disc-common
8734
8735# Type: Nintendo GameCube/Wii disc image (with SDK header)
8736# From: David Korth <gerbilsoft@gerbilsoft.com>
8737# Reference: https://wiibrew.org/wiki/Wii_Disc
87380		belong	0xFFFF0000
8739>0x18		belong	0x00000000
8740>>0x1C		belong	0x00000000
8741>>>0x8018	belong	0x5D1C9EA3	Nintendo Wii SDK disc image:
8742!:mime	application/x-wii-rom
8743>>>>0x8000	use	nintendo-gcn-disc-common
8744>>>0x801C	belong	0xC2339F3D	Nintendo GameCube SDK disc image:
8745!:mime	application/x-gamecube-rom
8746>>>>0x8000	use	nintendo-gcn-disc-common
8747
8748#------------------------------------------------------------------------------
8749# Nintendo 3DS file formats.
8750#
8751
8752# Type: Nintendo 3DS "NCSD" image. (game cards and eMMC)
8753# From: David Korth <gerbilsoft@gerbilsoft.com>
8754# Reference: https://www.3dbrew.org/wiki/NCSD
87550x100		string		NCSD
8756>0x118		lequad		0		Nintendo 3DS Game Card image
8757# NCCH header for partition 0. (game data)
8758>>0x1150	string		>\0	\b: "%.16s"
8759>>0x312		byte		x	(Rev.%02u)
8760>>0x118C	byte		2	(New3DS only)
8761>>0x18D		byte		0		(inner device)
8762>>0x18D		byte		1		(Card1)
8763>>0x18D		byte		2		(Card2)
8764>>0x18D		byte		3		(extended device)
8765>0x118		bequad		0x0102020202000000	Nintendo 3DS eMMC dump (Old3DS)
8766>0x118		bequad		0x0102020203000000	Nintendo 3DS eMMC dump (New3DS)
8767
8768# Nintendo 3DS version code.
8769# Reference: https://www.3dbrew.org/wiki/Titles
8770# Format: leshort containing three fields:
8771# - 6-bit: Major
8772# - 6-bit: Minor
8773# - 4-bit: Revision
8774# NOTE: Only supporting major/minor versions from 0-15 right now.
8775# NOTE: Should be prefixed with "v".
87760	name	nintendo-3ds-version-code
8777# Raw version.
8778>0	leshort	x	\b%u,
8779# Major version.
8780>0	leshort&0xFC00	0x0000	0
8781>0	leshort&0xFC00	0x0400	1
8782>0	leshort&0xFC00	0x0800	2
8783>0	leshort&0xFC00	0x0C00	3
8784>0	leshort&0xFC00	0x1000	4
8785>0	leshort&0xFC00	0x1400	5
8786>0	leshort&0xFC00	0x1800	6
8787>0	leshort&0xFC00	0x1C00	7
8788>0	leshort&0xFC00	0x2000	8
8789>0	leshort&0xFC00	0x2400	9
8790>0	leshort&0xFC00	0x2800	10
8791>0	leshort&0xFC00	0x2C00	11
8792>0	leshort&0xFC00	0x3000	12
8793>0	leshort&0xFC00	0x3400	13
8794>0	leshort&0xFC00	0x3800	14
8795>0	leshort&0xFC00	0x3C00	15
8796# Minor version.
8797>0	leshort&0x03F0	0x0000	\b.0
8798>0	leshort&0x03F0	0x0010	\b.1
8799>0	leshort&0x03F0	0x0020	\b.2
8800>0	leshort&0x03F0	0x0030	\b.3
8801>0	leshort&0x03F0	0x0040	\b.4
8802>0	leshort&0x03F0	0x0050	\b.5
8803>0	leshort&0x03F0	0x0060	\b.6
8804>0	leshort&0x03F0	0x0070	\b.7
8805>0	leshort&0x03F0	0x0080	\b.8
8806>0	leshort&0x03F0	0x0090	\b.9
8807>0	leshort&0x03F0	0x00A0	\b.10
8808>0	leshort&0x03F0	0x00B0	\b.11
8809>0	leshort&0x03F0	0x00C0	\b.12
8810>0	leshort&0x03F0	0x00D0	\b.13
8811>0	leshort&0x03F0	0x00E0	\b.14
8812>0	leshort&0x03F0	0x00F0	\b.15
8813# Revision.
8814>0	leshort&0x000F	x	\b.%u
8815
8816# Type: Nintendo 3DS "NCCH" container.
8817# https://www.3dbrew.org/wiki/NCCH
88180x100		string	NCCH	Nintendo 3DS
8819>0x18D		byte&2	0	File Archive (CFA)
8820>0x18D		byte&2	2	Executable Image (CXI)
8821>0x150		string	>\0	\b: "%.16s"
8822>0x18D		byte	0x05
8823>>0x10E		leshort	x	(Old3DS System Update v
8824>>0x10E		use	nintendo-3ds-version-code
8825>>0x10E		leshort	x	\b)
8826>0x18D		byte	0x15
8827>>0x10E		leshort	x	(New3DS System Update v
8828>>0x10E		use	nintendo-3ds-version-code
8829>>0x10E		leshort	x	\b)
8830>0x18D		byte	!0x05
8831>>0x18D		byte	!0x15
8832>>>0x112	byte	x	(v
8833>>>0x112	use	nintendo-3ds-version-code
8834>>>0x112	byte	x	\b)
8835>0x18C		byte	2	(New3DS only)
8836
8837# Type: Nintendo 3DS "SMDH" file. (application description)
8838# From: David Korth <gerbilsoft@gerbilsoft.com>
8839# Reference: https://3dbrew.org/wiki/SMDH
88400		string		SMDH		Nintendo 3DS SMDH file
8841>0x208		leshort		!0
8842>>0x208		lestring16	x		\b: "%.128s"
8843>>0x388		leshort		!0
8844>>>0x388	lestring16	x		by %.128s
8845>0x208		leshort		0
8846>>0x008		leshort		!0
8847>>>0x008	lestring16	x		\b: "%.128s"
8848>>>0x188	leshort		!0
8849>>>>0x188	lestring16	x		by %.128s
8850
8851# Type: Nintendo 3DS Homebrew Application.
8852# From: David Korth <gerbilsoft@gerbilsoft.com>
8853# Reference: https://3dbrew.org/wiki/3DSX_Format
88540	string	3DSX	Nintendo 3DS Homebrew Application (3DSX)
8855
8856# Type: Nintendo 3DS Banner Model Data.
8857# From: David Korth <gerbilsoft@gerbilsoft.com>
8858# Reference: https://3dbrew.org/wiki/CBMD
88590	string	CBMD\0\0\0\0	Nintendo 3DS Banner Model Data
8860
8861#------------------------------------------------------------------------------
8862# a7800: file(1) magic for the Atari 7800 raw ROM format.
8863# From: David Korth <gerbilsoft@gerbilsoft.com>
8864# Reference: https://sites.google.com/site/atari7800wiki/a78-header
8865
88660	byte	>0
8867>0	byte	<3
8868>>1	string	ATARI7800	Atari 7800 ROM image
8869!:mime	application/x-atari-7800-rom
8870>>>0x11	string	>\0	\b: "%.32s"
8871# Display type.
8872>>>0x39	byte	0	(NTSC)
8873>>>0x39	byte	1	(PAL)
8874>>>0x36	byte&1	1	(POKEY)
8875
8876#------------------------------------------------------------------------------
8877# vectrex: file(1) magic for the GCE Vectrex raw ROM format.
8878# From: David Korth <gerbilsoft@gerbilsoft.com>
8879# Reference: http://www.playvectrex.com/designit/chrissalo/hello1.htm
8880#
8881# NOTE: Title is terminated with 0x80, not 0.
8882# The header is terminated with a 0, so that will
8883# terminate the title as well.
8884#
88850	string	g\ GCE	Vectrex ROM image
8886>0x11	string	>\0	\b: "%.16s"
8887
8888#------------------------------------------------------------------------------
8889# amiibo: file(1) magic for Nintendo amiibo NFC dumps.
8890# From: David Korth <gerbilsoft@gerbilsoft.com>
8891# Reference: https://www.3dbrew.org/wiki/Amiibo
88920x00		byte	0x04
8893>0x0A		beshort	0x0FE0
8894>>0x0C		belong	0xF110FFEE
8895>>>0x208	beshort	0x0100
8896>>>>0x020A	byte	0x0F
8897>>>>>0x020C	bequad	0x000000045F000000
8898>>>>>>0x5B	byte	0x02
8899>>>>>>>0x54	belong	x	Nintendo amiibo NFC dump - amiibo ID: %08X-
8900>>>>>>>0x58	belong	x	\b%08X
8901
8902#------------------------------------------------------------------------------
8903# Type: Nintendo Switch XCI (Game Cartridge Image)
8904# From: Benjamin Lowry <ben@ben.gmbh>
8905# Reference: https://switchbrew.org/wiki/Gamecard_Format
89060x100		string	HEAD
8907>0x10D		byte	0xFA	Nintendo Switch cartridge image (XCI), 1GB
8908>0x10D		byte	0xF8	Nintendo Switch cartridge image (XCI), 2GB
8909>0x10D		byte	0xF0	Nintendo Switch cartridge image (XCI), 4GB
8910>0x10D		byte	0xE0	Nintendo Switch cartridge image (XCI), 8GB
8911>0x10D		byte	0xE1	Nintendo Switch cartridge image (XCI), 16GB
8912>0x10D		byte	0xE2	Nintendo Switch cartridge image (XCI), 32GB
8913
8914#------------------------------------------------------------------------------
8915# Type: Nintendo Switch Executable
8916# From: Benjamin Lowry <ben@ben.gmbh>
8917# Reference: https://switchbrew.org/wiki/NSO
89180x00		string	NSO0	Nintendo Switch executable (NSO)
8919
8920#------------------------------------------------------------------------------
8921# Type: Nintendo Switch PFS0
8922# From: Benjamin Lowry <ben@ben.gmbh>
8923# Reference: https://switchbrew.org/wiki/NCA_Format#PFS0
89240x00		string	PFS0	Nintendo Switch partition filesystem (PFS0)
8925>0x04		ulelong	x	\b, %d files
8926
8927#------------------------------------------------------------------------------
8928# amiibo: file(1) magic for Nintendo Badge Arcade files.
8929# From: David Korth <gerbilsoft@gerbilsoft.com>
8930# References:
8931# - https://github.com/GerbilSoft/rom-properties/issues/92
8932# - https://github.com/CaitSith2/BadgeArcadeTool
8933# - https://github.com/TheMachinumps/Advanced-badge-editor
8934
8935# PRBS: Individual badge and/or mega badge.
89360		string	PRBS
8937>0x44		byte	>0x20	Nintendo Badge Arcade
8938>>0xB8		ulelong	<2
8939>>>0xBC		ulelong	<2	badge:
8940>>>0xBC		ulelong	>1	Mega Badge
8941>>>>0xB8	ulelong	x	(%ux
8942>>>>0xBC	ulelong	x	\b%u):
8943>>0xB8		ulelong	>1	Mega Badge
8944>>>0xB8		ulelong	x	(%ux
8945>>>0xBC		ulelong	x	\b%u):
8946>0x44		string	x	"%s"
8947>0x3C		ulelong	x	\b, badge ID: %u
8948>0x74		byte	>0x20
8949>>0x74		string	x	\b, set: "%s"
8950>0xA8		ulelong	!0xFFFFFFFF
8951>>0xA8		ulelong	x	\b, launch title ID: %08X
8952>>0xA4		ulelong	x	\b-%08X
8953
8954# CABS: Badge set.
89550	string	CABS
8956>0x2C	byte	>0x20	Nintendo Badge Arcade badge set:
8957>>0x2C	string	x	"%.48s"
8958>>0x24	ulelong	x	\b, set ID: %u
8959
8960#------------------------------------------------------------------------------
8961# sufami: file(1) magic for Sufami Turbo ROM images.
8962# From: David Korth <gerbilsoft@gerbilsoft.com>
8963# References:
8964# - https://problemkaputt.de/fullsnes.htm#snescartsufamiturbominicartridgeadaptor
89650	string		BANDAI\ SFC-ADX
8966>0x10	string		!SFC-ADX\ BACKUP	Sufami Turbo ROM image:
8967>>0x10	string/T	x	"%.14s"
8968>>0x30	byte		x	\b, ID %02X
8969>>0x31	byte		x	\b%02X
8970>>0x32	byte		x	\b%02X
8971>>0x33	ubyte		>0	\b, series index %u
8972>>0x34	ubyte		0	[SlowROM]
8973>>0x34	ubyte		1	[FastROM]
8974>>0x35	ubyte		1	[SRAM]
8975>>0x35	ubyte		3	[Special]
8976
8977# Type: Nintendo GameCube/Wii disc image (RVZ format)
89780	string		RVZ\001	Nintendo
8979>0x48	belong		1	GameCube
8980!:mime	application/x-gamecube-rom
8981>0x48	belong		2	Wii
8982!:mime	application/x-wii-rom
8983>0x48	default		x	GameCube/Wii
8984>0x48	belong		x	disc image (RVZ format):
8985>>0x58	use		nintendo-gcn-disc-common
8986
8987
8988#------------------------------------------------------------------------------
8989# $File: convex,v 1.8 2012/10/03 23:44:43 christos Exp $
8990# convex:  file(1) magic for Convex boxes
8991#
8992# Convexes are big-endian.
8993#
8994# /*\
8995#  * Below are the magic numbers and tests added for Convex.
8996#  * Added at beginning, because they are expected to be used most.
8997# \*/
89980	belong	0507	Convex old-style object
8999>16	belong	>0	not stripped
90000	belong	0513	Convex old-style demand paged executable
9001>16	belong	>0	not stripped
90020	belong	0515	Convex old-style pre-paged executable
9003>16	belong	>0	not stripped
90040	belong	0517	Convex old-style pre-paged, non-swapped executable
9005>16	belong	>0	not stripped
90060	belong	0x011257	Core file
9007#
9008# The following are a series of dump format magic numbers.  Each one
9009# corresponds to a drastically different dump format.  The first on is
9010# the original dump format on a 4.1 BSD or earlier file system.  The
9011# second marks the change between the 4.1 file system and the 4.2 file
9012# system.  The Third marks the changing of the block size from 1K
9013# to 2K to be compatible with an IDC file system.  The fourth indicates
9014# a dump that is dependent on Convex Storage Manager, because data in
9015# secondary storage is not physically contained within the dump.
9016# The restore program uses these number to determine how the data is
9017# to be extracted.
9018#
901924	belong	=60013	dump format, 4.2 or 4.3 BSD (IDC compatible)
902024	belong	=60014	dump format, Convex Storage Manager by-reference dump
9021#
9022# what follows is a bunch of bit-mask checks on the flags field of the opthdr.
9023# If there is no `=' sign, assume just checking for whether the bit is set?
9024#
90250	belong	0601		Convex SOFF
9026>88	belong&0x000f0000	=0x00000000	c1
9027>88	belong			&0x00010000	c2
9028>88	belong			&0x00020000	c2mp
9029>88	belong			&0x00040000	parallel
9030>88	belong			&0x00080000	intrinsic
9031>88	belong			&0x00000001	demand paged
9032>88	belong			&0x00000002	pre-paged
9033>88	belong			&0x00000004	non-swapped
9034>88	belong			&0x00000008	POSIX
9035#
9036>84	belong			&0x80000000	executable
9037>84	belong			&0x40000000	object
9038>84	belong&0x20000000	=0		not stripped
9039>84	belong&0x18000000	=0x00000000	native fpmode
9040>84	belong&0x18000000	=0x10000000	ieee fpmode
9041>84	belong&0x18000000	=0x18000000	undefined fpmode
9042#
90430	belong			0605		Convex SOFF core
9044#
90450	belong			0607		Convex SOFF checkpoint
9046>88	belong&0x000f0000	=0x00000000	c1
9047>88	belong			&0x00010000	c2
9048>88	belong			&0x00020000	c2mp
9049>88	belong			&0x00040000	parallel
9050>88	belong			&0x00080000	intrinsic
9051>88	belong			&0x00000008	POSIX
9052#
9053>84	belong&0x18000000	=0x00000000	native fpmode
9054>84	belong&0x18000000	=0x10000000	ieee fpmode
9055>84	belong&0x18000000	=0x18000000	undefined fpmode
9056
9057#------------------------------------------------------------------------------
9058# $File: coverage,v 1.3 2021/02/23 00:51:10 christos Exp $
9059# xoverage:  file(1) magic for test coverage data
9060
9061# File formats used to store test coverage data
9062# 2016-05-21, Georg Sauthoff <mail@georg.so>
9063
9064
9065# - GCC gcno - written by GCC at compile time when compiling with
9066# 	gcc -ftest-coverage
9067# - GCC gcda - written by a program that was compiled with
9068#	gcc -fprofile-arcs
9069# - LLVM raw profiles - generated by a program compiled with
9070#	clang -fprofile-instr-generate -fcoverage-mapping ...
9071# - LLVM indexed profiles - generated by
9072#	llvm-profdata
9073# - GCOV reports, i.e. the annotated source code
9074# - LCOV trace files, i.e. aggregated GCC profiles
9075#
9076# GCC coverage tracefiles
9077# .gcno file are created during compile time,
9078# while data collected during runtime is stored in .gcda files
9079# cf. gcov-io.h
9080# https://gcc.gnu.org/onlinedocs/gcc-5.3.0/gcc/Gcov-Data-Files.html
9081# Examples:
9082# Fedora 23/x86-64/gcc-5.3.1: 6f 6e 63 67 52 33 30 35
9083# Debian 8 PPC64/gcc-4.9.2  : 67 63 6e 6f 34 30 39 2a
90840	lelong	0x67636e6f	GCC gcno coverage (-ftest-coverage),
9085>&3	byte	x	version %c.
9086>&1	byte	x	\b%c
9087
9088# big endian
90890	belong	0x67636e6f	GCC gcno coverage (-ftest-coverage),
9090>&0	byte	x	version %c.
9091>&2	byte	x	\b%c (big-endian)
9092
9093# Examples:
9094# Fedora 23/x86-64/gcc-5.3.1: 61 64 63 67 52 33 30 35
9095# Debian 8 PPC64/gcc-4.9.2  : 67 63 64 61 34 30 39 2a
90960	lelong	0x67636461	GCC gcda coverage (-fprofile-arcs),
9097>&3	byte	x	version %c.
9098>&1	byte	x	\b%c
9099
9100# big endian
91010	belong	0x67636461	GCC gcda coverage (-fprofile-arcs),
9102>&0	byte	x	version %c.
9103>&2	byte	x	\b%c (big-endian)
9104
9105
9106# LCOV tracefiles
9107# cf. http://ltp.sourceforge.net/coverage/lcov/geninfo.1.php
91080	string	TN:
9109>&0	search/64	\nSF:/	LCOV coverage tracefile
9110
9111
9112# Coverage reports generated by gcov
9113# i.e. source code annotated with coverage information
91140	string	\x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Source:
9115>&0	search/128	\x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Graph:
9116>>&0	search/128	\x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Data:	GCOV coverage report
9117
9118
9119# LLVM coverage files
9120
9121# raw data after running a program compiled with:
9122# `clang -fprofile-instr-generate -fcoverage-mapping ...`
9123# default name: default.profraw
9124# magic is: \xFF lprofr \x81
9125# cf. https://llvm.org/docs/doxygen/html/InstrProfData_8inc_source.html
91260	lequad	0xff6c70726f667281	LLVM raw profile data,
9127>&0	byte	x	version %d
9128
9129# big endian
91300	bequad	0xff6c70726f667281	LLVM raw profile data,
9131>&7	byte	x	version %d (big-endian)
9132
9133
9134# LLVM indexed instruction profile (as generated by llvm-profdata)
9135# magic is: reverse(\xFF lprofi \x81)
9136# cf. https://llvm.org/docs/CoverageMappingFormat.html
9137# https://llvm.org/docs/doxygen/html/namespacellvm_1_1IndexedInstrProf.html
9138# https://llvm.org/docs/CommandGuide/llvm-cov.html
9139# https://llvm.org/docs/CommandGuide/llvm-profdata.html
91400	lequad	0x8169666f72706cff	LLVM indexed profile data,
9141>&0	byte	x	version %d
9142
9143# big endian
91440	bequad	0x8169666f72706cff	LLVM indexed profile data,
9145>&7	byte	x	version %d (big-endian)
9146
9147
9148#------------------------------------------------------------------------------
9149# $File: cracklib,v 1.7 2009/09/19 16:28:08 christos Exp $
9150# cracklib:  file (1) magic for cracklib v2.7
9151
91520	lelong	0x70775631	Cracklib password index, little endian
9153>4	long	>0		(%i words)
9154>4	long	0		("64-bit")
9155>>8	long	>-1		(%i words)
91560	belong	0x70775631	Cracklib password index, big endian
9157>4	belong	>-1		(%i words)
9158# really bellong 0x0000000070775631
91590	search/1	\0\0\0\0pwV1	Cracklib password index, big endian ("64-bit")
9160>12	belong	>0		(%i words)
9161
9162#------------------------------------------------------------------------------
9163# $File: crypto,v 1.2 2021/03/27 20:15:53 christos Exp $
9164# crypto:  file(1) magic for crypto formats
9165#
9166
9167# ----------------------------------------------------------------------------
9168# $File: ctags,v 1.6 2009/09/19 16:28:08 christos Exp $
9169# ctags:  file (1) magic for Exuberant Ctags files
9170# From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de>
91710	search/1	=!_TAG	Exuberant Ctags tag file text
9172
9173#--------------------------------------------------------------
9174# ctf:  file(1) magic for CTF (Common Trace Format) trace files
9175#
9176# Specs. available here: <https://www.efficios.com/ctf>
9177#--------------------------------------------------------------
9178
9179# CTF trace data
91800	lelong	0xc1fc1fc1	Common Trace Format (CTF) trace data (LE)
91810	belong	0xc1fc1fc1	Common Trace Format (CTF) trace data (BE)
9182
9183# CTF metadata (packetized)
91840	lelong	0x75d11d57	Common Trace Format (CTF) packetized metadata (LE)
9185>35	byte	x		\b, v%d
9186>36	byte	x		\b.%d
91870	belong	0x75d11d57	Common Trace Format (CTF) packetized metadata (BE)
9188>35	byte	x		\b, v%d
9189>36	byte	x		\b.%d
9190
9191# CTF metadata (plain text)
91920	string	/*\x20CTF\x20   Common Trace Format (CTF) plain text metadata
9193!:strength + 5			# this is to make sure we beat C
9194>&0	regex	[0-9]+\.[0-9]+	\b, v%s
9195
9196#------------------------------------------------------------------------------
9197# $File: cubemap,v 1.1 2012/06/06 13:03:20 christos Exp $
9198# file(1) magic(5) data for cubemaps  Martin Erik Werner <martinerikwerner@gmail.com>
9199#
92000	string	ACMP	Map file for the AssaultCube FPS game
92010	string	CUBE	Map file for cube and cube2 engine games
92020	string	MAPZ)	Map file for the Blood Frontier/Red Eclipse FPS games
9203
9204#------------------------------------------------------------------------------
9205# $File: cups,v 1.6 2019/04/19 00:42:27 christos Exp $
9206# Cups: file(1) magic for the cups raster file format
9207# From: Laurent Martelli <martellilaurent@gmail.com>
9208# https://www.cups.org/documentation.php/spec-raster.html
9209#
9210
92110	name		cups-le
9212>280	lelong		x		\b, %d
9213>284	lelong		x		\bx%d dpi
9214>376	lelong		x		\b, %dx
9215>380	lelong		x		\b%d pixels
9216>388	lelong		x		%d bits/color
9217>392	lelong		x		%d bits/pixel
9218>400	lelong		0		ColorOrder=Chunky
9219>400	lelong		1		ColorOrder=Banded
9220>400	lelong		2		ColorOrder=Planar
9221>404	lelong		0		ColorSpace=gray
9222>404	lelong		1		ColorSpace=RGB
9223>404	lelong		2		ColorSpace=RGBA
9224>404	lelong		3		ColorSpace=black
9225>404	lelong		4		ColorSpace=CMY
9226>404	lelong		5		ColorSpace=YMC
9227>404	lelong		6		ColorSpace=CMYK
9228>404	lelong		7		ColorSpace=YMCK
9229>404	lelong		8		ColorSpace=KCMY
9230>404	lelong		9		ColorSpace=KCMYcm
9231>404	lelong		10		ColorSpace=GMCK
9232>404	lelong		11		ColorSpace=GMCS
9233>404	lelong		12		ColorSpace=WHITE
9234>404	lelong		13		ColorSpace=GOLD
9235>404	lelong		14		ColorSpace=SILVER
9236>404	lelong		15		ColorSpace=CIE XYZ
9237>404	lelong		16		ColorSpace=CIE Lab
9238>404	lelong		17		ColorSpace=RGBW
9239>404	lelong		18		ColorSpace=sGray
9240>404	lelong		19		ColorSpace=sRGB
9241>404	lelong		20		ColorSpace=AdobeRGB
9242
9243# Cups Raster image format, Big Endian
92440	string		RaS
9245>3	string		t		Cups Raster version 1, Big Endian
9246>3	string		2		Cups Raster version 2, Big Endian
9247>3	string		3		Cups Raster version 3, Big Endian
9248!:mime	application/vnd.cups-raster
9249>0	use		\^cups-le
9250
9251
9252# Cups Raster image format, Little Endian
92531	string		SaR
9254>0	string		t		Cups Raster version 1, Little Endian
9255>0	string		2		Cups Raster version 2, Little Endian
9256>0	string		3		Cups Raster version 3, Little Endian
9257!:mime	application/vnd.cups-raster
9258>0	use		cups-le
9259
9260#------------------------------------------------------------------------------
9261# $File: dact,v 1.4 2009/09/19 16:28:08 christos Exp $
9262# dact:  file(1) magic for DACT compressed files
9263#
92640	long		0x444354C3	DACT compressed data
9265>4	byte		>-1		(version %i.
9266>5	byte		>-1		$BS%i.
9267>6	byte		>-1		$BS%i)
9268>7	long		>0		$BS, original size: %i bytes
9269>15	long		>30		$BS, block size: %i bytes
9270
9271#------------------------------------------------------------------------------
9272# $File: database,v 1.61 2021/02/23 00:51:10 christos Exp $
9273# database:  file(1) magic for various databases
9274#
9275# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
9276#
9277#
9278# GDBM magic numbers
9279#  Will be maintained as part of the GDBM distribution in the future.
9280#  <downsj@teeny.org>
92810	belong	0x13579acd	GNU dbm 1.x or ndbm database, big endian, 32-bit
9282!:mime	application/x-gdbm
92830	belong	0x13579ace	GNU dbm 1.x or ndbm database, big endian, old
9284!:mime	application/x-gdbm
92850	belong	0x13579acf	GNU dbm 1.x or ndbm database, big endian, 64-bit
9286!:mime	application/x-gdbm
92870	lelong	0x13579acd	GNU dbm 1.x or ndbm database, little endian, 32-bit
9288!:mime	application/x-gdbm
92890	lelong	0x13579ace	GNU dbm 1.x or ndbm database, little endian, old
9290!:mime	application/x-gdbm
92910	lelong	0x13579acf	GNU dbm 1.x or ndbm database, little endian, 64-bit
9292!:mime	application/x-gdbm
92930	string	GDBM		GNU dbm 2.x database
9294!:mime	application/x-gdbm
9295#
9296# Berkeley DB
9297#
9298# Ian Darwin's file /etc/magic files: big/little-endian version.
9299#
9300# Hash 1.85/1.86 databases store metadata in network byte order.
9301# Btree 1.85/1.86 databases store the metadata in host byte order.
9302# Hash and Btree 2.X and later databases store the metadata in host byte order.
9303
93040	long	0x00061561	Berkeley DB
9305!:mime	application/x-dbm
9306>8	belong	4321
9307>>4	belong	>2		1.86
9308>>4	belong	<3		1.85
9309>>4	belong	>0		(Hash, version %d, native byte-order)
9310>8	belong	1234
9311>>4	belong	>2		1.86
9312>>4	belong	<3		1.85
9313>>4	belong	>0		(Hash, version %d, little-endian)
9314
93150	belong	0x00061561	Berkeley DB
9316>8	belong	4321
9317>>4	belong	>2		1.86
9318>>4	belong	<3		1.85
9319>>4	belong	>0		(Hash, version %d, big-endian)
9320>8	belong	1234
9321>>4	belong	>2		1.86
9322>>4	belong	<3		1.85
9323>>4	belong	>0		(Hash, version %d, native byte-order)
9324
93250	long	0x00053162	Berkeley DB 1.85/1.86
9326>4	long	>0		(Btree, version %d, native byte-order)
93270	belong	0x00053162	Berkeley DB 1.85/1.86
9328>4	belong	>0		(Btree, version %d, big-endian)
93290	lelong	0x00053162	Berkeley DB 1.85/1.86
9330>4	lelong	>0		(Btree, version %d, little-endian)
9331
933212	long	0x00061561	Berkeley DB
9333>16	long	>0		(Hash, version %d, native byte-order)
933412	belong	0x00061561	Berkeley DB
9335>16	belong	>0		(Hash, version %d, big-endian)
933612	lelong	0x00061561	Berkeley DB
9337>16	lelong	>0		(Hash, version %d, little-endian)
9338
933912	long	0x00053162	Berkeley DB
9340>16	long	>0		(Btree, version %d, native byte-order)
934112	belong	0x00053162	Berkeley DB
9342>16	belong	>0		(Btree, version %d, big-endian)
934312	lelong	0x00053162	Berkeley DB
9344>16	lelong	>0		(Btree, version %d, little-endian)
9345
934612	long	0x00042253	Berkeley DB
9347>16	long	>0		(Queue, version %d, native byte-order)
934812	belong	0x00042253	Berkeley DB
9349>16	belong	>0		(Queue, version %d, big-endian)
935012	lelong	0x00042253	Berkeley DB
9351>16	lelong	>0		(Queue, version %d, little-endian)
9352
9353# From Max Bowsher.
935412	long	0x00040988	Berkeley DB
9355>16	long	>0		(Log, version %d, native byte-order)
935612	belong	0x00040988	Berkeley DB
9357>16	belong	>0		(Log, version %d, big-endian)
935812	lelong	0x00040988	Berkeley DB
9359>16	lelong	>0		(Log, version %d, little-endian)
9360
9361#
9362#
9363# Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch>
93640	string/b	RRD\0		RRDTool DB
9365>4	string/b	x		version %s
9366
9367>>10	short		!0		16bit aligned
9368>>>10	bedouble	8.642135e+130	big-endian
9369>>>>18	short		x		32bit long (m68k)
9370
9371>>10	short		0
9372>>>12	long		!0		32bit aligned
9373>>>>12	bedouble	8.642135e+130	big-endian
9374>>>>>20 long		0		64bit long
9375>>>>>20 long		!0		32bit long
9376>>>>12	ledouble	8.642135e+130	little-endian
9377>>>>>24 long		0		64bit long
9378>>>>>24 long		!0		32bit long (i386)
9379>>>>12	string		\x43\x2b\x1f\x5b\x2f\x25\xc0\xc7	middle-endian
9380>>>>>24 short		!0		32bit long (arm)
9381
9382>>8	quad		0		64bit aligned
9383>>>16	bedouble	8.642135e+130	big-endian
9384>>>>24	long		0		64bit long (s390x)
9385>>>>24	long		!0		32bit long (hppa/mips/ppc/s390/SPARC)
9386>>>16	ledouble	8.642135e+130	little-endian
9387>>>>28	long		0		64bit long (alpha/amd64/ia64)
9388>>>>28	long		!0		32bit long (armel/mipsel)
9389
9390#----------------------------------------------------------------------
9391# ROOT: file(1) magic for ROOT databases
9392#
93930       string  root\0  ROOT file
9394>4      belong  x       Version %d
9395>33     belong  x       (Compression: %d)
9396
9397# XXX: Weak magic.
9398# Alex Ott <ott@jet.msk.su>
9399## Paradox file formats
9400#2	  leshort	0x0800	Paradox
9401#>0x39	  byte		3	v. 3.0
9402#>0x39	  byte		4	v. 3.5
9403#>0x39	  byte		9	v. 4.x
9404#>0x39	  byte		10	v. 5.x
9405#>0x39	  byte		11	v. 5.x
9406#>0x39	  byte		12	v. 7.x
9407#>>0x04	  byte		0	indexed .DB data file
9408#>>0x04	  byte		1	primary index .PX file
9409#>>0x04	  byte		2	non-indexed .DB data file
9410#>>0x04	  byte		3	non-incrementing secondary index .Xnn file
9411#>>0x04	  byte		4	secondary index .Ynn file
9412#>>0x04	  byte		5	incrementing secondary index .Xnn file
9413#>>0x04	  byte		6	non-incrementing secondary index .XGn file
9414#>>0x04	  byte		7	secondary index .YGn file
9415#>>>0x04	  byte		8	incrementing secondary index .XGn file
9416
9417## XBase database files
9418# updated by Joerg Jenderek at Feb 2013
9419# https://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm
9420# https://www.clicketyclick.dk/databases/xbase/format/dbf.html
9421# inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
94220	ubelong&0x0000FFFF		<0x00000C20
9423# skip Infocom game Z-machine
9424>2		ubyte			>0
9425# skip Androids *.xml
9426>>3		ubyte			>0
9427>>>3		ubyte			<32
9428# 1 < version VV
9429>>>>0		ubyte			>1
9430# skip HELP.CA3 by test for reserved byte ( NULL )
9431>>>>>27		ubyte			0
9432# reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF)
9433#>>>>>30		ubeshort     		x		30NULL?%x
9434# possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
9435>>>>>>24	ubelong&0xffFFFFff	>0x01302000
9436# .DBF or .MDX
9437>>>>>>24	ubelong&0xffFFFFff	<0x01302001
9438# for Xbase Database file (*.DBF) reserved (NULL) for multi-user
9439>>>>>>>24	ubelong&0xffFFFFff	=0
9440# test for 2 reserved NULL bytes,transaction and encryption byte flag
9441>>>>>>>>12	ubelong&0xFFFFfEfE	0
9442# test for MDX flag
9443>>>>>>>>>28	ubyte			x
9444>>>>>>>>>28	ubyte&0xf8		0
9445# header size >= 32
9446>>>>>>>>>>8	uleshort		>31
9447# skip PIC15736.PCX by test for language driver name or field name
9448>>>>>>>>>>>32	ubyte			>0
9449#!:mime	application/x-dbf; charset=unknown-8bit ??
9450#!:mime	application/x-dbase
9451>>>>>>>>>>>>0	use			xbase-type
9452# database file
9453>>>>>>>>>>>>0	ubyte			x		\b DBF
9454>>>>>>>>>>>>4	lelong			0		\b, no records
9455>>>>>>>>>>>>4	lelong			>0		\b, %d record
9456# plural s appended
9457>>>>>>>>>>>>>4	lelong			>1		\bs
9458# https://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF
9459# 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000)
9460>>>>>>>>>>>>10	uleshort		x		* %d
9461# file size = records * record size + header size
9462>>>>>>>>>>>>1	ubyte			x		\b, update-date
9463>>>>>>>>>>>>1	use			xbase-date
9464# https://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx
9465#>>>>>>>>>>>>29	ubyte			=0		\b, codepage ID=0x%x
9466# 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ?
9467>>>>>>>>>>>>29	ubyte			>0		\b, codepage ID=0x%x
9468#>>>>>>>>>>>>28	ubyte&0x01		0		\b, no index file
9469>>>>>>>>>>>>28	ubyte&0x01		1		\b, with index file .MDX
9470>>>>>>>>>>>>28	ubyte&0x02		2		\b, with memo .FPT
9471>>>>>>>>>>>>28	ubyte&0x04		4		\b, DataBaseContainer
9472# 1st record offset + 1 = header size
9473>>>>>>>>>>>>8	uleshort		>0
9474>>>>>>>>>>>>(8.s+1)	ubyte		>0
9475>>>>>>>>>>>>>8		uleshort	>0		\b, at offset %d
9476>>>>>>>>>>>>>(8.s+1)	ubyte		>0
9477>>>>>>>>>>>>>>&-1	string		>\0		1st record "%s"
9478# for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
9479>>>>>>>24	ubelong&0x0133f7ff	>0
9480# test for reserved NULL byte
9481>>>>>>>>47	ubyte			0
9482# test for valid TAG key format (0x10 or 0)
9483>>>>>>>>>559	ubyte&0xeF		0
9484# test MM <= 12
9485>>>>>>>>>>45	ubeshort		<0x0C20
9486>>>>>>>>>>>45	ubyte			>0
9487>>>>>>>>>>>>46	ubyte			<32
9488>>>>>>>>>>>>>46	ubyte			>0
9489#!:mime	application/x-mdx
9490>>>>>>>>>>>>>>0		use		xbase-type
9491>>>>>>>>>>>>>>0		ubyte		x		\b MDX
9492>>>>>>>>>>>>>>1		ubyte		x		\b, creation-date
9493>>>>>>>>>>>>>>1		use		xbase-date
9494>>>>>>>>>>>>>>44	ubyte		x		\b, update-date
9495>>>>>>>>>>>>>>44	use		xbase-date
9496# No.of tags in use (1,2,5,12)
9497>>>>>>>>>>>>>>28	uleshort	x		\b, %d
9498# No. of entries in tag (0x30)
9499>>>>>>>>>>>>>>25	ubyte		x		\b/%d tags
9500#  Length of tag
9501>>>>>>>>>>>>>>26	ubyte		x		* %d
9502# 1st tag name_
9503>>>>>>>>>>>>>548	string		x		\b, 1st tag "%.11s"
9504# 2nd tag name
9505#>>>>>>>>>>>>(26.b+548)	string		x		\b, 2nd tag "%.11s"
9506#
9507#		Print the xBase names of different version variants
95080	name				xbase-type
9509>0	ubyte		<2
9510# 1 < version
9511>0	ubyte		>1
9512>>0	ubyte		0x02		FoxBase
9513# FoxBase+/dBaseIII+, no memo
9514>>0	ubyte		0x03		FoxBase+/dBase III
9515!:mime	application/x-dbf
9516# dBASE IV no memo file
9517>>0	ubyte		0x04		dBase IV
9518!:mime	application/x-dbf
9519# dBASE V no memo file
9520>>0	ubyte		0x05		dBase V
9521!:mime	application/x-dbf
9522>>0	ubyte		0x30		Visual FoxPro
9523!:mime	application/x-dbf
9524>>0	ubyte		0x31		Visual FoxPro, autoincrement
9525!:mime	application/x-dbf
9526# Visual FoxPro, with field type Varchar or Varbinary
9527>>0	ubyte		0x32		Visual FoxPro, with field type Varchar
9528!:mime	application/x-dbf
9529# dBASE IV SQL, no memo;dbv memo var size (Flagship)
9530>>0	ubyte		0x43		dBase IV, with SQL table
9531!:mime	application/x-dbf
9532# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
9533#>>0	ubyte		0x62		dBase IV, with SQL table
9534#!:mime	application/x-dbf
9535# dBASE IV, with memo!!
9536>>0	ubyte		0x7b		dBase IV, with memo
9537!:mime	application/x-dbf
9538# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
9539#>>0	ubyte		0x82		dBase IV, with SQL system
9540#!:mime	application/x-dbf
9541# FoxBase+/dBaseIII+ with memo .DBT!
9542>>0	ubyte		0x83		FoxBase+/dBase III, with memo .DBT
9543!:mime	application/x-dbf
9544# VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file
9545>>0	ubyte		0x87		VISUAL OBJECTS, with memo file
9546!:mime	application/x-dbf
9547# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
9548#>>0	ubyte		0x8A		FoxBase+/dBase III, with memo .DBT
9549#!:mime	application/x-dbf
9550# dBASE IV with memo!
9551>>0	ubyte		0x8B		dBase IV, with memo .DBT
9552!:mime	application/x-dbf
9553# dBase IV with SQL Table,no memo?
9554>>0	ubyte		0x8E		dBase IV, with SQL table
9555!:mime	application/x-dbf
9556# .dbv and .dbt memo (Flagship)?
9557>>0	ubyte		0xB3		Flagship
9558# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
9559#>>0	ubyte		0xCA		dBase IV with memo .DBT
9560#!:mime	application/x-dbf
9561# dBASE IV with SQL table, with memo .DBT
9562>>0	ubyte		0xCB		dBase IV with SQL table, with memo .DBT
9563!:mime	application/x-dbf
9564# HiPer-Six format;Clipper SIX, with SMT memo file
9565>>0	ubyte		0xE5		Clipper SIX with memo
9566!:mime	application/x-dbf
9567# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
9568#>>0	ubyte		0xF4		dBase IV, with SQL table, with memo
9569#!:mime	application/x-dbf
9570>>0	ubyte		0xF5		FoxPro with memo
9571!:mime	application/x-dbf
9572# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
9573#>>0	ubyte		0xFA		FoxPro 2.x, with memo
9574#!:mime	application/x-dbf
9575# unknown version (should not happen)
9576>>0	default		x		xBase
9577!:mime	application/x-dbf
9578>>>0	ubyte		x		(0x%x)
9579# flags in version byte
9580# DBT flag (with dBASE III memo .DBT)!!
9581# >>0	ubyte&0x80	>0		DBT_FLAG=%x
9582# memo flag ??
9583# >>0	ubyte&0x08	>0		MEMO_FLAG=%x
9584# SQL flag ??
9585# >>0	ubyte&0x70	>0		SQL_FLAG=%x
9586#		test and print the date of xBase .DBF .MDX
95870	name				xbase-date
9588# inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
9589>0	ubelong		x
9590>1	ubyte		<13
9591>>1	ubyte		>0
9592>>>2	ubyte		>0
9593>>>>2	ubyte		<32
9594>>>>>0	ubyte		x
9595# YY is interpreted as 20YY or 19YY
9596>>>>>>0	ubyte		<100		\b %.2d
9597# YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY
9598>>>>>>0	ubyte		>99		\b %d
9599>>>>>1	ubyte		x		\b-%d
9600>>>>>2	ubyte		x		\b-%d
9601
9602#	dBase memo files .DBT or .FPT
9603# https://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx
960416		ubyte		<4
9605>16		ubyte		!2
9606>>16		ubyte		!1
9607# next free block index is positive
9608>>>0		ulelong		>0
9609# skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size
9610>>>>17		ubelong&0xFFfdFEff	0x00000000
9611# skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h
9612>>>>>20		ubelong&0xFF01209B	0x00000000
9613# dBASE III
9614>>>>>>16	ubyte		3
9615# dBASE III DBT
9616>>>>>>>0	use		dbase3-memo-print
9617# dBASE III DBT without version, dBASE IV DBT , FoxPro FPT , or many ZIP , DBF garbage
9618>>>>>>16	ubyte		0
9619# unusual dBASE III DBT like angest.dbt, dBASE IV DBT with block size 0 , FoxPro FPT ,  or garbage PCX DBF
9620>>>>>>>20	uleshort	0
9621# FoxPro FPT , unusual dBASE III DBT like biblio.dbt or garbage
9622>>>>>>>>8	ulong		=0
9623>>>>>>>>>6	ubeshort	>0
9624# skip emacs.PIF
9625>>>>>>>>>>4	ushort		0
9626# check for valid FoxPro field type
9627>>>>>>>>>>>512	ubelong		<3
9628>>>>>>>>>>>>0	use		foxpro-memo-print
9629# dBASE III DBT , garbage
9630# skip WORD1XW.DOC with improbably high free block index
9631>>>>>>>>>0	ulelong		<0x400000
9632# skip WinStore.App.exe by looking for printable 2nd character of 1st memo item
9633>>>>>>>>>>513	ubyte		>037
9634# unusual dBASE III DBT like adressen.dbt
9635>>>>>>>>>>>0	use		dbase3-memo-print
9636# dBASE III DBT like angest.dbt, or garbage PCX DBF
9637>>>>>>>>8	ubelong		!0
9638# skip PCX and some DBF by test for for reserved NULL bytes
9639>>>>>>>>>510	ubeshort	0
9640# skip bad symples with improbably high free block index above 2 GiB file limit
9641>>>>>>>>>>0	ulelong		<0x400000
9642# skip AI070GEP.EPS by printable 1st character of 1st memo item
9643>>>>>>>>>>>512	ubyte		>037
9644# skip gluon-ffhat-1.0-tp-link-tl-wr1043n-nd-v2-sysupgrade.bin by printable 2nd character
9645>>>>>>>>>>>>513	ubyte		>037
9646>>>>>>>>>>>>>0	use		dbase3-memo-print
9647# dBASE IV DBT with positive block size
9648>>>>>>>20	uleshort	>0
9649# dBASE IV DBT with valid block length like 512, 1024
9650# multiple of 2 in between 16 and 16 K ,implies upper and lower bits are zero
9651# skip also 3600h 3E00h size
9652>>>>>>>>20	uleshort&0xE00f	0
9653>>>>>>>>>0	use		dbase4-memo-print
9654
9655#		Print the information of dBase III DBT memo file
96560	name				dbase3-memo-print
9657>0	ubyte			x		dBase III DBT
9658!:mime	application/x-dbt
9659!:ext	dbt
9660# instead 3 as version number 0 for unusual examples like biblio.dbt
9661>16	ubyte			!3		\b, version number %u
9662# Number of next available block for appending data
9663#>0	lelong			=0		\b, next free block index %u
9664>0	lelong			!0		\b, next free block index %u
9665# no positive block length
9666#>20	uleshort		=0		\b, block length %u
9667>20	uleshort		!0		\b, block length %u
9668# dBase III memo field terminated by \032\032
9669>512	string			>\0		\b, 1st item "%s"
9670# https://www.clicketyclick.dk/databases/xbase/format/dbt.html
9671#		Print the information of dBase IV DBT memo file
96720	name				dbase4-memo-print
9673>0		lelong		x		dBase IV DBT
9674!:mime	application/x-dbt
9675!:ext dbt
9676# 8 character shorted main name of corresponding dBASE IV DBF file
9677>8		ubelong		>0x20000000
9678# skip unusual like for angest.dbt
9679>>20		uleshort	>0
9680>>>8		string		>\0		\b of %-.8s.DBF
9681# value 0 implies 512 as size
9682#>4		ulelong		=0		\b, blocks size %u
9683# size of blocks not reliable like 0x2020204C in angest.dbt
9684>4		ulelong		!0
9685>>4		ulelong&0x0000003f	0	\b, blocks size %u
9686# dBase IV DBT with positive block length (found 512 , 1024)
9687>20		uleshort	>0		\b, block length %u
9688# next available block
9689#>0		lelong		=0		\b, next free block index %u
9690>0		lelong		!0		\b, next free block index %u
9691>20		uleshort	>0
9692>>(20.s)	ubelong		x
9693>>>&-4		use		dbase4-memofield-print
9694# unusual dBase IV DBT without block length (implies 512 as length)
9695>20		uleshort	=0
9696>>512		ubelong		x
9697>>>&-4		use				dbase4-memofield-print
9698#		Print the information of dBase IV memo field
96990	name			dbase4-memofield-print
9700# free dBase IV memo field
9701>0		ubelong		!0xFFFF0800
9702>>0		lelong		x		\b, next free block %u
9703>>4		lelong		x		\b, next used block %u
9704# used dBase IV memo field
9705>0		ubelong		=0xFFFF0800
9706# length of memo field
9707>>4		lelong		x		\b, field length %d
9708>>>8		string		>\0		\b, 1st used item "%s"
9709# http://www.dbfree.org/webdocs/1-documentation/0018-developers_stuff_(advanced)/os_related_stuff/xbase_file_format.htm
9710#		Print the information of FoxPro FPT memo file
97110	name				foxpro-memo-print
9712>0		belong		x		FoxPro FPT
9713!:mime	application/x-fpt
9714!:ext	fpt
9715# Size of blocks for FoxPro ( 64,256 )
9716>6		ubeshort	x		\b, blocks size %u
9717# next available block
9718#>0		belong		=0		\b, next free block index %u
9719>0		belong		!0		\b, next free block index %u
9720# field type ( 0~picture, 1~memo, 2~object )
9721>512		ubelong		<3		\b, field type %u
9722# length of memo field
9723>512		ubelong		1
9724>>516		belong		>0		\b, field length %d
9725>>>520		string		>\0		\b, 1st item "%s"
9726
9727# TODO:
9728# DBASE index file *.NDX
9729# DBASE Compound Index file *.CDX
9730# dBASE IV Printer Driver *.PRF
9731## End of XBase database stuff
9732
9733# MS Access database
97344	string	Standard\ Jet\ DB	Microsoft Access Database
9735!:mime	application/x-msaccess
97364	string	Standard\ ACE\ DB	Microsoft Access Database
9737!:mime	application/x-msaccess
9738
9739# From: Joerg Jenderek
9740# URL: http://fileformats.archiveteam.org/wiki/Extensible_Storage_Engine
9741# Reference: https://github.com/libyal/libesedb/archive/master.zip
9742#	libesedb-master/documentation/
9743#	Extensible Storage Engine (ESE) Database File (EDB) format.asciidoc
9744# Note: also known as "JET Blue". Used by numerous Windows components such as
9745# Windows Search, Mail, Exchange and Active Directory.
97464	ubelong		0xefcdab89
9747# unknown1
9748>132	ubelong		0		Extensible storage engine
9749!:mime	application/x-ms-ese
9750# file_type 0~database 1~stream
9751>>12	ulelong		0		DataBase
9752# Security DataBase (sdb)
9753!:ext	edb/sdb
9754>>12	ulelong		1		STreaMing
9755!:ext	stm
9756# format_version 620h
9757>>8	uleshort	x		\b, version 0x%x
9758>>10	uleshort	>0		revision 0x%4.4x
9759>>0	ubelong		x	 	\b, checksum 0x%8.8x
9760# Page size 4096 8192 32768
9761>>236	ulequad		x		\b, page size %lld
9762# database_state
9763>>52	ulelong		1		\b, JustCreated
9764>>52	ulelong		2		\b, DirtyShutdown
9765#>>52	ulelong		3		\b, CleanShutdown
9766>>52	ulelong		4		\b, BeingConverted
9767>>52	ulelong		5		\b, ForceDetach
9768# Windows NT major version when the databases indexes were updated.
9769>>216	ulelong		x		\b, Windows version %d
9770# Windows NT minor version
9771>>220	ulelong		x		\b.%d
9772
9773# From: Joerg Jenderek
9774# URL: https://forensicswiki.org/wiki/Windows_Application_Compatibility
9775# Note: files contain application compatibility fixes, application compatibility modes and application help messages.
97768	string		sdbf
9777>7	ubyte		0
9778# TAG_TYPE_LIST+TAG_INDEXES
9779>>12	uleshort	0x7802		Windows application compatibility Shim DataBase
9780# version? 2 3
9781#>>>0	ulelong		x		\b, version %d
9782!:mime	application/x-ms-sdb
9783!:ext	sdb
9784
9785# TDB database from Samba et al - Martin Pool <mbp@samba.org>
97860	string	TDB\ file		TDB database
9787>32	lelong	0x2601196D		version 6, little-endian
9788>>36	lelong	x			hash size %d bytes
9789
9790# SE Linux policy database
97910       lelong  0xf97cff8c      SE Linux policy
9792>16     lelong  x               v%d
9793>20     lelong  1      MLS
9794>24     lelong  x       %d symbols
9795>28     lelong  x       %d ocons
9796
9797# ICE authority file data (Wolfram Kleff)
97982	string		ICE		ICE authority data
9799
9800# X11 Xauthority file (Wolfram Kleff)
980110	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
980211	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
980312	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
980413	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
980514	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
980615	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
980716	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
980817	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
980918	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
9810
9811# From: Maxime Henrion <mux@FreeBSD.org>
9812# PostgreSQL's custom dump format, Maxime Henrion <mux@FreeBSD.org>
98130	string		PGDMP		PostgreSQL custom database dump
9814>5	byte		x		- v%d
9815>6	byte		x		\b.%d
9816>5	beshort		<0x101		\b-0
9817>5	beshort		>0x100
9818>>7	byte		x		\b-%d
9819
9820# Type: Advanced Data Format (ADF) database
9821# URL:  https://www.grc.nasa.gov/WWW/cgns/adf/
9822# From: Nicolas Chauvat <nicolas.chauvat@logilab.fr>
98230	string	@(#)ADF\ Database	CGNS Advanced Data Format
9824
9825# Tokyo Cabinet magic data
9826# http://tokyocabinet.sourceforge.net/index.html
98270	string		ToKyO\ CaBiNeT\n	Tokyo Cabinet
9828>14	string		x			\b (%s)
9829>32	byte		0			\b, Hash
9830!:mime	application/x-tokyocabinet-hash
9831>32	byte		1			\b, B+ tree
9832!:mime	application/x-tokyocabinet-btree
9833>32	byte		2			\b, Fixed-length
9834!:mime	application/x-tokyocabinet-fixed
9835>32	byte		3			\b, Table
9836!:mime	application/x-tokyocabinet-table
9837>33	byte		&1			\b, [open]
9838>33	byte		&2			\b, [fatal]
9839>34	byte		x			\b, apow=%d
9840>35	byte		x			\b, fpow=%d
9841>36	byte		&0x01			\b, [large]
9842>36	byte		&0x02			\b, [deflate]
9843>36	byte		&0x04			\b, [bzip]
9844>36	byte		&0x08			\b, [tcbs]
9845>36	byte		&0x10			\b, [excodec]
9846>40	lequad		x			\b, bnum=%lld
9847>48	lequad		x			\b, rnum=%lld
9848>56	lequad		x			\b, fsiz=%lld
9849
9850# Type:	QDBM Quick Database Manager
9851# From:	Benoit Sibaud <bsibaud@april.org>
98520	string		\\[depot\\]\n\f		Quick Database Manager, little endian
98530	string		\\[DEPOT\\]\n\f		Quick Database Manager, big endian
9854
9855# Type:	TokyoCabinet database
9856# URL:	http://tokyocabinet.sourceforge.net/
9857# From:	Benoit Sibaud <bsibaud@april.org>
98580	string		ToKyO\ CaBiNeT\n	TokyoCabinet database
9859>14	string		x			(version %s)
9860
9861# From:  Stephane Blondon https://www.yaal.fr
9862# Database file for Zope (done by FileStorage)
98630	string	FS21	Zope Object Database File Storage v3 (data)
98640	string	FS30	Zope Object Database File Storage v4 (data)
9865
9866# Cache file for the database of Zope (done by ClientStorage)
98670	string		ZEC3	Zope Object Database Client Cache File (data)
9868
9869# IDA (Interactive Disassembler) database
98700	string		IDA1	IDA (Interactive Disassembler) database
9871
9872# Hopper (reverse engineering tool) https://www.hopperapp.com/
98730	string		hopperdb	Hopper database
9874
9875# URL: https://en.wikipedia.org/wiki/Panorama_(database_engine)
9876# Reference: http://www.provue.com/Panorama/
9877# From: Joerg Jenderek
9878# NOTE: test only versions 4 and 6.0 with Windows
9879# length of Panorama database name
98805	ubyte				>0
9881# look after database name for "some" null bits
9882>(5.B+7)	ubelong&0xF3ffF000	0
9883# look for first keyword
9884>>&1		search/2		DESIGN		Panorama database
9885#!:mime	application/x-panorama-database
9886!:apple	KASXZEPD
9887!:ext	pan
9888# database name
9889>>>5	pstring				x		\b, "%s"
9890
9891#
9892#
9893# askSam Database by Stefan A. Haubenthal <polluks@web.de>
98940	string	askw40\0	askSam DB
9895
9896#
9897#
9898# MUIbase Database Tool by Stefan A. Haubenthal <polluks@web.de>
98990	string	MBSTV\040	MUIbase DB
9900>6	string	x		version %s
9901
9902#
9903# CDB database
99040	string	NBCDB\012	NetBSD Constant Database
9905>7	byte	x		\b, version %d
9906>8	string	x		\b, for '%s'
9907>24	lelong	x		\b, datasize %d
9908>28	lelong	x		\b, entries %d
9909>32	lelong	x		\b, index %d
9910>36	lelong	x		\b, seed %#x
9911
9912#
9913# Redis RDB - https://redis.io/topics/persistence
99140	string	REDIS			Redis RDB file,
9915>5	regex	[0-9][0-9][0-9][0-9]	version %s
9916
9917# Mork database.
9918# Used by older versions of Mozilla Suite and Firefox,
9919# and current versions of Thunderbird.
9920# From: David Korth <gerbilsoft@gerbilsoft.com>
99210	string	//\ <!--\ <mdb:mork:z\ v="	Mozilla Mork database
9922>23	string	x		\b, version %.3s
9923
9924# URL:		https://en.wikipedia.org/wiki/Management_Information_Format
9925# Reference:	https://www.dmtf.org/sites/default/files/standards/documents/DSP0005.pdf
9926# From:		Joerg Jenderek
9927# Note:		only tested with monitor asset reports of Dell Display Manager
9928#		skip start like Language=fr|CA|iso8859-1
99290	search/27/C	Start\040Component	DMI Management Information Format
9930#!:mime	text/plain
9931!:mime	text/x-dmtf-mif
9932!:ext	mif
9933
9934
9935#------------------------------------------------------------------------------
9936# $File: dataone,v 1.2 2019/04/19 00:42:27 christos Exp $
9937#
9938# DataONE- files from Dave Vieglais <dave.vieglais@gmail.com> &
9939#                     Pratik Shrivastava <pratikshrivastava23@gmail.com>
9940#
9941# file formats:   https://cn.dataone.org/cn/v2/formats
9942#------------------------------------------------------------------------------
9943
9944# EML (Ecological Metadata Language Format)
99450	string	<?xml
9946>&0	regex	(eml)-[0-9].[0-9].[0-9]+	eml://ecoinformatics.org/%s
9947
9948# onedcx (DataONE Dublin Core Extended v1.0)
9949>&0	regex	(onedcx/v)[0-9].[0-9]+		https://ns.dataone.org/metadata/schema/onedcx/v1.0
9950
9951# FGDC-STD-001-1998 (Content Standard for Digital Geospatial Metadata,
9952# version 001-1998)
9953>&0	regex	fgdc				FGDC-STD-001-1998
9954
9955# Mercury (Oak Ridge National Lab Mercury Metadata version 1.0)
9956>&0	regex	(mercury/terms/v)[0-9].[0-9]	https://purl.org/ornl/schema/mercury/terms/v1.0
9957
9958# ISOTC211 (Geographic MetaData (GMD) Extensible Markup Language)
9959>&0	regex	isotc211
9960>>&0	regex	eng;USA				https://www.isotc211.org/2005/gmd
9961
9962# ISOTC211 (NOAA Variant Geographic MetaData (GMD) Extensible Markup Language)
9963>>&0	regex	gov.noaa.nodc:[0-9]+		https://www.isotc211.org/2005/gmd-noaa
9964
9965# ISOTC211 PANGAEA Variant Geographic MetaData (GMD) Extensible Markup Language
9966>>&0	regex	pangaea.dataset[0-9][0-9][0-9][0-9][0-9][0-9]+	https://www.isotc211.org/2005/gmd-pangaea
9967!:mime	text/xml
9968
9969
9970# Object Reuse and Exchange Vocabulary
99710	string	<?xml
9972>&0	regex	rdf
9973>>&0	regex	openarchives	https://www.openarchives.org/ore/terms
9974!:mime application/rdf+xml
9975
9976
9977# Dryad Metadata Application Profile Version 3.1
99780	string	<DryadData
9979>&0	regex	(dryad-bibo/v)[0-9].[0-9]	https://datadryad.org/profile/v3.1
9980!:mime	text/xml
9981
9982#------------------------------------------------------------------------------
9983# $File: dbpf,v 1.3 2019/04/19 00:42:27 christos Exp $
9984# dppf:	Maxis Database Packed Files, the stored data file format used by all
9985#	Maxis games after the Sims: http://wiki.niotso.org/DBPF
9986# 	https://www.wiki.sc4devotion.com/index.php?title=DBPF
9987#	13 Oct 2017, Kip Warner <kip at thevertigo dot com>
99880	string	DBPF	Maxis Database Packed File
9989>4	ulelong	x	\b, version: %u.
9990>>8	ulelong	x	\b%u
9991>>>36	ulelong	x       \b, files: %u
9992>>24	ledate	!0	\b, created: %s
9993>>28	ledate	!0	\b, modified: %s
9994!:ext	dbpf/package/dat/sc4
9995!:mime	application/x-maxis-dbpf
9996#------------------------------------------------------------------------------
9997# $File: der,v 1.4 2021/03/14 17:12:04 christos Exp $
9998# der: file(1) magic for DER encoded files
9999#
10000
10001# Certificate information piece
100020	name	certinfo
10003>0	der	seq
10004>>&0	der	set
10005>>>&0	der	seq
10006>>>>&0	der	obj_id3=550406
10007>>>>&0	der	prt_str=x	\b, countryName=%s
10008>>&0	der	set
10009>>>&0	der	seq
10010>>>>&0	der	obj_id3=550408
10011>>>>&0	der	utf8_str=x	\b, stateOrProvinceName=%s
10012>>&0	der	set
10013>>>&0	der	seq
10014>>>>&0	der	obj_id3=55040a
10015>>>>&0	der	utf8_str=x	\b, organizationName=%s
10016>>&0	der	set
10017>>>&0	der	seq
10018>>>>&0	der	obj_id3=550403
10019>>>>&0	der	utf8_str=x	\b, commonName=%s
10020>>&0	der	seq
10021
10022# Certificate requests
100230	der	seq
10024>&0	der	seq
10025>>&0	der	int1=00		DER Encoded Certificate request
10026>>&0	use	certinfo
10027
10028# Key Pairs
100290	der	seq
10030>&0	der	int1=00
10031>&0	der	int65=x
10032>&0	der	int3=010001	DER Encoded Key Pair, 512 bits
10033
100340	der	seq
10035>&0	der	int1=00
10036>&0	der	int129=x
10037>&0	der	int3=010001	DER Encoded Key Pair, 1024 bits
10038
100390	der	seq
10040>&0	der	int1=00
10041>&0	der	int257=x
10042>&0	der	int3=010001	DER Encoded Key Pair, 2048 bits
10043
100440	der	seq
10045>&0	der	int1=00
10046>&0	der	int513=x
10047>&0	der	int3=010001	DER Encoded Key Pair, 4096 bits
10048
100490	der	seq
10050>&0	der	int1=00
10051>&0	der	int1025=x
10052>&0	der	int3=010001	DER Encoded Key Pair, 8192 bits
10053
100540	der	seq
10055>&0	der	int1=00
10056>&0	der	int2049=x
10057>&0	der	int3=010001	DER Encoded Key Pair, 16k bits
10058
100590	der	seq
10060>&0	der	int1=00
10061>&0	der	int4097=x
10062>&0	der	int3=010001	DER Encoded Key Pair, 32k bits
10063
10064# Certificates
100650	der	seq
10066>&0	der	seq
10067>>&0	der	int2=0dfa	DER Encoded Certificate, 512 bits
10068>>&0	der	int2=0dfb	DER Encoded Certificate, 1024 bits
10069>>&0	der	int2=0dfc	DER Encoded Certificate, 2048 bits
10070>>&0	der	int2=0dfd	DER Encoded Certificate, 4096 bits
10071>>&0	der	int2=0dfe	DER Encoded Certificate, 8192 bits
10072>>&0	der	int2=0dff	DER Encoded Certificate, 16k bits
10073>>&0	der	int2=0e04	DER Encoded Certificate, 32k bits
10074>>&0	der	int2=x		DER Encoded Certificate, ? bits (%s)
10075>>&0	der	seq
10076>>>&0	der	obj_id9=2a864886f70d010105	\b, sha1WithRSAEncryption
10077>>>&0	der	obj_id9=x			\b, ? Encryption (%s)
10078>>>&0	der	null
10079>>&0	der	seq
10080>>>&0	der	set
10081>>>>&0	der	seq
10082>>>>>&0	der	obj_id3=550406
10083>>>>>&0	der	prt_str=x	\b, countryName=%s
10084>>>&0	der	set
10085>>>>&0	der	seq
10086>>>>>&0	der	obj_id3=550408
10087>>>>>&0	der	prt_str=x	\b, stateOrProvinceName=%s
10088>>>&0	der	set
10089>>>>&0	der	seq
10090>>>>>&0	der	obj_id3=550407
10091>>>>>&0	der	prt_str=x	\b, localityName=%s
10092>>>&0	der	set
10093>>>>&0	der	seq
10094>>>>>&0	der	obj_id3=55040a
10095>>>>>&0	der	prt_str=x	\b, organizationName=%s
10096>>>&0	der	set
10097>>>>&0	der	seq
10098>>>>>&0	der	obj_id3=55040b
10099>>>>>&0	der	prt_str=x	\b, organizationUnitName=%s
10100>>>&0	der	set
10101>>>>&0	der	seq
10102>>>>>&0	der	obj_id3=550403
10103>>>>>&0	der	prt_str=x	\b, commonName=%s
10104>>>&0	der	set
10105>>>>&0	der	seq
10106>>>>>&0	der	obj_id9=2a864886f70d010901
10107>>>>>&0	der	ia5_str=x	\b, emailAddress=%s
10108>>&0	der	seq
10109>>>&0	der	utc_time=x	\b, utcTime=%s
10110>>>&0	der	utc_time=x	\b, utcTime=%s
10111>>&0	use	certinfo
10112
101130	der	seq
10114>&0	der	seq
10115>>&0	der	eoc
10116>>>&0	der	int1=02		Certificate, Version=3
10117>>>&0	der	int1=x		Certificate, Version=%s
10118>>&0	der	int9=x		\b, Serial=%s
10119>>&0	der	seq
10120>>>&0	der     obj_id9=2a864886f70d01010b
10121>>>&0	der	null
10122>>&0	der	seq
10123>>>&0	der	set
10124>>>>&0	der	seq
10125>>>>>&0	der     obj_id3=550403
10126>>>>>&0	der     utf8_str=x      \b, Issuer=%s
10127>>&0	der	seq
10128>>>&0	der	utc_time=x	\b, not-valid-before=%s
10129>>>&0	der	utc_time=x	\b, not-valid-after=%s
10130>>&0	der	seq
10131>>>&0	der	set
10132>>>>&0	der	seq
10133>>>>>&0	der     obj_id3=550403
10134>>>>>&0	der     utf8_str=x      \b, Subject=%s
10135
10136#------------------------------------------------------------------------------
10137# $File: diamond,v 1.7 2009/09/19 16:28:08 christos Exp $
10138# diamond:  file(1) magic for Diamond system
10139#
10140# ... diamond is a multi-media mail and electronic conferencing system....
10141#
10142# XXX - I think it was either renamed Slate, or replaced by Slate....
10143#
10144#	The full deal is too long...
10145#0	string	<list>\n<protocol\ bbn-multimedia-format>	Diamond Multimedia Document
101460	string	=<list>\n<protocol\ bbn-m	Diamond Multimedia Document
10147
10148#------------------------------------------------------------------------------
10149# $File: dif,v 1.1 2020/04/09 19:14:01 christos Exp $
10150# dif:  file(1) magic for DIF text files
10151
10152#------------------------------------------------------------------------------
10153# From:	Joerg Jenderek
10154# URL:	http://en.wikipedia.org/wiki/Data_Interchange_Format
10155#	http://fileformats.archiveteam.org/wiki/Data_Interchange_Format
10156# Note:	called by TrID "Data Interchange Format",
10157#	by DROID x-fmt/368 "VisiCalc Database"
101580	string		TABLE
10159# skip text starting with TABLE by looking for numeric version on 2nd line
10160>6	search/2	0,
10161# skip DROID x-fmt-41-signature-id-380.dif by looking for key word TUPLES at the beginning
10162>>27	search/128	TUPLES		Data Interchange Format
10163# https://www.pcmatic.com/company/libraries/fileextension/detail.asp?ext=dif.html
10164#!:mime	application/x-dif-spreadsheet	Gnumeric
10165# https://github.com/LibreOffice/online/blob/master/discovery.xml
10166#!:mime	application/x-dif-document	LibreOffice
10167# https://www.wikidata.org/wiki/Wikidata:WikiProject_Informatics/File_formats/Lists/File_formats
10168!:mime	application/x-dif
10169# https://extension.nirsoft.net/dif
10170#!:mime	application/vnd.ms-excel
10171#!:mime	text/plain
10172!:ext	dif
10173# look for double quote 0x22 on 3rd line
10174>>>10	search/3	"
10175# skip if next character also double quote
10176>>>>&0	ubyte		!0x22		\b, generator or table name
10177# comment like EXCEL, pwm enclosed in double quotes
10178>>>>>&-2	string	x		%s
10179
10180
10181#------------------------------------------------------------------------------
10182# $File: diff,v 1.17 2020/08/22 18:16:58 christos Exp $
10183# diff:  file(1) magic for diff(1) output
10184#
101850	search/1	diff\040	diff output text
10186!:mime	text/x-diff
101870	search/1	***\040
10188>&0	search/1024	\n---\040	context diff output text
10189!:mime	text/x-diff
101900	search/1	Only\040in\040 	diff output text
10191!:mime	text/x-diff
101920	search/1	Common\040subdirectories:\040 	diff output text
10193!:mime	text/x-diff
10194
101950	search/1	Index:		RCS/CVS diff output text
10196!:mime	text/x-diff
10197
10198# bsdiff:  file(1) magic for bsdiff(1) output
101990	string/b	BSDIFF40	bsdiff(1) patch file
10200
10201
10202# unified diff
102030	search/4096	---\040
10204>&0	search/1024 	\n
10205>>&0	search/1 	+++\040
10206>>>&0	search/1024 	\n
10207>>>>&0	search/1	@@		unified diff output text
10208!:mime	text/x-diff
10209!:strength + 90
10210
10211# librsync -- the library for network deltas
10212#
10213# Copyright (C) 2001 by Martin Pool.  You may do whatever you want with
10214# this file.
10215#
102160	belong		0x72730236	rdiff network-delta data
10217
102180	belong		0x72730136	rdiff network-delta signature data
10219>4	belong		x		(block length=%d,
10220>8	belong		x		signature strength=%d)
10221
10222#------------------------------------------------------------------------------
10223# $File: digital,v 1.11 2013/01/11 16:45:23 christos Exp $
10224#  Digital UNIX - Info
10225#
102260	string	=!<arch>\n________64E	Alpha archive
10227>22	string	X			-- out of date
10228#
10229
102300	leshort		0603
10231>24	leshort		0410		COFF format alpha pure
10232>24	leshort		0413		COFF format alpha demand paged
10233>>22	leshort&030000	!020000		executable
10234>>22	leshort&020000	!0		dynamically linked
10235>>16	lelong		!0		not stripped
10236>>16	lelong		0		stripped
10237>>27	byte		x		- version %d
10238>>26	byte		x		\b.%d
10239>>28	byte		x		\b-%d
10240>24	leshort		0407		COFF format alpha object
10241>>22	leshort&030000	020000		shared library
10242>>27	byte		x		- version %d
10243>>26	byte		x		\b.%d
10244>>28	byte		x		\b-%d
10245
10246# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk>
10247#
10248# The actual magic number is just "Core", followed by a 2-byte version
10249# number; however, treating any file that begins with "Core" as a Digital
10250# UNIX core dump file may produce too many false hits, so we include one
10251# byte of the version number as well; DU 5.0 appears only to be up to
10252# version 2.
10253#
102540	string		Core\001	Alpha COFF format core dump (Digital UNIX)
10255>24	string		>\0		\b, from '%s'
102560	string		Core\002	Alpha COFF format core dump (Digital UNIX)
10257>24	string		>\0		\b, from '%s'
10258#
10259# The next is incomplete, we could tell more about this format,
10260# but its not worth it.
102610	leshort		0x188	Alpha compressed COFF
102620	leshort		0x18f	Alpha u-code object
10263#
10264#
10265# Some other interesting Digital formats,
102660	string	\377\377\177		ddis/ddif
102670	string	\377\377\174		ddis/dots archive
102680	string	\377\377\176		ddis/dtif table data
102690	string	\033c\033		LN03 output
102700	long	04553207		X image
10271#
102720	string	=!<PDF>!\n		profiling data file
10273#
10274# Locale data tables (MIPS and Alpha).
10275#
102760	short		0x0501		locale data table
10277>6	short		0x24		for MIPS
10278>6	short		0x40		for Alpha
10279
10280#------------------------------------------------------------------------------
10281# $File: dolby,v 1.9 2019/04/19 00:42:27 christos Exp $
10282# ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at>
10283# from https://www.atsc.org/standards/a_52a.pdf
10284# corrections, additions, etc. are always welcome!
10285#
10286# syncword
102870	beshort		0x0b77	ATSC A/52 aka AC-3 aka Dolby Digital stream,
10288# Proposed audio/ac3 RFC/4184
10289!:mime	audio/vnd.dolby.dd-raw
10290# fscod
10291>4	byte&0xc0 = 0x00	48 kHz,
10292>4	byte&0xc0 = 0x40	44.1 kHz,
10293>4	byte&0xc0 = 0x80	32 kHz,
10294# is this one used for 96 kHz?
10295>4	byte&0xc0 = 0xc0	reserved frequency,
10296#
10297>5	byte&0x07 = 0x00	\b, complete main (CM)
10298>5	byte&0x07 = 0x01	\b, music and effects (ME)
10299>5	byte&0x07 = 0x02	\b, visually impaired (VI)
10300>5	byte&0x07 = 0x03	\b, hearing impaired (HI)
10301>5	byte&0x07 = 0x04	\b, dialogue (D)
10302>5	byte&0x07 = 0x05	\b, commentary (C)
10303>5	byte&0x07 = 0x06	\b, emergency (E)
10304>5	beshort&0x07e0  0x0720	\b, voiceover (VO)
10305>5	beshort&0x07e0 >0x0720	\b, karaoke
10306# acmod
10307>6	byte&0xe0 = 0x00	1+1 front,
10308>>6	byte&0x10 = 0x10	LFE on,
10309>6	byte&0xe0 = 0x20	1 front/0 rear,
10310>>6	byte&0x10 = 0x10	LFE on,
10311>6	byte&0xe0 = 0x40	2 front/0 rear,
10312# dsurmod (for stereo only)
10313>>6	byte&0x18 = 0x00	Dolby Surround not indicated
10314>>6	byte&0x18 = 0x08	not Dolby Surround encoded
10315>>6	byte&0x18 = 0x10	Dolby Surround encoded
10316>>6	byte&0x18 = 0x18	reserved Dolby Surround mode
10317>>6	byte&0x04 = 0x04	LFE on,
10318>6	byte&0xe0 = 0x60	3 front/0 rear,
10319>>6	byte&0x04 = 0x04	LFE on,
10320>6	byte&0xe0 = 0x80	2 front/1 rear,
10321>>6	byte&0x04 = 0x04	LFE on,
10322>6	byte&0xe0 = 0xa0	3 front/1 rear,
10323>>6	byte&0x01 = 0x01	LFE on,
10324>6	byte&0xe0 = 0xc0	2 front/2 rear,
10325>>6	byte&0x04 = 0x04	LFE on,
10326>6	byte&0xe0 = 0xe0	3 front/2 rear,
10327>>6	byte&0x01 = 0x01	LFE on,
10328#
10329>4	byte&0x3e = 0x00	\b, 32 kbit/s
10330>4	byte&0x3e = 0x02	\b, 40 kbit/s
10331>4	byte&0x3e = 0x04	\b, 48 kbit/s
10332>4	byte&0x3e = 0x06	\b, 56 kbit/s
10333>4	byte&0x3e = 0x08	\b, 64 kbit/s
10334>4	byte&0x3e = 0x0a	\b, 80 kbit/s
10335>4	byte&0x3e = 0x0c	\b, 96 kbit/s
10336>4	byte&0x3e = 0x0e	\b, 112 kbit/s
10337>4	byte&0x3e = 0x10	\b, 128 kbit/s
10338>4	byte&0x3e = 0x12	\b, 160 kbit/s
10339>4	byte&0x3e = 0x14	\b, 192 kbit/s
10340>4	byte&0x3e = 0x16	\b, 224 kbit/s
10341>4	byte&0x3e = 0x18	\b, 256 kbit/s
10342>4	byte&0x3e = 0x1a	\b, 320 kbit/s
10343>4	byte&0x3e = 0x1c	\b, 384 kbit/s
10344>4	byte&0x3e = 0x1e	\b, 448 kbit/s
10345>4	byte&0x3e = 0x20	\b, 512 kbit/s
10346>4	byte&0x3e = 0x22	\b, 576 kbit/s
10347>4	byte&0x3e = 0x24	\b, 640 kbit/s
10348
10349#------------------------------------------------------------------------------
10350# $File: dump,v 1.17 2018/06/26 01:07:17 christos Exp $
10351# dump:  file(1) magic for dump file format--for new and old dump filesystems
10352#
10353# We specify both byte orders in order to recognize byte-swapped dumps.
10354#
103550	name	new-dump-be
10356>4	bedate	x		This dump %s,
10357>8	bedate	x		Previous dump %s,
10358>12	belong	>0		Volume %d,
10359>692	belong	0		Level zero, type:
10360>692	belong	>0		Level %d, type:
10361>0	belong	1		tape header,
10362>0	belong	2		beginning of file record,
10363>0	belong	3		map of inodes on tape,
10364>0	belong	4		continuation of file record,
10365>0	belong	5		end of volume,
10366>0	belong	6		map of inodes deleted,
10367>0	belong	7		end of medium (for floppy),
10368>676	string	>\0		Label %s,
10369>696	string	>\0		Filesystem %s,
10370>760	string	>\0		Device %s,
10371>824	string	>\0		Host %s,
10372>888	belong	>0		Flags %x
10373
103740	name	old-dump-be
10375#>4	bedate	x		This dump %s,
10376#>8	bedate	x		Previous dump %s,
10377>12	belong	>0		Volume %d,
10378>692	belong	0		Level zero, type:
10379>692	belong	>0		Level %d, type:
10380>0	belong	1		tape header,
10381>0	belong	2		beginning of file record,
10382>0	belong	3		map of inodes on tape,
10383>0	belong	4		continuation of file record,
10384>0	belong	5		end of volume,
10385>0	belong	6		map of inodes deleted,
10386>0	belong	7		end of medium (for floppy),
10387>676	string	>\0		Label %s,
10388>696	string	>\0		Filesystem %s,
10389>760	string	>\0		Device %s,
10390>824	string	>\0		Host %s,
10391>888	belong	>0		Flags %x
10392
103930	name	ufs2-dump-be
10394>896	beqdate	x		This dump %s,
10395>904	beqdate	x		Previous dump %s,
10396>12	belong	>0		Volume %d,
10397>692	belong	0		Level zero, type:
10398>692	belong	>0		Level %d, type:
10399>0	belong	1		tape header,
10400>0	belong	2		beginning of file record,
10401>0	belong	3		map of inodes on tape,
10402>0	belong	4		continuation of file record,
10403>0	belong	5		end of volume,
10404>0	belong	6		map of inodes deleted,
10405>0	belong	7		end of medium (for floppy),
10406>676	string	>\0		Label %s,
10407>696	string	>\0		Filesystem %s,
10408>760	string	>\0		Device %s,
10409>824	string	>\0		Host %s,
10410>888	belong	>0		Flags %x
10411
1041224	belong	60012		new-fs dump file (big endian),
10413>0	use	new-dump-be
10414
1041524	belong	60011		old-fs dump file (big endian),
10416>0	use	old-dump-be
10417
1041824	lelong	60012		new-fs dump file (little endian),
10419# to correctly recognize '*.mo' GNU message catalog (little endian)
10420!:strength - 15
10421>0	use	\^new-dump-be
10422
1042324	lelong	60011		old-fs dump file (little endian),
10424>0	use	\^old-dump-be
10425
10426
1042724	belong	0x19540119	new-fs dump file (ufs2, big endian),
10428>0	use	ufs2-dump-be
10429
1043024	lelong	0x19540119	new-fs dump file (ufs2, little endian),
10431>0	use	\^ufs2-dump-be
10432
1043318	leshort	60011		old-fs dump file (16-bit, assuming PDP-11 endianness),
10434>2	medate	x		Previous dump %s,
10435>6	medate	x		This dump %s,
10436>10	leshort	>0		Volume %d,
10437>0	leshort	1		tape header.
10438>0	leshort	2		beginning of file record.
10439>0	leshort	3		map of inodes on tape.
10440>0	leshort	4		continuation of file record.
10441>0	leshort	5		end of volume.
10442>0	leshort	6		map of inodes deleted.
10443>0	leshort	7		end of medium (for floppy).
10444
10445#------------------------------------------------------------------------------
10446# $File: dyadic,v 1.9 2019/04/19 00:42:27 christos Exp $
10447# Dyadic: file(1) magic for Dyalog APL.
10448#
10449# updated by Joerg Jenderek at Oct 2013
10450# https://en.wikipedia.org/wiki/Dyalog_APL
10451# https://www.dyalog.com/
10452# .DXV Dyalog APL External Variable
10453# .DIN Dyalog APL Input Table
10454# .DOT Dyalog APL Output Table
10455# .DFT Dyalog APL Format File
104560	ubeshort&0xFF60	0xaa00
10457# skip biblio.dbt
10458>1	byte		!4
10459# real Dyalog APL have non zero version numbers like 7.3 or 13.4
10460>>2	ubeshort	>0x0000		Dyalog APL
10461>>>1	byte		0x00		aplcore
10462#>>>1	byte		0x00		incomplete workspace
10463# *.DCF Dyalog APL Component File
10464>>>1	byte		0x01		component file 32-bit non-journaled non-checksummed
10465#>>>1	byte		0x01		component file
10466>>>1	byte		0x02		external variable exclusive
10467#>>>1	byte		0x02		external variable
10468# *.DWS Dyalog APL Workspace
10469>>>1	byte		0x03		workspace
10470>>>>7	byte&0x28	0x00		32-bit
10471>>>>7	byte&0x28	0x20		64-bit
10472>>>>7	byte&0x0c	0x00		classic
10473>>>>7	byte&0x0c	0x04		unicode
10474>>>>7	byte&0x88	0x00		big-endian
10475>>>>7	byte&0x88	0x80		little-endian
10476>>>1	byte		0x06		external variable shared
10477# *.DSE Dyalog APL Session , *.DLF Dyalog APL Session Log File
10478>>>1	byte		0x07		session
10479>>>1	byte		0x08		mapped file 32-bit
10480>>>1	byte		0x09		component file 64-bit non-journaled non-checksummed
10481>>>1	byte		0x0a		mapped file 64-bit
10482>>>1	byte		0x0b		component file 32-bit level 1 journaled non-checksummed
10483>>>1	byte		0x0c		component file 64-bit level 1 journaled non-checksummed
10484>>>1	byte		0x0d		component file 32-bit level 1 journaled checksummed
10485>>>1	byte		0x0e		component file 64-bit level 1 journaled checksummed
10486>>>1	byte		0x0f		component file 32-bit level 2 journaled checksummed
10487>>>1	byte		0x10		component file 64-bit level 2 journaled checksummed
10488>>>1	byte		0x11		component file 32-bit level 3 journaled checksummed
10489>>>1	byte		0x12		component file 64-bit level 3 journaled checksummed
10490>>>1	byte		0x13		component file 32-bit non-journaled checksummed
10491>>>1	byte		0x14		component file 64-bit non-journaled checksummed
10492>>>1	byte		0x15		component file under construction
10493>>>1	byte		0x16		DFS component file 64-bit level 1 journaled checksummed
10494>>>1	byte		0x17		DFS component file 64-bit level 2 journaled checksummed
10495>>>1	byte		0x18		DFS component file 64-bit level 3 journaled checksummed
10496>>>1	byte		0x19		external workspace
10497>>>1	byte		0x80		DDB
10498>>>2	byte		x		version %d
10499>>>3	byte		x		\b.%d
10500#>>>2	byte		x		type %d
10501#>>>3	byte		x		subtype %d
10502
10503# *.DXF Dyalog APL Transfer File
105040	short		0x6060		Dyalog APL transfer
10505
10506#------------------------------------------------------------------------------
10507# $File: ebml,v 1.2 2019/04/19 00:42:27 christos Exp $
10508# ebml:  file(1) magic for various Extensible Binary Meta Language
10509# https://www.matroska.org/technical/specs/index.html#track
105100	belong	0x1a45dfa3	EBML file
10511>4	search/b/100	\102\202
10512>>&1	string	x		\b, creator %.8s
10513
10514#------------------------------------------------------------------------------
10515# $File: edid,v 1.1 2019/03/28 12:36:01 christos Exp $
10516# edid:  file(1) magic for EDID dump files
10517
105180	quad	0x00ffffffffffff00	Extended display identification data dump
10519!:mime application/x-edid-dump
10520>18	byte	0x01			Version 1
10521>>19	byte	<0x04			\b.%d
10522>18	byte	0x02			Version 2
10523>>19	byte	0x00			\b.0
10524
10525#------------------------------------------------------------------------------
10526# $File: editors,v 1.12 2020/10/11 20:28:07 christos Exp $
10527# T602 editor documents
10528# by David Necas <yeti@physics.muni.cz>
105290	string	@CT\ 	T602 document data,
10530>4	string	0	Kamenicky
10531>4	string	1	CP 852
10532>4	string	2	KOI8-CS
10533>4	string	>2	unknown encoding
10534
10535# Vi IMproved Encrypted file
10536# by David Necas <yeti@physics.muni.cz>
10537# updated by Osman Surkatty
105380	string	VimCrypt~	Vim encrypted file data
10539>9	string	01!		with zip cryptmethod
10540>9	string	02!		with blowfish cryptmethod
10541>9	string	03!		with blowfish2 cryptmethod
10542
105430	name	vimnanoswap
10544>67	byte	0
10545>>107	byte	0
10546#>>>2	string	x	%s swap file
10547>>>24	ulelong	x	\b, pid %d
10548>>>28	string	>\0	\b, user %s
10549>>>68	string	>\0	\b, host %s
10550>>>108	string	>\0	\b, file %s
10551>>>1007	byte	0x55	\b, modified
10552
10553# Vi IMproved Swap file
10554# by Sven Wegener <swegener@gentoo.org>
105550	string  b0VIM\ 		Vim swap file
10556>&0	string  >\0		\b, version %s
10557>0	use	vimnanoswap
10558
10559
10560# Lock/swap file for several editors, at least
10561# Vi IMproved and nano
105620	string	b0nano		Nano swap file
10563>0	use	vimnanoswap
10564
10565# kate (K Advanced Text Editor)
105660	string	\x00\x00\x00\x12Kate\ Swap\ File\ 2.0\x00	Kate swap file
10567
10568#------------------------------------------------------------------------------
10569# $File: efi,v 1.5 2014/04/30 21:41:02 christos Exp $
10570# efi:  file(1) magic for Universal EFI binaries
10571
105720	lelong	0x0ef1fab9
10573>4	lelong	1		Universal EFI binary with 1 architecture
10574>>&0	lelong	7		\b, i386
10575>>&0	lelong	0x01000007	\b, x86_64
10576>4	lelong	2		Universal EFI binary with 2 architectures
10577>>&0	lelong	7		\b, i386
10578>>&0	lelong	0x01000007	\b, x86_64
10579>>&20	lelong	7		\b, i386
10580>>&20	lelong	0x01000007	\b, x86_64
10581>4	lelong	>2		Universal EFI binary with %d architectures
10582
10583#------------------------------------------------------------------------------
10584# $File: elf,v 1.85 2021/03/27 20:18:38 christos Exp $
10585# elf:  file(1) magic for ELF executables
10586#
10587# We have to check the byte order flag to see what byte order all the
10588# other stuff in the header is in.
10589#
10590# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
10591#
10592# Created by: unknown
10593# Modified by (1): Daniel Quinlan <quinlan@yggdrasil.com>
10594# Modified by (2): Peter Tobias <tobias@server.et-inf.fho-emden.de> (core support)
10595# Modified by (3): Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> (fix of core support)
10596# Modified by (4): <gerardo.cacciari@gmail.com> (VMS Itanium)
10597# Modified by (5): Matthias Urlichs <smurf@debian.org> (Listing of many architectures)
10598
105990	name		elf-mips
10600>0	lelong&0xf0000000	0x00000000	MIPS-I
10601>0	lelong&0xf0000000	0x10000000	MIPS-II
10602>0	lelong&0xf0000000	0x20000000	MIPS-III
10603>0	lelong&0xf0000000	0x30000000	MIPS-IV
10604>0	lelong&0xf0000000	0x40000000	MIPS-V
10605>0	lelong&0xf0000000	0x50000000	MIPS32
10606>0	lelong&0xf0000000	0x60000000	MIPS64
10607>0	lelong&0xf0000000	0x70000000	MIPS32 rel2
10608>0	lelong&0xf0000000	0x80000000	MIPS64 rel2
10609>0	lelong&0xf0000000	0x90000000	MIPS32 rel6
10610>0	lelong&0xf0000000	0xa0000000	MIPS64 rel6
10611
106120	name		elf-sparc
10613>0	lelong&0x00ffff00	0x00000100	V8+ Required,
10614>0	lelong&0x00ffff00	0x00000200	Sun UltraSPARC1 Extensions Required,
10615>0	lelong&0x00ffff00	0x00000400	HaL R1 Extensions Required,
10616>0	lelong&0x00ffff00	0x00000800	Sun UltraSPARC3 Extensions Required,
10617>0	lelong&0x3		0		total store ordering,
10618>0	lelong&0x3		1		partial store ordering,
10619>0	lelong&0x3		2		relaxed memory ordering,
10620
106210	name		elf-pa-risc
10622>2	leshort		0x020b		1.0
10623>2	leshort		0x0210		1.1
10624>2	leshort		0x0214		2.0
10625>0	leshort		&0x0008		(LP64)
10626
106270	name		elf-riscv
10628>0	lelong&0x00000001	0x00000001	RVC,
10629>0	lelong&0x00000008	0x00000008	RVE,
10630>0	lelong&0x00000006	0x00000000	soft-float ABI,
10631>0	lelong&0x00000006	0x00000002	single-float ABI,
10632>0	lelong&0x00000006	0x00000004	double-float ABI,
10633>0	lelong&0x00000006	0x00000006	quad-float ABI,
10634
106350	name		elf-le
10636>16	leshort		0		no file type,
10637!:mime	application/octet-stream
10638>16	leshort		1		relocatable,
10639!:mime	application/x-object
10640>16	leshort		2		executable,
10641!:mime	application/x-executable
10642>16	leshort		3		${x?pie executable:shared object},
10643
10644!:mime	application/x-${x?pie-executable:sharedlib}
10645>16	leshort		4		core file,
10646!:mime	application/x-coredump
10647# OS-specific
10648>7	byte		202
10649>>16	leshort		0xFE01		executable,
10650!:mime	application/x-executable
10651# Core file detection is not reliable.
10652#>>>(0x38+0xcc) string	>\0		of '%s'
10653#>>>(0x38+0x10) lelong	>0		(signal %d),
10654>16	leshort		&0xff00
10655>>18	leshort		!8		processor-specific,
10656>>18	leshort		8
10657>>>16	leshort		0xFF80		PlayStation 2 IOP module,
10658!:mime	application/x-sharedlib
10659>>>16	leshort		!0xFF80		processor-specific,
10660>18	clear		x
10661>18	leshort		0		no machine,
10662>18	leshort		1		AT&T WE32100,
10663>18	leshort		2		SPARC,
10664>18	leshort		3		Intel 80386,
10665>18	leshort		4		Motorola m68k,
10666>>4	byte		1
10667>>>36	lelong		&0x01000000	68000,
10668>>>36	lelong		&0x00810000	CPU32,
10669>>>36	lelong		0		68020,
10670>18	leshort		5		Motorola m88k,
10671>18	leshort		6		Intel 80486,
10672>18	leshort		7		Intel 80860,
10673# The official e_machine number for MIPS is now #8, regardless of endianness.
10674# The second number (#10) will be deprecated later. For now, we still
10675# say something if #10 is encountered, but only gory details for #8.
10676>18	leshort		8		MIPS,
10677>>4	byte		1
10678>>>36	lelong		&0x20		N32
10679>18	leshort		10		MIPS,
10680>>4	byte		1
10681>>>36	lelong		&0x20		N32
10682>18	leshort		8
10683# only for 32-bit
10684>>4	byte		1
10685>>>36	use		elf-mips
10686# only for 64-bit
10687>>4	byte		2
10688>>>48	use		elf-mips
10689>18	leshort		9		Amdahl,
10690>18	leshort		10		MIPS (deprecated),
10691>18	leshort		11		RS6000,
10692>18	leshort		15		PA-RISC,
10693# only for 32-bit
10694>>4	byte		1
10695>>>36	use		elf-pa-risc
10696# only for 64-bit
10697>>4	byte		2
10698>>>48	use		elf-pa-risc
10699>18	leshort		16		nCUBE,
10700>18	leshort		17		Fujitsu VPP500,
10701>18	leshort		18		SPARC32PLUS,
10702# only for 32-bit
10703>>4	byte		1
10704>>>36	use		elf-sparc
10705>18	leshort		19		Intel 80960,
10706>18	leshort		20		PowerPC or cisco 4500,
10707>18	leshort		21		64-bit PowerPC or cisco 7500,
10708>>48	lelong		0		Unspecified or Power ELF V1 ABI,
10709>>48	lelong		1		Power ELF V1 ABI,
10710>>48	lelong		2		OpenPOWER ELF V2 ABI,
10711>18	leshort		22		IBM S/390,
10712>18	leshort		23		Cell SPU,
10713>18	leshort		24		cisco SVIP,
10714>18	leshort		25		cisco 7200,
10715>18	leshort		36		NEC V800 or cisco 12000,
10716>18	leshort		37		Fujitsu FR20,
10717>18	leshort		38		TRW RH-32,
10718>18	leshort		39		Motorola RCE,
10719>18	leshort		40		ARM,
10720>>4	byte		1
10721>>>36	lelong&0xff000000	0x04000000	EABI4
10722>>>36	lelong&0xff000000	0x05000000	EABI5
10723>>>36	lelong		&0x00800000	BE8
10724>>>36	lelong		&0x00400000	LE8
10725>18	leshort		41		Alpha,
10726>18	leshort		42		Renesas SH,
10727>18	leshort		43		SPARC V9,
10728>>4	byte		2
10729>>>48	use		elf-sparc
10730>18	leshort		44		Siemens Tricore Embedded Processor,
10731>18	leshort		45		Argonaut RISC Core, Argonaut Technologies Inc.,
10732>18	leshort		46		Renesas H8/300,
10733>18	leshort		47		Renesas H8/300H,
10734>18	leshort		48		Renesas H8S,
10735>18	leshort		49		Renesas H8/500,
10736>18	leshort		50		IA-64,
10737>18	leshort		51		Stanford MIPS-X,
10738>18	leshort		52		Motorola Coldfire,
10739>18	leshort		53		Motorola M68HC12,
10740>18	leshort		54		Fujitsu MMA,
10741>18	leshort		55		Siemens PCP,
10742>18	leshort		56		Sony nCPU,
10743>18	leshort		57		Denso NDR1,
10744>18	leshort		58		Start*Core,
10745>18	leshort		59		Toyota ME16,
10746>18	leshort		60		ST100,
10747>18	leshort		61		Tinyj emb.,
10748>18	leshort		62		x86-64,
10749>18	leshort		63		Sony DSP,
10750>18	leshort		64		DEC PDP-10,
10751>18	leshort		65		DEC PDP-11,
10752>18	leshort		66		FX66,
10753>18	leshort		67		ST9+ 8/16 bit,
10754>18	leshort		68		ST7 8 bit,
10755>18	leshort		69		MC68HC16,
10756>18	leshort		70		MC68HC11,
10757>18	leshort		71		MC68HC08,
10758>18	leshort		72		MC68HC05,
10759>18	leshort		73		SGI SVx or Cray NV1,
10760>18	leshort		74		ST19 8 bit,
10761>18	leshort		75		Digital VAX,
10762>18	leshort		76		Axis cris,
10763>18	leshort		77		Infineon 32-bit embedded,
10764>18	leshort		78		Element 14 64-bit DSP,
10765>18	leshort		79		LSI Logic 16-bit DSP,
10766>18	leshort		80		MMIX,
10767>18	leshort		81		Harvard machine-independent,
10768>18	leshort		82		SiTera Prism,
10769>18	leshort		83		Atmel AVR 8-bit,
10770>18	leshort		84		Fujitsu FR30,
10771>18	leshort		85		Mitsubishi D10V,
10772>18	leshort		86		Mitsubishi D30V,
10773>18	leshort		87		NEC v850,
10774>18	leshort		88		Renesas M32R,
10775>18	leshort		89		Matsushita MN10300,
10776>18	leshort		90		Matsushita MN10200,
10777>18	leshort		91		picoJava,
10778>18	leshort		92		OpenRISC,
10779>18	leshort		93		Synopsys ARCompact ARC700 cores,
10780>18	leshort		94		Tensilica Xtensa,
10781>18	leshort		95		Alphamosaic VideoCore,
10782>18	leshort		96		Thompson Multimedia,
10783>18	leshort		97		NatSemi 32k,
10784>18	leshort		98		Tenor Network TPC,
10785>18	leshort		99		Trebia SNP 1000,
10786>18	leshort		100		STMicroelectronics ST200,
10787>18	leshort		101		Ubicom IP2022,
10788>18	leshort		102		MAX Processor,
10789>18	leshort		103		NatSemi CompactRISC,
10790>18	leshort		104		Fujitsu F2MC16,
10791>18	leshort		105		TI msp430,
10792>18	leshort		106		Analog Devices Blackfin,
10793>18	leshort		107		S1C33 Family of Seiko Epson,
10794>18	leshort		108		Sharp embedded,
10795>18	leshort		109		Arca RISC,
10796>18	leshort		110		PKU-Unity Ltd.,
10797>18	leshort		111		eXcess: 16/32/64-bit,
10798>18	leshort		112		Icera Deep Execution Processor,
10799>18	leshort		113		Altera Nios II,
10800>18	leshort		114		NatSemi CRX,
10801>18	leshort		115		Motorola XGATE,
10802>18	leshort		116		Infineon C16x/XC16x,
10803>18	leshort		117		Renesas M16C series,
10804>18	leshort		118		Microchip dsPIC30F,
10805>18	leshort		119		Freescale RISC core,
10806>18	leshort		120		Renesas M32C series,
10807>18	leshort		131		Altium TSK3000 core,
10808>18	leshort		132		Freescale RS08,
10809>18	leshort		134		Cyan Technology eCOG2,
10810>18	leshort		135		Sunplus S+core7 RISC,
10811>18	leshort		136		New Japan Radio (NJR) 24-bit DSP,
10812>18	leshort		137		Broadcom VideoCore III,
10813>18	leshort		138		LatticeMico32,
10814>18	leshort		139		Seiko Epson C17 family,
10815>18	leshort		140		TI TMS320C6000 DSP family,
10816>18	leshort		141		TI TMS320C2000 DSP family,
10817>18	leshort		142		TI TMS320C55x DSP family,
10818>18	leshort		144		TI Programmable Realtime Unit
10819>18	leshort		160		STMicroelectronics 64bit VLIW DSP,
10820>18	leshort		161		Cypress M8C,
10821>18	leshort		162		Renesas R32C series,
10822>18	leshort		163		NXP TriMedia family,
10823>18	leshort		164		QUALCOMM DSP6,
10824>18	leshort		165		Intel 8051 and variants,
10825>18	leshort		166		STMicroelectronics STxP7x family,
10826>18	leshort		167		Andes embedded RISC,
10827>18	leshort		168		Cyan eCOG1X family,
10828>18	leshort		169		Dallas MAXQ30,
10829>18	leshort		170		New Japan Radio (NJR) 16-bit DSP,
10830>18	leshort		171		M2000 Reconfigurable RISC,
10831>18	leshort		172		Cray NV2 vector architecture,
10832>18	leshort		173		Renesas RX family,
10833>18	leshort		174		META,
10834>18	leshort		175		MCST Elbrus,
10835>18	leshort		176		Cyan Technology eCOG16 family,
10836>18	leshort		177		NatSemi CompactRISC,
10837>18	leshort		178		Freescale Extended Time Processing Unit,
10838>18	leshort		179		Infineon SLE9X,
10839>18	leshort		180		Intel L1OM,
10840>18	leshort		181		Intel K1OM,
10841>18	leshort		183		ARM aarch64,
10842>18	leshort		185		Atmel 32-bit family,
10843>18	leshort		186		STMicroeletronics STM8 8-bit,
10844>18	leshort		187		Tilera TILE64,
10845>18	leshort		188		Tilera TILEPro,
10846>18	leshort		189		Xilinx MicroBlaze 32-bit RISC,
10847>18	leshort		190		NVIDIA CUDA architecture,
10848>18	leshort		191		Tilera TILE-Gx,
10849>18	leshort		195		Synopsys ARCv2/HS3x/HS4x cores,
10850>18	leshort		197		Renesas RL78 family,
10851>18	leshort		199		Renesas 78K0R,
10852>18	leshort		200		Freescale 56800EX,
10853>18	leshort		201		Beyond BA1,
10854>18	leshort		202		Beyond BA2,
10855>18	leshort		203		XMOS xCORE,
10856>18	leshort		204		Microchip 8-bit PIC(r),
10857>18	leshort		210		KM211 KM32,
10858>18	leshort		211		KM211 KMX32,
10859>18	leshort		212		KM211 KMX16,
10860>18	leshort		213		KM211 KMX8,
10861>18	leshort		214		KM211 KVARC,
10862>18	leshort		215		Paneve CDP,
10863>18	leshort		216		Cognitive Smart Memory,
10864>18	leshort		217		iCelero CoolEngine,
10865>18	leshort		218		Nanoradio Optimized RISC,
10866>18	leshort		243		UCB RISC-V,
10867# only for 32-bit
10868>>4	byte		1
10869>>>36	use		elf-riscv
10870# only for 64-bit
10871>>4	byte		2
10872>>>48	use		elf-riscv
10873>18	leshort		244		Lanai 32-bit processor,
10874>18	leshort		245		CEVA Processor Architecture Family,
10875>18	leshort		246		CEVA X2 Processor Family,
10876>18	leshort		247		eBPF,
10877>18	leshort		248		Graphcore Intelligent Processing Unit,
10878>18	leshort		249		Imagination Technologies,
10879>18	leshort		250		Netronome Flow Processor,
10880>18	leshort		251             NEC Vector Engine,
10881>18	leshort		252		C-SKY processor family,
10882>18	leshort		253		Synopsys ARCv3 64-bit ISA/HS6x cores,
10883>18	leshort		254		MOS Technology MCS 6502 processor,
10884>18	leshort		255		Synopsys ARCv3 32-bit,
10885>18	leshort		256		Kalray VLIW core of the MPPA family,
10886>18	leshort		257		WDC 65816/65C816,
10887>18	leshort		258		Loongson Loongarch,
10888>18	leshort		259		ChipON KungFu32,
10889>18	leshort		0x1057		AVR (unofficial),
10890>18	leshort		0x1059		MSP430 (unofficial),
10891>18	leshort		0x1223		Adapteva Epiphany (unofficial),
10892>18	leshort		0x2530		Morpho MT (unofficial),
10893>18	leshort		0x3330		FR30 (unofficial),
10894>18	leshort		0x3426		OpenRISC (obsolete),
10895>18	leshort		0x4688		Infineon C166 (unofficial),
10896>18	leshort		0x5441		Cygnus FRV (unofficial),
10897>18	leshort		0x5aa5		DLX (unofficial),
10898>18	leshort		0x7650		Cygnus D10V (unofficial),
10899>18	leshort		0x7676		Cygnus D30V (unofficial),
10900>18	leshort		0x8217		Ubicom IP2xxx (unofficial),
10901>18	leshort		0x8472		OpenRISC (obsolete),
10902>18	leshort		0x9025		Cygnus PowerPC (unofficial),
10903>18	leshort		0x9026		Alpha (unofficial),
10904>18	leshort		0x9041		Cygnus M32R (unofficial),
10905>18	leshort		0x9080		Cygnus V850 (unofficial),
10906>18	leshort		0xa390		IBM S/390 (obsolete),
10907>18	leshort		0xabc7		Old Xtensa (unofficial),
10908>18	leshort		0xad45		xstormy16 (unofficial),
10909>18	leshort		0xbaab		Old MicroBlaze (unofficial),,
10910>18	leshort		0xbeef		Cygnus MN10300 (unofficial),
10911>18	leshort		0xdead		Cygnus MN10200 (unofficial),
10912>18	leshort		0xf00d		Toshiba MeP (unofficial),
10913>18	leshort		0xfeb0		Renesas M32C (unofficial),
10914>18	leshort		0xfeba		Vitesse IQ2000 (unofficial),
10915>18	leshort		0xfebb		NIOS (unofficial),
10916>18	leshort		0xfeed		Moxie (unofficial),
10917>18	default		x
10918>>18	leshort		x		*unknown arch 0x%x*
10919>20	lelong		0		invalid version
10920>20	lelong		1		version 1
10921
109220	string		\177ELF		ELF
10923!:strength *2
10924>4	byte		0		invalid class
10925>4	byte		1		32-bit
10926>4	byte		2		64-bit
10927>5	byte		0		invalid byte order
10928>5	byte		1		LSB
10929>>0	use		elf-le
10930>5	byte		2		MSB
10931>>0	use		\^elf-le
10932>7	byte		0		(SYSV)
10933>7	byte		1		(HP-UX)
10934>7	byte		2		(NetBSD)
10935>7	byte		3		(GNU/Linux)
10936>7	byte		4		(GNU/Hurd)
10937>7	byte		5		(86Open)
10938>7	byte		6		(Solaris)
10939>7	byte		7		(Monterey)
10940>7	byte		8		(IRIX)
10941>7	byte		9		(FreeBSD)
10942>7	byte		10		(Tru64)
10943>7	byte		11		(Novell Modesto)
10944>7	byte		12		(OpenBSD)
10945>7	byte		13		(OpenVMS)
10946>7	byte		14		(HP NonStop Kernel)
10947>7	byte		15		(AROS Research Operating System)
10948>7	byte		16		(FenixOS)
10949>7	byte		17		(Nuxi CloudABI)
10950>7	byte		97		(ARM)
10951>7	byte		202		(Cafe OS)
10952>7	byte		255		(embedded)
10953
10954#------------------------------------------------------------------------------
10955# $File: encore,v 1.7 2014/04/30 21:41:02 christos Exp $
10956# encore:  file(1) magic for Encore machines
10957#
10958# XXX - needs to have the byte order specified (NS32K was little-endian,
10959# dunno whether they run the 88K in little-endian mode or not).
10960#
109610	short		0x154		Encore
10962>20	short		0x107		executable
10963>20	short		0x108		pure executable
10964>20	short		0x10b		demand-paged executable
10965>20	short		0x10f		unsupported executable
10966>12	long		>0		not stripped
10967>22	short		>0		- version %d
10968>22	short		0		-
10969#>4	date		x		stamp %s
109700	short		0x155		Encore unsupported executable
10971>12	long		>0		not stripped
10972>22	short		>0		- version %d
10973>22	short		0		-
10974#>4	date		x		stamp %s
10975
10976#------------------------------------------------------------------------------
10977# $File: epoc,v 1.9 2013/12/21 14:28:15 christos Exp $
10978# EPOC : file(1) magic for EPOC documents [Psion Series 5/Osaris/Geofox 1]
10979# Stefan Praszalowicz <hpicollo@worldnet.fr> and Peter Breitenlohner <peb@mppmu.mpg.de>
10980# Useful information for improving this file can be found at:
10981# http://software.frodo.looijaard.name/psiconv/formats/Index.html
10982#------------------------------------------------------------------------------
109830	lelong		0x10000037	Psion Series 5
10984>4	lelong		0x10000039	font file
10985>4	lelong		0x1000003A	printer driver
10986>4	lelong		0x1000003B	clipboard
10987>4	lelong		0x10000042	multi-bitmap image
10988!:mime image/x-epoc-mbm
10989>4	lelong		0x1000006A	application information file
10990>4	lelong		0x1000006D
10991>>8	lelong		0x1000007D	Sketch image
10992!:mime image/x-epoc-sketch
10993>>8	lelong		0x1000007E	voice note
10994>>8	lelong		0x1000007F	Word file
10995!:mime application/x-epoc-word
10996>>8	lelong		0x10000085	OPL program (TextEd)
10997!:mime application/x-epoc-opl
10998>>8	lelong		0x10000087	Comms settings
10999>>8	lelong		0x10000088	Sheet file
11000!:mime application/x-epoc-sheet
11001>>8	lelong		0x100001C4	EasyFax initialisation file
11002>4	lelong		0x10000073	OPO module
11003!:mime application/x-epoc-opo
11004>4	lelong		0x10000074	OPL application
11005!:mime application/x-epoc-app
11006>4	lelong		0x1000008A	exported multi-bitmap image
11007>4	lelong		0x1000016D
11008>>8	lelong		0x10000087	Comms names
11009
110100	lelong		0x10000041	Psion Series 5 ROM multi-bitmap image
11011
110120	lelong		0x10000050	Psion Series 5
11013>4	lelong		0x1000006D	database
11014>>8	lelong		0x10000084	Agenda file
11015!:mime application/x-epoc-agenda
11016>>8	lelong		0x10000086	Data file
11017!:mime application/x-epoc-data
11018>>8	lelong		0x10000CEA	Jotter file
11019!:mime application/x-epoc-jotter
11020>4	lelong		0x100000E4	ini file
11021
110220	lelong		0x10000079	Psion Series 5 binary:
11023>4	lelong		0x00000000	DLL
11024>4	lelong		0x10000049	comms hardware library
11025>4	lelong		0x1000004A	comms protocol library
11026>4	lelong		0x1000005D	OPX
11027>4	lelong		0x1000006C	application
11028>4	lelong		0x1000008D	DLL
11029>4	lelong		0x100000AC	logical device driver
11030>4	lelong		0x100000AD	physical device driver
11031>4	lelong		0x100000E5	file transfer protocol
11032>4	lelong		0x100000E5	file transfer protocol
11033>4	lelong		0x10000140	printer definition
11034>4	lelong		0x10000141	printer definition
11035
110360	lelong		0x1000007A	Psion Series 5 executable
11037
11038#------------------------------------------------------------------------------
11039# $File: erlang,v 1.7 2019/04/19 00:42:27 christos Exp $
11040# erlang:  file(1) magic for Erlang JAM and BEAM files
11041# URL:  https://www.erlang.org/faq/x779.html#AEN812
11042
11043# OTP R3-R4
110440	string	\0177BEAM!	Old Erlang BEAM file
11045>6	short	>0		- version %d
11046
11047# OTP R5 and onwards
110480	string	FOR1
11049>8	string	BEAM		Erlang BEAM file
11050
11051# 4.2 version may have a copyright notice!
110524	string	Tue\ Jan\ 22\ 14:32:44\ MET\ 1991	Erlang JAM file - version 4.2
1105379	string	Tue\ Jan\ 22\ 14:32:44\ MET\ 1991	Erlang JAM file - version 4.2
11054
110554	string	1.0\ Fri\ Feb\ 3\ 09:55:56\ MET\ 1995	Erlang JAM file - version 4.3
11056
110570	bequad	0x0000000000ABCDEF	Erlang DETS file
11058
11059# $File: espressif,v 1.2 2019/11/15 21:03:14 christos Exp $
11060# configuration dump of Tasmota firmware for ESP8266 based devices by Espressif
11061# URL: https://github.com/arendst/Sonoff-Tasmota/
11062# Reference: https://codeload.github.com/arendst/Sonoff-Tasmota/zip/release-6.2/
11063# Sonoff-Tasmota-release-6.2.zip/Sonoff-Tasmota-release-6.2/sonoff/settings.h
11064# From: Joerg Jenderek
11065#
11066# cfg_holder=4617=0x1209
110670		uleshort	4617
11068# remaining settings normally 0x5A+offset XORed; free_1D5[20] empty since 5.12.0e
11069>0x1D5		ubequad		0x2f30313233343536	configuration of Tasmota firmware (ESP8266)
11070!:mime	application/x-tasmota-dmp
11071!:ext	dmp
11072# version like 6.2.1.0 ~ 0x06020100 XORed to 0x63666262
11073>>11		ubyte^0x65	x			\b, version %u
11074>>10		ubyte^0x64	x			\b.%u
11075>>9		ubyte^0x63	x			\b.%u
11076>>8		ubyte^0x62	x			\b.%u
11077#>8		ubelong		x			(0x%x)
11078# hostname[33] XORed
11079>>0x165		ubyte^0x1BF	x			\b, hostname %c
11080>>0x166		ubyte^0x1C0	>037			\b%c
11081>>0x167		ubyte^0x1C1	>037			\b%c
11082>>0x168		ubyte^0x1C2	>037			\b%c
11083>>0x169		ubyte^0x1C3	>037			\b%c
11084>>0x16A		ubyte^0x1C4	>037			\b%c
11085>>0x16B		ubyte^0x1C5	>037			\b%c
11086>>0x16C		ubyte^0x1C6	>037			\b%c
11087>>0x16D		ubyte^0x1C7	>037			\b%c
11088>>0x16E		ubyte^0x1C8	>037			\b%c
11089>>0x16F		ubyte^0x1C9	>037			\b%c
11090>>0x170		ubyte^0x1CA	>037			\b%c
11091>>0x171		ubyte^0x1CB	>037			\b%c
11092>>0x172		ubyte^0x1CC 	>037			\b%c
11093>>0x173		ubyte^0x1CD	>037			\b%c
11094>>0x174		ubyte^0x1CE	>037			\b%c
11095>>0x175		ubyte^0x1CF	>037			\b%c
11096>>0x176		ubyte^0x1D0	>037			\b%c
11097>>0x177		ubyte^0x1D1	>037			\b%c
11098>>0x178		ubyte^0x1D2	>037			\b%c
11099>>0x179		ubyte^0x1D3	>037			\b%c
11100>>0x17A		ubyte^0x1D4	>037			\b%c
11101>>0x17B		ubyte^0x1D5	>037			\b%c
11102>>0x17C		ubyte^0x1D6	>037			\b%c
11103>>0x17D		ubyte^0x1D7	>037			\b%c
11104>>0x17E		ubyte^0x1D8	>037			\b%c
11105>>0x17F		ubyte^0x1D9	>037			\b%c
11106>>0x180		ubyte^0x1DA	>037			\b%c
11107>>0x181		ubyte^0x1DB	>037			\b%c
11108>>0x182		ubyte^0x1DC	>037			\b%c
11109>>0x183		ubyte^0x1DD	>037			\b%c
11110>>0x184		ubyte^0x1DE	>037			\b%c
11111>>0x185		ubyte^0x1DF	>037			\b%c
11112#>>0x165		string		x			(%.33s)
11113
11114
11115
11116#------------------------------------------------------------------------------
11117# $File: esri,v 1.5 2019/04/19 00:42:27 christos Exp $
11118# ESRI Shapefile format (.shp .shx .dbf=DBaseIII)
11119# Based on info from
11120# <URL:https://www.esri.com/library/whitepapers/pdfs/shapefile.pdf>
111210	belong	9994	ESRI Shapefile
11122>4	belong	=0
11123>8	belong	=0
11124>12	belong	=0
11125>16	belong	=0
11126>20	belong	=0
11127>28	lelong	x	version %d
11128>24	belong	x	length %d
11129>32	lelong	=0	type Null Shape
11130>32	lelong	=1	type Point
11131>32	lelong	=3	type PolyLine
11132>32	lelong	=5	type Polygon
11133>32	lelong	=8	type MultiPoint
11134>32	lelong	=11	type PointZ
11135>32	lelong	=13	type PolyLineZ
11136>32	lelong	=15	type PolygonZ
11137>32	lelong	=18	type MultiPointZ
11138>32	lelong	=21	type PointM
11139>32	lelong	=23	type PolyLineM
11140>32	lelong	=25	type PolygonM
11141>32	lelong	=28	type MultiPointM
11142>32	lelong	=31	type MultiPatch
11143
11144#------------------------------------------------------------------------------
11145# $File: fcs,v 1.4 2009/09/19 16:28:09 christos Exp $
11146# fcs: file(1) magic for FCS (Flow Cytometry Standard) data files
11147# From Roger Leigh <roger@whinlatter.uklinux.net>
111480       string          FCS1.0          Flow Cytometry Standard (FCS) data, version 1.0
111490       string          FCS2.0          Flow Cytometry Standard (FCS) data, version 2.0
111500       string          FCS3.0          Flow Cytometry Standard (FCS) data, version 3.0
11151
11152#------------------------------------------------------------------------------
11153# $File: filesystems,v 1.140 2021/02/23 00:51:10 christos Exp $
11154# filesystems:  file(1) magic for different filesystems
11155#
111560	name	partid
11157>0	ubyte	0x00	Unused
11158>0	ubyte	0x01	12-bit FAT
11159>0	ubyte	0x02	XENIX /
11160>0	ubyte	0x03	XENIX /usr
11161>0	ubyte	0x04	16-bit FAT, less than 32M
11162>0	ubyte	0x05	extended partition
11163>0	ubyte	0x06	16-bit FAT, more than 32M
11164>0	ubyte	0x07	OS/2 HPFS, NTFS, QNX2, Adv. UNIX
11165>0	ubyte	0x08	AIX or os, or etc.
11166>0	ubyte	0x09	AIX boot partition or Coherent
11167>0	ubyte	0x0a	O/2 boot manager or Coherent swap
11168>0	ubyte	0x0b	32-bit FAT
11169>0	ubyte	0x0c	32-bit FAT, LBA-mapped
11170>0	ubyte	0x0d	7XXX, LBA-mapped
11171>0	ubyte	0x0e	16-bit FAT, LBA-mapped
11172>0	ubyte	0x0f	extended partition, LBA-mapped
11173>0	ubyte	0x10	OPUS
11174>0	ubyte	0x11 	OS/2 DOS 12-bit FAT
11175>0	ubyte	0x12 	Compaq diagnostics
11176>0	ubyte	0x14 	OS/2 DOS 16-bit FAT <32M
11177>0	ubyte	0x16 	OS/2 DOS 16-bit FAT >=32M
11178>0	ubyte	0x17 	OS/2 hidden IFS
11179>0	ubyte	0x18 	AST Windows swapfile
11180>0	ubyte	0x19 	Willowtech Photon coS
11181>0	ubyte	0x1b 	hidden win95 fat 32
11182>0	ubyte	0x1c 	hidden win95 fat 32 lba
11183>0	ubyte	0x1d	hidden win95 fat 16 lba
11184>0	ubyte	0x20 	Willowsoft OFS1
11185>0	ubyte	0x21 	reserved
11186>0	ubyte	0x23 	reserved
11187>0	ubyte	0x24	NEC DOS
11188>0	ubyte	0x26 	reserved
11189>0	ubyte	0x31 	reserved
11190>0	ubyte	0x32	Alien Internet Services NOS
11191>0	ubyte	0x33 	reserved
11192>0	ubyte	0x34 	reserved
11193>0	ubyte	0x35 	JFS on OS2
11194>0	ubyte	0x36 	reserved
11195>0	ubyte	0x38 	Theos
11196>0	ubyte	0x39 	Plan 9, or Theos spanned
11197>0	ubyte	0x3a 	Theos ver 4 4gb partition
11198>0	ubyte	0x3b 	Theos ve 4 extended partition
11199>0	ubyte	0x3c 	PartitionMagic recovery
11200>0	ubyte	0x3d 	Hidden Netware
11201>0	ubyte	0x40 	VENIX 286 or LynxOS
11202>0	ubyte	0x41	PReP
11203>0	ubyte	0x42	linux swap sharing DRDOS disk
11204>0	ubyte	0x43	linux sharing DRDOS disk
11205>0	ubyte	0x44	GoBack change utility
11206>0	ubyte	0x45	Boot US Boot manager
11207>0	ubyte	0x46	EUMEL/Elan or Ergos 3
11208>0	ubyte	0x47	EUMEL/Elan or Ergos 3
11209>0	ubyte	0x48	EUMEL/Elan or Ergos 3
11210>0	ubyte	0x4a	ALFX/THIN filesystem for DOS
11211>0	ubyte	0x4c	Oberon partition
11212>0	ubyte	0x4d 	QNX4.x
11213>0	ubyte	0x4e 	QNX4.x 2nd part
11214>0	ubyte	0x4f 	QNX4.x 3rd part
11215>0	ubyte	0x50 	DM (disk manager)
11216>0	ubyte	0x51 	DM6 Aux1 (or Novell)
11217>0	ubyte	0x52 	CP/M or Microport SysV/AT
11218>0	ubyte	0x53 	DM6 Aux3
11219>0	ubyte	0x54	DM6 DDO
11220>0	ubyte	0x55	EZ-Drive (disk manager)
11221>0	ubyte	0x56	Golden Bow (disk manager)
11222>0	ubyte	0x57	Drive PRO
11223>0	ubyte	0x5c	Priam Edisk (disk manager)
11224>0	ubyte	0x61	SpeedStor
11225>0	ubyte	0x63	GNU HURD or Mach or Sys V/386
11226>0	ubyte	0x64	Novell Netware 2.xx or Speedstore
11227>0	ubyte	0x65	Novell Netware 3.xx
11228>0	ubyte	0x66	Novell 386 Netware
11229>0	ubyte	0x67	Novell
11230>0	ubyte	0x68	Novell
11231>0	ubyte	0x69	Novell
11232>0	ubyte	0x70	DiskSecure Multi-Boot
11233>0	ubyte	0x71	reserved
11234>0	ubyte	0x73	reserved
11235>0	ubyte	0x74	reserved
11236>0	ubyte	0x75	PC/IX
11237>0	ubyte	0x76	reserved
11238>0	ubyte	0x77	M2FS/M2CS partition
11239>0	ubyte	0x78	XOSL boot loader filesystem
11240>0	ubyte	0x80	MINIX until 1.4a
11241>0	ubyte	0x81	MINIX since 1.4b
11242>0	ubyte	0x82	Linux swap or Solaris
11243>0	ubyte	0x83	Linux native
11244>0	ubyte	0x84	OS/2 hidden C: drive
11245>0	ubyte	0x85	Linux extended partition
11246>0	ubyte	0x86	NT FAT volume set
11247>0	ubyte	0x87	NTFS volume set or HPFS mirrored
11248>0	ubyte	0x8a	Linux Kernel AiR-BOOT partition
11249>0	ubyte	0x8b	Legacy Fault tolerant FAT32
11250>0	ubyte	0x8c	Legacy Fault tolerant FAT32 ext
11251>0	ubyte	0x8d	Hidden free FDISK FAT12
11252>0	ubyte	0x8e	Linux Logical Volume Manager
11253>0	ubyte	0x90	Hidden free FDISK FAT16
11254>0	ubyte	0x91	Hidden free FDISK DOS EXT
11255>0	ubyte	0x92	Hidden free FDISK FAT16 Big
11256>0	ubyte	0x93	Amoeba filesystem
11257>0	ubyte	0x94	Amoeba bad block table
11258>0	ubyte	0x95	MIT EXOPC native partitions
11259>0	ubyte	0x97	Hidden free FDISK FAT32
11260>0	ubyte	0x98	Datalight ROM-DOS Super-Boot
11261>0	ubyte	0x99	Mylex EISA SCSI
11262>0	ubyte	0x9a	Hidden free FDISK FAT16 LBA
11263>0	ubyte	0x9b	Hidden free FDISK EXT LBA
11264>0	ubyte	0x9f	BSDI?
11265>0	ubyte	0xa0	IBM Thinkpad hibernation
11266>0	ubyte	0xa1	HP Volume expansion (SpeedStor)
11267>0	ubyte	0xa3	HP Volume expansion (SpeedStor)
11268>0	ubyte	0xa4	HP Volume expansion (SpeedStor)
11269>0	ubyte	0xa5	386BSD partition type
11270>0	ubyte	0xa6	OpenBSD partition type
11271>0	ubyte	0xa7	NeXTSTEP 486
11272>0	ubyte	0xa8	Apple UFS
11273>0	ubyte	0xa9	NetBSD partition type
11274>0	ubyte	0xaa	Olivetty Fat12 1.44MB Service part
11275>0	ubyte	0xab	Apple Boot
11276>0	ubyte	0xae	SHAG OS filesystem
11277>0	ubyte	0xaf	Apple HFS
11278>0	ubyte	0xb0	BootStar Dummy
11279>0	ubyte	0xb1	reserved
11280>0	ubyte	0xb3	reserved
11281>0	ubyte	0xb4	reserved
11282>0	ubyte	0xb6	reserved
11283>0	ubyte	0xb7	BSDI BSD/386 filesystem
11284>0	ubyte	0xb8	BSDI BSD/386 swap
11285>0	ubyte	0xbb	Boot Wizard Hidden
11286>0	ubyte	0xbe	Solaris 8 partition type
11287>0	ubyte	0xbf	Solaris partition type
11288>0	ubyte	0xc0 	CTOS
11289>0	ubyte	0xc1 	DRDOS/sec (FAT-12)
11290>0	ubyte	0xc2 	Hidden Linux
11291>0	ubyte	0xc3 	Hidden Linux swap
11292>0	ubyte	0xc4 	DRDOS/sec (FAT-16, < 32M)
11293>0	ubyte	0xc5 	DRDOS/sec (EXT)
11294>0	ubyte	0xc6 	DRDOS/sec (FAT-16, >= 32M)
11295>0	ubyte	0xc7 	Syrinx (Cyrnix?) or HPFS disabled
11296>0	ubyte	0xc8 	Reserved for DR-DOS 8.0+
11297>0	ubyte	0xc9 	Reserved for DR-DOS 8.0+
11298>0	ubyte	0xca 	Reserved for DR-DOS 8.0+
11299>0	ubyte	0xcb 	DR-DOS 7.04+ Secured FAT32 CHS
11300>0	ubyte	0xcc 	DR-DOS 7.04+ Secured FAT32 LBA
11301>0	ubyte	0xcd	CTOS Memdump
11302>0	ubyte	0xce 	DR-DOS 7.04+ FAT16X LBA
11303>0	ubyte	0xcf 	DR-DOS 7.04+ EXT LBA
11304>0	ubyte	0xd0 	REAL/32 secure big partition
11305>0	ubyte	0xd1 	Old Multiuser DOS FAT12
11306>0	ubyte	0xd4 	Old Multiuser DOS FAT16 Small
11307>0	ubyte	0xd5 	Old Multiuser DOS Extended
11308>0	ubyte	0xd6 	Old Multiuser DOS FAT16 Big
11309>0	ubyte	0xd8 	CP/M 86
11310>0	ubyte	0xdb 	CP/M or Concurrent CP/M
11311>0	ubyte	0xdd 	Hidden CTOS Memdump
11312>0	ubyte	0xde 	Dell PowerEdge Server utilities
11313>0	ubyte	0xdf 	DG/UX virtual disk manager
11314>0	ubyte	0xe0 	STMicroelectronics ST AVFS
11315>0	ubyte	0xe1 	DOS access or SpeedStor 12-bit
11316>0	ubyte	0xe3 	DOS R/O or Storage Dimensions
11317>0	ubyte	0xe4 	SpeedStor 16-bit FAT < 1024 cyl.
11318>0	ubyte	0xe5	reserved
11319>0	ubyte	0xe6	reserved
11320>0	ubyte	0xeb 	BeOS
11321>0	ubyte	0xee	GPT Protective MBR
11322>0	ubyte	0xef	EFI system partition
11323>0	ubyte	0xf0 	Linux PA-RISC boot loader
11324>0	ubyte	0xf1 	SpeedStor or Storage Dimensions
11325>0	ubyte	0xf2 	DOS 3.3+ Secondary
11326>0	ubyte	0xf3	reserved
11327>0	ubyte	0xf4	SpeedStor large partition
11328>0	ubyte	0xf5	Prologue multi-volumen partition
11329>0	ubyte	0xf6 	reserved
11330>0	ubyte	0xf9 	pCache: ext2/ext3 persistent cache
11331>0	ubyte	0xfa 	Bochs x86 emulator
11332>0	ubyte	0xfb 	VMware File System
11333>0	ubyte	0xfc 	VMware Swap
11334>0	ubyte	0xfd 	Linux RAID partition persistent sb
11335>0	ubyte	0xfe	LANstep or IBM PS/2 IML
11336>0	ubyte	0xff 	Xenix Bad Block Table
11337
113380	string	\366\366\366\366	PC formatted floppy with no filesystem
11339# Sun disk labels
11340# From /usr/include/sun/dklabel.h:
113410774	beshort		0xdabe
11342# modified by Joerg Jenderek, because original test
11343# succeeds for Cabinet archive dao360.dl_ with negative blocks
11344>0770	long		>0		Sun disk label
11345>>0	string		x		'%s
11346>>>31	string		>\0		\b%s
11347>>>>63	string		>\0		\b%s
11348>>>>>95	string		>\0		\b%s
11349>>0	string		x		\b'
11350>>0734	short		>0		%d rpm,
11351>>0736	short		>0		%d phys cys,
11352>>0740	short		>0		%d alts/cyl,
11353>>0746	short		>0		%d interleave,
11354>>0750	short		>0		%d data cyls,
11355>>0752	short		>0		%d alt cyls,
11356>>0754	short		>0		%d heads/partition,
11357>>0756	short		>0		%d sectors/track,
11358>>0764	long		>0		start cyl %d,
11359>>0770	long		x		%d blocks
11360# Is there a boot block written 1 sector in?
11361>512    belong&077777777	0600407	\b, boot block present
11362
11363# Joerg Jenderek: Smart Boot Manager backup file is 25 (MSDOS) or 41 (LINUX) byte header + first sectors of disk
11364# (http://btmgr.sourceforge.net/docs/user-guide-3.html)
113650		string	SBMBAKUP_	Smart Boot Manager backup file
11366>9		string	x		\b, version %-5.5s
11367>>14		string	=_
11368>>>15		string	x		%-.1s
11369>>>>16		string	=_		\b.
11370>>>>>17		string	x		\b%-.1s
11371>>>>>>18	string	=_		\b.
11372>>>>>>>19	string	x		\b%-.1s
11373>>>22		ubyte	0
11374>>>>21		ubyte	x		\b, from drive 0x%x
11375>>>22		ubyte	>0
11376>>>>21		string	x		\b, from drive %s
11377>>>535		search/17	\x55\xAA
11378>>>>&-512	indirect	x	\b; contains
11379
11380# updated by Joerg Jenderek at Nov 2012
11381# DOS Emulator image is 128 byte, null right padded header + harddisc image
113820	string	DOSEMU\0
11383>0x27E	leshort	0xAA55
11384#offset is 128
11385>>19	ubyte	128
11386>>>(19.b-1)	ubyte	0x0	DOS Emulator image
11387>>>>7	ulelong	>0		\b, %u heads
11388>>>>11	ulelong	>0		\b, %d sectors/track
11389>>>>15	ulelong	>0		\b, %d cylinders
11390>>>>128	indirect	x	\b; contains
11391
11392# added by Joerg Jenderek at Nov 2012
11393# http://www.thenakedpc.com/articles/v04/08/0408-05.html
11394# Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data
113950	string	PNCIHISK\0		Norton Utilities disc image data
11396# real x86 boot sector with jump instruction
11397>509	search/1026	\x55\xAA\xeb
11398>>&-1	indirect	x		\b; contains
11399# http://file-extension.net/seeker/file_extension_dat
114000	string	PNCIUNDO		Norton Disk Doctor UnDo file
11401#
11402
11403# DOS/MBR boot sector updated by Joerg Jenderek at Sep 2007,May 2011,2013
11404# for any allowed sector sizes
1140530		search/481	\x55\xAA
11406# to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111)
11407# DOS BPB information (70) and after DOS floppy (120) like in previous file version
11408!:strength +65
11409# for sector sizes < 512 Bytes
11410>11		uleshort	<512
11411>>(11.s-2)	uleshort	0xAA55		DOS/MBR boot sector
11412# for sector sizes with 512 or more Bytes
11413>0x1FE		leshort		0xAA55		DOS/MBR boot sector
11414
11415# ExFAT
114163		string/w	=EXFAT
11417>0x1FE		leshort		0xAA55
11418>>0x6E		ubyte		1
11419>>>0x6F		ubyte		0x80
11420>>>0		ubyte		0xEB	DOS/MBR boot sector,
11421>>>0x69		ubyte		x	ExFAT Filesystem version %d.
11422>>>0x68		ubyte		x	\b%d
11423>>>0x6d		ubyte		x	\b, (1<<%d) sectors per cluster
11424>>>0x48		ulequad		x	\b, sectors %lld
11425>>>0x64		ulelong		x	\b, serial number 0x%x
11426
11427# keep old DOS/MBR boot sector as dummy for mbr and bootloader displaying
11428# only for sector sizes with 512 or more Bytes
114290x1FE          leshort         0xAA55         	DOS/MBR boot sector
11430#
11431# to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version
11432!:strength +65
11433>2		string		OSBS		OS/BS MBR
11434# added by Joerg Jenderek at Feb 2013 according to https://thestarman.pcministry.com/asm/mbr/
11435# and https://en.wikipedia.org/wiki/Master_Boot_Record
11436# test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by
11437# characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00
11438>0	search/2	\x33\xc0\x8e\xd0\xbc\x00\x7c	MS-MBR
11439# Microsoft Windows 95A and early ( https://thestarman.pcministry.com/asm/mbr/STDMBR.htm )
11440# assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld
11441>>8	ubequad		0x8bf45007501ffbfc
11442# https://thestarman.pcministry.com/asm/mbr/200MBR.htm
11443>>>0x16	ubyte		0xF3				\b,DOS 2
11444>>>>219	regex		Author\ -\ 			Author:
11445# found "David Litton" , "A Pehrsson  "
11446>>>>>&0	string		x				"%s"
11447>>>0x16	ubyte		0xF2
11448# NEC MS-DOS 3.30 Rev. 3 . See https://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm
11449# assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz
11450>>>>0x22	ubequad	0xbf7c07813d5aa575		\b,NEC 3.3
11451# version MS-DOS 3.30 til MS-Windows 95A (WinVer=4.00.1111)
11452>>>>0x22	default	x				\b,D0S version 3.3-7.0
11453# error messages are printed by assembler instructions: mov si,06nn;...;int 10 (0xBEnn06;...)
11454# where nn is string offset varying for different languages
11455# "Invalid partition table"				nn=0x8b for english version
11456>>>>>(0x49.b)	string		Invalid\ partition\ table		english
11457>>>>>(0x49.b)	string		Ung\201ltige\ Partitionstabelle		german
11458>>>>>(0x49.b)	string		Table\ de\ partition\ invalide		french
11459>>>>>(0x49.b)	string		Tabela\ de\ parti\207ao\ inv\240lida	portuguese
11460>>>>>(0x49.b)	string		Tabla\ de\ partici\242n\ no\ v\240lida	spanish
11461>>>>>(0x49.b)	string		Tavola\ delle\ partizioni\ non\ valida	italian
11462>>>>>0x49	ubyte		>0			at offset 0x%x
11463>>>>>>(0x49.b)	string		>\0			"%s"
11464# "Error loading operating system"			nn=0xa3 for english version
11465# "Fehler beim Laden des Betriebssystems"		nn=0xa7 for german version
11466# "Erreur en chargeant syst\212me d'exploitation"	nn=0xa7 for french version
11467# "Erro na inicializa\207ao do sistema operacional"	nn=0xa7 for portuguese Brazilian version
11468# "Error al cargar sistema operativo"			nn=0xa8 for spanish version
11469# "Errore durante il caricamento del sistema operativo"	nn=0xae for italian version
11470>>>>>0x74	ubyte		>0			at offset 0x%x
11471>>>>>>(0x74.b)	string		>\0			"%s"
11472# "Missing operating system"				nn=0xc2 for english version
11473# "Betriebssystem fehlt"				nn=0xcd for german version
11474# "Syst\212me d'exploitation absent"			nn=0xd2 for french version
11475# "Sistema operacional nao encontrado"			nn=0xd4 for portuguese Brazilian version
11476# "Falta sistema operativo"				nn=0xca for spanish version
11477# "Sistema operativo mancante"				nn=0xe2 for italian version
11478>>>>>0x79	ubyte		>0			at offset 0x%x
11479>>>>>>(0x79.b)	string		>\0			"%s"
11480# Microsoft Windows 95B to XP (https://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm)
11481# assembler instructions: push ax;pop es;push  ax;pop ds;cld;mov si,7c1b
11482>>8	ubequad		0x5007501ffcbe1b7c
11483# assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04
11484>>>24		ubequad	0xf3a4cbbebe07b104		9M
11485# "Invalid partition table"				nn=0x10F for english version
11486# "Ung\201ltige Partitionstabelle"				nn=0x10F for german version
11487# "Table de partition erron\202e"				nn=0x10F for french version
11488# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240"	nn=0x10F for russian version
11489>>>>(0x3C.b+0x0FF)	string	Invalid\ partition\ table		english
11490>>>>(0x3C.b+0x0FF)	string	Ung\201ltige\ Partitionstabelle		german
11491>>>>(0x3C.b+0x0FF)	string	Table\ de\ partition\ erron\202e	french
11492>>>>(0x3C.b+0x0FF)	string	\215\245\257\340\240\242\250\253\354\255\240\357\ \342\240\241\253\250\346\240	russian
11493>>>>0x3C		ubyte	x			at offset 0x%x+0xFF
11494>>>>(0x3C.b+0x0FF)	string	>\0			"%s"
11495# "Error loading operating system"			nn=0x127 for english version
11496# "Fehler beim Laden des Betriebssystems"		nn=0x12b for german version
11497# "Erreur lors du chargement du syst\212me d'exploitation"	nn=0x12a for french version
11498# "\216\350\250\241\252\240 \257\340\250 \247\240\243\340\343\247\252\245 \256\257\245\340\240\346\250\256\255\255\256\251 \341\250\341\342\245\254\353"	nn=0x12d for russian version
11499>>>>0xBD		ubyte	x			at offset 0x1%x
11500>>>>(0xBD.b+0x100)	string	>\0			"%s"
11501# "Missing operating system"				nn=0x146 for english version
11502# "Betriebssystem fehlt"				nn=0x151 for german version
11503# "Syst\212me d'exploitation manquant"			nn=0x15e for french version
11504# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240"	nn=0x156 for russian version
11505>>>>0xA9		ubyte	x			at offset 0x1%x
11506>>>>(0xA9.b+0x100)	string	>\0			"%s"
11507# https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm
11508# assembler instructions: rep;movsb;retf;mov BP,07be;mov cl,04
11509>>>24		ubequad	0xf3a4cbbdbe07b104		XP
11510# where xxyyzz are lower bits from offsets of error messages varying for different languages
11511>>>>0x1B4	ubelong&0x00FFFFFF	0x002c4463	english
11512>>>>0x1B4	ubelong&0x00FFFFFF	0x002c486e	german
11513# "Invalid partition table"				xx=0x12C for english version
11514# "Ung\201ltige Partitionstabelle"				xx=0x12C for german version
11515>>>>0x1b5	ubyte		>0			at offset 0x1%x
11516>>>>(0x1b5.b+0x100)	string	>\0			"%s"
11517# "Error loading operating system"			yy=0x144 for english version
11518# "Fehler beim Laden des Betriebssystems"		yy=0x148 for german version
11519>>>>0x1b6	ubyte		>0			at offset 0x1%x
11520>>>>(0x1b6.b+0x100)	string	>\0			"%s"
11521# "Missing operating system"				zz=0x163 for english version
11522# "Betriebssystem nicht vorhanden"			zz=0x16e for german version
11523>>>>0x1b7	ubyte		>0			at offset 0x1%x
11524>>>>(0x1b7.b+0x100)	string	>\0			"%s"
11525# Microsoft Windows Vista or 7
11526# assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00
11527>>8	ubequad		0xc08ed8be007cbf00
11528# Microsoft Windows Vista (https://thestarman.pcministry.com/asm/mbr/VistaMBR.htm)
11529# assembler instructions: jnz 0729;cmp ebx,"TCPA"
11530>>>0xEC		ubequad	0x753b6681fb544350		Vista
11531# where xxyyzz are lower bits from offsets of error messages varying for different languages
11532>>>>0x1B4	ubelong&0x00FFFFFF	0x00627a99	english
11533#>>>>0x1B4	ubelong&0x00FFFFFF	?		german
11534# "Invalid partition table"				xx=0x162 for english version
11535# "Ung\201ltige Partitionstabelle"				xx=0x1?? for german version
11536>>>>0x1b5	ubyte		>0			at offset 0x1%x
11537>>>>(0x1b5.b+0x100)	string	>\0			"%s"
11538# "Error loading operating system"			yy=0x17a for english version
11539# "Fehler beim Laden des Betriebssystems"		yy= 0x1?? for german version
11540>>>>0x1b6	ubyte		>0			at offset 0x1%x
11541>>>>(0x1b6.b+0x100)	string	>\0			"%s"
11542# "Missing operating system"				zz=0x199 for english version
11543# "Betriebssystem nicht vorhanden"			zz=0x1?? for german version
11544>>>>0x1b7	ubyte		>0			at offset 0x1%x
11545>>>>(0x1b7.b+0x100)	string	>\0			"%s"
11546# Microsoft Windows 7 (https://thestarman.pcministry.com/asm/mbr/W7MBR.htm)
11547# assembler instructions: cmp ebx,"TCPA";cmp
11548>>>0xEC		ubequad	0x6681fb5443504175		Windows 7
11549# where xxyyzz are lower bits from offsets of error messages varying for different languages
11550>>>>0x1B4	ubelong&0x00FFFFFF	0x00637b9a	english
11551#>>>>0x1B4	ubelong&0x00FFFFFF	?		german
11552# "Invalid partition table"				xx=0x163 for english version
11553# "Ung\201ltige Partitionstabelle"				xx=0x1?? for german version
11554>>>>0x1b5	ubyte		>0			at offset 0x1%x
11555>>>>(0x1b5.b+0x100)	string	>\0			"%s"
11556# "Error loading operating system"			yy=0x17b for english version
11557# "Fehler beim Laden des Betriebssystems"		yy=0x1?? for german version
11558>>>>0x1b6	ubyte		>0			at offset 0x1%x
11559>>>>(0x1b6.b+0x100)	string	>\0			"%s"
11560# "Missing operating system"				zz=0x19a for english version
11561# "Betriebssystem nicht vorhanden"			zz=0x1?? for german version
11562>>>>0x1b7	ubyte		>0			at offset 0x1%x
11563>>>>(0x1b7.b+0x100)	string	>\0			"%s"
11564# https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs
11565# https://en.wikipedia.org/wiki/MBR_disk_signature#ID
11566>>0x1b8	ulelong		>0				\b, disk signature 0x%-.4x
11567# driveID/timestamp for Win 95B,98,98SE and ME. See https://thestarman.pcministry.com/asm/mbr/mystery.htm
11568>>0xDA	uleshort		0
11569>>>0xDC 	ulelong		>0			\b, created
11570# physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive
11571>>>>0xDC	ubyte		x			with driveID 0x%x
11572# hours, minutes and seconds
11573>>>>0xDf	ubyte		x			at %x
11574>>>>0xDe	ubyte		x			\b:%x
11575>>>>0xDd	ubyte		x			\b:%x
11576# special case for Microsoft MS-DOS 3.21 spanish
11577# assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov
11578>0	ubequad		0xfab830008ed0bc00
11579# assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov
11580>>8	ubequad		0x1fbfcb800008ed8		MS-MBR,D0S version 3.21 spanish
11581# Microsoft MBR IPL end
11582
11583# dr-dos with some upper-, lowercase variants
11584>0x9D	string	Invalid\ partition\ table$
11585>>181	string	No\ Operating\ System$
11586>>>201	string	Operating\ System\ load\ error$	\b, DR-DOS MBR, Version 7.01 to 7.03
11587>0x9D	string	Invalid\ partition\ table$
11588>>181	string	No\ operating\ system$
11589>>>201	string	Operating\ system\ load\ error$	\b, DR-DOS MBR, Version 7.01 to 7.03
11590>342	string	Invalid\ partition\ table$
11591>>366	string	No\ operating\ system$
11592>>>386	string	Operating\ system\ load\ error$	\b, DR-DOS MBR, version 7.01 to 7.03
11593>295	string	NEWLDR\0
11594>>302	string	Bad\ PT\ $
11595>>>310	string	No\ OS\ $
11596>>>>317	string	OS\ load\ err$
11597>>>>>329	string	Moved\ or\ missing\ IBMBIO.LDR\n\r
11598>>>>>>358	string	Press\ any\ key\ to\ continue.\n\r$
11599>>>>>>>387	string	Copyright\ (c)\ 1984,1998
11600>>>>>>>>411	string	Caldera\ Inc.\0		\b, DR-DOS MBR (IBMBIO.LDR)
11601#
11602# tests for different MS-DOS Master Boot Records (MBR) moved and merged
11603#
11604#>0x145	string	Default:\ F				\b, FREE-DOS MBR
11605#>0x14B	string	Default:\ F				\b, FREE-DOS 1.0 MBR
11606>0x145	search/7	Default:\ F			\b, FREE-DOS MBR
11607#>>313		string	F0\ .\ .\ .
11608#>>>322		string	disk\ 1
11609#>>>>382	string	FAT3
11610>64	string	no\ active\ partition\ found
11611>>96	string	read\ error\ while\ reading\ drive	\b, FREE-DOS Beta 0.9 MBR
11612# Ranish Partition Manager http://www.ranish.com/part/
11613>387	search/4	\0\ Error!\r
11614>>378	search/7	Virus!
11615>>>397	search/4	Booting\040
11616>>>>408	search/4	HD1/\0	 			\b, Ranish MBR (
11617>>>>>416	string	Writing\ changes...		\b2.37
11618>>>>>>438	ubyte		x			\b,0x%x dots
11619>>>>>>440	ubyte		>0			\b,virus check
11620>>>>>>441	ubyte		>0			\b,partition %c
11621#2.38,2.42,2.44
11622>>>>>416	string	!Writing\ changes...		\b
11623>>>>>>418	ubyte	1				\bvirus check,
11624>>>>>>419	ubyte	x				\b0x%x seconds
11625>>>>>>420	ubyte&0x0F	>0			\b,partition
11626>>>>>>>420	ubyte&0x0F	<5			\b %x
11627>>>>>>>420	ubyte&0x0F	0Xf			\b ask
11628>>>>>420	ubyte		x			\b)
11629#
11630# SYSLINUX MBR moved
11631# https://www.acronis.de/
11632>362	string	MBR\ Error\ \0\r
11633>>376	string	ress\ any\ key\ to\040
11634>>>392	string	boot\ from\ floppy...\0			\b, Acronis MBR
11635# added by Joerg Jenderek
11636# https://www.visopsys.org/
11637# https://partitionlogic.org.uk/
11638>309	string	No\ bootable\ partition\ found\r
11639>>339	string	I/O\ Error\ reading\ boot\ sector\r	\b, Visopsys MBR
11640>349	string	No\ bootable\ partition\ found\r
11641>>379	string	I/O\ Error\ reading\ boot\ sector\r	\b, simple Visopsys MBR
11642# bootloader, bootmanager
11643>0x40	string	SBML
11644# label with 11 characters of FAT 12 bit filesystem
11645>>43	string	SMART\ BTMGR
11646>>>430	string	SBMK\ Bad!\r			\b, Smart Boot Manager
11647# OEM-ID not always "SBM"
11648#>>>>3	strings	SBM
11649>>>>6	string	>\0                             \b, version %s
11650>382	string	XOSLLOADXCF			\b, eXtended Operating System Loader
11651>6	string	LILO				\b, LInux i386 boot LOader
11652>>120	string	LILO				\b, version 22.3.4 SuSe
11653>>172	string	LILO				\b, version 22.5.8 Debian
11654# updated by Joerg Jenderek at Oct 2008
11655# variables according to grub-0.97/stage1/stage1.S or
11656# https://www.gnu.org/software/grub/manual/grub.html#Embedded-data
11657# usual values are marked with comments to get only information of strange GRUB loaders
11658>342		search/60	\0Geom\0
11659#>0		ulelong		x		%x=0x009048EB ,	0x2a9048EB  0
11660>>0x41		ubyte		<2
11661>>>0x3E		ubyte		>2		\b; GRand Unified Bootloader
11662# 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90
11663>>>>0x3E	ubyte		x		\b, stage1 version 0x%x
11664#If it is 0xFF, use a drive passed by BIOS
11665>>>>0x40	ubyte		<0xFF		\b, boot drive 0x%x
11666# in most case 0,1,0x2e for GRUB 0.5.95
11667>>>>0x41	ubyte		>0		\b, LBA flag 0x%x
11668>>>>0x42	uleshort	<0x8000		\b, stage2 address 0x%x
11669#>>>>0x42	uleshort	=0x8000		\b, stage2 address 0x%x (usual)
11670>>>>0x42	uleshort	>0x8000		\b, stage2 address 0x%x
11671#>>>>0x44	ulelong		=1		\b, 1st sector stage2 0x%x (default)
11672>>>>0x44	ulelong		>1		\b, 1st sector stage2 0x%x
11673>>>>0x48	uleshort	<0x800		\b, stage2 segment 0x%x
11674#>>>>0x48	uleshort	=0x800		\b, stage2 segment 0x%x (usual)
11675>>>>0x48	uleshort	>0x800		\b, stage2 segment 0x%x
11676>>>>402		string	Geom\0Hard\ Disk\0Read\0\ Error\0
11677>>>>>394	string	stage1			\b, GRUB version 0.5.95
11678>>>>382		string	Geom\0Hard\ Disk\0Read\0\ Error\0
11679>>>>>376	string	GRUB\ \0		\b, GRUB version 0.93 or 1.94
11680>>>>383		string	Geom\0Hard\ Disk\0Read\0\ Error\0
11681>>>>>377	string	GRUB\ \0		\b, GRUB version 0.94
11682>>>>385		string	Geom\0Hard\ Disk\0Read\0\ Error\0
11683>>>>>379	string	GRUB\ \0		\b, GRUB version 0.95 or 0.96
11684>>>>391		string	Geom\0Hard\ Disk\0Read\0\ Error\0
11685>>>>>385	string	GRUB\ \0		\b, GRUB version 0.97
11686# unknown version
11687>>>343		string	Geom\0Read\0\ Error\0
11688>>>>321		string	Loading\ stage1.5	\b, GRUB version x.y
11689>>>380		string	Geom\0Hard\ Disk\0Read\0\ Error\0
11690>>>>374		string	GRUB\ \0		\b, GRUB version n.m
11691# SYSLINUX bootloader moved
11692>395	string	chksum\0\ ERROR!\0		\b, Gujin bootloader
11693# http://www.bcdwb.de/bcdw/index_e.htm
11694>3	string	BCDL
11695>>498	string	BCDL\ \ \ \ BIN			\b, Bootable CD Loader (1.50Z)
11696# mbr partition table entries updated by Joerg Jenderek at Sep 2013
11697# skip Norton Utilities disc image data
11698>3		string		!IHISK
11699# skip Linux style boot sector starting with assembler instructions mov 0x7c0,ax;
11700>>0		belong		!0xb8c0078e
11701# not Linux kernel
11702>>>514		string		!HdrS
11703# not BeOS
11704>>>>422		string		!Be\ Boot\ Loader
11705# jump over BPB instruction implies DOS bootsector or AdvanceMAME mbr
11706>>>>>0		ubelong&0xFD000000	=0xE9000000
11707# AdvanceMAME mbr
11708>>>>>>(1.b+2)	ubequad		0xfa31c08ed88ec08e
11709>>>>>>>446	use		partition-table
11710# mbr, Norton Utilities disc image data, or 2nd,etc. sector of x86 bootloader
11711>>>>>0		ubelong&0xFD000000	!0xE9000000
11712# skip FSInfosector
11713>>>>>>0		string		!RRaA
11714# skip 3rd sector of MS x86 bootloader with assembler instructions cli;MOVZX EAX,BYTE PTR [BP+10];MOV ECX,
11715# https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm
11716>>>>>>>0	ubequad		!0xfa660fb64610668b
11717# skip 13rd sector of MS x86 bootloader
11718>>>>>>>>0	ubequad		!0x660fb64610668b4e
11719# skip sector starting with DOS new line
11720>>>>>>>>>0	string		!\r\n
11721# allowed active flag 0,80h-FFh
11722>>>>>>>>>>446	ubyte		0
11723>>>>>>>>>>>446	use		partition-table
11724>>>>>>>>>>446	ubyte		>0x7F
11725>>>>>>>>>>>446	use		partition-table
11726# TODO: test for extended bootrecord (ebr) moved and merged with mbr partition table entries
11727# mbr partition table entries end
11728# https://www.acronis.de/
11729#FAT label=ACRONIS\ SZ
11730#OEM-ID=BOOTWIZ0
11731>442	string	Non-system\ disk,\040
11732>>459	string	press\ any\ key...\x7\0		\b, Acronis Startup Recovery Loader
11733# updated by Joerg Jenderek at Nov 2012, Sep 2013
11734# DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes
11735# display 1 space
11736>>>447	ubyte	x		\b
11737>>>477	use	DOS-filename
11738#
11739>185	string	FDBOOT\ Version\040
11740>>204	string	\rNo\ Systemdisk.\040
11741>>>220	string	Booting\ from\ harddisk.\n\r
11742>>>245	string	Cannot\ load\ from\ harddisk.\n\r
11743>>>>273 string	Insert\ Systemdisk\040
11744>>>>>291 string and\ press\ any\ key.\n\r		\b, FDBOOT harddisk Bootloader
11745>>>>>>200 string	>\0                             \b, version %-3s
11746>242	string	Bootsector\ from\ C.H.\ Hochst\204
11747# http://freecode.com/projects/dosfstools	dosfstools-n.m/src/mkdosfs.c
11748# updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string
11749# skip name "C.H. Hochstaetter" partly because it is sometimes written without umlaut
11750>242	search/127	Bootsector\ from\ C.H.\ Hochst
11751>>278	search/127	No\ Systemdisk.\ Booting\ from\ harddisk
11752# followed by variants with point,CR-NL or NL-CR
11753>>>208	search/261	Cannot\ load\ from\ harddisk.
11754# followed by variants CR-NL or NL-CR
11755>>>>236	search/235	Insert\ Systemdisk\ and\ press\ any\ key.
11756# followed by variants with point,CR-NL or NL-CR
11757>>>>>180	search/96	Disk\ formatted\ with\ WinImage\ 	\b, WinImage harddisk Bootloader
11758# followed by string like "6.50 (c) 1993-2004 Gilles Vollant"
11759>>>>>>&0	string		x 					\b, version %-4.4s
11760>(1.b+2)	ubyte		0xe
11761>>(1.b+3)	ubyte		0x1f
11762>>>(1.b+4)	ubyte		0xbe
11763# message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others
11764>>>>(1.b+5)	ubyte&0xd3	0x53
11765>>>>>(1.b+6)	ubyte		0x7c
11766# assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah,
11767>>>>>>(1.b+7)	ubyte		0xac
11768>>>>>>>(1.b+8)	ubyte		0x22
11769>>>>>>>>(1.b+9)	ubyte		0xc0
11770>>>>>>>>>(1.b+10)	ubyte	0x74
11771>>>>>>>>>>(1.b+11)	ubyte	0x0b
11772>>>>>>>>>>>(1.b+12)	ubyte	0x56
11773>>>>>>>>>>>>(1.b+13)	ubyte	0xb4			\b, mkdosfs boot message display
11774# FAT1X version
11775>>>>>>>>>>>>>(1.b+5)	ubyte	0x5b
11776>>>>>>>>>>>>>>0x5b	string	>\0			"%-s"
11777# FAT32 version
11778>>>>>>>>>>>>>(1.b+5)	ubyte	0x77
11779>>>>>>>>>>>>>>0x77	string	>\0			"%-s"
11780>214	string	Please\ try\ to\ install\ FreeDOS\ 	\b, DOS Emulator boot message display
11781#>>244	string	from\ dosemu-freedos-*-bin.tgz\r
11782#>>>170	string	Sorry,\ could\ not\ load\ an\040
11783#>>>>195	string	operating\ system.\r\n
11784#
11785>103	string	This\ is\ not\ a\ bootable\ disk.\040
11786>>132	string	Please\ insert\ a\ bootable\040
11787>>>157	string	floppy\ and\r\n
11788>>>>169	string	press\ any\ key\ to\ try\ again...\r	\b, FREE-DOS message display
11789#
11790>66	string	Solaris\ Boot\ Sector
11791>>99	string	Incomplete\ MDBoot\ load.
11792>>>89	string	Version 				\b, Sun Solaris Bootloader
11793>>>>97	byte	x					version %c
11794#
11795>408	string	OS/2\ !!\ SYS01475\r\0
11796>>429	string	OS/2\ !!\ SYS02025\r\0
11797>>>450	string	OS/2\ !!\ SYS02027\r\0
11798>>>469	string	OS2BOOT\ \ \ \ 				\b, IBM OS/2 Warp bootloader
11799#
11800>409	string	OS/2\ !!\ SYS01475\r\0
11801>>430	string	OS/2\ !!\ SYS02025\r\0
11802>>>451	string	OS/2\ !!\ SYS02027\r\0
11803>>>470	string	OS2BOOT\ \ \ \ 				\b, IBM OS/2 Warp Bootloader
11804>112		string	This\ disk\ is\ not\ bootable\r
11805>>142		string	If\ you\ wish\ to\ make\ it\ bootable
11806>>>176		string	run\ the\ DOS\ program\ SYS\040
11807>>>200		string	after\ the\r
11808>>>>216		string	system\ has\ been\ loaded\r\n
11809>>>>>242	string	Please\ insert\ a\ DOS\ diskette\040
11810>>>>>271	string	into\r\n\ the\ drive\ and\040
11811>>>>>>292	string	strike\ any\ key...\0		\b, IBM OS/2 Warp message display
11812# XP
11813>430	string	NTLDR\ is\ missing\xFF\r\n
11814>>449	string	Disk\ error\xFF\r\n
11815>>>462	string	Press\ any\ key\ to\ restart\r		\b, Microsoft Windows XP Bootloader
11816# DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes
11817>>>>417		ubyte&0xDF	>0
11818>>>>>417	string		x			%-.5s
11819>>>>>>422	ubyte&0xDF	>0
11820>>>>>>>422	string		x 			\b%-.3s
11821>>>>>425	ubyte&0xDF	>0
11822>>>>>>425	string		>\ 			\b.%-.3s
11823#
11824>>>>371		ubyte		>0x20
11825>>>>>368	ubyte&0xDF	>0
11826>>>>>>368	string		x 			%-.5s
11827>>>>>>>373	ubyte&0xDF	>0
11828>>>>>>>>373	string		x 			\b%-.3s
11829>>>>>>376	ubyte&0xDF	>0
11830>>>>>>>376	string		x 			\b.%-.3s
11831#
11832>430	string	NTLDR\ nicht\ gefunden\xFF\r\n
11833>>453	string	Datentr\204gerfehler\xFF\r\n
11834>>>473	string	Neustart\ mit\ beliebiger\ Taste\r	\b, Microsoft Windows XP Bootloader (german)
11835>>>>417		ubyte&0xDF	>0
11836>>>>>417	string		x			%-.5s
11837>>>>>>422	ubyte&0xDF	>0
11838>>>>>>>422	string		x 			\b%-.3s
11839>>>>>425	ubyte&0xDF	>0
11840>>>>>>425	string		>\ 			\b.%-.3s
11841# offset variant
11842>>>>379	string	\0
11843>>>>>368	ubyte&0xDF	>0
11844>>>>>>368	string		x 			%-.5s
11845>>>>>>>373	ubyte&0xDF	>0
11846>>>>>>>>373	string		x 			\b%-.3s
11847#
11848>430	string	NTLDR\ fehlt\xFF\r\n
11849>>444	string	Datentr\204gerfehler\xFF\r\n
11850>>>464	string	Neustart\ mit\ beliebiger\ Taste\r	\b, Microsoft Windows XP Bootloader (2.german)
11851>>>>417		ubyte&0xDF	>0
11852>>>>>417	string		x			%-.5s
11853>>>>>>422	ubyte&0xDF	>0
11854>>>>>>>422	string		x 			\b%-.3s
11855>>>>>425	ubyte&0xDF	>0
11856>>>>>>425	string		>\ 			\b.%-.3s
11857# variant
11858>>>>371		ubyte		>0x20
11859>>>>>368	ubyte&0xDF	>0
11860>>>>>>368	string		x 			%-.5s
11861>>>>>>>373	ubyte&0xDF	>0
11862>>>>>>>>373	string		x 			\b%-.3s
11863>>>>>>376	ubyte&0xDF	>0
11864>>>>>>>376	string		x 			\b.%-.3s
11865#
11866>430	string	NTLDR\ fehlt\xFF\r\n
11867>>444	string	Medienfehler\xFF\r\n
11868>>>459	string	Neustart:\ Taste\ dr\201cken\r		\b, Microsoft Windows XP Bootloader (3.german)
11869>>>>371		ubyte		>0x20
11870>>>>>368	ubyte&0xDF	>0
11871>>>>>>368	string		x 			%-.5s
11872>>>>>>>373	ubyte&0xDF	>0
11873>>>>>>>>373	string		x 			\b%-.3s
11874>>>>>>376	ubyte&0xDF	>0
11875>>>>>>>376	string		x 			\b.%-.3s
11876# variant
11877>>>>417		ubyte&0xDF	>0
11878>>>>>417	string		x			%-.5s
11879>>>>>>422	ubyte&0xDF	>0
11880>>>>>>>422	string		x 			\b%-.3s
11881>>>>>425	ubyte&0xDF	>0
11882>>>>>>425	string		>\ 			\b.%-.3s
11883#
11884>430	string	Datentr\204ger\ entfernen\xFF\r\n
11885>>454	string	Medienfehler\xFF\r\n
11886>>>469	string	Neustart:\ Taste\ dr\201cken\r		\b, Microsoft Windows XP Bootloader (4.german)
11887>>>>379		string		\0
11888>>>>>368	ubyte&0xDF	>0
11889>>>>>>368	string		x 			%-.5s
11890>>>>>>>373	ubyte&0xDF	>0
11891>>>>>>>>373	string		x 			\b%-.3s
11892>>>>>>376	ubyte&0xDF	>0
11893>>>>>>>376	string		x 			\b.%-.3s
11894# variant
11895>>>>417		ubyte&0xDF	>0
11896>>>>>417	string		x			%-.5s
11897>>>>>>422	ubyte&0xDF	>0
11898>>>>>>>422	string		x 			\b%-.3s
11899>>>>>425	ubyte&0xDF	>0
11900>>>>>>425	string		>\ 			\b.%-.3s
11901#
11902
11903#>3	string	NTFS\ \ \ \040
11904>389	string	Fehler\ beim\ Lesen\040
11905>>407	string	des\ Datentr\204gers
11906>>>426	string	NTLDR\ fehlt
11907>>>>440	string	NTLDR\ ist\ komprimiert
11908>>>>>464 string	Neustart\ mit\ Strg+Alt+Entf\r		\b, Microsoft Windows XP Bootloader NTFS (german)
11909#>3	string	NTFS\ \ \ \040
11910>313	string	A\ disk\ read\ error\ occurred.\r
11911>>345	string	A\ kernel\ file\ is\ missing\040
11912>>>370	string	from\ the\ disk.\r
11913>>>>484	string	NTLDR\ is\ compressed
11914>>>>>429 string	Insert\ a\ system\ diskette\040
11915>>>>>>454 string and\ restart\r\nthe\ system.\r		\b, Microsoft Windows XP Bootloader NTFS
11916# DOS loader variants different languages,offsets
11917>472	ubyte&0xDF	>0
11918>>389	string	Invalid\ system\ disk\xFF\r\n
11919>>>411	string	Disk\ I/O\ error
11920>>>>428	string	Replace\ the\ disk,\ and\040
11921>>>>>455 string	press\ any\ key				\b, Microsoft Windows 98 Bootloader
11922#IO.SYS
11923>>>>>>472	ubyte&0xDF	>0
11924>>>>>>>472	string		x 			\b %-.2s
11925>>>>>>>>474	ubyte&0xDF	>0
11926>>>>>>>>>474	string		x 			\b%-.5s
11927>>>>>>>>>>479	ubyte&0xDF	>0
11928>>>>>>>>>>>479 string		x 			\b%-.1s
11929>>>>>>>480	ubyte&0xDF	>0
11930>>>>>>>>480	string		x 			\b.%-.3s
11931#MSDOS.SYS
11932>>>>>>>483	ubyte&0xDF	>0			\b+
11933>>>>>>>>483	string		x 			\b%-.5s
11934>>>>>>>>>488	ubyte&0xDF	>0
11935>>>>>>>>>>488	string		x 			\b%-.3s
11936>>>>>>>>491	ubyte&0xDF	>0
11937>>>>>>>>>491	string		x 			\b.%-.3s
11938#
11939>>390	string	Invalid\ system\ disk\xFF\r\n
11940>>>412	string	Disk\ I/O\ error\xFF\r\n
11941>>>>429	string	Replace\ the\ disk,\ and\040
11942>>>>>451 string	then\ press\ any\ key\r			\b, Microsoft Windows 98 Bootloader
11943>>388	string	Ungueltiges\ System\ \xFF\r\n
11944>>>410	string	E/A-Fehler\ \ \ \ \xFF\r\n
11945>>>>427	string	Datentraeger\ wechseln\ und\040
11946>>>>>453 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (german)
11947#WINBOOT.SYS only not spaces (0xDF)
11948>>>>>>497	ubyte&0xDF	>0
11949>>>>>>>497	string		x 			%-.5s
11950>>>>>>>>502	ubyte&0xDF	>0
11951>>>>>>>>>502	string		x 			\b%-.1s
11952>>>>>>>>>>503	ubyte&0xDF	>0
11953>>>>>>>>>>>503	string		x 			\b%-.1s
11954>>>>>>>>>>>>504	ubyte&0xDF	>0
11955>>>>>>>>>>>>>504 string		x 			\b%-.1s
11956>>>>>>505	ubyte&0xDF	>0
11957>>>>>>>505	string		x 			\b.%-.3s
11958#IO.SYS
11959>>>>>>472	ubyte&0xDF	>0			or
11960>>>>>>>472	string		x 			\b %-.2s
11961>>>>>>>>474	ubyte&0xDF	>0
11962>>>>>>>>>474	string		x 			\b%-.5s
11963>>>>>>>>>>479	ubyte&0xDF	>0
11964>>>>>>>>>>>479 string		x 			\b%-.1s
11965>>>>>>>480	ubyte&0xDF	>0
11966>>>>>>>>480	string		x 			\b.%-.3s
11967#MSDOS.SYS
11968>>>>>>>483	ubyte&0xDF	>0			\b+
11969>>>>>>>>483	string		x 			\b%-.5s
11970>>>>>>>>>488	ubyte&0xDF	>0
11971>>>>>>>>>>488	string		x 			\b%-.3s
11972>>>>>>>>491	ubyte&0xDF	>0
11973>>>>>>>>>491	string		x 			\b.%-.3s
11974#
11975>>390	string	Ungueltiges\ System\ \xFF\r\n
11976>>>412	string	E/A-Fehler\ \ \ \ \xFF\r\n
11977>>>>429	string	Datentraeger\ wechseln\ und\040
11978>>>>>455 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (German)
11979#WINBOOT.SYS only not spaces (0xDF)
11980>>>>>>497	ubyte&0xDF	>0
11981>>>>>>>497	string		x 			%-.7s
11982>>>>>>>>504	ubyte&0xDF	>0
11983>>>>>>>>>504	string		x 			\b%-.1s
11984>>>>>>505	ubyte&0xDF	>0
11985>>>>>>>505	string		x 			\b.%-.3s
11986#IO.SYS
11987>>>>>>472	ubyte&0xDF	>0			or
11988>>>>>>>472	string		x 			\b %-.2s
11989>>>>>>>>474	ubyte&0xDF	>0
11990>>>>>>>>>474	string		x 			\b%-.6s
11991>>>>>>>480	ubyte&0xDF	>0
11992>>>>>>>>480	string		x 			\b.%-.3s
11993#MSDOS.SYS
11994>>>>>>>483	ubyte&0xDF	>0			\b+
11995>>>>>>>>483	string		x 			\b%-.5s
11996>>>>>>>>>488	ubyte&0xDF	>0
11997>>>>>>>>>>488	string		x 			\b%-.3s
11998>>>>>>>>491	ubyte&0xDF	>0
11999>>>>>>>>>491	string		x 			\b.%-.3s
12000#
12001>>389	string	Ungueltiges\ System\ \xFF\r\n
12002>>>411	string	E/A-Fehler\ \ \ \ \xFF\r\n
12003>>>>428	string	Datentraeger\ wechseln\ und\040
12004>>>>>454 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (GERMAN)
12005# DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes
12006>>>>>>472	string		x 			%-.2s
12007>>>>>>>474	ubyte&0xDF	>0
12008>>>>>>>>474	string		x 			\b%-.5s
12009>>>>>>>>479	ubyte&0xDF	>0
12010>>>>>>>>>479	string		x 			\b%-.1s
12011>>>>>>480	ubyte&0xDF	>0
12012>>>>>>>480	string		x 			\b.%-.3s
12013>>>>>>483	ubyte&0xDF	>0			\b+
12014>>>>>>>483	string		x 			\b%-.5s
12015>>>>>>>488	ubyte&0xDF	>0
12016>>>>>>>>488	string		x 			\b%-.2s
12017>>>>>>>>490	ubyte&0xDF	>0
12018>>>>>>>>>490	string		x 			\b%-.1s
12019>>>>>>>491	ubyte&0xDF	>0
12020>>>>>>>>491	string		x 			\b.%-.3s
12021>479	ubyte&0xDF	>0
12022>>416	string	Kein\ System\ oder\040
12023>>>433	string	Laufwerksfehler
12024>>>>450	string	Wechseln\ und\ Taste\ dr\201cken	\b, Microsoft DOS Bootloader (german)
12025#IO.SYS
12026>>>>>479	string		x 			\b %-.2s
12027>>>>>>481	ubyte&0xDF	>0
12028>>>>>>>481	string		x 			\b%-.6s
12029>>>>>487	ubyte&0xDF	>0
12030>>>>>>487	string		x 			\b.%-.3s
12031#MSDOS.SYS
12032>>>>>>490	ubyte&0xDF	>0			\b+
12033>>>>>>>490	string		x 			\b%-.5s
12034>>>>>>>>495	ubyte&0xDF	>0
12035>>>>>>>>>495	string		x 			\b%-.3s
12036>>>>>>>498	ubyte&0xDF	>0
12037>>>>>>>>498	string		x 			\b.%-.3s
12038#
12039>376	search/41	Non-System\ disk\ or\040
12040>>395	search/41	disk\ error\r
12041>>>407	search/41	Replace\ and\040
12042>>>>419	search/41	press\ 				\b,
12043>>>>419	search/41	strike\ 			\b, old
12044>>>>426	search/41	any\ key\ when\ ready\r		MS or PC-DOS bootloader
12045#449			Disk\ Boot\ failure\r		MS 3.21
12046#466			Boot\ Failure\r			MS 3.30
12047>>>>>468 search/18	\0
12048#IO.SYS,IBMBIO.COM
12049>>>>>>&0	string		x 			\b %-.2s
12050>>>>>>>&-20	ubyte&0xDF	>0
12051>>>>>>>>&-1	string		x 			\b%-.4s
12052>>>>>>>>>&-16	ubyte&0xDF	>0
12053>>>>>>>>>>&-1	string		x 			\b%-.2s
12054>>>>>>&8	ubyte&0xDF	>0			\b.
12055>>>>>>>&-1	string		x 			\b%-.3s
12056#MSDOS.SYS,IBMDOS.COM
12057>>>>>>&11	ubyte&0xDF	>0			\b+
12058>>>>>>>&-1	string		x 			\b%-.5s
12059>>>>>>>>&-6	ubyte&0xDF	>0
12060>>>>>>>>>&-1	string		x 			\b%-.1s
12061>>>>>>>>>>&-5	ubyte&0xDF	>0
12062>>>>>>>>>>>&-1	string		x 			\b%-.2s
12063>>>>>>>&7	ubyte&0xDF	>0			\b.
12064>>>>>>>>&-1	string		x 			\b%-.3s
12065>441	string	Cannot\ load\ from\ harddisk.\n\r
12066>>469	string	Insert\ Systemdisk\040
12067>>>487	string	and\ press\ any\ key.\n\r		\b, MS (2.11) DOS bootloader
12068#>43	string	\224R-LOADER\ \ SYS			=label
12069>54	string	SYS
12070>>324	string	VASKK
12071>>>495	string	NEWLDR\0				\b, DR-DOS Bootloader (LOADER.SYS)
12072#
12073>98	string	Press\ a\ key\ to\ retry\0\r
12074>>120	string	Cannot\ find\ file\ \0\r
12075>>>139	string	Disk\ read\ error\0\r
12076>>>>156	string	Loading\ ...\0				\b, DR-DOS (3.41) Bootloader
12077#DRBIOS.SYS
12078>>>>>44		ubyte&0xDF	>0
12079>>>>>>44	string		x			\b %-.6s
12080>>>>>>>50	ubyte&0xDF	>0
12081>>>>>>>>50	string		x 			\b%-.2s
12082>>>>>>52	ubyte&0xDF	>0
12083>>>>>>>52	string		x 			\b.%-.3s
12084#
12085>70	string	IBMBIO\ \ COM
12086>>472	string	Cannot\ load\ DOS!\040
12087>>>489	string	Any\ key\ to\ retry			\b, DR-DOS Bootloader
12088>>471	string	Cannot\ load\ DOS\040
12089>>487	string	press\ key\ to\ retry			\b, Open-DOS Bootloader
12090#??
12091>444	string	KERNEL\ \ SYS
12092>>314	string	BOOT\ error!				\b, FREE-DOS Bootloader
12093>499	string	KERNEL\ \ SYS
12094>>305	string	BOOT\ err!\0				\b, Free-DOS Bootloader
12095>449	string	KERNEL\ \ SYS
12096>>319	string	BOOT\ error!				\b, FREE-DOS 0.5 Bootloader
12097#
12098>449	string	Loading\ FreeDOS
12099>>0x1AF		ulelong		>0			\b, FREE-DOS 0.95,1.0 Bootloader
12100>>>497		ubyte&0xDF	>0
12101>>>>497		string		x 			\b %-.6s
12102>>>>>503	ubyte&0xDF	>0
12103>>>>>>503	string		x 			\b%-.1s
12104>>>>>>>504	ubyte&0xDF	>0
12105>>>>>>>>504	string		x 			\b%-.1s
12106>>>>505		ubyte&0xDF	>0
12107>>>>>505	string		x 			\b.%-.3s
12108#
12109>331	string	Error!.0				\b, FREE-DOS 1.0 bootloader
12110#
12111>125	string	Loading\ FreeDOS...\r
12112>>311	string	BOOT\ error!\r				\b, FREE-DOS bootloader
12113>>>441		ubyte&0xDF	>0
12114>>>>441		string		x 			\b %-.6s
12115>>>>>447	ubyte&0xDF	>0
12116>>>>>>447	string		x 			\b%-.1s
12117>>>>>>>448	ubyte&0xDF	>0
12118>>>>>>>>448	string		x 			\b%-.1s
12119>>>>449		ubyte&0xDF	>0
12120>>>>>449	string		x 			\b.%-.3s
12121>124	string	FreeDOS\0
12122>>331	string	\ err\0					\b, FREE-DOS BETa 0.9 Bootloader
12123# DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes
12124>>>497		ubyte&0xDF	>0
12125>>>>497		string		x 			\b %-.6s
12126>>>>>503	ubyte&0xDF	>0
12127>>>>>>503	string		x 			\b%-.1s
12128>>>>>>>504	ubyte&0xDF	>0
12129>>>>>>>>504	string		x 			\b%-.1s
12130>>>>505		ubyte&0xDF	>0
12131>>>>>505	string		x 			\b.%-.3s
12132>>333	string	\ err\0					\b, FREE-DOS BEta 0.9 Bootloader
12133>>>497		ubyte&0xDF	>0
12134>>>>497		string		x 			\b %-.6s
12135>>>>>503	ubyte&0xDF	>0
12136>>>>>>503	string		x 			\b%-.1s
12137>>>>>>>504	ubyte&0xDF	>0
12138>>>>>>>>504	string		x 			\b%-.1s
12139>>>>505		ubyte&0xDF	>0
12140>>>>>505	string		x 			\b.%-.3s
12141>>334	string	\ err\0					\b, FREE-DOS Beta 0.9 Bootloader
12142>>>497		ubyte&0xDF	>0
12143>>>>497		string		x 			\b %-.6s
12144>>>>>503	ubyte&0xDF	>0
12145>>>>>>503	string		x 			\b%-.1s
12146>>>>>>>504	ubyte&0xDF	>0
12147>>>>>>>>504	string		x 			\b%-.1s
12148>>>>505		ubyte&0xDF	>0
12149>>>>>505	string		x 			\b.%-.3s
12150>336	string	Error!\040
12151>>343	string	Hit\ a\ key\ to\ reboot.		\b, FREE-DOS Beta 0.9sr1 Bootloader
12152>>>497		ubyte&0xDF	>0
12153>>>>497		string		x 			\b %-.6s
12154>>>>>503	ubyte&0xDF	>0
12155>>>>>>503	string		x 			\b%-.1s
12156>>>>>>>504	ubyte&0xDF	>0
12157>>>>>>>>504	string		x 			\b%-.1s
12158>>>>505		ubyte&0xDF	>0
12159>>>>>505	string		x 			\b.%-.3s
12160# added by Joerg Jenderek
12161# https://www.visopsys.org/
12162# https://partitionlogic.org.uk/
12163# OEM-ID=Visopsys
12164>478		ulelong	0
12165>>(1.b+326)	string	I/O\ Error\ reading\040
12166>>>(1.b+344)	string	Visopsys\ loader\r
12167>>>>(1.b+361)	string	Press\ any\ key\ to\ continue.\r	\b, Visopsys loader
12168# http://alexfru.chat.ru/epm.html#bootprog
12169>494	ubyte	>0x4D
12170>>495	string	>E
12171>>>495	string	<S
12172#OEM-ID is not reliable
12173>>>>3	string	BootProg
12174# It just looks for a program file name at the root directory
12175# and loads corresponding file with following execution.
12176# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
12177>>>>499			ubyte&0xDF	>0		\b, COM/EXE Bootloader
12178>>>>>499		use		DOS-filename
12179#If the boot sector fails to read any other sector,
12180#it prints a very short message ("RE") to the screen and hangs the computer.
12181#If the boot sector fails to find needed program in the root directory,
12182#it also hangs with another message ("NF").
12183>>>>>492		string		RENF		\b, FAT (12 bit)
12184>>>>>495		string		RENF		\b, FAT (16 bit)
12185#If the boot sector fails to read any other sector,
12186#it prints a very short message ("RE") to the screen and hangs the computer.
12187# x86 bootloader end
12188
12189# added by Joerg Jenderek at Feb 2013 according to https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
12190# and https://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector
12191>0		string		RRaA
12192>>0x1E4		string		rrAa		\b, FSInfosector
12193#>>0x1FC	uleshort	=0		SHOULD BE ZERO
12194>>>0x1E8	ulelong		<0xffffffff	\b, %u free clusters
12195>>>0x1EC	ulelong		<0xffffffff	\b, last allocated cluster %u
12196
12197# updated by Joerg Jenderek at Sep 2007
12198>3	ubyte	0
12199#no active flag
12200>>446	ubyte	0
12201# partition 1 not empty
12202>>>450	ubyte	>0
12203# partitions 3,4 empty
12204>>>>482		ubyte	0
12205>>>>>498	ubyte	0
12206# partition 2 ID=0,5,15
12207>>>>>>466	ubyte	<0x10
12208>>>>>>>466	ubyte	0x05			\b, extended partition table
12209>>>>>>>466	ubyte	0x0F			\b, extended partition table (LBA)
12210>>>>>>>466	ubyte	0x0			\b, extended partition table (last)
12211
12212# DOS x86 sector separated and moved from "DOS/MBR boot sector" by Joerg Jenderek at May 2011
12213
12214>0x200	lelong	0x82564557		\b, BSD disklabel
12215
12216# by Joerg Jenderek at Apr 2013
12217#	Print the DOS filenames from directory entry form with 8 right space padded bytes + 3 bytes for extension
12218#	like IO.SYS. MSDOS.SYS , KERNEL.SYS , DRBIO.SYS
122190	name			DOS-filename
12220# space=0x20 (00100000b) means empty
12221>0			ubyte&0xDF	>0
12222>>0			ubyte		x 		\b%c
12223>>>1			ubyte&0xDF	>0
12224>>>>1			ubyte		x 		\b%c
12225>>>>>2			ubyte&0xDF	>0
12226>>>>>>2			ubyte		x 		\b%c
12227>>>>>>>3		ubyte&0xDF	>0
12228>>>>>>>>3		ubyte		x 		\b%c
12229>>>>>>>>>4		ubyte&0xDF	>0
12230>>>>>>>>>>4		ubyte		x 		\b%c
12231>>>>>>>>>>>5		ubyte&0xDF	>0
12232>>>>>>>>>>>>5		ubyte		x 		\b%c
12233>>>>>>>>>>>>>6		ubyte&0xDF	>0
12234>>>>>>>>>>>>>>6		ubyte		x 		\b%c
12235>>>>>>>>>>>>>>>7	ubyte&0xDF	>0
12236>>>>>>>>>>>>>>>>7	ubyte		x 		\b%c
12237# DOS filename extension
12238>>8			ubyte&0xDF	>0		\b.
12239>>>8			ubyte		x 		\b%c
12240>>>>9			ubyte&0xDF	>0
12241>>>>>9			ubyte		x 		\b%c
12242>>>>>>10		ubyte&0xDF	>0
12243>>>>>>>10		ubyte		x 		\b%c
12244#	Print 2 following DOS filenames from directory entry form
12245#	like IO.SYS+MSDOS.SYS or ibmbio.com+ibmdos.com
122460	name			2xDOS-filename
12247# display 1 space
12248>0			ubyte		x		\b
12249>0			use		DOS-filename
12250>11			ubyte		x		\b+
12251>11			use		DOS-filename
12252
12253# https://en.wikipedia.org/wiki/Master_boot_record#PTE
12254# display standard partition table
122550	name				partition-table
12256#>0		ubyte		x	PARTITION-TABLE
12257# test and display 1st til 4th partition table entry
12258>0		use			partition-entry-test
12259>16		use			partition-entry-test
12260>32		use			partition-entry-test
12261>48		use			partition-entry-test
12262#		test for entry of partition table
122630	name				partition-entry-test
12264# partition type ID > 0
12265>4		ubyte		>0
12266# active flag 0
12267>>0		ubyte		0
12268>>>0		use		partition-entry
12269# active flag 0x80, 0x81, ...
12270>>0		ubyte		>0x7F
12271>>>0		use		partition-entry
12272#		Print entry of partition table
122730	name				partition-entry
12274# partition type ID > 0
12275>4		ubyte		>0	\b; partition
12276>>64		leshort		0xAA55	1
12277>>48		leshort		0xAA55	2
12278>>32		leshort		0xAA55	3
12279>>16		leshort		0xAA55	4
12280>>4		ubyte		x	: ID=0x%x
12281>>0		ubyte&0x80	0x80	\b, active
12282>>0		ubyte		>0x80	0x%x
12283>>1		ubyte		x	\b, start-CHS (
12284>>1		use		partition-chs
12285>>5		ubyte		x	\b), end-CHS (
12286>>5		use		partition-chs
12287>>8		ulelong		x	\b), startsector %u
12288>>12		ulelong		x	\b, %u sectors
12289#		Print cylinder,head,sector (CHS) of partition entry
122900	name				partition-chs
12291# cylinder
12292>1		ubyte		x	\b0x
12293>1		ubyte&0xC0	0x40	\b1
12294>1		ubyte&0xC0	0x80	\b2
12295>1		ubyte&0xC0	0xC0	\b3
12296>2		ubyte		x	\b%x
12297# head
12298>0		ubyte		x	\b,%u
12299# sector
12300>1		ubyte&0x3F	x	\b,%u
12301
12302# FATX
123030		string		FATX		FATX filesystem data
12304
12305# romfs filesystems - Juan Cespedes <cespedes@debian.org>
123060	string		-rom1fs-	romfs filesystem, version 1
12307>8	belong	x			%d bytes,
12308>16	string	x			named %s.
12309
12310# netboot image - Juan Cespedes <cespedes@debian.org>
123110	lelong		0x1b031336L	Netboot image,
12312>4	lelong&0xFFFFFF00	0
12313>>4	lelong&0x100	0x000		mode 2
12314>>4	lelong&0x100	0x100		mode 3
12315>4	lelong&0xFFFFFF00	!0	unknown mode
12316
123170x18b	string	OS/2	OS/2 Boot Manager
12318
12319# updated by Joerg Jenderek at Oct 2008 and Sep 2012
12320# https://syslinux.zytor.com/iso.php
12321# tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05
12322# assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop
123230	ulequad&0x909000007cc0eafa	0x909000007c40eafa
12324>631	search/689	ISOLINUX\ 	isolinux Loader
12325>>&0	string		x		(version %-4.4s)
12326# https://syslinux.zytor.com/pxe.php
12327# assembler instructions: jmp 7C05
123280	ulelong	0x007c05ea		pxelinux loader (version 2.13 or older)
12329# assembler instructions: pushfd;pushad
123300	ulelong	0x60669c66		pxelinux loader
12331# assembler instructions: jmp 05
123320	ulelong	0xc00005ea		pxelinux loader (version 3.70 or newer)
12333# https://syslinux.zytor.com/wiki/index.php/SYSLINUX
123340	string	LDLINUX\ SYS\ 		SYSLINUX loader
12335>12	string	x			(older version %-4.4s)
123360	string	\r\nSYSLINUX\ 		SYSLINUX loader
12337>11	string	x			(version %-4.4s)
12338# syslinux updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012
12339# assembler instructions: jmp yy (yy=0x3c,0x58);nop;"SYSLINUX"
123400	ulelong&0x80909bEB	0x009018EB
12341# OEM-ID not always "SYSLINUX"
12342>434	search/47	Boot\ failed
12343# followed by \r\n\0 or :\
12344>>482	search/132	\0LDLINUX\ SYS		Syslinux bootloader (version 2.13 or older)
12345>>1	ubyte		0x58			Syslinux bootloader (version 3.0-3.9)
12346>459	search/30	Boot\ error\r\n\0
12347>>1	ubyte		0x58			Syslinux bootloader (version 3.10 or newer)
12348# SYSLINUX MBR updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012
12349# assembler instructions: mov di,0600h;mov cx,0100h
1235016	search/4	\xbf\x00\x06\xb9\x00\x01
12351# to display SYSLINUX MBR (36) before old DOS/MBR boot sector one with partition table (strength=50+21)
12352!:strength +36
12353>94	search/249	Missing\ operating\ system
12354# followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other
12355# skip Ranish MBR
12356>>408	search/4	HD1/\0
12357>>408	default		x
12358>>>250	search/118	\0Operating\ system\ load		SYSLINUX MBR
12359# followed by "ing " or space
12360>>>>292	search/98	error
12361>>>>>&0	string		\r		    			(version 3.35 or older)
12362>>>>>&0	string		.\r					(version 3.52 or newer)
12363>>>>>&0	default		x					(version 3.36-3.51 )
12364>368	search/106	\0Disk\ error\ on\ boot\r\n		SYSLINUX GPT-MBR
12365>>156	search/10	\0Boot\ partition\ not\ found\r\n
12366>>>270	search/10	\0OS\ not\ bootable\r\n			(version 3.86 or older)
12367>>174	search/10	\0Missing\ OS\r\n
12368>>>189	search/10	\0Multiple\ active\ partitions\r\n	(version 4.00 or newer)
12369# SYSLINUX END
12370
12371# NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012
12372# assembler instructions: xor ax,ax;mov	ax,ss;mov sp,0x7c00;mov	ax,
123730	ubequad		0x31c08ed0bc007c8e
12374# mbr_bootsel magic before partition table not reliable with small ipl fragments
12375#>444	uleshort	0xb5e1
12376>0004	uleshort	x
12377# ERRorTeXT
12378>>181	search/166		Error\ \0\r\n				NetBSD mbr
12379# NT Drive Serial Number https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS
12380>>>0x1B8	ubelong		>0					\b,Serial 0x%-.8x
12381# BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx
12382>>>0xbb		search/71	\xcd\x13\x5a\x52\x52			\b,bootselector
12383# BOOT_EXTENDED definitions contains assembler instructions:
12384# xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13
12385>>>0x96	search/1	\x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13	\b,boot extended
12386# COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al
12387>>>0x130	search/55	\xee\x80\xc2\x05\xec\xa8\x40		\b,serial IO
12388# not TERSE_ERROR
12389>>>196		search/106	No\ active\ partition\0
12390>>>>&0		string		Disk\ read\ error\0
12391>>>>>&0		string		No\ operating\ system\0			\b,verbose
12392# not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13
12393>>>0x7d		search/7	\x5a\x52\xb4\x08\xcd\x13		\b,CHS
12394# not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop	dx;push	dx;int 0x13
12395>>>0xa4		search/84	\xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13	\b,LBA-check
12396# assembler instructions: movw nametab,bx
12397>>>0x26	    search/21	\xBB\x94\x07
12398# not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf
12399>>>>&-9	ubequad&0xBE00f0E800febb94	0xBE0000E80000bb94
12400>>>>>181	search/166		Error\ \0
12401# "a: disk" , "Fn: diskn" or "NetBSD MBR boot"
12402>>>>>>&3	string			x				\b,"%s"
12403>>>446	use		partition-table
12404# Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html
12405# added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4
12406# assembler instructions: jmp short 0x58;nop;ASCII
124070	ubequad&0xeb58908000000000	0xeb58900000000000
12408# assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss,
12409>(1.b+2)	ubequad			0xfa31c08ed88ec08e
12410# Error messages at end of code
12411>>376		string	No\ operating\ system\r\n\0
12412>>>398		string	Disk\ error\r\n\0FDD\0HDD\0
12413>>>>419		string	\ EBIOS\r\n\0				AdvanceMAME mbr
12414
12415# Neil Turton mbr loader variant of https://www.chiark.greenend.org.uk/~neilt/mbr/
12416# added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11
12417# for 1st version assembler instructions:	cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI,
12418# or  	  	  	    			cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS,
124190	ulequad&0xcE1b40D48EC031FC	0x8E0000D08EC031FC
12420# pointer to the data starting with Neil Turton signature string
12421>(0x1BC.s)		string		NDTmbr
12422>>&-14			string		1234F\0			Turton mbr (
12423# parameters also viewed by install-mbr --list
12424>>>(0x1BC.s+7)		ubyte		x			\b%u<=
12425>>>(0x1BC.s+9)		ubyte		x			\bVersion<=%u
12426#>>>(0x1BC.s+8)		ubyte		x			asm_flag_%x
12427>>>(0x1BC.s+8)		ubyte&1		1			\b,Y2K-Fix
12428# variant used by testdisk of https://www.cgsecurity.org/wiki/Menu_MBRCode
12429>>>(0x1BC.s+8)		ubyte&2		2			\b,TestDisk
12430#0x1~1,..,0x8~4,0x10~F,0x80~A enabled
12431#>>>(0x1BC.s+10)		ubyte		x			\b,flags 0x%x
12432#0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot
12433#>>>(0x1BC.s+11)		ubyte		x			\b,cfg_def 0x%x
12434# for older versions
12435>>>(0x1BC.s+9)		ubyte		<2
12436#>>>>(0x1BC.s+12)	ubyte		18			\b,%hhu/18 seconds
12437>>>>(0x1BC.s+12)	ubyte		!18			\b,%u/18 seconds
12438# floppy A: or B:
12439>>>>(0x1BC.s+13)	ubyte		<2			\b,floppy 0x%x
12440>>>>(0x1BC.s+13)	ubyte		>1
12441# 1st hard disc
12442#>>>>>(0x1BC.s+13)	ubyte		0x80			\b,drive 0x%x
12443# not 1st hard disc
12444>>>>>(0x1BC.s+13)	ubyte		!0x80			\b,drive 0x%x
12445# for version >= 2 maximal timeout can be 65534
12446>>>(0x1BC.s+9)		ubyte		>1
12447#>>>>(0x1BC.s+12)	uleshort	18			\b,%u/18 seconds
12448>>>>(0x1BC.s+12)	uleshort	!18			\b,%u/18 seconds
12449# floppy A: or B:
12450>>>>(0x1BC.s+14)	ubyte		<2			\b,floppy 0x%x
12451>>>>(0x1BC.s+14)	ubyte		>1
12452# 1st hard disc
12453#>>>>>(0x1BC.s+14)	ubyte		0x80			\b,drive 0x%x
12454# not 1st hard disc
12455>>>>>(0x1BC.s+14)	ubyte		!0x80			\b,drive 0x%x
12456>>>0	ubyte		x					\b)
12457
12458# added by Joerg Jenderek
12459# In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or
12460# grub-1.94/kern/i386/pc/startup.S
12461# https://www.gnu.org/software/grub/manual/grub.html#Embedded-data
12462# usual values are marked with comments to get only information of strange GRUB loaders
124630x200	uleshort		0x70EA
12464# found only version 3.{1,2}
12465>0x206		ubeshort	>0x0300
12466# GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00"
12467>>0x212 	ubyte		>0x29
12468>>>0x213 	ubyte		>0x29
12469# not iso9660_stage1_5
12470#>>>0	ulelong&0x00BE5652	0x00BE5652
12471>>>>0x213 	ubyte		>0x29		GRand Unified Bootloader
12472# config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2"
12473>>>>0x217 	ubyte		0xFF		stage1_5
12474>>>>0x217 	ubyte		<0xFF		stage2
12475>>>>0x206	ubyte		x		\b version %u
12476>>>>0x207	ubyte		x		\b.%u
12477# module_size for 1.94
12478>>>>0x208	ulelong		<0xffffff	\b, installed partition %u
12479#>>>>0x208	ulelong		=0xffffff	\b, %lu (default)
12480>>>>0x208	ulelong		>0xffffff	\b, installed partition %u
12481# GRUB 0.5.95 unofficial
12482>>>>0x20C	ulelong&0x2E300000 0x2E300000
12483# 0=stage2	1=ffs	2=e2fs	3=fat	4=minix	5=reiserfs
12484>>>>>0x20C	ubyte		x		\b, identifier 0x%x
12485#>>>>>0x20D	ubyte		=0		\b, LBA flag 0x%x (default)
12486>>>>>0x20D	ubyte		>0		\b, LBA flag 0x%x
12487# GRUB version as string
12488>>>>>0x20E 	string		>\0		\b, GRUB version %-s
12489# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
12490>>>>>>0x215 	ulong		0xffffffff
12491>>>>>>>0x219 	string		>\0		\b, configuration file %-s
12492>>>>>>0x215 	ulong		!0xffffffff
12493>>>>>>>0x215 	string		>\0		\b, configuration file %-s
12494# newer GRUB versions
12495>>>>0x20C	ulelong&0x2E300000 !0x2E300000
12496##>>>>>0x20C	ulelong		=0		\b, saved entry %d (usual)
12497>>>>>0x20C	ulelong		>0		\b, saved entry %d
12498# for 1.94 contains kernel image size
12499# for 0.93,0.94,0.96,0.97
12500# 0=stage2	1=ffs	2=e2fs	3=fat	4=minix	5=reiserfs	6=vstafs	7=jfs	8=xfs	9=iso9660	a=ufs2
12501>>>>>0x210	ubyte		x		\b, identifier 0x%x
12502# The flag for LBA forcing is in most cases 0
12503#>>>>>0x211	ubyte		=0		\b, LBA flag 0x%x (default)
12504>>>>>0x211	ubyte		>0		\b, LBA flag 0x%x
12505# GRUB version as string
12506>>>>>0x212 	string		>\0		\b, GRUB version %-s
12507# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
12508>>>>>0x217 	ulong		0xffffffff
12509>>>>>>0x21b 	string		>\0		\b, configuration file %-s
12510>>>>>0x217 	ulong		!0xffffffff
12511>>>>>>0x217 	string		>\0		\b, configuration file %-s
12512
12513# DOS x86 sector updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at May 2011
12514# JuMP short     bootcodeoffset NOP assembler instructions will usually be EB xx 90
12515# over BIOS parameter block (BPB)
12516# https://thestarman.pcministry.com/asm/2bytejumps.htm#FWD
12517# older drives may use Near JuMP instruction E9 xx xx
12518# minimal short forward jump found 0x29 for bootloaders or 0x0
12519# maximal short forward jump is 0x7f
12520# OEM-ID is empty or contain readable bytes
125210		ulelong&0x804000E9	0x000000E9
12522!:strength	+60
12523# mtools-3.9.8/msdos.h
12524# usual values are marked with comments to get only information of strange FAT systems
12525# valid sectorsize must be a power of 2 from 32 to 32768
12526>11		uleshort&0x001f	0
12527>>11		uleshort	<32769
12528>>>11		uleshort	>31
12529>>>>21		ubyte&0xf0	0xF0
12530>>>>>0		ubyte		0xEB		DOS/MBR boot sector
12531>>>>>>1		ubyte		x		\b, code offset 0x%x+2
12532>>>>>0		ubyte		0xE9
12533>>>>>>1		uleshort	x		\b, code offset 0x%x+3
12534>>>>>3		string		>\0		\b, OEM-ID "%-.8s"
12535#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC
12536>>>>>>8		string		IHC		\b cached by Windows 9M
12537>>>>>11		uleshort	>512		\b, Bytes/sector %u
12538#>>>>>11	uleshort	=512		\b, Bytes/sector %u=512 (usual)
12539>>>>>11		uleshort	<512		\b, Bytes/sector %u
12540>>>>>13		ubyte		>1		\b, sectors/cluster %u
12541#>>>>>13	ubyte		=1		\b, sectors/cluster %u (usual on Floppies)
12542# for lazy FAT32 implementation like Transcend digital photo frame PF830
12543>>>>>82		string/c	fat32
12544>>>>>>14	uleshort	!32		\b, reserved sectors %u
12545#>>>>>>14	uleshort	=32		\b, reserved sectors %u (usual Fat32)
12546>>>>>82		string/c	!fat32
12547>>>>>>14	uleshort	>1		\b, reserved sectors %u
12548#>>>>>>14	uleshort	=1		\b, reserved sectors %u (usual FAT12,FAT16)
12549#>>>>>>14	uleshort	0		\b, reserved sectors %u (usual NTFS)
12550>>>>>16		ubyte		>2		\b, FATs %u
12551#>>>>>16	ubyte		=2		\b, FATs %u (usual)
12552>>>>>16		ubyte		=1		\b, FAT  %u
12553>>>>>16		ubyte		>0
12554>>>>>17		uleshort	>0		\b, root entries %u
12555#>>>>>17	uleshort	=0		\b, root entries %hu=0 (usual Fat32)
12556>>>>>19		uleshort	>0		\b, sectors %u (volumes <=32 MB)
12557#>>>>>19	uleshort	=0		\b, sectors %hu=0 (usual Fat32)
12558>>>>>21		ubyte		>0xF0		\b, Media descriptor 0x%x
12559#>>>>>21	ubyte		=0xF0		\b, Media descriptor 0x%x (usual floppy)
12560>>>>>21		ubyte		<0xF0		\b, Media descriptor 0x%x
12561>>>>>22		uleshort	>0		\b, sectors/FAT %u
12562#>>>>>22	uleshort	=0		\b, sectors/FAT %hu=0 (usual Fat32)
12563>>>>>24		uleshort	x		\b, sectors/track %u
12564>>>>>26		ubyte		>2		\b, heads %u
12565#>>>>>26	ubyte		=2		\b, heads %u (usual floppy)
12566>>>>>26		ubyte		=1		\b, heads %u
12567# valid only for sector sizes with more then 32 Bytes
12568>>>>>11		uleshort	>32
12569# https://en.wikipedia.org/wiki/Design_of_the_FAT_file_system#Extended_BIOS_Parameter_Block
12570# skip for values 2,2Ah,70h,73h,DFh
12571# and continue for extended boot signature values 0,28h,29h,80h
12572>>>>>>38	ubyte&0x56	=0
12573>>>>>>>28	ulelong		>0		\b, hidden sectors %u
12574#>>>>>>>28	ulelong		=0		\b, hidden sectors %u (usual floppy)
12575>>>>>>>32	ulelong		>0		\b, sectors %u (volumes > 32 MB)
12576#>>>>>>>32	ulelong		=0		\b, sectors %u (volumes > 32 MB)
12577# FAT<32 bit specific
12578>>>>>>>82	string/c	!fat32
12579#>>>>>>>>36	ubyte		0x80		\b, physical drive 0x%x=0x80 (usual harddisk)
12580#>>>>>>>>36	ubyte		0		\b, physical drive 0x%x=0 (usual floppy)
12581>>>>>>>>36	ubyte		!0x80
12582>>>>>>>>>36	ubyte		!0		\b, physical drive 0x%x
12583# VGA-copy CRC or
12584# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
12585>>>>>>>>37	ubyte		>0		\b, reserved 0x%x
12586#>>>>>>>>37	ubyte		=0		\b, reserved 0x%x
12587# extended boot signature value is 0x80 for NTFS, 0x28 or 0x29 for others
12588>>>>>>>>38	ubyte		!0x29		\b, dos < 4.0 BootSector (0x%x)
12589>>>>>>>>38	ubyte&0xFE	=0x28
12590>>>>>>>>>39	ulelong		x		\b, serial number 0x%x
12591>>>>>>>>38	ubyte		=0x29
12592>>>>>>>>>43	string		<NO\ NAME	\b, label: "%11.11s"
12593>>>>>>>>>43	string		>NO\ NAME	\b, label: "%11.11s"
12594>>>>>>>>>43	string		=NO\ NAME	\b, unlabeled
12595# there exist some old floppies without word FAT at offset 54
12596# a word like "FATnm   " is only a hint for a FAT size on nm-bits
12597# Normally the number of clusters is calculated by the values of BPP.
12598# if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit,
12599# otherwise FAT is 16 bit.
12600# http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html
12601>>>>>82		string/c	!fat32
12602>>>>>>54	string		FAT12		\b, FAT (12 bit)
12603>>>>>>54	string		FAT16		\b, FAT (16 bit)
12604>>>>>>54	default		x
12605# determinate FAT bit size by media descriptor
12606# small floppies implies FAT12
12607>>>>>>>21	ubyte		<0xF0		\b, FAT (12 bit by descriptor)
12608# with media descriptor F0h floppy or maybe superfloppy with FAT16
12609>>>>>>>21	ubyte		=0xF0
12610# superfloppy (many sectors) implies FAT16
12611>>>>>>>>32	ulelong		>0xFFFF		\b, FAT (16 bit by descriptor+sectors)
12612# no superfloppy with media descriptor F0h implies FAT12
12613>>>>>>>>32	default		x		\b, FAT (12 bit by descriptor+sectors)
12614# with media descriptor F8h floppy or hard disc with FAT12 or FAT16
12615>>>>>>>21	ubyte		=0xF8
12616# 360 KiB with media descriptor F8h, 9 sectors per track ,single sided floppy implies FAT12
12617>>>>>>>>19	ubequad	0xd002f80300090001	\b, FAT (12 bit by descriptor+geometry)
12618# hard disc with FAT12 or FAT16
12619>>>>>>>>19	default		x		\b, FAT (1Y bit by descriptor)
12620# with media descriptor FAh floppy, RAM disc with FAT12 or FAT16 or Tandy hard disc
12621>>>>>>>21	ubyte		=0xFA
12622# 320 KiB with media descriptor FAh, 8 sectors per track ,single sided floppy implies FAT12
12623>>>>>>>>19	ubequad	0x8002fa0200080001	\b, FAT (12 bit by descriptor+geometry)
12624# RAM disc with FAT12 or FAT16 or Tandy hard disc
12625>>>>>>>>19	default		x		\b, FAT (1Y bit by descriptor)
12626# others are floppy
12627>>>>>>>21	default		x		\b, FAT (12 bit by descriptor)
12628# FAT32 bit specific
12629>>>>>82		string/c	fat32		\b, FAT (32 bit)
12630>>>>>>36	ulelong		x		\b, sectors/FAT %u
12631# https://technet.microsoft.com/en-us/library/cc977221.aspx
12632>>>>>>40	uleshort	>0		\b, extension flags 0x%x
12633#>>>>>>40	uleshort	=0		\b, extension flags %hu
12634>>>>>>42	uleshort	>0		\b, fsVersion %u
12635#>>>>>>42	uleshort	=0		\b, fsVersion %u (usual)
12636>>>>>>44	ulelong		>2		\b, rootdir cluster %u
12637#>>>>>>44	ulelong		=2		\b, rootdir cluster %u
12638#>>>>>>44	ulelong		=1		\b, rootdir cluster %u
12639>>>>>>48	uleshort	>1		\b, infoSector %u
12640#>>>>>>48	uleshort	=1		\b, infoSector %u (usual)
12641>>>>>>48	uleshort	<1		\b, infoSector %u
12642# 0 or 0xFFFF instead of usual 6 means no backup sector
12643>>>>>>50	uleshort	=0xFFFF		\b, no Backup boot sector
12644>>>>>>50	uleshort	=0		\b, no Backup boot sector
12645#>>>>>>50	uleshort	=6		\b, Backup boot sector %u (usual)
12646>>>>>>50	default		x
12647>>>>>>>50	uleshort	x		\b, Backup boot sector %u
12648# corrected by Joerg Jenderek at Feb 2011 according to https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
12649>>>>>>52	ulelong		>0		\b, reserved1 0x%x
12650>>>>>>56	ulelong		>0		\b, reserved2 0x%x
12651>>>>>>60	ulelong		>0		\b, reserved3 0x%x
12652# same structure as FAT1X
12653#>>>>>>64	ubyte		=0x80		\b, physical drive 0x%x=80 (usual harddisk)
12654#>>>>>>64	ubyte		=0		\b, physical drive 0x%x=0 (usual floppy)
12655>>>>>>64	ubyte		!0x80
12656>>>>>>>64	ubyte		>0		\b, physical drive 0x%x
12657# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
12658>>>>>>65	ubyte		>0		\b, reserved 0x%x
12659>>>>>>66	ubyte		!0x29		\b, dos < 4.0 BootSector (0x%x)
12660>>>>>>66	ubyte		=0x29
12661>>>>>>>67	ulelong		x		\b, serial number 0x%x
12662>>>>>>>71	string		<NO\ NAME	\b, label: "%11.11s"
12663>>>>>>>71	string		>NO\ NAME	\b, label: "%11.11s"
12664>>>>>>>71	string		=NO\ NAME	\b, unlabeled
12665# additional tests for floppy image added by Joerg Jenderek
12666# no fixed disk
12667>>>>>21		ubyte		!0xF8
12668# floppy media with 12 bit FAT
12669>>>>>>54	string		!FAT16
12670# test for FAT after bootsector
12671>>>>>>>(11.s)	ulelong&0x00ffffF0	0x00ffffF0	\b, followed by FAT
12672# floppy image
12673!:mime application/x-ima
12674# NTFS specific added by Joerg Jenderek at Mar 2011 according to https://thestarman.pcministry.com/asm/mbr/NTFSBR.htm
12675# and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html
12676# 0 FATs
12677>>>>>16	ubyte		=0
12678# 0 root entries
12679>>>>>>17	uleshort	=0
12680# 0 DOS sectors
12681>>>>>>>19	uleshort	=0
12682# 0 sectors/FAT
12683# dos < 4.0 BootSector value found is 0x80
12684#38	ubyte		=0x80			\b, dos < 4.0 BootSector (0x%x)
12685>>>>>>>>22	uleshort	=0		\b; NTFS
12686>>>>>>>>>24	uleshort	>0		\b, sectors/track %u
12687>>>>>>>>>36	ulelong		!0x800080	\b, physical drive 0x%x
12688>>>>>>>>>40	ulequad		>0		\b, sectors %lld
12689>>>>>>>>>48	ulequad		>0		\b, $MFT start cluster %lld
12690>>>>>>>>>56	ulequad		>0		\b, $MFTMirror start cluster %lld
12691# Values 0 to 127 represent MFT record sizes of 0 to 127 clusters.
12692# Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes.
12693>>>>>>>>>64	lelong		<256
12694>>>>>>>>>>64	lelong		<128		\b, clusters/RecordSegment %d
12695>>>>>>>>>>64	ubyte		>127		\b, bytes/RecordSegment 2^(-1*%i)
12696# Values 0 to 127 represent index block sizes of 0 to 127 clusters.
12697# Values 128 to 255 represent index block sizes of 2^(256-N) byte
12698>>>>>>>>>68	ulelong		<256
12699>>>>>>>>>>68	ulelong		<128		\b, clusters/index block %d
12700#>>>>>>>>>>68	ulelong		>127		\b, bytes/index block 2^(256-%d)
12701>>>>>>>>>>68	ubyte		>127		\b, bytes/index block 2^(-1*%i)
12702>>>>>>>>>72	ulequad		x		\b, serial number 0%llx
12703>>>>>>>>>80	ulelong		>0		\b, checksum 0x%x
12704#>>>>>>>>>80	ulelong		=0		\b, checksum 0x%x=0 (usual)
12705# unicode loadername size jump
12706>>>>>>>>>(0x200.s*2)	ubyte				x
12707# in next sector loadername terminated by unicode CTRL-D and $
12708>>>>>>>>>>&0x1FF	ulequad&0x0000FFffFFffFF00	0x0000002400040000 \b; contains
12709# if 2nd NTFS sectors is found then assume whole filesystem
12710#!:mime		application/x-raw-disk-image
12711!:ext		img/bin/ntfs
12712>>>>>>>>>>>0x200	use				ntfs-sector2
12713
12714# For 2nd NTFS sector added by Joerg Jenderek at Jan 2013, Mar 2019
12715# https://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm
12716# unused assembler instructions short JMP y2;NOP;NOP
127170x056		ulelong&0xFFFF0FFF	0x909002EB	NTFS
12718#!:mime		application/octet-stream
12719!:ext		bin
12720>0		use		ntfs-sector2
12721# https://memory.dataram.com/products-and-services/software/ramdisk
12722# assembler instructions JMP C000;NOP
127230x056		ulelong			0x9000c0e9	NTFS
12724#!:mime		application/octet-stream
12725!:ext		bin
12726>0		use		ntfs-sector2
12727# check for characteristics of second NTFS sector and then display loader name
127280		name		ntfs-sector2
12729# number of utf16 characters of loadername
12730>0		uleshort	<8
12731# unused assembler instructions JMP y2;NOP;NOP or JMP C000;NOP
12732>>0x056		ulelong&0xFF0000FD	0x900000E9
12733# loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR
12734>>>0x002		lestring16	x	bootstrap %-5.5s
12735# check for 7 character length of loader name like BOOTMGR
12736>>>0		uleshort	7
12737>>>>0x0c	lestring16	x	\b%-2.2s
12738### DOS,NTFS boot sectors end
12739
12740# ntfsclone-image is a special save format for NTFS volumes,
12741# created and restored by the ntfsclone program
127420	string	\0ntfsclone-image	ntfsclone image,
12743>0x10	byte	x			version %d.
12744>0x11	byte	x			\b%d,
12745>0x12	lelong	x			cluster size %d,
12746>0x16	lequad	x			device size %lld,
12747>0x1e	lequad	x			%lld total clusters,
12748>0x26	lequad	x			%lld clusters in use
12749
127509564	lelong		0x00011954	Unix Fast File system [v1] (little-endian),
12751>8404	string		x		last mounted on %s,
12752#>9504	ledate		x		last checked at %s,
12753>8224	ledate		x		last written at %s,
12754>8401	byte		x		clean flag %d,
12755>8228	lelong		x		number of blocks %d,
12756>8232	lelong		x		number of data blocks %d,
12757>8236	lelong		x		number of cylinder groups %d,
12758>8240	lelong		x		block size %d,
12759>8244	lelong		x		fragment size %d,
12760>8252	lelong		x		minimum percentage of free blocks %d,
12761>8256	lelong		x		rotational delay %dms,
12762>8260	lelong		x		disk rotational speed %drps,
12763>8320	lelong		0		TIME optimization
12764>8320	lelong		1		SPACE optimization
12765
1276642332	lelong		0x19540119	Unix Fast File system [v2] (little-endian)
12767>&-1164	string		x		last mounted on %s,
12768>&-696	string		>\0		volume name %s,
12769>&-304	leqldate	x		last written at %s,
12770>&-1167	byte		x		clean flag %d,
12771>&-1168	byte		x		readonly flag %d,
12772>&-296	lequad		x		number of blocks %lld,
12773>&-288	lequad		x		number of data blocks %lld,
12774>&-1332	lelong		x		number of cylinder groups %d,
12775>&-1328	lelong		x		block size %d,
12776>&-1324	lelong		x		fragment size %d,
12777>&-180	lelong		x		average file size %d,
12778>&-176	lelong		x		average number of files in dir %d,
12779>&-272	lequad		x		pending blocks to free %lld,
12780>&-264	lelong		x		pending inodes to free %d,
12781>&-664	lequad		x		system-wide uuid %0llx,
12782>&-1316	lelong		x		minimum percentage of free blocks %d,
12783>&-1248	lelong		0		TIME optimization
12784>&-1248	lelong		1		SPACE optimization
12785
1278666908	lelong		0x19540119	Unix Fast File system [v2] (little-endian)
12787>&-1164	string		x		last mounted on %s,
12788>&-696	string		>\0		volume name %s,
12789>&-304	leqldate	x		last written at %s,
12790>&-1167	byte		x		clean flag %d,
12791>&-1168	byte		x		readonly flag %d,
12792>&-296	lequad		x		number of blocks %lld,
12793>&-288	lequad		x		number of data blocks %lld,
12794>&-1332	lelong		x		number of cylinder groups %d,
12795>&-1328	lelong		x		block size %d,
12796>&-1324	lelong		x		fragment size %d,
12797>&-180	lelong		x		average file size %d,
12798>&-176	lelong		x		average number of files in dir %d,
12799>&-272	lequad		x		pending blocks to free %lld,
12800>&-264	lelong		x		pending inodes to free %d,
12801>&-664	lequad		x		system-wide uuid %0llx,
12802>&-1316	lelong		x		minimum percentage of free blocks %d,
12803>&-1248	lelong		0		TIME optimization
12804>&-1248	lelong		1		SPACE optimization
12805
128069564	belong		0x00011954	Unix Fast File system [v1] (big-endian),
12807>7168   belong		0x4c41424c	Apple UFS Volume
12808>>7186  string		x		named %s,
12809>>7176  belong		x		volume label version %d,
12810>>7180  bedate		x		created on %s,
12811>8404	string		x		last mounted on %s,
12812#>9504	bedate		x		last checked at %s,
12813>8224	bedate		x		last written at %s,
12814>8401	byte		x		clean flag %d,
12815>8228	belong		x		number of blocks %d,
12816>8232	belong		x		number of data blocks %d,
12817>8236	belong		x		number of cylinder groups %d,
12818>8240	belong		x		block size %d,
12819>8244	belong		x		fragment size %d,
12820>8252	belong		x		minimum percentage of free blocks %d,
12821>8256	belong		x		rotational delay %dms,
12822>8260	belong		x		disk rotational speed %drps,
12823>8320	belong		0		TIME optimization
12824>8320	belong		1		SPACE optimization
12825
1282642332	belong		0x19540119	Unix Fast File system [v2] (big-endian)
12827>&-1164	string		x		last mounted on %s,
12828>&-696	string		>\0		volume name %s,
12829>&-304	beqldate	x		last written at %s,
12830>&-1167	byte		x		clean flag %d,
12831>&-1168	byte		x		readonly flag %d,
12832>&-296	bequad		x		number of blocks %lld,
12833>&-288	bequad		x		number of data blocks %lld,
12834>&-1332	belong		x		number of cylinder groups %d,
12835>&-1328	belong		x		block size %d,
12836>&-1324	belong		x		fragment size %d,
12837>&-180	belong		x		average file size %d,
12838>&-176	belong		x		average number of files in dir %d,
12839>&-272	bequad		x		pending blocks to free %lld,
12840>&-264	belong		x		pending inodes to free %d,
12841>&-664	bequad		x		system-wide uuid %0llx,
12842>&-1316	belong		x		minimum percentage of free blocks %d,
12843>&-1248	belong		0		TIME optimization
12844>&-1248	belong		1		SPACE optimization
12845
1284666908	belong		0x19540119	Unix Fast File system [v2] (big-endian)
12847>&-1164	string		x		last mounted on %s,
12848>&-696	string		>\0		volume name %s,
12849>&-304	beqldate	x		last written at %s,
12850>&-1167	byte		x		clean flag %d,
12851>&-1168	byte		x		readonly flag %d,
12852>&-296	bequad		x		number of blocks %lld,
12853>&-288	bequad		x		number of data blocks %lld,
12854>&-1332	belong		x		number of cylinder groups %d,
12855>&-1328	belong		x		block size %d,
12856>&-1324	belong		x		fragment size %d,
12857>&-180	belong		x		average file size %d,
12858>&-176	belong		x		average number of files in dir %d,
12859>&-272	bequad		x		pending blocks to free %lld,
12860>&-264	belong		x		pending inodes to free %d,
12861>&-664	bequad		x		system-wide uuid %0llx,
12862>&-1316	belong		x		minimum percentage of free blocks %d,
12863>&-1248	belong		0		TIME optimization
12864>&-1248	belong		1		SPACE optimization
12865
128660	ulequad		0xc8414d4dc5523031	HAMMER filesystem (little-endian),
12867>0x90	lelong+1	x			volume %d
12868>0x94	lelong		x			(of %d),
12869>0x50	string		x			name %s,
12870>0x98	ulelong		x			version %u,
12871>0xa0	ulelong		x			flags 0x%x
12872
12873# ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca>
12874# ext4 filesystem - Eric Sandeen <sandeen@sandeen.net>
12875# volume label and UUID Russell Coker
12876# https://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
128770x438   leshort         0xEF53          Linux
12878>0x44c  lelong          x               rev %d
12879>0x43e  leshort         x               \b.%d
12880# No journal?  ext2
12881>0x45c  lelong          ^0x0000004      ext2 filesystem data
12882>>0x43a leshort         ^0x0000001      (mounted or unclean)
12883# Has a journal?  ext3 or ext4
12884>0x45c  lelong          &0x0000004
12885#  and small INCOMPAT?
12886>>0x460 lelong          <0x0000040
12887#   and small RO_COMPAT?
12888>>>0x464 lelong         <0x0000008      ext3 filesystem data
12889#   else large RO_COMPAT?
12890>>>0x464 lelong         >0x0000007      ext4 filesystem data
12891#  else large INCOMPAT?
12892>>0x460	lelong          >0x000003f      ext4 filesystem data
12893>0x468	belong		x		\b, UUID=%08x
12894>0x46c	beshort		x		\b-%04x
12895>0x46e	beshort		x		\b-%04x
12896>0x470	beshort		x		\b-%04x
12897>0x472	belong		x		\b-%08x
12898>0x476	beshort		x		\b%04x
12899>0x478	string		>0		\b, volume name "%s"
12900# General flags for any ext* fs
12901>0x460	lelong          &0x0000004      (needs journal recovery)
12902>0x43a	leshort         &0x0000002      (errors)
12903# INCOMPAT flags
12904>0x460	lelong          &0x0000001      (compressed)
12905#>0x460	lelong          &0x0000002      (filetype)
12906#>0x460	lelong          &0x0000010      (meta bg)
12907>0x460	lelong          &0x0000040      (extents)
12908>0x460	lelong          &0x0000080      (64bit)
12909#>0x460	lelong          &0x0000100      (mmp)
12910#>0x460	lelong          &0x0000200      (flex bg)
12911# RO_INCOMPAT flags
12912#>0x464	lelong          &0x0000001      (sparse super)
12913>0x464	lelong          &0x0000002      (large files)
12914>0x464	lelong          &0x0000008      (huge files)
12915#>0x464	lelong          &0x0000010      (gdt checksum)
12916#>0x464	lelong          &0x0000020      (many subdirs)
12917#>0x463	lelong          &0x0000040      (extra isize)
12918
12919# f2fs filesystem - Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi>
129200x400	lelong		0xF2F52010	F2FS filesystem
12921>0x46c	belong		x		\b, UUID=%08x
12922>0x470	beshort		x		\b-%04x
12923>0x472	beshort		x		\b-%04x
12924>0x474	beshort		x		\b-%04x
12925>0x476	belong		x		\b-%08x
12926>0x47a	beshort		x		\b%04x
12927>0x147c	lestring16	x		\b, volume name "%s"
12928
12929# Minix filesystems - Juan Cespedes <cespedes@debian.org>
129300x410	leshort		0x137f
12931!:strength / 2
12932>0x402	beshort		< 100
12933>0x402	beshort		> -1		Minix filesystem, V1, 14 char names, %d zones
12934>0x1e	string		minix		\b, bootable
129350x410	beshort		0x137f
12936!:strength / 2
12937>0x402	beshort		< 100
12938>0x402	beshort		> -1		Minix filesystem, V1 (big endian), %d zones
12939>0x1e	string		minix		\b, bootable
129400x410	leshort		0x138f
12941!:strength / 2
12942>0x402	beshort		< 100
12943>0x402	beshort		> -1		Minix filesystem, V1, 30 char names, %d zones
12944>0x1e	string		minix		\b, bootable
129450x410	beshort		0x138f
12946!:strength / 2
12947>0x402	beshort		< 100
12948>0x402	beshort		> -1		Minix filesystem, V1, 30 char names (big endian), %d zones
12949>0x1e	string		minix		\b, bootable
12950# Weak Magic: this is $x
12951#0x410	leshort		0x2468
12952#>0x402	beshort		< 100
12953#>>0x402	beshort		> -1		Minix filesystem, V2, 14 char names
12954#>0x1e	string		minix		\b, bootable
12955#0x410	beshort		0x2468
12956#>0x402	beshort		< 100
12957#>0x402	beshort		> -1		Minix filesystem, V2 (big endian)
12958#>0x1e	string		minix		\b, bootable
12959#0x410	leshort		0x2478
12960#>0x402	beshort		< 100
12961#>0x402	beshort		> -1		Minix filesystem, V2, 30 char names
12962#>0x1e	string		minix		\b, bootable
12963#0x410	leshort		0x2478
12964#>0x402	beshort		< 100
12965#>0x402	beshort		> -1		Minix filesystem, V2, 30 char names
12966#>0x1e	string		minix		\b, bootable
12967#0x410	beshort		0x2478
12968#>0x402	beshort		!0		Minix filesystem, V2, 30 char names (big endian)
12969#>0x1e	string		minix		\b, bootable
12970# Weak Magic! this is MD
12971#0x418	leshort		0x4d5a
12972#>0x402	beshort		<100
12973#>>0x402	beshort		> -1		Minix filesystem, V3, 60 char names
12974
12975# SGI disk labels - Nathan Scott <nathans@debian.org>
129760	belong		0x0BE5A941	SGI disk label (volume header)
12977
12978# SGI XFS filesystem - Nathan Scott <nathans@debian.org>
129790	belong		0x58465342	SGI XFS filesystem data
12980>0x4	belong		x		(blksz %d,
12981>0x68	beshort		x		inosz %d,
12982>0x64	beshort		^0x2004		v1 dirs)
12983>0x64	beshort		&0x2004		v2 dirs)
12984
12985############################################################################
12986# Minix-ST kernel floppy
129870x800	belong		0x46fc2700	Atari-ST Minix kernel image
12988# https://en.wikipedia.org/wiki/BIOS_parameter_block
12989# floppies with valid BPB and any instruction at beginning
12990>19	string		\240\005\371\005\0\011\0\2\0	\b, 720k floppy
12991>19	string		\320\002\370\005\0\011\0\1\0	\b, 360k floppy
12992
12993############################################################################
12994# Hmmm, is this a better way of detecting _standard_ floppy images ?
1299519	string		\320\002\360\003\0\011\0\1\0	DOS floppy 360k
12996>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
1299719	string		\240\005\371\003\0\011\0\2\0	DOS floppy 720k
12998>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
1299919	string		\100\013\360\011\0\022\0\2\0	DOS floppy 1440k
13000>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
13001
1300219	string		\240\005\371\005\0\011\0\2\0	DOS floppy 720k, IBM
13003>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
1300419	string		\100\013\371\005\0\011\0\2\0	DOS floppy 1440k, mkdosfs
13005>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
13006
1300719	string		\320\002\370\005\0\011\0\1\0	Atari-ST floppy 360k
1300819	string		\240\005\371\005\0\011\0\2\0	Atari-ST floppy 720k
13009#			|       |   |     |     |
13010#			|       |   |     |     heads
13011#			|       |   |     sectors/track
13012#			|       |   sectors/FAT
13013#			|       media descriptor
13014#		BPB:	sectors
13015
13016#  Valid media descriptor bytes for MS-DOS:
13017#
13018#     Byte   Capacity   Media Size and Type
13019#     -------------------------------------------------
13020#
13021#     F0     2.88 MB    3.5-inch, 2-sided, 36-sector
13022#     F0     1.44 MB    3.5-inch, 2-sided, 18-sector
13023#     F9     720K       3.5-inch, 2-sided, 9-sector
13024#     F9     1.2 MB     5.25-inch, 2-sided, 15-sector
13025#     FD     360K       5.25-inch, 2-sided, 9-sector
13026#     FF     320K       5.25-inch, 2-sided, 8-sector
13027#     FC     180K       5.25-inch, 1-sided, 9-sector
13028#     FE     160K       5.25-inch, 1-sided, 8-sector
13029#     FE     250K       8-inch, 1-sided, single-density
13030#     FD     500K       8-inch, 2-sided, single-density
13031#     FE     1.2 MB     8-inch, 2-sided, double-density
13032#     F8     -----      Fixed disk
13033#
13034#     FC     xxxK       Apricot 70x1x9 boot disk.
13035#
13036# Originally a bitmap:
13037#  xxxxxxx0	Not two sided
13038#  xxxxxxx1	Double sided
13039#  xxxxxx0x	Not 8 SPT
13040#  xxxxxx1x	8 SPT
13041#  xxxxx0xx	Not Removable drive
13042#  xxxxx1xx	Removable drive
13043#  11111xxx	Must be one.
13044#
13045# But now it's rather random:
13046#  111111xx	Low density disk
13047#        00	SS, Not 8 SPT
13048#        01	DS, Not 8 SPT
13049#        10	SS, 8 SPT
13050#        11	DS, 8 SPT
13051#
13052#  11111001	Double density 3 1/2 floppy disk, high density 5 1/4
13053#  11110000	High density 3 1/2 floppy disk
13054#  11111000	Hard disk any format
13055#
13056
13057# all FAT12 (strength=70) floppies with sectorsize 512 added by Joerg Jenderek at Jun 2013
13058# https://en.wikipedia.org/wiki/File_Allocation_Table#Exceptions
13059# Too Weak.
13060#512		ubelong&0xE0ffff00	0xE0ffff00
13061# without valid Media descriptor in place of BPB, cases with are done at other places
13062#>21		ubyte			<0xE5			floppy with old FAT filesystem
13063# but valid Media descriptor at begin of FAT
13064#>>512		ubyte			=0xed			720k
13065#>>512		ubyte			=0xf0			1440k
13066#>>512		ubyte			=0xf8			720k
13067#>>512		ubyte			=0xf9			1220k
13068#>>512		ubyte			=0xfa			320k
13069#>>512		ubyte			=0xfb			640k
13070#>>512		ubyte			=0xfc			180k
13071# look like an old DOS directory entry
13072#>>>0xA0E	ubequad			0
13073#>>>>0xA00	ubequad			!0
13074#!:mime application/x-ima
13075#>>512		ubyte			=0xfd
13076# look for 2nd FAT at different location to distinguish between 360k and 500k
13077#>>>0x600	ubelong&0xE0ffff00	0xE0ffff00		360k
13078#>>>0x500	ubelong&0xE0ffff00	0xE0ffff00		500k
13079#>>>0xA0E	ubequad			0
13080#!:mime application/x-ima
13081#>>512		ubyte			=0xfe
13082#>>>0x400	ubelong&0xE0ffff00	0xE0ffff00		160k
13083#>>>>0x60E	ubequad			0
13084#>>>>>0x600	ubequad			!0
13085#!:mime application/x-ima
13086#>>>0xC00	ubelong&0xE0ffff00	0xE0ffff00		1200k
13087#>>512		ubyte			=0xff			320k
13088#>>>0x60E	ubequad			0
13089#>>>>0x600	ubequad			!0
13090#!:mime application/x-ima
13091#>>512		ubyte			x			\b, Media descriptor 0x%x
13092# without x86 jump instruction
13093#>>0		ulelong&0x804000E9	!0x000000E9
13094# assembler instructions: CLI;MOV SP,1E7;MOV AX;07c0;MOV
13095#>>>0	ubequad				0xfabce701b8c0078e	\b, MS-DOS 1.12 bootloader
13096# IOSYS.COM+MSDOS.COM
13097#>>>>0xc4	use			2xDOS-filename
13098#>>0		ulelong&0x804000E9	=0x000000E9
13099# only x86 short jump instruction found
13100#>>>0		ubyte			=0xEB
13101#>>>>1		ubyte			x			\b, code offset 0x%x+2
13102# https://thestarman.pcministry.com/DOS/ibm100/Boot.htm
13103# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;MOV DX,0
13104#>>>>(1.b+2)	ubequad			0xfa8cc88ed8ba0000	\b, PC-DOS 1.0 bootloader
13105# ibmbio.com+ibmdos.com
13106#>>>>>0x176	use			DOS-filename
13107#>>>>>0x181	ubyte			x			\b+
13108#>>>>>0x182	use			DOS-filename
13109# https://thestarman.pcministry.com/DOS/ibm110/Boot.htm
13110# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;XOR DX,DX;MOV
13111#>>>>(1.b+2)	ubequad			0xfa8cc88ed833d28e	\b, PC-DOS 1.1 bootloader
13112# ibmbio.com+ibmdos.com
13113#>>>>>0x18b	use			DOS-filename
13114#>>>>>0x196	ubyte			x			\b+
13115#>>>>>0x197	use			DOS-filename
13116# https://en.wikipedia.org/wiki/Zenith_Data_Systems
13117# assembler instructions: MOV BX,07c0;MOV SS,BX;MOV SP,01c6
13118#>>>>(1.b+2)	ubequad			0xbbc0078ed3bcc601	\b, Zenith Data Systems MS-DOS 1.25 bootloader
13119# IO.SYS+MSDOS.SYS
13120#>>>>>0x20	use			2xDOS-filename
13121# https://en.wikipedia.org/wiki/Corona_Data_Systems
13122# assembler instructions: MOV AX,CS;MOV DS,AX;CLI;MOV SS,AX;
13123#>>>>(1.b+2)	ubequad			0x8cc88ed8fa8ed0bc	\b, MS-DOS 1.25 bootloader
13124# IO.SYS+MSDOS.SYS
13125#>>>>>0x69	use			2xDOS-filename
13126# assembler instructions: CLI;PUSH CS;POP SS;MOV SP,7c00;
13127#>>>>(1.b+2)	ubequad			0xfa0e17bc007cb860	\b, MS-DOS 2.11 bootloader
13128# defect IO.SYS+MSDOS.SYS ?
13129#>>>>>0x162	use			2xDOS-filename
13130
131310	name				cdrom
13132>38913	string   !NSR0      ISO 9660 CD-ROM filesystem data
13133!:mime	application/x-iso9660-image
13134!:ext	iso/iso9660
13135>38913	string    NSR0      UDF filesystem data
13136!:mime	application/x-iso9660-image
13137!:ext	iso/udf
13138>>38917	string    1         (version 1.0)
13139>>38917	string    2         (version 1.5)
13140>>38917	string    3         (version 2.0)
13141>>38917	byte     >0x33      (unknown version, ID 0x%X)
13142>>38917	byte     <0x31      (unknown version, ID 0x%X)
13143# The next line is not necessary because the MBR staff is done looking for boot signature
13144>0x1FE	leshort  0xAA55     (DOS/MBR boot sector)
13145# "application id" which appears to be used as a volume label
13146>32808	string/T  >\0       '%.32s'
13147>34816	string    \000CD001\001EL\ TORITO\ SPECIFICATION    (bootable)
1314837633	string    CD001     ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
13149!:mime	application/x-iso9660-image
1315032777	string    CDROM     High Sierra CD-ROM filesystem data
13151# "application id" which appears to be used as a volume label
13152>32816	string/T  >\0       '%.32s'
13153
13154
13155# CDROM Filesystems
13156# https://en.wikipedia.org/wiki/ISO_9660
13157# Modified for UDF by gerardo.cacciari@gmail.com
1315832769	string    CD001
13159# mime line at that position does not work
13160# to display CD-ROM (70=81-11) after MBR (113=40+72+1), partition-table (71=50+21) and before Apple Driver Map (51)
13161#!:strength -11
13162# to display CD-ROM (114=81+33) before MBR (113=40+72+1), partition-table (71=50+21) and Apple Driver Map (51)
13163!:strength +35
13164>0	use	cdrom
13165
13166# URL: https://en.wikipedia.org/wiki/NRG_(file_format)
13167# Reference: https://dl.opendesktop.org/api/files/download/id/1460731811/
13168#	11577-mount-iso-0.9.5.tar.bz2/mount-iso-0.9.5/install.sh
13169# From: Joerg Jenderek
13170# Note:	Only for nero disc with once (DAO) type after 300 KB header
13171339969	string    CD001	Nero CD image at 0x4B000
13172!:mime	application/x-nrg
13173!:ext	nrg
13174>307200	use cdrom
13175
13176# .cso files
13177# Reference: https://pismotec.com/ciso/ciso.h
13178# NOTE: There are two other formats with the same magic but
13179# completely incompatible specifications:
13180# - GameCube/Wii CISO: https://github.com/dolphin-emu/dolphin/blob/master/Source/Core/DiscIO/CISOBlob.h
13181# - PSP CISO: https://github.com/jamie/ciso/blob/master/ciso.h
131820    string    CISO
13183# Other fields are used to determine what type of CISO this is:
13184# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size)
13185# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size)
13186# - 0x10 == 0x00004000: For >2GB files using maxcso...
13187# 			https://github.com/unknownbrackets/maxcso/issues/26
13188# - None of the above: Compact ISO.
13189>4	lelong	!0
13190>>4	lelong	!0x200000
13191>>>16	lelong	!0x800
13192>>>>16	lelong	!0x4000		Compressed ISO CD image
13193
13194# cramfs filesystem - russell@coker.com.au
131950       lelong    0x28cd3d45      Linux Compressed ROM File System data, little endian
13196>4      lelong  x size %u
13197>8      lelong  &1 version #2
13198>8      lelong  &2 sorted_dirs
13199>8      lelong  &4 hole_support
13200>32     lelong  x CRC 0x%x,
13201>36     lelong  x edition %u,
13202>40     lelong  x %u blocks,
13203>44     lelong  x %u files
13204
132050       belong    0x28cd3d45      Linux Compressed ROM File System data, big endian
13206>4      belong  x size %u
13207>8      belong  &1 version #2
13208>8      belong  &2 sorted_dirs
13209>8      belong  &4 hole_support
13210>32     belong  x CRC 0x%x,
13211>36     belong  x edition %u,
13212>40     belong  x %u blocks,
13213>44     belong  x %u files
13214
13215# reiserfs - russell@coker.com.au
132160x10034		string	ReIsErFs	ReiserFS V3.5
132170x10034		string	ReIsEr2Fs	ReiserFS V3.6
132180x10034		string	ReIsEr3Fs	ReiserFS V3.6.19
13219>0x1002c 	leshort	x		block size %d
13220>0x10032	leshort	&2		(mounted or unclean)
13221>0x10000	lelong	x		num blocks %d
13222>0x10040	lelong	1		tea hash
13223>0x10040	lelong	2		yura hash
13224>0x10040	lelong	3		r5 hash
13225
13226# EST flat binary format (which isn't, but anyway)
13227# From: Mark Brown <broonie@sirena.org.uk>
132280	string	ESTFBINR	EST flat binary
13229
13230# Aculab VoIP firmware
13231# From: Mark Brown <broonie@sirena.org.uk>
132320	string	VoIP\ Startup\ and	Aculab VoIP firmware
13233>35	string	x	format %s
13234
13235# From: Mark Brown <broonie@sirena.org.uk> [old]
13236# From: Behan Webster <behanw@websterwood.com>
132370	belong	0x27051956	u-boot legacy uImage,
13238>32	string	x		%s,
13239>28	byte	0		Invalid os/
13240>28	byte	1		OpenBSD/
13241>28	byte	2		NetBSD/
13242>28	byte	3		FreeBSD/
13243>28	byte	4		4.4BSD/
13244>28	byte	5		Linux/
13245>28	byte	6		SVR4/
13246>28	byte	7		Esix/
13247>28	byte	8		Solaris/
13248>28	byte	9		Irix/
13249>28	byte	10		SCO/
13250>28	byte	11		Dell/
13251>28	byte	12		NCR/
13252>28	byte	13		LynxOS/
13253>28	byte	14		VxWorks/
13254>28	byte	15		pSOS/
13255>28	byte	16		QNX/
13256>28	byte	17		Firmware/
13257>28	byte	18		RTEMS/
13258>28	byte	19		ARTOS/
13259>28	byte	20		Unity OS/
13260>28	byte	21		INTEGRITY/
13261>29	byte	0		\bInvalid CPU,
13262>29	byte	1		\bAlpha,
13263>29	byte	2		\bARM,
13264>29	byte	3		\bIntel x86,
13265>29	byte	4		\bIA64,
13266>29	byte	5		\bMIPS,
13267>29	byte	6		\bMIPS 64-bit,
13268>29	byte	7		\bPowerPC,
13269>29	byte	8		\bIBM S390,
13270>29	byte	9		\bSuperH,
13271>29	byte	10		\bSparc,
13272>29	byte	11		\bSparc 64-bit,
13273>29	byte	12		\bM68K,
13274>29	byte	13		\bNios-32,
13275>29	byte	14		\bMicroBlaze,
13276>29	byte	15		\bNios-II,
13277>29	byte	16		\bBlackfin,
13278>29	byte	17		\bAVR32,
13279>29	byte	18		\bSTMicroelectronics ST200,
13280>29	byte	19		\bSandbox architecture,
13281>29	byte	20		\bANDES Technology NDS32,
13282>29	byte	21		\bOpenRISC 1000,
13283>29	byte	22		\bARM 64-bit,
13284>29	byte	23		\bDesignWare ARC,
13285>29	byte	24		\bx86_64,
13286>29	byte	25		\bXtensa,
13287>29	byte	26		\bRISC-V,
13288>30	byte	0		Invalid Image
13289>30	byte	1		Standalone Program
13290>30	byte	2		OS Kernel Image
13291>30	byte	3		RAMDisk Image
13292>30	byte	4		Multi-File Image
13293>30	byte	5		Firmware Image
13294>30	byte	6		Script File
13295>30	byte	7		Filesystem Image (any type)
13296>30	byte	8		Binary Flat Device Tree BLOB
13297>31	byte	0		(Not compressed),
13298>31	byte	1		(gzip),
13299>31	byte	2		(bzip2),
13300>31	byte	3		(lzma),
13301>12	belong	x		%d bytes,
13302>8	bedate	x		%s,
13303>16	belong	x		Load Address: 0x%08X,
13304>20	belong	x		Entry Point: 0x%08X,
13305>4	belong	x		Header CRC: 0x%08X,
13306>24	belong	x		Data CRC: 0x%08X
13307
13308# JFFS2 file system
133090	leshort	0x1984		Linux old jffs2 filesystem data little endian
133100	beshort	0x1984		Linux old jffs2 filesystem data big endian
133110	leshort	0x1985		Linux jffs2 filesystem data little endian
133120	beshort	0x1985		Linux jffs2 filesystem data big endian
13313
13314# Squashfs
133150	name	squashfs
13316>28	beshort	x	version %d.
13317>30	beshort	x	\b%d,
13318>20	beshort 0	uncompressed,
13319>20	beshort 1	zlib
13320>20	beshort 2	lzma
13321>20	beshort 3	lzo
13322>20	beshort 4	xz
13323>20	beshort 5	lz4
13324>20	beshort 6	zstd
13325>20	beshort >0	compressed,
13326>28	beshort <3
13327>>8	belong	x	%d bytes,
13328>28	beshort >2
13329>>28	beshort <4
13330>>>63	bequad x	%lld bytes,
13331>>28	beshort >3
13332>>>40	bequad x	%lld bytes,
13333#>>67	belong	x	%d bytes,
13334>4	belong	x	%d inodes,
13335>28	beshort <2
13336>>32	beshort	x	blocksize: %d bytes,
13337>28	beshort >1
13338>>28	beshort <4
13339>>>51	belong	x	blocksize: %d bytes,
13340>>28	beshort >3
13341>>>12	belong	x	blocksize: %d bytes,
13342>28	beshort <4
13343>>39	bedate	x	created: %s
13344>28	beshort >3
13345>>8	bedate	x	created: %s
13346
133470	string	sqsh	Squashfs filesystem, big endian,
13348>0	use	squashfs
13349
133500	string	hsqs	Squashfs filesystem, little endian,
13351>0	use	\^squashfs
13352
13353# AFS Dump Magic
13354# From: Ty Sarna <tsarna@sarna.org>
133550       string                  \x01\xb3\xa1\x13\x22    AFS Dump
13356>&0     belong                  x                       (v%d)
13357>>&0    byte                    0x76
13358>>>&0   belong                  x                       Vol %d,
13359>>>>&0  byte                    0x6e
13360>>>>>&0 string                  x                       %s
13361>>>>>>&1        byte            0x74
13362>>>>>>>&0       beshort         2
13363>>>>>>>>&4      bedate          x                       on: %s
13364>>>>>>>>&0      bedate          =0                      full dump
13365>>>>>>>>&0      bedate          !0                      incremental since: %s
13366
13367#----------------------------------------------------------
13368#delta ISO    Daniel Novotny (dnovotny@redhat.com)
133690	string  DISO	Delta ISO data
13370!:strength +50
13371>4	belong  x	version %d
13372
13373# VMS backup savesets - gerardo.cacciari@gmail.com
13374#
133754            string  \x01\x00\x01\x00\x01\x00
13376>(0.s+16)    string  \x01\x01
13377>>&(&0.b+8)  byte    0x42       OpenVMS backup saveset data
13378>>>40        lelong  x          (block size %d,
13379>>>49        string  >\0        original name '%s',
13380>>>2         short   1024       VAX generated)
13381>>>2         short   2048       AXP generated)
13382>>>2         short   4096       I64 generated)
13383
13384# Summary: Oracle Clustered Filesystem
13385# Created by: Aaron Botsis <redhat@digitalmafia.org>
133868	string		OracleCFS	Oracle Clustered Filesystem,
13387>4	long		x		rev %d
13388>0	long		x		\b.%d,
13389>560	string		x		label: %.64s,
13390>136	string		x		mountpoint: %.128s
13391
13392# Summary: Oracle ASM tagged volume
13393# Created by: Aaron Botsis <redhat@digitalmafia.org>
1339432	string		ORCLDISK	Oracle ASM Volume,
13395>40	string		x		Disk Name: %0.12s
1339632	string		ORCLCLRD	Oracle ASM Volume (cleared),
13397>40	string		x		Disk Name: %0.12s
13398
13399# Oracle Clustered Filesystem - Aaron Botsis <redhat@digitalmafia.org>
134008	string		OracleCFS	Oracle Clustered Filesystem,
13401>4	long		x		rev %d
13402>0	long		x		\b.%d,
13403>560	string		x		label: %.64s,
13404>136	string		x		mountpoint: %.128s
13405
13406# Oracle ASM tagged volume - Aaron Botsis <redhat@digitalmafia.org>
1340732	string		ORCLDISK	Oracle ASM Volume,
13408>40	string		x		Disk Name: %0.12s
1340932	string		ORCLCLRD	Oracle ASM Volume (cleared),
13410>40	string		x		Disk Name: %0.12s
13411
13412# Compaq/HP RILOE floppy image
13413# From: Dirk Jagdmann <doj@cubic.org>
134140	string	CPQRFBLO	Compaq/HP RILOE floppy image
13415
13416#------------------------------------------------------------------------------
13417# Files-11 On-Disk Structure (File system for various RSX-11 and VMS flavours).
13418# These bits come from LBN 1 (home block) of ODS-1, ODS-2 and ODS-5 volumes,
13419# which is mapped to VBN 2 of [000000]INDEXF.SYS;1 - gerardo.cacciari@gmail.com
13420#
134211008    string          DECFILE11       Files-11 On-Disk Structure
13422>525    byte            x               (ODS-%d);
13423>1017   string          A               RSX-11, VAX/VMS or OpenVMS VAX file system;
13424>1017   string          B
13425>>525   byte            2               VAX/VMS or OpenVMS file system;
13426>>525   byte            5               OpenVMS Alpha or Itanium file system;
13427>984    string          x               volume label is '%-12.12s'
13428
13429# From: Thomas Klausner <wiz@NetBSD.org>
13430# https://filext.com/file-extension/DAA
13431# describes the daa file format. The magic would be:
134320	string		DAA\x0\x0\x0\x0\x0	PowerISO Direct-Access-Archive
13433
13434# From Albert Cahalan <acahalan@gmail.com>
13435# really le32 operation,destination,payloadsize (but quite predictable)
13436# 01 00 00 00 00 00 00 c0 00 02 00 00
134370	string		\1\0\0\0\0\0\0\300\0\2\0\0	Marvell Libertas firmware
13438
13439# From Eric Sandeen
13440# GFS2
134410x10000         belong          0x01161970
13442>0x10018        belong          0x0000051d      GFS1 Filesystem
13443>>0x10024        belong          x               (blocksize %d,
13444>>0x10060        string          >\0             lockproto %s)
13445>0x10018        belong          0x00000709      GFS2 Filesystem
13446>>0x10024        belong          x               (blocksize %d,
13447>>0x10060        string          >\0             lockproto %s)
13448
13449# Russell Coker <russell@coker.com.au>
134500x10040		string	_BHRfS_M	BTRFS Filesystem
13451>0x1012b	string	>\0		label "%s",
13452>0x10090	lelong	x		sectorsize %d,
13453>0x10094	lelong	x		nodesize %d,
13454>0x10098	lelong	x		leafsize %d,
13455>0x10020	belong	x		UUID=%08x-
13456>0x10024	beshort	x		\b%04x-
13457>0x10026	beshort	x		\b%04x-
13458>0x10028	beshort	x		\b%04x-
13459>0x1002a	beshort	x		\b%04x
13460>0x1002c	belong	x		\b%08x,
13461>0x10078	lequad	x		%lld/
13462>0x10070	lequad	x		\b%lld bytes used,
13463>0x10088	lequad	x		%lld devices
13464
13465# dvdisaster's .ecc
13466# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
134670	string	*dvdisaster*	dvdisaster error correction file
13468
13469# xfs metadump image
13470# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
13471# but can we do the << ?  For now it's always 512 (0x200) anyway.
134720	string XFSM
13473>0x200	string XFSB	XFS filesystem metadump image
13474
13475# Type:	CROM filesystem
13476# From:	Werner Fink <werner@suse.de>
134770	string	CROMFS	CROMFS
13478>6	string	>\0	\b version %2.2s,
13479>8	ulequad	>0	\b block data at %lld,
13480>16	ulequad	>0	\b fblock table at %lld,
13481>24	ulequad	>0	\b inode table at %lld,
13482>32	ulequad	>0	\b root at %lld,
13483>40	ulelong	>0	\b fblock size = %d,
13484>44	ulelong	>0	\b block size = %d,
13485>48	ulequad	>0	\b bytes = %lld
13486
13487# Type:	xfs metadump image
13488# From:	Daniel Novotny <dnovotny@redhat.com>
13489# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
13490# but can we do the << ? For now it's always 512 (0x200) anyway.
134910	string	XFSM
13492>0x200	string	XFSB	XFS filesystem metadump image
13493
13494# Type:	delta ISO
13495# From:	Daniel Novotny <dnovotny@redhat.com>
134960	string	DISO	Delta ISO data,
13497>4	belong	x	version %d
13498
13499# JFS2 (Journaling File System) image. (Old JFS1 has superblock at 0x1000.)
13500# See linux/fs/jfs/jfs_superblock.h for layout; see jfs_filsys.h for flags.
13501# From: Adam Buchbinder <adam.buchbinder@gmail.com>
135020x8000	string	JFS1
13503# Because it's text-only magic, check a binary value (version) to be sure.
13504# Should always be 2, but mkfs.jfs writes it as 1. Needs to be 2 or 1 to be
13505# mountable.
13506>&0	lelong	<3	JFS2 filesystem image
13507# Label is followed by a UUID; we have to limit string length to avoid
13508# appending the UUID in the case of a 16-byte label.
13509>>&144	regex	[\x20-\x7E]{1,16}	(label "%s")
13510>>&0	lequad	x	\b, %lld blocks
13511>>&8	lelong	x	\b, blocksize %d
13512>>&32	lelong&0x00000006	>0	(dirty)
13513>>&36	lelong	>0	(compressed)
13514
13515# LFS
135160	lelong	0x070162	LFS filesystem image
13517>4	lelong	1		version 1,
13518>>8	lelong	x		\b blocks %u,
13519>>12	lelong	x		\b blocks per segment %u,
13520>4	lelong	2		version 2,
13521>>8	lelong	x		\b fragments %u,
13522>>12	lelong	x		\b bytes per segment %u,
13523>16	lelong	x		\b disk blocks %u,
13524>20	lelong	x		\b block size %u,
13525>24	lelong	x		\b fragment size %u,
13526>28	lelong	x		\b fragments per block %u,
13527>32	lelong	x		\b start for free list %u,
13528>36	lelong	x		\b number of free blocks %d,
13529>40	lelong	x		\b number of files %u,
13530>44	lelong	x		\b blocks available for writing %d,
13531>48	lelong	x		\b inodes in cache %d,
13532>52	lelong	x		\b inode file disk address 0x%x,
13533>56	lelong	x		\b inode file inode number %u,
13534>60	lelong	x		\b address of last segment written 0x%x,
13535>64	lelong	x		\b address of next segment to write 0x%x,
13536>68	lelong	x		\b address of current segment written 0x%x
13537
135380	string	td\000		floppy image data (TeleDisk, compressed)
135390	string	TD\000		floppy image data (TeleDisk)
13540
135410	string	CQ\024		floppy image data (CopyQM,
13542>16	leshort	x		%d sectors,
13543>18	leshort	x		%d heads.)
13544
135450	string	ACT\020Apricot\020disk\020image\032\004	floppy image data (ApriDisk)
13546
135470	beshort	0xAA58		floppy image data (IBM SaveDskF, old)
135480	beshort	0xAA59		floppy image data (IBM SaveDskF)
135490	beshort	0xAA5A		floppy image data (IBM SaveDskF, compressed)
13550
135510	string	\074CPM_Disk\076	disk image data (YAZE)
13552
13553# ReFS
13554# Richard W.M. Jones <rjones@redhat.com>
135550	string	\0\0\0ReFS\0	ReFS filesystem image
13556
13557# EFW encase image file format:
13558# Gregoire Passault
13559# http://www.forensicswiki.org/wiki/Encase_image_file_format
135600	string	EVF\x09\x0d\x0a\xff\x00	EWF/Expert Witness/EnCase image file format
13561
13562# UBIfs
13563# Linux kernel sources: fs/ubifs/ubifs-media.h
135640	lelong	0x06101831
13565>0x16	leshort	0		UBIfs image
13566>0x08	lequad	x		\b, sequence number %llu
13567>0x10	leshort x		\b, length %u
13568>0x04	lelong	x		\b, CRC 0x%08x
13569
135700	lelong	0x23494255
13571>0x04	leshort	<2
13572>0x05	string	\0\0\0
13573>0x1c	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
13574>0x04	leshort	x		UBI image, version %u
13575
13576# NEC PC-88 2D disk image
13577# From Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
135780x20		ulelong&0xFFFFFEFF	0x2A0
13579>0x10		string			\0\0\0\0\0\0\0\0\0\0
13580>>0x280		string			\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
13581>>>0x1A		ubyte&0xEF		0
13582>>>>0x1B	ubyte&0x8F		0
13583>>>>>0x1B	ubyte&70		<0x40
13584>>>>>>0x1C	ulelong			>0x21
13585>>>>>>>0	regex	[[:print:]]*	NEC PC-88 disk image, name=%s
13586>>>>>>>>0x1B	ubyte	0		\b, media=2D
13587>>>>>>>>0x1B	ubyte	0x10		\b, media=2DD
13588>>>>>>>>0x1B	ubyte	0x20		\b, media=2HD
13589>>>>>>>>0x1B	ubyte	0x30		\b, media=1D
13590>>>>>>>>0x1B	ubyte	0x40		\b, media=1DD
13591>>>>>>>>0x1A	ubyte	0x10		\b, write-protected
13592
13593# HDD Raw Copy Tool disk image, file extension: .imgc
13594# From Benjamin Vanheuverzwijn <bvanheu@gmail.com>
135950	pstring	HDD\ Raw\ Copy\ Tool	%s
13596>0x100	pstring	x			%s
13597>0x200	pstring	x			- HD model: %s
13598#>0x300	pstring	x			unknown %s
13599>0x400	pstring	x			serial: %s
13600#>0x500	pstring	x			unknown: %s
13601!:ext	imgc
13602
13603# http://martin.hinner.info/fs/bfs/bfs-structure.html
136040	lelong	0x1BADFACE		SCO UnixWare BFS filesystem
13605
13606# https://arstechnica.com/information-technology/2018/07/the-beos-filesystem/
1360732	lelong	0x42465331		BE/OS BFS1 filesystem
13608>36	lelong	x			\b, byte order %d
13609>40	lelong	x			\b, block size %d
13610>44	lelong	x			\b, block shift %d
13611>48	lequad	x			\b, total blocks %lld
13612>56	lequad	x			\b, used blocks %lld
13613
13614
136150	name next
13616>0	lelong	x			\b, size %d
13617>4	string	x			\b, label %s
13618
13619# https://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-44.3\
13620# /IONeXTPartitionScheme.h
136210	string	NeXT			NeXT version 1 disklabel
13622>12	use next
136230	string	dlV1			NeXT version 2 disklabel
13624>12	use next
136250	string	dlV2			NeXT version 3 disklabel
13626>12	use next
13627
13628#------------------------------------------------------------------------------
13629# $File: finger,v 1.3 2019/04/19 00:42:27 christos Exp $
13630# fingerprint:  file(1) magic for fingerprint data
13631# XPM bitmaps)
13632#
13633
13634# https://cgit.freedesktop.org/libfprint/libfprint/tree/libfprint/data.c
13635
136360	string	FP1		libfprint fingerprint data V1
13637>3	beshort	x		\b, driver_id %x
13638>5	belong	x		\b, devtype %x
13639
136400	string	FP2		libfprint fingerprint data V2
13641>3	beshort	x		\b, driver_id %x
13642>5	belong	x		\b, devtype %x
13643
13644#------------------------------------------------------------------------------
13645# $File: flash,v 1.15 2019/04/19 00:42:27 christos Exp $
13646# flash:	file(1) magic for Macromedia Flash file format
13647#
13648# See
13649#
13650#	https://www.macromedia.com/software/flash/open/
13651#	https://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/\
13652#	en/devnet/swf/pdf/swf-file-format-spec.pdf page 27
13653#
13654
136550   name	swf-details
13656
13657>0	string		F
13658>>8	byte&0xfd	0x08		Macromedia Flash data
13659!:mime	application/x-shockwave-flash
13660>>>3	byte		x		\b, version %d
13661>>8	byte&0xfe	0x10		Macromedia Flash data
13662!:mime	application/x-shockwave-flash
13663>>>3	byte		x		\b, version %d
13664>>8	byte		0x18		Macromedia Flash data
13665!:mime	application/x-shockwave-flash
13666>>>3	byte		x		\b, version %d
13667>>8	beshort&0xff87	0x2000		Macromedia Flash data
13668!:mime	application/x-shockwave-flash
13669>>>3	byte		x		\b, version %d
13670>>8	beshort&0xffe0	0x3000		Macromedia Flash data
13671!:mime	application/x-shockwave-flash
13672>>>3	byte		x		\b, version %d
13673>>8	byte&0x7	0
13674>>>8	ubyte		>0x2f
13675>>>>9	ubyte		<0x20		Macromedia Flash data
13676!:mime	application/x-shockwave-flash
13677>>>>>3	byte		x		\b, version %d
13678
13679>0	string		C
13680>>8	byte		0x78		Macromedia Flash data (compressed)
13681!:mime	application/x-shockwave-flash
13682>>>3	byte		x		\b, version %d
13683
13684>0	string		Z
13685>>8	byte		0x5d		Macromedia Flash data (lzma compressed)
13686!:mime	application/x-shockwave-flash
13687>>>3	byte		x		\b, version %d
13688
13689
136901	string		WS
13691>4	ulelong		>14
13692>>3	ubyte		!0
13693>>>0	use		swf-details
13694
13695# From: Cal Peake <cp@absolutedigital.net>
136960	string		FLV\x01		Macromedia Flash Video
13697!:mime	video/x-flv
13698
13699#
13700# Yosu Gomez
137010	string	AGD2\xbe\xb8\xbb\xcd\x00	Macromedia Freehand 7 Document
137020	string	AGD3\xbe\xb8\xbb\xcc\x00	Macromedia Freehand 8 Document
13703# From Dave Wilson
137040	string	AGD4\xbe\xb8\xbb\xcb\x00	Macromedia Freehand 9 Document
13705
13706#------------------------------------------------------------------------------
13707#	$File: flif,v 1.1 2015/11/23 22:04:36 christos Exp $
13708#	flif:	Magic	data	for	file(1)	command.
13709#	FLIF	(Free	Lossless	Image	Format)
13710
137110	string	FLIF	FLIF
13712>4	string	<H	image data
13713>>6	beshort	x	\b, %u
13714>>8	beshort	x	\bx%u
13715>>5	string	1	\b, 8-bit/color,
13716>>5	string	2	\b, 16-bit/color,
13717>>4	string	1	\b, grayscale, non-interlaced
13718>>4	string	3	\b, RGB, non-interlaced
13719>>4	string	4	\b, RGBA, non-interlaced
13720>>4	string	A	\b, grayscale
13721>>4	string	C	\b, RGB, interlaced
13722>>4	string	D	\b, RGBA, interlaced
13723>4	string	>H	\b, animation data
13724>>5	ubyte	<255	\b, %i frames
13725>>>7	beshort	x	\b, %u
13726>>>9	beshort	x	\bx%u
13727>>>6	string	=1	\b, 8-bit/color
13728>>>6	string	=2	\b, 16-bit/color
13729>>5	ubyte	0xFF
13730>>>6	beshort	x	\b, %i frames,
13731>>>9	beshort	x	\b, %u
13732>>>11	beshort	x	\bx%u
13733>>>8	string	=1	\b, 8-bit/color
13734>>>8	string	=2	\b, 16-bit/color
13735>>4	string	=Q	\b, grayscale, non-interlaced
13736>>4	string	=S	\b, RGB, non-interlaced
13737>>4	string	=T	\b, RGBA, non-interlaced
13738>>4	string	=a	\b, grayscale
13739>>4	string	=c	\b, RGB, interlaced
13740>>4	string	=d	\b, RGBA, interlaced
13741
13742#------------------------------------------------------------------------------
13743# $File: fonts,v 1.45 2021/01/03 21:00:11 christos Exp $
13744# fonts:  file(1) magic for font data
13745#
137460	search/1	FONT		ASCII vfont text
137470	short		0436		Berkeley vfont data
137480	short		017001		byte-swapped Berkeley vfont data
13749
13750# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com
137510	string		%!PS-AdobeFont-1.	PostScript Type 1 font text
13752>20	string		>\0			(%s)
137536	string		%!PS-AdobeFont-1.	PostScript Type 1 font program data
13754>26	string		>\0			(%s)
137550	string		%!FontType1	PostScript Type 1 font program data
137566	string		%!FontType1	PostScript Type 1 font program data
137570	string		%!PS-Adobe-3.0\ Resource-Font	PostScript Type 1 font text
13758
13759# Summary:	PostScript Type 1 Printer Font Metrics
13760# URL:		https://en.wikipedia.org/wiki/PostScript_fonts
13761# Reference:	https://partners.adobe.com/public/developer/en/font/5178.PFM.pdf
13762# Modified by:	Joerg Jenderek
13763# Note:		moved from ./msdos magic
13764# dfVersion 256=0100h
137650		uleshort	0x0100
13766# GRR: line above is too general as it catches also TrueType font,
13767# raw G3 data FAX, WhatsApp encrypted and Panorama database
13768# dfType 129=0081h
13769>66		uleshort	0x0081
13770# dfVertRes 300=012Ch not needed as additional test
13771#>>70		uleshort	0x012c
13772# dfHorizRes 300=012Ch
13773#>>>72		uleshort	0x012c
13774# dfDriverInfo points to postscript information section
13775>>(101.l)	string/c	Postscript	Printer Font Metrics
13776# above labeled "PFM data" by ./msdos (version 5.28) or "Adobe Printer Font Metrics" by TrID
13777!:mime	application/x-font-pfm
13778# AppleShare Print Server
13779#!:apple	ASPS????
13780!:ext	pfm
13781# dfCopyright 60 byte null padded Copyright string. uncomment it to get old looking
13782#>>>6		string		>\060		- %-.60s
13783# dfDriverInfo
13784>>>139		ulelong		>0
13785# often abbreviated and same as filename
13786>>>>(139.l)	string		x		%s
13787# dfSize
13788>>>2		ulelong		x		\b, %d bytes
13789# dfFace 210=D2h 9Eh
13790>>>105		ulelong		>0
13791# Windows font name
13792>>>>(105.l)	string		x		\b, %s
13793# dfItalic
13794>>>80		ubyte		1		italic
13795# dfUnderline
13796>>>81		ubyte		1		underline
13797# dfStrikeOut
13798>>>82		ubyte		1		strikeout
13799# dfWeight 400=0x0190 300=0x012c 500=0x01f4 600=0x0258 700=0x02bc
13800>>>83		uleshort	>699		bold
13801# dfPitchAndFamily 16 17 48 49 64 65
13802>>>90		ubyte		16		serif
13803>>>90		ubyte		17		serif proportional
13804#>>>90		ubyte		48		other
13805>>>90		ubyte		49		proportional
13806>>>90		ubyte		64		script
13807>>>90		ubyte		65		script proportional
13808
13809# X11 font files in SNF (Server Natural Format) format
13810# updated by Joerg Jenderek at Feb 2013
13811# http://computer-programming-forum.com/51-perl/8f22fb96d2e34bab.htm
138120	belong		00000004		X11 SNF font data, MSB first
13813#>104	belong		00000004		X11 SNF font data, MSB first
13814!:mime	application/x-font-sfn
13815# GRR: line below too general as it catches also Xbase index file t3-CHAR.NDX
138160	lelong		00000004
13817>104	lelong		00000004		X11 SNF font data, LSB first
13818!:mime	application/x-font-sfn
13819
13820# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com)
138210	search/1	STARTFONT\ 		X11 BDF font text
13822
13823# From: Joerg Jenderek
13824# URL: https://grub.gibibit.com/New_font_format
13825# Reference: util/grub-mkfont.c
13826#		include/grub/fontformat.h
13827# FONT_FORMAT_SECTION_NAMES_FILE
138280			string		FILE
13829# FONT_FORMAT_PFF2_MAGIC
13830>8			string		PFF2
13831# leng 4 only at the moment
13832>>4			ubelong		4
13833# FONT_FORMAT_SECTION_NAMES_FONT_NAME
13834>>>12			string		NAME		GRUB2 font
13835!:mime			application/x-font-pf2
13836!:ext			pf2
13837# length of font_name
13838>>>>16			ubelong		>0
13839# font_name
13840>>>>>20			string		>\0		"%-s"
13841
13842# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com)
13843# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides)
138440	string		\001fcp			X11 Portable Compiled Font data,
13845>12	lelong		^0x08			bit: LSB,
13846>12	lelong		&0x08			bit: MSB,
13847>12	lelong		^0x04			byte: LSB first
13848>12	lelong		&0x04			byte: MSB first
138490	string		D1.0\015		X11 Speedo font data
13850
13851#------------------------------------------------------------------------------
13852# FIGlet fonts and controlfiles
13853# From figmagic supplied with Figlet version 2.2
13854# "David E. O'Brien" <obrien@FreeBSD.ORG>
138550	string		flf		FIGlet font
13856>3	string		>2a		version %-2.2s
138570	string		flc		FIGlet controlfile
13858>3	string		>2a		version %-2.2s
13859
13860# libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu)
13861# Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++
138620	belong		0x14025919	libGrx font data,
13863>8	leshort		x		%dx
13864>10	leshort		x		\b%d
13865>40	string		x		%s
13866# Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu)
13867# Update:	Joerg Jenderek
13868# URL:		http://fileformats.archiveteam.org/wiki/CPI
13869# Reference:	http://www.delorie.com/djgpp/doc/rbinter/it/58/17.html
138700	belong		0xff464f4e	DOS code page font data collection
13871!:mime	font/x-dos-cpi
13872!:ext	cpi
138730	string		\x7fDRFONT	DR-DOS code page font data collection
13874!:mime	font/x-drdos-cpi
13875!:ext	cpi
138767	belong		0x00454741	DOS code page font data
138777	belong		0x00564944	DOS code page font data (from Linux?)
138784098	string		DOSFONT		DOSFONT2 encrypted font data
13879
13880# From: Joerg Jenderek
13881# URL: http://fileformats.archiveteam.org/wiki/GEM_bitmap_font
13882# Reference: http://cd.textfiles.com/ataricompendium/BOOK/HTML/APPENDC.HTM#cnt
13883#
13884# usual case with lightening mask and skewing mask 5555h~UU
13885#62	ulelong		0x55555555
13886# skip cl8m8ocofedso.testfile by looking for face size lower/equal 72
13887#>2	uleshort	<73
13888#>>0	use		gdos-font
13889# BOX18.GFT COWBOY30.GFT ROYALK30.GFT
13890#62	ulelong		0
13891# skip ISO 9660 CD-ROM ./filesystem by looking for low positive face size
13892#>2	uleshort	>2
13893# skip DOS 2.0 backup id file ./msdos by looking for face size lower/equal 72
13894#>>2	uleshort	<73
13895# skip MS oem.hlp, some Windows ICO ./msdos by looking for valid long name like WYE
13896#>>>4	ulelong		>0x001F1f1F
13897# skip Microsoft WinWord 2.0 ./msdos by looking for positive offset to font data
13898#>>>>76	ulelong		>83
13899#>>>>>0	use		gdos-font
139000	name		gdos-font
13901>0	uleshort	x		GEM GDOS font
13902!:mime	application/x-font-gdos
13903# also .eps found like AA070GEP.EPS AI360GEP.EPS
13904!:ext	fnt/gtf
13905# font name like Big&Tall, Celtic #s, Courier, University Bold, WYE
13906>4	string		x		%.32s
13907# face size in points 3-72 SLSS03CG.FNT H1CELT72.FNT
13908>2	uleshort	x		%u
13909# face ID (must be unique)
13910>0	uleshort	x		\b, ID 0x%4.4x
13911# lowest character index in face (4 but usually 32 for disk-loaded fonts)
13912#>36	uleshort	!32		\b, unusual character index %u
13913# width of the widest character like 0 8 10 12 16 24 32
13914#>50	uleshort	x		\b, %u char width
13915# width of the widest character cell like 8 11 12 14 15 16 33 67
13916#>52	uleshort	x		\b, %u cell width
13917# thickening size in pixel like 0 1 2 3 4 5 6 7 8
13918#>58	uleshort	x		\b, %u thick
13919# lightening mask to eliminate pixels, usually 5555h
13920>62	uleshort	!0x5555		\b, lightening mask 0x%x
13921# skewing mask to determine when to perform additional rotation when skewing, usually 5555h
13922>64	uleshort	!0x5555		\b, skewing mask 0x%x
13923# offset to optional horizontal offset table 0 58h~88 5eh 252h
13924#>68	ulelong		x		\b, 0x%x horizontal table offset
13925# offset of character offset table 54h for many *.GFT 55h 58h 5Eh 120h 1D4h 202h 220h
13926#>72	ulelong		x		\b, 0x%x coffset
13927# offset to font data like 116h 118h 158 20Ah 20Eh
13928>76	ulelong		x		\b, 0x%x foffset
13929# form width in bytes like 58 67 156 190 227 317 345
13930#>80	uleshort	x		\b, %u fwidth
13931# form height in bytes like 4 8 11 17 26 56 70 90 120 146 150
13932#>82	uleshort	x		\b, %u fheight
13933# pointer to the next font like 0 10000h 20000h 30000h 40000h 60000h 80000h E0000h D0000h
13934#>84	ulelong		x		\b, 0x%x noffset
13935
13936# downloadable fonts for browser (prints type) anthon@mnt.org
13937# https://tools.ietf.org/html/rfc3073
139380	string		PFR1		Portable Font Resource font data (new)
13939>102	string		>0		\b: %s
139400	string		PFR0		Portable Font Resource font data (old)
13941>4	beshort		>0		version %d
13942
13943# True Type fonts
13944# Modified by: Joerg Jenderek
13945# URL: https://en.wikipedia.org/wiki/TrueType
13946# Reference: https://developer.apple.com/fonts/TrueType-Reference-Manual/
13947#
13948# sfnt version "typ1" used by some Apple, but no example found
139490	string	typ1
13950>0	use		sfnt-font
13951>0	use		sfnt-names
13952# sfnt version "true" used by some Apple
139530	string	true
13954>0	use		sfnt-font
13955>0	use		sfnt-names
13956# GRR: below test is too general
13957# sfnt version often 0x00010000
139580	string	\000\001\000\000
13959>0	use		sfnt-font
13960>0	use		sfnt-names
13961#	validate and display sfnt font data like number of tables
139620	name		sfnt-font
13963# file 5.30 version assumes 00FFh as maximal number of tables
13964#>4	ubeshort	<0x0100
13965# maximal 27 tables found like in Skia.ttf
13966# 46 different table names mentioned on Apple specification
13967# skip 1st sequence of DOS 2 backup with path separator (\~92 or /~47) misinterpreted as table number
13968>4	ubeshort	<47
13969# skip bad examples with garbage table names like in a5.show HYPERC MAC
13970# tag names consist of up to four characters padded with spaces at end like
13971# BASE DSIG OS/2 Zapf acnt glyf cvt vmtx xref ...
13972>>12	regex/4l	\^[A-Za-z][A-Za-z][A-Za-z/][A-Za-z2\ ]
13973#>>>0	ubelong	x	\b, sfnt version 0x%x
13974>>>0	ubelong	!0x4f54544f	TrueType
13975!:mime	font/sfnt
13976!:apple	????tfil
13977# .ttf for TrueType font
13978# EUDC.tte created by privat character editor %WINDIR%\system32\eudcedit.exe
13979!:ext	ttf/tte
13980# sfnt version 4F54544Fh~OTTO
13981>>>0	ubelong	=0x4f54544f	OpenType
13982!:mime	font/otf
13983!:apple	????OTTO
13984!:ext	otf
13985>>>0	ubelong	x		Font data
13986# DSIG=44454947h table name implies a digitally signed font
13987# search range = number of tables * 16 =< maximal number of tables * 16 = 27 * 16 = 432
13988>>>12	search/432	DSIG		\b, digitally signed
13989>>>4	ubeshort	x		\b, %d tables
13990# minimal 9 tables found like in NISC18030.ttf
13991#>>>4	ubeshort	<10		TMIN
13992#>>>4	ubeshort	>24		TBIG
13993# table directory entries
13994>>>12	string		x		\b, 1st "%4.4s"
13995
13996#	search and display 1st name in sfnt font which is often copyright text
13997#	does not work inside font collections
139980	name		sfnt-names
13999# search for naming table
14000>12	search/432/s	name
14001# biggest offset 0x0100bd28 like Windows10 Fonts\simsunb.ttf
14002#>>>>&8	ubelong		>0x0100bd27	BIGGEST OFFSET
14003>>&8	ubelong		>0x00100000
14004# offset of name table
14005>>>&-4	ubelong		x		\b, name offset 0x%x
14006# GRR: pointer to name table only works if offset ~< FILE_BYTES_MAX = 100000h defined in src\file.h
14007>>&8	ubelong		<0x00100000
14008>>>&-16	ubelong		x
14009# name table
14010>>>>(&8.L)	ubequad	x
14011# invalid format selector
14012#>>>>>&-8	ubeshort	!0	\b, invalid selector %x
14013# minimal 3 name records found like in c:\Program Files (x86)\Tesseract-OCR\tessdata\pdf.ttf
14014# maximal 1227 name records found like in Apple Chancery.ttf
14015#>>>>>&-6	ubeshort	<0x4	mincount
14016#>>>>>&-6	ubeshort	>130	maxcount
14017>>>>>&-6	ubeshort	x	\b, %d names
14018# offset to start of string storage from start of table
14019#>>>>>&-4	ubeshort	x	\b, record offset %d
14020# 1st name record
14021# string offset from start of storage area
14022#>>>>>&8		ubeshort	x	\b, string offset %d
14023# string length
14024#>>>>>&6		ubeshort	x	\b, string length %d
14025# minimal name string 7 like in c:\Program Files (x86)\Kodi\addons\webinterface.default\lib\video-js\font\VideoJS.ttf
14026# also found 0 like in SWZCONLN.TTF
14027#>>>>>&6		ubeshort	<8	MIN STRING
14028# maximal name string 806 like in c:\Windows\Fonts\palabi.ttf
14029#>>>>>&6		ubeshort	>805	MAX STRING
14030# platform identifier: 0~Apple Unicode, 1~Macintosh, 3~Microsoft
14031#>>>>>&-2	ubeshort	>3	BAD PLATFORM
14032>>>>>&-2	ubeshort	0	\b, Unicode
14033>>>>>&-2	ubeshort	1	\b, Macintosh
14034>>>>>&-2	ubeshort	3	\b, Microsoft
14035# languageID (0~english Macintosh, 0409h~english Microsoft, ...)
14036>>>>>&2		ubeshort	>0	\b, language 0x%x
14037# name identifiers
14038# often 0~copyright, 1~font, 2~font subfamily, 5~version, 13~license, 19~sample, ...
14039>>>>>&4		ubeshort	>0	\b, type %d string
14040# platform specific encoding:
14041# 0~undefined character set, 1~UGL set with Unicode, 3~Unicode 2.0 BMP only, 4~Unicode 2.0
14042#>>>>>&0		ubeshort	x	\b, %d encoding
14043>>>>>&0		ubeshort	0
14044# handle only name string offset 0 because do not know how to add 2 relative offsets
14045>>>>>>&6		ubeshort	0
14046>>>>>>>&(&-14.S-18)	ubyte		!0
14047# GRR: instead 806 only first MAXstring = 96 characters are displayed as defined in src\file.h
14048# often copyright string that starts like \251 2006 The Monotype Corporation
14049>>>>>>>>&-1		string		x	\b, %-11.96s
14050# test for unicode string
14051>>>>>>>&(&-14.S-18)	ubyte		0
14052>>>>>>>>&0		lestring16	x	\b, %-11.96s
14053# unicode encoding
14054>>>>>&0		ubeshort	>0
14055>>>>>>&6		ubeshort	0
14056>>>>>>>&(&-14.S-17)	lestring16	x	\b, %-11.96s
14057
140580	string		\007\001\001\000Copyright\ (c)\ 199	Adobe Multiple Master font
140590	string		\012\001\001\000Copyright\ (c)\ 199	Adobe Multiple Master font
14060
14061# TrueType/OpenType font collections (.ttc)
14062# URL: https://en.wikipedia.org/wiki/OpenType
14063# https://www.microsoft.com/typography/otspec/otff.htm
14064# Modified by: Joerg Jenderek
14065# Note:	container for TrueType, OpenType font
140660	string		ttcf
14067# skip ASCII text
14068>4	ubyte		0
14069# sfnt version often 0x00010000 of 1st table is TrueType
14070>>(12.L)	ubelong	!0x4f54544f	TrueType
14071!:mime	font/ttf
14072!:apple	????tfil
14073!:ext	ttc
14074# sfnt version 4F54544Fh~OTTO of 1st table is OpenType font
14075>>(12.L)	ubelong	=0x4f54544f	OpenType
14076!:mime	font/otf
14077!:apple	????OTTO
14078# no example found for otc
14079!:ext	ttc/otc
14080>>4	ubyte		x		font collection data
14081#!:mime	font/collection
14082# TCC version
14083>>4	belong		0x00010000	\b, 1.0
14084>>4	belong		0x00020000	\b, 2.0
14085>>8	ubelong		>0		\b, %d fonts
14086# array offset size = fonts * offsetsize = fonts * 4
14087>>(8.L*4) ubequad	x
14088# 0x44454947 = 'DSIG'
14089>>>&4	belong		0x44534947	\b, digitally signed
14090# offset to 1st font
14091>>12	ubelong		x		\b, at 0x%x
14092# point to 1st font that starts with sfnt version
14093>>(12.L) use		sfnt-font
14094
14095# Opentype font data from Avi Bercovich
140960	string		OTTO		OpenType font data
14097!:mime application/vnd.ms-opentype
14098
14099# From: Alex Myczko <alex@aiei.ch>
141000	string		SplineFontDB:	Spline Font Database
14101!:mime application/vnd.font-fontforge-sfd
14102>14	string		x		version %s
14103
14104# EOT
141050x40	string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
14106>0x22	string		LP		Embedded OpenType (EOT)
14107# workaround until there's lepstring16
14108# >>0x52	lepstring16/h	>\0		\b, %s family
14109>>0x52	short	!0
14110>>>0x54	lestring16	x		\b, %s family
14111!:mime application/vnd.ms-fontobject
14112
14113# Web Open Font Format (.woff)
141140	name		woff
14115>4	belong		0x00010000	\b, TrueType
14116>4	belong		0x4F54544F	\b, CFF
14117>4	belong		0x74727565	\b, TrueType
14118>4	default		x
14119>>4	belong		x		\b, flavor %d
14120>8	belong		x		\b, length %d
14121#>12	beshort		x		\b, numTables %d
14122#>14	beshort		x		\b, reserved %d
14123#>16	belong		x		\b, totalSfntSize %d
14124
14125# https://www.w3.org/TR/WOFF/
141260	string		wOFF	Web Open Font Format
14127!:mime font/woff
14128>0	use		woff
14129>20	beshort		x	\b, version %d
14130>22	beshort		x	\b.%d
14131# https://www.w3.org/TR/WOFF2/
141320	string		wOF2	Web Open Font Format (Version 2)
14133!:mime font/woff2
14134>0	use		woff
14135#>20	belong		x	\b, totalCompressedSize %d
14136>24	beshort		x	\b, version %d
14137>26	beshort		x	\b.%d
14138
14139#------------------------------------------------------------------------------
14140# $File: forth,v 1.3 2020/12/12 20:01:47 christos Exp $
14141# forth:  file(1) magic for various Forth environments
14142# From: Lubomir Rintel <lkundrak@v3.sk>
14143#
14144
14145# Has a FORTH stack diagram and something that looks very much like a FORTH
14146# multi-line word definition. Probably a FORTH source.
141470       regex   \[[:space:]]\\(([[:space:]].*)?\ --\ (.*[[:space:]])?\\)
14148>0      regex   \^:\[[:space:]]
14149>>0     regex   \^;$				FORTH program
14150!:mime  text/x-forth
14151
14152# Inline word definition complete with a stack diagram
141530       regex   \^:[[:space:]].*[[:space:]]\\(([[:space:]].*)?\ --\ (.*[[:space:]])?\\)[[:space:]].*[[:space:]];$	FORTH program
14154!:mime  text/x-forth
14155
14156# Various dictionary images used by OpenFirware FORTH environment
14157
141580	lelong	0xe1a00000
14159>8	lelong	0xe1a00000
14160# skip raspberry pi kernel image kernel7.img by checking for positive text length
14161>>24	lelong	>0		ARM OpenFirmware FORTH Dictionary,
14162>>>24	lelong	x		Text length: %d bytes,
14163>>>28	lelong	x		Data length: %d bytes,
14164>>>32	lelong	x		Text Relocation Table length: %d bytes,
14165>>>36	lelong	x		Data Relocation Table length: %d bytes,
14166>>>40	lelong	x		Entry Point: 0x%08X,
14167>>>44	lelong	x		BSS length: %d bytes
14168
141690	string	MP
14170>28	lelong	1		x86 OpenFirmware FORTH Dictionary,
14171>>4	leshort	x		%d blocks
14172>>2	leshort	x		+ %d bytes,
14173>>6	leshort	x		%d relocations,
14174>>8	leshort	x		Header length: %d paragraphs,
14175>>10	leshort	x		Data Size: %d
14176>>12	leshort	x		- %d 4K pages,
14177>>14	lelong	x		Initial Stack Pointer: 0x%08X,
14178>>20	lelong	x		Entry Point: 0x%08X,
14179>>24	lelong	x		First Relocation Item: %d,
14180>>26	lelong	x		Overlay Number: %d,
14181>>18	leshort	x		Checksum: 0x%08X
14182
141830	belong	0x48000020	PowerPC OpenFirmware FORTH Dictionary,
14184>4	belong	x		Text length: %d bytes,
14185>8	belong	x		Data length: %d bytes,
14186>12	belong	x		BSS length: %d bytes,
14187>16	belong	x		Symbol Table length: %d bytes,
14188>20	belong	x		Entry Point: 0x%08X,
14189>24	belong	x		Text Relocation Table length: %d bytes,
14190>28	belong	x		Data Relocation Table length: %d bytes
14191
141920	lelong	0x10000007	MIPS OpenFirmware FORTH Dictionary,
14193>4	lelong	x		Text length: %d bytes,
14194>8	lelong	x		Data length: %d bytes,
14195>12	lelong	x		BSS length: %d bytes,
14196>16	lelong	x		Symbol Table length: %d bytes,
14197>20	lelong	x		Entry Point: 0x%08X,
14198>24	lelong	x		Text Relocation Table length: %d bytes,
14199>28	lelong	x		Data Relocation Table length: %d bytes
14200
14201# Dictionary images used by minimal C FORTH environments, any platform,
14202# using native byte order.
14203
14204# Weak.
14205#0	short	0x5820		cForth 16-bit Dictionary,
14206#>2	short	x		Serial: 0x%08X,
14207#>4	short	x		Dictionary Start: 0x%08X,
14208#>6	short	x		Dictionary Size: %d bytes,
14209#>8	short	x		User Area Start: 0x%08X,
14210#>10	short	x		User Area Size: %d bytes,
14211#>12	short	x		Entry Point: 0x%08X
14212
142130	long	0x581120	cForth 32-bit Dictionary,
14214>4	long	x		Serial: 0x%08X,
14215>8	long	x		Dictionary Start: 0x%08X,
14216>12	long	x		Dictionary Size: %d bytes,
14217>16	long	x		User Area Start: 0x%08X,
14218>20	long	x		User Area Size: %d bytes,
14219>24	long	x		Entry Point: 0x%08X
14220
14221#------------------------------------------------------------------------------
14222# $File: fortran,v 1.10 2015/11/05 18:47:16 christos Exp $
14223# FORTRAN source
14224# Check that the first 100 lines start with C or whitespace first.
142250       regex/100l      !\^[^Cc\ \t].*$
14226>0	regex/100l	\^[Cc][\ \t]	FORTRAN program text
14227!:mime	text/x-fortran
14228!:strength - 5
14229
14230#------------------------------------------------------------------------------
14231# $File: frame,v 1.14 2019/11/25 00:31:30 christos Exp $
14232# frame:  file(1) magic for FrameMaker files
14233#
14234# This stuff came on a FrameMaker demo tape, most of which is
14235# copyright, but this file is "published" as witness the following:
14236#
14237# Note that this is the Framemaker Maker Interchange Format, not the
14238# Normal format which would be application/vnd.framemaker.
14239#
142400	string		\<MakerFile	FrameMaker document
14241!:mime	application/x-mif
14242>11	string		5.5		 (5.5
14243>11	string		5.0		 (5.0
14244>11	string		4.0		 (4.0
14245>11	string		3.0		 (3.0
14246>11	string		2.0		 (2.0
14247>11	string		1.0		 (1.0
14248>14	byte		x		  %c)
14249# URL:		http://fileformats.archiveteam.org/wiki/Maker_Interchange_Format
14250# Reference:	https://help.adobe.com/en_US/framemaker/mifreference/mifref.pdf
14251# Update:	Joerg Jenderek 2019 Nov
142520	string		\<MIFFile	FrameMaker MIF (ASCII) file
14253# https://www.iana.org/assignments/media-types/application/vnd.mif
14254!:mime	application/vnd.mif
14255# mif most but also find bookTOC.framemif
14256!:ext	mif/framemif
14257# followed by space~20h
14258#>8	ubyte		0x20		\b, space before version
14259# 3 characters of version number of the MIF language like 1.0, 2.0 ... 2015 ...
14260>9	string		x		(%.3s
14261# if not greater sign then display 4th character of version
14262>12	ubyte		=0x3e		\b)
14263>12	ubyte		!0x3e		\b%c)
14264# comment starting with # shows the name+version number of generating program
14265>13	search/3	#
14266>>&0	string		x		"%s"
142670	search/1	\<MakerDictionary	FrameMaker Dictionary text
14268!:mime	application/x-mif
14269>17	string		3.0		 (3.0)
14270>17	string		2.0		 (2.0)
14271>17	string		1.0		 (1.x)
142720	string		\<MakerScreenFont	FrameMaker Font file
14273!:mime	application/x-mif
14274>17	string		1.01		 (%s)
142750	string		\<MML		FrameMaker MML file
14276!:mime	application/x-mif
142770	string		\<BookFile	FrameMaker Book file
14278!:mime	application/x-mif
14279>10	string		3.0		 (3.0
14280>10	string		2.0		 (2.0
14281>10	string		1.0		 (1.0
14282>13	byte		x		  %c)
14283# XXX - this book entry should be verified, if you find one, uncomment this
14284#0	string		\<Book\040 	FrameMaker Book (ASCII) file
14285#!:mime	application/x-mif
14286#>6	string		3.0		 (3.0)
14287#>6	string		2.0		 (2.0)
14288#>6	string		1.0		 (1.0)
142890	string		\<Maker\040Intermediate\040Print\040File	FrameMaker IPL file
14290!:mime	application/x-mif
14291
14292#------------------------------------------------------------------------------
14293# $File: freebsd,v 1.7 2009/09/19 16:28:09 christos Exp $
14294# freebsd:  file(1) magic for FreeBSD objects
14295#
14296# All new-style FreeBSD magic numbers are in host byte order (i.e.,
14297# little-endian on x86).
14298#
14299# XXX - this comes from the file "freebsd" in a recent FreeBSD version of
14300# "file"; it, and the NetBSD stuff in "netbsd", appear to use different
14301# schemes for distinguishing between executable images, shared libraries,
14302# and object files.
14303#
14304# FreeBSD says:
14305#
14306#    Regardless of whether it's pure, demand-paged, or none of the
14307#    above:
14308#
14309#	if the entry point is < 4096, then it's a shared library if
14310#	the "has run-time loader information" bit is set, and is
14311#	position-independent if the "is position-independent" bit
14312#	is set;
14313#
14314#	if the entry point is >= 4096 (or >4095, same thing), then it's
14315#	an executable, and is dynamically-linked if the "has run-time
14316#	loader information" bit is set.
14317#
14318# On x86, NetBSD says:
14319#
14320#    If it's neither pure nor demand-paged:
14321#
14322#	if it has the "has run-time loader information" bit set, it's
14323#	a dynamically-linked executable;
14324#
14325#	if it doesn't have that bit set, then:
14326#
14327#	    if it has the "is position-independent" bit set, it's
14328#	    position-independent;
14329#
14330#	    if the entry point is non-zero, it's an executable, otherwise
14331#	    it's an object file.
14332#
14333#    If it's pure:
14334#
14335#	if it has the "has run-time loader information" bit set, it's
14336#	a dynamically-linked executable, otherwise it's just an
14337#	executable.
14338#
14339#    If it's demand-paged:
14340#
14341#	if it has the "has run-time loader information" bit set,
14342#	then:
14343#
14344#	    if the entry point is < 4096, it's a shared library;
14345#
14346#	    if the entry point is = 4096 or > 4096 (i.e., >= 4096),
14347#	    it's a dynamically-linked executable);
14348#
14349#	if it doesn't have the "has run-time loader information" bit
14350#	set, then it's just an executable.
14351#
14352# (On non-x86, NetBSD does much the same thing, except that it uses
14353# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K
14354# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's
14355# had 8K pages; dunno about MIPS.)
14356#
14357# I suspect the two will differ only in perverse and uninteresting cases
14358# ("shared" libraries that aren't demand-paged and whose pages probably
14359# won't actually be shared, executables with entry points <4096).
14360#
14361# I leave it to those more familiar with FreeBSD and NetBSD to figure out
14362# what the right answer is (although using ">4095", FreeBSD-style, is
14363# probably better than separately checking for "=4096" and ">4096",
14364# NetBSD-style).  (The old "netbsd" file analyzed FreeBSD demand paged
14365# executables using the NetBSD technique.)
14366#
143670	lelong&0377777777	041400407	FreeBSD/i386
14368>20	lelong			<4096
14369>>3	byte&0xC0		&0x80		shared library
14370>>3	byte&0xC0		0x40		PIC object
14371>>3	byte&0xC0		0x00		object
14372>20	lelong			>4095
14373>>3	byte&0x80		0x80		dynamically linked executable
14374>>3	byte&0x80		0x00		executable
14375>16	lelong			>0		not stripped
14376
143770	lelong&0377777777	041400410	FreeBSD/i386 pure
14378>20	lelong			<4096
14379>>3	byte&0xC0		&0x80		shared library
14380>>3	byte&0xC0		0x40		PIC object
14381>>3	byte&0xC0		0x00		object
14382>20	lelong			>4095
14383>>3	byte&0x80		0x80		dynamically linked executable
14384>>3	byte&0x80		0x00		executable
14385>16	lelong			>0		not stripped
14386
143870	lelong&0377777777	041400413	FreeBSD/i386 demand paged
14388>20	lelong			<4096
14389>>3	byte&0xC0		&0x80		shared library
14390>>3	byte&0xC0		0x40		PIC object
14391>>3	byte&0xC0		0x00		object
14392>20	lelong			>4095
14393>>3	byte&0x80		0x80		dynamically linked executable
14394>>3	byte&0x80		0x00		executable
14395>16	lelong			>0		not stripped
14396
143970	lelong&0377777777	041400314	FreeBSD/i386 compact demand paged
14398>20	lelong			<4096
14399>>3	byte&0xC0		&0x80		shared library
14400>>3	byte&0xC0		0x40		PIC object
14401>>3	byte&0xC0		0x00		object
14402>20	lelong			>4095
14403>>3	byte&0x80		0x80		dynamically linked executable
14404>>3	byte&0x80		0x00		executable
14405>16	lelong			>0		not stripped
14406
14407# XXX gross hack to identify core files
14408# cores start with a struct tss; we take advantage of the following:
14409# byte 7:     highest byte of the kernel stack pointer, always 0xfe
14410#      8/9:   kernel (ring 0) ss value, always 0x0010
14411#      10 - 27: ring 1 and 2 ss/esp, unused, thus always 0
14412#      28:    low order byte of the current PTD entry, always 0 since the
14413#             PTD is page-aligned
14414#
144157	string	\357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	FreeBSD/i386 a.out core file
14416>1039	string	>\0	from '%s'
14417
14418# /var/run/ld.so.hints
14419# What are you laughing about?
144200	lelong			011421044151	ld.so hints file (Little Endian
14421>4	lelong			>0		\b, version %d)
14422>4	belong			<1		\b)
144230	belong			011421044151	ld.so hints file (Big Endian
14424>4	belong			>0		\b, version %d)
14425>4	belong			<1		\b)
14426
14427#
14428# Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities
14429#
144300	string	SCRSHOT_	scrshot(1) screenshot,
14431>8	byte	x		version %d,
14432>9	byte	2		%d bytes in header,
14433>>10	byte	x		%d chars wide by
14434>>11	byte	x		%d chars high
14435
14436#------------------------------------------------------------------------------
14437# $File: fsav,v 1.21 2021/02/23 00:51:10 christos Exp $
14438# fsav:  file(1) magic for datafellows fsav virus definition files
14439# Anthon van der Neut (anthon@mnt.org)
14440
14441# ftp://ftp.f-prot.com/pub/{macrdef2.zip,nomacro.def}
144420	beshort		0x1575		fsav macro virus signatures
14443>8	leshort		>0		(%d-
14444>11	byte		>0		\b%02d-
14445>10	byte		>0		\b%02d)
14446# ftp://ftp.f-prot.com/pub/sign.zip
14447#10	ubyte		<12
14448#>9	ubyte		<32
14449#>>8	ubyte		0x0a
14450#>>>12	ubyte		0x07
14451#>>>>11	uleshort	>0		fsav DOS/Windows virus signatures (%d-
14452#>>>>10	byte		0		\b01-
14453#>>>>10	byte		1		\b02-
14454#>>>>10	byte		2		\b03-
14455#>>>>10	byte		3		\b04-
14456#>>>>10	byte		4		\b05-
14457#>>>>10	byte		5		\b06-
14458#>>>>10	byte		6		\b07-
14459#>>>>10	byte		7		\b08-
14460#>>>>10	byte		8		\b09-
14461#>>>>10	byte		9		\b10-
14462#>>>>10	byte		10		\b11-
14463#>>>>10	byte		11		\b12-
14464#>>>>9	ubyte		>0		\b%02d)
14465# ftp://ftp.f-prot.com/pub/sign2.zip
14466#0	ubyte		0x62
14467#>1	ubyte		0xF5
14468#>>2	ubyte		0x1
14469#>>>3	ubyte		0x1
14470#>>>>4	ubyte		0x0e
14471#>>>>>13		ubyte	>0		fsav virus signatures
14472#>>>>>>11	ubyte	x		size 0x%02x
14473#>>>>>>12	ubyte	x		\b%02x
14474#>>>>>>13	ubyte	x		\b%02x bytes
14475
14476# Joerg Jenderek: joerg dot jenderek at web dot de
14477# clamav-0.100.2\docs\html\node60.html
14478# https://github.com/vrtadmin/clamav-faq/raw/master/manual/clamdoc.pdf
14479# ClamAV virus database files start with a 512 bytes colon separated header
14480# ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime
14481# + gzipped (optional) tarball files
14482# output can often be verified by `sigtool --info=FILE`
144830	string		ClamAV-VDB:	Clam AntiVirus
14484# padding spaces implies database
14485>511	ubyte		=0x20		database
14486!:mime	application/x-clamav-database
14487# empty build time
14488>>10	string		=::		(unsigned)
14489# sigtool(1) man page
14490!:ext	cud
14491# display some text to avoid error like:
14492# Magdir/fsav, 78: Warning: Current entry does not yet have a description for adding a EXTENSION type
14493# file: could not find any valid magic files! (No error)
14494>>10	default		x		(with buildtime)
14495#>>10	default		x
14496# clamtmp is used for temporarily database like update process
14497# for pure tar database only cld extension found
14498!:ext	cld/cvd/clamtmp/cud
14499>511	default		x		file
14500!:mime	application/x-clamav
14501!:ext	info
14502>11	string		>\0
14503# buildDate empty or like "22 Mar 2017 12-57 -0400"; verified by `sigtool -i FILE`
14504>>11	regex		\^[^:]{0,23}	\b, %s
14505# version like 25170
14506>>>&1	regex		\^[^:]{1,6}	\b, version %s
14507# signaturesNumbers like 4566249
14508>>>>&1	regex		\^[^:]{1,10}	\b, %s signatures
14509# functionalityLevelRequired like 60
14510>>>>>&1	regex		\^[^:]{1,4}	\b, level %s
14511# X for nothing or MD5
14512#>>>>>>&1	regex	\^[^:]{1,32}	\b, MD5 "%s"
14513>>>>>>&1	regex	\^[^:]{1,32}
14514# X for nothing or digital signature starting like AIzk/LYbX
14515#>>>>>>>&1	regex	\^[^:]{1,255}	\b, signature "%s"
14516>>>>>>>&1	regex	\^[^:]{1,255}
14517# builder like neo
14518>>>>>>>>&1	regex	\^[^:]{1,32}	\b, builder %s
14519# buildTime like 1506611558
14520#>>>>>>>>>&1	regex	\^[^:]{1,10}	\b, %s
14521>>>>>>>>>&1	regex	\^[^:]{1,10}
14522# padding with spaces
14523#>>>>>>>>>>&1	ubequad	x		\b, padding 0x%16.16llx
14524>510	ubyte		=0x20
14525# inspect real database content
14526#>>512	ubeshort	x		\b, database MAGIC 0x%x
14527# ./archive handle pure tar archives
14528>>1012	quad		=0		\b, with
14529>>>512	use		tar-file
14530# not pure tar
14531>>1012	quad		!0
14532# one space at the end of text and then handles gzipped archives by ./compress
14533>>>512	string		\037\213	\b, with
14534>>>>512	indirect	x
14535
14536# Type: Grisoft AVG AntiVirus
14537# From: David Newgas <david@newgas.net>
145380	string	AVG7_ANTIVIRUS_VAULT_FILE	AVG 7 Antivirus vault file data
14539
145400	string	X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR
14541>33	string	-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*	EICAR virus test files
14542
14543# From: Joerg Jenderek
14544# URL: https://www.avira.com/
14545# Note: found in directory %ProgramData%\Avira\Antivirus\INFECTED (Windows)
14546# tested with version 15.0.43.23 at November 2019
145470	string		AntiVir\ Qua	Avira AntiVir quarantined
14548!:mime	application/x-avira-qua
14549#!:mime	application/octet-stream
14550!:ext	qua
14551>156	string		SUSPICIOUS_FILE
14552# file path of suspicious file
14553>>220	lestring16	x		%s
14554>156	string		!SUSPICIOUS_FILE
14555# file path of virus file
14556>>228	lestring16	x		%s
14557# quarantined date
14558>60	ldate		x		at %s
14559# virus/danger name
14560>156	string		!SUSPICIOUS_FILE
14561>>156	string		x		\b, category "%s"
14562
14563
14564#------------------------------------------------------------------------------
14565# $File: fusecompress,v 1.2 2011/08/08 09:05:55 christos Exp $
14566# fusecompress:   file(1) magic for fusecompress
145670	string	\037\135\211	FuseCompress(ed) data
14568>3	byte	0x00	(none format)
14569>3	byte	0x01	(bz2 format)
14570>3	byte	0x02	(gz format)
14571>3	byte	0x03	(lzo format)
14572>3	byte	0x04	(xor format)
14573>3	byte	>0x04	(unknown format)
14574>4	long	x	uncompressed size: %d
14575
14576#------------------------------------------------------------------------------
14577# $File: games,v 1.22 2021/02/23 00:51:10 christos Exp $
14578# games:  file(1) for games
14579
14580# Fabio Bonelli <fabiobonelli@libero.it>
14581# Quake II - III data files
145820       string  IDP2        	Quake II 3D Model file,
14583>20     long    x               %u skin(s),
14584>8      long    x               (%u x
14585>12     long    x 		%u),
14586>40     long    x               %u frame(s),
14587>16     long    x               Frame size %u bytes,
14588>24     long  	x               %u vertices/frame,
14589>28     long    x            	%u texture coordinates,
14590>32     long    x               %u triangles/frame
14591
145920       string  IBSP            Quake
14593>4      long    0x26            II Map file (BSP)
14594>4      long    0x2E      	III Map file (BSP)
14595
145960       string  IDS2            Quake II SP2 sprite file
14597
14598#---------------------------------------------------------------------------
14599# Doom and Quake
14600# submitted by Nicolas Patrois
14601
146020       string  \xcb\x1dBoom\xe6\xff\x03\x01    Boom or linuxdoom demo
14603# some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01
14604
1460524      string  LxD\ 203        Linuxdoom save
14606>0      string  x       , name=%s
14607>44     string  x       , world=%s
14608
14609# Quake
14610
14611# Update: Joerg Jenderek
14612# URL: http://fileformats.archiveteam.org/wiki/PAK
14613# reference: https://quakewiki.org/wiki/.pak
14614# GRR: line below is too general as it matches also Acorn PackDir compressed Archive
14615# and Git pack ./revision
146160       string  PACK
14617# real Quake examples like pak0.pak have only some hundreds like 150 files
14618# So test for few files
14619>8	ulelong <0x01000000
14620# in file version 5.32 test for null terminator is only true for
14621# offset ~< FILE_BYTES_MAX = 1 MB defined in ../../src/file.h
14622# look for null terminator of 1st entry name
14623>>(4.l+55)	ubyte	0	Quake I or II world or extension
14624!:mime	application/x-dzip
14625!:ext	pak
14626#>>>8	ulelong	x	\b, table size %u
14627# dividing this by entry size (64) gives number of files
14628>>>8	ulelong/64 x	\b, %u files
14629# offset to the beginning of the file table
14630>>>4	ulelong	x	\b, offset 0x%x
14631# 1st file entry
14632>>>(4.l)	use	pak-entry
14633# 2nd file entry
14634#>>>4	ulelong+64	x	\b, offset 0x%x
14635#>>>(4.l+64)	use	pak-entry
14636#
14637#	display file table entry of Quake PAK archive
146380	name		pak-entry
14639# normally entry start after header which implies offset 12 or higher
14640>56	ulelong	>11
14641# the offset from the beginning of pak to beginning of this entry file contents
14642>>56	ulelong	x	at 0x%x
14643# the size of file for this entry
14644>>60	ulelong	x	%u bytes
14645# 56 byte null-terminated entry name string includes path like maps/e1m1.bsp
14646>>0	string	x	'%-.56s'
14647# inspect entry content by jumping to entry offset
14648>>(56)	indirect x	\b:
14649
14650#0       string  -1\x0a  Quake I demo
14651#>30     string  x        version %.4s
14652#>61     string  x        level %s
14653
14654#0       string  5\x0a   Quake I save
14655
14656# The levels
14657
14658# Quake 1
14659
146600	string	5\x0aIntroduction             Quake I save: start Introduction
146610	string	5\x0athe_Slipgate_Complex     Quake I save: e1m1 The slipgate complex
146620	string	5\x0aCastle_of_the_Damned     Quake I save: e1m2 Castle of the damned
146630	string	5\x0athe_Necropolis           Quake I save: e1m3 The necropolis
146640	string	5\x0athe_Grisly_Grotto        Quake I save: e1m4 The grisly grotto
146650	string	5\x0aZiggurat_Vertigo         Quake I save: e1m8 Ziggurat vertigo (secret)
146660	string	5\x0aGloom_Keep               Quake I save: e1m5 Gloom keep
146670	string	5\x0aThe_Door_To_Chthon       Quake I save: e1m6 The door to Chthon
146680	string	5\x0aThe_House_of_Chthon      Quake I save: e1m7 The house of Chthon
146690	string	5\x0athe_Installation         Quake I save: e2m1 The installation
146700	string	5\x0athe_Ogre_Citadel         Quake I save: e2m2 The ogre citadel
146710	string	5\x0athe_Crypt_of_Decay       Quake I save: e2m3 The crypt of decay (dopefish lives!)
146720	string	5\x0aUnderearth               Quake I save: e2m7 Underearth (secret)
146730	string	5\x0athe_Ebon_Fortress        Quake I save: e2m4 The ebon fortress
146740	string	5\x0athe_Wizard's_Manse       Quake I save: e2m5 The wizard's manse
146750	string	5\x0athe_Dismal_Oubliette     Quake I save: e2m6 The dismal oubliette
146760	string	5\x0aTermination_Central      Quake I save: e3m1 Termination central
146770	string	5\x0aVaults_of_Zin            Quake I save: e3m2 Vaults of Zin
146780	string	5\x0athe_Tomb_of_Terror       Quake I save: e3m3 The tomb of terror
146790	string	5\x0aSatan's_Dark_Delight     Quake I save: e3m4 Satan's dark delight
146800	string	5\x0athe_Haunted_Halls        Quake I save: e3m7 The haunted halls (secret)
146810	string	5\x0aWind_Tunnels             Quake I save: e3m5 Wind tunnels
146820	string	5\x0aChambers_of_Torment      Quake I save: e3m6 Chambers of torment
146830	string	5\x0athe_Sewage_System        Quake I save: e4m1 The sewage system
146840	string	5\x0aThe_Tower_of_Despair     Quake I save: e4m2 The tower of despair
146850	string	5\x0aThe_Elder_God_Shrine     Quake I save: e4m3 The elder god shrine
146860	string	5\x0athe_Palace_of_Hate       Quake I save: e4m4 The palace of hate
146870	string	5\x0aHell's_Atrium            Quake I save: e4m5 Hell's atrium
146880	string	5\x0athe_Nameless_City        Quake I save: e4m8 The nameless city (secret)
146890	string	5\x0aThe_Pain_Maze            Quake I save: e4m6 The pain maze
146900	string	5\x0aAzure_Agony              Quake I save: e4m7 Azure agony
146910	string	5\x0aShub-Niggurath's_Pit     Quake I save: end Shub-Niggurath's pit
14692
14693# Quake DeathMatch levels
14694
146950	string	5\x0aPlace_of_Two_Deaths	 Quake I save: dm1 Place of two deaths
146960	string	5\x0aClaustrophobopolis		 Quake I save: dm2 Claustrophobopolis
146970	string	5\x0aThe_Abandoned_Base		 Quake I save: dm3 The abandoned base
146980	string	5\x0aThe_Bad_Place		 Quake I save: dm4 The bad place
146990	string	5\x0aThe_Cistern		 Quake I save: dm5 The cistern
147000	string	5\x0aThe_Dark_Zone		 Quake I save: dm6 The dark zone
14701
14702# Scourge of Armagon
14703
147040	string	5\x0aCommand_HQ               Quake I save: start Command HQ
147050	string	5\x0aThe_Pumping_Station      Quake I save: hip1m1 The pumping station
147060	string	5\x0aStorage_Facility         Quake I save: hip1m2 Storage facility
147070	string	5\x0aMilitary_Complex         Quake I save: hip1m5 Military complex (secret)
147080	string	5\x0athe_Lost_Mine            Quake I save: hip1m3 The lost mine
147090	string	5\x0aResearch_Facility        Quake I save: hip1m4 Research facility
147100	string	5\x0aAncient_Realms           Quake I save: hip2m1 Ancient realms
147110	string	5\x0aThe_Gremlin's_Domain     Quake I save: hip2m6 The gremlin's domain (secret)
147120	string	5\x0aThe_Black_Cathedral      Quake I save: hip2m2 The black cathedral
147130	string	5\x0aThe_Catacombs            Quake I save: hip2m3 The catacombs
147140	string	5\x0athe_Crypt__              Quake I save: hip2m4 The crypt
147150	string	5\x0aMortum's_Keep            Quake I save: hip2m5 Mortum's keep
147160	string	5\x0aTur_Torment              Quake I save: hip3m1 Tur torment
147170	string	5\x0aPandemonium              Quake I save: hip3m2 Pandemonium
147180	string	5\x0aLimbo                    Quake I save: hip3m3 Limbo
147190	string	5\x0athe_Edge_of_Oblivion     Quake I save: hipdm1 The edge of oblivion (secret)
147200	string	5\x0aThe_Gauntlet             Quake I save: hip3m4 The gauntlet
147210	string	5\x0aArmagon's_Lair           Quake I save: hipend Armagon's lair
14722
14723# Malice
14724
147250	string	5\x0aThe_Academy      Quake I save: start The academy
147260	string	5\x0aThe_Lab          Quake I save: d1 The lab
147270	string	5\x0aArea_33          Quake I save: d1b Area 33
147280	string	5\x0aSECRET_MISSIONS  Quake I save: d3b Secret missions
147290	string	5\x0aThe_Hospital     Quake I save: d10 The hospital (secret)
147300	string	5\x0aThe_Genetics_Lab Quake I save: d11 The genetics lab (secret)
147310	string	5\x0aBACK_2_MALICE    Quake I save: d4b Back to Malice
147320	string	5\x0aArea44           Quake I save: d1c Area 44
147330	string	5\x0aTakahiro_Towers  Quake I save: d2 Takahiro towers
147340	string	5\x0aA_Rat's_Life     Quake I save: d3 A rat's life
147350	string	5\x0aInto_The_Flood   Quake I save: d4 Into the flood
147360	string	5\x0aThe_Flood        Quake I save: d5 The flood
147370	string	5\x0aNuclear_Plant    Quake I save: d6 Nuclear plant
147380	string	5\x0aThe_Incinerator_Plant    Quake I save: d7 The incinerator plant
147390	string	5\x0aThe_Foundry              Quake I save: d7b The foundry
147400	string	5\x0aThe_Underwater_Base      Quake I save: d8 The underwater base
147410	string	5\x0aTakahiro_Base            Quake I save: d9 Takahiro base
147420	string	5\x0aTakahiro_Laboratories    Quake I save: d12 Takahiro laboratories
147430	string	5\x0aStayin'_Alive    Quake I save: d13 Stayin' alive
147440	string	5\x0aB.O.S.S._HQ      Quake I save: d14 B.O.S.S. HQ
147450	string	5\x0aSHOWDOWN!        Quake I save: d15 Showdown!
14746
14747# Malice DeathMatch levels
14748
147490	string	5\x0aThe_Seventh_Precinct	 Quake I save: ddm1 The seventh precinct
147500	string	5\x0aSub_Station		 Quake I save: ddm2 Sub station
147510	string	5\x0aCrazy_Eights!		 Quake I save: ddm3 Crazy eights!
147520	string	5\x0aEast_Side_Invertationa	 Quake I save: ddm4 East side invertationa
147530	string	5\x0aSlaughterhouse		 Quake I save: ddm5 Slaughterhouse
147540	string	5\x0aDOMINO			 Quake I save: ddm6 Domino
147550	string	5\x0aSANDRA'S_LADDER		 Quake I save: ddm7 Sandra's ladder
14756
14757
147580	string	MComprHD	MAME CHD compressed hard disk image,
14759>12	belong	x		version %u
14760
14761# doom - submitted by Jon Dowland
14762
147630	string	=IWAD		doom main IWAD data
14764>4	lelong	x		containing %d lumps
147650	string	=PWAD		doom patch PWAD data
14766>4	lelong	x		containing %d lumps
14767
14768# Build engine group files (Duke Nukem, Shadow Warrior, ...)
14769# Extension: .grp
14770# Created by: "Ganael Laplanche" <ganael.laplanche@martymac.org>
147710	string	KenSilverman	Build engine group file
14772>12	lelong	x		containing %d files
14773
14774# Summary: Warcraft 3 save
14775# Extension: .w3g
14776# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com>
147770	string		Warcraft\ III\ recorded\ game	%s
14778
14779
14780# Summary: Warcraft 3 map
14781# Extension: .w3m
14782# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com>
147830	string		HM3W		Warcraft III map file
14784
14785
14786# Summary: SGF Smart Game Format
14787# Extension: .sgf
14788# Reference: https://www.red-bean.com/sgf/
14789# Created by: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar>
14790# Modified by (1): Abel Cheung (regex, more game format)
14791# FIXME: Some games don't have GM (game type)
147920	regex		\\(;.*GM\\[[0-9]{1,2}\\]	Smart Game Format
14793>2	search/0x200/b	GM[
14794>>&0	string		1]	(Go)
14795>>&0	string		2]	(Othello)
14796>>&0	string		3]	(chess)
14797>>&0	string		4]	(Gomoku+Renju)
14798>>&0	string		5]	(Nine Men's Morris)
14799>>&0	string		6]	(Backgammon)
14800>>&0	string		7]	(Chinese chess)
14801>>&0	string		8]	(Shogi)
14802>>&0	string		9]	(Lines of Action)
14803>>&0	string		10]	(Ataxx)
14804>>&0	string		11]	(Hex)
14805>>&0	string		12]	(Jungle)
14806>>&0	string		13]	(Neutron)
14807>>&0	string		14]	(Philosopher's Football)
14808>>&0	string		15]	(Quadrature)
14809>>&0	string		16]	(Trax)
14810>>&0	string		17]	(Tantrix)
14811>>&0	string		18]	(Amazons)
14812>>&0	string		19]	(Octi)
14813>>&0	string		20]	(Gess)
14814>>&0	string		21]	(Twixt)
14815>>&0	string		22]	(Zertz)
14816>>&0	string		23]	(Plateau)
14817>>&0	string		24]	(Yinsh)
14818>>&0	string		25]	(Punct)
14819>>&0	string		26]	(Gobblet)
14820>>&0	string		27]	(hive)
14821>>&0	string		28]	(Exxit)
14822>>&0	string		29]	(Hnefatal)
14823>>&0	string		30]	(Kuba)
14824>>&0	string		31]	(Tripples)
14825>>&0	string		32]	(Chase)
14826>>&0	string		33]	(Tumbling Down)
14827>>&0	string		34]	(Sahara)
14828>>&0	string		35]	(Byte)
14829>>&0	string		36]	(Focus)
14830>>&0	string		37]	(Dvonn)
14831>>&0	string		38]	(Tamsk)
14832>>&0	string		39]	(Gipf)
14833>>&0	string		40]	(Kropki)
14834
14835##############################################
14836# NetImmerse/Gamebryo game engine entries
14837
14838# Summary: Gamebryo game engine file
14839# Extension: .nif, .kf
14840# Created by: Abel Cheung <abelcheung@gmail.com>
148410		string		Gamebryo\ File\ Format,\ Version\ 	Gamebryo game engine file
14842>&0		regex		[0-9a-z.]+				\b, version %s
14843
14844# Summary: Gamebryo game engine file
14845# Extension: .kfm
14846# Created by: Abel Cheung <abelcheung@gmail.com>
148470		string		;Gamebryo\ KFM\ File\ Version\ 		Gamebryo game engine animation File
14848>&0		regex		[0-9a-z.]+				\b, version %s
14849
14850# Summary: NetImmerse game engine file
14851# Extension .nif
14852# Created by: Abel Cheung <abelcheung@gmail.com>
148530		string		NetImmerse\ File\ Format,\ Version
14854>&0		string		n\ 					NetImmerse game engine file
14855>>&0		regex		[0-9a-z.]+				\b, version %s
14856
14857# Type:	SGF Smart Game Format
14858# URL:	https://www.red-bean.com/sgf/
14859# From:	Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar>
148602	regex/c	\\(;.*GM\\[[0-9]{1,2}\\]	Smart Game Format
14861>2	regex/c	GM\\[1\\]			- Go Game
14862>2	regex/c	GM\\[6\\]			- BackGammon Game
14863>2	regex/c	GM\\[11\\]			- Hex Game
14864>2	regex/c	GM\\[18\\]			- Amazons Game
14865>2	regex/c	GM\\[19\\]			- Octi Game
14866>2	regex/c	GM\\[20\\]			- Gess Game
14867>2	regex/c	GM\\[21\\]			- twix Game
14868
14869# Epic Games/Unreal Engine Package
14870#
148710	lelong		0x9E2A83C1	Unreal Engine Package,
14872>4	leshort		x		version: %i
14873>12	lelong		!0		\b, names: %i
14874>28	lelong		!0		\b, imports: %i
14875>20	lelong		!0		\b, exports: %i
14876
148770	string		ESVG
14878>4	lelong		0x00160000
14879>10	string		TOC\020		Empire Deluxe for DOS saved game
14880
14881# Sid Meier's Civilization V/VI
14882# From: Benjamin Lowry <ben@ben.gmbh>
148830	string	CIV5
14884>4	byte	0x08		Sid Meier's Civilization V saved game,
14885>>12	regex	[0-9a-z.]+	saved by game version %s
14886>4	byte	0x01		Sid Meier's Civilization V replay data,
14887>>12	regex	[0-9a-z.]+	saved by game version %s
14888
148890	string	CIV6		Sid Meier's Civilization VI saved game
14890
14891# https://syzygy-tables.info/
14892# From Michel Van den Bergh
148930	string	\327f\f\245	Syzygy DTZ tablebase
14894!:mime	application/syzygy
148950	string	q\350#]		Syzygy WDL tablebase
14896!:mime	application/syzygy
14897
14898#------------------------------------------------------------------------------
14899# $File: gcc,v 1.5 2016/07/01 23:31:13 christos Exp $
14900# gcc:  file(1) magic for GCC special files
14901#
149020	string		gpch		GCC precompiled header
14903
14904# The version field is annoying.  It's 3 characters, not zero-terminated.
14905>5	byte		x			(version %c
14906>6	byte		x			\b%c
14907>7	byte		x			\b%c)
14908
14909# 67 = 'C', 111 = 'o', 43 = '+', 79 = 'O'
14910>4	byte		67			for C
14911>4	byte		111			for Objective-C
14912>4	byte		43			for C++
14913>4	byte		79			for Objective-C++
14914
14915#------------------------------------------------------------------------------
14916# $File: gconv
14917# gconv: file(1) magic for iconv/gconv module configuration cache
14918#
14919# Magic number defined in glibc/iconv/iconvconfig.h as GCONVCACHE_MAGIC
14920#
14921# From: Marek Cermak <macermak@redhat.com>
14922#
149230		lelong		0x20010324 	gconv module configuration cache data
14924
14925#------------------------------------------------------------------------------
14926# $File: geo,v 1.7 2019/04/19 00:42:27 christos Exp $
14927# Geo- files from Kurt Schwehr <schwehr@ccom.unh.edu>
14928
14929######################################################################
14930#
14931# Acoustic Doppler Current Profilers (ADCP)
14932#
14933######################################################################
14934
149350	beshort	0x7f7f	RDI Acoustic Doppler Current Profiler (ADCP)
14936
14937######################################################################
14938#
14939# Metadata
14940#
14941######################################################################
14942
149430	string	Identification_Information	FGDC ASCII metadata
14944
14945######################################################################
14946#
14947# Seimsic / Subbottom
14948#
14949######################################################################
14950
14951# Knudsen subbottom chirp profiler - Binary File Format: B9
14952# KEB D409-03167 V1.75 Huffman
149530	string	KEB\ 	Knudsen seismic KEL binary (KEB) -
14954>4	regex	[-A-Z0-9]*	Software: %s
14955>>&1	regex	V[0-9]*\.[0-9]*	version %s
14956
14957######################################################################
14958#
14959# LIDAR - Laser altimetry or bathy
14960#
14961######################################################################
14962
14963
14964# Caris LIDAR format for LADS comes as two parts... ascii location file and binary waveform data
149650	string	HCA	LADS Caris Ascii Format (CAF) bathymetric lidar
14966>4	regex [0-9]*\.[0-9]*	version %s
14967
149680	string	HCB	LADS Caris Binary Format (CBF) bathymetric lidar waveform data
14969>3      byte    x	version %d .
14970>4	byte	x	%d
14971
14972
14973######################################################################
14974#
14975# MULTIBEAM SONARS https://www.ldeo.columbia.edu/res/pi/MB-System/formatdoc/
14976#
14977######################################################################
14978
14979# GeoAcoustics - GeoSwath Plus
149804	beshort	0x2002	GeoSwath RDF
149810	string	Start:-	GeoSwatch auf text file
14982
14983# Seabeam 2100
14984# mbsystem code mb41
149850	string SB2100	SeaBeam 2100 multibeam sonar
149860	string SB2100DR	SeaBeam 2100 DR multibeam sonar
149870	string SB2100PR SeaBeam 2100 PR multibeam sonar
14988
14989# This corresponds to MB-System format 94, L-3/ELAC/SeaBeam XSE vendor
14990# format. It is the format of our upgraded SeaBeam 2112 on R/V KNORR.
149910    string $HSF    XSE multibeam
14992
14993# mb121 https://www.saic.com/maritime/gsf/
149948	string	GSF-v	SAIC generic sensor format (GSF) sonar data,
14995>&0	regex [0-9]*\.[0-9]*	version %s
14996
14997# MGD77 - https://www.ngdc.noaa.gov/mgg/dat/geodas/docs/mgd77.htm
14998# mb161
149999	string MGD77	MGD77 Header, Marine Geophysical Data Exchange Format
15000
15001# MBSystem processing caches the mbinfo output
150021	string	Swath\ Data\ File:	mbsystem info cache
15003
15004# Caris John Hughes Clark format
150050	string	HDCS	Caris multibeam sonar related data
150061	string	Start/Stop\ parameter\ header:	Caris ASCII project summary
15007
15008######################################################################
15009#
15010# Visualization and 3D modeling
15011#
15012######################################################################
15013
15014# IVS - IVS3d.com Tagged Data Represetation
150150	string	%%\ TDR\ 2.0	IVS Fledermaus TDR file
15016
15017# http://www.ecma-international.org/publications/standards/Ecma-363.htm
15018# 3D in PDFs
150190	string	U3D	ECMA-363, Universal 3D
15020
15021######################################################################
15022#
15023# Support files
15024#
15025######################################################################
15026
15027# https://midas.psi.ch/elog/
150280	string	$@MID@$	elog journal entry
15029
15030# Geospatial Designs https://www.geospatialdesigns.com/surfer6_format.htm
150310	string		DSBB	Surfer 6 binary grid file
15032>4	leshort		x	\b, %d
15033>6	leshort		x	\bx%d
15034>8	ledouble	x	\b, minx=%g
15035>16	ledouble	x	\b, maxx=%g
15036>24	ledouble	x	\b, miny=%g
15037>32	ledouble	x	\b, maxy=%g
15038>40	ledouble	x	\b, minz=%g
15039>48	ledouble	x	\b, maxz=%g
15040
15041# magic for LAS format files
15042# alex myczko <alex@aiei.ch>
15043# https://www.asprs.org/wp-content/uploads/2010/12/LAS_1_3_r11.pdf
150440	string		LASF	LIDAR point data records
15045>24	byte		>0	\b, version %u
15046>25	byte		>0	\b.%u
15047>26	string		>\0	\b, SYSID %s
15048>58	string		>\0	\b, Generating Software %s
15049
15050# magic for PCD format files
15051# alex myczko <alex@aiei.ch>
15052# http://pointclouds.org/documentation/tutorials/pcd_file_format.php
150530	string		#\ .PCD	Point Cloud Data
15054
15055#------------------------------------------------------------------------------
15056# $File: geos,v 1.4 2009/09/19 16:28:09 christos Exp $
15057# GEOS files (Vidar Madsen, vidar@gimp.org)
15058# semi-commonly used in embedded and handheld systems.
150590	belong	0xc745c153	GEOS
15060>40	byte	1	executable
15061>40	byte	2	VMFile
15062>40	byte	3	binary
15063>40	byte	4	directory label
15064>40	byte	<1	unknown
15065>40	byte	>4	unknown
15066>4	string	>\0	\b, name "%s"
15067#>44	short	x	\b, version %d
15068#>46	short	x	\b.%d
15069#>48	short	x	\b, rev %d
15070#>50	short	x	\b.%d
15071#>52	short	x	\b, proto %d
15072#>54	short	x	\br%d
15073#>168	string	>\0	\b, copyright "%s"
15074
15075#------------------------------------------------------------------------------
15076# $File: gimp,v 1.10 2019/10/15 18:19:40 christos Exp $
15077# GIMP Gradient: file(1) magic for the GIMP's gradient data files (.ggr)
15078# by Federico Mena <federico@nuclecu.unam.mx>
15079
150800       string/t        GIMP\ Gradient  GIMP gradient data
15081#!:mime	text/plain
15082!:mime	text/x-gimp-ggr
15083!:ext	ggr
15084
15085# GIMP palette (.gpl)
15086# From: Markus Heidelberg <markus.heidelberg@web.de>
150870       string/t        GIMP\ Palette   GIMP palette data
15088# URL:		https://docs.gimp.org/en/gimp-concepts-palettes.html
15089# Reference:	http://fileformats.archiveteam.org/wiki/GIMP_Palette
15090#!:mime	text/plain
15091!:mime	text/x-gimp-gpl
15092!:ext	gpl
15093
15094#------------------------------------------------------------------------------
15095# XCF:  file(1) magic for the XCF image format used in the GIMP (.xcf) developed
15096#       by Spencer Kimball and Peter Mattis
15097#       ('Bucky' LaDieu, nega@vt.edu)
15098
15099# URL:		https://en.wikipedia.org/wiki/XCF_(file_format)
15100# Reference:	https://gitlab.gnome.org/GNOME/gimp/blob/master/devel-docs/xcf.txt
151010	string		gimp\ xcf	GIMP XCF image data,
15102!:mime	image/x-xcf
15103!:ext	xcf
15104>9	string		file		version 0,
15105>9	string		v		version
15106>>10	string		>\0		%s,
15107>14	belong		x		%u x
15108>18	belong		x		%u,
15109>22     belong          0               RGB Color
15110>22     belong          1               Greyscale
15111>22     belong          2               Indexed Color
15112>22	belong		>2		Unknown Image Type.
15113
15114#------------------------------------------------------------------------------
15115# XCF:  file(1) magic for the patterns used in the GIMP (.pat), developed
15116#       by Spencer Kimball and Peter Mattis
15117#       ('Bucky' LaDieu, nega@vt.edu)
15118
15119# Reference:	http://fileformats.archiveteam.org/wiki/GIMP_Pattern
1512020      string          GPAT            GIMP pattern data,
15121>24     string          x               %s
15122!:mime	image/x-gimp-pat
15123!:ext	pat
15124
15125#------------------------------------------------------------------------------
15126# XCF:  file(1) magic for the brushes used in the GIMP (.gbr), developed
15127#       by Spencer Kimball and Peter Mattis
15128#       ('Bucky' LaDieu, nega@vt.edu)
15129
1513020      string          GIMP            GIMP brush data
15131# Reference:	http://fileformats.archiveteam.org/wiki/GIMP_Brush
15132!:mime	image/x-gimp-gbr
15133# some sources also list gpb
15134!:ext	gbr
15135
15136# From:		Joerg Jenderek
15137# URL:		https://docs.gimp.org/en/gimp-using-animated-brushes.html
15138# Reference:	http://fileformats.archiveteam.org/wiki/GIMP_Animated_Brush
15139# share\gimp\2.0\brushes\Legacy\confetti.gih
151400	search/21/b	\040ncells:		GIMP animated brush data
15141!:mime	image/x-gimp-gih
15142!:ext	gih
15143
15144# GIMP Curves File
15145# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
151460	string	#\040GIMP\040Curves\040File	GIMP curve file
15147#!:mime	text/plain
15148!:mime	text/x-gimp-curve
15149!:ext	/txt
15150
15151
15152#------------------------------------------------------------------------------
15153# $File: git,v 1.2 2020/08/09 16:57:15 christos Exp $
15154# git:  file(1) magic for Git objects
15155
151560	string	blob\040
15157>5	regex	[0-9a-f]+		Git blob %s
15158
151590	string	tree\040
15160>5	regex	[0-9a-f]+		Git tree %s
15161
151620	string	commit\040
15163>7	regex	[0-9a-f]+		Git commit %s
15164
15165#------------------------------------------------------------------------------
15166# $File: glibc,v 1.1 2018/10/11 15:35:43 christos Exp $
15167# glibc locale files
15168#
15169# https://sourceware.org/git/?p=glibc.git;f=locale/localeinfo.h;h=68822a63#l32
15170
151710	belong	0x20070920	glibc locale file LC_CTYPE
151720	belong	0x14110320	glibc locale file LC_NUMERIC
151730	belong	0x17110320	glibc locale file LC_TIME
151740	belong	0x17100520	glibc locale file LC_COLLATE
151750	belong	0x11110320	glibc locale file LC_MONETARY
151760	belong	0x10110320	glibc locale file LC_MESSAGES
151770	belong	0x13110320	glibc locale file LC_ALL
151780	belong	0x12110320	glibc locale file LC_PAPER
151790	belong	0x1d110320	glibc locale file LC_NAME
151800	belong	0x1c110320	glibc locale file LC_ADDRESS
151810	belong	0x1f110320	glibc locale file LC_TELEPHONE
151820	belong	0x1e110320	glibc locale file LC_MEASUREMENT
151830	belong	0x19110320	glibc locale file LC_IDENTIFICATION
15184
15185
15186#------------------------------------------------------------------------------
15187# $File: gnome,v 1.7 2020/06/23 16:17:08 christos Exp $
15188# GNOME related files
15189
15190# Contributed by Josh Triplett
15191# FIXME: Could be simplified if pstring supported two-byte counts
151920         string   GnomeKeyring\n\r\0\n GNOME keyring
15193>&0       ubyte    0                    \b, major version 0
15194>>&0      ubyte    0                    \b, minor version 0
15195>>>&0     ubyte    0                    \b, crypto type 0 (AES)
15196>>>&0     ubyte    >0                   \b, crypto type %u (unknown)
15197>>>&1     ubyte    0                    \b, hash type 0 (MD5)
15198>>>&1     ubyte    >0                   \b, hash type %u (unknown)
15199>>>&2     ubelong  0xFFFFFFFF           \b, name NULL
15200>>>&2     ubelong  !0xFFFFFFFF
15201>>>>&-4   ubelong  >255                 \b, name too long for file's pstring type
15202>>>>&-4   ubelong  <256
15203>>>>>&-1  pstring  x                    \b, name "%s"
15204>>>>>>&0  ubeqdate x                    \b, last modified %s
15205>>>>>>&8  ubeqdate x                    \b, created %s
15206>>>>>>&16 ubelong  &1
15207>>>>>>>&0 ubelong  x                    \b, locked if idle for %u seconds
15208>>>>>>&16 ubelong  ^1                   \b, not locked if idle
15209>>>>>>&24 ubelong  x                    \b, hash iterations %u
15210>>>>>>&28 ubequad  x                    \b, salt %llu
15211>>>>>>&52 ubelong  x                    \b, %u item(s)
15212
15213# From: Alex Beregszaszi <alex@fsn.hu>
152144	string	gtktalog		GNOME Catalogue (gtktalog)
15215>13	string	>\0			version %s
15216
15217# Summary: GStreamer binary registry
15218# Extension: .bin
15219# Submitted by: Josh Triplett <josh@joshtriplett.org>
152200	belong	0xc0def00d		GStreamer binary registry
15221>4	string	x			\b, version %s
15222
15223# GVariant Database file
15224# By Elan Ruusamae <glen@delfi.ee>
15225# https://github.com/GNOME/gvdb/blob/master/gvdb-format.h
15226# It's always "GVariant", it's byte swapped on incompatible archs
15227# See https://github.com/GNOME/gvdb/blob/master/gvdb-builder.c
15228# file_builder_serialise()
15229# https://developer.gnome.org/glib/2.34/glib-GVariant.html#GVariant
152300	string	GVariant	GVariant Database file,
15231# version is never filled. probably future extension
15232>8	lelong	x		version %d
15233# not sure are these usable, so commented out
15234#>>16	lelong	x		start %d,
15235#>>>20	lelong	x		end %d
15236
15237# G-IR database made by gobject-introspect toolset,
15238# https://live.gnome.org/GObjectIntrospection
152390	string		GOBJ\nMETADATA\r\n\032	G-IR binary database
15240>16	byte		x			\b, v%d
15241>17	byte		x			\b.%d
15242>20	short		x			\b, %d entries
15243>22	short		x			\b/%d local
15244
15245#------------------------------------------------------------------------------
15246# $File: gnu,v 1.23 2021/02/23 00:51:10 christos Exp $
15247# gnu:  file(1) magic for various GNU tools
15248#
15249# GNU nlsutils message catalog file format
15250#
15251# GNU message catalog (.mo and .gmo files)
15252
15253# Update: Joerg Jenderek
15254# URL: https://www.gnu.org/software/gettext/manual/html_node/MO-Files.html
15255# Reference: ftp://ftp.gnu.org/pub/gnu/gettext/gettext-0.19.8.tar.gz/
15256#	gettext-0.19.8.1/gettext-runtime/intl/gmo.h
15257# Note: maybe call it like "GNU translation gettext machine object"
152580	string		\336\22\4\225	GNU message catalog (little endian),
15259#0	ulelong	0x950412DE		GNU-format message catalog data
15260# TODO: write lines in such a way that code can also be called for big endian variant
15261#>0	use		gettext-object
15262#0	name		gettext-object
15263>4	ulelong		x		revision
15264!:mime	application/x-gettext-translation
15265# mo extension is also used for Easeus Partition Master PE32 executable module
15266# like ConvertFatToNTFS.mo
15267!:ext	gmo/mo
15268# only found three revision combinations 0.0 0.1 1.1 as unsigned 32-bit
15269# major revision
15270>4	ulelong/0xFFff	x		%u.
15271# minor revision
15272>4	ulelong&0x0000FFff	x	\b%u
15273>>8	ulelong		x		\b, %u message
15274# plural s
15275>>8	ulelong		>1		\bs
15276# size of hashing table
15277#>20	ulelong		x		\b, %u hash
15278#>20	ulelong		>1		\bes
15279#>24	ulelong		x		at 0x%x
15280# for revision x.0 offset of table with originals is 1Ch if directly after header
15281>4	ulelong&0x0000FFff	=0
15282>>12	ulelong		!0x1C		\b, at 0x%x string table
15283# but for x.1 table offset i found is 30h. That means directly after bigger header
15284>4	ulelong&0x0000FFff	>0
15285>>12	ulelong		!0x30		\b, at 0x%x string table
15286# The following variables are only used in .mo files with minor revision >= 1
15287# number of system dependent segments
15288#>>28	ulelong		x		\b, %u segment
15289#>>28	ulelong		>1		\bs
15290# offset of table describing system dependent segments
15291#>>32	ulelong		x		at 0x%x
15292# number of system dependent strings pairs
15293>>36	ulelong		x		\b, %u sysdep message
15294>>36	ulelong		>1		\bs
15295# offset of table with start offsets of original sysdep strings
15296#>>40	ulelong		x		\b, at 0x%x sysdep strings
15297# offset of table with start offsets of translated sysdep strings
15298#>>44	ulelong		x		\b, at 0x%x sysdep translations
15299# >>(44.l)	ulelong	x		0x%x chars
15300# >>>&0		ulelong	x		at 0x%x
15301# >>>>(&-4)	string	x		"%s"
15302# string table after big header
15303#>>48	ubequad		x		\b, string table 0x%llx
15304#
15305# 0th string length seems to be always 0
15306#>(12.l)	ulelong	x		\b, %u chars
15307#>>&0		ulelong	x		at 0x%x
15308# if 1st string length positive inspect offset and string
15309#>(12.l+8)	ulelong	>0		\b, %u chars
15310#>>&0		ulelong	x		at 0x%x
15311# if 2nd string length positive inspect offset and string
15312# >(12.l+16)	ulelong	>0		\b, %u chars
15313# >>&0		ulelong	x		at 0x%x
15314# skip newline byte
15315#>>>(&-4)	ubyte	=0x0A
15316#>>>>&0		string	x		"%s"
15317#>>>(&-4)	ubyte	!0x0A
15318#>>>>&-1		string	x		'%s'
15319# offset of table with translation strings
15320#>16	ulelong		x		\b, at 0x%x translation table
15321# check translation 0 length and offset
15322>(16.l)		ulelong	>0
15323>>&0		ulelong	x
15324# translation 0 seems to be often Project-Id with name and version
15325>>>(&-4)	string	x		\b, %s
15326# trans. 1 with bytes >= 1 unlike icoutils-0.31.0\po\en@boldquot.gmo with 1 NL
15327>(16.l+8)	ulelong	>1
15328>>&0		ulelong	x
15329>>>(&-4)	ubyte	!0x0A
15330>>>>&-1		string	x		'%s'
15331# 1 New Line like in tar-1.29\po\de.gmo
15332>>>(&-4)	ubyte	=0x0A
15333>>>>&0		ubyte	!0x0A
15334>>>>>&-1	string	x		'%s'
15335# 2nd New Line like in parted-3.1\po\de.gmo
15336>>>>&0		ubyte	=0x0A
15337>>>>>&0		string	x		'%s'
15338
153390	string		\225\4\22\336	GNU message catalog (big endian),
15340#0	ubelong	0x950412DE		GNU-format message catalog data
15341!:mime	application/x-gettext-translation
15342!:ext	gmo/mo
15343# TODO: for big endian use same code as for little endian
15344#>0	use		\^gettext-object
15345# DEBUG code
15346#>16	ubelong		x		\b, at 0x%x translation table
15347#>(16.L)		ubelong	x		0x%x chars
15348#>>&0		ubelong	x		at 0x%x
15349# unexpected value HERE!
15350#>>>(&-4)	ubequad	x		0x%llx
15351#
15352>4	beshort		x		revision %d.
15353>6	beshort		>0		\b%d,
15354>>8	belong		x		%d messages,
15355>>36	belong		x		%d sysdep messages
15356>6	beshort		=0		\b%d,
15357>>8	belong		x		%d messages
15358
15359
15360# GnuPG
15361# The format is very similar to pgp
153620	string          \001gpg                 GPG key trust database
15363>4	byte            x                       version %d
15364# Note: magic.mime had 0x8501 for the next line instead of 0x8502
153650	beshort		0x8502			GPG encrypted data
15366!:mime	text/PGP # encoding: data
15367
15368# Update: Joerg Jenderek
15369# Note:	PGP and GPG use same data structure.
15370#	So recognition is now done by ./pgp with start test for byte 0x99
15371# This magic is not particularly good, as the keyrings don't have true
15372# magic. Nevertheless, it covers many keyrings.
15373# 0	ubeshort-0x9901	<2
15374# >3	byte		4
15375# >>4	bedate		x		GPG key public ring, created %s
15376# !:mime application/x-gnupg-keyring
15377
15378# Symmetric encryption
153790	leshort		0x0d8c
15380>4	leshort		0x0203
15381>>2	leshort		0x0204		GPG symmetrically encrypted data (3DES cipher)
15382>>2	leshort		0x0304		GPG symmetrically encrypted data (CAST5 cipher)
15383>>2	leshort		0x0404		GPG symmetrically encrypted data (BLOWFISH cipher)
15384>>2	leshort		0x0704		GPG symmetrically encrypted data (AES cipher)
15385>>2	leshort		0x0804		GPG symmetrically encrypted data (AES192 cipher)
15386>>2	leshort		0x0904		GPG symmetrically encrypted data (AES256 cipher)
15387>>2	leshort		0x0a04		GPG symmetrically encrypted data (TWOFISH cipher)
15388>>2	leshort		0x0b04		GPG symmetrically encrypted data (CAMELLIA128 cipher)
15389>>2	leshort		0x0c04		GPG symmetrically encrypted data (CAMELLIA192 cipher)
15390>>2	leshort		0x0d04		GPG symmetrically encrypted data (CAMELLIA256 cipher)
15391
15392
15393# GnuPG Keybox file
15394# <https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=kbx/keybox-blob.c;hb=HEAD>
15395# From: Philipp Hahn <hahn@univention.de>
153960	belong	32
15397>4	byte	1
15398>>8	string	KBXf	GPG keybox database
15399>>>5	byte	1	version %d
15400>>>16	bedate	x	\b, created-at %s
15401>>>20	bedate	x	\b, last-maintained %s
15402
15403
15404# From: James Youngman <jay@gnu.org>
15405# gnu find magic
154060	string	\0LOCATE	GNU findutils locate database data
15407>7	string	>\0		\b, format %s
15408>7	string	02		\b (frcode)
15409
15410# Files produced by GNU gettext
15411
15412# gettext message catalogue
154130	search/1024	\nmsgid
15414>&0	search/1024	\nmsgstr	GNU gettext message catalogue text
15415!:strength +100
15416!:mime text/x-po
15417
15418#------------------------------------------------------------------------------
15419# $File: gnumeric,v 1.4 2009/09/19 16:28:09 christos Exp $
15420# gnumeric:  file(1) magic for Gnumeric spreadsheet
15421# This entry is only semi-helpful, as Gnumeric compresses its files, so
15422# they will ordinarily reported as "compressed", but at least -z helps
1542339	string	=<gmr:Workbook	Gnumeric spreadsheet
15424!:mime	application/x-gnumeric
15425
15426#------------------------------------------------------------------------------
15427# $File: gpt,v 1.5 2020/12/12 20:01:47 christos Exp $
15428#
15429# GPT Partition table patterns.
15430# Author: Rogier Goossens (goossens.rogier@gmail.com)
15431# Note that a GPT-formatted disk must contain an MBR as well.
15432#
15433
15434# The initial segment (up to >>>>>>>>422) was copied from the X86
15435# partition table code (aka MBR).
15436# This is kept separate, so that MBR partitions are not reported as well.
15437# (use -k if you do want them as well)
15438
15439# First, detect the MBR partition table
15440# If more than one GPT protective MBR partition exists, don't print anything
15441# (the other MBR detection code will then just print the MBR partition table)
154420x1FE			leshort		0xAA55
15443>3			string		!MS
15444>>3			string		!SYSLINUX
15445>>>3			string		!MTOOL
15446>>>>3			string		!NEWLDR
15447>>>>>5			string		!DOS
15448# not FAT (32 bit)
15449>>>>>>82		string		!FAT32
15450#not Linux kernel
15451>>>>>>>514		string		!HdrS
15452#not BeOS
15453>>>>>>>>422		string		!Be\ Boot\ Loader
15454# GPT with protective MBR entry in partition 1 (only)
15455>>>>>>>>>450		ubyte		0xee
15456>>>>>>>>>>466		ubyte		!0xee
15457>>>>>>>>>>>482		ubyte		!0xee
15458>>>>>>>>>>>>498		ubyte		!0xee
15459#>>>>>>>>>>>>>446	use		gpt-mbr-partition
15460>>>>>>>>>>>>>(454.l*8192)	string		EFI\ PART	GPT partition table
15461>>>>>>>>>>>>>>0			use		gpt-mbr-type
15462>>>>>>>>>>>>>>&-8		use		gpt-table
15463>>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes
15464>>>>>>>>>>>>>(454.l*8192)	string		!EFI\ PART
15465>>>>>>>>>>>>>>(454.l*4096)	string		EFI\ PART	GPT partition table
15466>>>>>>>>>>>>>>>0		use		gpt-mbr-type
15467>>>>>>>>>>>>>>>&-8		use		gpt-table
15468>>>>>>>>>>>>>>>0		ubyte		x		of 4096 bytes
15469>>>>>>>>>>>>>>(454.l*4096)	string		!EFI\ PART
15470>>>>>>>>>>>>>>>(454.l*2048)	string		EFI\ PART	GPT partition table
15471>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
15472>>>>>>>>>>>>>>>>&-8		use		gpt-table
15473>>>>>>>>>>>>>>>>0		ubyte		x		of 2048 bytes
15474>>>>>>>>>>>>>>>(454.l*2048)	string		!EFI\ PART
15475>>>>>>>>>>>>>>>>(454.l*1024)	string		EFI\ PART	GPT partition table
15476>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
15477>>>>>>>>>>>>>>>>>&-8		use		gpt-table
15478>>>>>>>>>>>>>>>>>0		ubyte		x		of 1024 bytes
15479>>>>>>>>>>>>>>>>(454.l*1024)	string		!EFI\ PART
15480>>>>>>>>>>>>>>>>>(454.l*512)	string		EFI\ PART	GPT partition table
15481>>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
15482>>>>>>>>>>>>>>>>>>&-8		use		gpt-table
15483>>>>>>>>>>>>>>>>>>0		ubyte		x		of 512 bytes
15484# GPT with protective MBR entry in partition 2 (only)
15485>>>>>>>>>450		ubyte		!0xee
15486>>>>>>>>>>466		ubyte		0xee
15487>>>>>>>>>>>482		ubyte		!0xee
15488>>>>>>>>>>>>498		ubyte		!0xee
15489#>>>>>>>>>>>>>462	use		gpt-mbr-partition
15490>>>>>>>>>>>>>(470.l*8192)	string		EFI\ PART	GPT partition table
15491>>>>>>>>>>>>>>0			use		gpt-mbr-type
15492>>>>>>>>>>>>>>&-8		use		gpt-table
15493>>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes
15494>>>>>>>>>>>>>(470.l*8192)	string		!EFI\ PART
15495>>>>>>>>>>>>>>(470.l*4096)	string		EFI\ PART	GPT partition table
15496>>>>>>>>>>>>>>>0		use		gpt-mbr-type
15497>>>>>>>>>>>>>>>&-8		use		gpt-table
15498>>>>>>>>>>>>>>>0		ubyte		x		of 4096 bytes
15499>>>>>>>>>>>>>>(470.l*4096)	string		!EFI\ PART
15500>>>>>>>>>>>>>>>(470.l*2048)	string		EFI\ PART	GPT partition table
15501>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
15502>>>>>>>>>>>>>>>>&-8		use		gpt-table
15503>>>>>>>>>>>>>>>>0		ubyte		x		of 2048 bytes
15504>>>>>>>>>>>>>>>(470.l*2048)	string		!EFI\ PART
15505>>>>>>>>>>>>>>>>(470.l*1024)	string		EFI\ PART	GPT partition table
15506>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
15507>>>>>>>>>>>>>>>>>&-8		use		gpt-table
15508>>>>>>>>>>>>>>>>>0		ubyte		x		of 1024 bytes
15509>>>>>>>>>>>>>>>>(470.l*1024)	string		!EFI\ PART
15510>>>>>>>>>>>>>>>>>(470.l*512)	string		EFI\ PART	GPT partition table
15511>>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
15512>>>>>>>>>>>>>>>>>>&-8		use		gpt-table
15513>>>>>>>>>>>>>>>>>>0		ubyte		x		of 512 bytes
15514# GPT with protective MBR entry in partition 3 (only)
15515>>>>>>>>>450		ubyte		!0xee
15516>>>>>>>>>>466		ubyte		!0xee
15517>>>>>>>>>>>482		ubyte		0xee
15518>>>>>>>>>>>>498		ubyte		!0xee
15519#>>>>>>>>>>>>>478	use		gpt-mbr-partition
15520>>>>>>>>>>>>>(486.l*8192)	string		EFI\ PART	GPT partition table
15521>>>>>>>>>>>>>>0			use		gpt-mbr-type
15522>>>>>>>>>>>>>>&-8		use		gpt-table
15523>>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes
15524>>>>>>>>>>>>>(486.l*8192)	string		!EFI\ PART
15525>>>>>>>>>>>>>>(486.l*4096)	string		EFI\ PART	GPT partition table
15526>>>>>>>>>>>>>>>0		use		gpt-mbr-type
15527>>>>>>>>>>>>>>>&-8		use		gpt-table
15528>>>>>>>>>>>>>>>0		ubyte		x		of 4096 bytes
15529>>>>>>>>>>>>>>(486.l*4096)	string		!EFI\ PART
15530>>>>>>>>>>>>>>>(486.l*2048)	string		EFI\ PART	GPT partition table
15531>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
15532>>>>>>>>>>>>>>>>&-8		use		gpt-table
15533>>>>>>>>>>>>>>>>0		ubyte		x		of 2048 bytes
15534>>>>>>>>>>>>>>>(486.l*2048)	string		!EFI\ PART
15535>>>>>>>>>>>>>>>>(486.l*1024)	string		EFI\ PART	GPT partition table
15536>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
15537>>>>>>>>>>>>>>>>>&-8		use		gpt-table
15538>>>>>>>>>>>>>>>>>0		ubyte		x		of 1024 bytes
15539>>>>>>>>>>>>>>>>(486.l*1024)	string		!EFI\ PART
15540>>>>>>>>>>>>>>>>>(486.l*512)	string		EFI\ PART	GPT partition table
15541>>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
15542>>>>>>>>>>>>>>>>>>&-8		use		gpt-table
15543>>>>>>>>>>>>>>>>>>0		ubyte		x		of 512 bytes
15544# GPT with protective MBR entry in partition 4 (only)
15545>>>>>>>>>450		ubyte		!0xee
15546>>>>>>>>>>466		ubyte		!0xee
15547>>>>>>>>>>>482		ubyte		!0xee
15548>>>>>>>>>>>>498		ubyte		0xee
15549#>>>>>>>>>>>>>494	use		gpt-mbr-partition
15550>>>>>>>>>>>>>(502.l*8192)	string		EFI\ PART	GPT partition table
15551>>>>>>>>>>>>>>0			use		gpt-mbr-type
15552>>>>>>>>>>>>>>&-8		use		gpt-table
15553>>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes
15554>>>>>>>>>>>>>(502.l*8192)	string		!EFI\ PART
15555>>>>>>>>>>>>>>(502.l*4096)	string		EFI\ PART	GPT partition table
15556>>>>>>>>>>>>>>>0		use		gpt-mbr-type
15557>>>>>>>>>>>>>>>&-8		use		gpt-table
15558>>>>>>>>>>>>>>>0		ubyte		x		of 4096 bytes
15559>>>>>>>>>>>>>>(502.l*4096)	string		!EFI\ PART
15560>>>>>>>>>>>>>>>(502.l*2048)	string		EFI\ PART	GPT partition table
15561>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
15562>>>>>>>>>>>>>>>>&-8		use		gpt-table
15563>>>>>>>>>>>>>>>>0		ubyte		x		of 2048 bytes
15564>>>>>>>>>>>>>>>(502.l*2048)	string		!EFI\ PART
15565>>>>>>>>>>>>>>>>(502.l*1024)	string		EFI\ PART	GPT partition table
15566>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
15567>>>>>>>>>>>>>>>>>&-8		use		gpt-table
15568>>>>>>>>>>>>>>>>>0		ubyte		x		of 1024 bytes
15569>>>>>>>>>>>>>>>>(502.l*1024)	string		!EFI\ PART
15570>>>>>>>>>>>>>>>>>(502.l*512)	string		EFI\ PART	GPT partition table
15571>>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
15572>>>>>>>>>>>>>>>>>>&-8		use		gpt-table
15573>>>>>>>>>>>>>>>>>>0		ubyte		x		of 512 bytes
15574
15575# The following code does GPT detection and processing, including
15576# sector size detection.
15577# It has to be duplicated above because the top-level pattern
15578# (i.e. not called using 'use') must print *something* for file
15579# to count it as a match. Text only printed in named patterns is
15580# not counted, and causes file to continue, and try and match
15581# other patterns.
15582#
15583# Unfortunately, when assuming sector sizes >=16k, if the sector size
15584# happens to be 512 instead, we may find confusing data after the GPT
15585# table...  If the GPT table has less than 128 entries, this may even
15586# happen for assumed sector sizes as small as 4k
15587# This could be solved by checking for the presence of the backup GPT
15588# header as well, but that makes the logic extremely complex
15589##0		name		gpt-mbr-partition
15590##>(8.l*8192)	string		EFI\ PART
15591##>>(8.l*8192)	use		gpt-mbr-type
15592##>>&-8		use		gpt-table
15593##>>0		ubyte		x		of 8192 bytes
15594##>(8.l*8192)	string		!EFI\ PART
15595##>>(8.l*4096)	string		EFI\ PART	GPT partition table
15596##>>>0		use		gpt-mbr-type
15597##>>>&-8		use		gpt-table
15598##>>>0		ubyte		x		of 4096 bytes
15599##>>(8.l*4096)	string		!EFI\ PART
15600##>>>(8.l*2048)	string		EFI\ PART	GPT partition table
15601##>>>>0		use		gpt-mbr-type
15602##>>>>&-8		use		gpt-table
15603##>>>>0		ubyte		x		of 2048 bytes
15604##>>>(8.l*2048)	string		!EFI\ PART
15605##>>>>(8.l*1024)	string		EFI\ PART	GPT partition table
15606##>>>>>0		use		gpt-mbr-type
15607##>>>>>&-8	use		gpt-table
15608##>>>>>0		ubyte		x		of 1024 bytes
15609##>>>>(8.l*1024)	string		!EFI\ PART
15610##>>>>>(8.l*512)	string		EFI\ PART	GPT partition table
15611##>>>>>>0		use		gpt-mbr-type
15612##>>>>>>&-8	use		gpt-table
15613##>>>>>>0		ubyte		x		of 512 bytes
15614
15615# Print details of MBR type for a GPT-disk
15616# Calling code ensures that there is only one 0xee partition.
156170		name		gpt-mbr-type
15618# GPT with protective MBR entry in partition 1
15619>450		ubyte		0xee
15620>>454		ulelong		1
15621>>>462		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	\b (with hybrid MBR)
15622>>454		ulelong		!1													\b (nonstandard: not at LBA 1)
15623# GPT with protective MBR entry in partition 2
15624>466		ubyte		0xee
15625>>470		ulelong		1
15626>>>478		string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
15627>>>>446		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0					\b (with hybrid MBR)
15628>>>478		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	\b (with hybrid MBR)
15629>>470		ulelong		!1									\b (nonstandard: not at LBA 1)
15630# GPT with protective MBR entry in partition 3
15631>482		ubyte		0xee
15632>>486		ulelong		1
15633>>>494		string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
15634>>>>446		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	\b (with hybrid MBR)
15635>>>494		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0					\b (with hybrid MBR)
15636>>486		ulelong		!1									\b (nonstandard: not at LBA 1)
15637# GPT with protective MBR entry in partition 4
15638>498		ubyte		0xee
15639>>502		ulelong		1
15640>>>446		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	\b (with hybrid MBR)
15641>>502		ulelong		!1													\b (nonstandard: not at LBA 1)
15642
15643# Print the information from a GPT partition table structure
156440		name		gpt-table
15645>10		uleshort	x		\b, version %u
15646>8		uleshort	x		\b.%u
15647>56		ulelong		x		\b, GUID: %08x
15648>60		uleshort	x		\b-%04x
15649>62		uleshort	x		\b-%04x
15650>64		ubeshort	x		\b-%04x
15651>66		ubeshort	x		\b-%04x
15652>68		ubelong		x		\b%08x
15653#>80		uleshort	x		\b, %d partition entries
15654>32		ulequad+1	x		\b, disk size: %lld sectors
15655
15656# In case a GPT data-structure is at LBA 0, report it as well
15657# This covers systems which are not GPT-aware, and which show
15658# and allow access to the protective partition. This code will
15659# detect the contents of such a partition.
156600		string		EFI\ PART	GPT data structure (nonstandard: at LBA 0)
15661>0		use		gpt-table
15662>0		ubyte		x		(sector size unknown)
15663
15664
15665
15666#------------------------------------------------------------------------------
15667# $File: gpu,v 1.2 2017/03/23 22:11:53 christos Exp $
15668# gpu: file(1) magic for GPU input files
15669
15670# Standard Portable Intermediate Representation (SPIR)
15671# Documentation: https://www.khronos.org/spir
15672# Typical file extension: .spv
15673
156740	belong	0x07230203	Khronos SPIR-V binary, big-endian
15675>4	belong	x		\b, version 0x%08x
15676>8	belong	x		\b, generator 0x%08x
15677
156780	lelong	0x07230203      Khronos SPIR-V binary, little-endian
15679>4	lelong	x		\b, version 0x%08x
15680>8	lelong	x		\b, generator 0x%08x
15681
15682# Vulkan Trace file
15683# Documentation:
15684# https://github.com/LunarG/VulkanTools/blob/master/vktrace/vktrace_common/\
15685# vktrace_trace_packet_identifiers.h
15686# Typical file extension: .vktrace
15687
156888	lequad  0xABADD068ADEAFD0C	Vulkan trace file, little-endian
15689>0	leshort	x			\b, version %d
15690
156918	bequad  0xABADD068ADEAFD0C	Vulkan trace file, big-endian
15692>0	beshort	x			\b, version %d
15693
15694#------------------------------------------------------------------------------
15695# $File: grace,v 1.4 2009/09/19 16:28:09 christos Exp $
15696# ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
15697#
15698# ACE/gr binary
156990	string	\000\000\0001\000\000\0000\000\000\0000\000\000\0002\000\000\0000\000\000\0000\000\000\0003		old ACE/gr binary file
15700>39	byte	>0			- version %c
15701# ACE/gr ascii
157020	string	#\ xvgr\ parameter\ file	ACE/gr ascii file
157030	string	#\ xmgr\ parameter\ file	ACE/gr ascii file
157040	string	#\ ACE/gr\ parameter\ file	ACE/gr ascii file
15705# Grace projects
157060	string	#\ Grace\ project\ file		Grace project file
15707>23	string	@version\  			(version
15708>>32	byte	>0 				%c
15709>>33	string	>\0 				\b.%.2s
15710>>35	string	>\0 				\b.%.2s)
15711# ACE/gr fit description files
157120	string	#\ ACE/gr\ fit\ description\ 	ACE/gr fit description file
15713# end of ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
15714
15715#------------------------------------------------------------------------------
15716# $File: graphviz,v 1.9 2019/04/30 04:01:40 christos Exp $
15717# graphviz:  file(1) magic for https://www.graphviz.org/
15718
15719# FIXME: These patterns match too generally. For example, the first
15720# line matches a LaTeX file containing the word "graph" (with a {
15721# following later) and the second line matches this file.
15722#0	regex/100l	[\r\n\t\ ]*graph[\r\n\t\ ]+.*\\{	graphviz graph text
15723#!:mime	text/vnd.graphviz
15724#0	regex/100l	[\r\n\t\ ]*digraph[\r\n\t\ ]+.*\\{	graphviz digraph text
15725#!:mime	text/vnd.graphviz
15726
15727#------------------------------------------------------------------------------
15728# $File: gringotts,v 1.6 2017/03/17 21:35:28 christos Exp $
15729# gringotts:  file(1) magic for Gringotts
15730# http://devel.pluto.linux.it/projects/Gringotts/
15731# author: Germano Rizzo <mano@pluto.linux.it>
15732#GRG3????Y
157330	string	GRG		Gringotts data file
15734#file format 1
15735>3	string		1		v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9
15736#file format 2
15737>3	string		2		v.2, MCRYPT S2K,
15738>>8	byte&0x70	0x00		RIJNDAEL-128 crypt,
15739>>8	byte&0x70	0x10		SERPENT crypt,
15740>>8	byte&0x70	0x20		TWOFISH crypt,
15741>>8	byte&0x70	0x30		CAST-256 crypt,
15742>>8	byte&0x70	0x40		SAFER+ crypt,
15743>>8	byte&0x70	0x50		LOKI97 crypt,
15744>>8	byte&0x70	0x60		3DES crypt,
15745>>8	byte&0x70	0x70		RIJNDAEL-256 crypt,
15746>>8	byte&0x08	0x00		SHA1 hash,
15747>>8	byte&0x08	0x08		RIPEMD-160 hash,
15748>>8	byte&0x04	0x00		ZLib
15749>>8	byte&0x04	0x04		BZip2
15750>>8	byte&0x03	0x00		lvl.0
15751>>8	byte&0x03	0x01		lvl.3
15752>>8	byte&0x03	0x02		lvl.6
15753>>8	byte&0x03	0x03		lvl.9
15754#file format 3
15755>3	string		3		v.3, OpenPGP S2K,
15756>>8	byte&0x70	0x00		RIJNDAEL-128 crypt,
15757>>8	byte&0x70	0x10		SERPENT crypt,
15758>>8	byte&0x70	0x20		TWOFISH crypt,
15759>>8	byte&0x70	0x30		CAST-256 crypt,
15760>>8	byte&0x70	0x40		SAFER+ crypt,
15761>>8	byte&0x70	0x50		LOKI97 crypt,
15762>>8	byte&0x70	0x60		3DES crypt,
15763>>8	byte&0x70	0x70		RIJNDAEL-256 crypt,
15764>>8	byte&0x08	0x00		SHA1 hash,
15765>>8	byte&0x08	0x08		RIPEMD-160 hash,
15766>>8	byte&0x04	0x00		ZLib
15767>>8	byte&0x04	0x04		BZip2
15768>>8	byte&0x03	0x00		lvl.0
15769>>8	byte&0x03	0x01		lvl.3
15770>>8	byte&0x03	0x02		lvl.6
15771>>8	byte&0x03	0x03		lvl.9
15772#file format >3
15773>3	string		>3		v.%.1s (unknown details)
15774
15775#------------------------------------------------------------------------------
15776# $File: guile,v 1.2 2019/04/19 00:42:27 christos Exp $
15777# Guile file magic from <dalepsmith@gmail.com>
15778# https://www.gnu.org/s/guile/
15779# https://git.savannah.gnu.org/gitweb/?p=guile.git;f=libguile/_scm.h;hb=HEAD#l250
15780
157810	string	GOOF----	Guile Object
15782>8	string	LE		\b, little endian
15783>8	string	BE		\b, big endian
15784>11	string	4		\b, 32bit
15785>11	string	8		\b, 64bit
15786>13	regex	.\..		\b, bytecode v%s
15787
15788#------------------------------------------------------------------------------
15789# $File: hardware,v 1.1 2018/08/02 06:32:52 christos Exp $
15790# hardware magic
15791
15792# EDID
15793# https://en.wikipedia.org/wiki/Extended_Display_Identification_Data
157940	string		\x00\xFF\xFF\xFF\xFF\xFF\xFF\x00
15795>19	byte		x
15796>>18	byte		x	EDID data, version %u.
15797>>19	byte		x	\b%u
15798#>>17	ubyte+1990	<255	\b, manufactured %u
15799
15800#------------------------------------------------------------------------------
15801# $File: hitachi-sh,v 1.10 2020/12/12 20:01:47 christos Exp $
15802# hitach-sh: file(1) magic for Hitachi Super-H
15803#
15804# Super-H COFF
15805#
15806# updated by Joerg Jenderek at Oct 2015
15807# https://en.wikipedia.org/wiki/COFF
15808# https://de.wikipedia.org/wiki/Common_Object_File_Format
15809# http://www.delorie.com/djgpp/doc/coff/filhdr.html
15810# below test line conflicts with 2nd NTFS filesystem sector
15811# 2nd NTFS filesystem sector often starts with 0x05004e00 for unicode string 5 NTLDR
15812# and Portable Gaming Notation Compressed format (*.WID http://pgn.freeservers.com/)
158130	beshort		0x0500
15814# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags
15815>18	ubeshort&0x8E80	0
15816# use big endian variant of subroutine to display name+variables+flags
15817# for common object formatted files
15818>>0	use				\^display-coff
15819!:strength -10
15820
158210	leshort		0x0550
15822# test for unused flag bits in f_flags
15823>18	uleshort&0x8E80	0
15824# use little endian variant of subroutine to
15825# display name+variables+flags for common object formatted files
15826>>0	use				display-coff
15827!:strength -10
15828
15829
15830#------------------------------------------------------------------------------
15831# $File: hp,v 1.25 2019/01/13 00:32:38 christos Exp $
15832# hp:  file(1) magic for Hewlett Packard machines (see also "printer")
15833#
15834# XXX - somebody should figure out whether any byte order needs to be
15835# applied to the "TML" stuff; I'm assuming the Apollo stuff is
15836# big-endian as it was mostly 68K-based.
15837#
15838# I think the 500 series was the old stack-based machines, running a
15839# UNIX environment atop the "SUN kernel"; dunno whether it was
15840# big-endian or little-endian.
15841#
15842# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based;
15843# hp300 are 68020+68881 based; hp400 are also 68k.  The following basic
15844# HP magic is useful for reference, but using "long" magic is a better
15845# practice in order to avoid collisions.
15846#
15847# Guy Harris (guy@netapp.com): some additions to this list came from
15848# HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1,
15849# 1.2, and 2.0).  The 1.2 and 2.0 stuff isn't in the HP-UX 10.0
15850# "/etc/magic", though, except for the "archive file relocatable library"
15851# stuff, and the 68030 and 68040 stuff isn't there at all - are they not
15852# used in executables, or have they just not yet updated "/etc/magic"
15853# completely?
15854#
15855# 0	beshort		200		hp200 (68010) BSD binary
15856# 0	beshort		300		hp300 (68020+68881) BSD binary
15857# 0	beshort		0x20c		hp200/300 HP-UX binary
15858# 0	beshort		0x20d		hp400 (68030) HP-UX binary
15859# 0	beshort		0x20e		hp400 (68040?) HP-UX binary
15860# 0	beshort		0x20b		PA-RISC1.0 HP-UX binary
15861# 0	beshort		0x210		PA-RISC1.1 HP-UX binary
15862# 0	beshort		0x211		PA-RISC1.2 HP-UX binary
15863# 0	beshort		0x214		PA-RISC2.0 HP-UX binary
15864
15865#
15866# The "misc" stuff needs a byte order; the archives look suspiciously
15867# like the old 177545 archives (0xff65 = 0177545).
15868#
15869#### Old Apollo stuff
158700	beshort		0627		Apollo m68k COFF executable
15871>18	beshort		^040000		not stripped
15872>22	beshort		>0		- version %d
158730	beshort		0624		apollo a88k COFF executable
15874>18	beshort		^040000		not stripped
15875>22	beshort		>0		- version %d
158760       long            01203604016     TML 0123 byte-order format
158770       long            01702407010     TML 1032 byte-order format
158780       long            01003405017     TML 2301 byte-order format
158790       long            01602007412     TML 3210 byte-order format
15880#### PA-RISC 1.1
158810	belong 		0x02100106	PA-RISC1.1 relocatable object
158820	belong 		0x02100107	PA-RISC1.1 executable
15883>168	belong		&0x00000004	dynamically linked
15884>(144)	belong		0x054ef630	dynamically linked
15885>96	belong		>0		- not stripped
15886
158870	belong 		0x02100108	PA-RISC1.1 shared executable
15888>168	belong&0x4	0x4		dynamically linked
15889>(144)	belong		0x054ef630	dynamically linked
15890>96	belong		>0		- not stripped
15891
158920	belong 		0x0210010b	PA-RISC1.1 demand-load executable
15893>168	belong&0x4	0x4		dynamically linked
15894>(144)	belong		0x054ef630	dynamically linked
15895>96	belong		>0		- not stripped
15896
158970	belong 		0x0210010e	PA-RISC1.1 shared library
15898>96	belong		>0		- not stripped
15899
159000	belong 		0x0210010d	PA-RISC1.1 dynamic load library
15901>96	belong		>0		- not stripped
15902
15903#### PA-RISC 2.0
159040	belong		0x02140106	PA-RISC2.0 relocatable object
15905
159060       belong		0x02140107	PA-RISC2.0 executable
15907>168	belong		&0x00000004	dynamically linked
15908>(144)	belong		0x054ef630	dynamically linked
15909>96	belong		>0		- not stripped
15910
159110       belong		0x02140108	PA-RISC2.0 shared executable
15912>168	belong		&0x00000004	dynamically linked
15913>(144)	belong		0x054ef630	dynamically linked
15914>96	belong		>0		- not stripped
15915
159160       belong		0x0214010b	PA-RISC2.0 demand-load executable
15917>168	belong		&0x00000004	dynamically linked
15918>(144)	belong		0x054ef630	dynamically linked
15919>96	belong		>0		- not stripped
15920
159210       belong		0x0214010e	PA-RISC2.0 shared library
15922>96	belong		>0		- not stripped
15923
159240       belong		0x0214010d	PA-RISC2.0 dynamic load library
15925>96	belong		>0		- not stripped
15926
15927#### 800
159280	belong 		0x020b0106	PA-RISC1.0 relocatable object
15929
159300	belong 		0x020b0107	PA-RISC1.0 executable
15931>168	belong&0x4	0x4		dynamically linked
15932>(144)	belong		0x054ef630	dynamically linked
15933>96	belong		>0		- not stripped
15934
159350	belong 		0x020b0108	PA-RISC1.0 shared executable
15936>168	belong&0x4	0x4		dynamically linked
15937>(144)	belong		0x054ef630	dynamically linked
15938>96	belong		>0		- not stripped
15939
159400	belong 		0x020b010b	PA-RISC1.0 demand-load executable
15941>168	belong&0x4	0x4		dynamically linked
15942>(144)	belong		0x054ef630	dynamically linked
15943>96	belong		>0		- not stripped
15944
159450	belong 		0x020b010e	PA-RISC1.0 shared library
15946>96	belong		>0		- not stripped
15947
159480	belong 		0x020b010d	PA-RISC1.0 dynamic load library
15949>96	belong		>0		- not stripped
15950
15951#### 500
159520	long		0x02080106	HP s500 relocatable executable
15953>16	long		>0		- version %d
15954
159550	long		0x02080107	HP s500 executable
15956>16	long		>0		- version %d
15957
159580	long		0x02080108	HP s500 pure executable
15959>16	long		>0		- version %d
15960
15961#### 200
159620	belong 		0x020c0108	HP s200 pure executable
15963>4	beshort		>0		- version %d
15964>8	belong		&0x80000000	save fp regs
15965>8	belong		&0x40000000	dynamically linked
15966>8	belong		&0x20000000	debuggable
15967>36	belong		>0		not stripped
15968
159690	belong		0x020c0107	HP s200 executable
15970>4	beshort		>0		- version %d
15971>8	belong		&0x80000000	save fp regs
15972>8	belong		&0x40000000	dynamically linked
15973>8	belong		&0x20000000	debuggable
15974>36	belong		>0		not stripped
15975
159760	belong		0x020c010b	HP s200 demand-load executable
15977>4	beshort		>0		- version %d
15978>8	belong		&0x80000000	save fp regs
15979>8	belong		&0x40000000	dynamically linked
15980>8	belong		&0x20000000	debuggable
15981>36	belong		>0		not stripped
15982
159830	belong		0x020c0106	HP s200 relocatable executable
15984>4	beshort		>0		- version %d
15985>6	beshort		>0		- highwater %d
15986>8	belong		&0x80000000	save fp regs
15987>8	belong		&0x20000000	debuggable
15988>8	belong		&0x10000000	PIC
15989
159900	belong 		0x020a0108	HP s200 (2.x release) pure executable
15991>4	beshort		>0		- version %d
15992>36	belong		>0		not stripped
15993
159940	belong		0x020a0107	HP s200 (2.x release) executable
15995>4	beshort		>0		- version %d
15996>36	belong		>0		not stripped
15997
159980	belong		0x020c010e	HP s200 shared library
15999>4	beshort		>0		- version %d
16000>6	beshort		>0		- highwater %d
16001>36	belong		>0		not stripped
16002
160030	belong		0x020c010d	HP s200 dynamic load library
16004>4	beshort		>0		- version %d
16005>6	beshort		>0		- highwater %d
16006>36	belong		>0		not stripped
16007
16008#### MISC
160090	long		0x0000ff65	HP old archive
160100	long		0x020aff65	HP s200 old archive
160110	long		0x020cff65	HP s200 old archive
160120	long		0x0208ff65	HP s500 old archive
16013
160140	long		0x015821a6	HP core file
16015
160160	long		0x4da7eee8	HP-WINDOWS font
16017>8	byte		>0		- version %d
160180	string		Bitmapfile	HP Bitmapfile
16019
160200	string		IMGfile	CIS 	compimg HP Bitmapfile
16021# XXX - see "lif"
16022#0	short		0x8000		lif file
160230	long		0x020c010c	compiled Lisp
16024
160250	string		msgcat01	HP NLS message catalog,
16026>8	long		>0		%d messages
16027
16028# Summary: HP-48/49 calculator
16029# Created by: phk@data.fls.dk
16030# Modified by (1): AMAKAWA Shuhei <sa264@cam.ac.uk>
16031# Modified by (2): Samuel Thibault <samuel.thibault@ens-lyon.org> (HP49 support)
160320	string		HPHP		HP
16033>4	string		48		48 binary
16034>4	string		49		49 binary
16035>7	byte		>64		- Rev %c
16036>8	leshort		0x2911		(ADR)
16037>8	leshort		0x2933		(REAL)
16038>8	leshort		0x2955		(LREAL)
16039>8	leshort		0x2977		(COMPLX)
16040>8	leshort		0x299d		(LCOMPLX)
16041>8	leshort		0x29bf		(CHAR)
16042>8	leshort		0x29e8		(ARRAY)
16043>8	leshort		0x2a0a		(LNKARRAY)
16044>8	leshort		0x2a2c		(STRING)
16045>8	leshort		0x2a4e		(HXS)
16046>8	leshort		0x2a74		(LIST)
16047>8	leshort		0x2a96		(DIR)
16048>8	leshort		0x2ab8		(ALG)
16049>8	leshort		0x2ada		(UNIT)
16050>8	leshort		0x2afc		(TAGGED)
16051>8	leshort		0x2b1e		(GROB)
16052>8	leshort		0x2b40		(LIB)
16053>8	leshort		0x2b62		(BACKUP)
16054>8	leshort		0x2b88		(LIBDATA)
16055>8	leshort		0x2d9d		(PROG)
16056>8	leshort		0x2dcc		(CODE)
16057>8	leshort		0x2e48		(GNAME)
16058>8	leshort		0x2e6d		(LNAME)
16059>8	leshort		0x2e92		(XLIB)
16060
160610	string		%%HP:		HP text
16062>6	string		T(0)		- T(0)
16063>6	string		T(1)		- T(1)
16064>6	string		T(2)		- T(2)
16065>6	string		T(3)		- T(3)
16066>10	string		A(D)		A(D)
16067>10	string		A(R)		A(R)
16068>10	string		A(G)		A(G)
16069>14	string		F(.)		F(.);
16070>14	string		F(,)		F(,);
16071
16072
16073# Summary: HP-38/39 calculator
16074# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org>
160750	string		HP3
16076>3	string		8		HP 38
16077>3	string		9		HP 39
16078>4	string		Bin		binary
16079>4	string		Asc		ASCII
16080>7	string		A		(Directory List)
16081>7	string		B		(Zaplet)
16082>7	string		C		(Note)
16083>7	string		D		(Program)
16084>7	string		E		(Variable)
16085>7	string		F		(List)
16086>7	string		G		(Matrix)
16087>7	string		H		(Library)
16088>7	string		I		(Target List)
16089>7	string		J		(ASCII Vector specification)
16090>7	string		K		(wildcard)
16091
16092# Summary: HP-38/39 calculator
16093# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org>
160940	string		HP3
16095>3	string		8		HP 38
16096>3	string		9		HP 39
16097>4	string		Bin		binary
16098>4	string		Asc		ASCII
16099>7	string		A		(Directory List)
16100>7	string		B		(Zaplet)
16101>7	string		C		(Note)
16102>7	string		D		(Program)
16103>7	string		E		(Variable)
16104>7	string		F		(List)
16105>7	string		G		(Matrix)
16106>7	string		H		(Library)
16107>7	string		I		(Target List)
16108>7	string		J		(ASCII Vector specification)
16109>7	string		K		(wildcard)
16110
16111# hpBSD magic numbers
161120	beshort		200		hp200 (68010) BSD
16113>2	beshort		0407		impure binary
16114>2	beshort		0410		read-only binary
16115>2	beshort		0413		demand paged binary
161160	beshort		300		hp300 (68020+68881) BSD
16117>2	beshort		0407		impure binary
16118>2	beshort		0410		read-only binary
16119>2	beshort		0413		demand paged binary
16120#
16121# From David Gero <dgero@nortelnetworks.com>
16122# HP-UX 10.20 core file format from /usr/include/sys/core.h
16123# Unfortunately, HP-UX uses corehead blocks without specifying the order
16124# There are four we care about:
16125#     CORE_KERNEL, which starts with the string "HP-UX"
16126#     CORE_EXEC, which contains the name of the command
16127#     CORE_PROC, which contains the signal number that caused the core dump
16128#     CORE_FORMAT, which contains the version of the core file format (== 1)
16129# The only observed order in real core files is KERNEL, EXEC, FORMAT, PROC
16130# but we include all 6 variations of the order of the first 3, and
16131# assume that PROC will always be last
16132# Order 1: KERNEL, EXEC, FORMAT, PROC
161330x10		string	HP-UX
16134>0		belong	2
16135>>0xC		belong	0x3C
16136>>>0x4C		belong	0x100
16137>>>>0x58	belong	0x44
16138>>>>>0xA0	belong	1
16139>>>>>>0xAC	belong	4
16140>>>>>>>0xB0	belong	1
16141>>>>>>>>0xB4	belong	4		core file
16142>>>>>>>>>0x90	string	>\0		from '%s'
16143>>>>>>>>>0xC4	belong	3		- received SIGQUIT
16144>>>>>>>>>0xC4	belong	4		- received SIGILL
16145>>>>>>>>>0xC4	belong	5		- received SIGTRAP
16146>>>>>>>>>0xC4	belong	6		- received SIGABRT
16147>>>>>>>>>0xC4	belong	7		- received SIGEMT
16148>>>>>>>>>0xC4	belong	8		- received SIGFPE
16149>>>>>>>>>0xC4	belong	10		- received SIGBUS
16150>>>>>>>>>0xC4	belong	11		- received SIGSEGV
16151>>>>>>>>>0xC4	belong	12		- received SIGSYS
16152>>>>>>>>>0xC4	belong	33		- received SIGXCPU
16153>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
16154# Order 2: KERNEL, FORMAT, EXEC, PROC
16155>>>0x4C		belong	1
16156>>>>0x58	belong	4
16157>>>>>0x5C	belong	1
16158>>>>>>0x60	belong	0x100
16159>>>>>>>0x6C	belong	0x44
16160>>>>>>>>0xB4	belong	4		core file
16161>>>>>>>>>0xA4	string	>\0		from '%s'
16162>>>>>>>>>0xC4	belong	3		- received SIGQUIT
16163>>>>>>>>>0xC4	belong	4		- received SIGILL
16164>>>>>>>>>0xC4	belong	5		- received SIGTRAP
16165>>>>>>>>>0xC4	belong	6		- received SIGABRT
16166>>>>>>>>>0xC4	belong	7		- received SIGEMT
16167>>>>>>>>>0xC4	belong	8		- received SIGFPE
16168>>>>>>>>>0xC4	belong	10		- received SIGBUS
16169>>>>>>>>>0xC4	belong	11		- received SIGSEGV
16170>>>>>>>>>0xC4	belong	12		- received SIGSYS
16171>>>>>>>>>0xC4	belong	33		- received SIGXCPU
16172>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
16173# Order 3: FORMAT, KERNEL, EXEC, PROC
161740x24		string	HP-UX
16175>0		belong	1
16176>>0xC		belong	4
16177>>>0x10		belong	1
16178>>>>0x14	belong	2
16179>>>>>0x20	belong	0x3C
16180>>>>>>0x60	belong	0x100
16181>>>>>>>0x6C	belong	0x44
16182>>>>>>>>0xB4	belong	4		core file
16183>>>>>>>>>0xA4	string	>\0		from '%s'
16184>>>>>>>>>0xC4	belong	3		- received SIGQUIT
16185>>>>>>>>>0xC4	belong	4		- received SIGILL
16186>>>>>>>>>0xC4	belong	5		- received SIGTRAP
16187>>>>>>>>>0xC4	belong	6		- received SIGABRT
16188>>>>>>>>>0xC4	belong	7		- received SIGEMT
16189>>>>>>>>>0xC4	belong	8		- received SIGFPE
16190>>>>>>>>>0xC4	belong	10		- received SIGBUS
16191>>>>>>>>>0xC4	belong	11		- received SIGSEGV
16192>>>>>>>>>0xC4	belong	12		- received SIGSYS
16193>>>>>>>>>0xC4	belong	33		- received SIGXCPU
16194>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
16195# Order 4: EXEC, KERNEL, FORMAT, PROC
161960x64		string	HP-UX
16197>0		belong	0x100
16198>>0xC		belong	0x44
16199>>>0x54		belong	2
16200>>>>0x60	belong	0x3C
16201>>>>>0xA0	belong	1
16202>>>>>>0xAC	belong	4
16203>>>>>>>0xB0	belong	1
16204>>>>>>>>0xB4	belong	4		core file
16205>>>>>>>>>0x44	string	>\0		from '%s'
16206>>>>>>>>>0xC4	belong	3		- received SIGQUIT
16207>>>>>>>>>0xC4	belong	4		- received SIGILL
16208>>>>>>>>>0xC4	belong	5		- received SIGTRAP
16209>>>>>>>>>0xC4	belong	6		- received SIGABRT
16210>>>>>>>>>0xC4	belong	7		- received SIGEMT
16211>>>>>>>>>0xC4	belong	8		- received SIGFPE
16212>>>>>>>>>0xC4	belong	10		- received SIGBUS
16213>>>>>>>>>0xC4	belong	11		- received SIGSEGV
16214>>>>>>>>>0xC4	belong	12		- received SIGSYS
16215>>>>>>>>>0xC4	belong	33		- received SIGXCPU
16216>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
16217# Order 5: FORMAT, EXEC, KERNEL, PROC
162180x78		string	HP-UX
16219>0		belong	1
16220>>0xC		belong	4
16221>>>0x10		belong	1
16222>>>>0x14	belong	0x100
16223>>>>>0x20	belong	0x44
16224>>>>>>0x68	belong	2
16225>>>>>>>0x74	belong	0x3C
16226>>>>>>>>0xB4	belong	4		core file
16227>>>>>>>>>0x58	string	>\0		from '%s'
16228>>>>>>>>>0xC4	belong	3		- received SIGQUIT
16229>>>>>>>>>0xC4	belong	4		- received SIGILL
16230>>>>>>>>>0xC4	belong	5		- received SIGTRAP
16231>>>>>>>>>0xC4	belong	6		- received SIGABRT
16232>>>>>>>>>0xC4	belong	7		- received SIGEMT
16233>>>>>>>>>0xC4	belong	8		- received SIGFPE
16234>>>>>>>>>0xC4	belong	10		- received SIGBUS
16235>>>>>>>>>0xC4	belong	11		- received SIGSEGV
16236>>>>>>>>>0xC4	belong	12		- received SIGSYS
16237>>>>>>>>>0xC4	belong	33		- received SIGXCPU
16238>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
16239# Order 6: EXEC, FORMAT, KERNEL, PROC
16240>0		belong	0x100
16241>>0xC		belong	0x44
16242>>>0x54		belong	1
16243>>>>0x60	belong	4
16244>>>>>0x64	belong	1
16245>>>>>>0x68	belong	2
16246>>>>>>>0x74	belong	0x2C
16247>>>>>>>>0xB4	belong	4		core file
16248>>>>>>>>>0x44	string	>\0		from '%s'
16249>>>>>>>>>0xC4	belong	3		- received SIGQUIT
16250>>>>>>>>>0xC4	belong	4		- received SIGILL
16251>>>>>>>>>0xC4	belong	5		- received SIGTRAP
16252>>>>>>>>>0xC4	belong	6		- received SIGABRT
16253>>>>>>>>>0xC4	belong	7		- received SIGEMT
16254>>>>>>>>>0xC4	belong	8		- received SIGFPE
16255>>>>>>>>>0xC4	belong	10		- received SIGBUS
16256>>>>>>>>>0xC4	belong	11		- received SIGSEGV
16257>>>>>>>>>0xC4	belong	12		- received SIGSYS
16258>>>>>>>>>0xC4	belong	33		- received SIGXCPU
16259>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
16260
16261
16262
16263#------------------------------------------------------------------------------
16264# $File: human68k,v 1.5 2009/09/19 16:28:09 christos Exp $
16265# human68k:  file(1) magic for Human68k (X680x0 DOS) binary formats
16266# Magic too short!
16267#0		string	HU		Human68k
16268#>68		string	LZX		LZX compressed
16269#>>72		string	>\0		(version %s)
16270#>(8.L+74)	string	LZX		LZX compressed
16271#>>(8.L+78)	string	>\0		(version %s)
16272#>60		belong	>0		binded
16273#>(8.L+66)	string	#HUPAIR		hupair
16274#>0		string	HU		X executable
16275#>(8.L+74)	string	#LIBCV1		- linked PD LIBC ver 1
16276#>4		belong	>0		- base address 0x%x
16277#>28		belong	>0		not stripped
16278#>32		belong	>0		with debug information
16279#0		beshort	0x601a		Human68k Z executable
16280#0		beshort	0x6000		Human68k object file
16281#0		belong	0xd1000000	Human68k ar binary archive
16282#0		belong	0xd1010000	Human68k ar ascii archive
16283#0		beshort	0x0068		Human68k lib archive
16284#4		string	LZX		Human68k LZX compressed
16285#>8		string	>\0		(version %s)
16286#>4		string	LZX		R executable
16287#2		string	#HUPAIR		Human68k hupair R executable
16288
16289#------------------------------------------------------------------------------
16290# $File: ibm370,v 1.11 2021/03/14 16:51:45 christos Exp $
16291# ibm370:  file(1) magic for IBM 370 and compatibles.
16292#
16293# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
16294# What the heck *is* "USS/370"?
16295# AIX 4.1's "/etc/magic" has
16296#
16297#	0	short		0535		370 sysV executable
16298#	>12	long		>0		not stripped
16299#	>22	short		>0		- version %d
16300#	>30	long		>0		- 5.2 format
16301#	0	short		0530		370 sysV pure executable
16302#	>12	long		>0		not stripped
16303#	>22	short		>0		- version %d
16304#	>30	long		>0		- 5.2 format
16305#
16306# instead of the "USS/370" versions of the same magic numbers.
16307#
163080	beshort		0537		370 XA sysV executable
16309>12	belong		>0		not stripped
16310>22	beshort		>0		- version %d
16311>30	belong		>0		- 5.2 format
163120	beshort		0532		370 XA sysV pure executable
16313>12	belong		>0		not stripped
16314>22	beshort		>0		- version %d
16315>30	belong		>0		- 5.2 format
163160	beshort		054001		370 sysV pure executable
16317>12	belong		>0		not stripped
163180	beshort		055001		370 XA sysV pure executable
16319>12	belong		>0		not stripped
163200	beshort		056401		370 sysV executable
16321>12	belong		>0		not stripped
163220	beshort		057401		370 XA sysV executable
16323>12	belong		>0		not stripped
163240       beshort		0531		SVR2 executable (Amdahl-UTS)
16325>12	belong		>0		not stripped
16326>24     belong		>0		- version %d
163270	beshort		0534		SVR2 pure executable (Amdahl-UTS)
16328>12	belong		>0		not stripped
16329>24	belong		>0		- version %d
163300	beshort		0530		SVR2 pure executable (USS/370)
16331>12	belong		>0		not stripped
16332>24	belong		>0		- version %d
163330	beshort		0535		SVR2 executable (USS/370)
16334>12	belong		>0		not stripped
16335>24	belong		>0		- version %d
16336
16337# NETDATA (https://en.wikipedia.org/wiki/NETDATA)
16338#	-\INMR01 In EBCDIC
163390	string 		\x60\xe0\xc9\xd5\xd4\xd9\xf0\xf1	IBM NETDATA file
16340
16341#------------------------------------------------------------------------------
16342# $File: ibm6000,v 1.14 2019/03/07 17:21:54 christos Exp $
16343# ibm6000:  file(1) magic for RS/6000 and the RT PC.
16344#
163450	beshort		0x01df		executable (RISC System/6000 V3.1) or obj module
16346>12	belong		>0		not stripped
16347# Breaks sun4 statically linked execs.
16348#0      beshort		0x0103		executable (RT Version 2) or obj module
16349#>2	byte		0x50		pure
16350#>28	belong		>0		not stripped
16351#>6	beshort		>0		- version %ld
163520	beshort		0x0104		shared library
163530	beshort		0x0105		ctab data
163540	beshort		0xfe04		structured file
163550	string		0xabcdef	AIX message catalog
163560	belong		0x000001f9	AIX compiled message catalog
163570	string		\<aiaff>	archive
163580	string		\<bigaf>	archive (big format)
163590	belong		0x09006bea	AIX backup/restore format file
163600	belong		0x09006fea	AIX backup/restore format file
16361
163620	beshort		0x01f7		64-bit XCOFF executable or object module
16363>20	belong		0		not stripped
16364# GRR: this test is still too general as it catches also many FATs of DOS filesystems
163654	belong		&0x0feeddb0
16366# real core dump could not be 32-bit and 64-bit together
16367>7	byte&0x03	!3		AIX core file
16368>>1	byte		&0x01		fulldump
16369>>7	byte		&0x01		32-bit
16370>>>0x6e0	string	>\0		\b, %s
16371>>7	byte		&0x02		64-bit
16372>>>0x524	string	>\0		\b, %s
16373
16374#------------------------------------------------------------------------------
16375# $File: icc,v 1.6 2019/11/15 21:03:14 christos Exp $
16376# icc:  file(1) magic for International Color Consortium file formats
16377
16378#
16379# Color profiles as per the ICC's "Image technology colour management -
16380# Architecture, profile format, and data structure" specification.
16381# See
16382#
16383#	http://www.color.org/specification/ICC1v43_2010-12.pdf
16384#
16385# for Specification ICC.1:2010 (Profile version 4.3.0.0).
16386# URL: http://fileformats.archiveteam.org/wiki/ICC_profile
16387# Reference: http://www.color.org/iccmax/ICC.2-2016-7.pdf
16388# Update: Joerg Jenderek
16389#
16390# Bytes 36 to 39 contain a generic profile file signature of "acsp";
16391# bytes 40 to 43 "may be used to identify the primary platform/operating
16392# system framework for which the profile was created".
16393#
16394#	check and display ICC/ICM color profile
163950	name	color-profile
16396>36	string		acsp
16397# skip ASCII like Cognacspirit.txt by month <= 12
16398>>26	ubeshort	<13
16399# platform/operating system. Only 5 mentioned
16400
16401#
16402# This appears to be what's used for Apple ColorSync profiles.
16403# Instead of adding that, Apple just changed the generic "acsp" entry
16404# to be for "ColorSync ICC Color Profile" rather than "Kodak Color
16405# Management System, ICC Profile".
16406# Yes, it's "APPL", not "AAPL"; see the spec.
16407>>>40	string		APPL		ColorSync
16408
16409# Microsoft ICM color profile
16410>>>40	string		MSFT		Microsoft
16411
16412# Yes, that's a blank after "SGI".
16413>>>40	string		SGI\ 		SGI
16414
16415# XXX - is this what's used for the Sun KCMS or not?  The standard file
16416# uses just "acsp" for that, but Apple's file uses it for "ColorSync",
16417# and there *is* an identified "primary platform" value of SUNW.
16418>>>40	string		SUNW		Sun KCMS
16419
16420# 5th platform
16421>>>40	string		TGNT		Taligent
16422
16423# remaining "l" "e" of "color profile" printed later to avoid error
16424>>>40	string		x 		color profi
16425#>>>40	string		x		(%.4s)
16426!:mime	application/vnd.iccprofile
16427# for "ICM" extension only versions 2.x and for Kodak "CC" 2.0 is found
16428>>>8	ubyte		=2
16429# do not use empty message text to avoid error like
16430# icc, 82: Warning: Current entry does not yet have a description for adding a EXTENSION type
16431# file.exe: could not find any valid magic files!
16432>>>>9	ubyte		!0		\ble
16433!:ext	icc/icm
16434# minor version
16435>>>>9	ubyte		=0		\bl
16436# Kodak colour management system
16437>>>>>4	string		=KCMS		\be
16438!:ext	icc/icm/cc
16439>>>>>4	string		!KCMS		\be
16440!:ext	icc/icm
16441>>>8	ubyte		!2		\ble
16442!:ext	icc
16443# Profile version major.4bit-minor.sub1.sub2 like 4.3.0.0 (04300000h)
16444>>>8	ubyte		x		%u
16445>>>9	ubyte/16	x		\b.%u
16446# reserved and shall be null but 205.205 in umx1220u.icm
16447>>>10	ubyte		>0		\b.%u
16448>>>>11	ubyte		>0		\b.%u
16449# preferred colour management module like appl CCMS KCMS Lino UCCM "Win " "FF  "
16450# skip space like in brmsl08f.icm and null like in brmsl09f.icm, brmsl07f.icm
16451>>>4	string		>\ 		\b, type %.2s
16452>>>>6	string		>\  		\b%.1s
16453>>>>>7	string		>\  		\b%.1s
16454# colour space "XYZ " "Lab " "RGB " CMYK GRAY ...
16455>>>16	string		x		\b, %.3s
16456>>>19	string		>\  		\b%.1s
16457# Profile Connection Space (PCS) field usually "XYZ " or "Lab " but sometimes
16458# null or CMYK like in ISOcoated_v2_to_PSOcoated_v3_DeviceLink.icc
16459>>>20	string		>\0		\b/%.3s
16460>>>>23	string		>\ 		\b%.1s
16461# eleven device classes
16462>>>12	string		x		\b-%.4s device
16463# skip 00001964h in hpf69000.icc or 0h in XRDC50Q.ICM or " ROT" in brmsl05f.icm
16464>>>52	string		>\040
16465# skip "none" model like in "Trinitron Compatible 9300K G2.2.icm"
16466>>>>52	ubelong		!0x6e6f6e65
16467# device manufacturer field like "HP  " "IBM " EPSO
16468>>>>>48	string		x		\b, %.2s
16469>>>>>50	string		>\  		\b%.1s
16470>>>>>51	string		>\  		\b%.1s
16471# model like "ADI " "A265" and skip 20000404h in IS330.icm for RICOH RUSSIAN-SC
16472>>>>>52	string		>\ \  		\b/%.3s
16473>>>>>>55 string		>\  		\b%.1s
16474>>>>>52	string		x		model
16475# creator (often same as manufacture) like HP SONY XROX or null like in A925A.icm
16476>>>80	string		>\0		by %.2s
16477>>>>82	string		>\  		\b%.1s
16478>>>>>83	string		>\  		\b%.1s
16479# profile size
16480>>>0	ubelong		x		\b, %u bytes
16481# skip invalid date 0 like in linearSRGB.icc
16482>>>24	ubequad		!0
16483# datetime dd-mm-yyyy hh:mm:ss
16484>>>>28	ubeshort	x		\b, %u
16485# month <= 12
16486>>>>26	ubeshort	x		\b-%u
16487# year
16488>>>>24	ubeshort	x		\b-%u
16489# do not display midnight time like in CNHP8308.ICC
16490>>>>30	ubequad&0xFFffFFffFFff0000	!0
16491# hour <= 24
16492>>>>>30	ubeshort	x		%u
16493# minutes <= 59
16494>>>>>32	ubeshort	x		\b:%.2u
16495# seconds <= 59
16496>>>>>34	ubeshort	x		\b:%.2u
16497# vendor specific flags like 2 in HPCLJ5.ICM
16498>>>44	ubeshort	>0		\b, 0x%x vendor flags
16499# profile flags bits 0-2 of least 16 used by ICC
16500#>>>44	ubelong		>0		\b, 0x%x flags
16501# icEmbeddedProfileTrue
16502>>>44	ubelong		&1		\b, embedded
16503# icEmbeddedProfileFalse
16504#>>>44	ubelong		^1		\b, not embedded
16505# icUseWithEmbeddedDataOnly
16506>>>44	ubelong		&2		\b, dependently
16507# icUseAnywhere
16508#>>>44	ubelong		^2		\b, independently
16509>>>44	ubelong		&4		\b, MCS
16510#>>>44	ubelong		^4		\b, no MCS
16511# vendor specific device attributes 1~srgb.icc
16512# E000D00h~CNB7QEDA.ICM C000A00h~CNB5FCAA.ICM 01040401h~CNB25PE3.ICM
16513>>>56	ubelong		>0		\b, 0x%x vendor attribute
16514# ICC device attributes bits 0-7 used
16515#>>>60	ubelong		x		\b, 0x%x attribute
16516# http://www.color.org/icc34.h
16517>>>60	ubelong		&0x01		\b, transparent
16518#>>>60	ubelong		^0x01		\b, reflective
16519>>>60	ubelong		&0x02		\b, matte
16520#>>>60	ubelong		^0x02		\b, glossy
16521>>>60	ubelong		&0x04		\b, negative
16522#>>>60	ubelong		^0x04		\b, positive
16523>>>60	ubelong		&0x08		\b, black&white
16524#>>>60	ubelong		^0x08		\b, colour
16525>>>60	ubelong		&0x10		\b, non-paper
16526#>>>60	ubelong		^0x10		\b, paper
16527>>>60	ubelong		&0x20		\b, non-textured
16528#>>>60	ubelong		^0x20		\b, textured
16529>>>60	ubelong		&0x40		\b, non-isotropic
16530#>>>60	ubelong		^0x40		\b, isotropic
16531>>>60	ubelong		&0x80		\b, self-luminous
16532#>>>60	ubelong		^0x80		\b, non-self-luminous
16533# rendering intent 0-3 but 7AEA5027h in EE051__1.ICM 6CB1BCh in EE061__1.ICM
16534>>>64	ubelong		>3		\b, 0x%x rendering intent
16535#>>>64	ubelong		=0		\b, perceptual
16536>>>64	ubelong		=1		\b, relative colorimetric
16537>>>64	ubelong		=2		\b, saturation
16538>>>64	ubelong		=3		\b, absolute colorimetric
16539# PCS illuminant (3*s15Fixed16Numbers) often 0000f6d6 00010000 0000d32d
16540>>>71	ubequad		!0xd6000100000000d3	\b, PCS
16541# usually X~0.9642*65536=63189.8112~63190=F6D5h ; but also found
16542# often F6D6 in gt5000r.icm, F6B8 in kodakce.icm, F6CA in RSWOP.icm
16543>>>>68	ubelong			!0x0000f6d5	X=0x%x
16544# usually Y=1.0~00010000h but Y=0 in brmsl07f.icm
16545>>>>72	ubelong			!0x00010000	Y=0x%x
16546# usually Z~0.8249*65536=54060.6464~54061=D32Dh ; but also found
16547# D2F7 in hp1200c.icm, often D32C in A925A.icm, D309 in RSWOP.icm , D2F8 in kodak_dc.icm
16548>>>>76	ubelong			!0x0000d32d	Z=0x%x
16549# Profile ID. MD5 fingerprinting method as defined in Internet RFC 1321.
16550>>>84	ubequad		>0		\b, 0x%llx MD5
16551# reserved in older versions should be zero but also found CDCDCDCDCDCDCDCD
16552#>>100	ubequad		x		\b 0x%llx reserved
16553# tag table
16554# 6 <= tags count <= 43
16555#>>>128	ubelong		>43		\b, %u tags
16556>>>128	ubelong		x
16557# shall contain the profileDescriptionTag "desc" , copyrightTag "cprt"
16558# search range = tags count * 12 -8=< maximal tag count * 12 -8= 43 * 12 -8= 508
16559>>>>132	search/508	cprt
16560# but no copyright tag in linearSRGB.icc
16561# beneath /System/Library/Frameworks/WebKit.framework/
16562# Versions/A/Frameworks/WebCore.framework/Versions/A/Resources
16563>>>>132	default		x		\b, no copyright tag
16564# 1st tag
16565#>>>132	string		x		\b, 1st tag %.4s
16566#>>>136	ubelong		x		0x%x offset
16567#>>>140	ubelong		x		0x%x len
16568# 2nd tag,...
16569# look also for profileDescriptionTag "desc"
16570>>>132	search/508	desc
16571# look further for TextDescriptionType "desc" signature
16572>>>>(&0.L)	string		=desc
16573>>>>>&4		pstring/l	x	"%s"
16574# look alternative for multiLocalizedUnicodeType "mluc" signature like in VideoPAL.icc
16575>>>>(&0.L)	string		=mluc
16576>>>>>&(&8.L)	ubequad		x
16577>>>>>>&4	bestring16	x	'%s'
16578
16579# Any other profile.
16580# XXX - should we use "acsp\0\0\0\0" for "no primary platform" profiles,
16581# and use "acsp" for everything else and dump the "primary platform"
16582# string in those cases?
1658336	string		acsp
16584>0	use		color-profile
16585
16586
16587
16588#------------------------------------------------------------------------------
16589# $File: iff,v 1.17 2021/02/23 01:07:32 christos Exp $
16590# iff:	file(1) magic for Interchange File Format (see also "audio" & "images")
16591#
16592# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic
16593# Arts for file interchange.  It has also been used by Apple, SGI, and
16594# especially Commodore-Amiga.
16595#
16596# IFF files begin with an 8 byte FORM header, followed by a 4 character
16597# FORM type, which is followed by the first chunk in the FORM.
16598
165990	string		FORM		IFF data
16600#>4	belong		x		\b, FORM is %d bytes long
16601# audio formats
16602>8	string		AIFF		\b, AIFF audio
16603!:mime	audio/x-aiff
16604>8	string		AIFC		\b, AIFF-C compressed audio
16605!:mime	audio/x-aiff
16606>8	string		8SVX		\b, 8SVX 8-bit sampled sound voice
16607!:mime	audio/x-aiff
16608>8	string		16SV		\b, 16SV 16-bit sampled sound voice
16609>8	string		SAMP		\b, SAMP sampled audio
16610>8	string		MAUD		\b, MAUD MacroSystem audio
16611>8	string		SMUS		\b, SMUS simple music
16612>8	string		CMUS		\b, CMUS complex music
16613# image formats
16614>8	string		ILBMBMHD	\b, ILBM interleaved image
16615>>20	beshort		x		\b, %d x
16616>>22	beshort		x		%d
16617>8	string		RGBN		\b, RGBN 12-bit RGB image
16618>8	string		RGB8		\b, RGB8 24-bit RGB image
16619>8	string		DEEP		\b, DEEP TVPaint/XiPaint image
16620>8	string		DR2D		\b, DR2D 2-D object
16621>8	string		TDDD		\b, TDDD 3-D rendering
16622>8	string		LWOB		\b, LWOB 3-D object
16623>8	string		LWO2		\b, LWO2 3-D object, v2
16624>8	string		LWLO		\b, LWLO 3-D layered object
16625>8	string		REAL		\b, REAL Real3D rendering
16626>8	string		MC4D		\b, MC4D MaxonCinema4D rendering
16627>8	string		ANIM		\b, ANIM animation
16628>8	string		YAFA		\b, YAFA animation
16629>8	string		SSA\ 		\b, SSA super smooth animation
16630>8	string		FANT		\b, Fantavision animation
16631>8	string		ACBM		\b, ACBM continuous image
16632>8	string		FAXX		\b, FAXX fax image
16633>8	string		STFX		\b, ST-Fax image
16634# other formats
16635>8	string		FTXT		\b, FTXT formatted text
16636>8	string		CTLG		\b, CTLG message catalog
16637>8	string		PREF		\b, PREF preferences
16638>8	string		DTYP		\b, DTYP datatype description
16639>8	string		PTCH		\b, PTCH binary patch
16640>8	string		AMFF		\b, AMFF AmigaMetaFile format
16641>8	string		WZRD		\b, WZRD StormWIZARD resource
16642>8	string		DOC\040		\b, DOC desktop publishing document
16643>8	string		SWRT		\b, SWRT Final Copy/Writer document
16644>8	string		WORD		\b, ProWrite document
16645>8	string 		WTXT		\b, WTXT Wordworth document
16646>8	string 		WOWO		\b, WOWO Wordworth document
16647>8	string		WVQA 		\b, Westwood Studios VQA Multimedia,
16648>>24	leshort		x		%d video frames,
16649>>26	leshort		x		%d x
16650>>28	leshort		x		%d
16651>8	string		MOVE		\b, Wing Commander III Video
16652>>12	string		_PC_		\b, PC version
16653>>12	string		3DO_		\b, 3DO version
16654
16655# These go at the end of the iff rules
16656#
16657# David Griffith <dave@661.org>
16658# I don't see why these might collide with anything else.
16659#
16660# Interactive Fiction related formats
16661#
16662>8	string		IFRS		\b, Blorb Interactive Fiction
16663>>24	string		Exec		with executable chunk
16664>8	string          IFZS		\b, Z-machine or Glulx saved game file (Quetzal)
16665!:mime	application/x-blorb
16666
16667#------------------------------------------------------------------------------
16668# $File: images,v 1.194 2021/02/09 22:59:38 christos Exp $
16669# images:  file(1) magic for image formats (see also "iff", and "c-lang" for
16670# XPM bitmaps)
16671#
16672# originally from jef@helios.ee.lbl.gov (Jef Poskanzer),
16673# additions by janl@ifi.uio.no as well as others. Jan also suggested
16674# merging several one- and two-line files into here.
16675#
16676# little magic: PCX (first byte is 0x0a)
16677
16678# Targa - matches `povray', `ppmtotga' and `xv' outputs
16679# by Philippe De Muyter <phdm@macqel.be>
16680# URL: http://justsolve.archiveteam.org/wiki/TGA
16681# Reference: http://www.dca.fee.unicamp.br/~martino/disciplinas/ea978/tgaffs.pdf
16682# Update: Joerg Jenderek
16683# at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11
16684#	,32 or 33 (both not observed)
16685# at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise
16686#	or theoretically 2-128 reserved for use by Truevision or 128-255 may be used for developer applications
16687# at 3, leshort Index is 0 for povray, ppmtotga and xv outputs
16688# `xv' recognizes only a subset of the following (RGB with pixelsize = 24)
16689# `tgatoppm' recognizes a superset (Index may be anything)
16690#
16691# test of Color Map Type 0~no 1~color map
16692# and Image Type 1 2 3 9 10 11 32 33
16693# and Color Map Entry Size 0 15 16 24 32
166940	ubequad&0x00FeC400000000C0	0
16695# Conflict with MPEG sequences.
16696!:strength -40
16697# Prevent conflicts with CRI ADX.
16698#>(2.S-2) belong	!0x28632943
16699# above line does not work for rgb32_top_left_rle.tga
16700# skip some MPEG sequence *.vob and some CRI ADX audio with improbable interleave bits
16701>17	ubyte&0xC0		!0xC0
16702# skip more garbage like *.iso by looking for positive image type
16703>>2	ubyte			>0
16704# skip some compiled terminfo like xterm+tmux by looking for image type less equal 33
16705>>>2	ubyte			<34
16706# skip some MPEG sequence *.vob HV001T01.EVO winnicki.mpg with unacceptable alpha channel depth 11
16707>>>>17	ubyte&0x0F		!11
16708# skip arches.3200 , Finder.Root , Slp.1 by looking for low pixel depth 1 8 15 16 24 32
16709>>>>>16	ubyte			1
16710>>>>>>0		use		tga-image
16711>>>>>16	ubyte			8
16712>>>>>>0		use		tga-image
16713>>>>>16	ubyte			15
16714>>>>>>0		use		tga-image
16715>>>>>16	ubyte			16
16716>>>>>>0		use		tga-image
16717>>>>>16	ubyte			24
16718>>>>>>0		use		tga-image
16719>>>>>16	ubyte			32
16720>>>>>>0		use		tga-image
16721#	display tga bitmap image information
167220	name				tga-image
16723>2	ubyte		<34		Targa image data
16724!:mime	image/x-tga
16725!:apple	????TPIC
16726# normal extension .tga but some Truevision products used others:
16727# tpic (Apple),icb (Image Capture Board),vda (Video Display Adapter),vst (NuVista),win (UNSURE about that)
16728!:ext	tga/tpic/icb/vda/vst
16729# image type 1 2 3 9 10 11 32 33
16730>2	ubyte&0xF7	1		- Map
16731>2	ubyte&0xF7	2		- RGB
16732# alpha channel
16733>>17	ubyte&0x0F	>0		\bA
16734>2	ubyte&0xF7	3		- Mono
16735# type not found, but by http://www.fileformat.info/format/tga/corion.htm
16736# Compressed color-mapped data, using Huffman, Delta, and runlength encoding
16737>2	ubyte		32		- Color
16738# Compressed color-mapped data, using Huffman, Delta, and RLE. 4-pass quadtree- type process
16739>2	ubyte		33		- Color
16740# Color Map Type 0~no 1~color map
16741>1	ubyte		1		(
16742# first color map entry, 0 normal
16743>>3	uleshort	>0		\b%d-
16744# color map length 0 2 1dh 3bh d9h 100h
16745>>5	uleshort	x		\b%d)
16746# 8~run length encoding bit
16747>2	ubyte&0x08	8		- RLE
16748# gimp can create big pictures!
16749>12	uleshort	>0		%d x
16750>12	uleshort	=0		65536 x
16751# image height. 0 interpreted as 65536
16752>14	uleshort	>0		%d
16753>14	uleshort	=0		65536
16754# Image Pixel depth 1 8 15 16 24 32
16755>16	ubyte		x		x %d
16756# X origin of image. 0 normal
16757>8	uleshort	>0		+%d
16758# Y origin of image. 0 normal; positive for top
16759>10	uleshort	>0		+%d
16760# Image descriptor: bits 3-0 give the alpha channel depth, bits 5-4 give direction
16761# alpha depth like: 1 8
16762>17	ubyte&0x0F	>0		- %d-bit alpha
16763# bits 5-4 give direction. normal bottom left
16764>17	ubyte		&0x20		- top
16765#>17	ubyte		^0x20		- bottom
16766>17	ubyte		&0x10		- right
16767#>17	ubyte		^0x10		- left
16768# some info say other bits 6-7 should be zero
16769# but data storage interleave by http://www.fileformat.info/format/tga/corion.htm
16770# 00 - no interleave;01 - even/odd interleave; 10 - four way interleave; 11 - reserved
16771#>17	ubyte&0xC0	0x00		- no interleave
16772>17	ubyte&0xC0	0x40		- interleave
16773>17	ubyte&0xC0	0x80		- four way interleave
16774>17	ubyte&0xC0	0xC0		- reserved
16775# positive length implies identification field
16776>0	ubyte		>0
16777>>18	string		x		"%s"
16778# last 18 bytes of newer tga file footer signature
16779>18	search/4261301/s	TRUEVISION-XFILE.\0
16780# extension area offset if not 0
16781>>&-8		ulelong			>0
16782# length of the extension area. normal 495 for version 2.0
16783>>>(&-4.l)	uleshort		0x01EF
16784# AuthorName[41]
16785>>>>&0		string			>\0		- author "%-.40s"
16786# Comment[324]=4 * 80 null terminated
16787>>>>&41		string			>\0		- comment "%-.80s"
16788# date
16789>>>>&365	ubequad&0xffffFFFFffff0000	!0
16790# Day
16791>>>>>&-6		uleshort		x		%d
16792# Month
16793>>>>>&-8		uleshort		x		\b-%d
16794# Year
16795>>>>>&-4		uleshort		x		\b-%d
16796# time
16797>>>>&371	ubequad&0xffffFFFFffff0000	!0
16798# hour
16799>>>>>&-8		uleshort		x		%d
16800# minutes
16801>>>>>&-6		uleshort		x		\b:%.2d
16802# second
16803>>>>>&-4		uleshort		x		\b:%.2d
16804# JobName[41]
16805>>>>&377		string			>\0		- job "%-.40s"
16806# JobHour Jobminute Jobsecond
16807>>>>&418	ubequad&0xffffFFFFffff0000	!0
16808>>>>>&-8		uleshort		x		%d
16809>>>>>&-6		uleshort		x		\b:%.2d
16810>>>>>&-4		uleshort		x		\b:%.2d
16811# SoftwareId[41]
16812>>>>&424		string			>\0		- %-.40s
16813# SoftwareVersionNumber
16814>>>>&424	ubyte				>0
16815>>>>>&40		uleshort/100		x		%d
16816>>>>>&40		uleshort%100		x		\b.%d
16817# VersionLetter
16818>>>>>&42		ubyte			>0x20		\b%c
16819# KeyColor
16820>>>>&468		ulelong			>0		- keycolor 0x%8.8x
16821# Denominator of Pixel ratio. 0~no pixel aspect
16822>>>>&474	uleshort			>0
16823# Numerator
16824>>>>>&-4		uleshort		>0		- aspect %d
16825>>>>>&-2		uleshort		x		\b/%d
16826# Denominator of Gamma ratio. 0~no Gamma value
16827>>>>&478	uleshort			>0
16828# Numerator
16829>>>>>&-4		uleshort		>0		- gamma %d
16830>>>>>&-2		uleshort		x		\b/%d
16831# ColorOffset
16832#>>>>&480	ulelong			x		- col offset 0x%8.8x
16833# StampOffset
16834#>>>>&484	ulelong			x		- stamp offset 0x%8.8x
16835# ScanOffset
16836#>>>>&488	ulelong			x		- scan offset 0x%8.8x
16837# AttributesType
16838#>>>>&492	ubyte			x		- Attributes 0x%x
16839## EndOfTGA
16840
16841# PBMPLUS images
16842# URL: 		https://en.wikipedia.org/wiki/Netpbm
16843# The next byte following the magic is always whitespace.
16844# adding 65 to strength so that Netpbm images comes before "x86 boot sector" or
16845# "DOS/MBR boot sector" identified by ./filesystems is probably not needed
16846# because files are different
168470	name		netpbm
16848>3	regex/s		=[0-9]{1,50}\ [0-9]{1,50}	Netpbm image data
16849>>&0	regex		=[0-9]{1,50} 			\b, size = %s x
16850>>>&0	regex		=[0-9]{1,50}			\b %s
16851
168520	search/1	P1
16853# test for whitespace after 2 byte magic
16854>2	regex/2		[\040\t\f\r\n]
16855# skip DROID x-fmt-164-signature-id-583.pbm with ten 0 digits
16856>>3	string		!000000000
16857>>>0	use		netpbm
16858>>>0	string		x	\b, bitmap
16859#!:strength + 65
16860!:mime	image/x-portable-bitmap
16861!:ext	pbm
16862# check for character # starting a comment line
16863>>>3	ubyte		=0x23
16864>>>>4	string		x	%s
16865
168660	search/1	P2
16867>0	regex/4		P2[\040\t\f\r\n]
16868>>0	use		netpbm
16869>>0	string		x	\b, greymap
16870#!:strength + 65
16871# american spelling gray
16872!:mime	image/x-portable-graymap
16873!:ext	pgm
16874
168750	search/1	P3
16876>0	regex/4		P3[\040\t\f\r\n]
16877>>0	use		netpbm
16878>>0	string		x	\b, pixmap
16879#!:strength + 65
16880!:mime	image/x-portable-pixmap
16881!:ext	ppm
16882
168830	string		P4
16884>0	regex/4		P4[\040\t\f\r\n]
16885>>0	use		netpbm
16886>>0	string		x	\b, rawbits, bitmap
16887#!:strength + 65
16888!:mime	image/x-portable-bitmap
16889!:ext	pbm
16890
168910	string		P5
16892>0	regex/4		P5[\040\t\f\r\n]
16893>>0	use		netpbm
16894>>0	string		x	\b, rawbits, greymap
16895#!:strength + 65
16896!:mime	image/x-portable-greymap
16897!:ext	pgm
16898
168990	string		P6
16900>0	regex/4		P6[\040\t\f\r\n]
16901>>0	use		netpbm
16902>>0	string		x	\b, rawbits, pixmap
16903#!:strength + 65
16904!:mime	image/x-portable-pixmap
16905!:ext	ppm/pnm
16906
16907# URL: 		https://en.wikipedia.org/wiki/Netpbm#PAM_graphics_format
16908# Reference:	http://fileformats.archiveteam.org/wiki/Portable_Arbitrary_Map
16909# Update:	Joerg Jenderek
169100	string		P7
16911# skip DROID fmt-405-signature-id-589.pam by looking for character like New Line
16912>2	ubyte		!0xAB
16913#>2	ubyte		=0x0A
16914>>3	search/256/b	WIDTH		Netpbm PAM image file, size =
16915!:mime	image/x-portable-arbitrarymap
16916!:ext	pam
16917>>>&1	string		x		%s
16918>>>3	search/256/b	HEIGHT		x
16919>>>>&1	string		x		%s
16920# at offset 2 a New Line character (0xA) should appear
16921>>>2	ubyte		!0x0A		\b, 0x%x at offset 2 instead new line
16922
16923# From: bryanh@giraffe-data.com (Bryan Henderson)
169240	string		\117\072	Solitaire Image Recorder format
16925>4	string		\013		MGI Type 11
16926>4	string		\021		MGI Type 17
169270	string		.MDA		MicroDesign data
16928>21	byte		48		version 2
16929>21	byte		51		version 3
169300	string		.MDP		MicroDesign page data
16931>21	byte		48		version 2
16932>21	byte		51		version 3
16933
16934# NIFF (Navy Interchange File Format, a modification of TIFF) images
16935# [GRR:  this *must* go before TIFF]
169360	string		IIN1		NIFF image data
16937!:mime	image/x-niff
16938
16939# Canon RAW version 1 (CRW) files are a type of Canon Image File Format
16940# (CIFF) file. These are apparently all little-endian.
16941# From: Adam Buchbinder <adam.buchbinder@gmail.com>
16942# URL: https://www.sno.phy.queensu.ca/~phil/exiftool/canon_raw.html
169430	string		II\x1a\0\0\0HEAPCCDR	Canon CIFF raw image data
16944!:mime	image/x-canon-crw
16945>16	leshort		x	\b, version %d.
16946>14	leshort		x	\b%d
16947
16948# Canon RAW version 2 (CR2) files are a kind of TIFF with an extra magic
16949# number. Put this above the TIFF test to make sure we detect them.
16950# These are apparently all little-endian.
16951# From: Adam Buchbinder <adam.buchbinder@gmail.com>
16952# URL: https://libopenraw.freedesktop.org/wiki/Canon_CR2
169530	string		II\x2a\0\x10\0\0\0CR	Canon CR2 raw image data
16954!:mime	image/x-canon-cr2
16955!:strength +80
16956>10	byte		x	\b, version %d.
16957>11	byte		x	\b%d
16958
16959# Fujifilm RAF RAW image files with embedded JPEG data and compressed
16960# or uncompressed CFA RAW data. Byte order: Big Endian.
16961# URL: https://libopenraw.freedesktop.org/formats/raf/
169620	string		FUJIFILMCCD-RAW Fujifilm RAF raw image data
16963!:mime  image/x-fuji-raf
16964
16965# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com)
16966# The second word of TIFF files is the TIFF version number, 42, which has
16967# never changed.  The TIFF specification recommends testing for it.
169680	string		MM\x00\x2a	TIFF image data, big-endian
16969!:strength +70
16970!:mime	image/tiff
16971!:ext	tif,tiff
16972>(4.L)	use		\^tiff_ifd
169730	string		II\x2a\x00	TIFF image data, little-endian
16974!:mime	image/tiff
16975!:strength +70
16976!:ext	tif,tiff
16977>(4.l)	use		tiff_ifd
16978
169790	name		tiff_ifd
16980>0	leshort		x		\b, direntries=%d
16981>2	use		tiff_entry
16982
169830	name		tiff_entry
16984# NewSubFileType
16985>0	leshort		0xfe
16986>>12	use		tiff_entry
16987>0	leshort		0x100
16988>>4	lelong		1
16989>>>12	use		tiff_entry
16990>>>8	leshort		x		\b, width=%d
16991>0	leshort		0x101
16992>>4	lelong		1
16993>>>8	leshort		x		\b, height=%d
16994>>>12	use		tiff_entry
16995>0	leshort		0x102
16996>>8	leshort		x		\b, bps=%d
16997>>12	use		tiff_entry
16998>0	leshort		0x103
16999>>4	lelong		1		\b, compression=
17000>>>8	leshort		1		\bnone
17001>>>8	leshort		2		\bhuffman
17002>>>8	leshort		3		\bbi-level group 3
17003>>>8	leshort		4		\bbi-level group 4
17004>>>8	leshort		5		\bLZW
17005>>>8	leshort		6		\bJPEG (old)
17006>>>8	leshort		7		\bJPEG
17007>>>8	leshort		8		\bdeflate
17008>>>8	leshort		9		\bJBIG, ITU-T T.85
17009>>>8	leshort		0xa		\bJBIG, ITU-T T.43
17010>>>8	leshort		0x7ffe		\bNeXT RLE 2-bit
17011>>>8	leshort		0x8005		\bPackBits (Macintosh RLE)
17012>>>8	leshort		0x8029		\bThunderscan RLE
17013>>>8	leshort		0x807f		\bRasterPadding (CT or MP)
17014>>>8	leshort		0x8080		\bRLE (Line Work)
17015>>>8	leshort		0x8081		\bRLE (High-Res Cont-Tone)
17016>>>8	leshort		0x8082		\bRLE (Binary Line Work)
17017>>>8	leshort		0x80b2		\bDeflate (PKZIP)
17018>>>8	leshort		0x80b3		\bKodak DCS
17019>>>8	leshort		0x8765		\bJBIG
17020>>>8	leshort		0x8798		\bJPEG2000
17021>>>8	leshort		0x8799		\bNikon NEF Compressed
17022>>>8	default		x
17023>>>>8	leshort		x		\b(unknown 0x%x)
17024>>>12	use		tiff_entry
17025>0	leshort		0x106		\b, PhotometricIntepretation=
17026>>8	clear		x
17027>>8	leshort		0		\bWhiteIsZero
17028>>8	leshort		1		\bBlackIsZero
17029>>8	leshort		2		\bRGB
17030>>8	leshort		3		\bRGB Palette
17031>>8	leshort		4		\bTransparency Mask
17032>>8	leshort		5		\bCMYK
17033>>8	leshort		6		\bYCbCr
17034>>8	leshort		8		\bCIELab
17035>>8	default		x
17036>>>8	leshort		x		\b(unknown=0x%x)
17037>>12	use		tiff_entry
17038# FillOrder
17039>0	leshort		0x10a
17040>>4	lelong		1
17041>>>12	use		tiff_entry
17042# DocumentName
17043>0	leshort		0x10d
17044>>(8.l)	string		x		\b, name=%s
17045>>>12	use		tiff_entry
17046# ImageDescription
17047>0	leshort		0x10e
17048>>(8.l)	string		x		\b, description=%s
17049>>>12	use		tiff_entry
17050# Make
17051>0	leshort		0x10f
17052>>(8.l)	string		x		\b, manufacturer=%s
17053>>>12	use		tiff_entry
17054# Model
17055>0	leshort		0x110
17056>>(8.l)	string		x		\b, model=%s
17057>>>12	use		tiff_entry
17058# StripOffsets
17059>0	leshort		0x111
17060>>12	use		tiff_entry
17061# Orientation
17062>0	leshort		0x112		\b, orientation=
17063>>8	leshort		1		\bupper-left
17064>>8	leshort		3		\blower-right
17065>>8	leshort		6		\bupper-right
17066>>8	leshort		8		\blower-left
17067>>8	leshort		9		\bundefined
17068>>8	default		x
17069>>>8	leshort		x		\b[*%d*]
17070>>12	use		tiff_entry
17071# XResolution
17072>0	leshort		0x11a
17073>>8	lelong		x		\b, xresolution=%d
17074>>12	use		tiff_entry
17075# YResolution
17076>0	leshort		0x11b
17077>>8	lelong		x		\b, yresolution=%d
17078>>12	use		tiff_entry
17079# ResolutionUnit
17080>0	leshort		0x128
17081>>8	leshort		x		\b, resolutionunit=%d
17082>>12	use		tiff_entry
17083# Software
17084>0	leshort		0x131
17085>>(8.l)	string		x		\b, software=%s
17086>>12	use		tiff_entry
17087# Datetime
17088>0	leshort		0x132
17089>>(8.l)	string		x		\b, datetime=%s
17090>>12	use		tiff_entry
17091# HostComputer
17092>0	leshort		0x13c
17093>>(8.l)	string		x		\b, hostcomputer=%s
17094>>12	use		tiff_entry
17095# WhitePoint
17096>0	leshort		0x13e
17097>>12	use		tiff_entry
17098# PrimaryChromaticities
17099>0	leshort		0x13f
17100>>12	use		tiff_entry
17101# YCbCrCoefficients
17102>0	leshort		0x211
17103>>12	use		tiff_entry
17104# YCbCrPositioning
17105>0	leshort		0x213
17106>>12	use		tiff_entry
17107# ReferenceBlackWhite
17108>0	leshort		0x214
17109>>12	use		tiff_entry
17110# Copyright
17111>0	leshort		0x8298
17112>>(8.l)	string		x		\b, copyright=%s
17113>>12	use		tiff_entry
17114# ExifOffset
17115>0	leshort		0x8769
17116>>12	use		tiff_entry
17117# GPS IFD
17118>0	leshort		0x8825		\b, GPS-Data
17119>>12	use		tiff_entry
17120
17121#>0	leshort		x		\b, unknown=0x%x
17122#>>12	use		tiff_entry
17123
171240	string		MM\x00\x2b	Big TIFF image data, big-endian
17125!:mime	image/tiff
171260	string		II\x2b\x00	Big TIFF image data, little-endian
17127!:mime	image/tiff
17128
17129# PNG [Portable Network Graphics, or "PNG's Not GIF"] images
17130# (Greg Roelofs, newt@uchicago.edu)
17131# (Albert Cahalan, acahalan@cs.uml.edu)
17132#
17133# 137 P N G \r \n ^Z \n [4-byte length] I H D R [HEAD data] [HEAD crc] ...
17134#
17135
17136# IHDR parser
171370	name		png-ihdr
17138>0	belong		x		\b, %d x
17139>4	belong		x		%d,
17140>8	byte		x		%d-bit
17141>9	byte		0		grayscale,
17142>9	byte		2		\b/color RGB,
17143>9	byte		3		colormap,
17144>9	byte		4		gray+alpha,
17145>9	byte		6		\b/color RGBA,
17146#>10	byte		0		deflate/32K,
17147>12	byte		0		non-interlaced
17148>12	byte		1		interlaced
17149
17150# Standard PNG image.
171510	string		\x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x0DIHDR	PNG image data
17152!:mime	image/png
17153!:ext   png
17154!:strength +10
17155>16	use		png-ihdr
17156
17157# Apple CgBI PNG image.
171580	string		\x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x04CgBI
17159>24	string  	\x00\x00\x00\x0DIHDR	PNG image data (CgBI)
17160!:mime	image/png
17161!:ext   png
17162!:strength +10
17163>>32	use		png-ihdr
17164
17165# possible GIF replacements; none yet released!
17166# (Greg Roelofs, newt@uchicago.edu)
17167#
17168# GRR 950115:  this was mine ("Zip GIF"):
171690	string		GIF94z		ZIF image (GIF+deflate alpha)
17170!:mime	image/x-unknown
17171#
17172# GRR 950115:  this is Jeremy Wohl's Free Graphics Format (better):
17173#
171740	string		FGF95a		FGF image (GIF+deflate beta)
17175!:mime	image/x-unknown
17176#
17177# GRR 950115:  this is Thomas Boutell's Portable Bitmap Format proposal
17178# (best; not yet implemented):
17179#
171800	string		PBF		PBF image (deflate compression)
17181!:mime	image/x-unknown
17182
17183# GIF
17184# Strength set up to beat 0x55AA DOS/MBR signature word lookups (+65)
171850	string		GIF8		GIF image data
17186!:strength +80
17187!:mime	image/gif
17188!:apple	8BIMGIFf
17189!:ext	gif
17190>4	string		7a		\b, version 8%s,
17191>4	string		9a		\b, version 8%s,
17192>6	leshort		>0		%d x
17193>8	leshort		>0		%d
17194#>10	byte		&0x80		color mapped,
17195#>10	byte&0x07	=0x00		2 colors
17196#>10	byte&0x07	=0x01		4 colors
17197#>10	byte&0x07	=0x02		8 colors
17198#>10	byte&0x07	=0x03		16 colors
17199#>10	byte&0x07	=0x04		32 colors
17200#>10	byte&0x07	=0x05		64 colors
17201#>10	byte&0x07	=0x06		128 colors
17202#>10	byte&0x07	=0x07		256 colors
17203
17204# ITC (CMU WM) raster files.  It is essentially a byte-reversed Sun raster,
17205# 1 plane, no encoding.
172060	string		\361\0\100\273	CMU window manager raster image data
17207>4	lelong		>0		%d x
17208>8	lelong		>0		%d,
17209>12	lelong		>0		%d-bit
17210
17211# Magick Image File Format
17212# URL:		https://imagemagick.org/script/miff.php
17213# Reference:	http://fileformats.archiveteam.org/wiki/MIFF
17214# Update:	Joerg Jenderek
17215# http://www.nationalarchives.gov.uk/pronom/fmt/930
172160	search/256/bc	id=imagemagick
17217# skip bad ASCII text by following new line~0x0A or space~0x20 character
17218#>&0	ubyte		x		\b, next character 0x%x
17219# called by TriD ImageMagick Machine independent File Format bitmap
17220>&0	ubyte&0xD5	0		MIFF image data
17221# https://reposcope.com/mimetype/image/miff
17222#!:mime	image/miff
17223!:mime	image/x-miff
17224!:ext	miff/mif
17225# examples with standard file(1) magic
17226#>>0	string		=id=ImageMagick	with standard magic
17227# examples with unusual file(1) magic like
17228>>0	string		!id=ImageMagick	starting with
17229# start with comment (brace) like http://samples.fileformat.info/.../AQUARIUM.MIF
17230>>>0	ubyte		=0x7b		comment
17231# skip second character which is often a newline and show comment
17232>>>>2	string		x		"%s"
17233# does not start with comment, probably letters with other case like Id=ImageMagick
17234# ImageMagick-7.0.9-2/Magick++/demo/smile_anim.miff
17235>>>0	ubyte		!0x7b
17236>>>>0	string		>\0		'%-.14s'
17237# URL:		https://imagemagick.org/
17238# Reference:	https://imagemagick.org/script/magick-vector-graphics.php
17239# From:		Joerg Jenderek
17240# Note:		all white-spaces between commands are ignored
172410	string		push
17242# skip some white spaces
17243>5	search/3	graphic-context	ImageMagick Vector Graphic
17244# TODO: look for dangerous commands like CVE-2016-3715
17245#!:mime	text/plain
17246!:mime	image/x-mvg
17247!:ext	mvg
17248
17249# Artisan
172500	long		1123028772	Artisan image data
17251>4	long		1		\b, rectangular 24-bit
17252>4	long		2		\b, rectangular 8-bit with colormap
17253>4	long		3		\b, rectangular 32-bit (24-bit with matte)
17254
17255# FIG (Facility for Interactive Generation of figures), an object-based format
172560	search/1	#FIG		FIG image text
17257>5	string		x		\b, version %.3s
17258
17259# PHIGS
172600	string		ARF_BEGARF		PHIGS clear text archive
172610	string		@(#)SunPHIGS		SunPHIGS
17262# version number follows, in the form m.n
17263>40	string		SunBin			binary
17264>32	string		archive			archive
17265
17266# GKS (Graphics Kernel System)
172670	string		GKSM		GKS Metafile
17268>24	string		SunGKS		\b, SunGKS
17269
17270# CGM image files
172710	string		BEGMF		clear text Computer Graphics Metafile
17272
17273# MGR bitmaps  (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de)
172740	string	yz	MGR bitmap, modern format, 8-bit aligned
172750	string	zz	MGR bitmap, old format, 1-bit deep, 16-bit aligned
172760	string	xz	MGR bitmap, old format, 1-bit deep, 32-bit aligned
172770	string	yx	MGR bitmap, modern format, squeezed
17278
17279# Fuzzy Bitmap (FBM) images
172800	string		%bitmap\0	FBM image data
17281>30	long		0x31		\b, mono
17282>30	long		0x33		\b, color
17283
17284# facsimile data
172851	string		PC\ Research,\ Inc	group 3 fax data
17286>29	byte		0		\b, normal resolution (204x98 DPI)
17287>29	byte		1		\b, fine resolution (204x196 DPI)
17288# From: Herbert Rosmanith <herp@wildsau.idv.uni.linz.at>
172890	string		Sfff		structured fax file
17290
17291# From: Joerg Jenderek <joerg.jen.der.ek@gmx.net>
17292# most files with the extension .EPA and some with .BMP
172930	string		\x11\x06	Award BIOS Logo, 136 x 84
17294!:mime	image/x-award-bioslogo
172950	string		\x11\x09	Award BIOS Logo, 136 x 126
17296!:mime	image/x-award-bioslogo
17297#0	string		\x07\x1f	BIOS Logo corrupted?
17298# http://www.blackfiveservices.co.uk/awbmtools.shtml
17299# http://biosgfx.narod.ru/v3/
17300# http://biosgfx.narod.ru/abr-2/
173010	string		AWBM
17302>4	leshort		<1981		Award BIOS bitmap
17303!:mime	image/x-award-bmp
17304# image width is a multiple of 4
17305>>4	leshort&0x0003	0
17306>>>4		leshort	x		\b, %d
17307>>>6		leshort	x		x %d
17308>>4	leshort&0x0003	>0		\b,
17309>>>4	leshort&0x0003	=1
17310>>>>4		leshort	x		%d+3
17311>>>4	leshort&0x0003	=2
17312>>>>4		leshort	x		%d+2
17313>>>4	leshort&0x0003	=3
17314>>>>4		leshort	x		%d+1
17315>>>6		leshort	x		x %d
17316# at offset 8 starts imagedata followed by "RGB " marker
17317
17318# PC bitmaps (OS/2, Windows BMP files)  (Greg Roelofs, newt@uchicago.edu)
17319# https://en.wikipedia.org/wiki/BMP_file_format#DIB_header_.\
17320# 28bitmap_information_header.29
17321# Note:	variant starting direct with DIB header see
17322#	http://fileformats.archiveteam.org/wiki/BMP
17323#	verified by ImageMagick version 6.8.9-8 command `identify *.dib`
173240	leshort		40
17325# skip bad samples like GAME by looking for valid number of color planes
17326>12	uleshort	1		Device independent bitmap graphic
17327!:mime	image/x-ms-bmp
17328!:apple	????BMPp
17329!:ext	dib
17330>>4	lelong		x		\b, %d x
17331>>8	lelong		x		%d x
17332>>14	leshort		x		%d
17333# number of color planes (must be 1)
17334#>>12	uleshort	>1		\b, %u color planes
17335# compression method: 0~no 1~RLE 8-bit/pixel 3~Huffman 1D
17336#>>16	ulelong		3		\b, Huffman 1D compression
17337>>16	ulelong		>0		\b, %u compression
17338# image size is the size of raw bitmap; a dummy 0 can be given for BI_RGB bitmaps
17339>>20	ulelong		x		\b, image size %u
17340# horizontal and vertical resolution of the image (pixel per metre, signed integer)
17341>>24	lelong		>0		\b, resolution %d x
17342>>>28	lelong		x		%d px/m
17343# number of colors in palette, or 0 to default to 2**n
17344#>>32	ulelong		>0		\b, %u colors
17345# number of important colors used, or 0 when every color is important
17346>>36	ulelong		>0		\b, %u important colors
173470	string		BM
17348>14	leshort		12		PC bitmap, OS/2 1.x format
17349!:mime	image/x-ms-bmp
17350>>18	leshort		x		\b, %d x
17351>>20	leshort		x		%d
17352>14	leshort		64		PC bitmap, OS/2 2.x format
17353!:mime	image/x-ms-bmp
17354!:apple	????BMPp
17355!:ext	bmp
17356# image width and height fields are unsigned integers for OS/2
17357>>18	ulelong		x		\b, %u x
17358>>22	ulelong		x		%u
17359# number of bits per pixel (color depth); found 1 4 8
17360>>28	uleshort	>1		x %u
17361# x, y coordinates of the hotspot
17362>>6	uleshort	>0		\b, hotspot %ux
17363>>>8	uleshort	x		\b%u
17364>>26	uleshort	>1		\b, %u color planes
17365# cbSize; size of file or headers
17366>>2	ulelong		x		\b, cbSize %u
17367#>>2	ulelong		x		\b, cbSize 0x%x
17368# offBits; offset to bitmap data like 56h 5Eh 8Eh 43Eh
17369>>10	ulelong			x	\b, bits offset %u
17370#>>10	ulelong			x	\b, bits offset 0x%x
17371#>>(10.l) ubequad		!0	\b, bits 0x%16.16llx
17372# BITMAPV2INFOHEADER	adds RGB bit masks
17373>14	leshort		52		PC bitmap, Adobe Photoshop
17374!:mime	image/x-ms-bmp
17375!:apple	????BMPp
17376!:ext	bmp
17377>>18	lelong		x		\b, %d x
17378>>22	lelong		x		%d x
17379>>28	leshort		x		%d
17380# BITMAPV3INFOHEADER	adds alpha channel bit mask
17381>14	leshort		56		PC bitmap, Adobe Photoshop with alpha channel mask
17382!:mime	image/x-ms-bmp
17383!:apple	????BMPp
17384!:ext	bmp
17385>>18	lelong		x		\b, %d x
17386>>22	lelong		x		%d x
17387>>28	leshort		x		%d
17388>14	leshort		40
17389# jump 4 bytes before end of file/header to skip fmt-116-signature-id-118.dib
17390# broken for large bitmaps
17391#>>(2.l-4)	ulong	x		PC bitmap, Windows 3.x format
17392>>14	leshort		40		PC bitmap, Windows 3.x format
17393!:mime	image/x-ms-bmp
17394!:apple	????BMPp
17395>>>18	lelong		x		\b, %d x
17396>>>22	lelong		x		%d
17397# 320 x 400		https://en.wikipedia.org/wiki/LOGO.SYS
17398>>>18	ulequad		=0x0000019000000140	x
17399!:ext	bmp/sys
17400>>>18	ulequad		!0x0000019000000140
17401# compression method 2~RLE 4-bit/pixel implies also extension rle
17402>>>>30	ulelong		2		x
17403!:ext	bmp/rle
17404>>>>30	default		x		x
17405!:ext	bmp
17406# number of bits per pixel (color depth); found 1 2 4 8 16 24 32
17407>>>28	leshort		x		%d
17408# x, y coordinates of the hotspot; there is no hotspot in bitmaps, so values 0
17409#>>>6	uleshort	>0		\b, hotspot %ux
17410#>>>>8	uleshort	x		\b%u
17411# number of color planes (must be 1), except badplanes.bmp for testing
17412#>>>26	uleshort	>1		\b, %u color planes
17413# compression method: 0~no 1~RLE 8-bit/pixel 2~RLE 4-bit/pixel 3~Huffman 1D 6~RGBA bit field masks
17414#>>>30	ulelong		3		\b, Huffman 1D compression
17415>>>30	ulelong		>0		\b, %u compression
17416# image size is the size of raw bitmap; a dummy 0 can be given for BI_RGB bitmaps
17417>>>34	ulelong		>0		\b, image size %u
17418# horizontal and vertical resolution of the image (pixel per metre, signed integer)
17419>>>38	lelong		>0		\b, resolution %d x
17420>>>>42	lelong		x		%d px/m
17421# number of colors in palette 16 256, or 0 to default to 2**n
17422#>>>46	ulelong		>0		\b, %u colors
17423# number of important colors used, or 0 when every color is important
17424>>>50	ulelong		>0		\b, %u important colors
17425# cbSize; often size of file
17426>>>2	ulelong		x		\b, cbSize %u
17427#>>>2	ulelong		x		\b, cbSize 0x%x
17428# offBits; offset to bitmap data like 36h 76h BEh 236h 406h 436h 4E6h
17429>>>10	ulelong			x	\b, bits offset %u
17430#>>>10	ulelong			x	\b, bits offset 0x%x
17431#>>>(10.l) ubequad		!0	\b, bits 0x%16.16llxd
17432>14	leshort		124		PC bitmap, Windows 98/2000 and newer format
17433!:mime	image/x-ms-bmp
17434>>18	lelong		x		\b, %d x
17435>>22	lelong		x		%d x
17436>>28	leshort		x		%d
17437>14	leshort		108		PC bitmap, Windows 95/NT4 and newer format
17438!:mime	image/x-ms-bmp
17439>>18	lelong		x		\b, %d x
17440>>22	lelong		x		%d x
17441>>28	leshort		x		%d
17442>14	leshort		128		PC bitmap, Windows NT/2000 format
17443!:mime	image/x-ms-bmp
17444>>18	lelong		x		\b, %d x
17445>>22	lelong		x		%d x
17446>>28	leshort		x		%d
17447# Update:	Joerg Jenderek
17448# URL:		http://fileformats.archiveteam.org/wiki/OS/2_Icon
17449# Reference:	http://www.fileformat.info
17450#		/format/os2bmp/spec/902d5c253f2a43ada39c2b81034f27fd/view.htm
17451# Note: verified by command like `deark -l -d3 OS2MEMU.ICO`
174520	string			IC
17453# skip Lotus smart icon *.smi by looking for valid hotspot coordinates
17454>6	ulelong&0xFF00FF00	=0	OS/2 icon
17455# jump 4 bytes before end of header/file and test for accessibility
17456#>>(2.l-4) ubelong		x	End of header is OK!
17457!:mime	image/x-os2-ico
17458!:ext	ico
17459# cbSize; size of header or file in bytes like 1ah 120h 420h
17460>>2	ulelong			x	\b, cbSize %u
17461# xHotspot, yHotspot; coordinates of the hotspot for icons like 16 32
17462>>6	uleshort		x	\b, hotspot %ux
17463>>8	uleshort		x	\b%u
17464# offBits; offset in bytes to the beginning of the bit-map pel data like 20h
17465>>10	ulelong			x	\b, bits offset %u
17466#>>(10.l) ubequad		x	\b, bits 0x%16.16llx
17467#0	string		PI		PC pointer image data
17468#0	string		CI		PC color icon data
174690	string		CI
17470# test also for valid dib header sizes 12 or 64
17471>14	ulelong		<65		OS/2
17472# test also for valid hotspot coordinates
17473#>>6	ulelong&0xFE00FE00	=0	OS/2
17474!:mime	image/x-os2-ico
17475!:ext	ico
17476>>14	ulelong		12		1.x color icon
17477# image width and height fields are unsigned integers for OS/2
17478>>>18	uleshort	x		%u x
17479# stored height = 2 * real height
17480>>>20	uleshort/2	x		%u
17481# number of bits per pixel (color depth). Typical 32 24 16 8 4 but only 1 found
17482>>>24	uleshort	>1		x %u
17483# color planes; must be 1
17484#>>>22	uleshort	>1		\b, %u color planes
17485>>14	ulelong		64		2.x color icon
17486# image width and height
17487>>>18	ulelong		x		%u x
17488# stored height = 2 * real height
17489>>>22	ulelong/2	x		%u
17490# number of bits per pixel (color depth). only 1 found
17491>>>28	uleshort	>1		x %u
17492#>>>26	uleshort	>1		\b, %u color planes
17493# compression method: 0~no 3~Huffman 1D
17494>>>30	ulelong		3		\b, Huffman 1D compression
17495#>>>30	ulelong		>0		\b, %u compression
17496# xHotspot, yHotspot; coordinates of the hotspot like 0 1 16 20 32 33 63 64
17497>>6	uleshort		x	\b, hotspot %ux
17498>>8	uleshort		x	\b%u
17499# cbSize; size of header or maybe file in bytes like 1Ah 4Eh 84Eh
17500>>2	ulelong			x	\b, cbSize %u
17501#>>2	ulelong			x	\b, cbSize %x
17502# offBits; offset to bitmap data (pixel array) like E4h 3Ah 66h 6Ah 33Ah 4A4h
17503>>10	ulelong			x	\b, bits offset %u
17504#>>10	ulelong			x	\b, bits offset 0x%x
17505#>>(10.l) ubequad		!0	\b, bits 0x%16.16llx
17506# dib header size: 12~Ch~OS/2 1.x 64~40h~OS/2 2.x
17507#>>14	ulelong		x		\b, dib header size %u
17508#0	string		CP		PC color pointer image data
17509# URL:		http://fileformats.archiveteam.org/wiki/OS/2_Pointer
17510# Reference:	http://www.fileformat.info/format/os2bmp/egff.htm
175110	string		CP
17512# skip many Corel Photo-Paint image "CPT9FILE" by checking for positive bits offset
17513>10	ulelong		>0
17514# skip CPU-Z Report by checking for valid dib header sizes 12 or 64
17515>>14	ulelong		=12
17516>>>0		use		os2-ptr
17517>>14	ulelong		=64
17518>>>0		use		os2-ptr
17519#	display information of OS/2 pointer bitmaps
175200	name		os2-ptr
17521>14	ulelong		x		OS/2
17522# http://extension.nirsoft.net/PTR
17523!:mime	image/x-ibm-pointer
17524!:ext	ptr
17525>>14	ulelong		12		1.x color pointer
17526# image width and height fields are unsigned integers for OS/2
17527>>>18	uleshort	x		%u x
17528# stored height = 2 * real height
17529>>>20	uleshort/2	x		%u
17530# number of bits per pixel (color depth). Typical 32 24 16 8 4 but only 1 found
17531>>>24	uleshort	>1		x %u
17532# color planes; must be 1
17533#>>>22	uleshort	>1		\b, %u color planes
17534>>14	ulelong		64		2.x color pointer
17535# image width and height
17536>>>18	ulelong		x		%u x
17537# stored height = 2 * real height
17538>>>22	ulelong/2	x		%u
17539# number of bits per pixel (color depth). only 1 found
17540>>>28	uleshort	>1		x %u
17541#>>>26	uleshort	>1		\b, %u color planes
17542# compression method: 0~no 3~Huffman 1D
17543>>>30	ulelong		3		\b, Huffman 1D compression
17544#>>>30	ulelong		>0		\b, %u compression
17545# xHotspot, yHotspot; coordinates of the hotspot like 0 3 4 8 15 16 23 27 31
17546>>6	uleshort		x	\b, hotspot %ux
17547>>8	uleshort		x	\b%u
17548# cbSize; size of header or maybe file in bytes like 1Ah 4Eh
17549>>2	ulelong			x	\b, cbSize %u
17550#>>2	ulelong			x	\b, cbSize %x
17551# offBits; offset to bitmap data (pixel array) like 6Ah A4h E4h 4A4h
17552>>10	ulelong			x	\b, bits offset %u
17553#>>10	ulelong			x	\b, bits offset 0x%x
17554#>>(10.l) ubequad		!0	\b, bits 0x%16.16llx
17555# dib header size: 12~Ch~OS/2 1.x 64~40h~OS/2 2.x
17556#>>14	ulelong		x		\b, dib header size %u
17557# Conflicts with other entries [BABYL]
17558# URL:	http://fileformats.archiveteam.org/wiki/BMP#OS.2F2_Bitmap_Array
17559# Note:	container for OS/2 icon "IC", color icon "CI", color pointer "CP" or bitmap "BM"
17560#0	string		BA		PC bitmap array data
175610	string		BA
17562# skip old Emacs RMAIL BABYL ./mail.news by checking for low header size
17563>2	ulelong		<0x004c5942	OS/2 graphic array
17564!:mime	image/x-os2-graphics
17565#!:apple	????BMPf
17566# cbSize; size of header like 28h 5Ch
17567>>2	ulelong			x	\b, cbSize %u
17568#>>2	ulelong			x	\b, cbSize 0x%x
17569# offNext; offset to data like 0 48h F2h 4Eh 64h C6h D2h D6h DAh E6h EAh 348h
17570>>6	ulelong			>0	\b, data offset %u
17571#>>6	ulelong			>0	\b, data offset 0x%x
17572#>>(6.l) ubequad		!0	\b, data 0x%16.16llx
17573# dimensions of the intended device like 640 x 480 for VGA or 1024 x 768
17574>>10	uleshort	>0		\b, display %u
17575>>>12	uleshort	>0		x %u
17576# usType of first array element
17577#>>14	string		x		\b, usType %2.2s
17578# 1 space char after "1st"
17579# no *.bga examples found https://www.openwith.org/file-extensions/bga/1342
17580>>14	string		BM	\b; 1st
17581!:ext	bmp/bga
17582>>14	string		CI	\b; 1st
17583!:ext	ico
17584>>14	string		CP	\b; 1st
17585!:ext	ico
17586>>14	string		IC	\b; 1st
17587!:ext	ico
17588# no white-black pointer found
17589#>>14	string		PT	\b; 1st
17590#!:ext
17591>>14	indirect	x
17592
17593# XPM icons (Greg Roelofs, newt@uchicago.edu)
175940	search/1	/*\ XPM\ */	X pixmap image text
17595!:mime	image/x-xpmi
17596
17597# Utah Raster Toolkit RLE images (janl@ifi.uio.no)
175980	leshort		0xcc52		RLE image data,
17599>6	leshort		x		%d x
17600>8	leshort		x		%d
17601>2	leshort		>0		\b, lower left corner: %d
17602>4	leshort		>0		\b, lower right corner: %d
17603>10	byte&0x1	=0x1		\b, clear first
17604>10	byte&0x2	=0x2		\b, no background
17605>10	byte&0x4	=0x4		\b, alpha channel
17606>10	byte&0x8	=0x8		\b, comment
17607>11	byte		>0		\b, %d color channels
17608>12	byte		>0		\b, %d bits per pixel
17609>13	byte		>0		\b, %d color map channels
17610
17611# image file format (Robert Potter, potter@cs.rochester.edu)
176120	string		Imagefile\ version-	iff image data
17613# this adds the whole header (inc. version number), informative but longish
17614>10	string		>\0		%s
17615
17616# Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com)
176170	belong		0x59a66a95	Sun raster image data
17618>4	belong		>0		\b, %d x
17619>8	belong		>0		%d,
17620>12	belong		>0		%d-bit,
17621#>16	belong		>0		%d bytes long,
17622>20	belong		0		old format,
17623#>20	belong		1		standard,
17624>20	belong		2		compressed,
17625>20	belong		3		RGB,
17626>20	belong		4		TIFF,
17627>20	belong		5		IFF,
17628>20	belong		0xffff		reserved for testing,
17629>24	belong		0		no colormap
17630>24	belong		1		RGB colormap
17631>24	belong		2		raw colormap
17632#>28	belong		>0		colormap is %d bytes long
17633
17634# SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com)
17635#
17636# See
17637#	http://reality.sgi.com/grafica/sgiimage.html
17638#
176390	beshort		474		SGI image data
17640#>2	byte		0		\b, verbatim
17641>2	byte		1		\b, RLE
17642#>3	byte		1		\b, normal precision
17643>3	byte		2		\b, high precision
17644>4	beshort		x		\b, %d-D
17645>6	beshort		x		\b, %d x
17646>8	beshort		x		%d
17647>10	beshort		x		\b, %d channel
17648>10	beshort		!1		\bs
17649>80	string		>0		\b, "%s"
17650
176510	string		IT01		FIT image data
17652>4	belong		x		\b, %d x
17653>8	belong		x		%d x
17654>12	belong		x		%d
17655#
176560	string		IT02		FIT image data
17657>4	belong		x		\b, %d x
17658>8	belong		x		%d x
17659>12	belong		x		%d
17660#
176612048	string		PCD_IPI		Kodak Photo CD image pack file
17662>0xe02	byte&0x03	0x00		, landscape mode
17663>0xe02	byte&0x03	0x01		, portrait mode
17664>0xe02	byte&0x03	0x02		, landscape mode
17665>0xe02	byte&0x03	0x03		, portrait mode
176660	string		PCD_OPA		Kodak Photo CD overview pack file
17667
17668# FITS format.  Jeff Uphoff <juphoff@tarsier.cv.nrao.edu>
17669# FITS is the Flexible Image Transport System, the de facto standard for
17670# data and image transfer, storage, etc., for the astronomical community.
17671# (FITS floating point formats are big-endian.)
176720	string	SIMPLE\ \ =	FITS image data
17673!:mime	image/fits
17674!:ext	fits/fts
17675>109	string	8		\b, 8-bit, character or unsigned binary integer
17676>108	string	16		\b, 16-bit, two's complement binary integer
17677>107	string	\ 32		\b, 32-bit, two's complement binary integer
17678>107	string	-32		\b, 32-bit, floating point, single precision
17679>107	string	-64		\b, 64-bit, floating point, double precision
17680
17681# other images
176820	string	This\ is\ a\ BitMap\ file	Lisp Machine bit-array-file
17683
17684# From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image
17685# stuff.
17686#
176870	beshort		0x1010		PEX Binary Archive
17688
17689# DICOM medical imaging data
17690# URL:		https://en.wikipedia.org/wiki/DICOM#Data_format
17691# Note:		"dcm" is the official file name extension
17692# 		XnView mention also "dc3" and "acr" as file name extension
17693128	string	DICM			DICOM medical imaging data
17694!:mime	application/dicom
17695!:ext dcm/dicom/dic
17696
17697# XWD - X Window Dump file.
17698#   As described in /usr/X11R6/include/X11/XWDFile.h
17699#   used by the xwd program.
17700#   Bradford Castalia, idaeim, 1/01
17701#   updated by Adam Buchbinder, 2/09
17702# The following assumes version 7 of the format; the first long is the length
17703# of the header, which is at least 25 4-byte longs, and the one at offset 8
17704# is a constant which is always either 1 or 2. Offset 12 is the pixmap depth,
17705# which is a maximum of 32.
177060	belong	>100
17707>8	belong	<3
17708>>12	belong	<33
17709>>>4	belong	7			XWD X Window Dump image data
17710!:mime	image/x-xwindowdump
17711>>>>100	string	>\0			\b, "%s"
17712>>>>16	belong	x			\b, %dx
17713>>>>20	belong	x			\b%dx
17714>>>>12	belong	x			\b%d
17715
17716# PDS - Planetary Data System
17717#   These files use Parameter Value Language in the header section.
17718#   Unfortunately, there is no certain magic, but the following
17719#   strings have been found to be most likely.
177200	string	NJPL1I00		PDS (JPL) image data
177212	string	NJPL1I			PDS (JPL) image data
177220	string	CCSD3ZF			PDS (CCSD) image data
177232	string	CCSD3Z			PDS (CCSD) image data
177240	string	PDS_			PDS image data
177250	string	LBLSIZE=		PDS (VICAR) image data
17726
17727# pM8x: ATARI STAD compressed bitmap format
17728#
17729# from Oskar Schirmer <schirmer@scara.com> Feb 2, 2001
17730# p M 8 5/6 xx yy zz data...
17731# Atari ST STAD bitmap is always 640x400, bytewise runlength compressed.
17732# bytes either run horizontally (pM85) or vertically (pM86). yy is the
17733# most frequent byte, xx and zz are runlength escape codes, where xx is
17734# used for runs of yy.
17735#
177360	string	pM85		Atari ST STAD bitmap image data (hor)
17737>5	byte	0x00		(white background)
17738>5	byte	0xFF		(black background)
177390	string	pM86		Atari ST STAD bitmap image data (vert)
17740>5	byte	0x00		(white background)
17741>5	byte	0xFF		(black background)
17742
17743# From: Alex Myczko <alex@aiei.ch>
17744# https://www.atarimax.com/jindroush.atari.org/afmtatr.html
177450	leshort	0x0296		Atari ATR image
17746
17747# XXX:
17748# This is bad magic 0x5249 == 'RI' conflicts with RIFF and other
17749# magic.
17750# SGI RICE image file <mpruett@sgi.com>
17751#0	beshort	0x5249		RICE image
17752#>2	beshort	x		v%d
17753#>4	beshort	x		(%d x
17754#>6	beshort	x		%d)
17755#>8	beshort	0		8 bit
17756#>8	beshort	1		10 bit
17757#>8	beshort	2		12 bit
17758#>8	beshort	3		13 bit
17759#>10	beshort	0		4:2:2
17760#>10	beshort	1		4:2:2:4
17761#>10	beshort	2		4:4:4
17762#>10	beshort	3		4:4:4:4
17763#>12	beshort	1		RGB
17764#>12	beshort	2		CCIR601
17765#>12	beshort	3		RP175
17766#>12	beshort	4		YUV
17767
17768# PCX image files
17769# From: Dan Fandrich <dan@coneharvesters.com>
17770# updated by Joerg Jenderek at Feb 2013 by https://de.wikipedia.org/wiki/PCX
17771# https://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt
17772# GRR: original test was still too general as it catches xbase examples T5.DBT,T6.DBT with 0xa000000
17773# test for bytes 0x0a,version byte (0,2,3,4,5),compression byte flag(0,1), bit depth (>0) of PCX or T5.DBT,T6.DBT
177740	ubelong&0xffF8fe00	0x0a000000
17775# for PCX bit depth > 0
17776>3	ubyte		>0
17777# test for valid versions
17778>>1	ubyte		<6
17779>>>1	ubyte		!1	PCX
17780!:mime	image/x-pcx
17781#!:mime	image/pcx
17782>>>>1	ubyte		0	ver. 2.5 image data
17783>>>>1	ubyte		2	ver. 2.8 image data, with palette
17784>>>>1	ubyte		3	ver. 2.8 image data, without palette
17785>>>>1	ubyte		4	for Windows image data
17786>>>>1	ubyte		5	ver. 3.0 image data
17787>>>>4	uleshort	x	bounding box [%d,
17788>>>>6	uleshort	x	%d] -
17789>>>>8	uleshort	x	[%d,
17790>>>>10	uleshort	x	%d],
17791>>>>65	ubyte		>1	%d planes each of
17792>>>>3	ubyte		x	%d-bit
17793>>>>68	byte		1	colour,
17794>>>>68	byte		2	grayscale,
17795# this should not happen
17796>>>>68	default		x	image,
17797>>>>12	leshort		>0	%d x
17798>>>>>14	uleshort	x	%d dpi,
17799>>>>2	byte		0	uncompressed
17800>>>>2	byte		1	RLE compressed
17801
17802# Adobe Photoshop
17803# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
178040	string		8BPS Adobe Photoshop Image
17805!:mime	image/vnd.adobe.photoshop
17806!:ext	psd
17807>4   beshort 2 (PSB)
17808>18  belong  x \b, %d x
17809>14  belong  x %d,
17810>24  beshort 0 bitmap
17811>24  beshort 1 grayscale
17812>>12 beshort 2 with alpha
17813>24  beshort 2 indexed
17814>24  beshort 3 RGB
17815>>12 beshort 4 \bA
17816>24  beshort 4 CMYK
17817>>12 beshort 5 \bA
17818>24  beshort 7 multichannel
17819>24  beshort 8 duotone
17820>24  beshort 9 lab
17821>12  beshort > 1
17822>>12  beshort x \b, %dx
17823>12  beshort 1 \b,
17824>22  beshort x %d-bit channel
17825>12  beshort > 1 \bs
17826
17827# XV thumbnail indicator (ThMO)
17828# URL:		https://en.wikipedia.org/wiki/Xv_(software)
17829# Reference:	http://fileformats.archiveteam.org/wiki/XV_thumbnail
17830# Update:	Joerg Jenderek
178310	string		P7\ 332		XV thumbnail image data
17832#0	string		P7\ 332		XV "thumbnail file" (icon) data
17833!:mime	image/x-xv-thumbnail
17834# thumbnail .xvpic/foo.bar for graphic foo.bar
17835!:ext	p7/gif/tif/xpm/jpg
17836
17837# NITF is defined by United States MIL-STD-2500A
178380	string	NITF	National Imagery Transmission Format
17839>25	string	>\0	dated %.14s
17840
17841# GEM Image: Version 1, Headerlen 8 (Wolfram Kleff)
17842# Format variations from: Bernd Nuernberger <bernd.nuernberger@web.de>
17843# Update: Joerg Jenderek
17844# See http://fileformats.archiveteam.org/wiki/GEM_Raster
17845# For variations, also see:
17846#    https://www.seasip.info/Gem/ff_img.html (Ventura)
17847#    http://www.atari-wiki.com/?title=IMG_file (XIMG, STTT)
17848#    http://www.fileformat.info/format/gemraster/spec/index.htm (XIMG, STTT)
17849#    http://sylvana.net/1stguide/1STGUIDE.ENG (TIMG)
178500       beshort     0x0001
17851# header_size
17852>2      beshort     0x0008
17853>>0     use gem_info
17854>2      beshort     0x0009
17855>>0     use gem_info
17856# no example for NOSIG
17857>2      beshort     24
17858>>0     use gem_info
17859# no example for HYPERPAINT
17860>2      beshort     25
17861>>0     use gem_info
1786216      string      XIMG\0
17863>0      use gem_info
17864# no example
1786516      string      STTT\0\x10
17866>0      use gem_info
17867# no example or description
1786816      string      TIMG\0
17869>0      use gem_info
17870
178710   name        gem_info
17872# version is 2 for some XIMG and 1 for all others
17873>0	beshort		<0x0003		GEM
17874# https://www.snowstone.org.uk/riscos/mimeman/mimemap.txt
17875!:mime	image/x-gem
17876# header_size 24 25 27 59 779 words for colored bitmaps
17877>>2	beshort		>9
17878>>>16	string		STTT\0\x10	STTT
17879>>>16	string		TIMG\0		TIMG
17880# HYPERPAINT or NOSIG variant
17881>>>16	string		\0\x80
17882>>>>2	beshort		=24		NOSIG
17883>>>>2	beshort		!24		HYPERPAINT
17884# NOSIG or XIMG variant
17885>>>16	default		x
17886>>>>16	string		!XIMG\0		NOSIG
17887>>16	string		=XIMG\0		XIMG Image data
17888!:ext	img/ximg
17889# to avoid Warning: Current entry does not yet have a description for adding a EXTENSION type
17890>>16	string		!XIMG\0		Image data
17891!:ext	img
17892# header_size is 9 for Ventura files and 8 for other GEM Paint files
17893>>2	beshort		9		(Ventura)
17894#>>2	beshort		8		(Paint)
17895>>12	beshort		x		%d x
17896>>14	beshort		x		%d,
17897# 1 4 8
17898>>4	beshort		x		%d planes,
17899# in tenths of a millimetre
17900>>8	beshort		x		%d x
17901>>10	beshort		x		%d pixelsize
17902# pattern_size 1-8. 2 for GEM Paint
17903>>6	beshort		!2		\b, pattern size %d
17904
17905# GEM Metafile (Wolfram Kleff)
179060	lelong		0x0018FFFF	GEM Metafile data
17907>4	leshort		x		version %d
17908
17909#
17910# SMJPEG. A custom Motion JPEG format used by Loki Entertainment
17911# Software Torbjorn Andersson <d91tan@Update.UU.SE>.
17912#
179130	string	\0\nSMJPEG	SMJPEG
17914>8	belong	x		%d.x data
17915# According to the specification you could find any number of _TXT
17916# headers here, but I can't think of any way of handling that. None of
17917# the SMJPEG files I tried it on used this feature. Even if such a
17918# file is encountered the output should still be reasonable.
17919>16	string	_SND		\b,
17920>>24	beshort	>0		%d Hz
17921>>26	byte	8		8-bit
17922>>26	byte	16		16-bit
17923>>28	string	NONE		uncompressed
17924# >>28	string	APCM		ADPCM compressed
17925>>27	byte	1		mono
17926>>28	byte	2		stereo
17927# Help! Isn't there any way to avoid writing this part twice?
17928>>32	string	_VID		\b,
17929# >>>48	string	JFIF		JPEG
17930>>>40	belong	>0		%d frames
17931>>>44	beshort	>0		(%d x
17932>>>46	beshort	>0		%d)
17933>16	string	_VID		\b,
17934# >>32	string	JFIF		JPEG
17935>>24	belong	>0		%d frames
17936>>28	beshort	>0		(%d x
17937>>30	beshort	>0		%d)
17938
179390	string	Paint\ Shop\ Pro\ Image\ File	Paint Shop Pro Image File
17940
17941# taken from fkiss: (<yav@mte.biglobe.ne.jp> ?)
179420       string          KiSS            KISS/GS
17943>4      byte            16              color
17944>>5     byte            x               %d bit
17945>>8     leshort         x               %d colors
17946>>10    leshort         x               %d groups
17947>4      byte            32              cell
17948>>5     byte            x               %d bit
17949>>8     leshort         x               %d x
17950>>10    leshort         x               %d
17951>>12    leshort         x               +%d
17952>>14    leshort         x               +%d
17953
17954# Webshots (www.webshots.com), by John Harrison
179550       string          C\253\221g\230\0\0\0 Webshots Desktop .wbz file
17956
17957# Hercules DASD image files
17958# From Jan Jaeger <jj@septa.nl>
179590       string  CKD_P370        Hercules CKD DASD image file
17960>8      long    x               \b, %d heads per cylinder
17961>12     long    x               \b, track size %d bytes
17962>16     byte    x               \b, device type 33%2.2X
17963
179640       string  CKD_C370        Hercules compressed CKD DASD image file
17965>8      long    x               \b, %d heads per cylinder
17966>12     long    x               \b, track size %d bytes
17967>16     byte    x               \b, device type 33%2.2X
17968
179690       string  CKD_S370        Hercules CKD DASD shadow file
17970>8      long    x               \b, %d heads per cylinder
17971>12     long    x               \b, track size %d bytes
17972>16     byte    x               \b, device type 33%2.2X
17973
17974# Squeak images and programs - etoffi@softhome.net
179750	string		\146\031\0\0	Squeak image data
179760	search/1	'From\040Squeak	Squeak program text
17977
17978# partimage: file(1) magic for PartImage files (experimental, incomplete)
17979# Author: Hans-Joachim Baader <hjb@pro-linux.de>
179800		string	PaRtImAgE-VoLuMe	PartImage
17981>0x0020		string	0.6.1		file version %s
17982>>0x0060	lelong	>-1		volume %d
17983#>>0x0064 8 byte identifier
17984#>>0x007c reserved
17985>>0x0200	string	>\0		type %s
17986>>0x1400	string	>\0		device %s,
17987>>0x1600	string	>\0		original filename %s,
17988# Some fields omitted
17989>>0x2744	lelong	0		not compressed
17990>>0x2744	lelong	1		gzip compressed
17991>>0x2744	lelong	2		bzip2 compressed
17992>>0x2744	lelong	>2		compressed with unknown algorithm
17993>0x0020		string	>0.6.1		file version %s
17994>0x0020		string	<0.6.1		file version %s
17995
17996# DCX is multi-page PCX, using a simple header of up to 1024
17997# offsets for the respective PCX components.
17998# From: Joerg Wunsch <joerg_wunsch@uriah.heep.sax.de>
179990	lelong	987654321	DCX multi-page PCX image data
18000
18001# Simon Walton <simonw@matteworld.com>
18002# Kodak Cineon format for scanned negatives
18003# http://www.kodak.com/US/en/motion/support/dlad/
180040	lelong  0xd75f2a80	Cineon image data
18005>200	belong  >0		\b, %d x
18006>204	belong  >0		%d
18007
18008
18009# Bio-Rad .PIC is an image format used by microscope control systems
18010# and related image processing software used by biologists.
18011# From: Vebjorn Ljosa <vebjorn@ljosa.com>
18012# BOOL values are two-byte integers; use them to rule out false positives.
18013# https://web.archive.org/web/20050317223257/www.cs.ubc.ca/spider/ladic/text/biorad.txt
18014# Samples: https://www.loci.wisc.edu/software/sample-data
1801514	leshort <2
18016>62	leshort <2
18017>>54	leshort 12345		Bio-Rad .PIC Image File
18018>>>0	leshort >0		%d x
18019>>>2	leshort >0		%d,
18020>>>4	leshort =1		1 image in file
18021>>>4	leshort >1		%d images in file
18022
18023# From Jan "Yenya" Kasprzak <kas@fi.muni.cz>
18024# The description of *.mrw format can be found at
18025# http://www.dalibor.cz/minolta/raw_file_format.htm
180260	string	\000MRM			Minolta Dimage camera raw image data
18027
18028# Summary: DjVu image / document
18029# Extension: .djvu
18030# Reference: http://djvu.org/docs/DjVu3Spec.djvu
18031# Submitted by: Stephane Loeuillet <stephane.loeuillet@tiscali.fr>
18032# Modified by (1): Abel Cheung <abelcheung@gmail.com>
180330	string	AT&TFORM
18034>12	string	DJVM		DjVu multiple page document
18035!:mime	image/vnd.djvu
18036>12	string	DJVU		DjVu image or single page document
18037!:mime	image/vnd.djvu
18038>12	string	DJVI		DjVu shared document
18039!:mime	image/vnd.djvu
18040>12	string	THUM		DjVu page thumbnails
18041!:mime	image/vnd.djvu
18042
18043# Originally by Marc Espie
18044# Modified by Robert Minsk <robertminsk at yahoo.com>
18045# https://www.openexr.com/openexrfilelayout.pdf
180460	lelong		20000630	OpenEXR image data,
18047!:mime image/x-exr
18048>4	lelong&0x000000ff x		version %d,
18049>4	lelong		^0x00000200	storage: scanline
18050>4	lelong		&0x00000200	storage: tiled
18051>8	search/0x1000	compression\0	\b, compression:
18052>>&16	byte		0		none
18053>>&16	byte		1		rle
18054>>&16	byte		2		zips
18055>>&16	byte		3		zip
18056>>&16	byte		4		piz
18057>>&16	byte		5		pxr24
18058>>&16	byte		6		b44
18059>>&16	byte		7		b44a
18060>>&16	byte		8		dwaa
18061>>&16	byte		9		dwab
18062>>&16	byte		>9		unknown
18063>8	 search/0x1000	dataWindow\0	\b, dataWindow:
18064>>&10	lelong		x		(%d
18065>>&14	lelong		x		%d)-
18066>>&18	lelong		x		\b(%d
18067>>&22	lelong		x		%d)
18068>8	search/0x1000	displayWindow\0	\b, displayWindow:
18069>>&10	lelong		x		(%d
18070>>&14	lelong		x		%d)-
18071>>&18	lelong		x		\b(%d
18072>>&22	lelong		x		%d)
18073>8	search/0x1000	lineOrder\0	 \b, lineOrder:
18074>>&14	byte		0		increasing y
18075>>&14	byte		1		decreasing y
18076>>&14	byte		2		random y
18077>>&14	byte		>2		unknown
18078
18079# SMPTE Digital Picture Exchange Format, SMPTE DPX
18080#
18081# ANSI/SMPTE 268M-1994, SMPTE Standard for File Format for Digital
18082# Moving-Picture Exchange (DPX), v1.0, 18 February 1994
18083# Robert Minsk <robertminsk at yahoo.com>
18084# Modified by Harry Mallon <hjmallon at gmail.com>
180850	string		SDPX	DPX image data, big-endian,
18086!:mime image/x-dpx
18087>0	use		dpx_info
180880	string		XPDS	DPX image data, little-endian,
18089!:mime image/x-dpx
18090>0	use		\^dpx_info
18091
180920	name		dpx_info
18093>768	beshort		<4
18094>>772	belong		x	%dx
18095>>776	belong		x	\b%d,
18096>768	beshort		>3
18097>>776	belong		x	%dx
18098>>772	belong		x	\b%d,
18099>768	beshort		0	left to right/top to bottom
18100>768	beshort		1	right to left/top to bottom
18101>768	beshort		2	left to right/bottom to top
18102>768	beshort		3	right to left/bottom to top
18103>768	beshort		4	top to bottom/left to right
18104>768	beshort		5	top to bottom/right to left
18105>768	beshort		6	bottom to top/left to right
18106>768	beshort		7	bottom to top/right to left
18107
18108# From: Tom Hilinski <tom.hilinski@comcast.net>
18109# https://www.unidata.ucar.edu/packages/netcdf/
181100	string	CDF\001			NetCDF Data Format data
18111# 64-bit offset netcdf Classic https://www.unidata.ucar.edu/software/netcdf/docs/file_format_specifications
181120	string	CDF\002			NetCDF Data Format data (64-bit offset)
18113
18114#-----------------------------------------------------------------------
18115# Hierarchical Data Format, used to facilitate scientific data exchange
18116# specifications at http://hdf.ncsa.uiuc.edu/
181170	belong	0x0e031301	Hierarchical Data Format (version 4) data
18118!:mime	application/x-hdf
181190	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) data
18120!:mime	application/x-hdf
18121512	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) with 512 bytes user block
18122!:mime	application/x-hdf
181231024	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) with 1k user block
18124!:mime	application/x-hdf
181252048	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) with 2k user block
18126!:mime	application/x-hdf
181274096	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) with 4k user block
18128!:mime	application/x-hdf
18129
18130
18131# From: Tobias Burnus <burnus@net-b.de>
18132# Xara (for a while: Corel Xara) is a graphic package, see
18133# http://www.xara.com/ for Windows and as GPL application for Linux
181340	string	XARA\243\243	Xara graphics file
18135
18136# From:		Joerg Jenderek
18137# URL:		http://fileformats.archiveteam.org/wiki/Corel_Gallery
18138# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/b/bmf-corel.trid.xml
18139# Note:		called "Corel Binary Material Format" by TrID and
18140# 		"Corel Flow" by XnView
181410	string	@CorelBMF\n\rCorel\040Corporation 	Corel GALLERY Clipart
18142!:mime	image/x-corel-bmf
18143!:ext	bmf
18144
18145# https://www.cartesianinc.com/Tech/
18146# Reference:	http://fileformats.archiveteam.org/wiki/Cartesian_Perceptual_Compression
181470	string	CPC\262		Cartesian Perceptual Compression image
18148!:mime	image/x-cpi
18149!:ext	cpi/cpc
18150
18151# From Albert Cahalan <acahalan@gmail.com>
18152# puredigital used it for the CVS disposable camcorder
18153#8       lelong  4       ZBM bitmap image data
18154#>4      leshort x       %u x
18155#>6      leshort x       %u
18156
18157# From Albert Cahalan <acahalan@gmail.com>
18158# uncompressed 5:6:5 HighColor image for OLPC XO firmware icons
181590       string C565     OLPC firmware icon image data
18160>4      leshort x       %u x
18161>6      leshort x       %u
18162
18163# Applied Images - Image files from Cytovision
18164# Gustavo Junior Alves <gjalves@gjalves.com.br>
181650	string	\xce\xda\xde\xfa	Cytovision Metaphases file
181660	string	\xed\xad\xef\xac	Cytovision Karyotype file
181670	string	\x0b\x00\x03\x00	Cytovision FISH Probe file
181680	string	\xed\xfe\xda\xbe	Cytovision FLEX file
181690	string	\xed\xab\xed\xfe	Cytovision FLEX file
181700	string	\xad\xfd\xea\xad	Cytovision RATS file
18171
18172# Wavelet Scalar Quantization format used in gray-scale fingerprint images
18173# From Tano M Fotang <mfotang@quanteq.com>
181740	string	\xff\xa0\xff\xa8\x00	Wavelet Scalar Quantization image data
18175
18176# Type:		PCO B16 image files
18177# URL:		http://www.pco.de/fileadmin/user_upload/db/download/MA_CWDCOPIE_0412b.pdf
18178# From:		Florian Philipp <florian.philipp@binarywings.net>
18179# Extension:	.b16
18180# Description:	Pixel image format produced by PCO Camware, typically used
18181#		together with PCO cameras.
18182# Note:		Different versions exist for e.g. 8 bit and 16 bit images.
18183#		Documentation is incomplete.
181840	string/b	PCO-	PCO B16 image data
18185>12	lelong		x	\b, %dx
18186>16	lelong		x	\b%d
18187>20	lelong		0	\b, short header
18188>20	lelong		-1	\b, extended header
18189>>24	lelong		0	\b, grayscale
18190>>>36	lelong		0	linear LUT
18191>>>36	lelong		1	logarithmic LUT
18192>>>28	lelong		x	[%d
18193>>>32	lelong		x	\b,%d]
18194>>24	lelong		1	\b, color
18195>>>64	lelong		0	linear LUT
18196>>>64	lelong		1	logarithmic LUT
18197>>>40	lelong		x	r[%d
18198>>>44	lelong		x	\b,%d]
18199>>>48	lelong		x	g[%d
18200>>>52	lelong		x	\b,%d]
18201>>>56	lelong		x	b[%d
18202>>>60	lelong		x	\b,%d]
18203
18204# Polar Monitor Bitmap (.pmb) used as logo for Polar Electro watches
18205# From: Markus Heidelberg <markus.heidelberg at web.de>
182060	string/t	[BitmapInfo2]	Polar Monitor Bitmap text
18207!:mime	image/x-polar-monitor-bitmap
18208
18209# From: Rick Richardson <rickrich@gmail.com>
18210# updated by: Joerg Jenderek
18211# URL: http://techmods.net/nuvi/
182120	string	GARMIN\ BITMAP\ 01	Garmin Bitmap file
18213# extension is also used for
18214# Sony SRF raw image (image/x-sony-srf)
18215# SRF map
18216# Terragen Surface Map (https://www.planetside.co.uk/terragen)
18217# FileLocator Pro search criteria file (https://www.mythicsoft.com/filelocatorpro)
18218!:ext srf
18219#!:mime	image/x-garmin-srf
18220# version 1.00,2.00,2.10,2.40,2.50
18221>0x2f	string		>0		\b, version %4.4s
18222# width (2880,2881,3240)
18223>0x55	uleshort	>0		\b, %dx
18224# height (80,90)
18225>>0x53	uleshort	x		\b%d
18226
18227# Type:	Ulead Photo Explorer5 (.pe5)
18228# URL:	http://www.jisyo.com/cgibin/view.cgi?EXT=pe5 (Japanese)
18229# From:	Simon Horman <horms@debian.org>
182300	string	IIO2H			Ulead Photo Explorer5
18231
18232# Type:	X11 cursor
18233# URL:	http://webcvs.freedesktop.org/mime/shared-mime-info/freedesktop.org.xml.in?view=markup
18234# From:	Mathias Brodala <info@noctus.net>
182350	string	Xcur			X11 cursor
18236
18237# Type:	Olympus ORF raw images.
18238# URL:	https://libopenraw.freedesktop.org/wiki/Olympus_ORF
18239# From:	Adam Buchbinder <adam.buchbinder@gmail.com>
182400	string		MMOR		Olympus ORF raw image data, big-endian
18241!:mime	image/x-olympus-orf
182420	string		IIRO		Olympus ORF raw image data, little-endian
18243!:mime	image/x-olympus-orf
182440	string		IIRS		Olympus ORF raw image data, little-endian
18245!:mime	image/x-olympus-orf
18246
18247# Type: files used in modern AVCHD camcoders to store clip information
18248# Extension: .cpi
18249# From: Alexander Danilov <alexander.a.danilov@gmail.com>
182500	string	HDMV0100	AVCHD Clip Information
18251
18252# From: Adam Buchbinder <adam.buchbinder@gmail.com>
18253# URL: http://local.wasp.uwa.edu.au/~pbourke/dataformats/pic/
18254# Radiance HDR; usually has .pic or .hdr extension.
182550	string	#?RADIANCE\n	Radiance HDR image data
18256#!mime	image/vnd.radiance
18257
18258# From: Adam Buchbinder <adam.buchbinder@gmail.com>
18259# URL: https://www.mpi-inf.mpg.de/resources/pfstools/pfs_format_spec.pdf
18260# Used by the pfstools packages. The regex matches for the image size could
18261# probably use some work. The MIME type is made up; if there's one in
18262# actual common use, it should replace the one below.
182630	string	PFS1\x0a	PFS HDR image data
18264#!mime	image/x-pfs
18265>1	regex	[0-9]*\ 		\b, %s
18266>>1	regex	\ [0-9]{4}		\bx%s
18267
18268# Type: Foveon X3F
18269# URL:  https://www.photofo.com/downloads/x3f-raw-format.pdf
18270# From: Adam Buchbinder <adam.buchbinder@gmail.com>
18271# Note that the MIME type isn't defined anywhere that I can find; if
18272# there's a canonical type for this format, it should replace this one.
182730	string	FOVb	Foveon X3F raw image data
18274!:mime	image/x-x3f
18275>6	leshort	x	\b, version %d.
18276>4	leshort	x	\b%d
18277>28	lelong	x	\b, %dx
18278>32	lelong	x	\b%d
18279
18280# Paint.NET file
18281# From Adam Buchbinder <adam.buchbinder@gmail.com>
182820	string	PDN3	Paint.NET image data
18283!:mime	image/x-paintnet
18284
18285# Not really an image.
18286# From: "Tano M. Fotang" <mfotang@quanteq.com>
182870	string	\x46\x4d\x52\x00	ISO/IEC 19794-2 Format Minutiae Record (FMR)
18288
18289# doc: https://www.shikino.co.jp/eng/products/images/FLOWER.jpg.zip
18290# example: https://www.shikino.co.jp/eng/products/images/FLOWER.wdp.zip
1829190	bequad		0x574D50484F544F00	JPEG-XR Image
18292>98	byte&0x08	=0x08			\b, hard tiling
18293>99	byte&0x80	=0x80			\b, tiling present
18294>99	byte&0x40	=0x40			\b, codestream present
18295>99	byte&0x38	x			\b, spatial xform=
18296>99	byte&0x38	0x00			\bTL
18297>99	byte&0x38	0x08			\bBL
18298>99	byte&0x38	0x10			\bTR
18299>99	byte&0x38	0x18			\bBR
18300>99	byte&0x38	0x20			\bBT
18301>99	byte&0x38	0x28			\bRB
18302>99	byte&0x38	0x30			\bLT
18303>99	byte&0x38	0x38			\bLB
18304>100	byte&0x80	=0x80			\b, short header
18305>>102	beshort+1	x			\b, %d
18306>>104	beshort+1	x			\bx%d
18307>100	byte&0x80	=0x00			\b, long header
18308>>102	belong+1	x			\b, %x
18309>>106	belong+1	x			\bx%x
18310>101	beshort&0xf	x			\b, bitdepth=
18311>>101	beshort&0xf	0x0			\b1-WHITE=1
18312>>101	beshort&0xf	0x1			\b8
18313>>101	beshort&0xf	0x2			\b16
18314>>101	beshort&0xf	0x3			\b16-SIGNED
18315>>101	beshort&0xf	0x4			\b16-FLOAT
18316>>101	beshort&0xf	0x5			\b(reserved 5)
18317>>101	beshort&0xf	0x6			\b32-SIGNED
18318>>101	beshort&0xf	0x7			\b32-FLOAT
18319>>101	beshort&0xf	0x8			\b5
18320>>101	beshort&0xf	0x9			\b10
18321>>101	beshort&0xf	0xa			\b5-6-5
18322>>101	beshort&0xf	0xb			\b(reserved %d)
18323>>101	beshort&0xf	0xc			\b(reserved %d)
18324>>101	beshort&0xf	0xd			\b(reserved %d)
18325>>101	beshort&0xf	0xe			\b(reserved %d)
18326>>101	beshort&0xf	0xf			\b1-BLACK=1
18327>101	beshort&0xf0	x			\b, colorfmt=
18328>>101	beshort&0xf0	0x00			\bYONLY
18329>>101	beshort&0xf0	0x10			\bYUV240
18330>>101	beshort&0xf0	0x20			\bYWV422
18331>>101	beshort&0xf0	0x30			\bYWV444
18332>>101	beshort&0xf0	0x40			\bCMYK
18333>>101	beshort&0xf0	0x50			\bCMYKDIRECT
18334>>101	beshort&0xf0	0x60			\bNCOMPONENT
18335>>101	beshort&0xf0	0x70			\bRGB
18336>>101	beshort&0xf0	0x80			\bRGBE
18337>>101	beshort&0xf0	>0x80			\b(reserved 0x%x)
18338
18339# From: Johan van der Knijff <johan.vanderknijff@kb.nl>
18340#
18341# BPG (Better Portable Graphics) format
18342# https://bellard.org/bpg/
18343# http://fileformats.archiveteam.org/wiki/BPG
18344#
183450	string	\x42\x50\x47\xFB	BPG (Better Portable Graphics)
18346!:mime  image/bpg
18347
18348# From: Joerg Jenderek
18349# URL: https://en.wikipedia.org/wiki/Apple_Icon_Image_format
183500	string		icns		Mac OS X icon
18351!:mime	image/x-icns
18352!:apple	????icns
18353!:ext icns
18354>4	ubelong		>0
18355# file size
18356>>4	ubelong		x		\b, %d bytes
18357# icon type
18358>>8	string		x		\b, "%4.4s" type
18359
18360# TIM images
183610		lelong		0x00000010	TIM image,
18362>4		lelong  	0x8		4-Bit,
18363>4		lelong  	0x9		8-Bit,
18364>4		lelong  	0x2		15-Bit,
18365>4		lelong  	0x3		24-Bit,
18366>4		lelong 		&8
18367>>(8.l+12)	leshort		x		Pixel at (%d,
18368>>(8.l+14)	leshort		x		\b%d)
18369>>(8.l+16)	leshort		x		Size=%dx
18370>>(8.l+18)	leshort		x		\b%d,
18371>>4		lelong 		0x8		16 CLUT Entries at
18372>>4		lelong 		0x9		256 CLUT Entries at
18373>>12		leshort		x		(%d,
18374>>14		leshort		x		\b%d)
18375>4		lelong		^8
18376>>12		leshort		x		Pixel at (%d,
18377>>14		leshort		x		\b%d)
18378>>16		leshort		x		Size=%dx
18379>>18		leshort		x		\b%d
18380
18381# MDEC streams
183820		lelong		0x80010160	MDEC video stream,
18383>16		leshort		x		%dx
18384>18		leshort		x		\b%d
18385#>8		lelong		x		%d frames
18386#>4		leshort		x		secCount=%d;
18387#>6		leshort		x		nSectors=%d;
18388#>12		lelong		x		frameSize=%d;
18389
18390# BS encoded bitstreams
183912		leshort		0x3800		BS image,
18392>6		leshort		x		Version %d,
18393>4		leshort		x		Quantization %d,
18394>0		leshort		x		(Decompresses to %d words)
18395
18396# Type: farbfeld image.
18397# Url: http://tools.suckless.org/farbfeld/
18398# From: Ian D. Scott <ian@iandouglasscott.com>
18399#
184000		string		farbfeld	farbfeld image data,
18401>8		ubelong		x		%dx
18402>12		ubelong		x		\b%d
18403
18404# Type: Microsoft DirectDraw Surface (common data)
18405# URL:	https://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp
18406# From: Morten Hustveit <morten@debian.org>
18407# Updated by: David Korth <gerbilsoft@gerbilsoft.com>
184080	name	ms-directdraw-surface
18409>0x10	ulelong	x			%u x
18410>0x0C	ulelong	x			%u
18411# Color depth.
18412>0x58	ulelong	>0			\b, %u-bit color
18413# Determine the pixel format.
18414>0x50	ulelong&0x4	4
18415# FIXME: Handle DX10 and XBOX formats.
18416>>0x54	string	x			\b, compressed using %.4s
18417>0x50	ulelong&0x2	0x2		\b, alpha only
18418>0x50	ulelong&0x200	0x200		\b, YUV
18419>0x50	ulelong&0x20000	0x20000		\b, luminance
18420# RGB pixel format
18421>0x50	ulelong&0x40	0x40
18422
18423# Determine the RGB format using the color masks.
18424# ulequad order: 0xGGGGGGGGRRRRRRRR, 0xAAAAAAAABBBBBBBB
18425
18426>>0x58		ulelong	16
18427
18428# NOTE: 15-bit color formats usually have 16-bit listed as the color depth.
18429>>>0x5C		ulequad	0x000003E000007C00
18430>>>>0x64	ulequad 0x000000000000001F	\b, RGB555
18431>>>0x5C		ulequad	0x000003E000001F00
18432>>>>0x64	ulequad 0x000000000000007C	\b, BGR555
18433
18434>>>0x5C		ulequad	0x000007E00000F800
18435>>>>0x64	ulequad 0x000000000000001F	\b, RGB565
18436>>>0x5C		ulequad	0x000007E000001F00
18437>>>>0x64	ulequad 0x00000000000000F8	\b, BGR565
18438
18439>>>0x5C		ulequad	0x000000F000000F00
18440>>>>0x64	ulequad 0x0000F0000000000F	\b, ARGB4444
18441>>>0x5C		ulequad	0x000000F00000000F
18442>>>>0x64	ulequad 0x0000F00000000F00	\b, ABGR4444
18443
18444>>>0x5C		ulequad	0x00000F000000F000
18445>>>>0x64	ulequad 0x0000000F000000F0	\b, RGBA4444
18446>>>0x5C		ulequad	0x00000F00000000F0
18447>>>>0x64	ulequad 0x0000000F0000F000	\b, BGRA4444
18448
18449>>>0x5C		ulequad	0x000000F000000F00
18450>>>>0x64	ulequad 0x000000000000000F	\b, xRGB4444
18451>>>0x5C		ulequad	0x000000F00000000F
18452>>>>0x64	ulequad 0x0000000000000F00	\b, xBGR4444
18453
18454>>>0x5C		ulequad	0x00000F000000F000
18455>>>>0x64	ulequad 0x00000000000000F0	\b, RGBx4444
18456>>>0x5C		ulequad	0x00000F00000000F0
18457>>>>0x64	ulequad 0x000000000000F000	\b, BGRx4444
18458
18459>>>0x5C		ulequad	0x000003E000007C00
18460>>>>0x64	ulequad 0x000080000000001F	\b, ARGB1555
18461>>>0x5C		ulequad	0x000003E000001F00
18462>>>>0x64	ulequad 0x000080000000007C	\b, ABGR1555
18463>>>0x5C		ulequad	0x000007C00000F800
18464>>>>0x64	ulequad 0x000000010000003E	\b, RGBA5551
18465>>>0x5C		ulequad	0x000007C00000003E
18466>>>>0x64	ulequad 0x000000010000F800	\b, BGRA5551
18467
18468>>88		ulelong 24
18469>>>0x5C		ulequad	0x0000FF0000FF0000
18470>>>>0x64	ulequad 0x00000000000000FF	\b, RGB888
18471>>>0x5C		ulequad	0x0000FF00000000FF
18472>>>>0x64	ulequad 0x0000000000FF0000	\b, BGR888
18473
18474>>88		ulelong 32
18475>>>0x5C		ulequad	0x0000FF0000FF0000
18476>>>>0x64	ulequad 0xFF000000000000FF	\b, ARGB8888
18477>>>0x5C		ulequad	0x0000FF00000000FF
18478>>>>0x64	ulequad 0xFF00000000FF0000	\b, ABGR8888
18479
18480>>>0x5C		ulequad	0x00FF0000FF000000
18481>>>>0x64	ulequad 0x000000FF0000FF00	\b, RGBA8888
18482>>>0x5C		ulequad	0x00FF00000000FF00
18483>>>>0x64	ulequad 0x000000FFFF000000	\b, BGBA8888
18484
18485>>>0x5C		ulequad	0x0000FF0000FF0000
18486>>>>0x64	ulequad 0x00000000000000FF	\b, xRGB8888
18487>>>0x5C		ulequad	0x0000FF00000000FF
18488>>>>0x64	ulequad 0x0000000000FF0000	\b, xBGR8888
18489
18490>>>0x5C		ulequad	0x00FF0000FF000000
18491>>>>0x64	ulequad 0x000000000000FF00	\b, RGBx8888
18492>>>0x5C		ulequad	0x00FF00000000FF00
18493>>>>0x64	ulequad 0x00000000FF000000	\b, BGBx8888
18494
18495# Less common 32-bit color formats.
18496>>>0x5C		ulequad	0xFFFF00000000FFFF
18497>>>>0x64	ulequad 0x0000000000000000	\b, G16R16
18498>>>0x5C		ulequad	0x0000FFFFFFFF0000
18499>>>>0x64	ulequad 0x0000000000000000	\b, R16G16
18500
18501>>>0x5C		ulequad	0x000FFC003FF00000
18502>>>>0x64	ulequad 0xC0000000000003FF	\b, A2R10G10B10
18503>>>0x5C		ulequad	0x000FFC00000003FF
18504>>>>0x64	ulequad 0xC00000003FF00000	\b, A2B10G10R10
18505
18506# Type: Microsoft DirectDraw Surface
18507# URL:	https://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp
18508# From: Morten Hustveit <morten@debian.org>
18509# Updated by: David Korth <gerbilsoft@gerbilsoft.com>
185100	string/b	DDS\040\174\000\000\000 Microsoft DirectDraw Surface (DDS):
18511>0	use	ms-directdraw-surface
18512
18513# Type: Sega PVR image.
18514# From: David Korth <gerbilsoft@gerbilsoft.com>
18515# References:
18516# - https://fabiensanglard.net/Mykaruga/tools/segaPVRFormat.txt
18517# - https://github.com/yazgoo/pvrx2png
18518# - https://github.com/nickworonekin/puyotools
18519
18520# Sega PVR header.
185210	name	sega-pvr-image-header
18522>0x0C	leshort	x	%u x
18523>0x0E	leshort	x	%u
18524# Image format.
18525>0x08	byte	0	\b, ARGB1555
18526>0x08	byte	1	\b, RGB565
18527>0x08	byte	2	\b, ARGB4444
18528>0x08	byte	3	\b, YUV442
18529>0x08	byte	4	\b, Bump
18530>0x08	byte	5	\b, 4bpp
18531>0x08	byte	6	\b, 8bpp
18532# Image data type.
18533>0x09	byte	0x01	\b, square twiddled
18534>0x09	byte	0x02	\b, square twiddled & mipmap
18535>0x09	byte	0x03	\b, VQ
18536>0x09	byte	0x04	\b, VQ & mipmap
18537>0x09	byte	0x05	\b, 8-bit CLUT twiddled
18538>0x09	byte	0x06	\b, 4-bit CLUT twiddled
18539>0x09	byte	0x07	\b, 8-bit direct twiddled
18540>0x09	byte	0x08	\b, 4-bit direct twiddled
18541>0x09	byte	0x09	\b, rectangle
18542>0x09	byte	0x0B	\b, rectangular stride
18543>0x09	byte	0x0D	\b, rectangular twiddled
18544>0x09	byte	0x10	\b, small VQ
18545>0x09	byte	0x11	\b, small VQ & mipmap
18546>0x09	byte	0x12	\b, square twiddled & mipmap
18547
18548# Sega PVR image.
185490	string	PVRT
18550>0x10	string	DDS\040\174\000\000\000 Sega PVR (Xbox) image:
18551>>0x20	use	ms-directdraw-surface
18552>0x10	belong	!0x44445320		Sega PVR image:
18553>>0	use	sega-pvr-image-header
18554
18555# Sega PVR image with GBIX.
185560	string	GBIX
18557>0x10	string	PVRT
18558>>0x10	string	DDS\040\174\000\000\000 Sega PVR (Xbox) image:
18559>>>0x20	use	ms-directdraw-surface
18560>>0x10	belong	!0x44445320		Sega PVR image:
18561>>>0x10	use	sega-pvr-image-header
18562>>0x08	lelong	x	\b, global index = %u
18563
18564# Sega GVR header.
185650	name	sega-gvr-image-header
18566>0x0C	beshort	x	%u x
18567>0x0E	beshort	x	%u
18568# Image data format.
18569>0x0B	byte	0	\b, I4
18570>0x0B	byte	1	\b, I8
18571>0x0B	byte	2	\b, IA4
18572>0x0B	byte	3	\b, IA8
18573>0x0B	byte	4	\b, RGB565
18574>0x0B	byte	5	\b, RGB5A3
18575>0x0B	byte	6	\b, ARGB8888
18576>0x0B	byte	8	\b, CI4
18577>0x0B	byte	9	\b, CI8
18578>0x0B	byte	14	\b, DXT1
18579
18580# Sega GVR image.
185810	string	GVRT	Sega GVR image:
18582>0x10	use	sega-gvr-image-header
18583
18584# Sega GVR image with GBIX.
185850	string	GBIX
18586>0x10	string	GVRT	Sega GVR image:
18587>>0x10	use	sega-gvr-image-header
18588>>0x08	belong	x	\b, global index = %u
18589
18590# Sega GVR image with GCIX. (Wii)
185910	string	GCIX
18592>0x10	string	GVRT	Sega GVR image:
18593>>0x10	use	sega-gvr-image-header
18594>>0x08	belong	x	\b, global index = %u
18595
18596# Light Field Picture
18597# Documentation: http://optics.miloush.net/lytro/TheFileFormat.aspx
18598# Typical file extensions: .lfp .lfr .lfx
18599
186000	belong	0x894C4650
18601>4	belong	0x0D0A1A0A
18602>12	belong	0x00000000	Lytro Light Field Picture
18603>8	belong	x		\b, version %d
18604
18605# Type: Vision Research Phantom CINE Format
18606# URL: https://www.phantomhighspeed.com/
18607# URL2: http://phantomhighspeed.force.com/vriknowledge/servlet/fileField?id=0BEU0000000Cfyk
18608# From: Harry Mallon <hjmallon at gmail.com>
18609#
18610# This has a short "CI" code but the 44 is the size of the struct which is
18611# stable
186120	string	CI
18613>2	leshort 44		Vision Research CINE Video,
18614>>4	leshort	0		Grayscale,
18615>>4	leshort 1		JPEG Compressed,
18616>>4	leshort 2		RAW,
18617>>6	leshort x		version %d,
18618>>20	lelong	x		%d frames,
18619>>48	lelong	x		%dx
18620>>52	lelong	x		\b%d
18621
18622# Type: ARRI Raw Image
18623# Info: SMPTE RDD30:2014
18624# From: Harry Mallon <hjmallon at gmail.com>
186250	string ARRI		ARRI ARI image data,
18626>4	lelong 0x78563412	little-endian,
18627>4 	lelong 0x12345678	big-endian,
18628>12	lelong x		version %d,
18629>20	lelong x 		%dx
18630>24	lelong x		\b%d
18631
18632# Type: Khronos KTX texture.
18633# From: David Korth <gerbilsoft@gerbilsoft.com>
18634# Reference: https://www.khronos.org/opengles/sdk/tools/KTX/file_format_spec/
18635
18636# glEnum decoding.
18637# NOTE: Only the most common formats are listed here.
186380	name	khronos-ktx-glEnum
18639>0	lelong	0x1907	\b, RGB
18640>0	lelong	0x1908	\b, RGBA
18641>0	lelong	0x1909	\b, LUMINANCE
18642>0	lelong	0x190A	\b, LUMINANCE_ALPHA
18643>0	lelong	0x80E1	\b, BGR
18644>0	lelong	0x80E2	\b, BGRA
18645>0	lelong	0x83A0	\b, RGB_S3TC
18646>0	lelong	0x83A1	\b, RGB4_S3TC
18647>0	lelong	0x83A2	\b, RGBA_S3TC
18648>0	lelong	0x83A3	\b, RGBA4_S3TC
18649>0	lelong	0x83A4	\b, RGBA_DXT5_S3TC
18650>0	lelong	0x83A5	\b, RGBA4_DXT5_S3TC
18651>0	lelong	0x83F0	\b, COMPRESSED_RGB_S3TC_DXT1_EXT
18652>0	lelong	0x83F1	\b, COMPRESSED_RGBA_S3TC_DXT1_EXT
18653>0	lelong	0x83F2	\b, COMPRESSED_RGBA_S3TC_DXT3_EXT
18654>0	lelong	0x83F3	\b, COMPRESSED_RGBA_S3TC_DXT5_EXT
18655>0	lelong	0x8D64	\b, ETC1_RGB8_OES
18656>0	lelong	0x9270	\b, COMPRESSED_R11_EAC
18657>0	lelong	0x9271	\b, COMPRESSED_SIGNED_R11_EAC
18658>0	lelong	0x9272	\b, COMPRESSED_RG11_EAC
18659>0	lelong	0x9273	\b, COMPRESSED_SIGNED_RG11_EAC
18660>0	lelong	0x9274	\b, COMPRESSED_RGB8_ETC2
18661>0	lelong	0x9275	\b, COMPRESSED_SRGB8_ETC2
18662>0	lelong	0x9276	\b, COMPRESSED_RGB8_PUNCHTHROUGH_ALPHA1_ETC2
18663>0	lelong	0x9277	\b, COMPRESSED_SRGB8_PUNCHTHROUGH_ALPHA1_ETC2
18664>0	lelong	0x9278	\b, COMPRESSED_RGBA2_ETC2_EAC
18665>0	lelong	0x9279	\b, COMPRESSED_SRGB8_ALPHA8_ETC2_EAC
18666>0	lelong	0x93B0	\b, COMPRESSED_RGBA_ASTC_4x4_KHR
18667>0	lelong	0x93B1	\b, COMPRESSED_RGBA_ASTC_5x4_KHR
18668>0	lelong	0x93B2	\b, COMPRESSED_RGBA_ASTC_5x5_KHR
18669>0	lelong	0x93B3	\b, COMPRESSED_RGBA_ASTC_6x5_KHR
18670>0	lelong	0x93B4	\b, COMPRESSED_RGBA_ASTC_6x6_KHR
18671>0	lelong	0x93B5	\b, COMPRESSED_RGBA_ASTC_8x5_KHR
18672>0	lelong	0x93B6	\b, COMPRESSED_RGBA_ASTC_8x6_KHR
18673>0	lelong	0x93B7	\b, COMPRESSED_RGBA_ASTC_8x8_KHR
18674>0	lelong	0x93B8	\b, COMPRESSED_RGBA_ASTC_10x5_KHR
18675>0	lelong	0x93B9	\b, COMPRESSED_RGBA_ASTC_10x6_KHR
18676>0	lelong	0x93BA	\b, COMPRESSED_RGBA_ASTC_10x8_KHR
18677>0	lelong	0x93BB	\b, COMPRESSED_RGBA_ASTC_10x10_KHR
18678>0	lelong	0x93BC	\b, COMPRESSED_RGBA_ASTC_12x10_KHR
18679>0	lelong	0x93BD	\b, COMPRESSED_RGBA_ASTC_12x12_KHR
18680>0	lelong	0x93D0	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_4x4_KHR
18681>0	lelong	0x93D1	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_5x4_KHR
18682>0	lelong	0x93D2	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_5x5_KHR
18683>0	lelong	0x93D3	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_6x5_KHR
18684>0	lelong	0x93D4	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_6x6_KHR
18685>0	lelong	0x93D5	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_8x5_KHR
18686>0	lelong	0x93D6	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_8x6_KHR
18687>0	lelong	0x93D7	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_8x8_KHR
18688>0	lelong	0x93D8	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x5_KHR
18689>0	lelong	0x93D9	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x6_KHR
18690>0	lelong	0x93DA	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x8_KHR
18691>0	lelong	0x93DB	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x10_KHR
18692>0	lelong	0x93DC	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_12x10_KHR
18693>0	lelong	0x93DD	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_12x12_KHR
18694
18695# Endian-specific KTX header.
18696# TODO: glType (all textures I've seen so far are GL_UNSIGNED_BYTE)
186970	name	khronos-ktx-endian-header
18698>20	lelong	x	\b, %u
18699>24	lelong	>1	x %u
18700>28	lelong	>1	x %u
18701>8	lelong	>0
18702>>8	use	khronos-ktx-glEnum
18703>8	lelong	0
18704>>12	use	khronos-ktx-glEnum
18705
18706# Main KTX header.
18707# Determine endianness, then check the rest of the header.
187080	string	\xABKTX\ 11\xBB\r\n\x1A\n	Khronos KTX texture
18709>12	lelong	0x04030201			(little-endian)
18710>>16	use	khronos-ktx-endian-header
18711>12	belong	0x04030201			(big-endian)
18712>>16	use	\^khronos-ktx-endian-header
18713
18714# Type: Khronos KTX2 texture.
18715# From: David Korth <gerbilsoft@gerbilsoft.com>
18716# Based on draft19.
18717# Reference: http://github.khronos.org/KTX-Specification/
18718
18719# Supercompression enum.
187200	name	khronos-ktx2-supercompression
18721>0	lelong	1	BasisLZ
18722>0	lelong	2	Zstandard
18723>0	lelong	3	ZLIB
18724
18725# Vulkan format identifier.
18726# NOTE: Formats prohibited from KTX2 are commented out.
187270	name	khronos-ktx2-vkFormat
18728>0	lelong	0	UNDEFINED
18729>0	lelong	1	R4G4_UNORM_PACK8
18730>0	lelong	2	R4G4B4A4_UNORM_PACK16
18731>0	lelong	3	B4G4R4A4_UNORM_PACK16
18732>0	lelong	4	R5G6B5_UNORM_PACK16
18733>0	lelong	5	B5G6R5_UNORM_PACK16
18734>0	lelong	6	R5G5B5A1_UNORM_PACK16
18735>0	lelong	7	B5G5R5A1_UNORM_PACK16
18736>0	lelong	8	A1R5G5B5_UNORM_PACK16
18737>0	lelong	9	R8_UNORM
18738>0	lelong	10	R8_SNORM
18739#>0	lelong	11	R8_USCALED
18740#>0	lelong	12	R8_SSCALED
18741>0	lelong	13	R8_UINT
18742>0	lelong	14	R8_SINT
18743>0	lelong	15	R8_SRGB
18744>0	lelong	16	R8G8_UNORM
18745>0	lelong	17	R8G8_SNORM
18746#>0	lelong	18	R8G8_USCALED
18747#>0	lelong	19	R8G8_SSCALED
18748>0	lelong	20	R8G8_UINT
18749>0	lelong	21	R8G8_SINT
18750>0	lelong	22	R8G8_SRGB
18751>0	lelong	23	R8G8B8_UNORM
18752>0	lelong	24	R8G8B8_SNORM
18753#>0	lelong	25	R8G8B8_USCALED
18754#>0	lelong	26	R8G8B8_SSCALED
18755>0	lelong	27	R8G8B8_UINT
18756>0	lelong	28	R8G8B8_SINT
18757>0	lelong	29	R8G8B8_SRGB
18758>0	lelong	30	B8G8R8_UNORM
18759>0	lelong	31	B8G8R8_SNORM
18760#>0	lelong	32	B8G8R8_USCALED
18761#>0	lelong	33	B8G8R8_SSCALED
18762>0	lelong	34	B8G8R8_UINT
18763>0	lelong	35	B8G8R8_SINT
18764>0	lelong	36	B8G8R8_SRGB
18765>0	lelong	37	R8G8B8A8_UNORM
18766>0	lelong	38	R8G8B8A8_SNORM
18767#>0	lelong	39	R8G8B8A8_USCALED
18768#>0	lelong	40	R8G8B8A8_SSCALED
18769>0	lelong	41	R8G8B8A8_UINT
18770>0	lelong	42	R8G8B8A8_SINT
18771>0	lelong	43	R8G8B8A8_SRGB
18772>0	lelong	44	B8G8R8A8_UNORM
18773>0	lelong	45	B8G8R8A8_SNORM
18774#>0	lelong	46	B8G8R8A8_USCALED
18775#>0	lelong	47	B8G8R8A8_SSCALED
18776>0	lelong	48	B8G8R8A8_UINT
18777>0	lelong	49	B8G8R8A8_SINT
18778>0	lelong	50	B8G8R8A8_SRGB
18779#>0	lelong	51	A8B8G8R8_UNORM_PACK32
18780#>0	lelong	52	A8B8G8R8_SNORM_PACK32
18781#>0	lelong	53	A8B8G8R8_USCALED_PACK32
18782#>0	lelong	54	A8B8G8R8_SSCALED_PACK32
18783#>0	lelong	55	A8B8G8R8_UINT_PACK32
18784#>0	lelong	56	A8B8G8R8_SINT_PACK32
18785#>0	lelong	57	A8B8G8R8_SRGB_PACK32
18786>0	lelong	58	A2R10G10B10_UNORM_PACK32
18787>0	lelong	59	A2R10G10B10_SNORM_PACK32
18788#>0	lelong	60	A2R10G10B10_USCALED_PACK32
18789#>0	lelong	61	A2R10G10B10_SSCALED_PACK32
18790>0	lelong	62	A2R10G10B10_UINT_PACK32
18791>0	lelong	63	A2R10G10B10_SINT_PACK32
18792>0	lelong	64	A2B10G10R10_UNORM_PACK32
18793>0	lelong	65	A2B10G10R10_SNORM_PACK32
18794#>0	lelong	66	A2B10G10R10_USCALED_PACK32
18795#>0	lelong	67	A2B10G10R10_SSCALED_PACK32
18796>0	lelong	68	A2B10G10R10_UINT_PACK32
18797>0	lelong	69	A2B10G10R10_SINT_PACK32
18798>0	lelong	70	R16_UNORM
18799>0	lelong	71	R16_SNORM
18800#>0	lelong	72	R16_USCALED
18801#>0	lelong	73	R16_SSCALED
18802>0	lelong	74	R16_UINT
18803>0	lelong	75	R16_SINT
18804>0	lelong	76	R16_SFLOAT
18805>0	lelong	77	R16G16_UNORM
18806>0	lelong	78	R16G16_SNORM
18807#>0	lelong	79	R16G16_USCALED
18808#>0	lelong	80	R16G16_SSCALED
18809>0	lelong	81	R16G16_UINT
18810>0	lelong	82	R16G16_SINT
18811>0	lelong	83	R16G16_SFLOAT
18812>0	lelong	84	R16G16B16_UNORM
18813>0	lelong	85	R16G16B16_SNORM
18814#>0	lelong	86	R16G16B16_USCALED
18815#>0	lelong	87	R16G16B16_SSCALED
18816>0	lelong	88	R16G16B16_UINT
18817>0	lelong	89	R16G16B16_SINT
18818>0	lelong	90	R16G16B16_SFLOAT
18819>0	lelong	91	R16G16B16A16_UNORM
18820>0	lelong	92	R16G16B16A16_SNORM
18821#>0	lelong	93	R16G16B16A16_USCALED
18822#>0	lelong	94	R16G16B16A16_SSCALED
18823>0	lelong	95	R16G16B16A16_UINT
18824>0	lelong	96	R16G16B16A16_SINT
18825>0	lelong	97	R16G16B16A16_SFLOAT
18826>0	lelong	98	R32_UINT
18827>0	lelong	99	R32_SINT
18828>0	lelong	100	R32_SFLOAT
18829>0	lelong	101	R32G32_UINT
18830>0	lelong	102	R32G32_SINT
18831>0	lelong	103	R32G32_SFLOAT
18832>0	lelong	104	R32G32B32_UINT
18833>0	lelong	105	R32G32B32_SINT
18834>0	lelong	106	R32G32B32_SFLOAT
18835>0	lelong	107	R32G32B32A32_UINT
18836>0	lelong	108	R32G32B32A32_SINT
18837>0	lelong	109	R32G32B32A32_SFLOAT
18838>0	lelong	110	R64_UINT
18839>0	lelong	111	R64_SINT
18840>0	lelong	112	R64_SFLOAT
18841>0	lelong	113	R64G64_UINT
18842>0	lelong	114	R64G64_SINT
18843>0	lelong	115	R64G64_SFLOAT
18844>0	lelong	116	R64G64B64_UINT
18845>0	lelong	117	R64G64B64_SINT
18846>0	lelong	118	R64G64B64_SFLOAT
18847>0	lelong	119	R64G64B64A64_UINT
18848>0	lelong	120	R64G64B64A64_SINT
18849>0	lelong	121	R64G64B64A64_SFLOAT
18850>0	lelong	122	B10G11R11_UFLOAT_PACK32
18851>0	lelong	123	E5B9G9R9_UFLOAT_PACK32
18852>0	lelong	124	D16_UNORM
18853>0	lelong	125	X8_D24_UNORM_PACK32
18854>0	lelong	126	D32_SFLOAT
18855>0	lelong	127	S8_UINT
18856>0	lelong	128	D16_UNORM_S8_UINT
18857>0	lelong	129	D24_UNORM_S8_UINT
18858>0	lelong	130	D32_SFLOAT_S8_UINT
18859
18860>0	lelong	131	BC1_RGB_UNORM_BLOCK
18861>0	lelong	132	BC1_RGB_SRGB_BLOCK
18862>0	lelong	133	BC1_RGBA_UNORM_BLOCK
18863>0	lelong	134	BC1_RGBA_SRGB_BLOCK
18864>0	lelong	135	BC2_UNORM_BLOCK
18865>0	lelong	136	BC2_SRGB_BLOCK
18866>0	lelong	137	BC3_UNORM_BLOCK
18867>0	lelong	138	BC3_SRGB_BLOCK
18868>0	lelong	139	BC4_UNORM_BLOCK
18869>0	lelong	140	BC4_SNORM_BLOCK
18870>0	lelong	141	BC5_UNORM_BLOCK
18871>0	lelong	142	BC5_SNORM_BLOCK
18872>0	lelong	143	BC6H_UFLOAT_BLOCK
18873>0	lelong	144	BC6H_SFLOAT_BLOCK
18874>0	lelong	145	BC7_UNORM_BLOCK
18875>0	lelong	146	BC7_SRGB_BLOCK
18876
18877>0	lelong	147	ETC2_R8G8B8_UNORM_BLOCK
18878>0	lelong	148	ETC2_R8G8B8_SRGB_BLOCK
18879>0	lelong	149	ETC2_R8G8B8A1_UNORM_BLOCK
18880>0	lelong	150	ETC2_R8G8B8A1_SRGB_BLOCK
18881>0	lelong	151	ETC2_R8G8B8A8_UNORM_BLOCK
18882>0	lelong	152	ETC2_R8G8B8A8_SRGB_BLOCK
18883
18884>0	lelong	153	EAC_R11_UNORM_BLOCK
18885>0	lelong	154	EAC_R11_SNORM_BLOCK
18886>0	lelong	155	EAC_R11G11_UNORM_BLOCK
18887>0	lelong	156	EAC_R11G11_SNORM_BLOCK
18888
18889>0	lelong	157	ASTC_4x4_UNORM_BLOCK
18890>0	lelong	158	ASTC_4x4_SRGB_BLOCK
18891>0	lelong	159	ASTC_5x4_UNORM_BLOCK
18892>0	lelong	160	ASTC_5x4_SRGB_BLOCK
18893>0	lelong	161	ASTC_5x5_UNORM_BLOCK
18894>0	lelong	162	ASTC_5x5_SRGB_BLOCK
18895>0	lelong	163	ASTC_6x5_UNORM_BLOCK
18896>0	lelong	164	ASTC_6x5_SRGB_BLOCK
18897>0	lelong	165	ASTC_6x6_UNORM_BLOCK
18898>0	lelong	166	ASTC_6x6_SRGB_BLOCK
18899>0	lelong	167	ASTC_8x5_UNORM_BLOCK
18900>0	lelong	168	ASTC_8x5_SRGB_BLOCK
18901>0	lelong	169	ASTC_8x6_UNORM_BLOCK
18902>0	lelong	170	ASTC_8x6_SRGB_BLOCK
18903>0	lelong	171	ASTC_8x8_UNORM_BLOCK
18904>0	lelong	172	ASTC_8x8_SRGB_BLOCK
18905>0	lelong	173	ASTC_10x5_UNORM_BLOCK
18906>0	lelong	174	ASTC_10x5_SRGB_BLOCK
18907>0	lelong	175	ASTC_10x6_UNORM_BLOCK
18908>0	lelong	176	ASTC_10x6_SRGB_BLOCK
18909>0	lelong	177	ASTC_10x8_UNORM_BLOCK
18910>0	lelong	178	ASTC_10x8_SRGB_BLOCK
18911>0	lelong	179	ASTC_10x10_UNORM_BLOCK
18912>0	lelong	180	ASTC_10x10_SRGB_BLOCK
18913>0	lelong	181	ASTC_12x10_UNORM_BLOCK
18914>0	lelong	182	ASTC_12x10_SRGB_BLOCK
18915>0	lelong	183	ASTC_12x12_UNORM_BLOCK
18916>0	lelong	184	ASTC_12x12_SRGB_BLOCK
18917
18918>0	lelong	1000156000	G8B8G8R8_422_UNORM
18919>0	lelong	1000156001	B8G8R8G8_422_UNORM
18920>0	lelong	1000156002	G8_B8_R8_3PLANE_420_UNORM
18921>0	lelong	1000156003	G8_B8R8_2PLANE_420_UNORM
18922>0	lelong	1000156004	G8_B8_R8_3PLANE_422_UNORM
18923>0	lelong	1000156005	G8_B8R8_2PLANE_422_UNORM
18924>0	lelong	1000156006	G8_B8_R8_3PLANE_444_UNORM
18925>0	lelong	1000156007	R10X6_UNORM_PACK16
18926>0	lelong	1000156008	R10X6G10X6_UNORM_2PACK16
18927>0	lelong	1000156009	R10X6G10X6B10X6A10X6_UNORM_4PACK16
18928>0	lelong	1000156010	G10X6B10X6G10X6R10X6_422_UNORM_4PACK16
18929>0	lelong	1000156011	B10X6G10X6R10X6G10X6_422_UNORM_4PACK16
18930>0	lelong	1000156012	G10X6_B10X6_R10X6_3PLANE_420_UNORM_3PACK16
18931>0	lelong	1000156013	G10X6_B10X6R10X6_2PLANE_420_UNORM_3PACK16
18932>0	lelong	1000156014	G10X6_B10X6_R10X6_3PLANE_422_UNORM_3PACK16
18933>0	lelong	1000156015	G10X6_B10X6R10X6_2PLANE_422_UNORM_3PACK16
18934>0	lelong	1000156016	G10X6_B10X6_R10X6_3PLANE_444_UNORM_3PACK16
18935>0	lelong	1000156017	R12X4_UNORM_PACK16
18936>0	lelong	1000156018	R12X4G12X4_UNORM_2PACK16
18937>0	lelong	1000156019	R12X4G12X4B12X4A12X4_UNORM_4PACK16
18938>0	lelong	1000156020	G12X4B12X4G12X4R12X4_422_UNORM_4PACK16
18939>0	lelong	1000156021	B12X4G12X4R12X4G12X4_422_UNORM_4PACK16
18940>0	lelong	1000156022	G12X4_B12X4_R12X4_3PLANE_420_UNORM_3PACK16
18941>0	lelong	1000156023	G12X4_B12X4R12X4_2PLANE_420_UNORM_3PACK16
18942>0	lelong	1000156024	G12X4_B12X4_R12X4_3PLANE_422_UNORM_3PACK16
18943>0	lelong	1000156025	G12X4_B12X4R12X4_2PLANE_422_UNORM_3PACK16
18944>0	lelong	1000156026	G12X4_B12X4_R12X4_3PLANE_444_UNORM_3PACK16
18945>0	lelong	1000156027	G16B16G16R16_422_UNORM
18946>0	lelong	1000156028	B16G16R16G16_422_UNORM
18947>0	lelong	1000156029	G16_B16_R16_3PLANE_420_UNORM
18948>0	lelong	1000156030	G16_B16R16_2PLANE_420_UNORM
18949>0	lelong	1000156031	G16_B16_R16_3PLANE_422_UNORM
18950>0	lelong	1000156032	G16_B16R16_2PLANE_422_UNORM
18951>0	lelong	1000156033	G16_B16_R16_3PLANE_444_UNORM
18952
18953>0	lelong	1000054000	PVRTC1_2BPP_UNORM_BLOCK_IMG
18954>0	lelong	1000054001	PVRTC1_4BPP_UNORM_BLOCK_IMG
18955>0	lelong	1000054002	PVRTC2_2BPP_UNORM_BLOCK_IMG
18956>0	lelong	1000054003	PVRTC2_4BPP_UNORM_BLOCK_IMG
18957>0	lelong	1000054004	PVRTC1_2BPP_SRGB_BLOCK_IMG
18958>0	lelong	1000054005	PVRTC1_4BPP_SRGB_BLOCK_IMG
18959>0	lelong	1000054006	PVRTC2_2BPP_SRGB_BLOCK_IMG
18960>0	lelong	1000054007	PVRTC2_4BPP_SRGB_BLOCK_IMG
18961
18962>0	lelong	1000066000	ASTC_4x4_SFLOAT_BLOCK_EXT
18963>0	lelong	1000066001	ASTC_5x4_SFLOAT_BLOCK_EXT
18964>0	lelong	1000066002	ASTC_5x5_SFLOAT_BLOCK_EXT
18965>0	lelong	1000066003	ASTC_6x5_SFLOAT_BLOCK_EXT
18966>0	lelong	1000066004	ASTC_6x6_SFLOAT_BLOCK_EXT
18967>0	lelong	1000066005	ASTC_8x5_SFLOAT_BLOCK_EXT
18968>0	lelong	1000066006	ASTC_8x6_SFLOAT_BLOCK_EXT
18969>0	lelong	1000066007	ASTC_8x8_SFLOAT_BLOCK_EXT
18970>0	lelong	1000066008	ASTC_10x5_SFLOAT_BLOCK_EXT
18971>0	lelong	1000066009	ASTC_10x6_SFLOAT_BLOCK_EXT
18972>0	lelong	1000066010	ASTC_10x8_SFLOAT_BLOCK_EXT
18973>0	lelong	1000066011	ASTC_10x10_SFLOAT_BLOCK_EXT
18974>0	lelong	1000066012	ASTC_12x10_SFLOAT_BLOCK_EXT
18975>0	lelong	1000066013	ASTC_12x12_SFLOAT_BLOCK_EXT
18976
18977# Main KTX2 header.
189780	string	\xABKTX\ 20\xBB\r\n\x1A\n	Khronos KTX2 texture
18979>20	lelong	x	\b, %u
18980>24	lelong	>1	x %u
18981>28	lelong	>1	x %u
18982>32	lelong	>1	\b, %u layers
18983>36	lelong	>1	\b, %u faces
18984>40	lelong	>1	\b, %u mipmaps
18985>44	lelong	>0	\b,
18986>>44	use	khronos-ktx2-supercompression
18987>12	lelong	>0	\b,
18988>>12	use	khronos-ktx2-vkFormat
18989
18990# Type: Valve VTF texture.
18991# From: David Korth <gerbilsoft@gerbilsoft.com>
18992# References:
18993# - https://developer.valvesoftware.com/wiki/Valve_Texture_Format
18994
18995# VTF image formats.
189960	name	vtf-image-format
18997>0	lelong	0	RGBA8888
18998>0	lelong	1	ABGR8888
18999>0	lelong	2	RGB888
19000>0	lelong	3	BGR888
19001>0	lelong	4	RGB565
19002>0	lelong	5	I8
19003>0	lelong	6	IA88
19004>0	lelong	7	P8
19005>0	lelong	8	A8
19006>0	lelong	9	RGB888 (bluescreen)
19007>0	lelong	10	BGR888 (bluescreen)
19008>0	lelong	11	ARGB8888
19009>0	lelong	12	BGRA8888
19010>0	lelong	13	DXT1
19011>0	lelong	14	DXT3
19012>0	lelong	15	DXT5
19013>0	lelong	16	BGRx8888
19014>0	lelong	17	BGR565
19015>0	lelong	18	BGRx5551
19016>0	lelong	19	BGRA4444
19017>0	lelong	20	DXT1+A1
19018>0	lelong	21	BGRA5551
19019>0	lelong	22	UV88
19020>0	lelong	23	UVWQ8888
19021>0	lelong	24	RGBA16161616F
19022>0	lelong	25	RGBA16161616
19023>0	lelong	26	UVLX8888
19024
19025# Main VTF header.
190260	string	VTF\0				Valve Texture Format
19027>4	lelong	x				v%u
19028>8	lelong	x				\b.%u
19029>0x10	leshort	x				\b, %u
19030>0x12	leshort	>1				x %u
19031>4	lequad	0x0000000700000002
19032>>0x3F	leshort	>1				x %u
19033>0x18	leshort	>1				\b, %u frames
19034>0x38	byte	x				\b, mipmaps: %u
19035>0x34	lelong	>-1				\b,
19036>>0x34	use	vtf-image-format
19037
19038# Type: Valve VTF3 (PS3) texture.
19039# From: David Korth <gerbilsoft@gerbilsoft.com>
190400	string		VTF3	Valve Texture Format (PS3)
19041>0x14	beshort		x	\b, %u
19042>0x16	beshort		x	\b x %u
19043>0x10	belong&0x2000	0	\b, DXT1
19044>0x10	belong&0x2000	0x2000	\b, DXT5
19045
19046# Type: ASTC texture.
19047# From: David Korth <gerbilsoft@gerbilsoft.com>
19048# References:
19049# - https://stackoverflow.com/questions/22600678/determine-internal-format-of-given-astc-compressed-image-through-its-header
19050# - https://stackoverflow.com/a/22682244
190510	lelong	0x5ca1ab13			ASTC
19052>4	byte	x				%u
19053>5	byte	x				\bx%u
19054>6	byte	>1				\bx%u
19055# X, Y, and Z dimensions are stored as 24-bit LE.
19056# Pretend it's 32-bit and mask off the high byte.
19057>7	lelong&0x00FFFFFF	x		texture, %u
19058>10	lelong&0x00FFFFFF	x		x %u
19059>13	lelong&0x00FFFFFF	>1		x %u
19060
19061# Zebra Metafile graphic
19062# http://www.fileformat.info/format/zbr/egff.htm
190630	beshort	0x9a02	Zebra Metafile graphic
19064>2	leshort 1	(version 1.x)
19065>2	leshort	2	(version 1.1x or 1.2x)
19066>2	leshort	3	(version 1.49)
19067>2	leshort	4	(version 1.50)
19068>4	string	x	(comment = %s)
19069
19070# Microsoft Paint graphic
19071# http://www.fileformat.info/format/mspaint/egff.htm
190720	string	DanM 	icrosoft Paint image data (version 1.x)
19073>4	leshort	x	(%d
19074>>6	leshort	x	x %d)
190750	string	LinS 	Microsoft Paint image data (version 2.0)
19076>4	leshort	x	(%d
19077>>6	leshort	x	x %d)
19078
19079# reMarkable tablet internal file format (https://www.remarkable.com/)
19080# https://github.com/ax3l/lines-are-beautiful
19081# https://plasma.ninja/blog/devices/remarkable/binary/format/2017/12/26/\
19082#	reMarkable-lines-file-format.html#what-to-do-next
19083# from Axel Huebl
190840		string	reMarkable
19085>11		string	lines
19086>>17		string	with
19087>>>22		string	selections
19088>>>>33		string	and
19089>>>>>37		string	layers
19090>>>>>>43	lelong	x	reMarkable tablet notebook lines, 1404 x 1872, %x page(s)
19091
19092# newer per-page files for the reMarkable
190930		string	reMarkable
19094>11		string	.lines
19095>>18		string	file,
19096>>>24		string	version=
19097>>>>32		byte	x	reMarkable tablet page (v%c), 1404 x 1872,
19098>>>>>43		lelong	x	%d layer(s)
19099
19100# Type: PVR3 texture.
19101# From: David Korth <gerbilsoft@gerbilsoft.com>
19102# References:
19103# - http://cdn.imgtec.com/sdk-documentation/PVR+File+Format.Specification.pdf
19104
19105# PVR3 pixel formats.
191060	name		pvr3-pixel-format
19107>0	ulelong	0	PVRTC 2bpp RGB
19108>0	ulelong	1	PVRTC 2bpp RGBA
19109>0	ulelong	2	PVRTC 4bpp RGB
19110>0	ulelong	3	PVRTC 4bpp RGBA
19111>0	ulelong	4	PVRTC-II 2bpp
19112>0	ulelong	5	PVRTC-II 4bpp
19113>0	ulelong	6	ETC1
19114>0	ulelong	7	DXT1
19115>0	ulelong	8	DXT2
19116>0	ulelong	9	DXT3
19117>0	ulelong	10	DXT4
19118>0	ulelong	11	DXT5
19119>0	ulelong	12	BC4
19120>0	ulelong	13	BC5
19121>0	ulelong	14	BC6
19122>0	ulelong	15	BC7
19123>0	ulelong	16	UYVY
19124>0	ulelong	17	YUY2
19125>0	ulelong	18	BW1bpp
19126>0	ulelong	19	R9G9B9E5 Shared Exponent
19127>0	ulelong	20	RGBG8888
19128>0	ulelong	21	GRGB8888
19129>0	ulelong	22	ETC2 RGB
19130>0	ulelong	23	ETC2 RGBA
19131>0	ulelong	24	ETC2 RGB A1
19132>0	ulelong	25	EAC R11
19133>0	ulelong	26	EAC RG11
19134>0	ulelong	27	ASTC_4x4
19135>0	ulelong	28	ASTC_5x4
19136>0	ulelong	29	ASTC_5x5
19137>0	ulelong	30	ASTC_6x5
19138>0	ulelong	31	ASTC_6x6
19139>0	ulelong	32	ASTC_8x5
19140>0	ulelong	33	ASTC_8x6
19141>0	ulelong	34	ASTC_8x8
19142>0	ulelong	35	ASTC_10x5
19143>0	ulelong	36	ASTC_10x6
19144>0	ulelong	37	ASTC_10x8
19145>0	ulelong	38	ASTC_10x10
19146>0	ulelong	39	ASTC_12x10
19147>0	ulelong	40	ASTC_12x12
19148>0	ulelong	41	ASTC_3x3x3
19149>0	ulelong	42	ASTC_4x3x3
19150>0	ulelong	43	ASTC_4x4x3
19151>0	ulelong	44	ASTC_4x4x4
19152>0	ulelong	45	ASTC_5x4x4
19153>0	ulelong	46	ASTC_5x5x4
19154>0	ulelong	47	ASTC_5x5x5
19155>0	ulelong	48	ASTC_6x5x5
19156>0	ulelong	49	ASTC_6x6x5
19157>0	ulelong	50	ASTC_6x6x6
19158
191590	string		PVR\x03			PowerVR 3.0 texture:
19160>0x18	ulelong		x	%u x
19161>0x1C	ulelong		x	%u
19162>0x20	ulelong		>1	x %u
19163>0x08	byte		x	\b,
19164>0x0C	ulelong		0
19165>>0x08	use	pvr3-pixel-format
19166>0x0C	ulelong		!0
19167>>0x08	byte	!0	%c
19168>>>0x0C	byte	!0	\b%u
19169>>0x09	byte	!0	\b%c
19170>>>0x0D	byte	!0	\b%u
19171>>0x0A	byte	!0	\b%c
19172>>>0x0E	byte	!0	\b%u
19173>>0x0B	byte	!0	\b%c
19174>>>0x0F	byte	!0	\b%u
19175>0x10	ulelong		1	\b, sRGB
19176>0x04	ulelong&0x02	0x02	\b, premultiplied alpha
19177
191780	string		\x03RVP			PowerVR 3.0 texture: BE,
19179>0x18	ubelong		x	%u x
19180>0x1C	ubelong		x	%u
19181>0x20	ubelong		>1	x %u
19182>0x08	byte		x	\b,
19183>0x0C	ubelong		0
19184>>0x08	use	pvr3-pixel-format
19185>0x0C	ubelong		!0
19186>>0x0B	byte	!0	%c
19187>>>0x0F	byte	!0	\b%u
19188>>0x0A	byte	!0	\b%c
19189>>>0x0E	byte	!0	\b%u
19190>>0x09	byte	!0	\b%c
19191>>>0x0D	byte	!0	\b%u
19192>>0x08	byte	!0	\b%c
19193>>>0x0C	byte	!0	\b%u
19194>0x10	ubelong		1	\b, sRGB
19195>0x04	ubelong&0x02	0x02	\b, premultiplied alpha
19196
19197# Type: Microsoft Xbox XPR0 texture.
19198# From: David Korth <gerbilsoft@gerbilsoft.com>
19199# References:
19200# - https://github.com/Cxbx-Reloaded/Cxbx-Reloaded/blob/develop/src/core/hle/D3D8/XbD3D8Types.h
19201
19202# XPR pixel formats.
192030	name	xbox-xpr-pixel-format
19204>0	byte	0x00	L8
19205>0	byte	0x01	AL8
19206>0	byte	0x02	ARGB1555
19207>0	byte	0x03	RGB555
19208>0	byte	0x04	ARGB4444
19209>0	byte	0x05	RGB565
19210>0	byte	0x06	ARGB8888
19211>0	byte	0x07	xRGB8888
19212>0	byte	0x0B	P8
19213>0	byte	0x0C	DXT1
19214>0	byte	0x0E	DXT2
19215>0	byte	0x0F	DXT4
19216>0	byte	0x10	Linear ARGB1555
19217>0	byte	0x11	Linear RGB565
19218>0	byte	0x12	Linear ARGB8888
19219>0	byte	0x13	Linear L8
19220>0	byte	0x16	Linear R8B8
19221>0	byte	0x17	Linear G8B8
19222>0	byte	0x19	A8
19223>0	byte	0x1A	A8L8
19224>0	byte	0x1B	Linear AL8
19225>0	byte	0x1C	Linear RGB555
19226>0	byte	0x1D	Linear ARGB4444
19227>0	byte	0x1E	Linear xRGB8888
19228>0	byte	0x1F	Linear A8
19229>0	byte	0x20	Linear A8L8
19230>0	byte	0x24	YUY2
19231>0	byte	0x25	UYVY
19232>0	byte	0x27	L6V5U5
19233>0	byte	0x28	V8U8
19234>0	byte	0x29	R8B8
19235>0	byte	0x2A	D24S8
19236>0	byte	0x2B	F24S8
19237>0	byte	0x2C	D16
19238>0	byte	0x2D	F16
19239>0	byte	0x2E	Linear D24S8
19240>0	byte	0x2F	Linear F24S8
19241>0	byte	0x30	Linear D16
19242>0	byte	0x31	Linear F16
19243>0	byte	0x32	L16
19244>0	byte	0x33	V16U16
19245>0	byte	0x35	Linear L16
19246>0	byte	0x36	Linear V16U16
19247>0	byte	0x37	Linear L6V5U5
19248>0	byte	0x38	RGBA5551
19249>0	byte	0x39	RGBA4444
19250>0	byte	0x3A	QWVU8888
19251>0	byte	0x3B	BGRA8888
19252>0	byte	0x3C	RGBA8888
19253>0	byte	0x3D	Linear RGBA5551
19254>0	byte	0x3E	Linear RGBA4444
19255>0	byte	0x3F	Linear ABGR8888
19256>0	byte	0x40	Linear BGRA8888
19257>0	byte	0x41	Linear RGBA8888
19258>0	byte	0x64	Vertex Data
19259
192600	string		XPR0	Microsoft Xbox XPR0 texture
19261>0x19	byte	x	\b, format:
19262>>0x19	use	xbox-xpr-pixel-format
19263
19264# ILDA Image Data Transfer Format
19265# https://www.ilda.com/resources/StandardsDocs/ILDA_IDTF14_rev011.pdf
19266#
19267# Updated by Chuck Hein (laser@geekdude.com)
19268#
192690	string	ILDA	ILDA Image Data Transfer Format
19270>7	byte	0x00	3D Coordinates with Indexed Color
19271>7	byte	0x01	2D Coordinates with Indexed Color
19272>7	byte	0x02	Color Palette
19273>7	byte	0x04	3D Coordinates with True Color
19274>7	byte	0x05	2D Coordinates with True Color
19275>8	string	>0	\b, palette %s
19276>16	string	>0	\b, company %s
19277>24	beshort	>0	\b, number of records %d
19278>>26	beshort	x	\b, palette number %d
19279>>28	beshort	>0	\b, number of frames %d
19280>>30	byte	>0	\b, projector number %d
19281
19282# Dropbox "lepton" compressed jpeg format
19283# https://github.com/dropbox/lepton
192840	belong&0xfffff0ff	0xcf84005a	Lepton image file
19285>2	byte			x		(version %d)
19286
19287# Apple QuickTake camera raw images
19288# https://en.wikipedia.org/wiki/Apple_QuickTake
19289# dcraw can decode them
192900	name quicktake
19291>4	belong	8
19292>>544	beshort	x	\b, %dx
19293>>546	beshort	x	\b%d
19294>4	belong	4
19295>>546	beshort	x	\b, %dx
19296>>544	beshort	x	\b%d
19297
192980	string	qktk	Apple QuickTake 100 Raw Image
19299>0	use quicktake
19300
193010	string	qktn
19302>4	byte	0	Apple QuickTake 150 Raw Image
19303>4	byte	>0	Apple QuickTake 200 Raw Image
19304>0	use quicktake
19305
19306# From:		Joerg Jenderek
19307# URL:		http://fileformats.archiveteam.org/wiki/Corel_Photo-Paint_image
19308# Reference:	http://blog.argasinski.eu/wp-content/uploads/2011/08/cpt-specification-0.01.pdf
193090	string	CPT
19310>4	string	FILE		Corel Photo-Paint image, version
19311# version like 7, 9 or 8
19312>>3	ubyte	x		%c,
19313!:mime	image/x-corel-cpt
19314!:ext	cpt
19315# if blocks_array_offset available jump blockNumber*8 bytes
19316>>0x34	ulelong		>0
19317>>>(0x28.l*8)	ubyte	x
19318# jump additional stored blocks_array_offset bytes forward to object block
19319>>>>&(0x34.l-1) ulelong x	%u
19320# object height in pixels
19321>>>>>&0		ulelong	x	x %u
19322# if no blocks_array_offset available jump blockNumber*8 bytes
19323>>0x34	ulelong		=0
19324>>>(0x28.l*8)	ubyte	x
19325# jump additional 0x13C bytes forward to object block
19326>>>>&0x13B	ulelong x	%u
19327>>>>>&0	ulelong		x	x %u
19328# image color model used
19329>>0x8	ulelong	x
19330>>>0x8	ulelong	0x1		RGB 24 bits
19331>>>0x8	ulelong	0x3		CMYK 24 bits
19332>>>0x8	ulelong	0x5		greyscale 8 bits
19333>>>0x8	ulelong	0x6		black and white 1 bit
19334>>>0x8	ulelong	0xA		RGB 8 bits
19335# palette_length  number of colors * 3 in case of 8-bit RGB paletted image
19336# 0 otherwise. Allowed values: 0 or [1..256] * 3
19337#>>0xC	ulelong	>0		\b, palette length %u
19338>>>>0xC	ulelong/3	<256	\b, %u colors
19339>>>0x8	ulelong	0xB		LAB
19340>>>0x8	ulelong	0xC		RGB 48 bits
19341>>>0x8	ulelong	0xE		greyscale 16 bits
19342# this should not happen
19343>>>0x8	default	x		color model
19344>>>>0x8	ulelong	x		0x%x
19345# bit 1 in CPT file flags: UCS-2 file comment present
19346>>0x31	ubyte		&0x02
19347# look for comment marker
19348>>>0x100	search/0xc9d	\4\2\0\0
19349# UCS-2 file comment
19350>>>>&0		lestring16	x	"%s"
19351# if no UCS-2 is present show ANSI file comment[112] if available
19352>>0x31	ubyte&0x02	=0
19353>>>0x3C string		>\0	"%-.112s"
19354# reserved seems to be always 0
19355#>>0x10	ulelong		>0	\b, reserved1 %u
19356# horizontal real dpi = dpi_h * 25.4 / 10**6
19357>>0x18	ulelong	x		\b, %u micro dots/mm
19358# image vertical DPI in CPT DPI unit
19359#>>0x1C	ulelong	x		\b, %u micro dots/mm
19360# reserved seems to be always 0
19361#>>0x20	ulelong		>0	\b, reserved2 %u
19362#>>0x24	ulelong		>0	\b, reserved3 %u
19363# blocks_count; number of CPT_Block blocks. Allowed values: > 0
19364>>0x28	ulelong		x	\b, %u block
19365# plural s
19366>>0x28	ulelong		!1	\bs
19367# CPT file flags
19368# lower byte of CPT file flags: 0x94~CPT9FILE 0x01~often CPT7FILE 0x8C~CPT8FILE
19369#>>0x30	ubyte		x	\b, lower flags 0x%x
19370# upper byte of CPT file flags:
19371#>>0x31	ubyte		>0	\b, upper flags 0x%x
19372# bit 2 in CPT file flags: unknown
19373#>>0x31	ubyte		&0x04	\b, with UNKNOWN
19374# bits 3-7 in CPT file flags: unknown, seem to be often 0
19375# show unusual flag combinations
19376>>0x31	ubyte&0xFC	>0
19377>>>0x30	uleshort	x	\b, flags 0x%4.4x
19378# reserved seems to be always 0
19379#>>0x32	uleshort	>0	\b, reserved4 0x%x
19380# blocks_array_offset is always 0 for CPT7 and CPT8 files created by PP7-PP8
19381# typical values like: 13Ch 154h 43Ch 4F0h DA8h
19382>>0x34	ulelong	x		\b, array offset 0x%x
19383# reserved seems to be often 0
19384>>0x38	ulelong		>0	\b, reserved5 0x%x
19385# possible next master block
19386#>>0x100	ubequad		!0	\b, next block=0x%llx...
19387# bit 0: ICC profile block present
19388>>0x31	ubyte		&0x01	\b, with ICC profile
19389# check for characteristic string acsp of color profile for DEBUGGING
19390#>>>0x178	string	x	icc=%.4s
19391#	display ICC/ICM color profile by ./icc
19392#>>>0x154	use		color-profile
19393
19394# Type: Crunch compressed texture.
19395# From: David Korth <gerbilsoft@gerbilsoft.com>
19396# References:
19397# - https://github.com/BinomialLLC/crunch/blob/44c8402e24441c7524ca364941fd224ab3b971e9/inc/crn_decomp.h#L267
193980	ubelong		0x4878004A	Crunch compressed texture:
19399>0x0C	ubeshort	x	%u x
19400>0x0E	ubeshort	x	%u
19401>0x12	ubyte		0	\b, DXT1
19402>0x12	ubyte		1	\b, DXT3
19403>0x12	ubyte		2	\b, DXT5
19404>0x12	ubyte		3	\b, DXT5 CCxY
19405>0x12	ubyte		4	\b, DXT5 xGxR
19406>0x12	ubyte		5	\b, DXT5 xGBR
19407>0x12	ubyte		6	\b, DXT5 AGBR
19408>0x12	ubyte		7	\b, DXn XY
19409>0x12	ubyte		8	\b, DXn YX
19410>0x12	ubyte		9	\b, DXT5 Alpha
19411>0x12	ubyte		10	\b, ETC1
19412>0x10	ubyte		>1	\b, %u images
19413>0x11	ubyte		>1	\b, %u faces
19414# TODO: Flags at 0x13? (ubeshort)
19415
19416# Type: BasisLZ compressed texture.
19417# From: David Korth <gerbilsoft@gerbilsoft.com>
19418# References:
19419# - https://github.com/BinomialLLC/basis_universal/blob/master/spec/basis_spec.txt
194200	uleshort		0x4273
19421>0x04	uleshort		0x4D	BasisLZ
19422>>0x02	uleshort		x	v%x compressed texture:
19423>>0x14	ubyte			0	ETC1S
19424>>0x14	ubyte			1	UASTC 4x4
19425>>0x0E	ulelong&0xFFFFFF	>1	\b, %u slices
19426>>0x11	ulelong&0xFFFFFF	>1	\b, %u images
19427>>0x15	uleshort&0x02		2	\b, Y-flipped
19428
19429# MIME registration: https://www.iana.org/assignments/media-types/model/e57
19430# Sample files: http://www.libe57.org/data.html
19431# Reference implementation: http://www.libe57.org/
19432# https://www.ri.cmu.edu/pub_files/2011/1/2011-huber-e57-v3.pdf
194330	string		ASTM-E57	ASTM E57 three-dimensional model
19434!:mime model/e57
19435!:ext e57
19436
19437#------------------------------------------------------------------------------
19438# $File: inform,v 1.5 2009/09/19 16:28:09 christos Exp $
19439# inform:  file(1) magic for Inform interactive fiction language
19440
19441# URL:  http://www.inform-fiction.org/
19442# From: Reuben Thomas <rrt@sc3d.org>
19443
194440	search/100/cW	constant\ story		Inform source text
19445
19446#------------------------------------------------------------------------------
19447# $File: intel,v 1.19 2020/12/12 20:01:47 christos Exp $
19448# intel:  file(1) magic for x86 Unix
19449#
19450# Various flavors of x86 UNIX executable/object (other than Xenix, which
19451# is in "microsoft").  DOS is in "msdos"; the ambitious soul can do
19452# Windows as well.
19453#
19454# Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and
19455# whatever comes next (HP-PA Hummingbird?).  OS/2 may also go elsewhere
19456# as well, if, as, and when IBM makes it portable.
19457#
19458# The `versions' should be un-commented if they work for you.
19459# (Was the problem just one of endianness?)
19460#
194610	leshort		0502		basic-16 executable
19462>12	lelong		>0		not stripped
19463#>22	leshort		>0		- version %d
194640	leshort		0503		basic-16 executable (TV)
19465>12	lelong		>0		not stripped
19466#>22	leshort		>0		- version %d
194670	leshort		0510		x86 executable
19468>12	lelong		>0		not stripped
194690	leshort		0511		x86 executable (TV)
19470>12	lelong		>0		not stripped
194710	leshort		=0512		iAPX 286 executable small model (COFF)
19472>12	lelong		>0		not stripped
19473#>22	leshort		>0		- version %d
194740	leshort		=0522		iAPX 286 executable large model (COFF)
19475>12	lelong		>0		not stripped
19476#>22	leshort		>0		- version %d
19477# updated by Joerg Jenderek at Oct 2015
19478# https://de.wikipedia.org/wiki/Common_Object_File_Format
19479# http://www.delorie.com/djgpp/doc/coff/filhdr.html
19480# ./msdos (version 5.25) labeled the next entry as "MS Windows COFF Intel 80386 object file"
19481# ./intel (version 5.25) label labeled the next entry as "80386 COFF executable"
19482# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan
194830	leshort		=0514
19484# use subroutine to display name+flags+variables for common object formatted files
19485>0	use				display-coff
19486#>12	lelong		>0		not stripped
19487# no hint found, that at offset 22 is version
19488#>22	leshort		>0		- version %d
194890	leshort		0x0200
19490>0	use				display-coff
194910	leshort		0x8664
19492>0	use				display-coff
19493
19494# rom: file(1) magic for BIOS ROM Extensions found in intel machines
19495#      mapped into memory between 0xC0000 and 0xFFFFF
19496# From: Alex Myczko <alex@aiei.ch>
19497# updated by Joerg Jenderek
19498# https://en.wikipedia.org/wiki/Option_ROM
194990        beshort         0x55AA       BIOS (ia32) ROM Ext.
19500!:mime	application/octet-stream
19501!:ext	rom/bin
19502>5       string          USB          USB
19503>7       string          LDR          UNDI image
19504>30      string          IBM          IBM comp. Video
19505>26      string          Adaptec      Adaptec
19506>28      string          Adaptec      Adaptec
19507>42      string          PROMISE      Promise
19508>2       byte            x            (%d*512)
19509
19510# Flash descriptors for Intel SPI flash roms.
19511# From Dr. Jesus <j@hug.gs>
195120	lelong		0x0ff0a55a	Intel serial flash for ICH/PCH ROM <= 5 or 3400 series A-step
1951316	lelong		0x0ff0a55a	Intel serial flash for PCH ROM
19514
19515# From: 	Joerg Jenderek
19516# URL:		https://en.wikipedia.org/wiki/Advanced_Configuration_and_Power_Interface
19517# Reference:	https://uefi.org/sites/default/files/resources/ACPI_6_3_final_Jan30.pdf
19518# Note:		generated for example by `cat /sys/firmware/acpi/tables/DSDT MyDSDT.aml`
195190	string		DSDT
19520>0	use		acpi-table
19521# not tested or other file format
195220	string		APIC
19523>0	use		acpi-table
19524#0	string		ASF!
19525#>0	use		acpi-table
195260	string		FACP
19527>0	use		acpi-table
19528#0	string		FACS
19529#>0	use		acpi-table
195300	string		MCFG
19531>0	use		acpi-table
195320	string		SLIC
19533>0	use		acpi-table
195340	string		SSDT
19535>0	use		acpi-table
195360	name		acpi-table
19537# skip ASCII text starting with DSDT by looking for valid "low" revision
19538>8	ubyte		<17	ACPI Machine Language file
19539# assume that ACPI tables size are lower than 16 MiB
19540#>4	ulelong		<0x01000000
19541# DSDT for Differentiated System Description Table
19542>>0	string		x	'%.4s'
19543#!:mime	application/octet-stream
19544!:mime	application/x-intel-aml
19545!:ext	aml
19546# the manufacture model ID like: VBOXBIOS BXDSDT
19547>>16	string		>\0	%.8s
19548# OEM revision of DSDT for supplied OEM Table ID like: 0 1 2 20090511
19549>>>24	ulelong		x	%x
19550# OEM ID like: INTEL VBOX (VirtualBox) BXDSDT (qemu) MEDION or \030\001\0\0 for s3pt.aml
19551>>10	ubyte		>040	by %c
19552>>>11		ubyte	>040	\b%c
19553>>>>12		ubyte	>040	\b%c
19554>>>>>13		ubyte	>040	\b%c
19555>>>>>>14	ubyte	>040	\b%c
19556>>>>>>>15	ubyte	>040	\b%c
19557# This field also sets the global integer width for the AML interpreter.
19558# Values less than two will cause the interpreter to use 32-bit.
19559# Values of two and greater will cause the interpreter to use full 64-bit.
19560# 16 for asf!.aml, 67 fo rsdp.aml
19561>>8	ubyte		x	\b, revision %u
19562# length, in bytes, of the entire DSDT (including the header)
19563>>4	ulelong		x	\b, %u bytes
19564# entire table must sum to zero
19565#>>9	ubyte		x	\b, checksum 0x%x
19566# vendor ID for the ASL Compiler like: INTL MSFT ...
19567>>28	string		>\0	\b, created by %.4s
19568# revision number of the ASL Compiler like: 20051117 20140724 20190703 20200110 ...
19569>>>32	ulelong		x	%x
19570
19571
19572#------------------------------------------------------------------------------
19573# $File: interleaf,v 1.10 2009/09/19 16:28:10 christos Exp $
19574# interleaf:  file(1) magic for InterLeaf TPS:
19575#
195760	string		=\210OPS	Interleaf saved data
195770	string		=<!OPS		Interleaf document text
19578>5	string		,\ Version\ =	\b, version
19579>>17	string		>\0		%.3s
19580
19581#------------------------------------------------------------------------------
19582# $File: island,v 1.5 2009/09/19 16:28:10 christos Exp $
19583# island:  file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1
19584# "/etc/magic":
19585# From: guy@netapp.com (Guy Harris)
19586#
195874	string		pgscriptver	IslandWrite document
1958813	string		DrawFile	IslandDraw document
19589
19590
19591#------------------------------------------------------------------------------
19592# $File: ispell,v 1.8 2009/09/19 16:28:10 christos Exp $
19593# ispell:  file(1) magic for ispell
19594#
19595# Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602.  This magic
19596# will match 0x9600 through 0x9603 in *both* little endian and big endian.
19597# (No other current magic entries collide.)
19598#
19599# Updated by Daniel Quinlan (quinlan@yggdrasil.com)
19600#
196010	leshort&0xFFFC	0x9600		little endian ispell
19602>0	byte		0		hash file (?),
19603>0	byte		1		3.0 hash file,
19604>0	byte		2		3.1 hash file,
19605>0	byte		3		hash file (?),
19606>2	leshort		0x00		8-bit, no capitalization, 26 flags
19607>2	leshort		0x01		7-bit, no capitalization, 26 flags
19608>2	leshort		0x02		8-bit, capitalization, 26 flags
19609>2	leshort		0x03		7-bit, capitalization, 26 flags
19610>2	leshort		0x04		8-bit, no capitalization, 52 flags
19611>2	leshort		0x05		7-bit, no capitalization, 52 flags
19612>2	leshort		0x06		8-bit, capitalization, 52 flags
19613>2	leshort		0x07		7-bit, capitalization, 52 flags
19614>2	leshort		0x08		8-bit, no capitalization, 128 flags
19615>2	leshort		0x09		7-bit, no capitalization, 128 flags
19616>2	leshort		0x0A		8-bit, capitalization, 128 flags
19617>2	leshort		0x0B		7-bit, capitalization, 128 flags
19618>2	leshort		0x0C		8-bit, no capitalization, 256 flags
19619>2	leshort		0x0D		7-bit, no capitalization, 256 flags
19620>2	leshort		0x0E		8-bit, capitalization, 256 flags
19621>2	leshort		0x0F		7-bit, capitalization, 256 flags
19622>4	leshort		>0		and %d string characters
196230	beshort&0xFFFC	0x9600		big endian ispell
19624>1	byte		0		hash file (?),
19625>1	byte		1		3.0 hash file,
19626>1	byte		2		3.1 hash file,
19627>1	byte		3		hash file (?),
19628>2	beshort		0x00		8-bit, no capitalization, 26 flags
19629>2	beshort		0x01		7-bit, no capitalization, 26 flags
19630>2	beshort		0x02		8-bit, capitalization, 26 flags
19631>2	beshort		0x03		7-bit, capitalization, 26 flags
19632>2	beshort		0x04		8-bit, no capitalization, 52 flags
19633>2	beshort		0x05		7-bit, no capitalization, 52 flags
19634>2	beshort		0x06		8-bit, capitalization, 52 flags
19635>2	beshort		0x07		7-bit, capitalization, 52 flags
19636>2	beshort		0x08		8-bit, no capitalization, 128 flags
19637>2	beshort		0x09		7-bit, no capitalization, 128 flags
19638>2	beshort		0x0A		8-bit, capitalization, 128 flags
19639>2	beshort		0x0B		7-bit, capitalization, 128 flags
19640>2	beshort		0x0C		8-bit, no capitalization, 256 flags
19641>2	beshort		0x0D		7-bit, no capitalization, 256 flags
19642>2	beshort		0x0E		8-bit, capitalization, 256 flags
19643>2	beshort		0x0F		7-bit, capitalization, 256 flags
19644>4	beshort		>0		and %d string characters
19645# ispell 4.0 hash files  kromJx <kromJx@crosswinds.net>
19646# Ispell 4.0
196470       string          ISPL            ispell
19648>4      long            x               hash file version %d,
19649>8      long            x               lexletters %d,
19650>12     long            x               lexsize %d,
19651>16     long            x               hashsize %d,
19652>20     long            x               stblsize %d
19653
19654#------------------------------------------------------------------------------
19655# $File: isz,v 1.5 2019/04/19 00:42:27 christos Exp $
19656# ISO Zipped file format
19657# https://www.ezbsystems.com/isz/iszspec.txt
196580	string	IsZ!	ISO Zipped file
19659>4	byte	x	\b, header size %u
19660>5	byte	x	\b, version %u
19661>8	lelong	x	\b, serial %u
19662#12	leshort	x	\b, sector size %u
19663#>16	lelong	x	\b, total sectors %u
19664>17	byte	>0	\b, password protected
19665#>24	lequad	x	\b, segment size %llu
19666#>32	lelong	x	\b, blocks %u
19667#>36	lelong	x	\b, block size %u
19668
19669#------------------------------------------------------------
19670# $File: java,v 1.21 2019/02/18 17:58:50 christos Exp $
19671# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the
19672# same magic number, 0xcafebabe, so they are both handled
19673# in the entry called "cafebabe".
19674#------------------------------------------------------------
19675# Java serialization
19676# From Martin Pool (m.pool@pharos.com.au)
196770	beshort		0xaced		Java serialization data
19678>2	beshort		>0x0004		\b, version %d
19679
196800	belong		0xfeedfeed	Java KeyStore
19681!:mime	application/x-java-keystore
196820	belong		0xcececece	Java JCE KeyStore
19683!:mime	application/x-java-jce-keystore
19684
19685# Java source
196860	regex	\^import.*;$	Java source
19687!:mime	text/x-java
19688
19689# Java HPROF dumps
19690# https://java.net/downloads/heap-snapshot/hprof-binary-format.html
196910	string		JAVA\x20PROFILE\x201.0.
19692>0x12	byte		0
19693>>0x11	ubyte-0x31	<2      Java HPROF dump,
19694>>>0x17	beqdate/1000	x       created %s
19695
19696# Java jmod module
19697# See https://hg.openjdk.java.net/jdk9/jdk9/jdk/file/tip/src/java.base/share/classes/jdk/internal/jmod/JmodFile.java
19698# Grr. 2 byte magic "JM", really? In 2019?
196990	belong		0x4a4d0100	Java jmod module version 1.0
19700!:mime	application/x-java-jmod
19701
19702# Java jlinked image
19703# See https://hg.openjdk.java.net/jdk9/jdk9/jdk/file/tip/src/java.base/share/native/libjimage/imageFile.hpp
197040	belong	0xcafedada	Java module image (big endian)
19705>4	beshort	>0x00	\b, version %d
19706>6	beshort	x	\b.%d
19707!:mime	application/x-java-image
19708
197090	lelong	0xcafedada	Java module image (little endian)
19710>6	leshort	>0x00	\b, version %d
19711>4	leshort	x	\b.%d
19712!:mime	application/x-java-image
19713
19714#------------------------------------------------------------------------------
19715# $File: javascript,v 1.2 2019/08/05 10:34:26 christos Exp $
19716# javascript:  magic for javascript and node.js scripts.
19717#
197180	search/1/w	#!/bin/node		Node.js script text executable
19719!:mime application/javascript
197200	search/1/w	#!/usr/bin/node		Node.js script text executable
19721!:mime application/javascript
197220	search/1/w	#!/bin/nodejs		Node.js script text executable
19723!:mime application/javascript
197240	search/1/w	#!/usr/bin/nodejs	Node.js script text executable
19725!:mime application/javascript
197260	search/1	#!/usr/bin/env\ node	Node.js script text executable
19727!:mime application/javascript
197280	search/1	#!/usr/bin/env\ nodejs	Node.js script text executable
19729!:mime application/javascript
19730# Hermes by Facebook https://hermesengine.dev/
19731# https://github.com/facebook/hermes/blob/master/include/hermes/\
19732# BCGen/HBC/BytecodeFileFormat.h#L24
197330	lequad		0x1F1903C103BC1FC6	Hermes JavaScript bytecode
19734>8	lelong		x			\b, version %d
19735
19736#------------------------------------------------------------------------------
19737# $File: jpeg,v 1.33 2021/03/21 15:04:50 christos Exp $
19738# JPEG images
19739# SunOS 5.5.1 had
19740#
19741#	0	string		\377\330\377\340	JPEG file
19742#	0	string		\377\330\377\356	JPG file
19743#
19744# both of which turn into "JPEG image data" here.
19745#
197460	beshort		0xffd8		JPEG image data
19747!:mime	image/jpeg
19748!:apple	8BIMJPEG
19749!:strength *3
19750!:ext jpeg/jpg/jpe/jfif
19751>6	string		JFIF		\b, JFIF standard
19752# The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06
19753# in a vain attempt to add image size reporting for JFIF.  Note that these
19754# tests are not fool-proof since some perfectly valid JPEGs are currently
19755# impossible to specify in magic(4) format.
19756# First, a little JFIF version info:
19757>>11	byte		x		\b %d.
19758>>12	byte		x		\b%02d
19759# Next, the resolution or aspect ratio of the image:
19760>>13	byte		0		\b, aspect ratio
19761>>13	byte		1		\b, resolution (DPI)
19762>>13	byte		2		\b, resolution (DPCM)
19763>>14	beshort		x		\b, density %dx
19764>>16	beshort		x		\b%d
19765>>4	beshort		x		\b, segment length %d
19766# Next, show thumbnail info, if it exists:
19767>>18	byte		!0		\b, thumbnail %dx
19768>>>19	byte		x		\b%d
19769>6	string		Exif		\b, Exif standard: [
19770>>12	indirect/r	x
19771>>12	string		x		\b]
19772
19773# Jump to the first segment
19774>(4.S+4)	use		jpeg_segment
19775
19776# This uses recursion...
197770		name		jpeg_segment
19778>0	beshort		0xFFFE
19779# Recursion handled by FFE0
19780#>>(2.S+2)	use			jpeg_segment
19781>>2	pstring/HJ	x		\b, comment: "%s"
19782
19783>0	beshort		0xFFC0
19784>>(2.S+2)	use			jpeg_segment
19785>>4	byte		x		\b, baseline, precision %d
19786>>7	beshort		x		\b, %dx
19787>>5	beshort		x		\b%d
19788>>9	byte		x		\b, components %d
19789
19790>0	beshort		0xFFC1
19791>>(2.S+2)	use			jpeg_segment
19792>>4	byte		x		\b, extended sequential, precision %d
19793>>7	beshort		x		\b, %dx
19794>>5	beshort		x		\b%d
19795>>9	byte		x		\b, components %d
19796
19797>0	beshort		0xFFC2
19798>>(2.S+2)	use			jpeg_segment
19799>>4	byte		x		\b, progressive, precision %d
19800>>7	beshort		x		\b, %dx
19801>>5	beshort		x		\b%d
19802>>9	byte		x		\b, components %d
19803
19804# Define Huffman Tables
19805>0	beshort		0xFFC4
19806>>(2.S+2)	use			jpeg_segment
19807
19808>0	beshort		0xFFE1
19809# Recursion handled by FFE0
19810#>>(2.S+2)	use			jpeg_segment
19811>>4	string		Exif		\b, Exif Standard: [
19812>>>10	indirect/r	x
19813>>>10	string		x		\b]
19814
19815# Application specific markers
19816>0	beshort&0xFFE0	=0xFFE0
19817>>(2.S+2)	use			jpeg_segment
19818
19819# DB: Define Quantization tables
19820# DD: Define Restart interval [XXX: wrong here, it is 4 bytes]
19821# D8: Start of image
19822# D9: End of image
19823# Dn: Restart
19824>0	beshort&0xFFD0	=0xFFD0
19825>>0	beshort&0xFFE0	!0xFFE0
19826>>>(2.S+2)	use			jpeg_segment
19827
19828#>0	beshort		x		unknown 0x%x
19829#>>(2.S+2)	use			jpeg_segment
19830
19831# HSI is Handmade Software's proprietary JPEG encoding scheme
198320	string		hsi1		JPEG image data, HSI proprietary
19833
19834# From: David Santinoli <david@santinoli.com>
198350	string		\x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A	JPEG 2000
19836# From: Johan van der Knijff <johan.vanderknijff@kb.nl>
19837# Added sub-entries for JP2, JPX, JPM and MJ2 formats; added mimetypes
19838# https://github.com/bitsgalore/jp2kMagic
19839#
19840# Now read value of 'Brand' field, which yields a few possibilities:
19841>20	string		\x6a\x70\x32\x20	Part 1 (JP2)
19842!:mime	image/jp2
19843>20	string		\x6a\x70\x78\x20	Part 2 (JPX)
19844!:mime	image/jpx
19845>20	string		\x6a\x70\x6d\x20	Part 6 (JPM)
19846!:mime	image/jpm
19847>20	string		\x6d\x6a\x70\x32	Part 3 (MJ2)
19848!:mime	video/mj2
19849
19850# Type: JPEG 2000 codesream
19851# From: Mathieu Malaterre <mathieu.malaterre@gmail.com>
198520	belong		0xff4fff51						JPEG 2000 codestream
1985345	beshort		0xff52
19854
19855# JPEG extended range
198560	string		\x49\x49\xbc
19857>3	byte		1
19858>>4	lelong%2	0	JPEG-XR
19859!:mime	image/jxr
19860!:ext	jxr
19861
19862# JPEG XL
19863# From: Ian Tester
198640	string	\xff\x0a				JPEG XL codestream
19865!:mime  image/jxl
19866!:ext jxl
19867
19868# JPEG XL (transcoded JPEG file)
198690	string	\x00\x00\x00\x0cJXL\x20\x0d\x0a\x87\x0a	JPEG XL container
19870!:mime  image/jxl
19871!:ext jxl
19872
19873#------------------------------------------------------------------------------
19874# $File: karma,v 1.8 2015/08/29 07:10:35 christos Exp $
19875# karma:  file(1) magic for Karma data files
19876#
19877# From <rgooch@atnf.csiro.au>
19878
198790	string	KarmaRHD\040Version	Karma Data Structure Version
19880>16	belong		x		%u
19881
19882#------------------------------------------------------------------------------
19883# $File: kde,v 1.5 2010/11/25 15:00:12 christos Exp $
19884# kde:  file(1) magic for KDE
19885
198860		string/t	[KDE\ Desktop\ Entry]	KDE desktop entry
19887!:mime	application/x-kdelnk
198880		string/t	#\ KDE\ Config\ File	KDE config file
19889!:mime	application/x-kdelnk
198900		string/t	#\ xmcd	xmcd database file for kscd
19891!:mime	text/x-xmcd
19892
19893#------------------------------------------------------------------------------
19894# $File: keepass,v 1.2 2019/04/19 00:42:27 christos Exp $
19895# keepass: file(1) magic for KeePass file
19896#
19897# Keepass Password Safe:
19898#  * original one: https://keepass.info/
19899#  * *nix port:    https://www.keepassx.org/
19900#  * android port: https://code.google.com/p/keepassdroid/
19901
199020	lelong		0x9AA2D903	Keepass password database
19903>4	lelong		0xB54BFB65	1.x KDB
19904>>48	lelong		>0		\b, %d groups
19905>>52	lelong		>0		\b, %d entries
19906>>8	lelong&0x0f	1		\b, SHA-256
19907>>8	lelong&0x0f	2		\b, AES
19908>>8	lelong&0x0f	4		\b, RC4
19909>>8	lelong&0x0f	8		\b, Twofish
19910>>120	lelong		>0		\b, %d key transformation rounds
19911>4	lelong		0xB54BFB67	2.x KDBX
19912
19913#------------------------------------------------------------------------------
19914# $File: kerberos,v 1.3 2019/04/19 00:42:27 christos Exp $
19915# kerberos: MIT kerberos file binary formats
19916#
19917
19918# This magic entry is for demonstration purposes and could be improved
19919# if the following features were implemented in file:
19920#
19921# Strings inside [[ .. ]] in the descriptions have special meanings and
19922# are not printed.
19923#
19924# 	- Provide some form of iteration in number of components
19925#		[[${counter}=%d]] in the description
19926#		then append
19927#		[${counter}--] in the offset of the entries
19928#	- Provide a way to round the next offset
19929#		Add [R:4] after the offset?
19930#	- Provide a way to have optional entries
19931#		XXX: Syntax:
19932#	- Provide a way to "save" entries to print them later.
19933#		if the description is [[${name}=%s]], then nothing is
19934#		printed and a subsequent entry in the same magic file
19935#		can refer to ${name}
19936#	- Provide a way to format strings as hex values
19937#
19938# https://www.gnu.org/software/shishi/manual/html_node/\
19939#	The-Keytab-Binary-File-Format.html
19940#
19941
199420		name		keytab_entry
19943#>0		beshort		x		\b, size=%d
19944#>2		beshort		x		\b, components=%d
19945>4		pstring/H	x		\b, realm=%s
19946>>&0		pstring/H	x		\b, principal=%s/
19947>>>&0		pstring/H	x		\b%s
19948>>>>&0		belong		x		\b, type=%d
19949>>>>>&0		bedate		x		\b, date=%s
19950>>>>>>&0	byte		x		\b, kvno=%u
19951#>>>>>>>&0	pstring/H	x
19952#>>>>>>>>&0	belong		x
19953#>>>>>>>>>>&0	use		keytab_entry
19954
199550		belong		0x05020000	Kerberos Keytab file
19956>4		use		keytab_entry
19957
19958#------------------------------------------------------------------------------
19959# $File: kicad,v 1.2 2020/05/06 14:03:28 christos Exp $
19960# kicad:  file(1) magic for KiCad files
19961#
19962# See
19963#
19964#	http://kicad-pcb.org
19965#
19966
19967# KiCad Schematic Document
199680	    string  (kicad_sch
19969>10	    byte    0x20		KiCad Schematic Document
19970!:ext kicad_sch/kicad_sch-bak
19971>>11	    string  (version
19972>>>19	    byte    0x20
19973>>>>20	    regex   [0-9.]+		(Version %s)
19974
19975# KiCad Schematic Document (Legacy)
199760	    string  EESchema
19977>8	    byte    0x20
19978>>9	    string  Schematic
19979>>>18	    byte    0x20		KiCad Schematic Document (Legacy)
19980!:ext sch/bak
19981>>>>24	    string  Version
19982>>>>>31	    byte    0x20
19983>>>>>>32    string  x			(Version %s)
19984
19985# KiCad Symbol Library
199860	    string  (kicad_symbol_lib
19987>17	    byte    0x20		KiCad Symbol Library
19988!:ext kicad_sym
19989>>18	    string  (version
19990>>>26	    byte    0x20
19991>>>>27	    regex   [0-9.]+		(Version %s)
19992
19993# KiCad Symbol Library (Legacy)
199940	    string  EESchema-LIBRARY
19995>16	    byte    0x20		KiCad Symbol Library (Legacy)
19996!:ext lib
19997>>17	    string  Version
19998>>>24	    byte    0x20
19999>>>>25	    string  x			(Version %s)
20000
20001# KiCad Symbol Library Documentation (Legacy)
200020	    string  EESchema-DOCLIB
20003>15	    byte    0x20		KiCad Symbol Library Documentation (Legacy)
20004!:ext dcm
20005>>17	    string  Version
20006>>>24	    byte    0x20
20007>>>>25	    string  x			(Version %s)
20008
20009# KiCad Board Layout
200100	    string  (kicad_pcb
20011>10	    byte    0x20		KiCad Board Layout
20012!:ext kicad_pcb/kicad_pcb-bak
20013>>11	    string  (version
20014>>>19	    byte    0x20
20015>>>>20	    regex   [0-9.]+		(Version %s)
20016
20017# KiCad Footprint
200180	    string  (module
20019>7	    byte    0x20		KiCad Footprint
20020!:ext kicad_mod
20021
20022# KiCad Footprint (Legacy)
200230	    string  PCBNEW-LibModule-V1	    KiCad Footprint (Legacy)
20024!:ext mod
20025
20026# KiCad Netlist
200270	    string  (export
20028>7	    byte    0x20		KiCad Netlist
20029!:ext net
20030
20031# KiCad Symbol Library Table
200320	    string  (sym_lib_table
20033>14	    byte    0xA			KiCad Symbol Library Table
20034>14	    byte    0xD			KiCad Symbol Library Table
20035>14	    byte    0x20		KiCad Symbol Library Table
20036
20037# KiCad Footprint Library Table
200380	    string  (fp_lib_table
20039>13	    byte    0xA			KiCad Footprint Library Table
20040>13	    byte    0xD			KiCad Footprint Library Table
20041>13	    byte    0x20		KiCad Footprint Library Table
20042
20043#------------------------------------------------------------------------------
20044# $File: kml,v 1.6 2019/05/21 04:50:10 christos Exp $
20045# Type: Google KML, formerly Keyhole Markup Language
20046# Future development of this format has been handed
20047# over to the Open Geospatial Consortium.
20048# https://www.opengeospatial.org/standards/kml/
20049# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
200500 string/t    \<?xml
20051>20  search/400 \ xmlns=
20052>>&0 regex ['"]http://earth.google.com/kml Google KML document
20053!:mime application/vnd.google-earth.kml+xml
20054>>>&1 string 2.0' \b, version 2.0
20055>>>&1 string 2.1' \b, version 2.1
20056>>>&1 string 2.2' \b, version 2.2
20057
20058#------------------------------------------------------------------------------
20059# Type: OpenGIS KML, formerly Keyhole Markup Language
20060# This standard is maintained by the
20061# Open Geospatial Consortium.
20062# https://www.opengeospatial.org/standards/kml/
20063# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
20064>>&0 regex ['"]http://www.opengis.net/kml OpenGIS KML document
20065!:mime application/vnd.google-earth.kml+xml
20066>>>&1 string/t 2.2 \b, version 2.2
20067
20068#------------------------------------------------------------------------------
20069# Type: Google KML Archive (ZIP based)
20070# https://code.google.com/apis/kml/documentation/kml_tut.html
20071# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
200720 string    PK\003\004
20073>4  byte    0x14
20074>>30  string doc.kml Compressed Google KML Document, including resources.
20075!:mime application/vnd.google-earth.kmz
20076#------------------------------------------------------------------------------
20077# $File: lammps,v 1.1 2021/03/14 16:24:18 christos Exp $
20078#
20079
20080# Magic file patterns for use with file(1) for the
20081# LAMMPS molecular dynamics simulation software.
20082# https://lammps.sandia.gov
20083#
20084# Updated: 2021-03-14 by akohlmey@gmail.com
20085
20086# Binary restart file for the LAMMPS MD code
200870        string  LammpS\ RestartT  LAMMPS binary restart file
20088>0x14    long    x                 (rev %d),
20089>>0x20   string  x                 Version %s,
20090>>>0x10  lelong  0x0001            Little Endian
20091>>>0x10  lelong  0x1000            Big Endian
20092
20093# Atom style binary dump file for the LAMMPS MD code
20094# written on a little endian machine
200950         lequad  -8
20096>0x08     string  DUMPATOM     LAMMPS atom style binary dump
20097>>0x14    long    x            (rev %d),
20098>>>0x10   lelong  0x0001       Little Endian,
20099>>>>0x18  lequad  x            First time step: %lld
20100
20101# written on a big endian machine
201020         bequad  -8
20103>0x08     string  DUMPATOM     LAMMPS atom style binary dump
20104>>0x14    belong  x            (rev %d),
20105>>>0x10   lelong  0x1000       Big Endian,
20106>>>>0x18  bequad  x            First time step: %lld
20107
20108# Atom style binary dump file for the LAMMPS MD code
20109# written on a little endian machine
201100         lequad  -10
20111>0x08     string  DUMPCUSTOM   LAMMPS custom style binary dump
20112>>0x16    lelong  x            (rev %d),
20113>>>0x12   lelong  0x0001       Little Endian,
20114>>>>0x1a  lequad  x            First time step: %lld
20115
20116# written on a big endian machine
201170         bequad  -10
20118>0x08     string  DUMPCUSTOM   LAMMPS custom style binary dump
20119>>0x16    belong  x            (rev %d),
20120>>>0x12   lelong  0x1000       Big Endian,
20121>>>>0x1a  bequad  x            First time step: %lld
20122
20123# LAMMPS log file
201240         string LAMMPS\ (                    LAMMPS log file
20125>8        regex/16 [0-9]+\ [A-Za-z]+\ [0-9]+  written by version %s
20126
20127# Data file written either by LAMMPS, msi2lmp or VMD/TopoTools
201280      string LAMMPS\ data\ file  LAMMPS data file
20129>0x12  string CGCMM\ style        written by TopoTools
20130>0x12  string msi2lmp             written by msi2lmp
20131>0x11  string via\ write_data     written by LAMMPS
20132
20133# LAMMPS data file written by OVITO
201340      string #\ LAMMPS\ data\ file   LAMMPS data file
20135>0x13  string written\ by\ OVITO      written by OVITO
20136
20137# LAMMPS text mode dump file
201380      string    ITEM:\ TIMESTEP      LAMMPS text mode dump,
20139>15    regex/16  [0-9]+               First time step: %s
20140
20141#------------------------------------------------------------------------------
20142# $File: lecter,v 1.4 2009/09/19 16:28:10 christos Exp $
20143# DEC SRC Virtual Paper: Lectern files
20144# Karl M. Hegbloom <karlheg@inetarena.com>
201450	string	lect	DEC SRC Virtual Paper Lectern file
20146
20147#------------------------------------------------------------------------------
20148# $File: lex,v 1.6 2009/09/19 16:28:10 christos Exp $
20149# lex:  file(1) magic for lex
20150#
20151#	derived empirically, your offsets may vary!
201520	search/100	yyprevious	C program text (from lex)
20153>3	search/1	>\0		 for %s
20154# C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com>
201550	search/100	generated\ by\ flex	C program text (from flex)
20156# lex description file, from Daniel Quinlan <quinlan@yggdrasil.com>
201570	search/1	%{		lex description text
20158
20159#------------------------------------------------------------------------------
20160# $File: lif,v 1.9 2021/02/26 03:13:48 christos Exp $
20161# lif:  file(1) magic for lif
20162#
20163# (Daniel Quinlan <quinlan@yggdrasil.com>)
20164#
20165# Modified by:	Joerg Jenderek
20166# URL:		https://www.hp9845.net/9845/projects/hpdir/
20167#		https://github.com/bug400/lifutils
20168# Reference:	https://www.hp9845.net/9845/downloads/manuals/LIF_excerpt_64941-90906_flpRef_Jan84.pdf
20169# Note:		called by TrID "HP Logical Interchange Format disk image"
201700	beshort		0x8000
20171# GRR: line above is too general as it catches also compressed DEGAS low-res bitmap *.pc1
20172# skip many compressed DEGAS low-res bitmap *.pc1 by test for unused bytes
20173>14	beshort		=0
20174# skip MUNCHIE.PC1 BOARD.PC1 ENEMIES.PC1 by test for low version number
20175>>20	ubeshort	<0x0100
20176# skip DEGAS MUNCHIE.PC1 BOARD.PC1 ENEMIES.PC1 by test for ASCII like volume name
20177#>>>2	ubelong		>0x2020201F
20178>>>0	use		lif-file
201790	name		lif-file
20180# LIF ID
20181>0	beshort		x		lif file
20182!:mime	application/x-lif-disk
20183# lif used by Tony Duell LIF utilities; enhanced version by Joachim Siebold use also dat; hpi used by hpdir
20184!:ext	lif/hpi/dat
20185# volume label; A-Z 0-9 _ ; default are 6 spaces
20186>2	string		x		"%.6s"
20187# version number; 0 for systems without extensions or 1 for model 64000
20188>20	ubeshort	x		\b, version %u
20189# LIF identifier; 010000 for system 3000
20190>12	beshort		!0x1000		\b, LIF identifier 0x%x
20191# directory start address in units like: 2
20192>8	ubelong		x		\b, directory
20193>8	ubelong		!2		start address %u
20194# length of directory like: 2 4 7 10 12 14 (for model 64000) 16 18 20 24 30 50 57 77 80
20195>16	ubelong		x		length %u
20196# level 1 extensions
20197>20	beshort		=0
20198>>24	ubequad		!0		\b, for extensions 0x%llx...
20199>20	beshort		>0
20200>>24	ubequad		!0		\b, extensions 0x%llx...
20201# word 21-126 reserved for extensions and future use; set to nil
20202>42	ubequad		!0		\b, RESERVED 0x%llx
20203# lif first file name for standard directory; 0xffff... means uninitialized
20204>8	ubelong		2
20205>>512	string		<\xff\xff	\b, 1st file %-.10s
20206
20207
20208#------------------------------------------------------------------------------
20209# $File: linux,v 1.77 2021/02/24 23:05:02 christos Exp $
20210# linux:  file(1) magic for Linux files
20211#
20212# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
20213# The following basic Linux magic is useful for reference, but using
20214# "long" magic is a better practice in order to avoid collisions.
20215#
20216# 2	leshort		100		Linux/i386
20217# >0	leshort		0407		impure executable (OMAGIC)
20218# >0	leshort		0410		pure executable (NMAGIC)
20219# >0	leshort		0413		demand-paged executable (ZMAGIC)
20220# >0	leshort		0314		demand-paged executable (QMAGIC)
20221#
202220	lelong		0x00640107	Linux/i386 impure executable (OMAGIC)
20223>16	lelong		0		\b, stripped
202240	lelong		0x00640108	Linux/i386 pure executable (NMAGIC)
20225>16	lelong		0		\b, stripped
202260	lelong		0x0064010b	Linux/i386 demand-paged executable (ZMAGIC)
20227>16	lelong		0		\b, stripped
202280	lelong		0x006400cc	Linux/i386 demand-paged executable (QMAGIC)
20229>16	lelong		0		\b, stripped
20230#
202310	string		\007\001\000	Linux/i386 object file
20232>20	lelong		>0x1020		\b, DLL library
20233# Linux-8086 stuff:
202340	string		\01\03\020\04	Linux-8086 impure executable
20235>28	long		!0		not stripped
202360	string		\01\03\040\04	Linux-8086 executable
20237>28	long		!0		not stripped
20238#
202390	string		\243\206\001\0	Linux-8086 object file
20240#
202410	string		\01\03\020\20	Minix-386 impure executable
20242>28	long		!0		not stripped
202430	string		\01\03\040\20	Minix-386 executable
20244>28	long		!0		not stripped
202450	string		\01\03\04\20	Minix-386 NSYM/GNU executable
20246>28	long		!0		not stripped
20247# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov>
20248216	lelong		0421		Linux/i386 core file
20249!:strength / 2
20250>220	string		>\0		of '%s'
20251>200	lelong		>0		(signal %d)
20252#
20253# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com>
20254# this can be overridden by the DOS executable (COM) entry
202552	string		LILO		Linux/i386 LILO boot/chain loader
20256#
20257# Linux make config build file, from Ole Aamot <oka@oka.no>
20258# Updated by Ken Sharp
2025928	string		make\ config		Linux make config build file (old)
2026049	search/70	Kernel\ Configuration	Linux make config build file
20261
20262#
20263# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com>
20264# Updated by Adam Buchbinder <adam.buchbinder@gmail.com>
20265# See: https://www.win.tue.nl/~aeb/linux/kbd/font-formats-1.html
202660	leshort		0x0436		Linux/i386 PC Screen Font v1 data,
20267>2	byte&0x01	0		256 characters,
20268>2	byte&0x01	!0		512 characters,
20269>2	byte&0x02	0		no directory,
20270>2	byte&0x02	!0		Unicode directory,
20271>3	byte		>0		8x%d
202720	string		\x72\xb5\x4a\x86\x00\x00 Linux/i386 PC Screen Font v2 data,
20273>16	lelong		x		%d characters,
20274>12	lelong&0x01	0		no directory,
20275>12	lelong&0x01	!0		Unicode directory,
20276>24	lelong		x		%d
20277>28	lelong		x		\bx%d
20278
20279# Linux swap and hibernate files
20280# Linux kernel: include/linux/swap.h
20281# util-linux: libblkid/src/superblocks/swap.c
20282
20283# format v0, unsupported since 2002
202840xff6	string		SWAP-SPACE	Linux old swap file, 4k page size
202850x1ff6	string		SWAP-SPACE	Linux old swap file, 8k page size
202860x3ff6	string		SWAP-SPACE	Linux old swap file, 16k page size
202870x7ff6	string		SWAP-SPACE	Linux old swap file, 32k page size
202880xfff6	string		SWAP-SPACE	Linux old swap file, 64k page size
20289
20290# format v1, supported since 1998
202910		name	linux-swap
20292>0x400	lelong	1	little endian, version %u,
20293>>0x404	lelong	x	size %u pages,
20294>>0x408	lelong	x	%u bad pages,
20295>0x400	belong	1	big endian, version %u,
20296>>0x404	belong	x	size %u pages,
20297>>0x408	belong	x	%u bad pages,
20298>0x41c	string	\0	no label,
20299>0x41c	string	>\0	LABEL=%s,
20300>0x40c	belong	x	UUID=%08x
20301>0x410	beshort	x	\b-%04x
20302>0x412	beshort	x	\b-%04x
20303>0x414	beshort	x	\b-%04x
20304>0x416	belong	x	\b-%08x
20305>0x41a	beshort	x	\b%04x
20306
203070xff6	string		SWAPSPACE2	Linux swap file, 4k page size,
20308>0		use			linux-swap
203090x1ff6	string		SWAPSPACE2	Linux swap file, 8k page size,
20310>0		use			linux-swap
203110x3ff6	string		SWAPSPACE2	Linux swap file, 16k page size,
20312>0		use			linux-swap
203130x7ff6	string		SWAPSPACE2	Linux swap file, 32k page size,
20314>0		use			linux-swap
203150xfff6	string		SWAPSPACE2	Linux swap file, 64k page size,
20316>0		use			linux-swap
20317
203180	name	linux-hibernate
20319>0	string	S1SUSPEND	\b, with SWSUSP1 image
20320>0	string	S2SUSPEND	\b, with SWSUSP2 image
20321>0	string	ULSUSPEND	\b, with uswsusp image
20322>0	string	LINHIB0001	\b, with compressed hibernate image
20323>0	string	\xed\xc3\x02\xe9\x98\x56\xe5\x0c	\b, with tuxonice image
20324>0	default	x			\b, with unknown hibernate image
20325
203260xfec	string		SWAPSPACE2	Linux swap file, 4k page size,
20327>0		use			linux-swap
20328>0xff6	use			linux-hibernate
203290x1fec	string		SWAPSPACE2	Linux swap file, 8k page size,
20330>0		use			linux-swap
20331>0x1ff6	use			linux-hibernate
203320x3fec	string		SWAPSPACE2	Linux swap file, 16k page size,
20333>0		use			linux-swap
20334>0x3ff6	use			linux-hibernate
203350x7fec	string		SWAPSPACE2	Linux swap file, 32k page size,
20336>0		use			linux-swap
20337>0x7ff6	use			linux-hibernate
203380xffec	string		SWAPSPACE2	Linux swap file, 64k page size,
20339>0		use			linux-swap
20340>0xfff6	use			linux-hibernate
20341
20342#
20343# Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu>
20344# and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de>
20345# and Nicolas Lichtmaier <nick@debian.org>
20346# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29
20347# Linux kernel boot images (i386 arch) (Wolfram Kleff)
20348# URL: https://www.kernel.org/doc/Documentation/x86/boot.txt
20349514	string		HdrS		Linux kernel
20350!:strength + 55
20351# often no extension like in linux, vmlinuz, bzimage or memdisk but sometimes
20352# Acronis Recovery kernel64.dat and Plop Boot Manager plpbtrom.bin
20353# DamnSmallLinux 1.5 damnsmll.lnx
20354!:ext	/dat/bin/lnx
20355>510	leshort		0xAA55		x86 boot executable
20356>>518	leshort		>0x1ff
20357>>>529	byte		0		zImage,
20358>>>529	byte		1		bzImage,
20359>>>526	lelong		>0
20360>>>>(526.s+0x200) string	>\0	version %s,
20361>>498	leshort		1		RO-rootFS,
20362>>498	leshort		0		RW-rootFS,
20363>>508	leshort		>0		root_dev 0x%X,
20364>>502	leshort		>0		swap_dev 0x%X,
20365>>504	leshort		>0		RAMdisksize %u KB,
20366>>506	leshort		0xFFFF		Normal VGA
20367>>506	leshort		0xFFFE		Extended VGA
20368>>506	leshort		0xFFFD		Prompt for Videomode
20369>>506	leshort		>0		Video mode %d
20370# This also matches new kernels, which were caught above by "HdrS".
203710		belong	0xb8c0078e	Linux kernel
20372>0x1e3		string	Loading		version 1.3.79 or older
20373>0x1e9		string	Loading		from prehistoric times
20374
20375# System.map files - Nicolas Lichtmaier <nick@debian.org>
203768	search/1	\ A\ _text	Linux kernel symbol map text
20377
20378# LSM entries - Nicolas Lichtmaier <nick@debian.org>
203790	search/1	Begin3	Linux Software Map entry text
203800	search/1	Begin4	Linux Software Map entry text (new format)
20381
20382# From Matt Zimmerman, enhanced for v3 by Matthew Palmer
203830	belong	0x4f4f4f4d	User-mode Linux COW file
20384>4	belong	<3		\b, version %d
20385>>8	string	>\0		\b, backing file %s
20386>4	belong	>2		\b, version %d
20387>>32	string	>\0		\b, backing file %s
20388
20389############################################################################
20390# Linux kernel versions
20391
203920		string		\xb8\xc0\x07\x8e\xd8\xb8\x00\x90	Linux
20393>497		leshort		0		x86 boot sector
20394>>514		belong		0x8e	of a kernel from the dawn of time!
20395>>514		belong		0x908ed8b4	version 0.99-1.1.42
20396>>514		belong		0x908ed8b8	for memtest86
20397
20398>497		leshort		!0		x86 kernel
20399>>504		leshort		>0		RAMdisksize=%u KB
20400>>502		leshort		>0		swap=0x%X
20401>>508		leshort		>0		root=0x%X
20402>>>498		leshort		1		\b-ro
20403>>>498		leshort		0		\b-rw
20404>>506		leshort		0xFFFF		vga=normal
20405>>506		leshort		0xFFFE		vga=extended
20406>>506		leshort		0xFFFD		vga=ask
20407>>506		leshort		>0		vga=%d
20408>>514		belong		0x908ed881	version 1.1.43-1.1.45
20409>>514		belong		0x15b281cd
20410>>>0xa8e	belong		0x55AA5a5a	version 1.1.46-1.2.13,1.3.0
20411>>>0xa99	belong		0x55AA5a5a	version 1.3.1,2
20412>>>0xaa3	belong		0x55AA5a5a	version 1.3.3-1.3.30
20413>>>0xaa6	belong		0x55AA5a5a	version 1.3.31-1.3.41
20414>>>0xb2b	belong		0x55AA5a5a	version 1.3.42-1.3.45
20415>>>0xaf7	belong		0x55AA5a5a	version 1.3.46-1.3.72
20416>>514		string		HdrS
20417>>>518		leshort		>0x1FF
20418>>>>529		byte		0		\b, zImage
20419>>>>529		byte		1		\b, bzImage
20420>>>>(526.s+0x200) string 	>\0		\b, version %s
20421
20422# Linux boot sector thefts.
204230		belong		0xb8c0078e	Linux
20424>0x1e6		belong		0x454c4b53	ELKS Kernel
20425>0x1e6		belong		!0x454c4b53	style boot sector
20426
20427############################################################################
20428# Linux S390 kernel image
20429# Created by: Jan Kaluza <jkaluza@redhat.com>
204308 string \x02\x00\x00\x18\x60\x00\x00\x50\x02\x00\x00\x68\x60\x00\x00\x50\x40\x40\x40\x40\x40\x40\x40\x40 Linux S390
20431>0x00010000 search/b/4096 \x00\x0a\x00\x00\x8b\xad\xcc\xcc
20432# 64bit
20433>>&0 string \xc1\x00\xef\xe3\xf0\x68\x00\x00 Z10 64bit kernel
20434>>&0 string \xc1\x00\xef\xc3\x00\x00\x00\x00 Z9-109 64bit kernel
20435>>&0 string \xc0\x00\x20\x00\x00\x00\x00\x00 Z990 64bit kernel
20436>>&0 string \x00\x00\x00\x00\x00\x00\x00\x00 Z900 64bit kernel
20437# 32bit
20438>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z10 32bit kernel
20439>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z9-109 32bit kernel
20440>>&0 string \x80\x00\x20\x00\x00\x00\x00\x00 Z990 32bit kernel
20441>>&0 string \x80\x00\x00\x00\x00\x00\x00\x00 Z900 32bit kernel
20442
20443############################################################################
20444# Linux ARM compressed kernel image
20445# From: Kevin Cernekee <cernekee@gmail.com>
20446# Update: Joerg Jenderek
204470x24	lelong	0x016f2818	Linux kernel ARM boot executable zImage
20448# There are three possible situations: LE, BE with LE bootloader and pure BE.
20449# In order to aid telling these apart a new endian flag was added. In order
20450# to support kernels before the flag and BE with LE bootloader was added we'll
20451# do a negative check against the BE variant of the flag when we see a LE magic.
20452>0x30	belong	!0x04030201	(little-endian)
20453# raspian "kernel7.img", Vu+ Ultimo4K "kernel_auto.bin"
20454!:ext	img/bin
20455>0x30	belong	0x04030201	(big-endian)
204560x24	belong	0x016f2818	Linux kernel ARM boot executable zImage (big-endian)
20457
20458############################################################################
20459# Linux AARCH64 kernel image
204600x38    lelong  0x644d5241  Linux kernel ARM64 boot executable Image
20461>0x18   lelong  ^1          \b, little-endian
20462>0x18   lelong  &1          \b, big-endian
20463>0x18   lelong  &2          \b, 4K pages
20464>0x18   lelong  &4          \b, 16K pages
20465>0x18   lelong  &6          \b, 32K pages
20466
20467############################################################################
20468# Linux 8086 executable
204690	lelong&0xFF0000FF 0xC30000E9	Linux-Dev86 executable, headerless
20470>5	string		.
20471>>4	string		>\0		\b, libc version %s
20472
204730	lelong&0xFF00FFFF 0x4000301	Linux-8086 executable
20474>2	byte&0x01	!0		\b, unmapped zero page
20475>2	byte&0x20	0		\b, impure
20476>2	byte&0x20	!0
20477>>2	byte&0x10	!0		\b, A_EXEC
20478>2	byte&0x02	!0		\b, A_PAL
20479>2	byte&0x04	!0		\b, A_NSYM
20480>2	byte&0x08	!0		\b, A_STAND
20481>2	byte&0x40	!0		\b, A_PURE
20482>2	byte&0x80	!0		\b, A_TOVLY
20483>28     long            !0              \b, not stripped
20484>37	string		.
20485>>36	string		>\0		\b, libc version %s
20486
20487# 0	lelong&0xFF00FFFF 0x10000301	ld86 I80386 executable
20488# 0	lelong&0xFF00FFFF 0xB000301	ld86 M68K executable
20489# 0	lelong&0xFF00FFFF 0xC000301	ld86 NS16K executable
20490# 0	lelong&0xFF00FFFF 0x17000301	ld86 SPARC executable
20491
20492# SYSLINUX boot logo files (from 'ppmtolss16' sources)
20493# https://www.syslinux.org/wiki/index.php/SYSLINUX#Display_graphic_from_filename:
20494# file extension .lss .16
204950	lelong	=0x1413f33d		SYSLINUX' LSS16 image data
20496# syslinux-4.05/mime/image/x-lss16.xml
20497!:mime image/x-lss16
20498>4	leshort	x			\b, width %d
20499>6	leshort	x			\b, height %d
20500
205010	string	OOOM			User-Mode-Linux's Copy-On-Write disk image
20502>4	belong	x			version %d
20503
20504# SE Linux policy database
20505# From: Mike Frysinger <vapier@gentoo.org>
205060	lelong	0xf97cff8c		SE Linux policy
20507>16	lelong	x			v%d
20508>20	lelong	1			MLS
20509>24	lelong	x			%d symbols
20510>28	lelong	x			%d ocons
20511
20512# Linux Logical Volume Manager (LVM)
20513# Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net>
20514#
20515# System ID, UUID and volume group name are 128 bytes long
20516# but they should never be full and initialized with zeros...
20517#
20518# LVM1
20519#
205200x0	string/b	HM\001		LVM1 (Linux Logical Volume Manager), version 1
20521>0x12c	string/b	>\0		, System ID: %s
20522
205230x0	string/b	HM\002		LVM1 (Linux Logical Volume Manager), version 2
20524>0x12c	string/b	>\0		, System ID: %s
20525
20526#  LVM2
20527#
20528# It seems that the label header can be in one the four first sector
20529# of the disk... (from _find_labeller in lib/label/label.c of LVM2)
20530#
20531# 0x200 seems to be the common case
205320		name	lvm2
20533# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
20534>0x0          string  >\x2f          \b, UUID: %.6s
20535>0x6          string  >\x2f          \b-%.4s
20536>0xa          string  >\x2f          \b-%.4s
20537>0xe          string  >\x2f          \b-%.4s
20538>0x12         string  >\x2f          \b-%.4s
20539>0x16         string  >\x2f          \b-%.4s
20540>0x1a         string  >\x2f          \b-%.6s
20541>0x20         lequad  x              \b, size: %lld
20542
20543
20544# read the offset to add to the start of the header, and the header
20545# start in 0x200
205460x218           string/b  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
20547>&(&-12.l-0x20) use	lvm2
20548
205490x018           string/b  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
20550>&(&-12.l-0x20) use	lvm2
20551
205520x418           string/b  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
20553>&(&-12.l-0x20) use	lvm2
20554
205550x618           string/b  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
20556>&(&-12.l-0x20) use	lvm2
20557
20558# LVM snapshot
20559# from Jason Farrel
205600	string	SnAp	LVM Snapshot (CopyOnWrite store)
20561>4	lelong	!0	- valid,
20562>4	lelong	0	- invalid,
20563>8	lelong	x	version %d,
20564>12	lelong	x	chunk_size %d
20565
20566# SE Linux policy database
205670	lelong	0xf97cff8c		SE Linux policy
20568>16	lelong	x			v%d
20569>20	lelong	1			MLS
20570>24	lelong	x			%d symbols
20571>28	lelong	x			%d ocons
20572
20573# LUKS: Linux Unified Key Setup, On-Disk Format, http://luks.endorphin.org/spec
20574# Anthon van der Neut (anthon@mnt.org)
205750	string	LUKS\xba\xbe	LUKS encrypted file,
20576>6	beshort x		ver %d
20577>8	string	x		[%s,
20578>40	string	x		%s,
20579>72	string	x		%s]
20580>168	string	x		UUID: %s
20581
20582
20583# Summary: Xen saved domain file
20584# Created by: Radek Vokal <rvokal@redhat.com>
205850	string		LinuxGuestRecord	Xen saved domain
20586>20	search/256	(name
20587>>&1	string		x			(name %s)
20588
20589# Type: Xen, the virtual machine monitor
20590# From: Radek Vokal <rvokal@redhat.com>
205910	string		LinuxGuestRecord	Xen saved domain
20592#>2	regex		\(name\ [^)]*\)		%s
20593>20	search/256	(name			(name
20594>>&1	string		x			%s...)
20595
20596# Systemd journald files
20597# See https://www.freedesktop.org/wiki/Software/systemd/journal-files/.
20598# From: Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl>
20599
20600# check magic
206010	string	LPKSHHRH
20602# check that state is one of known values
20603>16		ubyte&252	0
20604# check that each half of three unique id128s is non-zero
20605>>24		ubequad		>0
20606>>>32		ubequad		>0
20607>>>>40		ubequad		>0
20608>>>>>48		ubequad		>0
20609>>>>>>56	ubequad		>0
20610>>>>>>>64	ubequad		>0	Journal file
20611!:mime application/octet-stream
20612# provide more info
20613>>>>>>>>184	leqdate		0	empty
20614>>>>>>>>16	ubyte		0	\b, offline
20615>>>>>>>>16	ubyte		1	\b, online
20616>>>>>>>>16	ubyte		2	\b, archived
20617>>>>>>>>8	ulelong&1	1	\b, sealed
20618>>>>>>>>12	ulelong&1	1	\b, compressed
20619
20620# BCache backing and cache devices
20621# From: Gabriel de Perthuis <g2p.code@gmail.com>
206220x1008		lequad		8
20623>0x1018		string		\xc6\x85\x73\xf6\x4e\x1a\x45\xca\x82\x65\xf5\x7f\x48\xba\x6d\x81	BCache
20624>>0x1010	ulequad		0	cache device
20625>>0x1010	ulequad		1	backing device
20626>>0x1010	ulequad		3	cache device
20627>>0x1010	ulequad		4	backing device
20628>>0x1048	string		>0	\b, label "%.32s"
20629>>0x1028	ubelong		x	\b, uuid %08x
20630>>0x102c	ubeshort	x	\b-%04x
20631>>0x102e	ubeshort	x	\b-%04x
20632>>0x1030	ubeshort	x	\b-%04x
20633>>0x1032	ubelong		x	\b-%08x
20634>>0x1036	ubeshort	x	\b%04x
20635>>0x1038	ubelong		x	\b, set uuid %08x
20636>>0x103c	ubeshort	x	\b-%04x
20637>>0x103e	ubeshort	x	\b-%04x
20638>>0x1040	ubeshort	x	\b-%04x
20639>>0x1042	ubelong		x	\b-%08x
20640>>0x1046	ubeshort	x	\b%04x
20641
20642# Linux device tree:
20643# File format description can be found in the Linux kernel sources at
20644# Documentation/devicetree/booting-without-of.txt
20645# From Christoph Biedl
206460		belong		0xd00dfeed
20647# structure must be within blob, strings are omitted to handle devicetrees > 1M
20648>&(8.L)		byte		x
20649>>20		belong		>1	Device Tree Blob version %d
20650>>>4		belong		x	\b, size=%d
20651>>>20		belong		>1
20652>>>>28		belong		x	\b, boot CPU=%d
20653>>>20		belong		>2
20654>>>>32		belong		x	\b, string block size=%d
20655>>>20		belong		>16
20656>>>>36		belong		x	\b, DT structure block size=%d
20657
20658# glibc locale archive as defined in glibc locale/locarchive.h
206590		lelong		0xde020109	locale archive
20660>24		lelong		x		%d strings
20661
20662# Linux Software RAID (mdadm)
20663# Russell Coker <russell@coker.com.au>
206640	name	linuxraid
20665>16	belong	x		UUID=%8x:
20666>20	belong	x		\b%8x:
20667>24	belong	x		\b%8x:
20668>28	belong	x		\b%8x
20669>32	string	x		name=%s
20670>72	lelong	x		level=%d
20671>92	lelong	x		disks=%d
20672
206734096	lelong	0xa92b4efc	Linux Software RAID
20674>4100	lelong	x		version 1.2 (%d)
20675>4096	use	linuxraid
20676
206770	lelong	0xa92b4efc	Linux Software RAID
20678>4	lelong	x		version 1.1 (%d)
20679>0	use	linuxraid
20680
20681# Summary:     Database file for mlocate
20682# Description: A database file as used by mlocate, a fast implementation
20683#              of locate/updatedb. It uses merging to reuse the existing
20684#              database and avoid rereading most of the filesystem. It's
20685#              the default version of locate on Arch Linux (and others).
20686# File path:   /var/lib/mlocate/mlocate.db by default (but configurable)
20687# Site:        https://fedorahosted.org/mlocate/
20688# Format docs: https://linux.die.net/man/5/mlocate.db
20689# Type: mlocate database file
20690# URL:  https://fedorahosted.org/mlocate/
20691# From: Wander Nauta <info@wandernauta.nl>
206920		string		\0mlocate	mlocate database
20693>12		byte		x		\b, version %d
20694>13		byte		1		\b, require visibility
20695>16		string		x		\b, root %s
20696
20697# Dump files for iproute2 tool. Generated by the "ip r|a save" command. URL:
20698# https://www.linuxfoundation.org/collaborate/workgroups/networking/iproute2
20699# From: Pavel Emelyanov <xemul@parallels.com>
207000		lelong		0x45311224	iproute2 routes dump
207010		lelong		0x47361222	iproute2 addresses dump
20702
20703# Image and service files for CRIU tool.
20704# URL: https://criu.org
20705# From: Pavel Emelyanov <xemul@parallels.com>
207060		lelong		0x54564319	CRIU image file v1.1
207070		lelong		0x55105940	CRIU service file
207080		lelong		0x58313116	CRIU inventory
20709
20710# Kdump compressed dump files
20711# https://sourceforge.net/p/makedumpfile/code/ci/master/tree/IMPLEMENTATION
20712
207130		string		KDUMP          	Kdump compressed dump
20714>8		long		x		v%d
20715>12		string		>\0		\b, system %s
20716>77		string		>\0		\b, node %s
20717>142		string		>\0		\b, release %s
20718>207		string		>\0		\b, version %s
20719>272		string		>\0		\b, machine %s
20720>337		string		>\0		\b, domain %s
20721
20722# Device Tree files
207230		search/1024	/dts-v1/	Device Tree File (v1)
20724# beat c code
20725!:strength +14
20726
20727
20728# e2fsck undo file
20729# David Gilman <davidgilman1@gmail.com>
207300		string		E2UNDO02	e2fsck undo file, version 2
20731>44		lelong		x		\b, undo file is
20732>>44		lelong&1	0		not finished
20733>>44		lelong&1	1		finished
20734>48		lelong		x		\b, undo file features:
20735>>48		lelong&1	0		lacks filesystem offset
20736>>48		lelong&1	1		has filesystem offset
20737>>>64		lequad		x		at 0x%llx
20738
20739# ansible vault (does not really belong here)
207400		string		$ANSIBLE_VAULT;	Ansible Vault
20741>&0		regex		[0-9]*\.[0-9]*	\b, version %s
20742>>&0		string		;
20743>>>&0		regex		[A-Z0-9]*	\b, encryption %s
20744
20745#------------------------------------------------------------------------------
20746# $File: lisp,v 1.27 2020/08/14 19:23:39 christos Exp $
20747# lisp:  file(1) magic for lisp programs
20748#
20749# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
20750
20751# updated by Joerg Jenderek
20752# GRR: This lot is too weak
20753#0	string	;;
20754# windows INF files often begin with semicolon and use CRLF as line end
20755# lisp files are mainly created on unix system with LF as line end
20756#>2	search/4096	!\r		Lisp/Scheme program text
20757#>2	search/4096	\r		Windows INF file
20758
207590	search/4096	(setq\ 			Lisp/Scheme program text
20760!:mime	text/x-lisp
207610	search/4096	(defvar\ 		Lisp/Scheme program text
20762!:mime	text/x-lisp
207630	search/4096	(defparam\ 		Lisp/Scheme program text
20764!:mime	text/x-lisp
207650	search/4096	(defun\  		Lisp/Scheme program text
20766!:mime	text/x-lisp
207670	search/4096	(autoload\ 		Lisp/Scheme program text
20768!:mime	text/x-lisp
207690	search/4096	(custom-set-variables\ 	Lisp/Scheme program text
20770!:mime	text/x-lisp
20771
20772# URL: https://en.wikipedia.org/wiki/Emacs_Lisp
20773# Reference: https://ftp.gnu.org/old-gnu/emacs/elisp-manual-18-1.03.tar.gz
20774# Update: Joerg Jenderek
20775# Emacs 18 - this is always correct, but not very magical.
207760	string	\012(
20777# look for emacs lisp keywords
20778# GRR: split regex because it is too long or get error like
20779# lisp, 36: Warning: cannot get string from `^(defun|defvar|defconst|defmacro|setq|fset|put|provide|require|'
20780>&0	regex	\^(defun|defvar|defconst|defmacro|setq|fset)	Emacs v18 byte-compiled Lisp data
20781!:mime	application/x-elc
20782# https://searchcode.com/codesearch/view/2173420/
20783# not really pure text
20784!:apple	EMAxTEXT
20785!:ext elc
20786# remaining regex
20787>&0	regex	\^(put|provide|require|random)	Emacs v18 byte-compiled Lisp data
20788!:mime	application/x-elc
20789!:apple	EMAxTEXT
20790!:ext elc
20791# missed cl.elc dbx.elc simple.elc look like normal lisp starting with ;;;
20792
20793# Emacs 19+ - ver. recognition added by Ian Springer
20794# Also applies to XEmacs 19+ .elc files; could tell them apart with regexs
20795# - Chris Chittleborough <cchittleborough@yahoo.com.au>
20796# Update: Joerg Jenderek
207970	string	;ELC
20798# version\0\0\0
20799>4	byte	>18			Emacs/XEmacs v%d byte-compiled Lisp data
20800# why less than 32 ? does not make sense to me. GNU Emacs version is 24.5 at April 2015
20801#>4	byte    <32			Emacs/XEmacs v%d byte-compiled Lisp data
20802!:mime	application/x-elc
20803!:apple	EMAxTEXT
20804!:ext elc
20805
20806# Files produced by GNU/Emacs pdumper
208070	string	DUMPEDGNUEMACS	GNU/Emacs pdumper image
20808
20809# Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr>
208100	string	(SYSTEM::VERSION\040'	CLISP byte-compiled Lisp program (pre 2004-03-27)
208110	string	(|SYSTEM|::|VERSION|\040'	CLISP byte-compiled Lisp program text
20812
208130	long	0x70768BD2		CLISP memory image data
208140	long	0xD28B7670		CLISP memory image data, other endian
20815
20816#.com and .bin for MIT scheme
208170	string	\372\372\372\372	MIT scheme (library?)
20818
20819# From: David Allouche <david@allouche.net>
208200	search/1	\<TeXmacs|	TeXmacs document text
20821!:mime	text/texmacs
20822
20823#------------------------------------------------------------------------------
20824# $File: llvm,v 1.9 2019/04/19 00:42:27 christos Exp $
20825# llvm:  file(1) magic for LLVM byte-codes
20826# URL:  https://llvm.org/docs/BitCodeFormat.html
20827# From: Al Stone <ahs3@fc.hp.com>
20828
208290	string	llvm	LLVM byte-codes, uncompressed
208300	string	llvc0	LLVM byte-codes, null compression
208310	string	llvc1	LLVM byte-codes, gzip compression
208320	string	llvc2	LLVM byte-codes, bzip2 compression
20833
208340	lelong	0x0b17c0de	LLVM bitcode, wrapper
20835# Are these Mach-O ABI values?  They appear to be.
20836>16	lelong	0x01000007	x86_64
20837>16	lelong	0x00000007	i386
20838>16	lelong	0x00000012	ppc
20839>16	lelong	0x01000012	ppc64
20840>16	lelong 	0x0000000c	arm
20841
208420	string	BC\xc0\xde	LLVM IR bitcode
20843
20844#------------------------------------------------------------------------------
20845# $File: locoscript,v 1.1 2021/01/03 20:56:25 christos Exp $
20846# locoscript:  file(1) magic for LocoScript documents and related files
20847#
20848# See http://fileformats.archiveteam.org/wiki/LocoScript
208490	string	JOY\x01\x01	LocoScript 1 document
208500	string	JOY\x01\x02	LocoScript 2 document
208510	string	JOY\x01\x04	LocoScript 3 document
208520	string	JOY\x01\x06	LocoScript 4 document
208530	string	DOC\x01\x01	LocoScript PC document
208540	string	DOC\x01\x03	LocoScript Professional document
20855
20856#------------------------------------------------------------------------------
20857# $File: lua,v 1.8 2020/10/08 23:23:56 christos Exp $
20858# lua:  file(1) magic for Lua scripting language
20859# URL:  https://www.lua.org/
20860# From: Reuben Thomas <rrt@sc3d.org>, Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr>
20861
20862# Lua scripts
208630	search/1/w	#!\ /usr/bin/lua	Lua script text executable
20864!:mime	text/x-lua
208650	search/1/w	#!\ /usr/local/bin/lua	Lua script text executable
20866!:mime	text/x-lua
208670	search/1	#!/usr/bin/env\ lua	Lua script text executable
20868!:mime	text/x-lua
208690	search/1	#!\ /usr/bin/env\ lua	Lua script text executable
20870!:mime	text/x-lua
20871
20872# Lua bytecode
208730	string		\033Lua			Lua bytecode,
20874# 2.4 uses 0x23 as its version byte because it shares the format
20875# with 2.3 (which was never released publicly).
20876>4	byte		0x23			version 2.4
20877>4	byte		0x25			version 2.5/3.0
20878>4	byte		0x31			version 3.1
20879>4	byte		0x32			version 3.2
20880>4	byte		0x40			version 4.0
20881>4	byte		0x50			version 5.0
20882>4	byte		0x51			version 5.1
20883>4	byte		0x52			version 5.2
20884>4	byte		0x53			version 5.3
20885>4	byte		0x54			version 5.4
20886
20887#------------------------------------------------------------------------------
20888# $File: luks,v 1.4 2009/09/19 16:28:10 christos Exp $
20889# luks:  file(1) magic for Linux Unified Key Setup
20890# URL:	http://luks.endorphin.org/spec
20891# From:	Anthon van der Neut <anthon@mnt.org>
20892
208930	string		LUKS\xba\xbe	LUKS encrypted file,
20894>6	beshort		x		ver %d
20895>8	string		x		[%s,
20896>40	string		x		%s,
20897>72	string		x		%s]
20898>168	string		x		UUID: %s
20899#------------------------------------------------------------------------------
20900# $File: m4,v 1.3 2019/02/27 16:46:23 christos Exp $
20901# make:  file(1) magic for M4 scripts
20902#
209030	search/8192	dnl
20904>0	regex	\^dnl\ 		M4 macro processor script text
20905!:mime	text/x-m4
209060	search/8192	AC_DEFUN
20907>0	regex	\^AC_DEFUN\\(\\[	M4 macro processor script text
20908!:strength + 15
20909!:mime	text/x-m4
20910
20911#------------------------------------------------------------
20912# $File: mach,v 1.28 2020/12/12 20:01:47 christos Exp $
20913# Mach has two magic numbers, 0xcafebabe and 0xfeedface.
20914# Unfortunately the first, cafebabe, is shared with
20915# Java ByteCode, so they are both handled in the file "cafebabe".
20916# The "feedface" ones are handled herein.
20917#------------------------------------------------------------
20918# if set, it's for the 64-bit version of the architecture
20919# yes, this is separate from the low-order magic number bit
20920# it's also separate from the "64-bit libraries" bit in the
20921# upper 8 bits of the CPU subtype
20922
20923# Reference:	https://opensource.apple.com/source/cctools/cctools-949.0.1/
20924#               include/mach-o/loader.h
20925# display CPU type as string like: i386 x86_64 ... armv7 armv7k ...
209260	name	mach-o-cpu
20927>0	belong&0xff000000	0
20928#
20929# 32-bit ABIs.
20930#
20931#				1	vax
20932>>0	belong&0x00ffffff	1
20933>>>4		belong&0x00ffffff	0	vax
20934>>>4		belong&0x00ffffff	1	vax11/780
20935>>>4		belong&0x00ffffff	2	vax11/785
20936>>>4		belong&0x00ffffff	3	vax11/750
20937>>>4		belong&0x00ffffff	4	vax11/730
20938>>>4		belong&0x00ffffff	5	uvaxI
20939>>>4		belong&0x00ffffff	6	uvaxII
20940>>>4		belong&0x00ffffff	7	vax8200
20941>>>4		belong&0x00ffffff	8	vax8500
20942>>>4		belong&0x00ffffff	9	vax8600
20943>>>4		belong&0x00ffffff	10	vax8650
20944>>>4		belong&0x00ffffff	11	vax8800
20945>>>4		belong&0x00ffffff	12	uvaxIII
20946>>>4		belong&0x00ffffff	>12	vax subarchitecture=%d
20947>>0	belong&0x00ffffff	2	romp
20948>>0	belong&0x00ffffff	3	architecture=3
20949>>0	belong&0x00ffffff	4	ns32032
20950>>0	belong&0x00ffffff	5	ns32332
20951>>0	belong&0x00ffffff	6	m68k
20952#				7	x86
20953>>0	belong&0x00ffffff	7
20954>>>4	belong&0x0000000f	3		i386
20955>>>4	belong&0x0000000f	4		i486
20956>>>>4	belong&0x00fffff0	0
20957>>>>4	belong&0x00fffff0	0x80		\bsx
20958>>>4	belong&0x0000000f	5		i586
20959>>>4	belong&0x0000000f	6
20960>>>>4	belong&0x00fffff0	0		p6
20961>>>>4	belong&0x00fffff0	0x10		pentium_pro
20962>>>>4	belong&0x00fffff0	0x20		pentium_2_m0x20
20963>>>>4	belong&0x00fffff0	0x30		pentium_2_m3
20964>>>>4	belong&0x00fffff0	0x40		pentium_2_m0x40
20965>>>>4	belong&0x00fffff0	0x50		pentium_2_m5
20966>>>>4	belong&0x00fffff0	>0x50		pentium_2_m0x%x
20967>>>4	belong&0x0000000f	7		celeron
20968>>>>4	belong&0x00fffff0	0x00		\b_m0x%x
20969>>>>4	belong&0x00fffff0	0x10		\b_m0x%x
20970>>>>4	belong&0x00fffff0	0x20		\b_m0x%x
20971>>>>4	belong&0x00fffff0	0x30		\b_m0x%x
20972>>>>4	belong&0x00fffff0	0x40		\b_m0x%x
20973>>>>4	belong&0x00fffff0	0x50		\b_m0x%x
20974>>>>4	belong&0x00fffff0	0x60
20975>>>>4	belong&0x00fffff0	0x70		\b_mobile
20976>>>>4	belong&0x00fffff0	>0x70		\b_m0x%x
20977>>>4	belong&0x0000000f	8		pentium_3
20978>>>>4	belong&0x00fffff0	0x00
20979>>>>4	belong&0x00fffff0	0x10		\b_m
20980>>>>4	belong&0x00fffff0	0x20		\b_xeon
20981>>>>4	belong&0x00fffff0	>0x20		\b_m0x%x
20982>>>4	belong&0x0000000f	9		pentiumM
20983>>>>4	belong&0x00fffff0	0x00
20984>>>>4	belong&0x00fffff0	>0x00		\b_m0x%x
20985>>>4	belong&0x0000000f	10		pentium_4
20986>>>>4	belong&0x00fffff0	0x00
20987>>>>4	belong&0x00fffff0	0x10		\b_m
20988>>>>4	belong&0x00fffff0	>0x10		\b_m0x%x
20989>>>4	belong&0x0000000f	11		itanium
20990>>>>4	belong&0x00fffff0	0x00
20991>>>>4	belong&0x00fffff0	0x10		\b_2
20992>>>>4	belong&0x00fffff0	>0x10		\b_m0x%x
20993>>>4	belong&0x0000000f	12		xeon
20994>>>>4	belong&0x00fffff0	0x00
20995>>>>4	belong&0x00fffff0	0x10		\b_mp
20996>>>>4	belong&0x00fffff0	>0x10		\b_m0x%x
20997>>>4	belong&0x0000000f	>12		ia32 family=%d
20998>>>>4	belong&0x00fffff0	0x00
20999>>>>4	belong&0x00fffff0	>0x00		model=%x
21000>>0	belong&0x00ffffff	8	mips
21001>>>4		belong&0x00ffffff	1	R2300
21002>>>4		belong&0x00ffffff	2	R2600
21003>>>4		belong&0x00ffffff	3	R2800
21004>>>4		belong&0x00ffffff	4	R2000a
21005>>>4		belong&0x00ffffff	5	R2000
21006>>>4		belong&0x00ffffff	6	R3000a
21007>>>4		belong&0x00ffffff	7	R3000
21008>>>4		belong&0x00ffffff	>7	subarchitecture=%d
21009>>0	belong&0x00ffffff	9	ns32532
21010>>0	belong&0x00ffffff	10	mc98000
21011>>0	belong&0x00ffffff	11	hppa
21012>>>4		belong&0x00ffffff	0	7100
21013>>>4		belong&0x00ffffff	1	7100LC
21014>>>4		belong&0x00ffffff	>1	subarchitecture=%d
21015>>0	belong&0x00ffffff	12	arm
21016>>>4		belong&0x00ffffff	0
21017>>>4		belong&0x00ffffff	1	subarchitecture=%d
21018>>>4		belong&0x00ffffff	2	subarchitecture=%d
21019>>>4		belong&0x00ffffff	3	subarchitecture=%d
21020>>>4		belong&0x00ffffff	4	subarchitecture=%d
21021>>>4		belong&0x00ffffff	5	\bv4t
21022>>>4		belong&0x00ffffff	6	\bv6
21023>>>4		belong&0x00ffffff	7	\bv5tej
21024>>>4		belong&0x00ffffff	8	\bxscale
21025>>>4		belong&0x00ffffff	9	\bv7
21026>>>4		belong&0x00ffffff	10	\bv7f
21027>>>4		belong&0x00ffffff	11	\bv7s
21028>>>4		belong&0x00ffffff	12	\bv7k
21029>>>4		belong&0x00ffffff	13	\bv8
21030>>>4		belong&0x00ffffff	14	\bv6m
21031>>>4		belong&0x00ffffff	15	\bv7m
21032>>>4		belong&0x00ffffff	16	\bv7em
21033>>>4		belong&0x00ffffff	>16	subarchitecture=%d
21034#				13	m88k
21035>>0	belong&0x00ffffff	13
21036>>>4		belong&0x00ffffff	0	mc88000
21037>>>4		belong&0x00ffffff	1	mc88100
21038>>>4		belong&0x00ffffff	2	mc88110
21039>>>4		belong&0x00ffffff	>2	mc88000 subarchitecture=%d
21040>>0	belong&0x00ffffff	14	SPARC
21041>>0	belong&0x00ffffff	15	i860g
21042>>0	belong&0x00ffffff	16	alpha
21043>>0	belong&0x00ffffff	17	rs6000
21044>>0	belong&0x00ffffff	18	ppc
21045>>>4		belong&0x00ffffff	0
21046>>>4		belong&0x00ffffff	1	\b_601
21047>>>4		belong&0x00ffffff	2	\b_602
21048>>>4		belong&0x00ffffff	3	\b_603
21049>>>4		belong&0x00ffffff	4	\b_603e
21050>>>4		belong&0x00ffffff	5	\b_603ev
21051>>>4		belong&0x00ffffff	6	\b_604
21052>>>4		belong&0x00ffffff	7	\b_604e
21053>>>4		belong&0x00ffffff	8	\b_620
21054>>>4		belong&0x00ffffff	9	\b_750
21055>>>4		belong&0x00ffffff	10	\b_7400
21056>>>4		belong&0x00ffffff	11	\b_7450
21057>>>4		belong&0x00ffffff	100	\b_970
21058>>>4		belong&0x00ffffff	>100	subarchitecture=%d
21059>>0	belong&0x00ffffff	>18	architecture=%d
21060>0	belong&0xff000000	0x01000000
21061#
21062# 64-bit ABIs.
21063#
21064>>0	belong&0x00ffffff	0	64-bit architecture=%d
21065>>0	belong&0x00ffffff	1	64-bit architecture=%d
21066>>0	belong&0x00ffffff	2	64-bit architecture=%d
21067>>0	belong&0x00ffffff	3	64-bit architecture=%d
21068>>0	belong&0x00ffffff	4	64-bit architecture=%d
21069>>0	belong&0x00ffffff	5	64-bit architecture=%d
21070>>0	belong&0x00ffffff	6	64-bit architecture=%d
21071>>0	belong&0x00ffffff	7	x86_64
21072>>>4		belong&0x00ffffff	0	subarchitecture=%d
21073>>>4		belong&0x00ffffff	1	subarchitecture=%d
21074>>>4		belong&0x00ffffff	2	subarchitecture=%d
21075>>>4		belong&0x00ffffff	3
21076>>>4		belong&0x00ffffff	4	\b_arch1
21077>>>4		belong&0x00ffffff	8	\b_haswell
21078>>>4		belong&0x00ffffff	>4	subarchitecture=%d
21079>>0	belong&0x00ffffff	8	64-bit architecture=%d
21080>>0	belong&0x00ffffff	9	64-bit architecture=%d
21081>>0	belong&0x00ffffff	10	64-bit architecture=%d
21082>>0	belong&0x00ffffff	11	64-bit architecture=%d
21083>>0	belong&0x00ffffff	12	arm64
21084>>>4		belong&0x00ffffff	0
21085>>>4		belong&0x00ffffff	1	\bv8
21086>>>4		belong&0x00ffffff	2	\be
21087>>>>7		ubyte&0xff		>0	(caps:
21088>>>>7		ubyte&0xff		<0x80	0x%02x
21089>>>>7		ubyte&0xc0		0x80	PAC
21090>>>>>7		ubyte&0x3f		x	\b%02d
21091>>>>7		ubyte&0xc0		0xc0	PAK
21092>>>>>7		ubyte&0x3f		x	\b%02d
21093>>>>7		ubyte&0xff		x	\b)
21094>>>4		belong&0x00ffffff	>2	subarchitecture=%d
21095>>0	belong&0x00ffffff	13	64-bit architecture=%d
21096>>0	belong&0x00ffffff	14	64-bit architecture=%d
21097>>0	belong&0x00ffffff	15	64-bit architecture=%d
21098>>0	belong&0x00ffffff	16	64-bit architecture=%d
21099>>0	belong&0x00ffffff	17	64-bit architecture=%d
21100>>0	belong&0x00ffffff	18	ppc64
21101>>>4		belong&0x00ffffff	0
21102>>>4		belong&0x00ffffff	1		\b_601
21103>>>4		belong&0x00ffffff	2		\b_602
21104>>>4		belong&0x00ffffff	3		\b_603
21105>>>4		belong&0x00ffffff	4		\b_603e
21106>>>4		belong&0x00ffffff	5		\b_603ev
21107>>>4		belong&0x00ffffff	6		\b_604
21108>>>4		belong&0x00ffffff	7		\b_604e
21109>>>4		belong&0x00ffffff	8		\b_620
21110>>>4		belong&0x00ffffff	9		\b_650
21111>>>4		belong&0x00ffffff	10		\b_7400
21112>>>4		belong&0x00ffffff	11		\b_7450
21113>>>4		belong&0x00ffffff	100		\b_970
21114>>>4		belong&0x00ffffff	>100		subarchitecture=%d
21115>>0	belong&0x00ffffff	>18	64-bit architecture=%d
21116>0	belong&0xff000000	0x02000000
21117#
21118# 64_32-bit ABIs.
21119#
21120>>0	belong&0x00ffffff	0	64_32-bit architecture=%d
21121>>0	belong&0x00ffffff	1	64_32-bit architecture=%d
21122>>0	belong&0x00ffffff	2	64_32-bit architecture=%d
21123>>0	belong&0x00ffffff	3	64_32-bit architecture=%d
21124>>0	belong&0x00ffffff	4	64_32-bit architecture=%d
21125>>0	belong&0x00ffffff	5	64_32-bit architecture=%d
21126>>0	belong&0x00ffffff	6	64_32-bit architecture=%d
21127>>0	belong&0x00ffffff	7	64_32-bit architecture=%d
21128>>0	belong&0x00ffffff	8	64_32-bit architecture=%d
21129>>0	belong&0x00ffffff	9	64_32-bit architecture=%d
21130>>0	belong&0x00ffffff	10	64_32-bit architecture=%d
21131>>0	belong&0x00ffffff	11	64_32-bit architecture=%d
21132>>0	belong&0x00ffffff	12	64_32-bit arm
21133>>>4		belong&0x00ffffff	0
21134>>>4		belong&0x00ffffff	1	\bv8
21135>>>4		belong&0x00ffffff	>1	subarchitecture=%d
21136>>0	belong&0x00ffffff	13	64_32-bit architecture=%d
21137>>0	belong&0x00ffffff	14	64_32-bit architecture=%d
21138>>0	belong&0x00ffffff	15	64_32-bit architecture=%d
21139>>0	belong&0x00ffffff	16	64_32-bit architecture=%d
21140>>0	belong&0x00ffffff	17	64_32-bit architecture=%d
21141>>0	belong&0x00ffffff	18	64_32-bit architecture=%d
21142>>0	belong&0x00ffffff	>18	64_32-bit architecture=%d
21143
211440	name		mach-o-be
21145>0	byte		0xcf		64-bit
21146>4	use		mach-o-cpu
21147>12	belong		1		object
21148# GRR: Does not work for Mach-O with 2 architectures; instead display oo
21149#!:ext	o
21150!:ext	o/
21151>12	belong		2		executable
21152# the executables normally have no file extension like perl,
21153# but exceptions like perl5.18 perl5.16
21154!:ext	16/18/
21155>12	belong		3		fixed virtual memory shared library
21156>12	belong		4		core
21157>12	belong		5		preload executable
21158>12	belong		6		dynamically linked shared library
21159# GRR: Does not work for Mach-O with 2 architectures; instead display dylibdylib
21160#!:ext	dylib
21161!:ext	dylib/
21162>12	belong		7		dynamic linker
21163>12	belong		8		bundle
21164# normally name extension bundle; but exceptions like: AMDil_r700.dylib
21165!:ext	bundle/dylib/
21166>12	belong		9		dynamically linked shared library stub
21167>12	belong		10		dSYM companion file
21168>12	belong		11		kext bundle
21169>12	belong		>11
21170>>12	belong		x		filetype=%d
21171>24	belong		>0		\b, flags:<
21172>>24	belong		&0x00000001	\bNOUNDEFS
21173>>24	belong		&0x00000002	\b|INCRLINK
21174>>24	belong		&0x00000004	\b|DYLDLINK
21175>>24	belong		&0x00000008	\b|BINDATLOAD
21176>>24	belong		&0x00000010	\b|PREBOUND
21177>>24	belong		&0x00000020	\b|SPLIT_SEGS
21178>>24	belong		&0x00000040	\b|LAZY_INIT
21179>>24	belong		&0x00000080	\b|TWOLEVEL
21180>>24	belong		&0x00000100	\b|FORCE_FLAT
21181>>24	belong		&0x00000200	\b|NOMULTIDEFS
21182>>24	belong		&0x00000400	\b|NOFIXPREBINDING
21183>>24	belong		&0x00000800	\b|PREBINDABLE
21184>>24	belong		&0x00001000	\b|ALLMODSBOUND
21185>>24	belong		&0x00002000	\b|SUBSECTIONS_VIA_SYMBOLS
21186>>24	belong		&0x00004000	\b|CANONICAL
21187>>24	belong		&0x00008000	\b|WEAK_DEFINES
21188>>24	belong		&0x00010000	\b|BINDS_TO_WEAK
21189>>24	belong		&0x00020000	\b|ALLOW_STACK_EXECUTION
21190>>24	belong		&0x00040000	\b|ROOT_SAFE
21191>>24	belong		&0x00080000	\b|SETUID_SAFE
21192>>24	belong		&0x00100000	\b|NO_REEXPORTED_DYLIBS
21193>>24	belong		&0x00200000	\b|PIE
21194>>24	belong		&0x00400000	\b|DEAD_STRIPPABLE_DYLIB
21195>>24	belong		&0x00800000	\b|HAS_TLV_DESCRIPTORS
21196>>24	belong		&0x01000000	\b|NO_HEAP_EXECUTION
21197>>24	belong		&0x02000000	\b|APP_EXTENSION_SAFE
21198>>24	belong		&0x04000000	\b|NLIST_OUTOFSYNC_WITH_DYLDINFO
21199>>24	belong		&0x08000000	\b|SIM_SUPPORT
21200>>24	belong		&0x80000000	\b|DYLIB_IN_CACHE
21201>>24	belong		x		\b>
21202
21203#
212040	lelong&0xfffffffe	0xfeedface	Mach-O
21205!:strength +1
21206!:mime application/x-mach-binary
21207>0	use	\^mach-o-be
21208
212090	belong&0xfffffffe	0xfeedface	Mach-O
21210!:strength +1
21211!:mime application/x-mach-binary
21212>0	use	mach-o-be
21213
21214#------------------------------------------------------------------------------
21215# $File: macintosh,v 1.31 2020/12/12 20:01:47 christos Exp $
21216# macintosh description
21217#
21218# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
21219# Daniel Quinlan, quinlan@yggdrasil.com
21220# Update:	Joerg Jenderek
21221# URL:		https://en.wikipedia.org/wiki/BinHex
21222# Reference:	http://fileformats.archiveteam.org/wiki/BinHex
21223# Note:		only tested with version 4.0 and hqx extension
21224# Any text/binary before the characteristic comment sentence is to be ignored like in
21225# http://ftp.vim.org/pub/ftp/ftp/infomac/disk/mac-update-40b7.hqx
212260	search/1602	(This\ file\
21227>&0	use		binhex
21228# http://ftp.vim.org/pub/ftp/ftp/infomac/_Disk_&_File/zap-res-forks-101.hqx
212290	search/2652/b	(This\ file\
21230>&0	use		binhex
212310	name				binhex
21232# keep split search string format similar like in version 5.37
21233>0	string	must\ be\ converted\ with\ BinHex\ 	BinHex binary text, version
21234# http://www.macdisk.com/binhexen.php3
21235!:apple	BNHQTEXT
21236# http://www.faqs.org/faqs/macintosh/comm-faq/part1/
21237>>&0	string	1.0					1.0
21238!:mime	application/mac-binhex
21239!:ext	hex
21240>>&0	string	2.0					2.0
21241!:mime	application/mac-binhex
21242!:ext	hcx
21243# BinHex	3.0 never existed
21244>>&0	string	4.0					4.0
21245!:mime	application/mac-binhex40
21246!:ext	hqx
21247# BinHex	5.0 also MacBinary I
21248>>&0	string	5.0					5.0
21249!:mime	application/mac-binhex40
21250!:ext	hqx
21251# this should never happen
21252>>&0	default	x
21253>>>&0	string	x					%.3s
21254!:mime	application/mac-binhex
21255!:ext	hqx
21256
21257# Stuffit archives are the de facto standard of compression for Macintosh
21258# files obtained from most archives. (franklsm@tuns.ca)
212590	string		SIT!			StuffIt Archive (data)
21260!:mime	application/x-stuffit
21261!:apple	SIT!SIT!
21262>2	string		x			: %s
212630	string		SITD			StuffIt Deluxe (data)
21264>2	string		x			: %s
212650	string		Seg			StuffIt Deluxe Segment (data)
21266>2	string		x			: %s
21267
21268# Newer StuffIt archives (grant@netbsd.org)
212690	string		StuffIt			StuffIt Archive
21270!:mime	application/x-stuffit
21271!:apple	SIT!SIT!
21272#>162	string		>0			: %s
21273
21274# Macintosh Applications and Installation binaries (franklsm@tuns.ca)
21275# GRR: Too weak
21276#0	string		APPL			Macintosh Application (data)
21277#>2	string		x			\b: %s
21278
21279# Macintosh System files (franklsm@tuns.ca)
21280# GRR: Too weak
21281#0	string		zsys			Macintosh System File (data)
21282#0	string		FNDR			Macintosh Finder (data)
21283#0	string		libr			Macintosh Library (data)
21284#>2	string		x			: %s
21285#0	string		shlb			Macintosh Shared Library (data)
21286#>2	string		x			: %s
21287#0	string		cdev			Macintosh Control Panel (data)
21288#>2	string		x			: %s
21289#0	string		INIT			Macintosh Extension (data)
21290#>2	string		x			: %s
21291#0	string		FFIL			Macintosh Truetype Font (data)
21292#>2	string		x			: %s
21293#0	string		LWFN			Macintosh Postscript Font (data)
21294#>2	string		x			: %s
21295
21296# Additional Macintosh Files (franklsm@tuns.ca)
21297# GRR: Too weak
21298#0	string		PACT			Macintosh Compact Pro Archive (data)
21299#>2	string		x			: %s
21300#0	string		ttro			Macintosh TeachText File (data)
21301#>2	string		x			: %s
21302#0	string		TEXT			Macintosh TeachText File (data)
21303#>2	string		x			: %s
21304#0	string		PDF			Macintosh PDF File (data)
21305#>2	string		x			: %s
21306
21307# MacBinary format (Eric Fischer, enf@pobox.com)
21308# Update: Joerg Jenderek
21309# URL: https://en.wikipedia.org/wiki/MacBinary
21310# Reference: https://files.stairways.com/other/macbinaryii-standard-info.txt
21311#
21312# Unfortunately MacBinary doesn't really have a magic number prior
21313# to the MacBinary III format.
21314#
21315
21316# old version number, must be kept at zero for compatibility
213170	byte	0
21318# length of filename (must be in the range 1-63)
21319>1	ubyte	>0
21320# skip T.PIC.LZ INSTRUMENT.7T INVENTORY
21321>>1	ubyte	<64
21322# skip Docs.MWII ReadMe.MacWrite "Notes (MacWrite II)"
21323# by looking for printable characters at beginning of file name
21324>>>2	ubelong	>0x1F000000
21325# zero fill, must be zero for compatibility
21326>>>>74	byte	0
21327# zero fill, must be zero for compatibility
21328>>>>>82	byte	0
21329# MacBinary I		test for valid version numbers
21330>>>>>>122	ubeshort	0
21331# additional check for creation date after 1 Jan 1970 ~ 7C25B080h
21332#>>>>>>>91	ubelong		>0x7c25b07F
21333# additional check for undefined header fields in MacBinary I
21334#>>>>>>>101	ulong		0
21335>>>>>>>0	use	mac-bin
21336# MacBinary II		the newer versions begins at 129
21337>>>>>>122	ubeshort	0x8181
21338>>>>>>>0	use	mac-bin
21339# MacBinary III with MacBinary II to read
21340>>>>>122	ubeshort	0x8281
21341>>>>>>0	use	mac-bin
21342
21343#	display information of MacBinary file
213440	name		mac-bin
21345>122	ubyte	x	MacBinary
21346# versions for MacBinary II/III
21347>122	ubyte	129		II
21348>122	ubyte	130		III
21349# only in MacBinary III
21350>>102	string	!mBIN		with surprising version
21351!:mime	application/x-macbinary
21352!:apple	PSPTBINA
21353!:ext	bin/macbin
21354# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified as MacBinary
21355#>1	ubyte	>63		\b, name length %u too BIG!
21356#>122	ubeshort	x	\b, version 0x%x
21357# Finder flags if not 0
21358# >73	byte		!0		\b, flags 0x
21359# >73	byte		=0
21360# >>101	byte		!0		\b, flags 0x
21361# # original Finder flags (Bits 8-15)
21362# >73	byte		!0		\b%x
21363# # finder flags, bits 0-7
21364# >101	byte		!0		\b%x
21365>73	byte		&0x01		\b, inited
21366>73	byte		&0x02		\b, changed
21367>73	byte		&0x04		\b, busy
21368>73	byte		&0x08		\b, bozo
21369>73	byte		&0x10		\b, system
21370>73	byte		&0x20		\b, bundle
21371>73	byte		&0x40		\b, invisible
21372>73	byte		&0x80		\b, locked
21373
21374# 75	beshort				# vertical posn in window
21375#>75	beshort		!0		\b, v.pos %u
21376# 77	beshort				# horiz posn in window
21377#>77	beshort		!0		\b, h.pos %u
21378# 79	beshort				# window or folder ID
21379>79	ubeshort	!0		\b, ID 0x%x
21380# protected flag
21381>81	byte		!0		\b, protected 0x%x
21382# length of comment after resource
21383>99	ubeshort	!0		\b, comment length %u
21384# char. code of file name
21385>106	ubyte		!0		\b, char. code 0x%x
21386# still more Finder flags
21387>107	ubyte		!0		\b, more flags 0x%x
21388# length of total files when unpacked only used when pack and unpack on the fly
21389>116	ubelong		!0		\b, total length %u
21390# 120	beshort				# length of add'l header
21391>120	ubeshort	!0		\b, 2nd header length %u
21392# 124	beshort				# checksum
21393#>124	ubeshort	!0		\b, CRC 0x%x
21394# creation date in seconds since MacOS epoch start. So 1 Jan 1970 ~ 7C25B080
21395>91	beldate-0x7C25B080	x	\b, %s
21396# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified or time overflow
21397>91	ubelong		<0x7c25b080	INVALID date
21398#>91	belong-0x7C25B080	x	\b, DEBUG DATE %d
21399# last modified date
21400>95	beldate-0x7C25B080	x	\b, modified %s
21401# Apple creator+typ if not null
21402# file creator (normally expressed as four characters)
21403>69	ulong			!0	\b, creator
21404# instead 4 character code display full creator name
21405>>69	use			apple-creator
21406# file type (normally expressed as four characters)
21407>65	ulong			!0	\b, type
21408>>65	use			apple-type
21409# length of data segment
21410>83	ubelong			!0	\b, %u bytes
21411# filename (in the range 1-63)
21412>1	pstring			x	"%s"
21413# print 1 space and then at offset 128 inspect data fork content if it has one
21414>83	ubelong			!0	\b
21415>>128	indirect		x
21416# Afterwards resource fork if length of resource segment not zero
21417>87	ubelong			!0
21418# calculate resource fork offset
21419>>83	ubelong+128		x	\b, at 0x%x
21420# length of resource segment
21421>>87	ubelong			!0	%u bytes
21422>>(83.S+128)	ubequad		x	resource
21423# further resource fork content inspection
21424>>>&-8	indirect		x
21425
21426# Apple Type/Creator Database
21427# URL: https://en.wikipedia.org/wiki/Type_code
21428# Reference:	https://www.lacikam.co.il/tcdb/
21429#		https://www.macdisk.com/macsigen.php
21430# Note:	classic Mac OS files have two 4 character codes for type and creator.
21431#	Thereby the Finder attach documents types to applications.
21432
21433#>65	string		x		\b, type "%4.4s"
21434
21435#	display information about apple type
214360	name		apple-type
21437>0	string		8BIM		PhotoShop
21438>0	string		ALB3		PageMaker 3
21439>0	string		ALB4		PageMaker 4
21440>0	string		ALT3		PageMaker 3
21441>0	string		APPL		application
21442>0	string		AWWP		AppleWorks word processor
21443>0	string		CIRC		simulated circuit
21444>0	string		DRWG		MacDraw
21445>0	string		EPSF		Encapsulated PostScript
21446>0	string		FFIL		font suitcase
21447>0	string		FKEY		function key
21448>0	string		FNDR		Macintosh Finder
21449>0	string		GIFf		GIF image
21450>0	string		Gzip		GNU gzip
21451>0	string		INIT		system extension
21452>0	string		LIB\ 		library
21453>0	string		LWFN		PostScript font
21454>0	string		MSBC		Microsoft BASIC
21455>0	string		PACT		Compact Pro archive
21456>0	string		PDF\ 		Portable Document Format
21457>0	string		PICT		picture
21458>0	string		PNTG		MacPaint picture
21459>0	string		PREF		preferences
21460>0	string		PROJ		Think C project
21461>0	string		QPRJ		Think Pascal project
21462>0	string		SCFL		Defender scores
21463>0	string		SCRN		startup screen
21464>0	string		SITD		StuffIt Deluxe
21465>0	string		SPn3		SuperPaint
21466>0	string		STAK		HyperCard stack
21467>0	string		Seg\ 		StuffIt segment
21468>0	string		TARF		Unix tar archive
21469>0	string		TEXT		ASCII
21470>0	string		TIFF		TIFF image
21471>0	string		TOVF		Eudora table of contents
21472>0	string		WDBN		Microsoft Word word processor
21473>0	string		WORD		MacWrite word processor
21474>0	string		XLS\ 		Microsoft Excel
21475>0	string		ZIVM		compress (.Z)
21476>0	string		ZSYS		Pre-System 7 system file
21477>0	string		acf3		Aldus FreeHand
21478>0	string		cdev		control panel
21479>0	string		dfil		Desk Accessory suitcase
21480>0	string		libr		library
21481>0	string		nX^d		WriteNow word processor
21482>0	string		nX^w		WriteNow dictionary
21483>0	string		rsrc		resource
21484>0	string		scbk		Scrapbook
21485>0	string		shlb		shared library
21486>0	string		ttro		SimpleText read-only
21487>0	string		zsys		system file
21488
21489#	additional types added in Dec 2017
21490>0	string		BINA		binary file
21491>0	string		BMPp		BMP image
21492>0	string		JPEG		JPEG image
21493#>0	string		W4BN		Microsoft Word x.y word processor?
21494# if type name is not known display 4 character identifier
21495>0	default		x
21496>>0	string		x		'%4.4s'
21497
21498#>69	string		x		\b, creator "%4.4s"
21499
21500# Now Apple has no repository of registered Creator IDs any more. These are
21501# just the ones that I happened to have files from and was able to identify.
21502
21503#	display information about apple creator
215040	name		apple-creator
21505>0	string		8BIM		Adobe Photoshop
21506>0	string		ALD3		PageMaker 3
21507>0	string		ALD4		PageMaker 4
21508>0	string		ALFA		Alpha editor
21509>0	string		APLS		Apple Scanner
21510>0	string		APSC		Apple Scanner
21511>0	string		BRKL		Brickles
21512>0	string		BTFT		BitFont
21513>0	string		CCL2		Common Lisp 2
21514>0	string		CCL\ 		Common Lisp
21515>0	string		CDmo		The Talking Moose
21516>0	string		CPCT		Compact Pro
21517>0	string		CSOm		Eudora
21518>0	string		DMOV		Font/DA Mover
21519>0	string		DSIM		DigSim
21520>0	string		EDIT		Macintosh Edit
21521>0	string		ERIK		Macintosh Finder
21522>0	string		EXTR		self-extracting archive
21523>0	string		Gzip		GNU gzip
21524>0	string		KAHL		Think C
21525>0	string		LWFU		LaserWriter Utility
21526>0	string		LZIV		compress
21527>0	string		MACA		MacWrite
21528>0	string		MACS		Macintosh operating system
21529>0	string		MAcK		MacKnowledge terminal emulator
21530>0	string		MLND		Defender
21531>0	string		MPNT		MacPaint
21532>0	string		MSBB		Microsoft BASIC (binary)
21533>0	string		MSWD		Microsoft Word
21534>0	string		NCSA		NCSA Telnet
21535>0	string		PJMM		Think Pascal
21536>0	string		PSAL		Hunt the Wumpus
21537#>0	string		PSI2		Apple File Exchange
21538>0	string		R*ch		BBEdit
21539>0	string		RMKR		Resource Maker
21540>0	string		RSED		Resource Editor
21541>0	string		Rich		BBEdit
21542>0	string		SIT!		StuffIt
21543>0	string		SPNT		SuperPaint
21544>0	string		Unix		NeXT Mac filesystem
21545>0	string		VIM!		Vim editor
21546>0	string		WILD		HyperCard
21547>0	string		XCEL		Microsoft Excel
21548>0	string		aCa2		Fontographer
21549>0	string		aca3		Aldus FreeHand
21550>0	string		dosa		Macintosh MS-DOS file system
21551>0	string		movr		Font/DA Mover
21552>0	string		nX^n		WriteNow
21553>0	string		pdos		Apple ProDOS file system
21554>0	string		scbk		Scrapbook
21555>0	string		ttxt		SimpleText
21556>0	string		ufox		Foreign File Access
21557#	additional creators added in Dec 2017
21558# Claris/Apple Works
21559>0	string		BOBO		Apple Works
21560# CU-SeeMe_0.87b3_(68K).bin
21561#>0	string		CUce		bar
21562>0	string		PSPT		Apple File Exchange
21563# Disk_Copy_4.2.sea.bin
21564#>0	string		NCse		foo
21565# probably StuffIt/Aladdin by Smith Micro Software, Inc.
21566>0	string		STi0		stuffit
21567# MacGzip-1.1.3.sea.bin
21568#>0	string		aust		bar
21569# D-Disk_Copy_6.3.3.smi.bin
21570>0	string		oneb		Disk Copy Self Mounting
21571# if creator name is not known display 4 character identifier
21572>0	default		x
21573>>0	string		x		'%4.4s'
21574
21575# sas magic from Bruce Foster (bef@nwu.edu)
21576#
21577#0	string		SAS		SAS
21578#>8	string		x		%s
215790	string		SAS		SAS
21580>24	string		DATA		data file
21581>24	string		CATALOG		catalog
21582>24	string		INDEX		data file index
21583>24	string		VIEW		data view
21584# sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com)
21585#
215860x54    string          SAS             SAS 7+
21587>0x9C   string          DATA            data file
21588>0x9C   string          CATALOG         catalog
21589>0x9C   string          INDEX           data file index
21590>0x9C   string          VIEW            data view
21591
21592# spss magic for SPSS system and portable files,
21593#	 from Bruce Foster (bef@nwu.edu).
21594
215950	long		0xc1e2c3c9	SPSS Portable File
21596>40	string 		x		%s
21597
215980	string		$FL2		SPSS System File
21599>24	string		x		%s
21600
216010	string		$FL3		SPSS System File
21602>24	string		x		%s
21603
21604# Macintosh filesystem data
21605# From "Tom N Harris" <telliamed@mac.com>
21606# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net>
21607# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these
21608# entries depend on the data arithmetic added after v.35
21609# There's also some Pascal strings in here, ditto...
21610
21611# The boot block signature, according to IM:Files, is
21612# "for HFS volumes, this field always contains the value 0x4C4B."
21613# But if this is true for MFS or HFS+ volumes, I don't know.
21614# Alternatively, the boot block is supposed to be zeroed if it's
21615# unused, so a simply >0 should suffice.
21616
216170x400	beshort			0xD2D7		Macintosh MFS data
21618>0	beshort			0x4C4B		(bootable)
21619>0x40a	beshort			&0x8000		(locked)
21620>0x402	beldate-0x7C25B080	x		created: %s,
21621>0x406	beldate-0x7C25B080	>0		last backup: %s,
21622>0x414	belong			x		block size: %d,
21623>0x412	beshort			x		number of blocks: %d,
21624>0x424	pstring			x		volume name: %s
21625
21626# *.hfs updated by Joerg Jenderek
21627# https://en.wikipedia.org/wiki/Hierarchical_File_System
21628# "BD" gives many false positives
216290x400	beshort			0x4244
21630# ftp://ftp.mars.org/pub/hfs/hfsutils-3.2.6.tar.gz/hfsutils-3.2.6/libhfs/apple.h
21631# first block of volume bit map (always 3)
21632>0x40e	ubeshort		0x0003
21633# maximal length of volume name is 27
21634>>0x424		ubyte			<28	Macintosh HFS data
21635!:mime	application/x-apple-diskimage
21636#!:apple	hfsdINIT
21637#!:apple	MACSdisk
21638# https://www.macdisk.com/macsigen.php
21639#!:apple	ddskdevi
21640!:apple	????devi
21641# https://en.wikipedia.org/wiki/Apple_Disk_Image
21642!:ext hfs/dmg
21643>>>0		beshort			0x4C4B	(bootable)
21644#>>>0		beshort			0x0000	(not bootable)
21645>>>0x40a	beshort			&0x8000	(locked)
21646>>>0x40a	beshort			^0x0100	(mounted)
21647>>>0x40a	beshort			&0x0200	(spared blocks)
21648>>>0x40a	beshort			&0x0800	(unclean)
21649>>>0x47C	beshort			0x482B	(Embedded HFS+ Volume)
21650# https://www.epochconverter.com/
21651# 0x7C245F00 seconds	~ 2082758400	~ 01 Jan 2036 00:00:00	~ 66 years to 1970
21652# 0x7C25B080 seconds	~ 2082844800	~ 02 Jan 2036 00:00:00
21653# construct not working
21654#>>>0x402	beldate-0x7C25B080	x	created: %s,
21655#>>>0x406	beldate-0x7C25B080	x	last modified: %s,
21656#>>>0x440	beldate-0x7C25B080	>0	last backup: %s,
21657# found block sizes 200h,1200h,2800h
21658>>>0x414	belong			x	block size: %d,
21659>>>0x412	beshort			x	number of blocks: %d,
21660>>>0x424	pstring			x	volume name: %s
21661
216620x400	beshort			0x482B		Macintosh HFS Extended
21663>&0	beshort			x		version %d data
21664>0	beshort			0x4C4B		(bootable)
21665>0x404	belong			^0x00000100	(mounted)
21666>&2	belong			&0x00000200	(spared blocks)
21667>&2	belong			&0x00000800	(unclean)
21668>&2	belong			&0x00008000	(locked)
21669>&6	string			x		last mounted by: '%.4s',
21670# really, that should be treated as a belong and we print a string
21671# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1"
21672>&14	beldate-0x7C25B080	x		created: %s,
21673# only the creation date is local time, all other timestamps in HFS+ are UTC.
21674>&18	bedate-0x7C25B080	x		last modified: %s,
21675>&22	bedate-0x7C25B080	>0		last backup: %s,
21676>&26	bedate-0x7C25B080	>0		last checked: %s,
21677>&38	belong			x		block size: %d,
21678>&42	belong			x		number of blocks: %d,
21679>&46	belong			x		free blocks: %d
21680
21681## AFAIK, only the signature is different
21682# same as Apple Partition Map
21683# GRR: This magic is too weak, it is just "TS"
21684#0x200		beshort		0x5453		Apple Old Partition data
21685#>0x2		beshort		x		block size: %d,
21686#>0x230		string		x		first type: %s,
21687#>0x210		string		x		name: %s,
21688#>0x254		belong		x		number of blocks: %d,
21689#>0x400		beshort		0x504D
21690#>>0x430		string		x		second type: %s,
21691#>>0x410		string		x		name: %s,
21692#>>0x454		belong		x		number of blocks: %d,
21693#>>0x800		beshort		0x504D
21694#>>>0x830	string		x		third type: %s,
21695#>>>0x810	string		x		name: %s,
21696#>>>0x854	belong		x		number of blocks: %d,
21697#>>>0xa00	beshort		0x504D
21698#>>>>0xa30	string		x		fourth type: %s,
21699#>>>>0xa10	string		x		name: %s,
21700#>>>>0xa54	belong		x		number of blocks: %d
21701
21702# From: Remi Mommsen <mommsen@slac.stanford.edu>
217030		string		BOMStore	Mac OS X bill of materials (BOM) file
21704
21705# From: Adam Buchbinder <adam.buchbinder@gmail.com>
21706# URL: https://en.wikipedia.org/wiki/Datafork_TrueType
21707# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is
21708# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I
21709# don't know what they mean.
217100	belong	0x100
21711>(0x4.L+24)	beshort	x
21712>>&4	belong	0x73666e74	Mac OSX datafork font, TrueType
21713>>&4	belong	0x464f4e54	Mac OSX datafork font, 'FONT'
21714>>&4	belong	0x4e464e54	Mac OSX datafork font, 'NFNT'
21715>>&4	belong	0x504f5354	Mac OSX datafork font, PostScript
21716
21717#------------------------------------------------------------------------------
21718# $File: macos,v 1.1 2012/12/21 16:41:07 christos Exp $
21719# MacOS files
21720#
21721
217220	string		book\0\0\0\0mark\0\0\0\0	MacOS Alias file
21723
21724#------------------------------------------------------------------------------
21725# $File: magic,v 1.10 2010/11/25 15:00:12 christos Exp $
21726# magic:  file(1) magic for magic files
21727#
217280	string/t		#\ Magic	magic text file for file(1) cmd
217290	lelong		0xF11E041C	magic binary file for file(1) cmd
21730>4	lelong		x		(version %d) (little endian)
217310	belong		0xF11E041C	magic binary file for file(1) cmd
21732>4	belong		x		(version %d) (big endian)
21733#------------------------------------------------------------------------------
21734# $File: mail.news,v 1.27 2021/04/05 16:36:14 christos Exp $
21735# mail.news:  file(1) magic for mail and news
21736#
21737# Unfortunately, saved netnews also has From line added in some news software.
21738#0	string		From 		mail text
217390	string/t		Relay-Version: 	old news text
21740!:mime	message/rfc822
217410	string/t		#!\ rnews	batched news text
21742!:mime	message/rfc822
217430	string/t		N#!\ rnews	mailed, batched news text
21744!:mime	message/rfc822
217450	string/t		Forward\ to 	mail forwarding text
21746!:mime	message/rfc822
217470	string/t		Pipe\ to 	mail piping text
21748!:mime	message/rfc822
217490	string/tc		delivered-to:	SMTP mail text
21750!:mime	message/rfc822
217510	string/tc		return-path:	SMTP mail text
21752!:mime	message/rfc822
217530	string/t		Path:		news text
21754!:mime	message/news
217550	string/t		Xref:		news text
21756!:mime	message/news
217570	string/t		From:		news or mail text
21758!:mime	message/rfc822
217590	string/t		Article 	saved news text
21760!:mime	message/news
21761# Reference:	http://quimby.gnus.org/notes/BABYL
21762# Update:	Joerg Jenderek
21763# Note:		used by Rmail in Emacs version 22 and before
21764#		is not text because of characters like Control-L Control-_
217650	string/b		BABYL\ OPTIONS:	Emacs RMAIL
21766#0	string/t		BABYL		Emacs RMAIL text
21767# https://reposcope.com/mimetype/message/x-gnu-rmail
21768!:mime	message/x-gnu-rmail
21769# ~/RMAIL
21770!:ext	/
217710	string/t		Received:	RFC 822 mail text
21772!:mime	message/rfc822
217730	string/t		MIME-Version:	MIME entity text
21774#0	string/t		Content-	MIME entity text
21775
21776# TNEF files...
217770	lelong		0x223E9F78	Transport Neutral Encapsulation Format
21778!:mime	application/vnd.ms-tnef
21779
21780# From: Kevin Sullivan <ksulliva@psc.edu>
217810	string		*mbx*		MBX mail folder
21782
21783# From: Simon Matter <simon.matter@invoca.ch>
217840	string		\241\002\213\015skiplist\ file\0\0\0	Cyrus skiplist DB
217850	string		\241\002\213\015twoskip\ file\0\0\0\0	Cyrus twoskip DB
21786
21787# JAM(mbp) Fidonet message area databases
21788# JHR file
217890	string	JAM\0			JAM message area header file
21790>12	leshort >0			(%d messages)
21791
21792# Squish Fidonet message area databases
21793# SQD file (requires at least one message in the area)
21794# XXX: Weak magic
21795#256	leshort	0xAFAE4453		Squish message area data file
21796#>4	leshort	>0			(%d messages)
21797
21798#0	string		\<!--\ MHonArc		text/html; x-type=mhonarc
21799
21800# Cyrus: file(1) magic for compiled Cyrus sieve scripts
21801# URL: https://www.cyrusimap.org/docs/cyrus-imapd/2.4.6/internal/bytecode.php
21802# URL: http://git.cyrusimap.org/cyrus-imapd/tree/sieve/bytecode.h?h=master
21803# From: Philipp Hahn <hahn@univention.de>
21804
21805# Compiled Cyrus sieve script
218060       string CyrSBytecode     Cyrus sieve bytecode data,
21807>12     belong =1       version 1, big-endian
21808>12     lelong =1       version 1, little-endian
21809>12     belong x        version %d, network-endian
21810
21811# Dovecot mail server, version 2.2 and later.
21812# Dovecot mailing list: dovecot@dovecot.org
21813# File format spec: https://wiki.dovecot.org/Design/Dcrypt/#File_format
21814# From: Stephen Gildea
218150	string	CRYPTED\003\007		Dovecot encrypted message
21816>9	byte	x			\b, dcrypt version %d
21817#------------------------------------------------------------------------------
21818# $File: make,v 1.4 2018/05/29 17:26:02 christos Exp $
21819# make:  file(1) magic for makefiles
21820#
21821# URL: https://en.wikipedia.org/wiki/Make_(software)
218220	regex/100l	\^CFLAGS	makefile script text
21823!:mime	text/x-makefile
218240	regex/100l	\^VPATH		makefile script text
21825!:mime	text/x-makefile
218260	regex/100l	\^LDFLAGS	makefile script text
21827!:mime	text/x-makefile
218280	regex/100l	\^all:		makefile script text
21829!:mime	text/x-makefile
218300	regex/100l	\^\\.PRECIOUS	makefile script text
21831!:mime	text/x-makefile
21832# Update: Joerg Jenderek
21833# Reference: https://www.freebsd.org/cgi/man.cgi?make(1)
21834# exclude grub-core\lib\libgcrypt\mpi\Makefile.am with "#BEGIN_ASM_LIST"
21835# by additional escaping point character
218360	regex/100l	\^\\.BEGIN	BSD makefile script text
21837!:mime	text/x-makefile
21838!:ext	/mk
21839!:strength +10
21840# exclude MS Windows help file CoNtenT with ":include FOOBAR.CNT"
21841# and NSIS script with "!include" by additional escaping point character
218420	regex/100l	\^\\.include	BSD makefile script text
21843!:mime	text/x-makefile
21844!:ext	/mk
21845!:strength +10
218460	regex/100l	\^\\.endif	BSD makefile script text
21847!:mime	text/x-makefile
21848!:ext	/mk
21849!:strength +10
218500	regex/100l	\^SUBDIRS	automake makefile script text
21851!:mime	text/x-makefile
21852!:strength +10
21853
21854
21855#------------------------------------------------------------------------------
21856# $File: map,v 1.8 2019/12/01 22:46:23 christos Exp $
21857# map:  file(1) magic for Map data
21858#
21859
21860# Garmin .FIT files https://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml
218618	string	.FIT		FIT Map data
21862>15	byte	0
21863>>35	belong	x		\b, unit id %d
21864>>39	lelong	x		\b, serial %u
21865# https://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml
21866# 20 years after unix epoch
21867# TZ=GMT date -d '1989-12-31 0:00' +%s
21868>>43	leldate+631065600	x	\b, %s
21869
21870>>47	leshort x		\b, manufacturer %d
21871>>47	leshort	1		\b (garmin)
21872>>49	leshort x		\b, product %d
21873>>53	byte	x		\b, type %d
21874>>53	byte	1		\b (Device)
21875>>53	byte	2		\b (Settings)
21876>>53	byte	3		\b (Sports/Cycling)
21877>>53	byte	4		\b (Activity)
21878>>53	byte	8		\b (Elevations)
21879>>53	byte	10		\b (Totals)
21880
21881# Summary: Garmin map
21882# From:	Joerg Jenderek
21883# URL: https://en.wikipedia.org/wiki/Garmin_.img
21884# Reference: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/IMG_File_Format
21885# sourceforge.net/projects/garmin-img/files/IMG%20File%20Format/1.0/imgformat-1.0.pdf
21886# GRR: similar to MBR boot sector handled by ./filesystems
218870x1FE	leshort		=0xAA55
21888# look for valid map signature
21889>0x13	string		=IMG\0
21890>>0	use		garmin-map
218910	name				garmin-map
21892>0	ubyte		x		Garmin
21893!:mime	application/x-garmin-map
21894# If non-zero, every byte of the entire .img file is to be XORed with this value
21895>0	ubyte		!0		\b, 0x%x XORed
21896# goto block before FAT
21897>(0x40.b*512)	ubyte	x
21898# 1st fat name "DLLINFO TXT" only found for vpm
21899>>&512 		string	=DLLINFO\ TXT 	map (Voice Processing)
21900# there exist 2 other Garmin VPM formats; see ./audio
21901!:ext	vpm
21902# Deutsch__Yannick_D4481-00_0210.vpm
21903#>>>512	search/0x0116da60/s	RIFF	\b; with
21904# determine type voice type by ./riff
21905#>>>>&0	indirect	x	\b
21906>>&512 		string	!DLLINFO\ TXT 	map
21907!:ext	img
21908# 9 zeros
21909>1 	ubelong		!0 		\b, zeroes 0x%x
21910# Map's version major
21911>8	ubyte		x		v%u
21912# Map's version minor
21913>9	ubyte		x		\b.%.2u
21914# Map description[20], 0x20 padded
21915>0x49	string		x		%.20s
21916# Map name, continued (0x20 padded, \0 terminated)
21917>0x65	string		>\ 		\b%.31s
21918# Update year (+1900 for val >= 0x63, +2000 for val <= 0x62)
21919>0xB	ubyte		x		\b, updated
21920>>0xB	ubyte		>0x62
21921>>>0xB	ubyte-100	x		20%.2u
21922>>0xB	ubyte		<0x63
21923>>>0xB	ubyte		x		20%.2u
21924# Update month (0-11)
21925>0xA	ubyte		x		\b-%.2u
21926# All zeroes
21927>0xc 	uleshort	!0 		\b, zeroes 0x%x
21928# Mapsource flag, 1 - file created by Mapsource, 0 - Garmin map visible in Basecamp and Homeport
21929#>0xE	ubyte		!0		\b, Mapsource flag 0x%x
21930>0xE	ubyte		1		\b, Mapsource
21931# Checksum, sum of all bytes modulo 256 should be 0
21932#>0xF	ubyte		x		\b, Checksum 0x%x
21933# Signature: DSKIMG 0x00 or DSDIMG 0x00 for demo map
21934>0x10	string		!DSKIMG		\b, signature "%.7s"
21935>0x39	use		garmin-date
21936# Map file identifier like GARMIN\0
21937>0x41	string		!GARMIN		\b, id "%.7s"
21938# Block size exponent, E1; appears to always be 0x09; minimum block size 512 bytes
21939>0x61	ubyte		!0x09		\b, E1=%u
21940# Block size exponent, E2 ; file blocksize=2**(E1+E2)
21941>>0x62	ubyte		x		\b, E2=%u
21942>0x61	ubyte		=0x09		\b, blocksize
21943>>0x62	ubyte		0		512
21944>>0x62	ubyte		1		1024
21945>>0x62	ubyte		2		2048
21946>>0x62	ubyte		3		4096
21947>>0x62	ubyte		4		8192
21948>>0x62	ubyte		5		16384
21949>>0x62	default		x
21950>>>0x62	ubyte		x		E2=%u
21951# MBR signature
21952>0x1FE	leshort		!0xAA55		\b, invalid MBR
21953# 512 zeros
21954>0x200 	uquad		!0		\b, zeroes 0x%llx
21955# First sub-file offset (absolute); sometimes NO/UNKNOWN sub file!
21956>0x40C	ulelong		>0		\b, at 0x%x
21957# sub-file Header length
21958#>>(0x40C.l)	uleshort	x	\b, header len 0x%x
21959>>(0x40C.l)	uleshort	x	%u bytes
21960# sub-file Type[10] like "GARMIN RGN" "GARMIN TRE", "GARMIN TYP", etc.
21961>>(0x40C.l+2)	ubyte	>0x1F
21962>>>(0x40C.l+2)	ubyte	<0xFF
21963>>>>(0x40C.l+2)	string	x		"%.10s"
21964# 0x00 for most maps, 0x80 for locked maps (City Nav, City Select, etc.)
21965>>>>(0x40C.l+13)	ubyte	>0		\b, locked 0x%x
21966# Block sequence numbers like 0000 0100 0200 ... FFFF
21967# >0x420	ubequad		>0	\b, seq. 0x%16.16llx
21968# >>0x428	ubequad		>0	\b%16.16llx
21969# >>>0x430	ubequad	>0	\b%16.16llx
21970# >>>>0x438	ubequad	>0	\b%16.16llx
21971# >>>>>0x440	ubequad	>0	\b%16.16llx
21972# >>>>>>0x448	ubequad	>0	\b%16.16llx
21973# >>>>>>>0x450	ubequad	>0	\b%16.16llx
21974# >>>>>>>>0x458	ubequad	>0	\b%16.16llx
21975# >>>>>>>>>0x460	ubequad	>0	\b%16.16llx
21976# >>>>>>>>>>0x468	ubequad	>0	\b%16.16llx
21977# >>>>>>>>>>>0x470	ubequad	>0	\b%16.16llx
21978# >>>>>>>>>>>>0x478	ubequad	>0	\b%16.16llx
21979# >>>>>>>>>>>>>0x480	ubequad	>0	\b%16.16llx
21980# >>>>>>>>>>>>>>0x488	ubequad	>0	\b%16.16llx
21981# >>>>>>>>>>>>>>>0x490	ubequad	>0	\b%16.16llx
21982# >>>>>>>>>>>>>>>>0x498	ubequad	>0	\b%16.16llx
21983# >>>>>>>>>>>>>>>>>0x4A0	ubequad	>0	\b%16.16llx
21984# >>>>>>>>>>>>>>>>>>0x4A8	ubequad	>0	\b%16.16llx
21985# look for end of FAT
21986#>>0x420	search/512/s	\xff\xff	FAT END
21987# Physical block number of FAT header
21988#>0x40	ubyte		x		\b, FAT at phy. block %u
21989>0x40	ubyte		x
21990>>(0x40.b*512)	ubyte	x
21991# 1st FAT block
21992>>>&511 	use	garmin-fat
21993# 2nd FAT block
21994>>>&1023 	use	garmin-fat
21995# 3th FAT block
21996>>>&1535 	use	garmin-fat
21997# 4th FAT block
21998>>>&2047 	use	garmin-fat
21999# ... xth FAT block
22000#
22001# 314 zeros but not in vpm and also gmaptz.img
22002>0x84 	uquad		!0		\b, at 0x84 0x%llx
22003# display FileAllocationTable block entry in garmin map
220040	name				garmin-fat
22005>0	ubyte		x		\b;
22006# sub file part; 0x0003 seems to be garbage
22007>0x10	uleshort	!0		next 0x%4.4x
22008>0x10	uleshort	=0
22009# fat flag 0~dummy block 1~true sub file
22010>>0	ubyte		!1		flag %u
22011>>0	ubyte		=1
22012# sub-file name like MAKEGMAP 12345678
22013>>>0x1	string		x		%.8s
22014# sub-file typ like RGN TRE MDR LBL
22015>>>0x9	string		x		\b.%.3s
22016# size of sub file
22017>>>0xC	ulelong		x		\b, %u bytes
22018# 32-bit block sequence numbers
22019#>>>0x20	ubequad		x		\b, seq. 0x%16.16llx
22020
22021#	display date stored inside Garmin maps like yyyy-mm-dd h:mm:ss
220220	name				garmin-date
22023# year like 2018
22024>0 	uleshort	x 		\b, created %u
22025# month (0-11)
22026>2	ubyte		x		\b-%.2u
22027# day (1-31)
22028>3	ubyte		x		\b-%.2u
22029# hour (0-23)
22030>4	ubyte		x		%u
22031# minute (0-59)
22032>5	ubyte		x		\b:%.2u
22033# second (0-59)
22034>6	ubyte		x		\b:%.2u
22035
22036# Summary: Garmin Map subfiles
22037# From:	Joerg Jenderek
22038# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/IMG_File_Format
22039# Garmin Common Header
220402	string	GARMIN\
22041# skip ASCII text by checking for low header length
22042>0	uleshort <0x1000	Garmin map,
22043# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/GMP_Subfile_Format
22044>>9	string	GMP				subtile
22045!:mime			application/x-garmin-gpm
22046!:ext			gmp
22047# copyright message
22048>>>(0.s)		string		x	%s
22049>>>0x0E 		use		garmin-date
22050# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/MDR_Subfile_Format
22051# This contains the searchable address table used for finding routing destinations
22052>>9	string	MDR				address table
22053!:mime			application/x-garmin-mdr
22054!:ext			mdr
22055# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/NOD_Subfile_Format
22056# http://svn.parabola.me.uk/display/trunk/doc/nod.txt
22057# This contains the routing information
22058>>9	string	NOD				routing
22059!:mime			application/x-garmin-nod
22060!:ext			nod
22061>>>0x0E 		use		garmin-date
22062#>>>0x15			ulelong		x	\b, at 0x%x
22063#>>>0x19			ulelong		x	0x%x bytes NOD1
22064#>>>0x25			ulelong		x	\b, at 0x%x
22065#>>>0x29			ulelong		x	0x%x bytes NOD2
22066#>>>0x31			ulelong		x	\b, at 0x%x
22067#>>>0x35			ulelong		x	0x%x bytes NOD3
22068# URL: http://www.pinns.co.uk/osm/net.html
22069# routable highways (length, direction, allowed speed,house address information)
22070>>9	string	NET				highways
22071!:mime			application/x-garmin-net
22072!:ext			net
22073#>>>0x15			ulelong		x	\b, at 0x%x
22074#>>>0x19			ulelong		x	0x%x bytes NET1
22075#>>>0x22			ulelong		>0
22076#>>>>0x1E		ulelong		x	\b, at 0x%x
22077#>>>>0x22		ulelong		x	0x%x bytes NET2
22078#>>>0x2B			ulelong		>0
22079#>>>>0x27		ulelong		x	\b, at 0x%x
22080#>>>>0x2B		ulelong		x	0x%x bytes NET3
22081# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/LBL_Subfile_Format
22082>>9	string	LBL				labels
22083!:mime			application/x-garmin-lbl
22084!:ext			lbl
22085>>>(0.s)		string	x	%s
22086# Label coding type 6h 9h and ah
22087>>>0x1E			ubyte		x	\b, coding type 0x%x
22088#>>>0x15			ulelong		x	\b, at 0x%x
22089#>>>0x19			ulelong		x	0x%x bytes LBL1
22090#>>>0x1F			ulelong		x	\b, at 0x%x
22091#>>>0x23			ulelong		x	0x%x bytes LBL2
22092#>>>0x2D			ulelong		x	\b, at 0x%x
22093#>>>0x31			ulelong		x	0x%x bytes LBL3
22094# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/SRT_Subfile_Format
22095# A lookup table of the chars in the map's codepage, and their collating sequence
22096>>9	string	SRT				sort table
22097!:mime			application/x-garmin-srt
22098!:ext			srt
22099>>>0x0E 		use		garmin-date
22100# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/TRE_Subfile_Format
22101>>9	string	TRE				tree
22102!:mime			application/x-garmin-tre
22103!:ext			tre
22104# title like City Nav Europe NTU 2019.2 Basemap
22105# or OSM Street map
22106>>>(0.s)		string		x	%s
22107# 2nd title like Copyright 1995-2018 by GARMIN Corporation.
22108# or http://www.openstreetmap.org/
22109>>>>&1			string		x	%s
22110>>>0x0E 		use		garmin-date
22111#>>>0x21			ulelong		x	\b, at 0x%x
22112#>>>0x25			ulelong		x	0x%x bytes TRE1
22113#>>>0x29			ulelong		x	\b, at 0x%x
22114#>>>0x2D			ulelong		x	0x%x bytes TRE2
22115#>>>0x31			ulelong		x	\b, at 0x%x
22116#>>>0x35			ulelong		x	0x%x bytes TRE3
22117# Copyright record size
22118#>>>0x39			uleshort	x	\b, copyright record size %u
22119# Map ID
22120>>>0x74			ulelong		x	\b, ID 0x%x
22121# URL: https://www.gpspower.net/garmin-tutorials/353310-basecamp-installing-free-desktop-map.html
22122# For road traffic information service (RDS/TMS/TMC). Commonly seen in City Navigator maps
22123>>9	string	TRF				traffic,
22124!:mime			application/x-garmin-trf
22125!:ext			trf
22126# city/region like Preitenegg
22127>>>(0.s+1) 		string		x	1st %s
22128# highway part like L606/L148
22129>>>>&1			string		x	%s
22130# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/Format
22131# Reference: http://www.pinns.co.uk/osm/typformat.html
22132# customize the appearance of objects. For GPS and MapSource/Qlandkarte better looking maps
22133>>9	string	TYP				types
22134!:mime			application/x-garmin-typ
22135!:ext			typ
22136>>>0x0E 		use		garmin-date
22137# character set 1252 65001~UTF8
22138>>>0x15			uleshort	x	\b, code page %u
22139# POIs
22140#>>>0x17			ulelong		x	\b, at 0x%x
22141#>>>0x1B			ulelong		x	0x%x bytes TYP1
22142# extra pois
22143#>>>0x5B			ulelong		x	\b, at 0x%x
22144#>>>0x5F			ulelong		x	0x%x bytes TYP8
22145# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/RGN_Subfile_Format
22146# http://www.pinns.co.uk/osm/RGN.html
22147# region data used by the Garmin software
22148>>9	string	RGN				region
22149!:mime			application/x-garmin-rgn
22150!:ext			rgn
22151# POIs,Indexed POIs,Polylines or Polygons or first map level
22152#>>>0x15			ulelong	       x	\b, at 0x%x
22153#>>>0x19			ulelong	       x	0x%x bytes RGN1
22154# polygons with extended types
22155#>>>0x21			ulelong	       >0
22156#>>>>0x1D		ulelong	       x	\b, at 0x%x
22157#>>>>0x21		ulelong	       x	0x%x bytes RGN2
22158# polylines with extended types
22159#>>>0x3D			ulelong	       >0
22160#>>>>0x39		ulelong	       x	\b, at 0x%x
22161#>>>>0x3D		ulelong	       x	0x%x bytes RGN3
22162# extended POIs
22163#>>>0x59			ulelong	       >0
22164#>>>>0x55		ulelong	       x	\b, at 0x%x
22165#>>>>0x59		ulelong	       x	0x%x bytes RGN3
22166#>>9	default		x		unknown map type
22167# Header length; GMP:31h 35h 3Dh,MDR:11Eh 238h 2C4h 310h,NOD:3Fh 7Fh,NET:64h,
22168# LBL:2A9h,SRT:1Dh 25h 27h,TRE:CFh 135h,TRF:5Ah,TYP:5Bh 6Eh 7Ch AEh,RGN:7Dh
22169>>0	uleshort	x		\b, header length 0x%x
22170
22171# URL:		https://www.memotech.franken.de/FileFormats/
22172# Reference:	https://www.memotech.franken.de/FileFormats/Garmin_RGN_Format.pdf
22173# From:		Joerg Jenderek
221740	string		KpGr		Garmin update
22175# format version like: 0064h~1.0
22176>0x4	uleshort	!0x0064
22177>>4	uleshort/100	x		\b, version %u
22178>>4	uleshort%100	x		\b.%u
22179# 1st Garmin entry
22180>6	use	garmin-entry
22181# 2nd Garmin entry
22182>(0x6.l+10)	ubyte		x
22183>>&0		use		garmin-entry
22184# 3rd entry
22185>(0x6.l+10)	ubyte		x
22186>>&(&0.l+4)	ubyte		x
22187>>>&0		use		garmin-entry
22188# look again at version to use default clause
22189>0x4	uleshort	x
22190# test for region content by looking for
22191# Garmin *.srf by ./images with normal builder name "SQA" or longer "hales"
22192# 1 space after equal sign
22193>>0x3a	search/5/s	GARMIN\ BITMAP	\b=
22194!:mime	image/x-garmin-exe
22195!:ext	exe
22196>>>&0	indirect	x
22197# if not bitmap *.srf then region; 1 space after equal sign
22198>>0x3a	default		x		\b=
22199!:mime	application/x-garmin-rgn
22200!:ext	rgn
22201# recursiv embedded
22202>>>0x3a	search/5/s	KpGrd
22203>>>>&0	indirect	x
22204# look for ZIP or JAR archive by ./archive and ./zip
22205>>>0x3a	search/5/s	PK\003\004
22206>>>>&0	indirect	x
22207# TODO: other garmin RGN record content like foo
22208#>>0x3a	search/5/s	bar		BAR
22209#		display information of Garmin RGN record
222100	name	garmin-entry
22211# record length: 2 for Data, for Application often 1Bh sometimes 1Dh, "big" for Region
22212#>0	ulelong		x		\b, length 0x%x
22213# data record (ID='D') with version content like 0064h~1.0
22214>4	ubyte		=0x44
22215>>5	uleshort	!0x0064		\b; Data
22216>>>5	uleshort/100	x		\b, version %u
22217>>>5	uleshort%100	x		\b.%u
22218# Application Record (ID='A')
22219>4	ubyte		=0x41		\b; App
22220# version content like 00c8h~2.0
22221>>5	uleshort	!0x00C8
22222>>>5	uleshort/100	x		\b, version %u
22223>>>5	uleshort%100	x		\b.%u
22224# builder name like: SQA sqa build hales
22225>>7	string		x		\b, build by %s
22226# build date like: Oct 25 1999, Oct 1 2008, Feb 23 2009, Dec 15 2009
22227>>>&1	string		x		%s
22228# build time like: 11:26:12, 11:45:54, 14:16:13, 18:23:01
22229>>>>&1	string		x		%s
22230# region record (ID='R')
22231>4	ubyte		=0x52		\b; Region
22232# region ID:14~fw_all.bin: 78~ZIP, RGN or SRF bitmap; 148~ZIP or JAR; 249~display firmware; 251~WiFi or GCD firmware; 255~ZIP
22233>>5	uleshort	x		ID=%u
22234# delay in ms: like 0, 500
22235>>7	ulelong		!0		\b, %u ms
22236# region size (is record length - 10)
22237#>>11	ulelong		x		\b, length 0x%x
22238# region content like:
22239# "KpGr"~recursiv embedded,"GARMIN BITMAP"~Garmin Bitmap *.srf, "PK"~ZIP archive
22240#>>15	string		x		\b, content "%s"
22241>>15	ubequad		x		\b, content 0x%llx...
22242# This does NOT WORK!
22243#>>15	indirect	x		\b; contains
22244>4	default		x		\b; other
22245# garmin Record ID Identifies the record content like: D A R
22246>>4	ubyte		x		ID '%c'
22247
22248# TOM TOM GPS watches ttbin files:
22249# https://github.com/ryanbinns/ttwatch/tree/master/ttbin
22250# From: Daniel Lenski
222510	byte	0x20
22252>1	leshort	0x0007
22253>>0x76	byte	0x20
22254>>>0x77	leshort	0x0075		TomTom activity file, v7
22255>>>>8	leldate	x		(%s,
22256>>>>3	byte    x		device firmware %d.
22257>>>>4	byte	x		\b%d.
22258>>>>5	byte	x		\b%d,
22259>>>>6	leshort	x		product ID %04d)
22260
22261
22262#------------------------------------------------------------------------------
22263# $File: maple,v 1.8 2017/03/17 21:35:28 christos Exp $
22264# maple:  file(1) magic for maple files
22265# "H. Nanosecond" <aldomel@ix.netcom.com>
22266# Maple V release 4, a multi-purpose math program
22267#
22268
22269# maple library .lib
222700	string	\000MVR4\nI	MapleVr4 library
22271
22272# .ind
22273# no magic for these :-(
22274# they are compiled indexes for maple files
22275
22276# .hdb
222770	string	\000\004\000\000	Maple help database
22278
22279# .mhp
22280# this has the form <PACKAGE=name>
222810	string	\<PACKAGE=	Maple help file
222820	string	\<HELP\ NAME=	Maple help file
222830	string	\n\<HELP\ NAME=	Maple help file with extra carriage return at start (yuck)
22284#0	string	#\ Newton	Maple help file, old style
222850	string	#\ daub	Maple help file, old style
22286#0	string	#===========	Maple help file, old style
22287
22288# .mws
222890	string	\000\000\001\044\000\221	Maple worksheet
22290#this is anomalous
222910	string	WriteNow\000\002\000\001\000\000\000\000\100\000\000\000\000\000	Maple worksheet, but weird
22292# this has the form {VERSION 2 3 "IBM INTEL NT" "2.3" }\n
22293# that is {VERSION major_version miunor_version computer_type version_string}
222940	string	{VERSION\ 	Maple worksheet
22295>9	string	>\0	version %.1s.
22296>>11	string	>\0	%.1s
22297
22298# .mps
222990	string	\0\0\001$	Maple something
22300# from byte 4 it is either 'nul E' or 'soh R'
22301# I think 'nul E' means a file that was saved as  a different name
22302# a sort of revision marking
22303# 'soh R' means new
22304>4	string	\000\105	An old revision
22305>4	string	\001\122	The latest save
22306
22307# .mpl
22308# some of these are the same as .mps above
22309#0000000 000 000 001 044 000 105 same as .mps
22310#0000000 000 000 001 044 001 122 same as .mps
22311
223120	string	#\n##\ <SHAREFILE=	Maple something
223130	string	\n#\n##\ <SHAREFILE=	Maple something
223140	string	##\ <SHAREFILE=	Maple something
223150	string	#\r##\ <SHAREFILE=	Maple something
223160	string	\r#\r##\ <SHAREFILE=	Maple something
223170	string	#\ \r##\ <DESCRIBE>	Maple something anomalous.
22318#--------------------------------------------
22319# marc21: file(1) magic for MARC 21 Format
22320#
22321# Kevin Ford (kefo@loc.gov)
22322#
22323# MARC21 formats are for the representation and communication
22324# of bibliographic and related information in machine-readable
22325# form.  For more info, see https://www.loc.gov/marc/
22326
22327
22328# leader position 20-21 must be 45
22329# and 22-23 also 00 so far, but we check that later.
2233020	string		45
22331>0	search/2048	\x1e
22332
22333# leader starts with 5 digits, followed by codes specific to MARC format
22334>>0	regex/1l	(^[0-9]{5})[acdnp][^bhlnqsu-z]	MARC21 Bibliographic
22335!:mime	application/marc
22336>>0	regex/1l	(^[0-9]{5})[acdnosx][z]	MARC21 Authority
22337!:mime	application/marc
22338>>0	regex/1l	(^[0-9]{5})[cdn][uvxy]	MARC21 Holdings
22339!:mime	application/marc
22340>>0	regex/1l	(^[0-9]{5})[acdn][w]	MARC21 Classification
22341!:mime	application/marc
22342>>0	regex/1l	(^[0-9]{5})[cdn][q]	MARC21 Community
22343!:mime	application/marc
22344
22345# leader position 22-23, should be "00" but is it?
22346>>0	regex/1l	(^.{21})([^0]{2})	(non-conforming)
22347!:mime	application/marc
22348
22349#------------------------------------------------------------------------------
22350# $File: mathcad,v 1.5 2009/09/19 16:28:10 christos Exp $
22351# mathcad:  file(1) magic for Mathcad documents
22352# URL:	http://www.mathsoft.com/
22353# From:	Josh Triplett <josh@freedesktop.org>
22354
223550	string	.MCAD\t		Mathcad document
22356
22357#------------------------------------------------------------------------------
22358# $File: mathematica,v 1.11 2021/02/23 00:51:10 christos Exp $
22359# mathematica:  file(1) magic for mathematica files
22360# "H. Nanosecond" <aldomel@ix.netcom.com>
22361# Mathematica a multi-purpose math program
22362# versions 2.2 and 3.0
22363
22364#mathematica .mb
223650	string	\064\024\012\000\035\000\000\000	Mathematica version 2 notebook
22366!:ext mb
223670	string	\064\024\011\000\035\000\000\000	Mathematica version 2 notebook
22368!:ext mb
22369
22370# .ma
22371# multiple possibilities:
22372
223730	string	(*^\n\n::[\011frontEndVersion\ =\ 	Mathematica notebook
22374#>41	string	>\0	%s
22375!:ext mb
22376
22377#0	string	(*^\n\n::[\011palette	Mathematica notebook version 2.x
22378
22379#0	string	(*^\n\n::[\011Information	Mathematica notebook version 2.x
22380#>675	string	>\0	%s #doesn't work well
22381
22382# there may be 'cr' instead of 'nl' in some does this matter?
22383
22384# generic:
223850	string	(*^\r\r::[\011	Mathematica notebook version 2.x
22386!:ext mb
223870	string	(*^\r\n\r\n::[\011	Mathematica notebook version 2.x
22388!:ext mb
223890	string	(*^\015			Mathematica notebook version 2.x
22390!:ext mb
223910	string	(*^\n\r\n\r::[\011	Mathematica notebook version 2.x
22392!:ext mb
223930	string	(*^\r::[\011	Mathematica notebook version 2.x
22394!:ext mb
223950	string	(*^\r\n::[\011	Mathematica notebook version 2.x
22396!:ext mb
223970	string	(*^\n\n::[\011	Mathematica notebook version 2.x
22398!:ext mb
223990	string	(*^\n::[\011	Mathematica notebook version 2.x
22400!:ext mb
22401
22402
22403# Mathematica .mx files
22404
22405#0	string	(*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*)	Mathematica binary file
224060	string	(*This\ is\ a\ Mathematica\ binary\ 	Mathematica binary file
22407#>71	string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000
22408# >71... is optional
22409>88	string	>\0	from %s
22410
22411
22412# Mathematica files PBF:
22413# 115 115 101 120 102 106 000 001 000 000 000 203 000 001 000
224140	string	MMAPBF\000\001\000\000\000\203\000\001\000	Mathematica PBF (fonts I think)
22415
22416# .ml files  These are menu resources I think
22417# these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\
22418# how to put that into a magic rule?
224194	string	\ A~	MAthematica .ml file
22420
22421# .nb files
22422#too long 0	string	(***********************************************************************\n\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Mathematica-Compatible Notebook	Mathematica 3.0 notebook
224230	string	(***********************	Mathematica 3.0 notebook
22424
22425# other (* matches it is a comment start in these langs
22426# GRR: Too weak; also matches other languages e.g. ML
22427#0	string	(*	Mathematica, or Pascal, Modula-2 or 3 code text
22428
22429#########################
22430# MatLab v5
224310       string  MATLAB  Matlab v5 mat-file
22432>126    short   0x494d  (big endian)
22433>>124   beshort x       version 0x%04x
22434>126    short   0x4d49  (little endian)
22435>>124   leshort x       version 0x%04x
22436
22437
22438#------------------------------------------------------------------------------
22439# $File: matroska,v 1.9 2019/04/19 00:42:27 christos Exp $
22440# matroska:  file(1) magic for Matroska files
22441#
22442# See https://www.matroska.org/
22443#
22444
22445# EBML id:
224460		belong		0x1a45dfa3
22447# DocType id:
22448>4		search/4096 	\x42\x82
22449# DocType contents:
22450>>&1		string		webm		WebM
22451!:mime  video/webm
22452>>&1		string		matroska	Matroska data
22453!:mime  video/x-matroska
22454
22455#------------------------------------------------------------------------------
22456# $File: mcrypt,v 1.5 2009/09/19 16:28:10 christos Exp $
22457# Mavroyanopoulos Nikos <nmav@hellug.gr>
22458# mcrypt:   file(1) magic for mcrypt 2.2.x;
224590	string		\0m\3		mcrypt 2.5 encrypted data,
22460>4	string		>\0		algorithm: %s,
22461>>&1	leshort		>0		keysize: %d bytes,
22462>>>&0	string		>\0		mode: %s,
22463
224640	string		\0m\2		mcrypt 2.2 encrypted data,
22465>3	byte		0		algorithm: blowfish-448,
22466>3	byte		1		algorithm: DES,
22467>3	byte		2		algorithm: 3DES,
22468>3	byte		3		algorithm: 3-WAY,
22469>3	byte		4		algorithm: GOST,
22470>3	byte		6		algorithm: SAFER-SK64,
22471>3	byte		7		algorithm: SAFER-SK128,
22472>3	byte		8		algorithm: CAST-128,
22473>3	byte		9		algorithm: xTEA,
22474>3	byte		10		algorithm: TWOFISH-128,
22475>3	byte		11		algorithm: RC2,
22476>3	byte		12		algorithm: TWOFISH-192,
22477>3	byte		13		algorithm: TWOFISH-256,
22478>3	byte		14		algorithm: blowfish-128,
22479>3	byte		15		algorithm: blowfish-192,
22480>3	byte		16		algorithm: blowfish-256,
22481>3	byte		100		algorithm: RC6,
22482>3	byte		101		algorithm: IDEA,
22483>4	byte		0		mode: CBC,
22484>4	byte		1		mode: ECB,
22485>4	byte		2		mode: CFB,
22486>4	byte		3		mode: OFB,
22487>4	byte		4		mode: nOFB,
22488>5	byte		0		keymode: 8bit
22489>5	byte		1		keymode: 4bit
22490>5	byte		2		keymode: SHA-1 hash
22491>5	byte		3		keymode: MD5 hash
22492
22493#------------------------------------------------------------------------------
22494# $File: measure,v 1.3 2021/03/25 17:30:10 christos Exp $
22495# measure: file(1) magic for measurement data
22496
22497# DIY-Thermocam raw data
224980	name	diy-thermocam-parser
22499>0	beshort	x	scale %d-
22500>2	beshort x	\b%d,
22501>4	lefloat	x	spot sensor temperature %f,
22502>9	ubyte	0	unit celsius,
22503>9	ubyte	1	unit fahrenheit,
22504>8	ubyte	x	color scheme %d
22505>10	ubyte	1	\b, show spot sensor
22506>11	ubyte	1	\b, show scale bar
22507>12	ubyte	&1	\b, minimum point enabled
22508>12	ubyte	&2	\b, maximum point enabled
22509>13	lefloat	x	\b, calibration: offset %f,
22510>17	lefloat x	slope %f
22511
225120	name	diy-thermocam-checker
22513>9	ubyte	<2
22514>>10	ubyte	<2
22515>>>11	ubyte	<2
22516>>>>12	ubyte	<4
22517>>>>>17	lefloat	>0.0001	DIY-Thermocam raw data
22518
22519# V2 and Leption 3.x:
2252038408	ubyte	<19
22521>38400	use	diy-thermocam-checker
22522>>38400	default x	(Lepton 3.x),
22523>>>38400	use	diy-thermocam-parser
22524
22525# V1 or Lepton 2.x
225269608	ubyte	<19
22527>9600	use	diy-thermocam-checker
22528>>9600	default	x	(Lepton 2.x),
22529>>>9600	use	diy-thermocam-parser
22530
22531# Becker & Hickl Photon Counting (PMS) data file
22532# format documentation: https://www.becker-hickl.com/wp-content/uploads/2018/11/opm-pms400-v01.pdf (page 57)
22533(0x02.l)	string	*IDENTIFICATION		Becker & Hickl PMS Data File
22534>0x12		short	x			(%d data blocks)
22535!:ext sdt
22536
22537#------------------------------------------------------------------------------
22538# $File: mercurial,v 1.5 2019/04/19 00:42:27 christos Exp $
22539# mercurial:  file(1) magic for Mercurial changeset bundles
22540# https://www.selenic.com/mercurial/wiki/
22541#
22542# Jesse Glick (jesse.glick@sun.com)
22543#
22544
225450	string		HG10		Mercurial changeset bundle
22546>4	string		UN		(uncompressed)
22547>4	string		GZ		(gzip compressed)
22548>4	string		BZ		(bzip2 compressed)
22549
22550#------------------------------------------------------------------------------
22551# $File: metastore,v 1.3 2019/04/19 00:42:27 christos Exp $
22552# metastore:  file(1) magic for metastore files
22553# From: Thomas Wissen
22554# see https://david.hardeman.nu/software.php#metastore
225550	string		MeTaSt00r3	Metastore data file,
22556>10	bequad		x		version %0llx
22557
22558#------------------------------------------------------------------------------
22559# $File: meteorological,v 1.2 2017/03/17 21:35:28 christos Exp $
22560# rinex:  file(1) magic for RINEX files
22561# http://igscb.jpl.nasa.gov/igscb/data/format/rinex210.txt
22562# ftp://cddis.gsfc.nasa.gov/pub/reports/formats/rinex300.pdf
22563# data for testing: ftp://cddis.gsfc.nasa.gov/pub/gps/data
2256460	string		RINEX
22565>80	search/256	XXRINEXB	RINEX Data, GEO SBAS Broadcast
22566>>&32	string		x		\b, date %15.15s
22567>>5	string		x		\b, version %6.6s
22568!:mime	rinex/broadcast
22569>80	search/256	XXRINEXD	RINEX Data, Observation (Hatanaka comp)
22570>>&32	string		x		\b, date %15.15s
22571>>5	string		x		\b, version %6.6s
22572!:mime	rinex/observation
22573>80	search/256	XXRINEXC	RINEX Data, Clock
22574>>&32	string		x		\b, date %15.15s
22575>>5	string		x		\b, version %6.6s
22576!:mime	rinex/clock
22577>80	search/256	XXRINEXH	RINEX Data, GEO SBAS Navigation
22578>>&32	string		x		\b, date %15.15s
22579>>5	string		x		\b, version %6.6s
22580!:mime	rinex/navigation
22581>80	search/256	XXRINEXG	RINEX Data, GLONASS Navigation
22582>>&32	string		x		\b, date %15.15s
22583>>5	string		x		\b, version %6.6s
22584!:mime	rinex/navigation
22585>80	search/256	XXRINEXL	RINEX Data, Galileo Navigation
22586>>&32	string		x		\b, date %15.15s
22587>>5	string		x		\b, version %6.6s
22588!:mime	rinex/navigation
22589>80	search/256	XXRINEXM	RINEX Data, Meteorological
22590>>&32	string		x		\b, date %15.15s
22591>>5	string		x		\b, version %6.6s
22592!:mime	rinex/meteorological
22593>80	search/256	XXRINEXN	RINEX Data, Navigation
22594>>&32	string		x		\b, date %15.15s
22595>>5	string		x		\b, version %6.6s
22596!:mime	rinex/navigation
22597>80	search/256	XXRINEXO	RINEX Data, Observation
22598>>&32	string		x		\b, date %15.15s
22599>>5	string		x		\b, version %6.6s
22600!:mime	rinex/observation
22601
22602# https://en.wikipedia.org/wiki/GRIB
226030	string	GRIB
22604>7	byte	=1	Gridded binary (GRIB) version 1
22605>7	byte	=2	Gridded binary (GRIB) version 2
22606
22607#------------------------------------------------------------------------------
22608# $File: microfocus,v 1.3 2019/04/19 00:42:27 christos Exp $
22609# Micro Focus COBOL data files.
22610
22611# https://documentation.microfocus.com/help/index.jsp?topic=\
22612# %2FGUID-0E0191D8-C39A-44D1-BA4C-D67107BAF784%2FHRFLRHFILE05.html
22613# http://www.cobolproducts.com/datafile/data-viewer.html
22614# https://github.com/miracle2k/mfcobol-export
22615
226160 string \x30\x00\x00\x7C
22617>36 string \x00\x3E Micro Focus File with Header (DAT)
22618!:mime application/octet-stream
22619
226200 string \x30\x7E\x00\x00
22621>36 string \x00\x3E Micro Focus File with Header (DAT)
22622!:mime application/octet-stream
22623
2262439 string \x02
22625>136 string \x02\x02\x04\x04 Micro Focus Index File (IDX)
22626!:mime application/octet-stream
22627
22628#------------------------------------------------------------------------------
22629# $File: mime,v 1.8 2017/03/17 22:20:22 christos Exp $
22630# mime:  file(1) magic for MIME encoded files
22631#
226320	string/t		Content-Type:\040
22633>14	string		>\0		%s
226340	string/t		Content-Type:
22635>13	string		>\0		%s
22636
22637#------------------------------------------------------------------------------
22638# $File: mips,v 1.10 2014/04/30 21:41:02 christos Exp $
22639# mips:  file(1) magic for MIPS ECOFF and Ucode, as used in SGI IRIX
22640# and DEC Ultrix
22641#
226420	beshort	0x0160		MIPSEB ECOFF executable
22643>20	beshort	0407		(impure)
22644>20	beshort	0410		(swapped)
22645>20	beshort	0413		(paged)
22646>8	belong	>0		not stripped
22647>8	belong	0		stripped
22648>22	byte	x		- version %d
22649>23	byte	x		\b.%d
22650#
226510	beshort	0x0162		MIPSEL-BE ECOFF executable
22652>20	beshort	0407		(impure)
22653>20	beshort	0410		(swapped)
22654>20	beshort	0413		(paged)
22655>8	belong	>0		not stripped
22656>8	belong	0		stripped
22657>23	byte	x		- version %d
22658>22	byte	x		\b.%d
22659#
226600	beshort	0x6001		MIPSEB-LE ECOFF executable
22661>20	beshort	03401		(impure)
22662>20	beshort	04001		(swapped)
22663>20	beshort	05401		(paged)
22664>8	belong	>0		not stripped
22665>8	belong	0		stripped
22666>23	byte	x		- version %d
22667>22	byte	x		\b.%d
22668#
226690	beshort	0x6201		MIPSEL ECOFF executable
22670>20	beshort	03401		(impure)
22671>20	beshort	04001		(swapped)
22672>20	beshort	05401		(paged)
22673>8	belong	>0		not stripped
22674>8	belong	0		stripped
22675>23	byte	x		- version %d
22676>22	byte	x		\b.%d
22677#
22678# MIPS 2 additions
22679#
226800	beshort	0x0163		MIPSEB MIPS-II ECOFF executable
22681>20	beshort	0407		(impure)
22682>20	beshort	0410		(swapped)
22683>20	beshort	0413		(paged)
22684>8	belong	>0		not stripped
22685>8	belong	0		stripped
22686>22	byte	x		- version %d
22687>23	byte	x		\b.%d
22688#
226890	beshort	0x0166		MIPSEL-BE MIPS-II ECOFF executable
22690>20	beshort	0407		(impure)
22691>20	beshort	0410		(swapped)
22692>20	beshort	0413		(paged)
22693>8	belong	>0		not stripped
22694>8	belong	0		stripped
22695>22	byte	x		- version %d
22696>23	byte	x		\b.%d
22697#
226980	beshort	0x6301		MIPSEB-LE MIPS-II ECOFF executable
22699>20	beshort	03401		(impure)
22700>20	beshort	04001		(swapped)
22701>20	beshort	05401		(paged)
22702>8	belong	>0		not stripped
22703>8	belong	0		stripped
22704>23	byte	x		- version %d
22705>22	byte	x		\b.%d
22706#
227070	beshort	0x6601		MIPSEL MIPS-II ECOFF executable
22708>20	beshort	03401		(impure)
22709>20	beshort	04001		(swapped)
22710>20	beshort	05401		(paged)
22711>8	belong	>0		not stripped
22712>8	belong	0		stripped
22713>23	byte	x		- version %d
22714>22	byte	x		\b.%d
22715#
22716# MIPS 3 additions
22717#
227180	beshort	0x0140		MIPSEB MIPS-III ECOFF executable
22719>20	beshort	0407		(impure)
22720>20	beshort	0410		(swapped)
22721>20	beshort	0413		(paged)
22722>8	belong	>0		not stripped
22723>8	belong	0		stripped
22724>22	byte	x		- version %d
22725>23	byte	x		\b.%d
22726#
227270	beshort	0x0142		MIPSEL-BE MIPS-III ECOFF executable
22728>20	beshort	0407		(impure)
22729>20	beshort	0410		(swapped)
22730>20	beshort	0413		(paged)
22731>8	belong	>0		not stripped
22732>8	belong	0		stripped
22733>22	byte	x		- version %d
22734>23	byte	x		\b.%d
22735#
227360	beshort	0x4001		MIPSEB-LE MIPS-III ECOFF executable
22737>20	beshort	03401		(impure)
22738>20	beshort	04001		(swapped)
22739>20	beshort	05401		(paged)
22740>8	belong	>0		not stripped
22741>8	belong	0		stripped
22742>23	byte	x		- version %d
22743>22	byte	x		\b.%d
22744#
227450	beshort	0x4201		MIPSEL MIPS-III ECOFF executable
22746>20	beshort	03401		(impure)
22747>20	beshort	04001		(swapped)
22748>20	beshort	05401		(paged)
22749>8	belong	>0		not stripped
22750>8	belong	0		stripped
22751>23	byte	x		- version %d
22752>22	byte	x		\b.%d
22753#
227540	beshort	0x180		MIPSEB Ucode
227550	beshort	0x182		MIPSEL-BE Ucode
22756
22757#------------------------------------------------------------------------------
22758# $File: mirage,v 1.7 2009/09/19 16:28:10 christos Exp $
22759# mirage:  file(1) magic for Mirage executables
22760#
22761# XXX - byte order?
22762#
227630	long	31415		Mirage Assembler m.out executable
22764
22765#-----------------------------------------------------------------------------
22766# $File: misctools,v 1.18 2019/04/19 00:42:27 christos Exp $
22767# misctools:  file(1) magic for miscellaneous UNIX tools.
22768#
227690	search/1	%%!!			X-Post-It-Note text
227700	string/c	BEGIN:VCALENDAR		vCalendar calendar file
22771!:mime	text/calendar
22772# updated by Joerg Jenderek at Apr 2015
22773# Extension: .vcf
22774# https://en.wikipedia.org/wiki/VCard
227750	string/c	BEGIN:VCARD		vCard visiting card
22776# deprecated
22777#!:mime	text/x-vcard
22778!:mime	text/vcard
22779# VERSION must come right after BEGIN for 3.0 or 4.0 except in 2.1 , where it can be anywhere
22780>12	search/14000/c	VERSION:
22781# VERSION 2.1 , 3.0 or 4.0
22782>>&0	string		x			\b, version %-.3s
22783
22784# Summary: Libtool library file
22785# Extension: .la
22786# Submitted by: Tomasz Trojanowski <tomek@uninet.com.pl>
227870	search/80	.la\ -\ a\ libtool\ library\ file	libtool library file
22788
22789# Summary: Libtool object file
22790# Extension: .lo
22791# Submitted by: Abel Cheung <abelcheung@gmail.com>
227920	search/80	.lo\ -\ a\ libtool\ object\ file	libtool object file
22793
22794# From: Daniel Novotny <dnovotny@redhat.com>
22795# Update: Joerg Jenderek
22796# URL: https://en.wikipedia.org/wiki/Core_dump#User-mode_memory_dumps
22797# Reference: https://msdn.microsoft.com/en-us/library/ms680378%28VS.85%29.aspx
22798#
22799# "Windows Minidump" by TrID
22800# ./misctools (version 5.25) labeled the entry as "MDMP crash report data"
228010	string		MDMP					Mini DuMP crash report
22802# https://filext.com/file-extension/DMP
22803!:mime	application/x-dmp
22804!:ext	dmp/mdmp
22805# The high-order word is an internal value that is implementation specific.
22806# The low-order word is MINIDUMP_VERSION 0xA793
22807>4	ulelong&0x0000FFFF	!0xA793				\b, version 0x%4.4x
22808# NumberOfStreams 8,9,10,13
22809>8	ulelong			x				\b, %d streams
22810# StreamDirectoryRva 0x20
22811>12	ulelong			!0x20				\b, 0x%8.8x RVA
22812# CheckSum 0
22813>16	ulelong			!0				\b, CheckSum 0x%8.8x
22814# Reserved or TimeDateStamp
22815>20	ledate			x				\b, %s
22816# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680519%28v=vs.85%29.aspx
22817# Flags MINIDUMP_TYPE enumeration type 0 0x121 0x800
22818>24	ulelong			x				\b, 0x%x type
22819# >24	ulelong			>0				\b; include
22820# >>24	ulelong			&0x00000001			\b data sections,
22821# >>24	ulelong			&0x00000020			\b list of unloaded modules,
22822# >>24	ulelong			&0x00000100			\b process and thread information,
22823# >>24	ulelong			&0x00000800			\b memory information,
22824
22825# Summary: abook addressbook file
22826# Submitted by: Mark Schreiber <mark7@alumni.cmu.edu>
228270	string	#\x20abook\x20addressbook\x20file abook address book
22828!:mime application/x-abook-addressbook
22829
22830#------------------------------------------------------------------------------
22831# $File: mkid,v 1.6 2009/09/19 16:28:10 christos Exp $
22832# mkid:  file(1) magic for mkid(1) databases
22833#
22834# ID is the binary tags database produced by mkid(1).
22835#
22836# XXX - byte order?
22837#
228380	string		\311\304	ID tags data
22839>2	short		>0		version %d
22840
22841#------------------------------------------------------------------------------
22842# $File: mlssa,v 1.4 2009/09/19 16:28:10 christos Exp $
22843# mlssa: file(1) magic for MLSSA datafiles
22844#
228450		lelong		0xffffabcd	MLSSA datafile,
22846>4		leshort		x		algorithm %d,
22847>10		lelong		x		%d samples
22848
22849#------------------------------------------------------------------------------
22850# $File: mmdf,v 1.6 2009/09/19 16:28:10 christos Exp $
22851# mmdf:  file(1) magic for MMDF mail files
22852#
228530	string	\001\001\001\001	MMDF mailbox
22854
22855#------------------------------------------------------------------------------
22856# $File: modem,v 1.9 2019/04/19 00:42:27 christos Exp $
22857# modem:  file(1) magic for modem programs
22858#
22859# From: Florian La Roche <florian@knorke.saar.de>
228601	string		PC\ Research,\ Inc	Digifax-G3-File
22861>29	byte		1			\b, fine resolution
22862>29	byte		0			\b, normal resolution
22863
22864# Summary: CCITT Group 3 Facsimile in "raw" form (i.e. no header).
22865# Modified by: Joerg Jenderek
22866# URL: https://de.wikipedia.org/wiki/Fax
22867# Reference: https://web.archive.org/web/20020628195336/http://www.netnam.vn/unescocourse/computervision/104.htm
22868# GRR: EOL of G3 is too general as it catches also TrueType fonts, Postscript PrinterFontMetric, others
228690	short		0x0100
22870# 16 0-bits near beginning like True Type fonts *.ttf, Postscript PrinterFontMetric *.pfm, FTYPE.HYPERCARD, XFER
22871>2	search/9	\0\0
22872# maximal 7 0-bits for pixel sequences or 11 0-bits for EOL in G3
22873>2	default		x
22874# skip IRCAM file (VAX big-endian)	./audio
22875>>0	belong		!0x0001a364
22876# skip GEM Image data			./images
22877>>>2	beshort		!0x0008
22878# look for first keyword of Panorama database *.pan
22879>>>>11	search/262	\x06DESIGN
22880# skip Panorama database
22881>>>>11	default		x
22882# old Apple DreamWorld DreamGrafix *.3200 with keyword at end of g3 looking files
22883>>>>>27118	search/1864	DreamWorld
22884>>>>>27118	default		x
22885# skip MouseTrap/Mt.Defaults with file size 16 found on Golden Orchard Apple II CD Rom
22886>>>>>>8		ubequad		!0x2e01010454010203
22887# skip PICTUREH.SML found on Golden Orchard Apple II CD Rom
22888>>>>>>>8	ubequad		!0x5dee74ad1aa56394	raw G3 (Group 3) FAX, byte-padded
22889# version 5.25 labeled the entry above "raw G3 data, byte-padded"
22890!:mime	image/g3fax
22891#!:apple	????TIFF
22892!:ext	g3
22893# unusual image starting with black pixel
22894#0	short		0x1300		raw G3 (Group 3) FAX
228950	short		0x1400
22896# 16 0-bits near beginning like PicturePuzzler found on Golden Orchard Apple CD Rom
22897>2	search/9	\0\0
22898# maximal 7 0-bits for pixel sequences or 11 0-bits for EOL in G3
22899>2	default		x		raw G3 (Group 3) FAX
22900# version 5.25 labeled the above entry as "raw G3 data"
22901!:mime	image/g3fax
22902!:ext	g3
22903# unusual image with black pixel near beginning
22904#0	short		0x1900		raw G3 (Group 3) FAX
22905
22906#
22907# Magic data for vgetty voice formats
22908# (Martin Seine & Marc Eberhard)
22909
22910#
22911# raw modem data version 1
22912#
229130    string    RMD1      raw modem data
22914>4   string    >\0       (%s /
22915>20  short     >0        compression type 0x%04x)
22916
22917#
22918# portable voice format 1
22919#
229200    string    PVF1\n         portable voice format
22921>5   string    >\0       (binary %s)
22922
22923#
22924# portable voice format 2
22925#
229260    string    PVF2\n         portable voice format
22927>5   string >\0          (ascii %s)
22928
22929# From: Bernd Nuernberger <bernd.nuernberger@web.de>
22930# Brooktrout G3 fax data incl. 128 byte header
22931# Common suffixes: 3??, BRK, BRT, BTR
229320	leshort		0x01bb
22933>2	leshort		0x0100		Brooktrout 301 fax image,
22934>>9	leshort		x		%d x
22935>>0x2d	leshort		x		%d
22936>>6	leshort		200		\b, fine resolution
22937>>6	leshort		100		\b, normal resolution
22938>>11	byte		1		\b, G3 compression
22939>>11	byte		2		\b, G32D compression
22940
22941#------------------------------------------------------------------------------
22942# $File: modulefile,v 1.1 2019/10/15 18:04:40 christos Exp $
22943# modulefile:  file(1) magic for user's environment modulefile
22944# URL: http://modules.sourceforge.net/
22945# Reference: https://modules.readthedocs.io/en/stable/modulefile.html
22946# From: Xavier Delaruelle <xavier.delaruelle@cea.fr>
229470	string	#%Module	modulefile
22948!:mime	text/x-modulefile
22949
22950#------------------------------------------------------------------------------
22951# $File: motorola,v 1.11 2014/04/30 21:41:02 christos Exp $
22952# motorola:  file(1) magic for Motorola 68K and 88K binaries
22953#
22954# 68K
22955#
229560	beshort		0520		mc68k COFF
22957>18	beshort		^00000020	object
22958>18	beshort		&00000020	executable
22959>12	belong		>0		not stripped
22960>168	string		.lowmem		Apple toolbox
22961>20	beshort		0407		(impure)
22962>20	beshort		0410		(pure)
22963>20	beshort		0413		(demand paged)
22964>20	beshort		0421		(standalone)
229650	beshort		0521		mc68k executable (shared)
22966>12	belong		>0		not stripped
229670	beshort		0522		mc68k executable (shared demand paged)
22968>12	belong		>0		not stripped
22969#
22970# Motorola/UniSoft 68K Binary Compatibility Standard (BCS)
22971#
229720	beshort		0554		68K BCS executable
22973#
22974# 88K
22975#
22976# Motorola/88Open BCS
22977#
229780	beshort		0555		88K BCS executable
22979#
22980# Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de>
229810   string      S0          Motorola S-Record; binary data in text format
22982
22983# ATARI ST relocatable PRG
22984#
22985# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001
22986# (according to Roland Waldi, Oct 21, 1987)
22987# besides the magic 0x601a, the text segment size is checked to be
22988# not larger than 1 MB (which is a lot on ST).
22989# The additional 0x601b distinction I took from Doug Lee's magic.
229900	belong&0xFFFFFFF0	0x601A0000	Atari ST M68K contiguous executable
22991>2	belong			x		(txt=%d,
22992>6	belong			x		dat=%d,
22993>10	belong			x		bss=%d,
22994>14	belong			x		sym=%d)
229950	belong&0xFFFFFFF0	0x601B0000	Atari ST M68K non-contig executable
22996>2	belong			x		(txt=%d,
22997>6	belong			x		dat=%d,
22998>10	belong			x		bss=%d,
22999>14	belong			x		sym=%d)
23000
23001# Atari ST/TT... program format (sent by Wolfram Kleff <kleff@cs.uni-bonn.de>)
230020       beshort         0x601A          Atari 68xxx executable,
23003>2      belong          x               text len %u,
23004>6      belong          x               data len %u,
23005>10     belong          x               BSS len %u,
23006>14     belong          x               symboltab len %u,
23007>18     belong          0
23008>22     belong          &0x01           fastload flag,
23009>22     belong          &0x02           may be loaded to alternate RAM,
23010>22     belong          &0x04           malloc may be from alternate RAM,
23011>22     belong          x               flags: 0x%X,
23012>26     beshort         0               no relocation tab
23013>26     beshort         !0              + relocation tab
23014>30     string          SFX             [Self-Extracting LZH SFX archive]
23015>38     string          SFX             [Self-Extracting LZH SFX archive]
23016>44     string          ZIP!            [Self-Extracting ZIP SFX archive]
23017
230180       beshort         0x0064          Atari 68xxx CPX file
23019>8      beshort         x               (version %04x)
23020
23021#------------------------------------------------------------------------------
23022# $File: mozilla,v 1.11 2020/12/12 20:01:47 christos Exp $
23023# mozilla:  file(1) magic for Mozilla XUL fastload files
23024# (XUL.mfasl and XPC.mfasl)
23025# URL:	https://www.mozilla.org/
23026# From:	Josh Triplett <josh@freedesktop.org>
23027
230280	string	XPCOM\nMozFASL\r\n\x1A		Mozilla XUL fastload data
23029# Probably the next magic line contains misspelled "mozLz40\0"
230300	string	mozLz4a				Mozilla lz4 compressed bookmark data
23031# From: Joerg Jenderek
23032# URL: https://lz4.github.io/lz4/
23033# Reference: https://github.com/avih/dejsonlz4/archive/master.zip/
23034# dejsonlz4-master\src\dejsonlz4.c
23035# Note: mostly JSON compressed with a non-standard LZ4 header
23036# can be unpacked by dejsonlz4 but not lz4 program.
230370	string	mozLz40\0			Mozilla lz4 compressed data
23038!:mime	application/x-lz4+json
23039# mozlz4 extension seems to be used for search/store, while jsonlz4 for bookmarks
23040!:ext	jsonlz4/mozlz4
23041# decomp_size
23042>8	ulelong	x				\b, originally %u bytes
23043# lz4 data
23044#>12	ubequad	x				\b, lz4 data 0x%16.16llx
23045
23046# From: Joerg Jenderek
23047# URL: https://en.wikipedia.org/wiki/Firefox_4
23048# Reference: https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT
23049# Note:	Most ZIP utilities are able to extract such archives
23050#	maybe only partly or after some warnings. Example:
23051#	zip -FF omni.ja --out omni.zip
230524	string	PK\001\002	Mozilla archive omni.ja
23053!:mime	application/x-zip
23054!:ext	ja
23055# TODO:
23056#>4	use	zip-dir-entry
23057
23058#------------------------------------------------------------------------------
23059# $File: msdos,v 1.145 2021/02/23 00:51:10 christos Exp $
23060# msdos:  file(1) magic for MS-DOS files
23061#
23062
23063# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
23064# updated by Joerg Jenderek at Oct 2008,Apr 2011
230650	string/t	@
23066>1	string/cW	\ echo\ off	DOS batch file text
23067!:mime	text/x-msdos-batch
23068!:ext	bat
23069>1	string/cW	echo\ off	DOS batch file text
23070!:mime	text/x-msdos-batch
23071!:ext	bat
23072>1	string/cW	rem		DOS batch file text
23073!:mime	text/x-msdos-batch
23074!:ext	bat
23075>1	string/cW	set\ 		DOS batch file text
23076!:mime	text/x-msdos-batch
23077!:ext	bat
23078
23079
23080# OS/2 batch files are REXX. the second regex is a bit generic, oh well
23081# the matched commands seem to be common in REXX and uncommon elsewhere
23082100	search/0xffff   rxfuncadd
23083>100	regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc	OS/2 REXX batch file text
23084100	search/0xffff   say
23085>100	regex/c =^[\ \t]{0,10}say\ ['"]			OS/2 REXX batch file text
23086
23087# updated by Joerg Jenderek at Oct 2015
23088# https://de.wikipedia.org/wiki/Common_Object_File_Format
23089# http://www.delorie.com/djgpp/doc/coff/filhdr.html
23090# ./intel already labeled COFF type 0x14c=0514 as "80386 COFF executable"
23091#0	leshort		0x14c	MS Windows COFF Intel 80386 object file
23092#>4	ledate		x	stamp %s
230930	leshort		0x166	MS Windows COFF MIPS R4000 object file
23094#>4	ledate		x	stamp %s
230950	leshort		0x184	MS Windows COFF Alpha object file
23096#>4	ledate		x	stamp %s
230970	leshort		0x268	MS Windows COFF Motorola 68000 object file
23098#>4	ledate		x	stamp %s
230990	leshort		0x1f0	MS Windows COFF PowerPC object file
23100#>4	ledate		x	stamp %s
231010	leshort		0x290	MS Windows COFF PA-RISC object file
23102#>4	ledate		x	stamp %s
23103
23104# Tests for various EXE types.
23105#
23106# Many of the compressed formats were extracted from IDARC 1.23 source code.
23107#
231080	string/b	MZ
23109# All non-DOS EXE extensions have the relocation table more than 0x40 bytes into the file.
23110>0x18	leshort <0x40 MS-DOS executable
23111!:mime	application/x-dosexec
23112# Windows and later versions of DOS will allow .EXEs to be named with a .COM
23113# extension, mostly for compatibility's sake.
23114# URL:		https://en.wikipedia.org/wiki/Personal_NetWare#VLM
23115# Reference:	https://mark0.net/download/triddefs_xml.7z/defs/e/exe-vlm-msg.trid.xml
23116!:ext	exe/com/vlm
23117# These traditional tests usually work but not always.  When test quality support is
23118# implemented these can be turned on.
23119#>>0x18	leshort	0x1c	(Borland compiler)
23120#>>0x18	leshort	0x1e	(MS compiler)
23121
23122# Maybe it's a PE?
23123>(0x3c.l)	string		PE\0\0	PE
23124!:mime	application/x-dosexec
23125>>(0x3c.l+24)	leshort		0x010b	\b32 executable
23126>>(0x3c.l+24)	leshort		0x020b	\b32+ executable
23127>>(0x3c.l+24)	leshort		0x0107	ROM image
23128>>(0x3c.l+24)	default		x	Unknown PE signature
23129>>>&0 		leshort		x	0x%x
23130>>(0x3c.l+22)	leshort&0x2000	>0	(DLL)
23131>>(0x3c.l+92)	leshort		1
23132# Native PEs include ntoskrnl.exe, hal.dll, smss.exe, autochk.exe, and all the
23133# drivers in Windows/System32/drivers/*.sys.
23134>>>(0x3c.l+22)	leshort&0x2000	>0	(native)
23135!:ext	dll/sys
23136>>>(0x3c.l+22)	leshort&0x2000	0	(native)
23137!:ext	exe/sys
23138>>(0x3c.l+92)	leshort		2
23139>>>(0x3c.l+22)	leshort&0x2000	>0	(GUI)
23140# These could probably be at least partially distinguished from one another by
23141# looking for specific exported functions.
23142# CPL: Control Panel item
23143# TLB: Type library
23144# OCX: OLE/ActiveX control
23145# ACM: Audio compression manager codec
23146# AX: DirectShow source filter
23147# IME: Input method editor
23148!:ext	dll/cpl/tlb/ocx/acm/ax/ime
23149>>>(0x3c.l+22)	leshort&0x2000	0	(GUI)
23150# Screen savers typically include code from the scrnsave.lib static library, but
23151# that's not guaranteed.
23152!:ext	exe/scr
23153>>(0x3c.l+92)	leshort		3
23154>>>(0x3c.l+22)	leshort&0x2000	>0	(console)
23155!:ext	dll/cpl/tlb/ocx/acm/ax/ime
23156>>>(0x3c.l+22)	leshort&0x2000	0	(console)
23157!:ext	exe/com
23158# https://docs.microsoft.com/en-us/windows/win32/debug/pe-format
23159>>(0x3c.l+92)	leshort		7	(POSIX)
23160>>(0x3c.l+92)	leshort		9	(Windows CE)
23161>>(0x3c.l+92)	leshort		10	(EFI application)
23162>>(0x3c.l+92)	leshort		11	(EFI boot service driver)
23163>>(0x3c.l+92)	leshort		12	(EFI runtime driver)
23164>>(0x3c.l+92)	leshort		13	(EFI ROM)
23165>>(0x3c.l+92)	leshort		14	(XBOX)
23166>>(0x3c.l+92)	leshort		15	(Windows boot application)
23167>>(0x3c.l+92)	default		x	(Unknown subsystem
23168>>>&0		leshort		x	0x%x)
23169>>(0x3c.l+4)	leshort		0x14c	Intel 80386
23170>>(0x3c.l+4)	leshort		0x166	MIPS R4000
23171>>(0x3c.l+4)	leshort		0x168	MIPS R10000
23172>>(0x3c.l+4)	leshort		0x184	Alpha
23173>>(0x3c.l+4)	leshort		0x1a2	Hitachi SH3
23174>>(0x3c.l+4)	leshort		0x1a3	Hitachi SH3 DSP
23175>>(0x3c.l+4)	leshort		0x1a8	Hitachi SH5
23176>>(0x3c.l+4)	leshort		0x169	MIPS WCE v2
23177>>(0x3c.l+4)	leshort		0x1a6	Hitachi SH4
23178>>(0x3c.l+4)	leshort		0x1c0	ARM
23179>>(0x3c.l+4)	leshort		0x1c2	ARM Thumb
23180>>(0x3c.l+4)	leshort		0x1c4	ARMv7 Thumb
23181>>(0x3c.l+4)	leshort		0x1d3	Matsushita AM33
23182>>(0x3c.l+4)	leshort		0x1f0	PowerPC
23183>>(0x3c.l+4)	leshort		0x1f1	PowerPC with FPU
23184>>(0x3c.l+4)	leshort		0x1f2	PowerPC (big-endian)
23185>>(0x3c.l+4)	leshort		0x200	Intel Itanium
23186>>(0x3c.l+4)	leshort		0x266	MIPS16
23187>>(0x3c.l+4)	leshort		0x268	Motorola 68000
23188>>(0x3c.l+4)	leshort		0x290	PA-RISC
23189>>(0x3c.l+4)	leshort		0x366	MIPSIV
23190>>(0x3c.l+4)	leshort		0x466	MIPS16 with FPU
23191>>(0x3c.l+4)	leshort		0xebc	EFI byte code
23192>>(0x3c.l+4)	leshort		0x5032	RISC-V 32-bit
23193>>(0x3c.l+4)	leshort		0x5064	RISC-V 64-bit
23194>>(0x3c.l+4)	leshort		0x5128	RISC-V 128-bit
23195>>(0x3c.l+4)	leshort		0x9041	Mitsubishi M32R
23196>>(0x3c.l+4)	leshort		0x8664	x86-64
23197>>(0x3c.l+4)	leshort		0xaa64	Aarch64
23198>>(0x3c.l+4)	leshort		0xc0ee	MSIL
23199>>(0x3c.l+4)	default		x	Unknown processor type
23200>>>&0		leshort		x	0x%x
23201>>(0x3c.l+22)	leshort&0x0200	>0	(stripped to external PDB)
23202>>(0x3c.l+22)	leshort&0x1000	>0	system file
23203>>(0x3c.l+24)	leshort		0x010b
23204>>>(0x3c.l+232) lelong	>0	Mono/.Net assembly
23205>>(0x3c.l+24)	leshort		0x020b
23206>>>(0x3c.l+248) lelong	>0	Mono/.Net assembly
23207
23208# hooray, there's a DOS extender using the PE format, with a valid PE
23209# executable inside (which just prints a message and exits if run in win)
23210>>(8.s*16)		string		32STUB	\b, 32rtm DOS extender
23211>>(8.s*16)		string		!32STUB	\b, for MS Windows
23212>>(0x3c.l+0xf8)		string		UPX0 \b, UPX compressed
23213>>(0x3c.l+0xf8)		search/0x140	PEC2 \b, PECompact2 compressed
23214>>(0x3c.l+0xf8)		search/0x140	UPX2
23215>>>(&0x10.l+(-4))	string		PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
23216>>(0x3c.l+0xf8)		search/0x140	.idata
23217>>>(&0xe.l+(-4))	string		PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
23218>>>(&0xe.l+(-4))	string		ZZ0 \b, ZZip self-extracting archive
23219>>>(&0xe.l+(-4))	string		ZZ1 \b, ZZip self-extracting archive
23220>>(0x3c.l+0xf8)		search/0x140	.rsrc
23221>>>(&0x0f.l+(-4))	string		a\\\4\5 \b, WinHKI self-extracting archive
23222>>>(&0x0f.l+(-4))	string		Rar! \b, RAR self-extracting archive
23223>>>(&0x0f.l+(-4))	search/0x3000	MSCF \b, InstallShield self-extracting archive
23224>>>(&0x0f.l+(-4))	search/32	Nullsoft \b, Nullsoft Installer self-extracting archive
23225>>(0x3c.l+0xf8)		search/0x140	.data
23226>>>(&0x0f.l)		string		WEXTRACT \b, MS CAB-Installer self-extracting archive
23227>>(0x3c.l+0xf8)		search/0x140	.petite\0 \b, Petite compressed
23228>>>(0x3c.l+0xf7)	byte		x
23229>>>>(&0x104.l+(-4))	string		=!sfx! \b, ACE self-extracting archive
23230>>(0x3c.l+0xf8)		search/0x140	.WISE \b, WISE installer self-extracting archive
23231>>(0x3c.l+0xf8)		search/0x140	.dz\0\0\0 \b, Dzip self-extracting archive
23232>>&(0x3c.l+0xf8)	search/0x100	_winzip_ \b, ZIP self-extracting archive (WinZip)
23233>>&(0x3c.l+0xf8)	search/0x100	SharedD \b, Microsoft Installer self-extracting archive
23234>>0x30			string		Inno \b, InnoSetup self-extracting archive
23235
23236# If the relocation table is 0x40 or more bytes into the file, it's definitely
23237# not a DOS EXE.
23238>0x18  leshort >0x3f
23239
23240# Hmm, not a PE but the relocation table is too high for a traditional DOS exe,
23241# must be one of the unusual subformats.
23242>>(0x3c.l) string !PE\0\0 MS-DOS executable
23243!:mime	application/x-dosexec
23244
23245>>(0x3c.l)		string		NE \b, NE
23246!:mime	application/x-dosexec
23247>>>(0x3c.l+0x36)	byte		1 for OS/2 1.x
23248>>>(0x3c.l+0x36)	byte		2 for MS Windows 3.x
23249>>>(0x3c.l+0x36)	byte		3 for MS-DOS
23250>>>(0x3c.l+0x36)	byte		4 for Windows 386
23251>>>(0x3c.l+0x36)	byte		5 for Borland Operating System Services
23252>>>(0x3c.l+0x36)	default		x
23253>>>>(0x3c.l+0x36)	byte		x (unknown OS %x)
23254>>>(0x3c.l+0x36)	byte		0x81 for MS-DOS, Phar Lap DOS extender
23255>>>(0x3c.l+0x0c)	leshort&0x8000	0x8000 (DLL or font)
23256# DRV: Driver
23257# 3GR: Grabber device driver
23258# CPL: Control Panel Item
23259# VBX: Visual Basic Extension
23260# FON: Bitmap font
23261# FOT: Font resource file
23262!:ext	dll/drv/3gr/cpl/vbx/fon/fot
23263>>>(0x3c.l+0x0c)	leshort&0x8000	0 (EXE)
23264!:ext	exe/scr
23265>>>&(&0x24.s-1)		string		ARJSFX \b, ARJ self-extracting archive
23266>>>(0x3c.l+0x70)	search/0x80	WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip)
23267
23268>>(0x3c.l)		string		LX\0\0 \b, LX
23269!:mime	application/x-dosexec
23270>>>(0x3c.l+0x0a)	leshort		<1 (unknown OS)
23271>>>(0x3c.l+0x0a)	leshort		1 for OS/2
23272>>>(0x3c.l+0x0a)	leshort		2 for MS Windows
23273>>>(0x3c.l+0x0a)	leshort		3 for DOS
23274>>>(0x3c.l+0x0a)	leshort		>3 (unknown OS)
23275>>>(0x3c.l+0x10)	lelong&0x28000	=0x8000 (DLL)
23276>>>(0x3c.l+0x10)	lelong&0x20000	>0 (device driver)
23277>>>(0x3c.l+0x10)	lelong&0x300	0x300 (GUI)
23278>>>(0x3c.l+0x10)	lelong&0x28300	<0x300 (console)
23279>>>(0x3c.l+0x08)	leshort		1 i80286
23280>>>(0x3c.l+0x08)	leshort		2 i80386
23281>>>(0x3c.l+0x08)	leshort		3 i80486
23282>>>(8.s*16)		string		emx \b, emx
23283>>>>&1			string		x %s
23284>>>&(&0x54.l-3)		string		arjsfx \b, ARJ self-extracting archive
23285
23286# MS Windows system file, supposedly a collection of LE executables
23287>>(0x3c.l)		string		W3 \b, W3 for MS Windows
23288!:mime	application/x-dosexec
23289
23290>>(0x3c.l)		string		LE\0\0 \b, LE executable
23291!:mime	application/x-dosexec
23292>>>(0x3c.l+0x0a)	leshort		1
23293# some DOS extenders use LE files with OS/2 header
23294>>>>0x240		search/0x100	DOS/4G for MS-DOS, DOS4GW DOS extender
23295>>>>0x240		search/0x200	WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender
23296>>>>0x440		search/0x100	CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender
23297>>>>0x40		search/0x40	PMODE/W for MS-DOS, PMODE/W DOS extender
23298>>>>0x40		search/0x40	STUB/32A for MS-DOS, DOS/32A DOS extender (stub)
23299>>>>0x40		search/0x80	STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub)
23300>>>>0x40		search/0x80	DOS/32A for MS-DOS, DOS/32A DOS extender (embedded)
23301# this is a wild guess; hopefully it is a specific signature
23302>>>>&0x24		lelong		<0x50
23303>>>>>(&0x4c.l)		string		\xfc\xb8WATCOM
23304>>>>>>&0		search/8	3\xdbf\xb9 \b, 32Lite compressed
23305# another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP
23306#>>>>(0x3c.l+0x1c)	lelong		>0x10000 for OS/2
23307# fails with DOS-Extenders.
23308>>>(0x3c.l+0x0a)	leshort		2 for MS Windows
23309>>>(0x3c.l+0x0a)	leshort		3 for DOS
23310>>>(0x3c.l+0x0a)	leshort		4 for MS Windows (VxD)
23311# VXD: VxD for Windows 95/98/Me
23312# 386: VxD for Windows 2.10, 3.0, 3.1x
23313# PDR: Port driver
23314# MPD: Miniport driver (?)
23315!:ext	vxd/386/pdr/mpd
23316>>>(&0x7c.l+0x26)	string		UPX \b, UPX compressed
23317>>>&(&0x54.l-3)		string		UNACE \b, ACE self-extracting archive
23318
23319# looks like ASCII, probably some embedded copyright message.
23320# and definitely not NE/LE/LX/PE
23321>>0x3c		lelong	>0x20000000
23322>>>(4.s*512)	leshort !0x014c \b, MZ for MS-DOS
23323!:mime	application/x-dosexec
23324!:ext	exe/com
23325# header data too small for extended executable
23326>2		long	!0
23327>>0x18		leshort <0x40
23328>>>(4.s*512)	leshort !0x014c
23329
23330>>>>&(2.s-514)	string	!LE
23331>>>>>&-2	string	!BW \b, MZ for MS-DOS
23332!:mime	application/x-dosexec
23333>>>>&(2.s-514)	string	LE \b, LE
23334>>>>>0x240	search/0x100	DOS/4G for MS-DOS, DOS4GW DOS extender
23335# educated guess since indirection is still not capable enough for complex offset
23336# calculations (next embedded executable would be at &(&2*512+&0-2)
23337# I suspect there are only LE executables in these multi-exe files
23338>>>>&(2.s-514)	string	BW
23339>>>>>0x240	search/0x100	DOS/4G	\b, LE for MS-DOS, DOS4GW DOS extender (embedded)
23340>>>>>0x240	search/0x100	!DOS/4G	\b, BW collection for MS-DOS
23341
23342# This sequence skips to the first COFF segment, usually .text
23343>(4.s*512)	leshort		0x014c \b, COFF
23344!:mime	application/x-dosexec
23345>>(8.s*16)	string		go32stub for MS-DOS, DJGPP go32 DOS extender
23346>>(8.s*16)	string		emx
23347>>>&1		string		x for DOS, Win or OS/2, emx %s
23348>>&(&0x42.l-3)	byte		x
23349>>>&0x26	string		UPX \b, UPX compressed
23350# and yet another guess: small .text, and after large .data is unusual, could be 32lite
23351>>&0x2c		search/0xa0	.text
23352>>>&0x0b	lelong		<0x2000
23353>>>>&0		lelong		>0x6000 \b, 32lite compressed
23354
23355>(8.s*16) string $WdX \b, WDos/X DOS extender
23356
23357# By now an executable type should have been printed out.  The executable
23358# may be a self-uncompressing archive, so look for evidence of that and
23359# print it out.
23360#
23361# Some signatures below from Greg Roelofs, newt@uchicago.edu.
23362#
23363>0x35	string	\x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed
23364>0xe7	string	LH/2\ 	Self-Extract \b, %s
23365>0x1c	string	UC2X	\b, UCEXE compressed
23366>0x1c	string	WWP\ 	\b, WWPACK compressed
23367>0x1c	string	RJSX 	\b, ARJ self-extracting archive
23368>0x1c	string	diet 	\b, diet compressed
23369>0x1c	string	LZ09 	\b, LZEXE v0.90 compressed
23370>0x1c	string	LZ91 	\b, LZEXE v0.91 compressed
23371>0x1c	string	tz 	\b, TinyProg compressed
23372>0x1e	string	Copyright\ 1989-1990\ PKWARE\ Inc.	Self-extracting PKZIP archive
23373!:mime	application/zip
23374# Yes, this really is "Copr", not "Corp."
23375>0x1e	string	PKLITE\ Copr.	Self-extracting PKZIP archive
23376!:mime	application/zip
23377# winarj stores a message in the stub instead of the sig in the MZ header
23378>0x20	search/0xe0	aRJsfX \b, ARJ self-extracting archive
23379>0x20	string AIN
23380>>0x23	string 2	\b, AIN 2.x compressed
23381>>0x23	string <2	\b, AIN 1.x compressed
23382>>0x23	string >2	\b, AIN 1.x compressed
23383>0x24	string	LHa's\ SFX \b, LHa self-extracting archive
23384!:mime	application/x-lha
23385>0x24	string	LHA's\ SFX \b, LHa self-extracting archive
23386!:mime	application/x-lha
23387>0x24	string	\ $ARX \b, ARX self-extracting archive
23388>0x24	string	\ $LHarc \b, LHarc self-extracting archive
23389>0x20	string	SFX\ by\ LARC \b, LARC self-extracting archive
23390>0x40	string aPKG \b, aPackage self-extracting archive
23391>0x64	string	W\ Collis\0\0 \b, Compack compressed
23392>0x7a	string		Windows\ self-extracting\ ZIP	\b, ZIP self-extracting archive
23393>>&0xf4 search/0x140 \x0\x40\x1\x0
23394>>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive
23395>1638	string	-lh5- \b, LHa self-extracting archive v2.13S
23396>0x17888 string Rar! \b, RAR self-extracting archive
23397
23398# Skip to the end of the EXE.  This will usually work fine in the PE case
23399# because the MZ image is hardcoded into the toolchain and almost certainly
23400# won't match any of these signatures.
23401>(4.s*512)	long	x
23402>>&(2.s-517)	byte	x
23403>>>&0	string		PK\3\4 \b, ZIP self-extracting archive
23404>>>&0	string		Rar! \b, RAR self-extracting archive
23405>>>&0	string		=!\x11 \b, AIN 2.x self-extracting archive
23406>>>&0	string		=!\x12 \b, AIN 2.x self-extracting archive
23407>>>&0	string		=!\x17 \b, AIN 1.x self-extracting archive
23408>>>&0	string		=!\x18 \b, AIN 1.x self-extracting archive
23409>>>&7	search/400	**ACE** \b, ACE self-extracting archive
23410>>>&0	search/0x480	UC2SFX\ Header \b, UC2 self-extracting archive
23411
23412# a few unknown ZIP sfxes, no idea if they are needed or if they are
23413# already captured by the generic patterns above
23414>(8.s*16)	search/0x20	PKSFX \b, ZIP self-extracting archive (PKZIP)
23415# TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive
23416#
23417
23418# TELVOX Teleinformatica CODEC self-extractor for OS/2:
23419>49801	string	\x79\xff\x80\xff\x76\xff	\b, CODEC archive v3.21
23420>>49824 leshort		=1			\b, 1 file
23421>>49824 leshort		>1			\b, %u files
23422
23423# added by Joerg Jenderek of https://www.freedos.org/software/?prog=kc
23424# and https://www.freedos.org/software/?prog=kpdos
23425# for FreeDOS files like KEYBOARD.SYS, KEYBRD2.SYS, KEYBRD3.SYS, *.KBD
234260	string/b	KCF		FreeDOS KEYBoard Layout collection
23427# only version=0x100 found
23428>3	uleshort	x		\b, version 0x%x
23429# length of string containing author,info and special characters
23430>6	ubyte		>0
23431#>>6	pstring		x		\b, name=%s
23432>>7	string		>\0		\b, author=%-.14s
23433>>7	search/254	\xff		\b, info=
23434#>>>&0	string		x		\b%-s
23435>>>&0	string		x		\b%-.15s
23436# for FreeDOS *.KL files
234370	string/b	KLF		FreeDOS KEYBoard Layout file
23438# only version=0x100 or 0x101 found
23439>3	uleshort	x		\b, version 0x%x
23440# stringlength
23441>5	ubyte		>0
23442>>8	string		x		\b, name=%-.2s
234430	string	\xffKEYB\ \ \ \0\0\0\0
23444>12	string	\0\0\0\0`\004\360	MS-DOS KEYBoard Layout file
23445
23446# DOS device driver updated by Joerg Jenderek at May 2011,Mar 2017,Aug 2020
23447# URL:		http://fileformats.archiveteam.org/wiki/DOS_device_driver
23448# Reference:	http://www.delorie.com/djgpp/doc/rbinter/it/46/16.html
23449# https://amaus.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009
234500	ulequad&0x07a0ffffffff		0xffffffff
23451# skip OS/2 INI ./os2
23452>4  ubelong   !0x14000000
23453>>0	use				msdos-driver
234540       name    			msdos-driver		DOS executable (
23455#!:mime	application/octet-stream
23456!:mime	application/x-dosdriver
23457# also found FreeDOS print driver SPOOL.DEV and disc compression driver STACLOAD.BIN
23458# and IBM Token-Ring adapter IBMTOK.DOS. Why and when DOS instead SYS is used?
23459# PROTMAN.DOS ELNKPL.DOS
23460!:ext	sys/dev/bin/dos
23461# 1 space char after "UPX compressed" to get phrase like "UPX compressed character device"
23462>40	search/7			UPX!			\bUPX compressed\040
23463# DOS device driver attributes
23464>4	uleshort&0x8000			0x0000			\bblock device driver
23465# character device
23466>4	uleshort&0x8000			0x8000			\b
23467# 1 space char after "clock" to get phrase like "clock character device driver CLOCK$"
23468>>4	uleshort&0x0008			0x0008			\bclock\040
23469# fast video output by int 29h
23470# 1 space char after "fast" to get phrase like "fast standard input/output character device driver"
23471>>4	uleshort&0x0010			0x0010			\bfast\040
23472# standard input/output device
23473# 1 space char after "standard" to get phrase like "standard input/output character device driver"
23474>>4	uleshort&0x0003			>0			\bstandard\040
23475>>>4	uleshort&0x0001			0x0001			\binput
23476>>>4	uleshort&0x0003			0x0003			\b/
23477# 1 space char after "output" to get phrase like "input/output character device driver"
23478>>>4	uleshort&0x0002			0x0002			\boutput\040
23479>>4	uleshort&0x8000			0x8000			\bcharacter device driver
23480>0	ubyte				x
23481# upx compressed device driver has garbage instead of real in name field of header
23482>>40	search/7			UPX!
23483>>40	default				x
23484# leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped
23485# 1 space char before device driver name to get phrase like "device driver PROTMAN$"
23486>>>12		ubyte			>0x2E			\b\040
23487>>>>10		ubyte			>0x20
23488>>>>>10		ubyte			!0x2E
23489>>>>>>10	ubyte			!0x2A			\b%c
23490>>>>11		ubyte			>0x20
23491>>>>>11		ubyte			!0x2E			\b%c
23492>>>>12		ubyte			>0x20
23493>>>>>12		ubyte			!0x39
23494>>>>>>12	ubyte			!0x2E			\b%c
23495>>>13		ubyte			>0x20
23496>>>>13		ubyte			!0x2E			\b%c
23497>>>>14		ubyte			>0x20
23498>>>>>14		ubyte			!0x2E			\b%c
23499>>>>15		ubyte			>0x20
23500>>>>>15		ubyte			!0x2E			\b%c
23501>>>>16		ubyte			>0x20
23502>>>>>16		ubyte			!0x2E
23503>>>>>>16	ubyte			<0xCB			\b%c
23504>>>>17		ubyte			>0x20
23505>>>>>17		ubyte			!0x2E
23506>>>>>>17	ubyte			<0x90			\b%c
23507# some character device drivers like ASPICD.SYS, btcdrom.sys and Cr_atapi.sys contain only spaces or points in name field
23508>>>12		ubyte			<0x2F
23509# they have their real name at offset 22
23510# also block device drivers like DUMBDRV.SYS
23511>>>>22		string			>\056			%-.6s
23512>4	uleshort&0x8000			0x0000
23513# 32 bit sector addressing ( > 32 MB) for block devices
23514>>4	uleshort&0x0002			0x0002			\b,32-bit sector-
23515# support by driver functions 13h, 17h, 18h
23516>4	uleshort&0x0040			0x0040			\b,IOCTL-
23517# open, close, removable media support by driver functions 0Dh, 0Eh, 0Fh
23518>4	uleshort&0x0800			0x0800			\b,close media-
23519# output until busy support by int 10h for character device driver
23520>4	uleshort&0x8000			0x8000
23521>>4	uleshort&0x2000			0x2000			\b,until busy-
23522# direct read/write support by driver functions 03h,0Ch
23523>4	uleshort&0x4000			0x4000			\b,control strings-
23524>4	uleshort&0x8000			0x8000
23525>>4	uleshort&0x6840			>0			\bsupport
23526>4	uleshort&0x8000			0x0000
23527>>4	uleshort&0x4842			>0			\bsupport
23528>0	ubyte				x			\b)
23529>0	ulelong				!0xffffffff		with pointer 0x%x
23530# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header
235310	ulequad				0x0513c00000000012
23532>0	use				msdos-driver
23533# DOS drivers DC2975.SYS, DUMBDRV.SYS, ECHO.SYS has also none 0xffffffff for pointer field
235340	ulequad				0x32f28000ffff0016
23535>0	use				msdos-driver
235360	ulequad				0x007f00000000ffff
23537>0	use				msdos-driver
23538# https://www.uwe-sieber.de/files/cfg_echo.zip
235390	ulequad				0x001600000000ffff
23540>0	use				msdos-driver
23541# DOS drivers LS120.SYS, MKELS120.SYS use reserved bits of attribute field
235420	ulequad				0x0bf708c2ffffffff
23543>0	use				msdos-driver
235440	ulequad				0x07bd08c2ffffffff
23545>0	use				msdos-driver
23546# 3Com EtherLink 3C501 CID\SERVER\IBMLS\IBM500D1\DLSNETDR.ZIP\ELNK.DOS
235470	ulequad				0x027ac0c0ffffffff
23548>0	use				msdos-driver
23549# IBM Streamer CID\SERVER\IBMLS\IBM500D1\DLSNETDR.ZIP\IBMMPC.DOS
235500	ulequad				0x00228880ffffffff
23551>0	use				msdos-driver
23552
23553# updated by Joerg Jenderek
23554# GRR: line below too general as it catches also
23555# rt.lib DYADISKS.PIC and many more
23556# start with assembler instruction MOV
235570	ubyte		0x8c
23558# skip "AppleWorks word processor data" like ARTICLE.1 ./apple
23559>4	string			!O====
23560# skip some unknown basic binaries like RocketRnger.SHR
23561>>5	string			!MAIN
23562# skip "GPG symmetrically encrypted data" ./gnu
23563# skip "PGP symmetric key encrypted data" ./pgp
23564# openpgpdefs.h: fourth byte < 14 indicate cipher algorithm type
23565>>>4	ubyte			>13	DOS executable (COM, 0x8C-variant)
23566# the remaining files should be DOS *.COM executables
23567# dosshell.COM	8cc0 2ea35f07 e85211 e88a11 b80058 cd
23568# hmload.COM	8cc8 8ec0 bbc02b 89dc 83c30f c1eb04 b4
23569# UNDELETE.COM	8cca 2e8916 6503 b430 cd21 8b 2e0200 8b
23570# BOOTFIX.COM	8cca 2e8916 9603 b430 cd21 8b 2e0200 8b
23571# RAWRITE3.COM	8cca 2e8916 d602 b430 cd21 8b 2e0200 8b
23572# SHARE.COM	8cca 2e8916 d602 b430 cd21 8b 2e0200 8b
23573# validchr.COM	8cca 2e8916 9603 b430 cd21 8b 2e028b1e
23574# devload.COM	8cca 8916ad01 b430 cd21 8b2e0200 892e
23575!:mime	application/x-dosexec
23576!:ext com
23577
23578# updated by Joerg Jenderek at Oct 2008
235790	ulelong		0xffff10eb	DR-DOS executable (COM)
23580# byte 0xeb conflicts with "sequent" magic leshort 0xn2eb
235810	ubeshort&0xeb8d	>0xeb00
23582# DR-DOS STACKER.COM SCREATE.SYS missed
23583
235840       name    msdos-com
23585>0  byte        x               DOS executable (COM)
23586!:mime	application/x-dosexec
23587!:ext	com
23588>6	string		SFX\ of\ LHarc	\b, %s
23589>0x1FE leshort	0xAA55		    \b, boot code
23590>85	string		UPX		        \b, UPX compressed
23591>4	string		\ $ARX		    \b, ARX self-extracting archive
23592>4	string		\ $LHarc	    \b, LHarc self-extracting archive
23593>0x20e string	SFX\ by\ LARC	\b, LARC self-extracting archive
23594
23595# JMP 8bit
235960	        byte	0xeb
23597# allow forward jumps only
23598>1          byte    >-1
23599# that offset must be accessible
23600>>(1.b+2)   byte    x
23601>>>0        use msdos-com
23602
23603# JMP 16bit
236040           byte    0xe9
23605# forward jumps
23606>1          short   >-1
23607# that offset must be accessible
23608>>(1.s+3)   byte    x
23609>>>0        use msdos-com
23610# negative offset, must not lead into PSP
23611>1          short   <-259
23612# that offset must be accessible
23613>>(1,s+65539)   byte    x
23614>>>0        use msdos-com
23615
23616# updated by Joerg Jenderek at Oct 2008,2015
23617# following line is too general
236180	ubyte		0xb8
23619# skip 2 linux kernels like memtest.bin with "\xb8\xc0\x07\x8e" in ./linux
23620>0	string		!\xb8\xc0\x07\x8e
23621# modified by Joerg Jenderek
23622# syslinux COM32 or COM32R executable
23623>>1	lelong&0xFFFFFFFe 0x21CD4CFe	COM executable (32-bit COMBOOT
23624# https://www.syslinux.org/wiki/index.php/Comboot_API
23625# Since version 5.00 c32 modules switched from the COM32 object format to ELF
23626!:mime	application/x-c32-comboot-syslinux-exec
23627!:ext c32
23628# https://syslinux.zytor.com/comboot.php
23629# older syslinux version ( <4 )
23630# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode
23631# start with assembler instructions mov eax,21cd4cffh
23632>>>1	lelong		0x21CD4CFf	\b)
23633# syslinux:doc/comboot.txt
23634# A COM32R program must start with the byte sequence B8 FE 4C CD 21 (mov
23635# eax,21cd4cfeh) as a magic number.
23636# syslinux version (4.x)
23637# "COM executable (COM32R)" or "Syslinux COM32 module" by TrID
23638>>>1	lelong		0x21CD4CFe	\b, relocatable)
23639# Hajin Jang <hajin_jang@worksmobile.com>:
23640# Disable simplest COM signature to prevent false positive on some EUC-KR text files.
23641## remaining are DOS COM executables starting with assembler instruction MOV
23642## like FreeDOS BANNER*.COM FINDDISK.COM GIF2RAW.COM WINCHK.COM
23643## MS-DOS SYS.COM RESTART.COM
23644## SYSLINUX.COM (version 1.40 - 2.13)
23645## GFXBOOT.COM (version 3.75)
23646## COPYBS.COM POWEROFF.COM INT18.COM
23647#>>1	default	x			COM executable for DOS
23648#!:mime	application/x-dosexec
23649##!:mime	application/x-ms-dos-executable
23650##!:mime	application/x-msdos-program
23651#!:ext com
23652
23653# URL:		https://en.wikipedia.org/wiki/UPX
23654# Reference:	https://github.com/upx/upx/archive/v3.96.zip/upx-3.96/
23655#		src/stub/src/i086-dos16.com.S
23656# Update:	Joerg Jenderek
23657# assembler instructions: cmp sp, offset sp_limit
236580	string/b	\x81\xfc
23659#>2	uleshort	x		\b, sp_limit=0x%x
23660# assembler instructions: jump above +2; int 0x20; mov cx, offset bytes_to_copy
23661>4	string	\x77\x02\xcd\x20\xb9
23662#>9	uleshort	x		\b, [bytes_to_copy]=0x%x
23663# at different offsets assembler instructions: push di; jump decomp_start_n2b
23664>0x1e	search/3	\x57\xe9
23665#>>&0	uleshort	x		\b, decomp_start_n2b=0x%x
23666# src/stub/src/include/header.S; UPX_MAGIC_LE32
23667>>&2	string		UPX!		FREE-DOS executable (COM), UPX
23668!:mime	application/x-dosexec
23669# UPX compressed *.CPI; See ./fonts
23670>>>&21	string		=FONT		compressed DOS code page font
23671!:ext	cpx
23672>>>&21	string		!FONT		compressed
23673!:ext	com
23674# compressed size?
23675#>>>&14	uleshort+152	x		\b, %u bytes
23676# uncompressed len
23677>>>&12	uleshort	x		\b, uncompressed %u bytes
23678252	string Must\ have\ DOS\ version DR-DOS executable (COM)
23679!:mime	application/x-dosexec
23680!:ext	com
23681# GRR search is not working
23682#2	search/28	\xcd\x21	COM executable for MS-DOS
23683#WHICHFAT.cOM
236842	string	\xcd\x21		COM executable for DOS
23685!:mime	application/x-dosexec
23686!:ext	com
23687#DELTREE.cOM DELTREE2.cOM
236884	string	\xcd\x21		COM executable for DOS
23689!:mime	application/x-dosexec
23690!:ext	com
23691#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM
236925	string	\xcd\x21		COM executable for DOS
23693!:mime	application/x-dosexec
23694!:ext	com
23695#DELTMP.COm HASFAT32.cOM
236967	string	\xcd\x21
23697>0	byte	!0xb8			COM executable for DOS
23698!:mime	application/x-dosexec
23699!:ext	com
23700#COMP.cOM MORE.COm
2370110	string	\xcd\x21
23702>5	string	!\xcd\x21		COM executable for DOS
23703!:mime	application/x-dosexec
23704!:ext	com
23705#comecho.com
2370613	string	\xcd\x21		COM executable for DOS
23707!:mime	application/x-dosexec
23708!:ext	com
23709#HELP.COm EDIT.coM
2371018	string	\xcd\x21		COM executable for MS-DOS
23711!:mime	application/x-dosexec
23712!:ext	com
23713#NWRPLTRM.COm
2371423	string	\xcd\x21		COM executable for MS-DOS
23715!:mime	application/x-dosexec
23716!:ext	com
23717#LOADFIX.cOm LOADFIX.cOm
2371830	string	\xcd\x21		COM executable for MS-DOS
23719!:mime	application/x-dosexec
23720!:ext	com
23721#syslinux.com 3.11
2372270	string	\xcd\x21		COM executable for DOS
23723!:mime	application/x-dosexec
23724!:ext	com
23725# many compressed/converted COMs start with a copy loop instead of a jump
237260x6	search/0xa	\xfc\x57\xf3\xa5\xc3	COM executable for MS-DOS
23727!:mime	application/x-dosexec
23728!:ext	com
237290x6	search/0xa	\xfc\x57\xf3\xa4\xc3	COM executable for DOS
23730!:mime	application/x-dosexec
23731!:ext	com
23732>0x18	search/0x10	\x50\xa4\xff\xd5\x73	\b, aPack compressed
237330x3c	string		W\ Collis\0\0		COM executable for MS-DOS, Compack compressed
23734!:mime	application/x-dosexec
23735!:ext	com
23736# FIXME: missing diet .com compression
23737
23738# miscellaneous formats
237390	string/b	LZ		MS-DOS executable (built-in)
23740#0	byte		0xf0		MS-DOS program library data
23741#
23742
23743# AAF files:
23744# <stuartc@rd.bbc.co.uk> Stuart Cunningham
237450	string/b	\320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377			AAF legacy file using MS Structured Storage
23746>30	byte	9		(512B sectors)
23747>30	byte	12		(4kB sectors)
237480	string/b	\320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001			AAF file using MS Structured Storage
23749>30	byte	9		(512B sectors)
23750>30	byte	12		(4kB sectors)
23751
23752# Popular applications
23753#
23754# Update:	Joerg Jenderek
23755# URL:		http://fileformats.archiveteam.org/wiki/DOC
23756# Reference:	https://web.archive.org/web/20170206041048/
23757#		http://www.msxnet.org/word2rtf/formats/ffh-dosword5
23758# wIdent+dty
237590	belong	0x31be0000
23760# skip droid skeleton like x-fmt-274-signature-id-488.doc
23761>128	ubyte		>0  			Microsoft
23762>>96	uleshort	=0			Word
23763!:mime	application/msword
23764!:apple	MSWDWDBN
23765# DCX is used in the Unix version.
23766!:ext	doc/dcx
23767>>>0x6E	ulequad		=0			1.0-4.0
23768>>>0x6E	ulequad		!0			5.0-6.0
23769>>>0x6E	ulequad		x			(DOS) Document
23770# https://web.archive.org/web/20130831064118/http://msxnet.org/word2rtf/formats/write.txt
23771>>96	uleshort	!0			Write 3.0 (Windows) Document
23772!:mime	application/x-mswrite
23773!:apple	MSWDWDBN
23774# sometimes also doc like in splitter.doc srchtest.doc
23775!:ext	wri/doc
23776# wTool must be 0125400 octal
23777#>>4	uleshort	!0xAB00			\b, wTool %o
23778# reserved; must be zero
23779#>>6	ulelong		!0			\b, reserved %u
23780# block pointer to the block containing optional file manager information
23781#>>0x1C	uleshort	x			\b, at 0x%x info block
23782# jump to File manager information block
23783>>(0x1C.s*128)	uleshort x
23784# test for valid information start; maybe also 0012h
23785>>>&-2		uleshort	=0x0014
23786# Document ASCIIZ name
23787>>>>&0x12	string		x		%s
23788# author name
23789>>>>>&1		string		x		\b, author %s
23790# reviser name
23791>>>>>>&1	string		x		\b, reviser %s
23792# keywords
23793>>>>>>>&1	string		x		\b, keywords %s
23794# comment
23795>>>>>>>>&1	string		x		\b, comment %s
23796# version number
23797>>>>>>>>>&1	string		x		\b, version %s
23798# date of last change MM/DD/YY
23799>>>>>>>>>>&1	string		x		\b, %-.8s
23800# creation date MM/DD/YY
23801>>>>>>>>>>&9	string		x		created %-.8s
23802# file name of print format like NORMAL.STY
23803>>0x1E	string		>0			\b, formatted by %-.66s
23804# count of pages in whole file for write variant; maybe some times wrong
23805>>96	uleshort	>0			\b, %u pages
23806# name of the printer driver like HPLASMS
23807>>0x62	string		>0			\b, %-.8s printer
23808# number of blocks used in the file; seems to be 0 for Word 4.0 and Write 3.0
23809>>0x6A	uleshort	>0			\b, %u blocks
23810# bit field for corrected text areas
23811#>>0x6C	uleshort	x			\b, 0x%x bit field
23812# text of document; some times start with 4 non printable characters like CR LF
23813>>128	ubyte		x			\b,
23814>>>128		ubyte	>0x1F
23815>>>>128		string	x			%s
23816>>>128		ubyte	<0x20
23817>>>>129		ubyte	>0x1F
23818>>>>>129	string	x			%s
23819>>>>129		ubyte	<0x20
23820>>>>>130	ubyte	>0x1F
23821>>>>>>130	string	x			%s
23822>>>>>130	ubyte	<0x20
23823>>>>>>131	ubyte	>0x1F
23824>>>>>>>131	string	x			%s
23825>>>>>>131	ubyte	<0x20
23826>>>>>>>132	ubyte	>0x1F
23827>>>>>>>>132	string	x			%s
23828>>>>>>>132	ubyte	<0x20
23829>>>>>>>>133	ubyte	>0x1F
23830>>>>>>>>>133	string	x			%s
23831#
238320	string/b	PO^Q`				Microsoft Word 6.0 Document
23833!:mime	application/msword
23834#
238354   long        0
23836>0  belong      0xfe320000      Microsoft Word for Macintosh 1.0
23837!:mime	application/msword
23838!:ext   mcw
23839>0  belong      0xfe340000      Microsoft Word for Macintosh 3.0
23840!:mime	application/msword
23841!:ext   mcw
23842>0  belong      0xfe37001c      Microsoft Word for Macintosh 4.0
23843!:mime	application/msword
23844!:ext   mcw
23845>0  belong      0xfe370023      Microsoft Word for Macintosh 5.0
23846!:mime	application/msword
23847!:ext   mcw
23848
238490	string/b	\333\245-\0\0\0			Microsoft Word 2.0 Document
23850!:mime	application/msword
23851!:ext   doc
23852# Note: seems already recognized as "OLE 2 Compound Document" in ./ole2compounddocs
23853#512	string/b	\354\245\301			Microsoft Word Document
23854#!:mime	application/msword
23855
23856#
238570	string/b	\xDB\xA5\x2D\x00		Microsoft WinWord 2.0 Document
23858!:mime application/msword
23859#
238600	string/b	\xDB\xA5\x2D\x00		Microsoft WinWord 2.0 Document
23861!:mime application/msword
23862
23863#
238640	string/b	\x09\x04\x06\x00\x00\x00\x10\x00	Microsoft Excel Worksheet
23865!:mime	application/vnd.ms-excel
23866# https://www.macdisk.com/macsigen.php
23867!:apple	XCELXLS4
23868!:ext	xls
23869#
23870# Update: Joerg Jenderek
23871# URL: https://en.wikipedia.org/wiki/Lotus_1-2-3
23872# Reference: http://www.aboutvb.de/bas/formate/pdf/wk3.pdf
23873# Note: newer Lotus versions >2 use longer BOF record
23874# record type (BeginningOfFile=0000h) + length (001Ah)
238750	belong	0x00001a00
23876# reserved should be 0h but 8c0dh for TUTMAC.WK3, 5h for SAMPADNS.WK3, 1h for a_readme.wk3, 1eh for K&G86.WK3
23877#>18	uleshort&0x73E0	0
23878# Lotus Multi Byte Character Set (LMBCS=1-31)
23879>20	ubyte		>0
23880>>20	ubyte		<32	Lotus 1-2-3
23881#!:mime	application/x-123
23882!:mime	application/vnd.lotus-1-2-3
23883!:apple	????L123
23884# (version 5.26) labeled the entry as "Lotus 1-2-3 wk3 document data"
23885>>>4	uleshort	0x1000	WorKsheet, version 3
23886!:ext	wk3
23887# (version 5.26) labeled the entry as "Lotus 1-2-3 wk4 document data"
23888>>>4	uleshort	0x1002	WorKsheet, version 4
23889# also worksheet template 4 (.wt4)
23890!:ext	wk4/wt4
23891# no example or documentation for wk5
23892#>>4	uleshort	0x????	WorKsheet, version 4
23893#!:ext	wk5
23894# only MacrotoScript.123 example
23895>>>4	uleshort	0x1003	WorKsheet, version 97
23896# also worksheet template Smartmaster (.12M)?
23897!:ext	123
23898# only Set_Y2K.123 example
23899>>>4	uleshort	0x1005	WorKsheet, version 9.8 Millennium
23900!:ext	123
23901# no example for this version
23902>>>4	uleshort	0x8001	FoRMatting data
23903!:ext	frm
23904# (version 5.26) labeled the entry as "Lotus 1-2-3 fm3 or fmb document data"
23905# TrID labeles the entry as "Formatting Data for Lotus 1-2-3 worksheet"
23906>>>4	uleshort	0x8007	ForMatting data, version 3
23907!:ext	fm3
23908>>>4	default		x	unknown
23909# file revision sub code 0004h for worksheets
23910>>>>6	uleshort	=0x0004	worksheet
23911!:ext	wXX
23912>>>>6	uleshort	!0x0004	formatting data
23913!:ext	fXX
23914# main revision number
23915>>>>4	uleshort	x	\b, revision 0x%x
23916>>>6	uleshort	=0x0004	\b, cell range
23917# active cellcoord range (start row, page,column ; end row, page, column)
23918# start values normally 0~1st sheet A1
23919>>>>8	ulelong		!0
23920>>>>>10	ubyte		>0	\b%d*
23921>>>>>8	uleshort	x	\b%d,
23922>>>>>11	ubyte		x	\b%d-
23923# end page mostly 0
23924>>>>14	ubyte		>0	\b%d*
23925# end raw, column normally not 0
23926>>>>12	uleshort	x	\b%d,
23927>>>>15	ubyte		x	\b%d
23928# Lotus Multi Byte Character Set (1~cp850,2~cp851,...,16~japan,...,31~??)
23929>>>>20	ubyte		>1	\b, character set 0x%x
23930# flags
23931>>>>21	ubyte		x	\b, flags 0x%x
23932>>>6	uleshort	!0x0004
23933# record type (FONTNAME=00AEh)
23934>>>>30	search/29	\0\xAE
23935# variable length m (2) + entries (1) + ?? (1) + LCMBS string (n)
23936>>>>>&4	string		>\0	\b, 1st font "%s"
23937#
23938# Update: Joerg Jenderek
23939# URL: http://fileformats.archiveteam.org/wiki/Lotus_1-2-3
23940# Reference: http://www.schnarff.com/file-formats/lotus-1-2-3/WSFF2.TXT
23941# Note: Used by both old Lotus 1-2-3 and Lotus Symphony (DOS) til version 2.x
23942# record type (BeginningOfFile=0000h) + length (0002h)
239430	belong	0x00000200
23944# GRR: line above is too general as it catches also MS Windows CURsor
23945# to display MS Windows cursor (strength=70) before Lotus 1-2-3 (strength=70-1)
23946!:strength -1
23947# skip Windows cursors with image height <256 and keep Lotus with low opcode 0001-0083h
23948>7	ubyte		0
23949# skip Windows cursors with image width 256 and keep Lotus with positive opcode
23950>>6	ubyte		>0	Lotus
23951# !:mime	application/x-123
23952!:mime	application/vnd.lotus-1-2-3
23953!:apple	????L123
23954# revision number (0404h = 123 1A, 0405h = Lotus Symphony , 0406h = 123 2.x wk1 , 8006h = fmt , ...)
23955# undocumented; (version 5.26) labeled the configurations as "Lotus 1-2-3"
23956>>>4	uleshort	0x0007	1-2-3 CoNFiguration, version 2.x (PGRAPH.CNF)
23957!:ext	cnf
23958>>>4	uleshort	0x0C05	1-2-3 CoNFiguration, version 2.4J
23959!:ext	cnf
23960>>>4	uleshort	0x0801	1-2-3 CoNFiguration, version 1-2.1
23961!:ext	cnf
23962>>>4	uleshort	0x0802	Symphony CoNFiguration
23963!:ext	cnf
23964>>>4	uleshort	0x0804	1-2-3 CoNFiguration, version 2.2
23965!:ext	cnf
23966>>>4	uleshort	0x080A	1-2-3 CoNFiguration, version 2.3-2.4
23967!:ext	cnf
23968>>>4	uleshort	0x1402	1-2-3 CoNFiguration, version 3.x
23969!:ext	cnf
23970>>>4	uleshort	0x1450	1-2-3 CoNFiguration, version 4.x
23971!:ext	cnf
23972# (version 5.26) labeled the entry as "Lotus 123"
23973# TrID labeles the entry as "Lotus 123 Worksheet (generic)"
23974>>>4	uleshort	0x0404	1-2-3 WorKSheet, version 1
23975# extension "wks" also for Microsoft Works document
23976!:ext	wks
23977# (version 5.26) labeled the entry as "Lotus 123"
23978# TrID labeles the entry as "Lotus 123 Worksheet (generic)"
23979>>>4	uleshort	0x0405	Symphony WoRksheet, version 1.0
23980!:ext	wrk/wr1
23981# (version 5.26) labeled the entry as "Lotus 1-2-3 wk1 document data"
23982# TrID labeles the entry as "Lotus 123 Worksheet (V2)"
23983>>>4	uleshort	0x0406	1-2-3/Symphony worksheet, version 2
23984# Symphony (.wr1)
23985!:ext	wk1/wr1
23986# no example for this japan version
23987>>>4	uleshort	0x0600	1-2-3 WorKsheet, version 1.xJ
23988!:ext	wj1
23989# no example or documentation for wk2
23990#>>>4	uleshort	0x????	1-2-3 WorKsheet, version 2
23991#!:ext	wk2
23992# undocumented japan version
23993>>>4	uleshort	0x0602	1-2-3 worksheet, version 2.4J
23994!:ext	wj3
23995# (version 5.26) labeled the entry as "Lotus 1-2-3 fmt document data"
23996>>>4	uleshort	0x8006	1-2-3 ForMaTting data, version 2.x
23997# japan version 2.4J (fj3)
23998!:ext	fmt/fj3
23999# no example for this version
24000>>>4	uleshort	0x8007	1-2-3 FoRMatting data, version 2.0
24001!:ext	frm
24002# (version 5.26) labeled the entry as "Lotus 1-2-3"
24003>>>4	default		x	unknown worksheet or configuration
24004!:ext	cnf
24005>>>>4	uleshort	x	\b, revision 0x%x
24006# 2nd record for most worksheets describes cells range
24007>>>6		use	lotus-cells
24008# 3rd record for most japan worksheets describes cells range
24009>>>(8.s+10)	use	lotus-cells
24010#	check and then display Lotus worksheet cells range
240110	name		lotus-cells
24012# look for type (RANGE=0006h) + length (0008h) at record begin
24013>0	ubelong	0x06000800	\b, cell range
24014# cell range (start column, row, end column, row) start values normally 0,0~A1 cell
24015>>4	ulong		!0
24016>>>4	uleshort	x	\b%d,
24017>>>6	uleshort	x	\b%d-
24018# end of cell range
24019>>8	uleshort	x	\b%d,
24020>>10	uleshort	x	\b%d
24021# EndOfLotus123
240220	string/b		WordPro\0	Lotus WordPro
24023!:mime	application/vnd.lotus-wordpro
240240	string/b		WordPro\r\373	Lotus WordPro
24025!:mime	application/vnd.lotus-wordpro
24026
24027
24028# Summary: Script used by InstallScield to uninstall applications
24029# Extension: .isu
24030# Submitted by: unknown
24031# Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry)
240320		string		\x71\xa8\x00\x00\x01\x02
24033>12		string		Stirling\ Technologies,		InstallShield Uninstall Script
24034
24035# Winamp .avs
24036#0	string	Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player
240370	string/b	Nullsoft\ AVS\ Preset\ 	Winamp plug in
24038
24039# Windows Metafile .WMF
240400	string/b	\327\315\306\232	Windows metafile
24041!:mime	image/wmf
24042!:ext	wmf
240430	string/b	\002\000\011\000	Windows metafile
24044!:mime	image/wmf
24045!:ext	wmf
240460	string/b	\001\000\011\000	Windows metafile
24047!:mime	image/wmf
24048!:ext	wmf
24049
24050#tz3 files whatever that is (MS Works files)
240510	string/b	\003\001\001\004\070\001\000\000	tz3 ms-works file
240520	string/b	\003\002\001\004\070\001\000\000	tz3 ms-works file
240530	string/b	\003\003\001\004\070\001\000\000	tz3 ms-works file
24054
24055# PGP sig files .sig
24056#0 string \211\000\077\003\005\000\063\237\127 065 to  \027\266\151\064\005\045\101\233\021\002 PGP sig
240570 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig
240580 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig
240590 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig
240600 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig
240610 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig
240620 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig
24063
24064# windows zips files .dmf
240650	string/b	MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file
24066
24067# Windows icons
24068# Update: Joerg Jenderek
24069# URL: https://en.wikipedia.org/wiki/CUR_(file_format)
24070# Note: similar to Windows CURsor. container for BMP (only DIB part) or PNG
240710   belong  0x00000100
24072>9  byte    0
24073>>0 byte    x
24074>>0 use     cur-ico-dir
24075>9  ubyte   0xff
24076>>0 byte    x
24077>>0 use     cur-ico-dir
24078#	displays number of icons and information for icon or cursor
240790	name		cur-ico-dir
24080# skip some Lotus 1-2-3 worksheets, CYCLE.PIC and keep Windows cursors with
24081# 1st data offset = dir header size + n * dir entry size = 6 + n * 10h = ?6h
24082>18		ulelong		&0x00000006
24083# skip remaining worksheets, because valid only for DIB image (40) or PNG image (\x89PNG)
24084>>(18.l)	ulelong		x		MS Windows
24085>>>0		ubelong		0x00000100	icon resource
24086# https://www.iana.org/assignments/media-types/image/vnd.microsoft.icon
24087!:mime		image/vnd.microsoft.icon
24088#!:mime		image/x-icon
24089!:ext		ico
24090>>>>4 		uleshort	x		- %d icon
24091# plural s
24092>>>>4 		uleshort	>1		\bs
24093# 1st icon
24094>>>>0x06	use		ico-entry
24095# 2nd icon
24096>>>>4 		uleshort	>1
24097>>>>>0x16	use		ico-entry
24098>>>0		ubelong		0x00000200	cursor resource
24099#!:mime		image/x-cur
24100!:mime		image/x-win-bitmap
24101!:ext		cur
24102>>>>4 		uleshort	x		- %d icon
24103>>>>4 		uleshort	>1		\bs
24104# 1st cursor
24105>>>>0x06	use		cur-entry
24106#>>>>0x16	use		cur-entry
24107#	display information of one cursor entry
241080	name		cur-entry
24109>0	use		cur-ico-entry
24110>4	uleshort	x	\b, hotspot @%dx
24111>6	uleshort	x	\b%d
24112#	display information of one icon entry
241130	name		ico-entry
24114>0			use	cur-ico-entry
24115# normally 0 1 but also found 14
24116>4	uleshort	>1	\b, %d planes
24117# normally 0 1 but also found some 3, 4, some 6, 8, 24, many 32, two 256
24118>6	uleshort	>1	\b, %d bits/pixel
24119#	display shared information of cursor or icon entry
241200		name		cur-ico-entry
24121>0		byte		=0		\b, 256x
24122>0		byte		!0		\b, %dx
24123>1		byte        	=0		\b256
24124>1		byte        	!0		\b%d
24125# number of colors in palette
24126>2		ubyte		!0		\b, %d colors
24127# reserved 0 FFh
24128#>3		ubyte        	x		\b, reserved %x
24129#>8		ulelong		x		\b, image size %d
24130# offset of PNG or DIB image
24131#>12		ulelong		x		\b, offset 0x%x
24132# PNG header (\x89PNG)
24133>(12.l)		ubelong		=0x89504e47
24134# 1 space char after "with" to get phrase "with PNG image" by magic in ./images
24135>>&-4		indirect	x	\b with\040
24136# DIB image
24137>(12.l)		ubelong		!0x89504e47
24138#>>&-4		use     	dib-image
24139
24140# Windows non-animated cursors
24141# Update: Joerg Jenderek
24142# URL: https://en.wikipedia.org/wiki/CUR_(file_format)
24143# Note: similar to Windows ICOn. container for BMP ( only DIB part)
24144# GRR: line below is too general as it catches also Lotus 1-2-3 files
241450   belong  0x00000200
24146>9  byte    0
24147>>0 use     cur-ico-dir
24148>9  ubyte   0xff
24149>>0 use     cur-ico-dir
24150
24151# .chr files
241520	string/b	PK\010\010BGI	Borland font
24153>4	string	>\0	%s
24154# then there is a copyright notice
24155
24156
24157# .bgi files
241580	string/b	pk\010\010BGI	Borland device
24159>4	string	>\0	%s
24160# then there is a copyright notice
24161
24162
24163# Windows Recycle Bin record file (named INFO2)
24164# By Abel Cheung (abelcheung AT gmail dot com)
24165# Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes
24166# Since Vista uses another structure, INFO2 structure probably won't change
24167# anymore. Detailed analysis in:
24168# http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf
241690	lelong		0x00000004
24170>12	lelong		0x00000118	Windows Recycle Bin INFO2 file (Win98 or below)
24171
241720	lelong		0x00000005
24173>12	lelong		0x00000320	Windows Recycle Bin INFO2 file (Win2k - WinXP)
24174
24175# From Doug Lee via a FreeBSD pr
241769	string		GERBILDOC	First Choice document
241779	string		GERBILDB	First Choice database
241789	string		GERBILCLIP	First Choice database
241790	string		GERBIL		First Choice device file
241809	string		RABBITGRAPH	RabbitGraph file
241810	string		DCU1		Borland Delphi .DCU file
241820	string		=!<spell>	MKS Spell hash list (old format)
241830	string		=!<spell2>	MKS Spell hash list
24184# Too simple - MPi
24185#0	string		AH		Halo(TM) bitmapped font file
241860	lelong		0x08086b70	TurboC BGI file
241870	lelong		0x08084b50	TurboC Font file
24188
24189# Debian#712046: The magic below identifies "Delphi compiled form data".
24190# An additional source of information is available at:
24191# http://www.woodmann.com/fravia/dafix_t1.htm
241920	string		TPF0
24193>4	pstring		>\0		Delphi compiled form '%s'
24194
24195# tests for DBase files moved, updated and merged to database
24196
241970	string		PMCC		Windows 3.x .GRP file
241981	string		RDC-meg		MegaDots
24199>8	byte		>0x2F		version %c
24200>9	byte		>0x2F		\b.%c file
242010	lelong		0x4C
24202>4	lelong		0x00021401	Windows shortcut file
24203
24204# .PIF files added by Joerg Jenderek from https://smsoft.ru/en/pifdoc.htm
24205# only for windows versions equal or greater 3.0
242060x171	string	MICROSOFT\ PIFEX\0	Windows Program Information File
24207!:mime	application/x-dosexec
24208!:ext	pif
24209#>2	string	 	>\0		\b, Title:%.30s
24210>0x24	string		>\0		\b for %.63s
24211>0x65	string		>\0		\b, directory=%.64s
24212>0xA5	string		>\0		\b, parameters=%.64s
24213#>0x181	leshort	x	\b, offset %x
24214#>0x183	leshort	x	\b, offsetdata %x
24215#>0x185	leshort	x	\b, section length %x
24216>0x187	search/0xB55	WINDOWS\ VMM\ 4.0\0
24217>>&0x5e		ubyte	>0
24218>>>&-1		string	<PIFMGR.DLL		\b, icon=%s
24219#>>>&-1		string	PIFMGR.DLL		\b, icon=%s
24220>>>&-1		string	>PIFMGR.DLL		\b, icon=%s
24221>>&0xF0		ubyte	>0
24222>>>&-1		string	<Terminal		\b, font=%.32s
24223#>>>&-1		string	=Terminal		\b, font=%.32s
24224>>>&-1		string	>Terminal		\b, font=%.32s
24225>>&0x110	ubyte	>0
24226>>>&-1		string	<Lucida\ Console	\b, TrueTypeFont=%.32s
24227#>>>&-1		string	=Lucida\ Console	\b, TrueTypeFont=%.32s
24228>>>&-1		string	>Lucida\ Console	\b, TrueTypeFont=%.32s
24229#>0x187	search/0xB55	WINDOWS\ 286\ 3.0\0	\b, Windows 3.X standard mode-style
24230#>0x187	search/0xB55	WINDOWS\ 386\ 3.0\0	\b, Windows 3.X enhanced mode-style
24231>0x187	search/0xB55	WINDOWS\ NT\ \ 3.1\0	\b, Windows NT-style
24232#>0x187	search/0xB55	WINDOWS\ NT\ \ 4.0\0	\b, Windows NT-style
24233>0x187	search/0xB55	CONFIG\ \ SYS\ 4.0\0	\b +CONFIG.SYS
24234#>>&06		string	x			\b:%s
24235>0x187	search/0xB55	AUTOEXECBAT\ 4.0\0	\b +AUTOEXEC.BAT
24236#>>&06		string	x			\b:%s
24237
24238# DOS EPS Binary File Header
24239# From: Ed Sznyter <ews@Black.Market.NET>
242400	belong		0xC5D0D3C6	DOS EPS Binary File
24241!:mime	image/x-eps
24242>4	long		>0		Postscript starts at byte %d
24243>>8	long		>0		length %d
24244>>>12	long		>0		Metafile starts at byte %d
24245>>>>16	long		>0		length %d
24246>>>20	long		>0		TIFF starts at byte %d
24247>>>>24	long		>0		length %d
24248
24249# TNEF magic From "Joomy" <joomy@se-ed.net>
24250# Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF)
242510	lelong		0x223e9f78	TNEF
24252!:mime	application/vnd.ms-tnef
24253
24254# Norton Guide (.NG , .HLP) files added by Joerg Jenderek from source NG2HTML.C
24255# of http://www.davep.org/norton-guides/ng2h-105.tgz
24256# https://en.wikipedia.org/wiki/Norton_Guides
242570	string		NG\0\001
24258# only value 0x100 found at offset 2
24259>2	ulelong		0x00000100	Norton Guide
24260!:mime	application/x-norton-guide
24261# often like NORTON.NG but some times like NC.HLP
24262!:ext	ng/hlp
24263# Title[40]
24264>>8	string		>\0		"%-.40s"
24265#>>6	uleshort	x		\b, MenuCount=%u
24266# szCredits[5][66]
24267>>48	string		>\0		\b, %-.66s
24268>>114	string		>\0		%-.66s
24269
24270# URL:		https://en.wikipedia.org/wiki/Norton_Commander
24271# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/m/msg-nc-eng.trid.xml
24272# From:		Joerg Jenderek
24273# Note:		Message file is used by executable with same main name.
24274#		Only tested with version 5.50 (english) and 2.01 (Windows)
242750	string		Abort
24276# \0 or i
24277#>5	ubyte		x		%x
24278# skip ASCII Abort text by looking for error message like in NCVIEW.MSG
24279>6	search/7089	Non-DOS\ disk	Norton Commander module message
24280!:mime	application/x-norton-msg
24281!:ext	msg
24282
24283# URL:		http://www.antonis.de/dos/dos-tuts/mpdostip/html/nwdostip.htm
24284# Reference:	https://mark0.net/download/triddefs_xml.7z/defs/m/msg-netware-dos.trid.xml
24285# From:		Joerg Jenderek
242860	string	DOS\ Client\ Message\ File:	Novell DOS client message
24287#!:mime	application/octet-stream
24288#!:mime	application/x-novell-msg
24289!:ext	msg
24290# look for second letter instead space character
24291>26	ubyte		>0x20
24292# digit 1 or often main or program name like: IPXODI.COM TASKID pnwtrap DOSRqstr
24293>>25		ubyte	!0x20			%c
24294>>>26		ubyte	!0x20			\b%c
24295>>>>27		ubyte	!0x20			\b%c
24296>>>>>28		ubyte	!0x20			\b%c
24297>>>>>>29	ubyte	!0x20			\b%c
24298>>>>>>>30	ubyte	!0x20			\b%c
24299>>>>>>>>31	ubyte	!0x20			\b%c
24300>>>>>>>>>32	ubyte	!0x20			\b%c
24301>>>>>>>>>>33	ubyte	!0x20			\b%c
24302>>>>>>>>>>>34	ubyte	!0x20			\b%c
24303>>>>>>>>>>>>35	ubyte	!0x20			\b%c
24304>>>>>>>>>>>>>36	ubyte	!0x20			\b%c
24305# followed by string like: 0 v.10 V1.20
24306#
24307# followed by ,\040Tran\040
24308>28	search/14	,\040Tran\040
24309# probably translated version string like: 0 v1.00
24310>>&0	string	x				\b, tran version %s
24311# followed by Ctrl-J Ctrl-Z
24312>>>&0	ubyte		!0xa			\b, terminated by 0x%2.2x
24313>>>>&0	ubyte		x			\b%2.2x
24314# Ctrl-Z
24315>0x65	ubyte		!0x1A			\b, at 0x65 0x%x
24316# one
24317>0x66	ubyte		!0x01			\b, at 0x66 0x%x
24318# URL:		https://en.wikipedia.org/wiki/NetWare
24319# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/d/dat-novell-msg.trid.xml
24320# ftp://ftp.iitb.ac.in/LDP/en/NLM-HOWTO/NLM-HOWTO-single.html
24321# From:		Joerg Jenderek
243220	string	Novell\ Message\ Librarian\ Data\ File	Novell message librarian data
24323#>35	string	Version\ 1.00
24324#>49	string	COPYRIGHT\ (c)\ 1985\ by\ Novell,\ Inc.
24325#>83	string	\ \ All\ Rights\ Reserved
24326#!:mime	application/octet-stream
24327#!:mime	application/x-novell-msg
24328!:ext	msg
24329#!:ext	msg/dat
24330# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS
24331# of https://www.4dos.info/
24332# pointer,HelpID[8]=4DHnnnmm
243330	ulelong	0x48443408		4DOS help file
24334>4	string	x			\b, version %-4.4s
24335
24336# old binary Microsoft (.HLP) files added by Joerg Jenderek from http://file-extension.net/seeker/file_extension_hlp
243370	ulequad	0x3a000000024e4c	MS Advisor help file
24338
24339# HtmlHelp files (.chm)
243400	string/b	ITSF\003\000\000\000\x60\000\000\000	MS Windows HtmlHelp Data
24341
24342# GFA-BASIC (Wolfram Kleff)
243432	string/b	GFA-BASIC3	GFA-BASIC 3 data
24344
24345#------------------------------------------------------------------------------
24346# From Stuart Caie <kyzer@4u.net> (developer of cabextract)
24347# Update: Joerg Jenderek
24348# URL: https://en.wikipedia.org/wiki/Cabinet_(file_format)
24349# Reference: https://msdn.microsoft.com/en-us/library/bb267310.aspx
24350# Note: verified by `7z l *.cab`
24351# Microsoft Cabinet files
243520	string/b	MSCF\0\0\0\0	Microsoft Cabinet archive data
24353#
24354# https://support.microsoft.com/en-us/help/973559/frequently-asked-questions-about-the-microsoft-support-diagnostic-tool
24355# CAB with *.{diagcfg,diagpkg} is used by Microsoft Support Diagnostic Tool MSDT.EXE
24356# because some archive does not have *.diag* as 1st or 2nd archive member like
24357# O15CTRRemove.diagcab or AzureStorageAnalyticsLogs_global.DiagCab
24358# brute looking after header for filenames with diagcfg or diagpkg extension in CFFILE section
24359>0x2c	search/980/c	.diag		\b, Diagnostic
24360!:mime	application/vnd.ms-cab-compressed
24361!:ext	diagcab
24362# http://fileformats.archiveteam.org/wiki/PUZ
24363# Microsoft Publisher version about 2003 has a "Pack and Go" feature that
24364# bundles a Publisher document *PNG.pub with all links into a CAB
24365>0x2c	search/300/c	png.pub\0		\b, Publisher Packed and Go
24366!:mime	application/vnd.ms-cab-compressed
24367!:ext	puz
24368# ppz variant with Microsoft PowerPoint Viewer ppview32.exe to play PowerPoint presentation
24369>0x2c	search/17/c	ppview32.exe\0		\b, PowerPoint Viewer Packed and Go
24370!:mime	application/vnd.ms-powerpoint
24371#!:mime	application/mspowerpoint
24372!:ext	ppz
24373# URL:		https://en.wikipedia.org/wiki/Windows_Desktop_Gadgets
24374# Reference:	https://docs.microsoft.com/en-us/previous-versions/windows/desktop/sidebar/
24375# http://win10gadgets.com/download/273/ All_CPU_Meter1.zip/All_CPU_Meter_V4.7.3.gadget
24376>0x2c	search/968/c	gadget.xml		\b, Windows Desktop Gadget
24377#!:mime	application/vnd.ms-cab-compressed
24378# http://extension.nirsoft.net/gadget
24379!:mime	application/x-windows-gadget
24380!:ext	gadget
24381# http://www.incredimail.com/
24382# IncrediMail CAB contains an initialisation file "content.ini" like in im2.ims
24383>0x2c	search/3369/c	content.ini\0	\b, IncrediMail
24384!:mime	application/x-incredimail
24385# member Flavor.htm implies IncrediMail ecard like in tell_a_friend.imf
24386>>0x2c	search/83/c	Flavor.htm\0	ecard
24387!:ext	imf
24388# member Macromedia Flash data *.swf implies IncrediMail skin like in im2.ims
24389>>0x2c	search/211/c	.swf\0		skin
24390!:ext	ims
24391# member anim.im3 implies IncrediMail animation like in letter_fold.ima
24392>>0x2c	search/92/c	anim.im3\0	animation
24393!:ext	ima
24394# other IncrediMail cab archive
24395>>0x2c	default		x
24396>>>0x2c	search/116/c	thumb		ecard, image, notifier or skin
24397!:ext	imf/imi/imn/ims
24398# http://file-extension.net/seeker/file_extension_ime
24399>>>0x2c	default		x		emoticons or sound
24400!:ext	ime/imw
24401# no Diagnostic, Packed and Go, Windows Desktop Gadget, IncrediMail
24402>0x2c	default		x
24403# look for 1st member name
24404>>(16.l+16)	ubyte	x
24405# https://en.wikipedia.org/wiki/SNP_file_format
24406>>>&-1	string/c 	_accrpt_.snp	\b, Access report snapshot
24407!:mime	application/msaccess
24408!:ext	snp
24409# https://en.wikipedia.org/wiki/Microsoft_InfoPath
24410>>>&-1	string 		manifest.xsf	\b, InfoPath Form Template
24411!:mime	application/vnd.ms-cab-compressed
24412#!:mime	application/vnd.ms-infopath
24413!:ext	xsn
24414# https://www.cabextract.org.uk/wince_cab_format/
24415# extension of DOS 8+3 name with ".000" of 1st archive member name implies Windows CE installer
24416>>>&7	string 		=.000		\b, WinCE install
24417!:mime	application/vnd.ms-cab-compressed
24418!:ext	cab
24419
24420# https://support.microsoft.com/kb/934307/en-US
24421# All inspected MSU contain a file with name WSUSSCAN.cab
24422# that is called "Windows Update meta data" by Microsoft
24423>>>&-1	string/c 	wsusscan.cab	\b, Microsoft Standalone Update
24424!:mime	application/vnd.ms-cab-compressed
24425!:ext	msu
24426>>>&-1	default		x
24427# look at point character of 1st archive member name for file name extension
24428>>>>&-1	search/255 	.
24429# http://www.pptfaq.com/FAQ00164_What_is_a_PPZ_file-.htm
24430# PPZ were created using Pack & Go feature of PowerPoint versions 97 - 2002
24431# packs optional files, a PowerPoint presentation *.ppt with optional PLAYLIST.LST to CAB
24432>>>>>&0	string/c	ppt\0		\b, PowerPoint Packed and Go
24433!:mime	application/vnd.ms-powerpoint
24434#!:mime	application/mspowerpoint
24435!:ext	ppz
24436# https://msdn.microsoft.com/en-us/library/windows/desktop/bb773190(v=vs.85).aspx
24437# first member *.theme implies Windows 7 Theme Pack like in CommunityShowcaseAqua3.themepack
24438# or Windows 8 Desktop Theme Pack like in PanoramicGlaciers.deskthemepack
24439>>>>>&0	string/c	theme		\b, Windows
24440!:mime	application/x-windows-themepack
24441# https://www.drewkeller.com/content/using-theme-both-windows-7-and-windows-8
24442# 1st member Panoramic.theme or Panoramas.theme implies Windows 8-10 Theme Pack
24443# with MTSM=RJSPBS in [MasterThemeSelector] inside *.theme
24444>>>>>>(16.l+16)	string	=Panoram	8
24445!:ext	deskthemepack
24446>>>>>>(16.l+16)	string	!Panoram	7 or 8
24447!:ext	themepack/deskthemepack
24448>>>>>>(16.l+16)	ubyte	x		Theme Pack
24449>>>>>&0	default		x
24450# look for null terminator of 1st member name
24451>>>>>>&0	search/255 	\0
24452# 2nd member name WSUSSCAN.cab like in Microsoft-Windows-MediaFeaturePack-OOB-Package.msu
24453>>>>>>>&16	string/c 	wsusscan.cab	\b, Microsoft Standalone Update
24454!:mime	application/vnd.ms-cab-compressed
24455!:ext	msu
24456>>>>>>>&16	default	x
24457# archive with more then one file need some output in version 5.32 to avoid error message like
24458# Magdir/msdos, 1138: Warning: Current entry does not yet have a description for adding a MIME type
24459# Magdir/msdos, 1139: Warning: Current entry does not yet have a description for adding a EXTENSION type
24460# file: could not find any valid magic files!
24461>>>>>>>>28	uleshort	>1	\b, many
24462!:mime	application/vnd.ms-cab-compressed
24463!:ext	cab
24464# remaining archives with just one file
24465>>>>>>>>28	uleshort	=1
24466# neither extra bytes nor cab chain implies Windows 2000,XP setup files in directory i386
24467>>>>>>>>>30	uleshort	=0x0000	\b, Windows 2000/XP setup
24468# cut of last char of source extension and add underscore to generate extension
24469# TERMCAP._ ... FXSCOUNT.H_ ... L3CODECA.AC_ ... NPDRMV2.ZI_
24470!:mime	application/vnd.ms-cab-compressed
24471!:ext	_/?_/??_
24472# archive need some output like "single" in version 5.32 to avoid error messages
24473>>>>>>>>>30	uleshort	!0x0000	\b, single
24474!:mime	application/vnd.ms-cab-compressed
24475!:ext	cab
24476# TODO: additional extensions like
24477# .xtp	InfoPath Template Part
24478# .lvf	Logitech Video Effects Face Accessory
24479>8	ulelong		x		\b, %u bytes
24480>28	uleshort		1		\b, 1 file
24481>28	uleshort		>1		\b, %u files
24482# Reserved fields, set to zero
24483#>4	belong		!0		\b, reserved1 %x
24484#>12	belong		!0		\b, reserved2 %x
24485# offset of the first CFFILE entry coffFiles: minimal 2Ch
24486>16	ulelong		x		\b, at 0x%x
24487>(16.l)	use		cab-file
24488# at least also 2nd member
24489>28	uleshort		>1
24490>>(16.l+16)	ubyte	x
24491>>>&0	search/255 	\0
24492# second member info
24493>>>>&0	use		cab-file
24494#>20	belong		!0		\b, reserved %x
24495# Cabinet file format version. Currently, versionMajor = 1 and versionMinor = 3
24496>24	ubeshort	!0x0301		\b version 0x%x
24497# number of CFFOLDER entries
24498>26	uleshort	>1		\b, %u cffolders
24499# cabinet file option indicators 1~PREVIOUS, 2~NEXT, 4~reserved fields
24500# only found for flags 0 1 2 3 4 not 7
24501>30	uleshort	>0		\b, flags 0x%x
24502# Cabinet files have a 16-bit cabinet setID field that is designed for application use.
24503# default is zero, however, the -i option of cabarc can be used to set this field
24504>32	uleshort	>0		\b, ID %u
24505# iCabinet is number of this cabinet file in a set, where 0 for the first cabinet
24506#>34	uleshort	x		\b, iCabinet %u
24507# add one for display because humans start numbering by 1 and also fit to name of disk szDisk*
24508>34	uleshort+1	x		\b, number %u
24509>30	uleshort	&0x0004		\b, extra bytes
24510# cbCFHeader optional size of per-cabinet reserved area 14h 1800h
24511>>36	uleshort	>0		%u in head
24512# cbCFFolder is optional size of per-folder reserved area
24513>>38	ubyte		>0		%u in folder
24514# cbCFData is optional size of per-datablock reserved area
24515>>39	ubyte		>0		%u in data block
24516# optional per-cabinet reserved area abReserve[cbCFHeader]
24517>>36	uleshort	>0
24518# 1st CFFOLDER after reserved area in header
24519>>>(36.s+40)	use			cab-folder
24520# no reserved area in header
24521>30	uleshort	^0x0004
24522# no previous and next cab archive
24523>>30	uleshort		=0x0000
24524>>>36	use				cab-folder
24525# only previous cab archive
24526>>30	uleshort		=0x0001	\b, previous
24527>>>36	use				cab-anchor
24528# only next cab archive
24529>>30	uleshort		=0x0002	\b, next
24530>>>36	use				cab-anchor
24531# previous+next cab archive
24532# can not use sub routine cab-anchor to display previous and next cabinet together
24533#>>>36	use				cab-anchor
24534#>>>>&0	use				cab-anchor
24535>>30	uleshort		=0x0003	\b, previous
24536>>>36	string		x		%s
24537# optional name of previous disk szDisk*
24538>>>>&1	string		x		disk %s
24539>>>>>&1	string		x		\b, next %s
24540# optional name of previous disk szDisk*
24541>>>>>>&1	string		x	disk %s
24542>>>>>>>&1	use			cab-folder
24543#	display filename and disk name of previous or next cabinet
245440       name    			cab-anchor
24545# optional name of previous/next cabinet file szCabinet*[255]
24546>&0	string		x		%s
24547# optional name of previous/next disk szDisk*[255]
24548>>&1	string		x		disk %s
24549#	display folder structure CFFOLDER information like compression of cabinet
245500       name    			cab-folder
24551# offset of the CFDATA block in this folder
24552#>0	ulelong		x		\b, coffCabStart 0x%x
24553# number of CFDATA blocks in folder
24554>4	uleshort	x		\b, %u datablock
24555# plural s
24556>4	uleshort	>1		\bs
24557# compression typeCompress: 0~None 1~MSZIP 0x1503~LZX:21 0x1003~LZX:16 0x0f03~LZX:15
24558>6	uleshort	x		\b, 0x%x compression
24559# optional per-folder reserved area
24560#>8	ubequad		x		\b, abReserve 0x%llx
24561#	display member structure CFFILE information like member name of cabinet
245620       name    			cab-file
24563# cbFile is uncompressed size of file in bytes
24564#>0	ulelong		x		\b, cbFile %u
24565# uoffFolderStart is uncompressed offset of file in folder
24566#>4	ulelong		>0		\b, uoffFolderStart 0x%x
24567# iFolder is index into the CFFOLDER area. 0 indicates first folder in cabinet
24568# define ifoldCONTINUED_FROM_PREV      (0xFFFD)
24569# define ifoldCONTINUED_TO_NEXT        (0xFFFE)
24570# define ifoldCONTINUED_PREV_AND_NEXT  (0xFFFF)
24571>8	uleshort	>0		\b, iFolder 0x%x
24572# date stamp for file
24573#>10	uleshort	x		\b, date 0x%x
24574# time stamp for file
24575#>12	uleshort	x		\b, time 0x%x
24576# attribs is attribute flags for file
24577# define  _A_RDONLY       (0x01)  file is read-only
24578# define  _A_HIDDEN       (0x02)  file is hidden
24579# define  _A_SYSTEM       (0x04)  file is a system file
24580# define  _A_ARCH         (0x20)  file modified since last backup
24581# example http://sebastien.kirche.free.fr/pebuilder_plugins/depends.cab
24582# define  _A_EXEC         (0x40)  run after extraction
24583# define  _A_NAME_IS_UTF  (0x80)  szName[] contains UTF
24584# define  UNKNOWN       (0x0100)  undocumented or accident
24585#>14	uleshort	x		\b, attribs 0x%x
24586>14	uleshort	>0		+
24587>>14	uleshort	&0x0001		\bR
24588>>14	uleshort	&0x0002		\bH
24589>>14	uleshort	&0x0004		\bS
24590>>14	uleshort	&0x0020		\bA
24591>>14	uleshort	&0x0040		\bX
24592>>14	uleshort	&0x0080		\bUtf
24593# unknown 0x0100 flag found on one XP_CD:\I386\DRIVER.CAB
24594>>14	uleshort	&0x0100		\b?
24595# szName is name of archive member
24596>16	string		x		"%s"
24597# next archive member name if more files
24598#>>&17	string		>\0		\b, NEXT NAME %-.50s
24599
24600# InstallShield Cabinet files
246010	string/b	ISc(		InstallShield Cabinet archive data
24602>5	byte&0xf0	=0x60		version 6,
24603>5	byte&0xf0	!0x60		version 4/5,
24604>(12.l+40)	lelong	x		%u files
24605
24606# Windows CE package files
246070	string/b	MSCE\0\0\0\0	Microsoft WinCE install header
24608>20	lelong		0		\b, architecture-independent
24609>20	lelong		103		\b, Hitachi SH3
24610>20	lelong		104		\b, Hitachi SH4
24611>20	lelong		0xA11		\b, StrongARM
24612>20	lelong		4000		\b, MIPS R4000
24613>20	lelong		10003		\b, Hitachi SH3
24614>20	lelong		10004		\b, Hitachi SH3E
24615>20	lelong		10005		\b, Hitachi SH4
24616>20	lelong		70001		\b, ARM 7TDMI
24617>52	leshort		1		\b, 1 file
24618>52	leshort		>1		\b, %u files
24619>56	leshort		1		\b, 1 registry entry
24620>56	leshort		>1		\b, %u registry entries
24621
24622
24623# Windows Enhanced Metafile (EMF)
24624# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp
24625# for further information.
246260	ulelong 1
24627>40	string	\ EMF		Windows Enhanced Metafile (EMF) image data
24628>>44	ulelong x		version 0x%x
24629
24630
246310	string/b	\224\246\056		Microsoft Word Document
24632!:mime	application/msword
24633
24634# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
24635# Magic type for Dell's BIOS .hdr files
24636# Dell's .hdr
246370	string/b $RBU
24638>23	string Dell			%s system BIOS
24639>5	byte   2
24640>>48	byte   x			version %d.
24641>>49	byte   x			\b%d.
24642>>50	byte   x			\b%d
24643>5	byte   <2
24644>>48	string x			version %.3s
24645
24646# Type: Microsoft Document Imaging Format (.mdi)
24647# URL:	https://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format
24648# From: Daniele Sempione <scrows@oziosi.org>
24649# Too weak (EP)
24650#0	short	0x5045			Microsoft Document Imaging Format
24651
24652# MS eBook format (.lit)
246530	string/b	ITOLITLS		Microsoft Reader eBook Data
24654>8	lelong	x			\b, version %u
24655!:mime					application/x-ms-reader
24656
24657# Windows CE Binary Image Data Format
24658# From: Dr. Jesus <j@hug.gs>
246590	string/b	B000FF\n	Windows Embedded CE binary image
24660
24661# The second byte of these signatures is a file version; I don't know what,
24662# if anything, produced files with version numbers 0-2.
24663# From: John Elliott <johne@seasip.demon.co.uk>
246640	string	\xfc\x03\x00	Mallard BASIC program data (v1.11)
246650	string	\xfc\x04\x00	Mallard BASIC program data (v1.29+)
246660	string	\xfc\x03\x01	Mallard BASIC protected program data (v1.11)
246670	string	\xfc\x04\x01	Mallard BASIC protected program data (v1.29+)
24668
246690	string	MIOPEN		Mallard BASIC Jetsam data
246700	string	Jetsam0		Mallard BASIC Jetsam index data
24671
24672# DOS backup 2.0 to 3.2
24673
24674# backupid.@@@
24675
24676# plausibility check for date
246770x3	ushort	>1979
24678>0x5	ubyte-1 <31
24679>>0x6	ubyte-1 <12
24680# actually 121 nul bytes
24681>>>0x7	string	\0\0\0\0\0\0\0\0
24682>>>>0x1 ubyte	x	DOS 2.0 backup id file, sequence %d
24683!:ext @@@
24684>>>>0x0 ubyte	0xff	\b, last disk
24685
24686# backed up file
24687
24688# skip some AppleWorks word like Tomahawk.Awp, WIN98SE-DE.vhd
24689# by looking for trailing nul of maximal file name string
246900x52	ubyte	0
24691# test for flag byte: FFh~complete file, 00h~split file
24692# FFh -127 =	-1 -127 =	-128
24693# 00h -127 =	 0 -127 =	-127
24694>0	byte-127	<-126
24695# plausibility check for file name length
24696>>0x53	ubyte-1	<78
24697# looking for terminating nul of file name string
24698>>>(0x53.b+4)	ubyte	0
24699# looking if last char of string is valid DOS file name
24700>>>>(0x53.b+3)	ubyte	>0x1F
24701# actually 44 nul bytes
24702# but sometimes garbage according to Ralf Quint. So can not be used as test
24703#>0x54	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
24704# first char of full file name is DOS (5Ch) or UNIX (2Fh) path separator
24705# only DOS variant found. UNIX variant according to V32SLASH.TXT in archive PD0315.EXE
24706>>>>>5	ubyte&0x8C	0x0C
24707# ./msdos (version 5.30) labeled the entry as
24708# "DOS 2.0 backed up file %s, split file, sequence %d" or
24709# "DOS 2.0 backed up file %s, complete file"
24710>>>>>>0	ubyte	x	DOS 2.0-3.2 backed up
24711#>>>>>>0	ubyte	0xff	complete
24712>>>>>>0	ubyte	0
24713>>>>>>>1 uleshort	x	sequence %d of
24714# full file name with path but without drive letter and colon stored from 0x05 til 0x52
24715>>>>>>0x5	string	x	file %s
24716# backup name is original filename
24717#!:ext	*
24718# magic/Magdir/msdos, 1169: Warning: EXTENSION type `     *' has bad char '*'
24719# file: line 1169: Bad magic entry '  *'
24720# after header original file content
24721>>>>>>128	indirect x	\b;\040
24722
24723
24724# DOS backup 3.3 to 5.x
24725
24726# CONTROL.nnn files
247270	string	\x8bBACKUP\x20
24728# actually 128 nul bytes
24729>0xa	string	\0\0\0\0\0\0\0\0
24730>>0x9	ubyte	x	DOS 3.3 backup control file, sequence %d
24731>>0x8a	ubyte	0xff	\b, last disk
24732
24733# NB: The BACKUP.nnn files consist of the files backed up,
24734# concatenated.
24735
24736#------------------------------------------------------------------------------
24737# $File: msooxml,v 1.15 2020/09/05 22:59:14 christos Exp $
24738# msooxml:  file(1) magic for Microsoft Office XML
24739# From: Ralf Brown <ralf.brown@gmail.com>
24740
24741# .docx, .pptx, and .xlsx are XML plus other files inside a ZIP
24742#   archive.  The first member file is normally "[Content_Types].xml".
24743#   but some libreoffice generated files put this later. Perhaps skip
24744#   the "[Content_Types].xml" test?
24745# Since MSOOXML doesn't have anything like the uncompressed "mimetype"
24746#   file of ePub or OpenDocument, we'll have to scan for a filename
24747#   which can distinguish between the three types
24748
247490		name		msooxml
24750>0		string		word/		Microsoft Word 2007+
24751!:mime application/vnd.openxmlformats-officedocument.wordprocessingml.document
24752>0		string		ppt/		Microsoft PowerPoint 2007+
24753!:mime application/vnd.openxmlformats-officedocument.presentationml.presentation
24754>0		string		xl/		Microsoft Excel 2007+
24755!:mime application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
24756>0		string		visio/		Microsoft Visio 2013+
24757!:mime application/vnd.ms-visio.drawing.main+xml
24758
24759# start by checking for ZIP local file header signature
247600		string		PK\003\004
24761!:strength +10
24762# make sure the first file is correct
24763>0x1E		use		msooxml
24764>0x1E		default		x
24765>>0x1E		regex		\\[Content_Types\\]\\.xml|_rels/\\.rels|docProps
24766# skip to the second local file header
24767# since some documents include a 520-byte extra field following the file
24768# header, we need to scan for the next header
24769>>>(18.l+49)	search/6000	PK\003\004
24770# now skip to the *third* local file header; again, we need to scan due to a
24771# 520-byte extra field following the file header
24772>>>>&26		search/6000	PK\003\004
24773# and check the subdirectory name to determine which type of OOXML
24774# file we have.  Correct the mimetype with the registered ones:
24775# https://technet.microsoft.com/en-us/library/cc179224.aspx
24776>>>>>&26		use		msooxml
24777>>>>>&26		default		x
24778# OpenOffice/Libreoffice orders ZIP entry differently, so check the 4th file
24779>>>>>>&26	search/6000	PK\003\004
24780>>>>>>>&26	use		msooxml
24781>>>>>>>&26	default		x		Microsoft OOXML
24782>>>>>&26	default		x		Microsoft OOXML
24783
24784#------------------------------------------------------------------------------
24785# $File: msvc,v 1.10 2018/10/01 19:14:03 christos Exp $
24786# msvc:  file(1) magic for msvc
24787# "H. Nanosecond" <aldomel@ix.netcom.com>
24788# Microsoft visual C
24789#
24790# I have version 1.0
24791
24792# .aps
247930	string	HWB\000\377\001\000\000\000	Microsoft Visual C .APS file
24794
24795# .ide
24796#too long 0	string	\102\157\162\154\141\156\144\040\103\053\053\040\120\162\157\152\145\143\164\040\106\151\154\145\012\000\032\000\002\000\262\000\272\276\372\316	MSVC .ide
247970	string	\102\157\162\154\141\156\144\040\103\053\053\040\120\162\157	MSVC .ide
24798
24799# .res
248000	string	\000\000\000\000\040\000\000\000\377	MSVC .res
248010	string	\377\003\000\377\001\000\020\020\350	MSVC .res
248020	string	\377\003\000\377\001\000\060\020\350	MSVC .res
24803
24804#.lib
248050	string	\360\015\000\000	Microsoft Visual C library
248060	string	\360\075\000\000	Microsoft Visual C library
248070	string	\360\175\000\000	Microsoft Visual C library
24808
24809#.pch
248100	string	DTJPCH0\000\022\103\006\200	Microsoft Visual C .pch
24811
24812# Summary: Symbol Table / Debug info used by Microsoft compilers
24813# URL: https://en.wikipedia.org/wiki/Program_database
24814# Reference: https://code.google.com/p/pdbparser/wiki/MSF_Format
24815# Update: Joerg Jenderek
24816# Note:	test only for Windows XP+SP3 x86 , 8.1 x64 arm and 10.1 x86
24817#	info does only applies partly for older files like msvbvm50.pdb about year 2001
248180	string	Microsoft\ C/C++\040
24819# "Microsoft Program DataBase" by TrID
24820>24	search/14	\r\n\x1A	MSVC program database
24821!:mime	application/x-ms-pdb
24822!:ext	pdb
24823# "MSF 7.00" "program database 2.00" for msvbvm50.pdb
24824>>16	regex	\([0-9.]+\)	ver %s
24825#>>>0x38	search/128123456	/LinkInfo	\b with linkinfo
24826# "MSF 7.00" variant
24827>>0x1e	leshort	0
24828# PageSize 400h 1000h
24829>>>0x20	lelong	x	\b, %d
24830# Page Count
24831>>>0x28	lelong	x	\b*%d bytes
24832# "program database 2.00"  variant
24833>>0x1e	leshort	!0
24834# PageSize 400h
24835>>>0x2c	lelong	x	\b, %d
24836# Page Count for msoo-dll.pdb 4379h
24837>>>0x32	leshort	x	\b*%d bytes
24838
24839# Reference: https://github.com/Microsoft/vstest/pull/856/commits/fdc7a9f074ca5a8dfeec83b1be9162bf0cf4000d
248400       string/c bsjb\001\000\001\000\000\000\000\000\f\000\000\000pdb\ v1.0     Microsoft Roslyn C# debugging symbols version 1.0
24841
24842#.sbr
248430	string	\000\002\000\007\000	MSVC .sbr
24844>5	string 	>\0	%s
24845
24846#.bsc
248470	string	\002\000\002\001	MSVC .bsc
24848
24849#.wsp
248500	string	1.00\ .0000.0000\000\003	MSVC .wsp version 1.0000.0000
24851# these seem to start with the version and contain menus
24852
24853#------------------------------------------------------------------------------
24854# msx:  file(1) magic for the MSX Home Computer
24855# v1.3
24856# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
24857
24858############## MSX Music file formats ##############
24859
24860# Gigamix MGSDRV music file
248610	string/b		MGS	MSX Gigamix MGSDRV3 music file,
24862>6	ubeshort	0x0D0A
24863>>3	byte		x	\bv%c
24864>>4	byte		x	\b.%c
24865>>5	byte		x	\b%c
24866>>8	string		>\0	\b, title: %s
24867
248681	string/b		mgs2\ 	MSX Gigamix MGSDRV2 music file
24869>6	uleshort	0x80
24870>>0x2E	uleshort	0
24871>>>0x30	string		>\0	\b, title: %s
24872
24873# KSS music file
248740	string/b		KSCC	KSS music file v1.03
24875>0xE	byte		0
24876>>0xF	byte&0x02	0	\b, soundchips: AY-3-8910, SCC(+)
24877>>0xF	byte&0x02	2	\b, soundchip(s): SN76489
24878>>>0xF	byte&0x04	4	stereo
24879>>0xF	byte&0x01	1	\b, YM2413
24880>>0xF	byte&0x08	8	\b, Y8950
24881
248820	string/b		KSSX	KSS music file v1.20
24883>0xE	byte&0xEF	0
24884>>0xF	byte&0x40	0x00	\b, 60Hz
24885>>0xF	byte&0x40	0x40	\b, 50Hz
24886>>0xF	byte&0x02	0	\b, soundchips: AY-3-8910, SCC(+)
24887>>0xF	byte&0x02	0x02	\b, soundchips: SN76489
24888>>>0xF	byte&0x04	0x04	stereo
24889>>0xF	byte&0x01	0x01	\b,
24890>>>0xF	byte&0x18	0x00	\bYM2413
24891>>>0xF	byte&0x18	0x08	\bYM2413, Y8950
24892>>>0xF	byte&0x18	0x18	\bYM2413+Y8950 pseudostereo
24893>>0xF	byte&0x18	0x10	\b, Majyutsushi DAC
24894
24895# Moonblaster for Moonsound
248960	string/b		MBMS
24897>4	byte		0x10	MSX Moonblaster for MoonSound music
24898
24899# Music Player K-kaz
249000	string/b		MPK	MSX Music Player K-kaz song
24901>6	ubeshort	0x0D0A
24902>>3	byte		x	v%c
24903>>4	byte		x	\b.%c
24904>>5	byte		x	\b%c
24905
24906# I don't know why these don't work
24907#0	search/0xFFFF	\r\n.FM9
24908#>0	search/0xFFFF	\r\n#FORMAT	MSX Music Player K-kaz source MML file
24909#0	search/0xFFFF	\r\nFM1\ \=
24910#>0	search/0xFFFF	\r\nPSG1\=
24911#>>0	search/0xFFFF	\r\nSCC1\=		MSX MuSiCa MML source file
24912
24913# OPX Music file
249140x35	beshort		0x0d0a
24915>0x7B	beshort		0x0d0a
24916>>0x7D	byte		0x1a
24917>>>0x87	uleshort	0		MSX OPX Music file
24918>>>>0x86	byte		0		v1.5
24919>>>>>0	string		>\32		\b, title: %s
24920>>>>0x86	byte		1		v2.4
24921>>>>>0	string		>\32		\b, title: %s
24922
24923# SCMD music file
249240x8B	string/b		SCMD
24925>0xCE	uleshort	0	MSX SCMD Music file
24926#>>-2	uleshort	0x6a71	; The file must end with this value. How to code this here?
24927>>0x8F	string		>\0		\b, title: %s
24928
249290	search/0xFFFF	\r\n@title
24930>&0	search/0xFFFF	\r\n@m=[	MSX SCMD source MML file
24931
24932
24933############## MSX image file formats ##############
24934
24935# MSX raw VRAM dump
249360	ubyte		0xFE
24937>1	uleshort	0
24938>>5	uleshort	0
24939>>>3	uleshort	0x37FF		MSX SC2/GRP raw image
24940>>>3	uleshort	0x6A00		MSX Graph Saurus SR5 raw image
24941>>>3	uleshort	>0x769E
24942>>>>3	uleshort	<0x8000		MSX GE5/GE6 raw image
24943>>>>>3	uleshort	0x7FFF		\b, with sprite patterns
24944>>>3	uleshort	0xD3FF		MSX screen 7-12 raw image
24945>>>3	uleshort	0xD400		MSX Graph Saurus SR7/SR8/SRS raw image
24946
24947# Graph Saurus compressed images
249480	ubyte		0xFD
24949>1	uleshort	0
24950>>5	uleshort	0
24951>>>3	uleshort	>0x013D		MSX Graph Saurus compressed image
24952
24953# MSX G9B image file
249540	string/b		G9B
24955>1	uleshort	11
24956>>3	uleshort	>10
24957>>>5	ubyte		>0		MSX G9B image, depth=%d
24958>>>>8	uleshort	x		\b, %dx
24959>>>>10	uleshort	x		\b%d
24960>>>>5	ubyte		<9
24961>>>>>6	ubyte		0
24962>>>>>>7	ubyte		x		\b, codec=%d RGB color palettes
24963>>>>>6	ubyte		64		\b, codec=RGB fixed color
24964>>>>>6	ubyte		128		\b, codec=YJK
24965>>>>>6	ubyte		192		\b, codec=YUV
24966>>>>5	ubyte		>8		codec=RGB fixed color
24967>>>>12	ubyte		0		\b, raw
24968>>>>12	ubyte		1		\b, bitbuster compression
24969
24970############## Other MSX file formats ##############
24971
24972# MSX internal ROMs
249730		ubeshort	0xF3C3
24974>2		uleshort	<0x4000
24975>>8		ubyte		0xC3
24976>>>9		uleshort	<0x4000
24977>>>>0x0B	ubeshort	0x00C3
24978>>>>>0x0D	uleshort	<0x4000
24979>>>>>>0x0F	ubeshort	0x00C3
24980>>>>>>>0x11	uleshort	<0x4000
24981>>>>>>>>0x13	ubeshort	0x00C3
24982>>>>>>>>>0x15	uleshort	<0x4000
24983>>>>>>>>>>0x50	ubyte		0xC3
24984>>>>>>>>>>>0x51	uleshort	<0x4000
24985>>>>>>>>>>>>(9.s)	ubyte	0xC3
24986>>>>>>>>>>>>>&0	uleshort	>0x4000
24987>>>>>>>>>>>>>>&0	ubyte	0xC3		MSX BIOS+BASIC
24988>>>>>>>>>>>>>>>0x002D	ubyte+1	<3		\b. version=MSX%d
24989>>>>>>>>>>>>>>>0x002D	ubyte	2		\b, version=MSX2+
24990>>>>>>>>>>>>>>>0x002D	ubyte	3		\b, version=MSX Turbo-R
24991>>>>>>>>>>>>>>>0x002D	ubyte	>3		\b, version=Unknown MSX %d version
24992>>>>>>>>>>>>>>>0x0006	ubyte	x		\b, VDP.DR=0x%2x
24993>>>>>>>>>>>>>>>0x0007	ubyte	x		\b, VDP.DW=0x%2x
24994>>>>>>>>>>>>>>>0x002B	ubyte&0xF	0		\b, charset=Japanese
24995>>>>>>>>>>>>>>>0x002B	ubyte&0xF	1		\b, charset=International
24996>>>>>>>>>>>>>>>0x002B	ubyte&0xF	2		\b, charset=Korean
24997>>>>>>>>>>>>>>>0x002B	ubyte&0xF	>2		\b, charset=Unknown id:%d
24998>>>>>>>>>>>>>>>0x002B	ubyte&0x70	0x00		\b, date format=Y-M-D
24999>>>>>>>>>>>>>>>0x002B	ubyte&0x70	0x10		\b, date format=M-D-Y
25000>>>>>>>>>>>>>>>0x002B	ubyte&0x70	0x20		\b, date format=D-M-Y
25001>>>>>>>>>>>>>>>0x002B	ubyte&0x80	0x00		\b, vfreq=60Hz
25002>>>>>>>>>>>>>>>0x002B	ubyte&0x80	0x80		\b, vfreq=50Hz
25003>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	0		\b, keyboard=Japanese
25004>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	1		\b, keyboard=International
25005>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	2		\b, keyboard=French
25006>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	3		\b, keyboard=UK
25007>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	4		\b, keyboard=German
25008>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	5		\b, keyboard=Unknown id:%d
25009>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	6		\b, keyboard=Spanish
25010>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	>6		\b, keyboard=Unknown id:%d
25011>>>>>>>>>>>>>>>0x002C	ubyte&0xF0	0x00		\b, basic=Japanese
25012>>>>>>>>>>>>>>>0x002C	ubyte&0xF0	0x10		\b, basic=International
25013>>>>>>>>>>>>>>>0x002C	ubyte&0xF0	>0x10		\b, basic=Unknown id:%d
25014>>>>>>>>>>>>>>>0x002E	ubyte&1		1		\b, built-in MIDI
25015
25016
250170		string/b		CD
25018>2		uleshort	>0x10
25019>>2		uleshort	<0x4000
25020>>>4		uleshort	<0x4000
25021>>>>6		uleshort	<0x4000
25022>>>>>8		ubyte		0xC3
25023>>>>>>9		uleshort	<0x4000
25024>>>>>>>0x10	ubyte		0xC3
25025>>>>>>>>0x11	uleshort	<0x4000
25026>>>>>>>>>0x14	ubyte		0xC3
25027>>>>>>>>>>0x15	uleshort	<0x4000		MSX2/2+/TR SubROM
25028
250290		string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
25030>0x5F0		ubequad		0x8282828244380000
25031>>0x150		ubyte		0x38
25032>>>0x170	string		\20\20\20
25033>>>>0x1E32	string		())
25034>>>>>0x2130	ubequad		0xA5A5594924231807
25035>>>>>0x2138	ubequad		0x4A4A3424488830C0	MSX Kanji Font
25036
25037
25038
25039# MSX extension ROMs
250400	string/b		AB
25041>2	uleshort	0x0010			MSX ROM
25042>>2	uleshort	x			\b, init=0x%4x
25043>>4	uleshort	>0			\b, stahdl=0x%4x
25044>>6	uleshort	>0			\b, devhdl=0x%4x
25045>>8	uleshort	>0			\b, bas=0x%4x
25046>2	uleshort	0x4010			MSX ROM
25047>>2	uleshort	x			\b, init=0x%04x
25048>>4	uleshort	>0			\b, stahdl=0x%04x
25049>>6	uleshort	>0			\b, devhdl=0x%04x
25050>>8	uleshort	>0			\b, bas=0x%04x
25051>2	uleshort	0x8010			MSX ROM
25052>>2	uleshort	x			\b, init=0x%04x
25053>>4	uleshort	>0			\b, stahdl=0x%04x
25054>>6	uleshort	>0			\b, devhdl=0x%04x
25055>>8	uleshort	>0			\b, bas=0x%04x
250560	string/b		AB\0\0
25057>6	uleshort	0
25058>>4	uleshort	>0x400F			MSX-BASIC extension ROM
25059>>>4	uleshort	>0			\b, stahdl=0x%04x
25060>>>6	uleshort	>0			\b, devhdl=0x%04x
25061>>>0x1C		string		OPLL			\b, MSX-Music
25062>>>>0x18	string		PAC2			\b (external)
25063>>>>0x18	string		APRL			\b (internal)
25064
250650	string/b		AB\0\0\0\0
25066>6	uleshort	>0x400F			MSX device BIOS
25067>>6	uleshort	>0			\b, devhdl=0x%04x
25068
25069
250700	string/b		AB
25071#>2	string		5JSuperLAYDOCK		MSX Super Laydock ROM
25072#>3	string		@HYDLIDE3MSX		MSX Hydlide-3 ROM
25073#>3	string		@3\x80IA862		Golvellius MSX1 ROM
25074>2	uleshort	>15
25075>>2	uleshort	<0xC000
25076>>>8	string		\0\0\0\0\0\0\0\0
25077>>>>(2.s&0x3FFF)	uleshort	>0		MSX ROM
25078>>>>>0x10	string		YZ\0\0\0\0		Konami Game Master 2 MSX ROM
25079>>>>>0x10	string		CD			\b, Konami RC-
25080>>>>>>0x12	ubyte		x			\b%d
25081>>>>>>0x13	ubyte/16	x			\b%d
25082>>>>>>0x13	ubyte&0xF	x			\b%d
25083>>>>>0x10	string		EF			\b, Konami RC-
25084>>>>>>0x12	ubyte		x			\b%d
25085>>>>>>0x13	ubyte/16	x			\b%d
25086>>>>>>0x13	ubyte&0xF	x			\b%d
25087>>>>>2	uleshort	x			\b, init=0x%04x
25088>>>>>4	uleshort	>0			\b, stahdl=0x%04x
25089>>>>>6	uleshort	>0			\b, devhdl=0x%04x
25090>>>>>8	uleshort	>0			\b, bas=0x%04x
25091>>>2	uleshort	0
25092>>>>4	uleshort	0
25093>>>>>6	uleshort	0
25094>>>>>>8	uleshort	>0			MSX BASIC program in ROM, bas=0x%04x
25095
250960x4000	string/b		AB
25097>0x4002	uleshort	>0x400F
25098>>0x400A	string		\0\0\0\0\0\0	MSX ROM with nonstandard page order
25099>>>0x4002	uleshort	x			\b, init=0x%04x
25100>>>0x4004	uleshort	>0			\b, stahdl=0x%04x
25101>>>0x4006	uleshort	>0			\b, devhdl=0x%04x
25102>>>0x4008	uleshort	>0			\b, bas=0x%04x
25103
251040x8000	string/b		AB
25105>0x8002	uleshort	>0x400F
25106>>0x800A	string		\0\0\0\0\0\0	MSX ROM with nonstandard page order
25107>>>0x8002	uleshort	x			\b, init=0x%04x
25108>>>0x8004	uleshort	>0			\b, stahdl=0x%04x
25109>>>0x8006	uleshort	>0			\b, devhdl=0x%04x
25110>>>0x8008	uleshort	>0			\b, bas=0x%04x
25111
25112
251130x3C000	string/b		AB
25114>0x3C008	string		\0\0\0\0\0\0\0\0	MSX MegaROM with nonstandard page order
25115>>0x3C002	uleshort	x			\b, init=0x%04x
25116>>0x3C004	uleshort	>0			\b, stahdl=0x%04x
25117>>0x3C006	uleshort	>0			\b, devhdl=0x%04x
25118>>0x3C008	uleshort	>0			\b, bas=0x%04x
25119
25120# MSX BIN file
25121#0	byte		0xFE
25122#>1	uleshort	>0x8000
25123#>>3	uleshort	>0x8004
25124#>>>5	uleshort	>0x8000			MSX BIN file
25125
25126# MSX-BASIC file
251270	byte		0xFF
25128>3	uleshort	0x000A
25129>>1	uleshort	>0x8000			MSX-BASIC program
25130
25131# MSX .CAS file
251320	string/b	\x1F\xA6\xDE\xBA\xCC\x13\x7D\x74	MSX cassette archive
25133
25134# Mega-Assembler file
251350	byte		0xFE
25136>1	uleshort	0x0001
25137>>5	uleshort	0xffff
25138>>>6	byte		0x0A		MSX Mega-Assembler source
25139
25140# Execrom Patchfile
251410	string		ExecROM\ patchfile\x1A	MSX ExecROM patchfile
25142>0x12	ubyte/16	x		v%d
25143>0x12	ubyte&0xF	x		\b.%d
25144>0x13	ubyte		x		\b, contains %d patches
25145
25146# Konami's King's Valley-2 custom stage (ELG file)
251474	uleshort	0x0900
25148>0xF	byte		1
25149>>0x14	byte		0
25150>>>0x1E	string		\040\040\040
25151>>>>0x23	byte	1
25152>>>>>0x25	byte	0
25153>>>>>>0x15	string	>\x30
25154>>>>>>>0x15	string	<\x5A		Konami King's Valley-2 custom stage, title: "%-8.8s"
25155>>>>>>>>0x1D	byte	<32	\b, theme: %d
25156
25157# Metal Gear 1 savegame
25158#0x4F	string	\x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF
25159#>>0x60	string	\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF
25160#>>>0x7B	string	\0x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\x00	Metal Gear 1 savegame
25161
25162# ------------------------------------------------------------------------
25163# $File: mup,v 1.5 2017/03/17 21:35:28 christos Exp $
25164# mup: file(1) magic for Mup (Music Publisher) input file.
25165#
25166# From: Abel Cheung <abel (@) oaka.org>
25167#
25168# NOTE: This header is mainly proposed in the Arkkra mailing list,
25169# and is not a mandatory header because of old mup input file
25170# compatibility. Noteedit also use mup format, but is not forcing
25171# user to use any header as well.
25172#
251730		search/1	//!Mup		Mup music publication program input text
25174>6		string		-Arkkra		(Arkkra)
25175>>13		string		-
25176>>>16		string		.
25177>>>>14		string		x		\b, need V%.4s
25178>>>15		string		.
25179>>>>14		string		x		\b, need V%.3s
25180>6		string		-
25181>>9		string		.
25182>>>7		string		x		\b, need V%.4s
25183>>8		string		.
25184>>>7		string		x		\b, need V%.3s
25185#------------------------------------------------------------------------------
25186# $File: music,v 1.1 2011/11/25 03:28:17 christos Exp $
25187# music:  file (1) magic for music formats
25188
25189# BWW format used by Bagpipe Music Writer Gold by Robert MacNeil Musicworks
25190# and Bagpipe Writer by Doug Wickstrom
25191#
251920	string		Bagpipe		Bagpipe
25193>8	string		Reader		Reader
25194>>15	string		>\0		(version %.3s)
25195>8	string		Music\ Writer	Music Writer
25196>>20	string		:
25197>>>21	string		>\0		(version %.3s)
25198>>21	string		Gold		Gold
25199>>>25	string		:
25200>>>>26	string		>\0		(version %.3s)
25201
25202
25203#------------------------------------------------------------------------------
25204# nasa:	file(1) magic
25205
25206# From: Barry Carter <carter.barry@gmail.com>
252070	string	DAF/SPK				NASA SPICE file (binary format)
252080	string	DAFETF\ NAIF\ DAF\ ENCODED	NASA SPICE file (transfer format)
25209
25210#-----------------------------------------------------------------------------
25211# $File: natinst,v 1.6 2014/06/03 19:17:27 christos Exp $
25212# natinst:  file(1) magic for National Instruments Code Files
25213
25214#
25215# From <egamez@fcfm.buap.mx> Enrique Gamez-Flores
25216# version 1
25217# Many formats still missing, we use, for the moment LabVIEW
25218# We guess VXI format file. VISA, LabWindowsCVI, BridgeVIEW, etc, are missing
25219#
252200       string          RSRC            National Instruments,
25221# Check if it's a LabVIEW File
25222>8      string          LV              LabVIEW File,
25223# Check which kind of file it is
25224>>10    string          SB              Code Resource File, data
25225>>10    string          IN              Virtual Instrument Program, data
25226>>10    string          AR              VI Library, data
25227# This is for Menu Libraries
25228>8      string          LMNULBVW        Portable File Names, data
25229# This is for General Resources
25230>8      string          rsc             Resources File, data
25231# This is for VXI Package
252320       string          VMAP            National Instruments, VXI File, data
25233
25234#------------------------------------------------------------------------------
25235# $File: ncr,v 1.8 2014/04/30 21:41:02 christos Exp $
25236# ncr:  file(1) magic for NCR Tower objects
25237#
25238# contributed by
25239# Michael R. Wayne  ***  TMC & Associates  ***  INTERNET: wayne@ford-vax.arpa
25240# uucp: {philabs | pyramid} !fmsrl7!wayne   OR   wayne@fmsrl7.UUCP
25241#
252420	beshort		000610	Tower/XP rel 2 object
25243>12	   belong		>0	not stripped
25244>20	   beshort		0407	executable
25245>20	   beshort		0410	pure executable
25246>22	   beshort		>0	- version %d
252470	beshort		000615	Tower/XP rel 2 object
25248>12	   belong		>0	not stripped
25249>20	   beshort		0407	executable
25250>20	   beshort		0410	pure executable
25251>22	   beshort		>0	- version %d
252520	beshort		000620	Tower/XP rel 3 object
25253>12	   belong		>0	not stripped
25254>20	   beshort		0407	executable
25255>20	   beshort		0410	pure executable
25256>22	   beshort		>0	- version %d
252570	beshort		000625	Tower/XP rel 3 object
25258>12	   belong		>0	not stripped
25259>20	   beshort		0407	executable
25260>20	   beshort		0410	pure executable
25261>22	   beshort		>0	- version %d
252620	beshort		000630	Tower32/600/400 68020 object
25263>12	   belong		>0	not stripped
25264>20	   beshort		0407	executable
25265>20	   beshort		0410	pure executable
25266>22	   beshort		>0	- version %d
252670	beshort		000640	Tower32/800 68020
25268>18	   beshort		&020000	w/68881 object
25269>18	   beshort		&040000	compatible object
25270>18	   beshort		&060000	object
25271>20	   beshort		0407	executable
25272>20	   beshort		0413	pure executable
25273>12	   belong		>0	not stripped
25274>22	   beshort		>0	- version %d
252750	beshort		000645	Tower32/800 68010
25276>18	   beshort		&040000	compatible object
25277>18	   beshort		&060000 object
25278>20	   beshort		0407	executable
25279>20	   beshort		0413	pure executable
25280>12	   belong		>0	not stripped
25281>22	   beshort		>0	- version %d
25282
25283#------------------------------------------------------------
25284# $File: neko,v 1.2 2019/04/19 00:42:27 christos Exp $
25285
25286# From: Mikhail Gusarov <dottedmag@dottedmag.net>
25287# NekoVM (https://nekovm.org/) bytecode
252880	string		NEKO	NekoVM bytecode
25289>4	lelong		x	(%d global symbols,
25290>8	lelong		x	%d global fields,
25291>12	lelong		x	%d bytecode ops)
25292!:mime	application/x-nekovm-bytecode
25293
25294
25295#------------------------------------------------------------------------------
25296# $File: netbsd,v 1.26 2019/01/01 03:11:23 christos Exp $
25297# netbsd:  file(1) magic for NetBSD objects
25298#
25299# All new-style magic numbers are in network byte order.
25300# The old-style magic numbers are indistinguishable from the same magic
25301# numbers used in other systems, and are handled, for all those systems,
25302# in aout.
25303#
25304
253050	name	netbsd-detail
25306>20	lelong	x		@%#x
25307>4	lelong	>0		\b+T=%d
25308>8	lelong	>0		\b+D=%d
25309>12	lelong	>0		\b+B=%d
25310>16	lelong	>0		\b+S=%d
25311>24	lelong	>0		\b+TR=%d
25312>28	lelong	>0		\b+TD=%d
25313
253140	name			netbsd-4096
25315>0	byte			&0x80
25316>>20	lelong			<4096		shared library
25317>>20	lelong			=4096		dynamically linked executable
25318>>20	lelong			>4096		dynamically linked executable
25319>0	byte			^0x80		executable
25320>16	lelong			>0		not stripped
25321
253220	name			netbsd-8192
25323>0	byte			&0x80
25324>>20	lelong			<8192		shared library
25325>>20	lelong			=8192		dynamically linked executable
25326>>20	lelong			>8192		dynamically linked executable
25327>0	byte			^0x80		executable
25328>16	lelong			>0		not stripped
25329>0	use			netbsd-detail
25330
253310	name			netbsd-normal
25332>0	byte			&0x80		dynamically linked executable
25333>0	byte			^0x80
25334>>0	byte			&0x40		position independent
25335>>20	lelong			!0		executable
25336>>20	lelong			=0		object file
25337>16	lelong			>0		not stripped
25338>0	use			netbsd-detail
25339
253400	name			netbsd-pure
25341>0	byte			&0x80		dynamically linked executable
25342>0	byte			^0x80		executable
25343>16	lelong			>0		not stripped
25344>0	use			netbsd-detail
25345
253460	name			netbsd-core
25347>12	string			>\0		from '%s'
25348>32	lelong			!0		(signal %d)
25349
253500	belong&0377777777	041400413	a.out NetBSD/i386 demand paged
25351>0	use			netbsd-4096
25352
253530	belong&0377777777	041400410	a.out NetBSD/i386 pure
25354>0	use			netbsd-pure
25355
253560	belong&0377777777	041400407	a.out NetBSD/i386
25357>0	use			netbsd-normal
25358
253590	belong&0377777777	041400507	a.out NetBSD/i386 core
25360>0	use			netbsd-core
25361
253620	belong&0377777777	041600413	a.out NetBSD/m68k demand paged
25363>0	use			\^netbsd-8192
25364
253650	belong&0377777777	041600410	a.out NetBSD/m68k pure
25366>0	use			\^netbsd-pure
25367
253680	belong&0377777777	041600407	a.out NetBSD/m68k
25369>0	use			\^netbsd-normal
25370
253710	belong&0377777777	041600507	a.out NetBSD/m68k core
25372>0	use			\^netbsd-core
25373
253740	belong&0377777777	042000413	a.out NetBSD/m68k4k demand paged
25375>0	use			\^netbsd-4096
25376
253770	belong&0377777777	042000410	a.out NetBSD/m68k4k pure
25378>0	use			\^netbsd-pure
25379
253800	belong&0377777777	042000407	a.out NetBSD/m68k4k
25381>0	use			\^netbsd-normal
25382
253830	belong&0377777777	042000507	a.out NetBSD/m68k4k core
25384>0	use			\^netbsd-core
25385
253860	belong&0377777777	042200413	a.out NetBSD/ns32532 demand paged
25387>0	use			netbsd-4096
25388
253890	belong&0377777777	042200410	a.out NetBSD/ns32532 pure
25390>0	use			netbsd-pure
25391
253920	belong&0377777777	042200407	a.out NetBSD/ns32532
25393>0	use			netbsd-normal
25394
253950	belong&0377777777	042200507	a.out NetBSD/ns32532 core
25396>0	use			netbsd-core
25397
253980	belong&0377777777	045200507	a.out NetBSD/powerpc core
25399>0	use			netbsd-core
25400
254010	belong&0377777777	042400413	a.out NetBSD/SPARC demand paged
25402>0	use			\^netbsd-8192
25403
254040	belong&0377777777	042400410	a.out NetBSD/SPARC pure
25405>0	use			\^netbsd-pure
25406
254070	belong&0377777777	042400407	a.out NetBSD/SPARC
25408>0	use			\^netbsd-normal
25409
254100	belong&0377777777	042400507	a.out NetBSD/SPARC core
25411>0	use			\^netbsd-core
25412
254130	belong&0377777777	042600413	a.out NetBSD/pmax demand paged
25414>0	use			netbsd-4096
25415
254160	belong&0377777777	042600410	a.out NetBSD/pmax pure
25417>0	use			\^netbsd-pure
25418
254190	belong&0377777777	042600407	a.out NetBSD/pmax
25420>0	use			netbsd-normal
25421
254220	belong&0377777777	042600507	a.out NetBSD/pmax core
25423>0	use			netbsd-core
25424
254250	belong&0377777777	043000413	a.out NetBSD/vax 1k demand paged
25426>0	use			netbsd-4096
25427
254280	belong&0377777777	043000410	a.out NetBSD/vax 1k pure
25429>0	use			netbsd-pure
25430
254310	belong&0377777777	043000407	a.out NetBSD/vax 1k
25432>0	use			netbsd-normal
25433
254340	belong&0377777777	043000507	a.out NetBSD/vax 1k core
25435>0	use			netbsd-core
25436
254370	belong&0377777777	045400413	a.out NetBSD/vax 4k demand paged
25438>0	use			netbsd-4096
25439
254400	belong&0377777777	045400410	a.out NetBSD/vax 4k pure
25441>0	use			netbsd-pure
25442
254430	belong&0377777777	045400407	a.out NetBSD/vax 4k
25444>0	use			netbsd-normal
25445
254460	belong&0377777777	045400507	a.out NetBSD/vax 4k core
25447>0	use			netbsd-core
25448
25449# NetBSD/alpha does not support (and has never supported) a.out objects,
25450# so no rules are provided for them.  NetBSD/alpha ELF objects are
25451# dealt with in "elf".
254520	lelong		0x00070185		ECOFF NetBSD/alpha binary
25453>10	leshort		0x0001			not stripped
25454>10	leshort		0x0000			stripped
254550	belong&0377777777	043200507	a.out NetBSD/alpha core
25456>12	string			>\0		from '%s'
25457>32	lelong			!0		(signal %d)
25458
254590	belong&0377777777	043400413	a.out NetBSD/mips demand paged
25460>0	use			\^netbsd-8192
25461
25462>16	belong			>0		not stripped
254630	belong&0377777777	043400410	a.out NetBSD/mips pure
25464>0	use			netbsd-pure
25465
254660	belong&0377777777	043400407	a.out NetBSD/mips
25467>0	use			netbsd-normal
25468
254690	belong&0377777777	043400507	a.out NetBSD/mips core
25470>0	use			netbsd-core
25471
254720	belong&0377777777	043600413	a.out NetBSD/arm32 demand paged
25473>0	use			netbsd-4096
25474
254750	belong&0377777777	043600410	a.out NetBSD/arm32 pure
25476>0	use			netbsd-pure
25477
254780	belong&0377777777	043600407	a.out NetBSD/arm32
25479>0	use			netbsd-normal
25480
25481# NetBSD/arm26 has always used ELF objects, but it shares a core file
25482# format with NetBSD/arm32.
254830	belong&0377777777	043600507	a.out NetBSD/arm core
25484>0	use			netbsd-core
25485
25486# Kernel core dump format
254870	belong&0x0000ffff 0x00008fca	NetBSD kernel core file
25488>0	belong&0x03ff0000 0x00000000	\b, Unknown
25489>0	belong&0x03ff0000 0x00010000	\b, sun 68010/68020
25490>0	belong&0x03ff0000 0x00020000	\b, sun 68020
25491>0	belong&0x03ff0000 0x00640000	\b, 386 PC
25492>0	belong&0x03ff0000 0x00860000	\b, i386 BSD
25493>0	belong&0x03ff0000 0x00870000	\b, m68k BSD (8K pages)
25494>0	belong&0x03ff0000 0x00880000	\b, m68k BSD (4K pages)
25495>0	belong&0x03ff0000 0x00890000	\b, ns32532 BSD
25496>0	belong&0x03ff0000 0x008a0000	\b, SPARC/32 BSD
25497>0	belong&0x03ff0000 0x008b0000	\b, pmax BSD
25498>0	belong&0x03ff0000 0x008c0000	\b, vax BSD (1K pages)
25499>0	belong&0x03ff0000 0x008d0000	\b, alpha BSD
25500>0	belong&0x03ff0000 0x008e0000	\b, mips BSD (Big Endian)
25501>0	belong&0x03ff0000 0x008f0000	\b, arm6 BSD
25502>0	belong&0x03ff0000 0x00900000	\b, m68k BSD (2K pages)
25503>0	belong&0x03ff0000 0x00910000	\b, sh3 BSD
25504>0	belong&0x03ff0000 0x00950000	\b, ppc BSD (Big Endian)
25505>0	belong&0x03ff0000 0x00960000	\b, vax BSD (4K pages)
25506>0	belong&0x03ff0000 0x00970000	\b, mips1 BSD
25507>0	belong&0x03ff0000 0x00980000	\b, mips2 BSD
25508>0	belong&0x03ff0000 0x00990000	\b, m88k BSD
25509>0	belong&0x03ff0000 0x00920000	\b, parisc BSD
25510>0	belong&0x03ff0000 0x009b0000	\b, sh5/64 BSD
25511>0	belong&0x03ff0000 0x009c0000	\b, SPARC/64 BSD
25512>0	belong&0x03ff0000 0x009d0000	\b, amd64 BSD
25513>0	belong&0x03ff0000 0x009e0000	\b, sh5/32 BSD
25514>0	belong&0x03ff0000 0x009f0000	\b, ia64 BSD
25515>0	belong&0x03ff0000 0x00b70000	\b, aarch64 BSD
25516>0	belong&0x03ff0000 0x00b80000	\b, or1k BSD
25517>0	belong&0x03ff0000 0x00b90000	\b, Risk-V BSD
25518>0	belong&0x03ff0000 0x00c80000	\b, hp200 BSD
25519>0	belong&0x03ff0000 0x012c0000	\b, hp300 BSD
25520>0	belong&0x03ff0000 0x020b0000	\b, hp800 HP-UX
25521>0	belong&0x03ff0000 0x020c0000	\b, hp200/hp300 HP-UX
25522>0	belong&0xfc000000 0x04000000	\b, CPU
25523>0	belong&0xfc000000 0x08000000	\b, DATA
25524>0	belong&0xfc000000 0x10000000	\b, STACK
25525>4	leshort	x			\b, (headersize = %d
25526>6	leshort	x			\b, segmentsize = %d
25527>8	lelong	x			\b, segments = %d)
25528
25529# little endian only for now.
255300	name		ktrace
25531>4	leshort		7
25532>>6	leshort		<3		NetBSD ktrace file version %d
25533>>>12	string		x		from %s
25534>>>56	string		x		\b, emulation %s
25535>>>8	lelong		<65536		\b, pid=%d
25536
2553756	string		netbsd
25538>0	use		ktrace
2553956	string		linux
25540>0	use		ktrace
2554156	string		sunos
25542>0	use		ktrace
2554356	string		hpux
25544>0	use		ktrace
25545
25546#------------------------------------------------------------------------------
25547# $File: netscape,v 1.8 2017/03/17 21:35:28 christos Exp $
25548# netscape:  file(1) magic for Netscape files
25549# "H. Nanosecond" <aldomel@ix.netcom.com>
25550# version 3 and 4 I think
25551#
25552
25553# Netscape Address book  .nab
255540	string \000\017\102\104\000\000\000\000\000\000\001\000\000\000\000\002\000\000\000\002\000\000\004\000 Netscape Address book
25555
25556# Netscape Communicator address book
255570   string   \000\017\102\111 Netscape Communicator address book
25558
25559# .snm Caches
255600	string		#\ Netscape\ folder\ cache	Netscape folder cache
255610	string	\000\036\204\220\000	Netscape folder cache
25562# .n2p
25563# Net 2 Phone
25564#0	string	123\130\071\066\061\071\071\071\060\070\061\060\061\063\060
255650	string	SX961999	Net2phone
25566
25567#
25568#This is files ending in .art, FIXME add more rules
255690	string	JG\004\016\0\0\0\0	AOL ART image
255700	string	JG\003\016\0\0\0\0	AOL ART image
25571
25572#------------------------------------------------------------------------------
25573# $File: netware,v 1.5 2020/09/04 16:30:51 christos Exp $
25574# netware:  file(1) magic for NetWare Loadable Modules (NLMs)
25575# From: Mads Martin Joergensen <mmj@suse.de>
25576# URL:		https://en.wikipedia.org/wiki/NetWare_Loadable_Module
25577
255780	string	NetWare\ Loadable\ Module	NetWare Loadable Module
25579#!:mime	application/octet-stream
25580!:ext	nlm
25581
25582
25583#------------------------------------------------------------------------------
25584# $File: news,v 1.6 2009/09/19 16:28:11 christos Exp $
25585# news:  file(1) magic for SunOS NeWS fonts (not "news" as in "netnews")
25586#
255870	string		StartFontMetrics	ASCII font metrics
255880	string		StartFont	ASCII font bits
255890	belong		0x137A2944	NeWS bitmap font
255900	belong		0x137A2947	NeWS font family
255910	belong		0x137A2950	scalable OpenFont binary
255920	belong		0x137A2951	encrypted scalable OpenFont binary
255938	belong		0x137A2B45	X11/NeWS bitmap font
255948	belong		0x137A2B48	X11/NeWS font family
25595
25596#------------------------------------------------------------------------------
25597# $File: nitpicker,v 1.8 2019/04/19 00:42:27 christos Exp $
25598# nitpicker:  file(1) magic for Flowfiles.
25599# From: Christian Jachmann <C.Jachmann@gmx.net> https://www.nitpicker.de
256000	string	NPFF	NItpicker Flow File
25601>4	byte	x	V%d.
25602>5	byte	x	%d
25603>6	bedate	x	started: %s
25604>10	bedate	x	stopped: %s
25605>14	belong	x	Bytes: %u
25606>18	belong	x	Bytes1: %u
25607>22	belong	x	Flows: %u
25608>26	belong	x	Pkts: %u
25609
25610#------------------------------------------------------------------------------
25611# $File: numpy,v 1.1 2019/05/09 16:24:36 christos Exp $
25612# numpy: file(1) magic for NumPy array binary serialization format
25613# Reference: https://docs.scipy.org/doc/numpy/reference/generated/numpy.lib.format.html
256140	string		\x93NUMPY	NumPy array,
25615>6	ubyte		x		version %d
25616>7	ubyte		x		\b.%d,
25617>8	uleshort	x		header length %d
25618
25619#------------------------------------------------------------------------------
25620# $File: oasis,v 1.2 2014/06/03 19:17:27 christos Exp $
25621# OASIS
25622# Summary: OASIS stream file
25623# Long description: Open Artwork System Interchange Standard
25624# File extension: .oas
25625# Full name:	Ben Cowley (bcowley@broadcom.com)
25626#		Philip Dixon (pdixon@broadcom.com)
25627# Reference: http://www.wrcad.com/oasis/oasis-3626-042303-draft.pdf
25628#		(see page 3)
256290	string	%SEMI-OASIS\r\n		OASIS Stream file
25630
25631#------------------------------------------------------------------------------
25632# $File: ocaml,v 1.5 2010/09/20 18:55:20 rrt Exp $
25633# ocaml: file(1) magic for Objective Caml files.
256340	string	Caml1999	OCaml
25635>8	string	X		exec file
25636>8	string	I		interface file (.cmi)
25637>8	string	O		object file (.cmo)
25638>8	string	A		library file (.cma)
25639>8	string	Y		native object file (.cmx)
25640>8	string	Z		native library file (.cmxa)
25641>8	string	M		abstract syntax tree implementation file
25642>8	string	N		abstract syntax tree interface file
25643>9	string	>\0		(Version %3.3s)
25644
25645#------------------------------------------------------------------------------
25646# $File: octave,v 1.4 2009/09/19 16:28:11 christos Exp $
25647# octave binary data file(1) magic, from Dirk Eddelbuettel <edd@debian.org>
256480	string		Octave-1-L	Octave binary data (little endian)
256490	string		Octave-1-B	Octave binary data (big endian)
25650
25651#------------------------------------------------------------------------------
25652# $File: ole2compounddocs,v 1.10 2021/02/23 00:51:10 christos Exp $
25653# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured
25654# storage (https://en.wikipedia.org/wiki/Compound_File_Binary_Format)
25655# Additional tests for OLE 2 Compound Documents should be under this recipe.
25656# reference:	https://www.openoffice.org/sc/compdocfileformat.pdf
25657
256580   string  \320\317\021\340\241\261\032\341
25659# https://digital-preservation.github.io/droid/
25660# skip droid skeleton like fmt-39-signature-id-128.doc by valid version
25661>0x1A	ushort		!0xABAB		OLE 2 Compound Document
25662#>0x1C	uleshort		x			\b, endnian 0x%4.4x
25663# big endian not tested
25664>>0x1C	ubeshort		=0xfffe			\b, big-endian
25665>>>546	string	jbjb			: Microsoft Word Document
25666!:mime	application/msword
25667!:apple	MSWDWDBN
25668!:ext	doc
25669# Byte Order 0xFFFE means little-endian found in real world applications
25670#>>0x1C	uleshort		=0xfffe			\b, little-endian
25671>>0x1C	uleshort		=0xfffe
25672# From:		Joerg Jenderek
25673# Major Version 3 or 4
25674>>>0x1A	uleshort		x			\b, v%u
25675# Minor Version 32h=50 3Bh=59 3Eh=62
25676>>>0x18	uleshort		x			\b.%u
25677# SecID of first sector of the directory stream is often 1 but high like 3144h
25678>>>48	ulelong			x			\b, SecID 0x%x
25679# Sector Shift Exponent in short-stream container stream: 6~64 bytes
25680>>>32	uleshort		!6			\b, exponent of short stream %u
25681# total number of sectors used for the FAT
25682>>>44	ulelong			>1			\b, %u FAT sectors
25683# SecID of first sector of the short-sector allocation table (Mini FAT)
25684# or -2 (End Of ChainSecID) if not extant
25685>>>60	ulelong			!0xffFFffFE		\b, Mini FAT start sector 0x%x
25686# total number of sectors used for the short-sector allocation table
25687>>>64	ulelong			!1			\b, %u Mini FAT sector
25688# plural s
25689>>>>64	ulelong			>1			\bs
25690# SecID of first sector of the master sector allocation table (DIFAT)
25691# or -2 (End Of Chain SecID) if no additional sectors used
25692>>>68	ulelong			!0xffFFffFE		\b, DIFAT start sector 0x%x
25693# total number of sectors used for the master sector allocation table (DIFAT)
25694>>>72	ulelong			>0			\b, %u DIFAT sectors
25695# First part of the master sector allocation table (DIFAT) containing 109 SecIDs
25696#>>>76 	ubequad			x			\b, DIFAT=0x%16.16llx
25697#>>>84 	ubequad			x			\b%16.16llx...
25698# pointer to root entry only works with standard configuration for SecID ~< 800h
25699# Red-Carpet-presentation-1.0-1.sdd sg10.sdv 2000_GA_Annual_Review_Data.xls
25700# "ORLEN Factbook 2017.xls" XnView_metadata.doc
25701# "Barham, Lisa - Die Shopping-Prinzessinnen.doc" then not recognized
25702>>>48	ulelong			>0x800			too big for FILE_BYTES_MAX = 1 MiB
25703# Sector Shift Exponent 9~512 for major version 3 or C~4096 for major version 4
25704>>>0x1E	uleshort		0xc			\b, blocksize 4096
25705# jump to one block (4096 bytes per block) before root storage block
25706>>>>(48.l*4096)	ubyte	x
25707>>>>>&4095 	use		ole2-directory
25708#>>>0x1E	uleshort		9			\b, blocksize 512
25709>>>0x1E	uleshort		9
25710# jump to one block (512 bytes per block) before root storage block
25711# in 5.37 only true for offset ~< FILE_BYTES_MAX=7 MiB defined in ../../src/file.h
25712>>>>(48.l*512)	ubyte		x
25713>>>>>&511 	use		ole2-directory
25714# check directory entry structure and display types by GUID
257150	name			ole2-directory
25716# directory entry name like "Root Entry"
25717#>0 	lestring16	x 			\b, 1st %.10s
25718# type of the entry; 5~Root storage
25719#>66 	ubyte		x			\b, type %x
25720# node colour of the entry: 00H ~ Red 01H ~ Black
25721#>67 	ubyte		x			\b, color %x
25722# the DirIDs of the child nodes. Should both be -1 in the root storage entry
25723#>68 	bequad		!0xffffffffffffffff	\b, DirIDs %llx
25724# second directory entry name like VisioDocument Control000
25725#>128	lestring16	x \b, 2nd %.20s
25726# third directory entry like WordDocument
25727#>256	lestring16	x \b, 3rd %.20s
25728# forth
25729#>384	lestring16	x \b, 4th %.10s
25730# 5th
25731#>512	lestring16	x \b, 5th %.10s
25732# 6th
25733#>640	lestring16	x \b, 6th %.10s
25734# 7th
25735#>768	lestring16	x \b, 7th %.10s
25736#	https://wikileaks.org/ciav7p1/cms/page_13762814.html
25737#	https://m.blog.naver.com/superman4u/40047693679
25738#	https://misc.daniel-marschall.de/projects/guid_analysis/guid.txt
25739#	http://www.windowstricks.in/online-windows-guid-converter
25740#>80 	ubequad		!0			\b, clsid 0x%16.16llx
25741#>>88 	ubequad		x			\b%16.16llx
25742# test for "Root Entry" inside directory by type 5 value
25743>66 	ubyte		5
25744# look for CLSID GUID 0
25745>>88 	ubequad		0x0
25746>>>80 	ubequad		0x0
25747# - Microstation V8 DGN files (www.bentley.com)
25748# URL:	https://en.wikipedia.org/wiki/MicroStation
25749#   Last update on 10/23/2006 by Lester Hightower
25750#   07/24/2019 by Joerg Jenderek
25751# Second directory entry name like Dgn~H Dgn~S
25752>>>>128 	lestring16	Dgn~			: Microstation V8 CAD
25753#!:mime	application/x-ole-storage
25754!:mime	application/x-bentley-dgn
25755# http://www.q-cad.com/files/samples_cad_files/1344468165.dgn
25756!:ext	dgn
25757#
25758# URL:	http://fileformats.archiveteam.org/wiki/WordPerfect
25759# Second directory entry name PerfectOffice_
25760>>>>128 	lestring16	PerfectOffice_		: WordPerfect 7-X3 presentations Master, Document or Graphic
25761!:mime	application/vnd.wordperfect
25762# https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd
25763!:apple	????WPC7
25764!:ext	mst/wpd/wpg
25765#
25766# URL:	http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
25767# Second directory entry name MatOST_
25768>>>>128 	lestring16	MatOST			: Microsoft Works 3.0 document
25769!:mime	application/vnd.ms-works
25770!:apple	????AWWP
25771!:ext	wps
25772#
25773# URL:	http://fileformats.archiveteam.org/wiki/Microsoft_Works_Spreadsheet
25774# 3rd directory entry name WksSSWorkBook
25775>>>>256 	lestring16	WksSSWorkBook		: Microsoft Works 6-9 spreadsheet
25776!:mime	application/vnd.ms-works
25777!:apple	????AWSS
25778!:ext	xlr
25779#
25780# URL:	http://fileformats.archiveteam.org/wiki/XLS
25781# what is the difference to {00020820-0000-0000-c000-000000000046} ?
25782# Second directory entry name Workbook
25783>>>>128 	lestring16	Workbook
25784>>>>>256 	lestring16	!WksSSWorkBook		: Microsoft Excel 97-2003 worksheet 0 clsid
25785!:mime	application/vnd.ms-excel
25786# https://www.macdisk.com/macsigen.php	XLS5 for Excel 5
25787!:apple	????XLS9
25788!:ext	xls
25789#
25790# URL:	http://fileformats.archiveteam.org/wiki/PPT
25791# Second directory entry name Object1 Object12 Object35
25792>>>>128 	lestring16	Object			: Microsoft PowerPoint 4 presentation
25793!:mime	application/vnd.ms-powerpoint
25794# https://www.macdisk.com/macsigen.php
25795!:apple	????PPT3
25796!:ext	ppt
25797#
25798# URL:	https://www.msoutlook.info/question/164
25799# Second directory entry name __CollDataStm
25800>>>>128 	lestring16	__CollDataStm		: Microsoft Outlook Send Receive Settings
25801#!:mime	application/vnd.ms-outlook
25802!:mime	application/x-ms-srs
25803# %APPDATA%\Microsoft\Outlook\Outlook.srs
25804!:ext	srs
25805#
25806# URL:	https://www.file-extensions.org/cag-file-extension
25807# Second directory entry name Category
25808>>>>128 	lestring16	Category		: Microsoft Clip Art Gallery
25809#!:mime	application/x-ole-storage
25810!:mime	application/x-ms-cag
25811!:apple	MScgCGdb
25812!:ext	cag/
25813#
25814# URL:	https://www.filesuffix.com/de/extension/rra
25815# 3rd directory entry name StrIndex_StringTable
25816>>>>256 	lestring16	StrIndex_StringTable	: Windows temporarily installer
25817#!:mime	application/x-ole-storage
25818!:mime	application/x-ms-rra
25819!:ext	rra
25820#
25821# URL:	https://www.forensicswiki.org/wiki/Jump_Lists
25822# 3rd directory entry name DestList
25823>>>>256 	lestring16	DestList		: Windows jump list
25824#!:mime	application/x-ole-storage
25825!:mime	application/x-ms-jumplist
25826# %APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\*.automaticDestinations-ms
25827!:ext	automaticDestinations-ms
25828#
25829# URL:	https://en.wikipedia.org/wiki/Windows_thumbnail_cache
25830# Second directory entry name 256_
25831>>>>128 	lestring16	256_			: Windows thumbnail database 256
25832#!:mime	application/x-ole-storage
25833!:mime	application/x-ms-thumbnail
25834# Thumbs.db
25835!:ext	db
25836>>>>128 	lestring16	96_			: Windows thumbnail database 96
25837!:mime	application/x-ms-thumbnail
25838!:ext	db
25839# 3rd directory entry name Catalog_
25840>>>>256 	lestring16	Catalog			: Windows thumbnail database
25841!:mime	application/x-ms-thumbnail
25842!:ext	db
25843#
25844# URL:	https://support.microsoft.com/en-us/help/300887/how-to-use-system-information-msinfo32-command-line-tool-switches
25845# Note:	older Microsoft Systeminfo (MSInfo Configuration File of msinfo32); newer use xml based
25846# Second directory entry name Control000
25847>>>>128 	lestring16	Control000		: Microsoft old Systeminfo
25848#!:mime	application/x-ole-storage
25849!:mime	application/x-ms-info
25850!:ext	nfo
25851#
25852# URL:	http://fileformats.archiveteam.org/wiki/Corel_Print_House
25853# Second directory entry name Thumbnail
25854>>>>128 	lestring16	Thumbnail		: Corel PrintHouse image
25855#!:mime	application/x-ole-storage
25856!:mime	application/x-corel-cph
25857!:ext	cph
25858# 3rd directory entry name Thumbnail
25859>>>>256 	lestring16	Thumbnail		: Corel PrintHouse image
25860!:mime	application/x-corel-cph
25861!:ext	cph
25862# URL:	http://fileformats.archiveteam.org/wiki/Corel_Gallery
25863# Note:	format since Gallery 2; sometimes called Corel Multimedia Manager Album
25864# third directory entry name _INFO_
25865>>>>256 	lestring16	_INFO_			: Corel Gallery
25866# second directory entry name _ITEM_ or _DATA_
25867# later directory entry names: _ALBUM_ _THUMBNAIL_
25868#!:mime	application/x-ole-storage
25869!:mime	application/x-corel-gal
25870!:ext	gal
25871#
25872# URL:	https://en.wikipedia.org/wiki/Hangul_(word_processor)
25873# Note:	"HWP Document File" signature found in FileHeader
25874# Second directory entry name FileHeader hint for Thinkfree Office document
25875>>>>128 	lestring16	FileHeader		: Hangul (Korean) 5.0 Word Processor File
25876#!:mime	application/haansofthwp
25877!:mime	application/x-hwp
25878# https://example-files.online-convert.com/document/hwp/example.hwp
25879!:ext	hwp
25880#
25881# URL:	https://ask.libreoffice.org/en/question/26303/creating-new-themes-for-the-gallery-not-functioning/
25882# Second directory entry name like dd2000 dd2001 dd2036 dd2060 dd2083
25883>>>>128 	lestring16	dd2			: StarOffice Gallery view
25884#!:mime	application/x-ole-storage
25885!:mime	application/x-star-sdv
25886!:ext	sdv
25887# URL:	https://en.wikipedia.org/wiki/SoftMaker_Office
25888# second directory entry name Current User
25889>>>>128 	lestring16	Current\ User		: SoftMaker
25890# third directory entry name SMNativeObjData
25891>>>>>256	lestring16	SMNativeObjData
25892# 5th directory entry name PowerPoint
25893>>>>>>512	lestring16	PowerPoint		PowerPoint presentation or template
25894!:mime	application/vnd.ms-powerpoint
25895!:ext	ppt/pps/pot
25896# 4th directory entry name PowerPoint
25897>>>>>384	lestring16	PowerPoint		Presentations or template
25898# http://extension.nirsoft.net/prv
25899!:mime	application/vnd.softmaker.presentations
25900!:ext	prd/prv
25901# third directory entry name like Current User
25902>>>>256 	lestring16	Current\ User		: SoftMaker
25903# 5th directory entry name PowerPoint
25904>>>>>512	lestring16	PowerPoint		Presentations or template
25905# http://extension.nirsoft.net/prd
25906!:mime	application/vnd.softmaker.presentations
25907!:ext	prd/prv
25908# 2nd directory entry name Pictures
25909>>>>>>128 	lestring16	Pictures		with pictures
25910#	remaining null clsid
25911>>>>128 	default		x			: UNKNOWN
25912# second directory entry name like VisioDocument Control000
25913>>>>>128	lestring16	x with names %.20s
25914# third directory entry like WordDocument
25915>>>>>256	lestring16	x %.20s
25916# forth
25917>>>>>384	lestring16	x %.20s
25918!:mime	application/x-ole-storage
25919#	look for known clsid GUID
25920# - Visio documents
25921# URL:	http://fileformats.archiveteam.org/wiki/Visio
25922#   Last update on 10/23/2006 by Lester Hightower, 07/20/2019 by Joerg Jenderek
25923>>88 	ubequad		0xc000000000000046	: Microsoft
25924>>>80 	ubequad		0x131a020000000000	Visio 2000-2002 Document, stencil or template
25925!:mime	application/vnd.visio
25926# VSD~Drawing VSS~Stencil VST~Template
25927!:ext	vsd/vss/vst
25928>>>80 	ubequad		0x141a020000000000	Visio 2003-2010 Document, stencil or template
25929!:mime	application/vnd.visio
25930!:ext	vsd/vss/vst
25931#
25932# URL:	http://fileformats.archiveteam.org/wiki/Windows_Installer
25933>>>80 	ubequad		0x84100c0000000000	Windows Installer Package
25934!:mime	application/x-msi
25935#!:mime	application/x-ms-win-installer
25936!:ext	msi
25937>>>80 	ubequad		0x86100c0000000000	Windows Installer Patch
25938# ??
25939!:mime	application/x-wine-extension-msp
25940#!:mime	application/x-ms-msp
25941!:ext	msp
25942#
25943# URL:	http://fileformats.archiveteam.org/wiki/DOC
25944>>>80 	ubequad		0x0009020000000000	Word 6-95 document or template
25945!:mime	application/msword
25946# for template MSWDW8TN
25947!:apple	MSWDWDBN
25948!:ext	doc/dot
25949>>>80 	ubequad		0x0609020000000000	Word 97-2003 document or template
25950!:mime	application/msword
25951!:apple	MSWDWDBN
25952# dot for template; no extension on Macintosh
25953!:ext	doc/dot/
25954#
25955# URL:	http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
25956>>>80 	ubequad		0x0213020000000000	Works 3-4 document or template
25957!:mime	application/vnd.ms-works
25958!:apple	????AWWP
25959# ps for template	https://filext.com/file-extension/PS	bps for backup
25960!:ext	wps/ps/bps
25961#
25962# URL:	http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database
25963>>>80 	ubequad		0x0313020000000000	Works 3-4 database or template
25964!:mime	application/vnd.ms-works-db
25965# https://www.macdisk.com/macsigen.php
25966!:apple	????AWDB
25967# db for template www.file-extensions.org/db-file-extension-microsoft-works-data bdb for backup
25968!:ext	wdb/db/bdb
25969#
25970# URL:	https://en.wikipedia.org/wiki/Microsoft_Excel
25971>>>80 	ubequad		0x1008020000000000	Excel 5-95 worksheet, addin or template
25972!:mime	application/vnd.ms-excel
25973# https://www.macdisk.com/macsigen.php
25974!:apple	????XLS5
25975# worksheet/addin/template/no extension on Macintosh
25976!:ext	xls/xla/xlt/
25977#
25978>>>80 	ubequad		0x2008020000000000	Excel 97-2003
25979!:mime	application/vnd.ms-excel
25980# https://www.macdisk.com/macsigen.php	XLS5 for Excel 5
25981!:apple	????XLS9
25982# 3rd directory entry name
25983>>>>256 	lestring16	_VBA_PROJECT_CUR	addin
25984!:ext	xla/
25985# 4th directory entry name
25986>>>>384 	lestring16	_VBA_PROJECT_CUR	addin
25987!:ext	xla
25988#!:ext	xla/
25989>>>>256 	default		x			worksheet or template
25990!:ext	xls/xlt
25991#!:ext	xls/xlt/
25992#
25993# URL:	http://fileformats.archiveteam.org/wiki/OLE2
25994>>>80 	ubequad		0x0b0d020000000000	Outlook 97-2003 item
25995#>>>80 	ubequad		0x0b0d020000000000	Outlook 97-2003 Message
25996#!:mime	application/vnd.ms-outlook
25997!:mime	application/x-ms-msg
25998!:ext	msg
25999# URL:	https://wiki.fileformat.com/email/oft/
26000>>>80 	ubequad		0x46f0060000000000	Outlook 97-2003 item template
26001#!:mime	application/vnd.ms-outlook
26002!:mime	application/x-ms-oft
26003!:ext	oft
26004#
26005# URL:	http://fileformats.archiveteam.org/wiki/PPT
26006>>>80 	ubequad		0x5148040000000000	PowerPoint 4.0 presentation
26007!:mime	application/vnd.ms-powerpoint
26008# https://www.macdisk.com/macsigen.php
26009!:apple	????PPT3
26010!:ext	ppt
26011#??
26012# URL:	http://www.checkfilename.com/view-details/Microsoft-Works/RespageIndex/0/sTab/2/
26013>>88 	ubequad		0xa29a00aa004a1a72	: Microsoft
26014# URL:	http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
26015>>>80 	ubequad		0xc2dbcd28e20ace11	Works 4 document
26016!:mime	application/vnd.ms-works
26017!:apple	????AWWP
26018!:ext	wps
26019#
26020# URL:	http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database
26021>>>80 	ubequad		0xc3dbcd28e20ace11	Works 4 database
26022!:mime	application/vnd.ms-works-db
26023!:apple	????AWDB
26024!:ext	wdb/bdb
26025#??
26026>>88 	ubequad		0xa40700c04fb932ba	: Microsoft
26027# URL:	http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
26028>>>80 	ubequad		0xb25aa40e0a9ed111	Works 5-6 document
26029!:mime	application/vnd.ms-works
26030!:apple	????AWWP
26031!:ext	wps
26032#??
26033# URL:	http://fileformats.archiveteam.org/wiki/Microsoft_Publisher
26034>>88 	ubequad		0x00c0000000000046	: Microsoft
26035>>>80 	ubequad		0x0112020000000000	Publisher
26036!:mime	application/vnd.ms-publisher
26037!:ext	pub
26038#
26039# URL:	http://fileformats.archiveteam.org/wiki/PPT
26040#??
26041>>88 	ubequad		0xa90300aa00510ea3	: Microsoft
26042>>>80 	ubequad		0x70ae7bea3bfbcd11	PowerPoint 95 presentation
26043!:mime	application/vnd.ms-powerpoint
26044# https://www.macdisk.com/macsigen.php
26045!:apple	????PPT3
26046!:ext	ppt/pot
26047#??
26048>>88 	ubequad		0x86ea00aa00b929e8	: Microsoft
26049>>>80 	ubequad		0x108d81649b4fcf11	PowerPoint 97-2003 presentation or template
26050!:mime	application/vnd.ms-powerpoint
26051!:apple	????PPT3
26052# /autostart/template
26053!:ext	ppt/pps/pot
26054#
26055# URL:	https://en.wikipedia.org/wiki/Microsoft_Project
26056#??
26057>>88 	ubequad		0xbe1100c04fb6faf1	: Microsoft
26058>>>80 	ubequad		0x3a8fb774c8c8d111	Project
26059!:mime	application/vnd.ms-project
26060!:ext	mpp
26061#
26062# URL:	http://fileformats.archiveteam.org/wiki/SHW_(Corel)
26063#???
26064>>88 	ubequad		0x99ae04021c007002	: WordPerfect
26065>>>80 	ubequad		0x62fe2e4099191b10	7-X3 presentation
26066!:mime	application/x-corelpresentations
26067#!:mime	application/x-shw-viewer
26068#!:mime	image/x-presentations
26069!:ext	shw
26070#
26071# URL:	http://www.checkfilename.com/view-details/WordPerfect-Office-X3/RespageIndex/0/sTab/2/
26072>>>80 	ubequad		0x60fe2e4099191b10	9 Graphic
26073#!:mime	application/x-wpg
26074#!:mime	image/x-wordperfect-graphics
26075!:mime	image/x-wpg
26076# https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd
26077!:apple	????WPC9
26078!:ext	wpg
26079#
26080# URL:	http://fileformats.archiveteam.org/wiki/StarOffice_binary_formats
26081>>88 	ubequad		0x996104021c007002	: StarOffice
26082>>>80 	ubequad		0x407e5cdc5cb31b10	StarWriter 3.0 document or template
26083# https://www.openoffice.org/framework/documentation/mimetypes/mimetypes.html
26084!:mime	application/x-starwriter
26085!:ext	sdw/vor
26086#
26087>>>80 	ubequad		0xa03f543fa6b61b10	StarCalc 3.0 spreadsheet or template
26088!:mime	application/x-starcalc
26089!:ext	sdc/vor
26090#
26091>>>80 	ubequad		0xe0aa10af6db31b10	StarDraw 3.0 drawing or template
26092!:mime	application/x-starimpress
26093#!:mime	application/x-stardraw
26094# sda ??
26095!:ext	sdd/sda/vor
26096#??
26097>>88 	ubequad		0x89cb008029e4b0b1	: StarOffice
26098>>>80 	ubequad		0x41d461633542d011	StarCalc 4.0 spreadsheet or template
26099!:mime	application/x-starcalc
26100!:ext	sdc/vor
26101#
26102>>>80 	ubequad		0x61b8a5c6d685d111	StarCalc 5.0 spreadsheet or template
26103!:mime	application/vnd.stardivision.cal
26104!:ext	sdc/vor
26105#
26106>>>80 	ubequad		0xc03c2d011642d011	StarImpress 4.0 presentation or template
26107!:mime	application/x-starimpress
26108!:ext	sdd/vor
26109#??
26110>>88 	ubequad		0xb12a04021c007002	: StarOffice
26111>>>80 	ubequad		0x600459d4fd351c10	StarMath 3.0
26112!:mime	application/x-starmath
26113!:ext	smf
26114#??
26115>>88 	ubequad		0x8e2c00001b4cc711	: StarOffice
26116>>>80 	ubequad		0xe0999cfb6d2c1c10	StarChart 3.0
26117!:mime	application/x-starchart
26118!:ext	sds
26119#??
26120>>88 	ubequad		0xa45e00a0249d57b1	: StarOffice
26121>>>80 	ubequad		0xb0e9048b0e42d011	StarWriter 4.0 document or template
26122!:mime	application/x-starwriter
26123!:ext	sdw/vor
26124#??
26125>>88 	ubequad		0x89ca008029e4b0b1	: StarOffice
26126>>>80 	ubequad		0xe1b7b3022542d011	StarMath 4.0
26127!:mime	application/x-starmath
26128!:ext	smf
26129#
26130>>>80 	ubequad		0xe0b7b3022542d011	StarChart 4.0
26131!:mime	application/x-starchart
26132!:ext	sds
26133#??
26134>>88 	ubequad		0xa53f00a0249d57b1	: StarOffice
26135>>>80 	ubequad		0x70c90a340de3d011	Master 4.0 document
26136!:mime	application/x-starwriter-global
26137!:ext	sgl
26138#??
26139>>88 	ubequad		0x89d0008029e4b0b1	: StarOffice
26140>>>80 	ubequad		0x40e6b5ffde85d111	StarMath 5.0
26141!:mime	application/vnd.stardivision.math
26142!:ext	smf
26143#
26144>>>80 	ubequad		0xa005892ebd85d111	StarDraw 5.0 drawing or template
26145!:mime	application/vnd.stardivision.draw
26146!:ext	sda/vor
26147#
26148>>>80 	ubequad		0x21725c56bc85d111	StarImpress 5.0 presentation or template
26149!:mime	application/vnd.stardivision.impress
26150# sda is used for what?
26151!:ext	sdd/vor/sda
26152#
26153>>>80 	ubequad		0x214388bfdd85d111	StarChart 5.0
26154!:mime	application/vnd.stardivision.chart
26155!:ext	sds
26156# ??
26157>>88 	ubequad		0xaab4006097da561a	: StarOffice
26158>>>80 	ubequad		0xd1f90cc2ae85d111	StarWriter 5.0 document or template
26159!:mime	application/vnd.stardivision.writer
26160!:ext	sdw/vor
26161#
26162>>>80 	ubequad		0xd3f90cc2ae85d111	Master 5.0 document
26163!:mime	application/vnd.stardivision.writer-global
26164!:ext	sgl
26165#??
26166# URL:	http://fileformats.archiveteam.org/wiki/FlashPix
26167>>88 	ubequad		0x855300aa00a1f95b	: Kodak
26168>>>80 	ubequad		0x0067615654c1ce11	FlashPIX Image
26169!:mime	image/vnd.fpx
26170!:apple	????FPix
26171!:ext	fpx
26172# URL:	https://en.wikipedia.org/wiki/SoftMaker_Office
26173>>88 	ubequad		0x95f600a0cc3cca14	: PlanMaker
26174>>>80 	ubequad		0x9174088a6452d411	document or template
26175!:mime	application/vnd.softmaker.planmaker
26176# pmv for template	https://www.file-extensions.org/pmv-file-extension
26177!:ext	pmd/pmv
26178# remaining non null clsid
26179>>88 	default		x			: UNKNOWN
26180!:mime	application/x-ole-storage
26181>>>80 	ubequad		!0			\b, clsid 0x%16.16llx
26182>>>88 	ubequad		x			\b%16.16llx
26183
26184
26185#------------------------------------------------------------------------------
26186# $File: olf,v 1.4 2009/09/19 16:28:11 christos Exp $
26187# olf:  file(1) magic for OLF executables
26188#
26189# We have to check the byte order flag to see what byte order all the
26190# other stuff in the header is in.
26191#
26192# MIPS R3000 may also be for MIPS R2000.
26193# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
26194#
26195# Created by Erik Theisen <etheisen@openbsd.org>
26196# Based on elf from Daniel Quinlan <quinlan@yggdrasil.com>
261970	string		\177OLF		OLF
26198>4	byte		0		invalid class
26199>4	byte		1		32-bit
26200>4	byte		2		64-bit
26201>7	byte		0		invalid os
26202>7	byte		1		OpenBSD
26203>7	byte		2		NetBSD
26204>7	byte		3		FreeBSD
26205>7	byte		4		4.4BSD
26206>7	byte		5		Linux
26207>7	byte		6		SVR4
26208>7	byte		7		esix
26209>7	byte		8		Solaris
26210>7	byte		9		Irix
26211>7	byte		10		SCO
26212>7	byte		11		Dell
26213>7	byte		12		NCR
26214>5	byte		0		invalid byte order
26215>5	byte		1		LSB
26216>>16	leshort		0		no file type,
26217>>16	leshort		1		relocatable,
26218>>16	leshort		2		executable,
26219>>16	leshort		3		shared object,
26220# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de>
26221# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de>
26222>>16	leshort		4		core file
26223>>>(0x38+0xcc) string	>\0		of '%s'
26224>>>(0x38+0x10) lelong	>0		(signal %d),
26225>>16	leshort		&0xff00		processor-specific,
26226>>18	leshort		0		no machine,
26227>>18	leshort		1		AT&T WE32100 - invalid byte order,
26228>>18	leshort		2		SPARC - invalid byte order,
26229>>18	leshort		3		Intel 80386,
26230>>18	leshort		4		Motorola 68000 - invalid byte order,
26231>>18	leshort		5		Motorola 88000 - invalid byte order,
26232>>18	leshort		6		Intel 80486,
26233>>18	leshort		7		Intel 80860,
26234>>18	leshort		8		MIPS R3000_BE - invalid byte order,
26235>>18	leshort		9		Amdahl - invalid byte order,
26236>>18	leshort		10		MIPS R3000_LE,
26237>>18	leshort		11		RS6000 - invalid byte order,
26238>>18	leshort		15		PA-RISC - invalid byte order,
26239>>18	leshort		16		nCUBE,
26240>>18	leshort		17		VPP500,
26241>>18	leshort		18		SPARC32PLUS,
26242>>18	leshort		20		PowerPC,
26243>>18	leshort		0x9026		Alpha,
26244>>20	lelong		0		invalid version
26245>>20	lelong		1		version 1
26246>>36	lelong		1		MathCoPro/FPU/MAU Required
26247>8	string		>\0		(%s)
26248>5	byte		2		MSB
26249>>16	beshort		0		no file type,
26250>>16	beshort		1		relocatable,
26251>>16	beshort		2		executable,
26252>>16	beshort		3		shared object,
26253>>16	beshort		4		core file,
26254>>>(0x38+0xcc) string	>\0		of '%s'
26255>>>(0x38+0x10) belong	>0		(signal %d),
26256>>16	beshort		&0xff00		processor-specific,
26257>>18	beshort		0		no machine,
26258>>18	beshort		1		AT&T WE32100,
26259>>18	beshort		2		SPARC,
26260>>18	beshort		3		Intel 80386 - invalid byte order,
26261>>18	beshort		4		Motorola 68000,
26262>>18	beshort		5		Motorola 88000,
26263>>18	beshort		6		Intel 80486 - invalid byte order,
26264>>18	beshort		7		Intel 80860,
26265>>18	beshort		8		MIPS R3000_BE,
26266>>18	beshort		9		Amdahl,
26267>>18	beshort		10		MIPS R3000_LE - invalid byte order,
26268>>18	beshort		11		RS6000,
26269>>18	beshort		15		PA-RISC,
26270>>18	beshort		16		nCUBE,
26271>>18	beshort		17		VPP500,
26272>>18	beshort		18		SPARC32PLUS,
26273>>18	beshort		20		PowerPC or cisco 4500,
26274>>18	beshort		21		cisco 7500,
26275>>18	beshort		24		cisco SVIP,
26276>>18	beshort		25		cisco 7200,
26277>>18	beshort		36		cisco 12000,
26278>>18	beshort		0x9026		Alpha,
26279>>20	belong		0		invalid version
26280>>20	belong		1		version 1
26281>>36	belong		1		MathCoPro/FPU/MAU Required
26282
26283#------------------------------------------------------------------------------
26284# $File: openfst,v 1.1 2019/09/30 15:58:24 christos Exp $
26285# openfs:  file(1) magic for OpenFST (Weighted finite-state tranducer library)
26286
262870	long		0x7eb2fdd6	OpenFst binary FST data
26288>&0	pstring/l	x		\b, fst type: %s
26289>>&0	pstring/l	x		\b, arc type: %s
26290>>>&0	long		x		\b, version: %d
26291>>>>&20	quad		x		\b, num states: %lld
26292>>>>>&0	quad		>0		\b, num arcs: %lld
26293
262940	long    0x56515c	OpenFst binary FAR data, far type: stlist
26295>4	long 	x		\b, version: %d
26296
262970	long	0x7eb2f35c	OpenFst binary FAR data, far type: sttable
26298>4	long	x		\b, version: %d
26299
26300#------------------------------------------------------------
26301# $File: opentimestamps,v 1.1 2019/05/27 01:27:31 christos Exp $
26302# OpenTimestamps related magic entries
26303# https://opentimestamps.org/
26304# https://en.wikipedia.org/wiki/OpenTimestamps
26305# "Emanuele Cisbani" <emanuele.cisbani@gmail.com>
26306#------------------------------------------------------------
26307
26308# OpenTimestamps Proof .ots format.
26309# Magic is defined here:
26310# https://github.com/opentimestamps/python-opentimestamps/\
26311# blob/master/opentimestamps/core/timestamp.py#L273
26312
263130	string	\x00\x4f\x70\x65\x6e\x54\x69\x6d\x65\x73\x74\x61\x6d\x70\x73\x00 OpenTimestamps
26314>16	string	\x00\x50\x72\x6f\x6f\x66\x00\xbf\x89\xe2\xe8\x84\xe8\x92\x94\x01 Proof
26315
26316#------------------------------------------------------------------------------
26317# $File: os2,v 1.11 2020/08/30 16:22:20 christos Exp $
26318# os2:  file(1) magic for OS/2 files
26319#
26320
26321# Provided 1998/08/22 by
26322# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
263231	search/100	InternetShortcut	MS Windows 95 Internet shortcut text
26324>17	search/100	URL= 			(URL=<
26325>>&0	string		x			\b%s>)
26326
26327# OS/2 URL objects
26328# Provided 1998/08/22 by
26329# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
26330#0	string	http:			OS/2 URL object text
26331#>5	string	>\			(WWW) <http:%s>
26332#0	string	mailto:			OS/2 URL object text
26333#>7	string	>\			(email) <%s>
26334#0	string	news:			OS/2 URL object text
26335#>5	string	>\			(Usenet) <%s>
26336#0	string	ftp:			OS/2 URL object text
26337#>4	string	>\			(FTP) <ftp:%s>
26338#0	string	file:			OS/2 URL object text
26339#>5	string	>\			(Local file) <%s>
26340
26341# >>>>> OS/2 INF/HLP <<<<<  (source: Daniel Dissett ddissett@netcom.com)
26342# URL:		http://fileformats.archiveteam.org/wiki/INF/HLP_(OS/2)
26343# Reference:	http://www.edm2.com/0308/inf.html
26344# Carl Hauser (chauser.parc@xerox.com) and
26345# Marcus Groeber (marcusg@ph-cip.uni-koeln.de)
26346# list the following header format in inf02a.doc:
26347#
26348#  int16 ID;           // ID magic word (5348h = "HS")
26349#  int8  unknown1;     // unknown purpose, could be third letter of ID
26350#  int8  flags;        // probably a flag word...
26351#                      //  bit 0: set if INF style file
26352#                      //  bit 4: set if HLP style file
26353#                      // patching this byte allows reading HLP files
26354#                      // using the VIEW command, while help files
26355#                      // seem to work with INF settings here as well.
26356#  int16 hdrsize;      // total size of header
26357#  int16 unknown2;     // unknown purpose
26358#
263590   string  HSP\x01\x9b\x00 OS/2 INF
26360!:mime	application/x-os2-inf
26361!:ext	inf
26362>107 string >0                      (%s)
263630   string  HSP\x10\x9b\x00     OS/2 HLP
26364!:mime	application/x-os2-hlp
26365!:ext	hlp
26366>107 string >0                      (%s)
26367
26368# From:		Joerg Jenderek
26369# URL:		http://fileformats.archiveteam.org/wiki/MSG_(OS/2)
26370# Reference:	https://github.com/OS2World/UTIL-SYSTEM-MKMSGF/blob/master/mkmsgf.h
26371# Note:		created by MKMSGF.EXE. Text source can be recreated by E_MSGF
26372#		example like OS001H.MSG
263730	string			\xffMKMSGF\0	OS/2 help message
26374!:mime	application/x-os2-msg
26375!:ext	msg
26376# identifier[3] like: DOS NET REX SYS ...
26377>8	string				x	'%.3s'
26378# msgnumber: number of messages
26379>11	uleshort			x	\b, %u messages
26380# firstmsgnumber; number of the first message like: some times 0 often 1 169 1000 3502
26381>13	uleshort      			>1	\b, 1st number %u
26382# offset16bit; 1~Index table has 16-bit offsets (files<64k) 0~Index table has 32-bit offsets
26383>15	ubyte				=0	\b, 32-bit
26384#>15	ubyte				=1	\b, 16-bit
26385# version; file version: 2~new 0~old
26386>16	uleshort      			!2	\b, version %u
26387# indextaboffset; offset of index table: 1F~after header 0~no index table for version 0?
26388>18	uleshort			>0
26389>>18		uleshort		!0x1f	\b, at 0x%x index
26390#	32-bit offset
26391>>15		ubyte			=0
26392# offset with message table
26393>>>(18.s)		ulelong		x	\b, at 0x%x
26394# 1st message
26395# http://www.os2museum.com/files/docs/os210ptk/os2-1.0-ptk-tools-1988.pdf
26396# message type: E~Error H~Help I~Information P~Prompt W~Warning ?
26397>>>>(&-4.l)		ubyte		x	%c-type
26398>>>>>&0			string		x	%s
26399#	16-bit offset
26400>>15		ubyte			=1
26401# msgnum; message number
26402>>>(18.s)		uleshort	x	\b, number %u
26403# msgindex; offset of message from begin of file
26404>>>(18.s+2)		uleshort	x	at 0x%x
26405# message type E H I P W ?
26406>>>>(&-2.s)		ubyte		x	%c-type
26407# skip newline carriage return
26408>>>>>&0			ubeshort	=0x0D0a
26409>>>>>>&0		string		x	%s
26410>>>>>&0			ubeshort	!0x0D0a
26411>>>>>>&-2		string		x	%s
26412#		for version 0 index table apparently at offset 1F
26413>16	uleshort      			0
26414>>15		ubyte			1
26415# 1st message 16-bit
26416>>>0x1F			uleshort	x	\b, at 0x%x
26417# message type: E~Error H~Help I~Information P~Prompt W~Warning ?
26418>>>>(0x1F.s)		ubyte		x	%c-type
26419>>>>>&0			string		x	%s
26420# 2nd message 16-bit
26421>>>0x21			uleshort	x	\b, at 0x%x
26422>>>>(0x21.s)		ubyte		x	%c-type
26423>>>>>&0			string		x	%s
26424# 3rd message 16-bit
26425>>>0x23			uleshort	x	\b, at 0x%x
26426>>>>(0x23.s)		ubyte		x	%c-type
26427>>>>>&0			string		x	%s
26428#		version 0 32-bit
26429>>15		ubyte			0
26430# 1st message 32-bit
26431>>>0x1f			ulelong		x	\b, at 0x%x
26432>>>>(0x1F.l)		ubyte		x	%c-type
26433>>>>>&0			string		x	%s
26434# 2nd message 32-bit
26435>>>0x23			ulelong		x	\b, at 0x%x
26436>>>>(0x23.l)		ubyte		x	%c-type
26437>>>>>&0			string		x	%s
26438# 3rd message 32-bit
26439>>>0x27			ulelong		x	\b, AT 0x%x
26440>>>>(0x27.l)		ubyte		x	 %c-type
26441>>>>>&0			string		x	%s
26442# countryinfo; offset of country info block: 0 for version 0
26443>20	uleshort			!0	\b, at 0x%x countryinfo
26444# nextcoutryinfo
26445>>22		uleshort		>0	\b, at 0x%x next
26446# reserved[5]; Must be 0
26447>>25	ulelong		!0		\b, RESERVED 0x%x
26448>>(20.s) use				os2-msg-info
26449#	display country info block of MKMSGF message file
264500	name		os2-msg-info
26451# bytesperchar; bytes per char: 1~SBCS 2~DBCS
26452>0	ubyte		>1		\b, %u bytes/char
26453# reserved; Not known
26454>1	uleshort	!0		\b, reserved 0x%x
26455# langfamilyID; language family ID like: 0~? 1~Arabic ... 7~German ... 9~English  ... 34~Slovene
26456>3	uleshort	>0		\b, language %u
26457# langversionID; like: 7_1~German 7_2~Swiss German 12_1~French 12_3~Canadian French
26458>>5	uleshort	x		\b_%u
26459# langfamilyID too high. This should not happen
26460>3	uleshort	>34		(invalid language)
26461# codepagesnumber; number of codepages like: 1 2 ... 16
26462>7	uleshort	x		\b, %u code page
26463# plural s
26464>7	uleshort	>1		\bs
26465# too many number of codepages. This should not happen
26466>7	uleshort	>16		(Too many)
26467# codepages[16]; codepages list like 437 850 ...
26468>7	uleshort	<17
26469# 1st code page
26470>>9	uleshort	>0		%u
26471# possible 2nd code page number
26472>>>7	uleshort	>1
26473>>>>11	uleshort	x		%u
26474# filename[260]; name of file like: dbaseos2.msg dde4c01e.msg os2ldr.mgr xdfh.msg ...
26475>41	string		x	 	\b, %s
26476
26477# OS/2 INI (this is a guess)
264780  string   \xff\xff\xff\xff\x14\0\0\0  OS/2 INI
26479!:mime	application/x-os2-ini
26480!:ext	ini
26481
26482
26483#------------------------------------------------------------------------------
26484# $File: os400,v 1.5 2009/09/19 16:28:11 christos Exp $
26485# os400:  file(1) magic for IBM OS/400 files
26486#
26487# IBM OS/400 (i5/OS) Save file (SAVF) - gerardo.cacciari@gmail.com
26488# In spite of its quite variable format (due to internal memory page
26489# length differences between CISC and RISC versions of the OS) the
26490# SAVF structure hasn't suitable offsets to identify the catalog
26491# header in the first descriptor where there are some useful infos,
26492# so we must search in a somewhat large area for a particular string
26493# that represents the EBCDIC encoding of 'QSRDSSPC' (save/restore
26494# descriptor space) preceded by a two byte constant.
26495#
264961090	 search/7393	\x19\xDB\xD8\xE2\xD9\xC4\xE2\xE2\xD7\xC3 IBM OS/400 save file data
26497>&212	 byte		0x01			 \b, created with SAVOBJ
26498>&212	 byte		0x02			 \b, created with SAVLIB
26499>&212	 byte		0x07			 \b, created with SAVCFG
26500>&212	 byte		0x08			 \b, created with SAVSECDTA
26501>&212	 byte		0x0A			 \b, created with SAVSECDTA
26502>&212	 byte		0x0B			 \b, created with SAVDLO
26503>&212	 byte		0x0D			 \b, created with SAVLICPGM
26504>&212	 byte		0x11			 \b, created with SAVCHGOBJ
26505>&213	 byte		0x44			 \b, at least V5R4 to open
26506>&213	 byte		0x43			 \b, at least V5R3 to open
26507>&213	 byte		0x42			 \b, at least V5R2 to open
26508>&213	 byte		0x41			 \b, at least V5R1 to open
26509>&213	 byte		0x40			 \b, at least V4R5 to open
26510>&213	 byte		0x3F			 \b, at least V4R4 to open
26511>&213	 byte		0x3E			 \b, at least V4R3 to open
26512>&213	 byte		0x3C			 \b, at least V4R2 to open
26513>&213	 byte		0x3D			 \b, at least V4R1M4 to open
26514>&213	 byte		0x3B			 \b, at least V4R1 to open
26515>&213	 byte		0x3A			 \b, at least V3R7 to open
26516>&213	 byte		0x35			 \b, at least V3R6 to open
26517>&213	 byte		0x36			 \b, at least V3R2 to open
26518>&213	 byte		0x34			 \b, at least V3R1 to open
26519>&213	 byte		0x31			 \b, at least V3R0M5 to open
26520>&213	 byte		0x30			 \b, at least V2R3 to open
26521
26522#------------------------------------------------------------------------------
26523# $File: os9,v 1.8 2017/03/17 21:35:28 christos Exp $
26524#
26525# Copyright (c) 1996 Ignatios Souvatzis. All rights reserved.
26526#
26527# Redistribution and use in source and binary forms, with or without
26528# modification, are permitted provided that the following conditions
26529# are met:
26530# 1. Redistributions of source code must retain the above copyright
26531#    notice, this list of conditions and the following disclaimer.
26532# 2. Redistributions in binary form must reproduce the above copyright
26533#    notice, this list of conditions and the following disclaimer in the
26534#    documentation and/or other materials provided with the distribution.
26535#
26536# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
26537# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
26538# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
26539# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
26540# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
26541# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
26542# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
26543# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
26544# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
26545# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26546#
26547#
26548#
26549# OS9/6809 module descriptions:
26550#
265510	beshort		0x87CD	OS9/6809 module:
26552#
26553>6	byte&0x0f	0x00	non-executable
26554>6	byte&0x0f	0x01	machine language
26555>6	byte&0x0f	0x02	BASIC I-code
26556>6	byte&0x0f	0x03	Pascal P-code
26557>6	byte&0x0f	0x04	C I-code
26558>6	byte&0x0f	0x05	COBOL I-code
26559>6	byte&0x0f	0x06	Fortran I-code
26560#
26561>6	byte&0xf0	0x10	program executable
26562>6	byte&0xf0	0x20	subroutine
26563>6	byte&0xf0	0x30	multi-module
26564>6	byte&0xf0	0x40	data module
26565#
26566>6	byte&0xf0	0xC0	system module
26567>6	byte&0xf0	0xD0	file manager
26568>6	byte&0xf0	0xE0	device driver
26569>6	byte&0xf0	0xF0	device descriptor
26570#
26571# OS9/m68k stuff (to be continued)
26572#
265730	beshort		0x4AFC	OS9/68K module:
26574#
26575# attr
26576>0x14	byte&0x80	0x80	re-entrant
26577>0x14	byte&0x40	0x40	ghost
26578>0x14	byte&0x20	0x20	system-state
26579#
26580# lang:
26581#
26582>0x13	byte		1	machine language
26583>0x13	byte		2	BASIC I-code
26584>0x13	byte		3	Pascal P-code
26585>0x13	byte		4	C I-code
26586>0x13	byte		5	COBOL I-code
26587>0x13	byte		6	Fortran I-code
26588#
26589#
26590# type:
26591#
26592>0x12	byte		1	program executable
26593>0x12	byte		2	subroutine
26594>0x12	byte		3	multi-module
26595>0x12	byte		4	data module
26596>0x12	byte		11	trap library
26597>0x12	byte		12	system module
26598>0x12	byte		13	file manager
26599>0x12	byte		14	device driver
26600>0x12	byte		15	device descriptor
26601
26602#------------------------------------------------------------------------------
26603# $File: osf1,v 1.7 2009/09/19 16:28:11 christos Exp $
26604#
26605# Mach magic number info
26606#
266070	long		0xefbe	OSF/Rose object
26608# I386 magic number info
26609#
266100	short		0565	i386 COFF object
26611
26612#------------------------------------------------------------------------------
26613# $File: palm,v 1.14 2019/04/19 00:42:27 christos Exp $
26614# palm:	 file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks
26615#
26616# Brian Lalor <blalor@hcirisc.cs.binghamton.edu>
26617
26618# These are weak, byte 59 is not guaranteed to be 0 and there are
26619# 8 character identifiers at byte 60, one I found for appl is BIGb.
26620# What are the possibilities and where is this documented?
26621
26622# The common header format for PalmOS .pdb/.prc files is
26623# {
26624#         char            name[ 32 ];
26625#         Word            attributes;
26626#         Word            version;
26627#         DWord           creationDate;
26628#         DWord           modificationDate;
26629#         DWord           lastBackupDate;
26630#         DWord           modificationNumber;
26631#         DWord           appInfoID;
26632#         DWord           sortInfoID;
26633#         char            type[4];
26634#         char            creator[4];
26635#         DWord           uniqueIDSeed;
26636#         RecordListType  recordList;
26637# };
26638#
26639# Datestamps are unsigned seconds since the MacOS epoch (Jan 1, 1904),
26640# or Unix/POSIX time + 2082844800.
26641
266420		name		aportisdoc
26643# date is supposed to be big-endian seconds since 1 Jan 1904, but many
26644# files contain the timestamp in little-endian or a completely
26645# nonsensical value...
26646#>36		bedate-2082844800	>0	\b, created %s
26647# compression: 1=uncomp, 2=orig, 0x4448=HuffDic
26648>(78.L)		beshort		=1		\b, uncompressed
26649# compressed
26650>(78.L)		beshort		>1
26651>>(78.L+4)	belong		x		\b, %d bytes uncompressed
26652
26653# appl
26654#60		string		appl		PalmOS application
26655#>0		string		>\0		"%s"
26656
26657# HACK
26658#60		string		HACK		HackMaster hack
26659#>0		string		>\0		"%s"
26660
26661# iSiloX e-book
2666260		string		SDocSilX	iSiloX E-book
26663>0		string		>\0		"%s"
26664
26665# Mobipocket (www.mobipocket.com), donated by Carl Witty
26666# expanded by Ralf Brown
2666760		string	 	BOOKMOBI	Mobipocket E-book
26668# MobiPocket stores a full title, pointed at by the belong at offset
26669# 0x54 in its header at (78.L), with length given by the belong at
26670# offset 0x58.
26671# there's no guarantee that the title string is null-terminated, but
26672# we currently can't specify a variable-length string where the length
26673# field is not at the start of the string; in practice, the data
26674# following the string always seems to start with a zero byte
26675>(78.L)		belong		x
26676>>&(&0x50.L-4)	string		>\0		"%s"
26677>0		use		aportisdoc
26678>>(78.L+0x68)	belong		>0		\b, version %d
26679>>(78.L+0x1C)	belong		!0		\b, codepage %d
26680>>(78.L+0x0C)	beshort	 	>0		\b, encrypted (type %d)
26681
26682# AportisDoc/PalmDOC
2668360		string		TEXtREAd	AportisDoc/PalmDOC E-book
26684>0		string		>\0		"%s"
26685>0		use		aportisdoc
26686
26687# Variety of PalmOS document types
26688# Michael-John Turner <mj@debian.org>
26689# Thanks to Hasan Umit Ezerce <humit@tr-net.net.tr> for his DocType
2669060	string			BVokBDIC	BDicty PalmOS document
26691>0	string			>\0		"%s"
2669260	string			DB99DBOS	DB PalmOS document
26693>0	string			>\0		"%s"
2669460	string			vIMGView	FireViewer/ImageViewer PalmOS document
26695>0	string			>\0		"%s"
2669660	string			PmDBPmDB	HanDBase PalmOS document
26697>0	string			>\0		"%s"
2669860	string			InfoINDB	InfoView PalmOS document
26699>0	string			>\0		"%s"
2670060	string			ToGoToGo	iSilo PalmOS document
26701>0	string			>\0		"%s"
2670260	string			JfDbJBas	JFile PalmOS document
26703>0	string			>\0		"%s"
2670460	string			JfDbJFil	JFile Pro PalmOS document
26705>0	string			>\0		"%s"
2670660	string			DATALSdb	List PalmOS document
26707>0	string			>\0		"%s"
2670860	string			Mdb1Mdb1	MobileDB PalmOS document
26709>0	string			>\0		"%s"
2671060	string			PNRdPPrs	PeanutPress PalmOS document
26711>0	string			>\0		"%s"
2671260	string			DataPlkr	Plucker PalmOS document
26713>0	string			>\0		"%s"
2671460	string			DataSprd	QuickSheet PalmOS document
26715>0	string			>\0		"%s"
2671660	string			SM01SMem	SuperMemo PalmOS document
26717>0	string			>\0		"%s"
2671860	string			TEXtTlDc	TealDoc PalmOS document
26719>0	string			>\0		"%s"
2672060	string			InfoTlIf	TealInfo PalmOS document
26721>0	string			>\0		"%s"
2672260	string			DataTlMl	TealMeal PalmOS document
26723>0	string			>\0		"%s"
2672460	string			DataTlPt	TealPaint PalmOS document
26725>0	string			>\0		"%s"
2672660	string			dataTDBP	ThinkDB PalmOS document
26727>0	string			>\0		"%s"
2672860	string			TdatTide	Tides PalmOS document
26729>0	string			>\0		"%s"
2673060	string			ToRaTRPW	TomeRaider PalmOS document
26731>0	string			>\0		"%s"
26732
26733# A GutenPalm zTXT etext for use on Palm Pilots (http://gutenpalm.sf.net)
26734# For version 1.xx zTXTs, outputs version and numbers of bookmarks and
26735#   annotations.
26736# For other versions, just outputs version.
26737#
2673860		string		zTXT		A GutenPalm zTXT e-book
26739>0		string		>\0		"%s"
26740>(0x4E.L)	byte		0
26741>>(0x4E.L+1)	byte		x		(v0.%02d)
26742>(0x4E.L)	byte		1
26743>>(0x4E.L+1)	byte		x		(v1.%02d)
26744>>>(0x4E.L+10)	beshort		>0
26745>>>>(0x4E.L+10) beshort		<2		- 1 bookmark
26746>>>>(0x4E.L+10) beshort		>1		- %d bookmarks
26747>>>(0x4E.L+14)	beshort		>0
26748>>>>(0x4E.L+14) beshort		<2		- 1 annotation
26749>>>>(0x4E.L+14) beshort		>1		- %d annotations
26750>(0x4E.L)	byte		>1		(v%d.
26751>>(0x4E.L+1)	byte		x		%02d)
26752
26753# Palm OS .prc file types
2675460		string		libr
26755# flags, only bit 0 or bit 6
26756# https://en.wikipedia.org/wiki/PRC_%28Palm_OS%29
26757# https://web.mit.edu/tytso/www/pilot/prc-format.html
26758>0x20		beshort&0xffbe	0
26759>>0		string		>\0		Palm OS dynamic library data "%s"
2676060		string		ptch		Palm OS operating system patch data
26761>0		string		>\0		"%s"
26762
26763# Mobipocket (www.mobipocket.com), donated by Carl Witty
2676460	string			BOOKMOBI	Mobipocket E-book
26765>0	string			>\0		"%s"
26766
26767#------------------------------------------------------------------------------
26768# $File: parix,v 1.5 2020/03/08 22:18:32 christos Exp $
26769#
26770# Parix COFF executables
26771# From: Ignatios Souvatzis <ignatios@cs.uni-bonn.de>
26772#
267730	beshort&0xefff	0x8ACE	PARIX
26774>0	byte&0xf0	0x80	T800
26775>0	byte&0xf0	0x90	T9000
26776>19	byte&0x02	0x02	executable
26777>19	byte&0x02	0x00	object
26778>19	byte&0x0c	0x00	not stripped
26779#------------------------------------------------------------------------------
26780# $File: parrot,v 1.2 2019/04/19 00:42:27 christos Exp $
26781# parrot: file(1) magic for Parrot Virtual Machine
26782# URL:	https://www.lua.org/
26783# From: Lubomir Rintel <lkundrak@v3.sk>
26784
26785# Compiled Parrot byte code
267860	string	\376PBC\r\n\032\n	Parrot bytecode
26787>64	byte	x			%d.
26788>72	byte	x			\b%d,
26789>8	byte	>0			%d byte words,
26790>16	byte	0			little-endian,
26791>16	byte	1			big-endian,
26792>32	byte	0			IEEE-754 8 byte double floats,
26793>32	byte	1			x86 12 byte long double floats,
26794>32	byte	2			IEEE-754 16 byte long double floats,
26795>32	byte	3			MIPS 16 byte long double floats,
26796>32	byte	4			AIX 16 byte long double floats,
26797>32	byte	5			4-byte floats,
26798>40	byte	x			Parrot %d.
26799>48	byte	x			\b%d.
26800>56	byte	x			\b%d
26801#------------------------------------------------------------------------------
26802# $File: pascal,v 1.3 2020/06/07 18:10:26 christos Exp $
26803# pascal:  file(1) magic for Pascal source
26804#
268050	search/8192	(input,		Pascal source text
26806!:mime	text/x-pascal
26807#0	regex		\^program	Pascal source text
26808#!:mime	text/x-pascal
26809#0	regex           	\^record		Pascal source text
26810#!:mime	text/x-pascal
26811
26812# Free Pascal
268130	string	PPU	Pascal unit
26814>3	string	x	\b, version %s
26815
26816#------------------------------------------------------------------------------
26817# $File: pbf,v 1.3 2019/04/19 00:42:27 christos Exp $
26818# file(1) magic(5) data for OpenStreetMap
26819
26820# OpenStreetMap Protocolbuffer Binary Format (.osm.pbf)
26821# https://wiki.openstreetmap.org/wiki/PBF_Format
26822# From: Markus Heidelberg <markus.heidelberg@web.de>
268230	belong&0xfffffff0	0
26824>4	beshort			0x0A09
26825>>6	string			OSMHeader	OpenStreetMap Protocolbuffer Binary Format
26826
26827#------------------------------------------------------------------------------
26828# $File: pbm,v 1.6 2009/09/19 16:28:11 christos Exp $
26829# pbm:  file(1) magic for Portable Bitmap files
26830#
26831# XXX - byte order?
26832#
268330	short	0x2a17	"compact bitmap" format (Poskanzer)
26834#------------------------------------------------------------------------------
26835# pc88:  file(1) magic for the NEC Home Computer
26836# v1.0
26837# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
26838
26839# PC88 2D disk image
268400x20		ulelong&0xFFFFFEFF	0x2A0
26841>0x10		string		\0\0\0\0\0\0\0\0\0\0
26842>>0x280		string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
26843>>>0x1A		ubyte&0xEF	0
26844>>>>0x1B	ubyte&0x8F	0
26845>>>>>0x1B	ubyte&70	<0x40
26846>>>>>>0x1C	ulelong	>0x21
26847>>>>>>>0		regex	[[:print:]]*	NEC PC-88 disk image, name=%s
26848>>>>>>>>0x1B	ubyte	0	\b, media=2D
26849>>>>>>>>0x1B	ubyte	0x10	\b, media=2DD
26850>>>>>>>>0x1B	ubyte	0x20	\b, media=2HD
26851>>>>>>>>0x1B	ubyte	0x30	\b, media=1D
26852>>>>>>>>0x1B	ubyte	0x40	\b, media=1DD
26853>>>>>>>>0x1A	ubyte	0x10	\b, write-protected
26854
26855
26856
26857
26858#------------------------------------------------------------------------------
26859# pc98:  file(1) magic for the MSX Home Computer
26860# v1.0
26861# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
26862
26863# Maki-chan v1 Graphic format
26864# The image resolution should be X=(44.L - 40.L) and Y=(46.L - 42.L), but I couldn't find a way to do so
26865# http://www.jisyo.com/viewer/faq/maki_tech.htm
268660	string/b		MAKI01 	Maki-chan v1.
26867>6	ubyte|0x20	x		\b%c image
26868>8	ubelong		>0x40404040	\b, system ID:
26869>>8	byte		x		%c
26870>>9	byte		x		\b%c
26871>>10	byte		x		\b%c
26872>>11	byte		x		\b%c
26873>44	ubeshort	x		\b, %dx
26874>46	ubeshort	x		\b%d
26875>38	ubeshort&2	0		\b, 16 paletted RGB colors
26876>38	ubeshort&2	2		\b, 8 fixed RGB colors
26877>38	ubeshort&1	1		\b, 2:1 dot aspect ratio
26878
26879# Maki-chan v2 Graphic format
26880# http://www.jisyo.com/viewer/faq/mag_tech.htm
26881# https://mooncore.eu/bunny/txt/makichan.htm
26882# http://metanest.jp/mag/mag.xhtml
268830	string/b		MAKI02\ \ 	Maki-chan v2 image,
26884>8	byte		x		system ID: %c
26885>9	byte		x		\b%c
26886>10	byte		x		\b%c
26887>11	byte		x		\b%c,
26888>13	search/0x200	\x1A
26889#Maki-chan video modes are a bit messy and seems to have been expanded over the years without too much planing:
26890#1) When offset1(ubeshort) !=0x0344:
26891# 1.1) And  offset3(ubyte).b7=0:
26892# - b0=pixel aspect ratio: 1=2:1   (note: this ignores that the machine's 1:1 pixel aspect ratio isn't really 1:1)
26893# - b1=number of colors: 0=16 colors, 1=8 colors
26894# - b2=Palette or fixed colors flag (called "analog" and "digital" in the doc): 0=Paletted, 1=Fixed colors encoded directly in the pixel data
26895# 1.2) And  offset3(ubyte).B7=1:
26896# - b0=256 paletted colors
26897# - b1=256 fixed colors using the MSX SCR8 palette
26898#2) When offset1(ubeshort) =0x0344:
26899# - 256x212 image with 19268 YJK colors. The usual resolution and color information fields from the file must be ignored
26900>>&1	ubeshort	0x0344		256x212, 19268 fixed YJK colors
26901>>&1	ubeshort	!0x0344
26902>>>&5	uleshort+1	x		%dx
26903>>>&7	uleshort+1	x		\b%d,
26904>>>&0	ubyte&0x86	0x00		16 paletted RGB colors
26905>>>&0	ubyte&0x86	0x02		8 paletted RGB colors
26906>>>&0	ubyte&0x86	0x04		16 fixed RGB colors
26907>>>&0	ubyte&0x86	0x06		8 fixed RGB colors
26908>>>&0	ubyte&0x81	0x80		256 paletted RGB colors
26909>>>&0	ubyte&0x81	0x81		256 fixed MSX-SCR8 colors
26910>>>&0	ubyte&0x01	1		\b, 2:1 dot aspect ratio
26911
26912# XLD4 (Q4) picture
2691311	string/b	MAJYO		XLD4(Q4) picture
26914
26915# Yanagisawa Pi picture
26916#0	string		Pi\x1A\0	Yanagisawa Pi picture
26917#>3	search/0x200	\x04
269180	string		Pi
26919>2	search/0x200	\x1A
26920>>&0	ubyte		0
26921>>>&3	ubyte		4		Yanagisawa Pi 16 color picture,
26922>>>&4	byte		x		system ID: %c
26923>>>&5	byte		x		\b%c
26924>>>&6	byte		x		\b%c
26925>>>&7	byte		x		\b%c,
26926>>>&10	ubeshort	x		%dx
26927>>>&12	ubeshort	x		\b%d
26928>>>&3	ubyte		8		Yanagisawa Pi 256 color picture
26929>>>&4	byte		x		system ID: %c
26930>>>&5	byte		x		\b%c
26931>>>&6	byte		x		\b%c
26932>>>&7	byte		x		\b%c,
26933>>>&10	ubeshort	x		%dx
26934>>>&12	ubeshort	x		\b%d
26935
26936#------------------------------------------------------------------------------
26937# $File: pcjr,v 1.1 2021/01/09 15:09:58 christos Exp $
26938# pcjr:  file(1) magic for PCjr Cartridge image file format
26939# From: Francis Laniel <laniel_francis@privacyrequired.com>
269400	string	PCjr
26941>0x80	beshort	0x55aa	PCjr Cartridge image
26942>0x200	beshort	0x55aa	PCjr Cartridge image
26943
26944#------------------------------------------------------------------------------
26945# $File: pdf,v 1.15 2020/08/23 00:30:45 christos Exp $
26946# pdf:  file(1) magic for Portable Document Format
26947#
26948
269490	name	pdf
26950>8	search		/Count
26951>>&0	regex		[0-9]+		\b, %s pages
26952>8	search/512	/Filter/FlateDecode/	(password protected)
26953
269540	string		%PDF-		PDF document
26955!:mime	application/pdf
26956!:strength +60
26957!:ext	pdf
26958>5	byte		x		\b, version %c
26959>7	byte		x		\b.%c
26960>0	use		pdf
26961
269620	string		\012%PDF-	PDF document
26963!:mime	application/pdf
26964!:strength +60
26965!:ext	pdf
26966>6	byte		x		\b, version %c
26967>8	byte		x		\b.%c
26968>0	use		pdf
26969
269700	string		\xef\xbb\xbf%PDF-	PDF document (UTF-8)
26971!:mime	application/pdf
26972!:strength +60
26973!:ext	pdf
26974>6	byte		x		\b, version %c
26975>8	byte		x		\b.%c
26976>0	use		pdf
26977
26978# From: Nick Schmalenberger <nick@schmalenberger.us>
26979# Forms Data Format
269800       string          %FDF-           FDF document
26981!:mime application/vnd.fdf
26982!:strength +60
26983!:ext	pdf
26984>5      byte            x               \b, version %c
26985>7      byte            x               \b.%c
26986
269870	search/256	%PDF-		PDF document
26988!:mime	application/pdf
26989!:strength +60
26990!:ext	pdf
26991>&0	byte		x		\b, version %c
26992>&2	byte		x		\b.%c
26993>0	use		pdf
26994
26995#------------------------------------------------------------------------------
26996# $File: pdp,v 1.11 2017/03/17 21:35:28 christos Exp $
26997# pdp:  file(1) magic for PDP-11 executable/object and APL workspace
26998#
269990	lelong		0101555		PDP-11 single precision APL workspace
270000	lelong		0101554		PDP-11 double precision APL workspace
27001#
27002# PDP-11 a.out
27003#
270040	leshort		0407		PDP-11 executable
27005>8	leshort		>0		not stripped
27006>15	byte		>0		- version %d
27007
27008# updated by Joerg Jenderek at Mar 2013
27009# GRR: line below too general as it catches also Windows precompiled setup information *.PNF
270100	leshort		0401
27011# skip *.PNF with WinDirPathOffset 58h
27012>68	ulelong		!0x00000058	PDP-11 UNIX/RT ldp
27013# skip *.PNF with high byte of InfVersionDatumCount zero
27014#>>15	byte		!0		PDP-11 UNIX/RT ldp
270150	leshort		0405		PDP-11 old overlay
27016
270170	leshort		0410		PDP-11 pure executable
27018>8	leshort		>0		not stripped
27019>15	byte		>0		- version %d
27020
270210	leshort		0411		PDP-11 separate I&D executable
27022>8	leshort		>0		not stripped
27023>15	byte		>0		- version %d
27024
270250	leshort		0437		PDP-11 kernel overlay
27026
27027# These last three are derived from 2.11BSD file(1)
270280	leshort		0413		PDP-11 demand-paged pure executable
27029>8	leshort		>0		not stripped
27030
270310	leshort		0430		PDP-11 overlaid pure executable
27032>8	leshort		>0		not stripped
27033
270340	leshort		0431		PDP-11 overlaid separate executable
27035>8	leshort		>0		not stripped
27036#------------------------------------------------------------------------------
27037# $File: perl,v 1.26 2017/02/21 18:34:55 christos Exp $
27038# perl:  file(1) magic for Larry Wall's perl language.
27039#
27040# The `eval' lines recognizes an outrageously clever hack.
27041# Keith Waclena <keith@cerberus.uchicago.edu>
27042# Send additions to <perl5-porters@perl.org>
270430	search/1024	eval\ "exec\ perl		Perl script text
27044!:mime	text/x-perl
270450	search/1024	eval\ "exec\ /bin/perl		Perl script text
27046!:mime	text/x-perl
270470	search/1024	eval\ "exec\ /usr/bin/perl	Perl script text
27048!:mime	text/x-perl
270490	search/1024	eval\ "exec\ /usr/local/bin/perl	Perl script text
27050!:mime	text/x-perl
270510	search/1024	eval\ 'exec\ perl		Perl script text
27052!:mime	text/x-perl
270530	search/1024	eval\ 'exec\ /bin/perl		Perl script text
27054!:mime	text/x-perl
270550	search/1024	eval\ 'exec\ /usr/bin/perl	Perl script text
27056!:mime	text/x-perl
270570	search/1024	eval\ 'exec\ /usr/local/bin/perl	Perl script text
27058!:mime	text/x-perl
270590	search/1024	eval\ '(exit\ $?0)'\ &&\ eval\ 'exec	Perl script text
27060!:mime	text/x-perl
270610	string	#!/usr/bin/env\ perl	Perl script text executable
27062!:mime	text/x-perl
270630	string	#!\ /usr/bin/env\ perl	Perl script text executable
27064!:mime	text/x-perl
270650	string	#!
27066>0	regex	\^#!.*/bin/perl([[:space:]].*)*$	Perl script text executable
27067!:mime	text/x-perl
27068
27069# by Dmitry V. Levin and Alexey Tourbin
27070# check the first line
270710	search/8192	package
27072>0	regex		\^package[\ \t]+[0-9A-Za-z_:]+\ *;	Perl5 module source text
27073!:strength + 40
27074# not 'p', check other lines
270750	search/8192	!p
27076>0	regex		\^package[\ \t]+[0-9A-Za-z_:]+\ *;
27077>>0	regex		\^1\ *;|\^(use|sub|my)\ .*[(;{=]	Perl5 module source text
27078!:strength + 75
27079
27080# Perl POD documents
27081# From: Tom Hukins <tom@eborcom.com>
270820	search/1024/W	\=pod\n		Perl POD document text
270830	search/1024/W	\n\=pod\n	Perl POD document text
270840	search/1024/W	\=head1\ 	Perl POD document text
270850	search/1024/W	\n\=head1\ 	Perl POD document text
270860	search/1024/W	\=head2\ 	Perl POD document text
270870	search/1024/W	\n\=head2\ 	Perl POD document text
270880	search/1024/W	\=encoding\ 	Perl POD document text
270890	search/1024/W	\n\=encoding\ 	Perl POD document text
27090
27091
27092# Perl Storable data files.
270930	string	perl-store	perl Storable (v0.6) data
27094>4	byte	>0	(net-order %d)
27095>>4	byte	&01	(network-ordered)
27096>>4	byte	=3	(major 1)
27097>>4	byte	=2	(major 1)
27098
270990	string	pst0	perl Storable (v0.7) data
27100>4	byte	>0
27101>>4	byte	&01	(network-ordered)
27102>>4	byte	=5	(major 2)
27103>>4	byte	=4	(major 2)
27104>>5	byte	>0	(minor %d)
27105
27106# This is Debian #742949 by Zefram <zefram@fysh.org>:
27107# -----------------------------------------------------------
27108# The Perl module Hash::SharedMem
27109# <https://metacpan.org/release/Hash-SharedMem> defines a file format
27110# for a key/value store.  Details of the file format are in the "DESIGN"
27111# file in the module distribution.  Magic:
271120	bequad	=0xa58afd185cbf5af7	Hash::SharedMem master file, big-endian
27113>8	bequad	<0x1000000
27114>>15	byte	>2	\b, line size 2^%d byte
27115>>14	byte	>2	\b, page size 2^%d byte
27116>>13	byte	&1
27117>>>13	byte	>1	\b, max fanout %d
271180	lequad	=0xa58afd185cbf5af7	Hash::SharedMem master file, little-endian
27119>8	lequad	<0x1000000
27120>>8	byte	>2	\b, line size 2^%d byte
27121>>9	byte	>2	\b, page size 2^%d byte
27122>>10	byte	&1
27123>>>10	byte	>1	\b, max fanout %d
271240	bequad	=0xc693dac5ed5e47c2	Hash::SharedMem data file, big-endian
27125>8	bequad	<0x1000000
27126>>15	byte	>2	\b, line size 2^%d byte
27127>>14	byte	>2	\b, page size 2^%d byte
27128>>13	byte	&1
27129>>>13	byte	>1	\b, max fanout %d
271300	lequad	=0xc693dac5ed5e47c2	Hash::SharedMem data file, little-endian
27131>8	lequad	<0x1000000
27132>>8	byte	>2	\b, line size 2^%d byte
27133>>9	byte	>2	\b, page size 2^%d byte
27134>>10	byte	&1
27135>>>10	byte	>1	\b, max fanout %d
27136
27137#------------------------------------------------------------------------------
27138# $File: pgf,v 1.3 2021/02/23 00:51:10 christos Exp $
27139# pgf: file(1) magic for Progressive Graphics File (PGF)
27140#
27141# <http://www.libpgf.org/uploads/media/PGF_Details_01.pdf>
27142# 2013 by Philipp Hahn <pmhahn debian org>
271430 string PGF Progressive Graphics image data,
27144!:mime image/x-pgf
27145>3	string	2	version %s,
27146>3	string	4	version %s,
27147>3	string	5	version %s,
27148>3	string	6	version %s,
27149#	PGFPreHeader
27150#>>4	lelong	x	header size %d,
27151#	PGFHeader
27152>>8	lelong	x	%d x
27153>>12	lelong	x	%d,
27154>>16	byte	x	%d levels,
27155>>17	byte	x	compression level %d,
27156>>18	byte	x	%d bpp,
27157>>19	byte	x	%d channels,
27158>>20	clear	x
27159>>20	byte	0	bitmap,
27160>>20	byte	1	gray scale,
27161>>20	byte	2	indexed color,
27162>>20	byte	3	RGB color,
27163>>20	byte	4	CMYK color,
27164>>20	byte	5	HSL color,
27165>>20	byte	6	HSB color,
27166>>20	byte	7	multi-channel,
27167>>20	byte	8	duo tone,
27168>>20	byte	9	LAB color,
27169>>20	byte	10	gray scale 16,
27170>>20	byte	11	RGB color 48,
27171>>20	byte	12	LAB color 48,
27172>>20	byte	13	CMYK color 64,
27173>>20	byte	14	deep multi-channel,
27174>>20	byte	15	duo tone 16,
27175>>20	byte	17	RGBA color,
27176>>20	byte	18	gray scale 32,
27177>>20	byte	19	RGB color 12,
27178>>20	byte	20	RGB color 16,
27179>>20	byte	255	unknown format,
27180>>20	default	x	format
27181>>>20	byte	x	\b %d,
27182>>21	byte	x	%d bpc
27183#	PGFPostHeader
27184#	Level-Sizes
27185#>>(4.l+4)	lelong x level 0 size: %d
27186#>>(4.l+8)	lelong x level 1 size: %d
27187#>>(4.l+12)	lelong x level 2 size: %d
27188
27189#------------------------------------------------------------------------------
27190# $File: pgp,v 1.24 2020/10/14 21:07:29 christos Exp $
27191# pgp:  file(1) magic for Pretty Good Privacy
27192
27193# Handling of binary PGP keys is in pgp-binary-keys.
27194# see https://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html
27195#
271960	beshort		0xa600			PGP encrypted data
27197#!:mime	application/pgp-encrypted
27198#0	string		-----BEGIN\040PGP	text/PGP armored data
27199!:mime	text/PGP # encoding: armored data
27200#>15	string	PUBLIC\040KEY\040BLOCK-	public key block
27201#>15	string	MESSAGE-		message
27202#>15	string	SIGNED\040MESSAGE-	signed message
27203#>15	string	PGP\040SIGNATURE-	signature
27204
27205# Update:	Joerg Jenderek
27206# URL:		http://en.wikipedia.org/wiki/Pretty_Good_Privacy
27207# Reference:	https://reposcope.com/mimetype/application/pgp-keys
272082	string	---BEGIN\040PGP\040PRIVATE\040KEY\040BLOCK-	PGP private key block
27209#!:mime	text/PGP
27210!:mime	application/pgp-keys
27211!:ext	asc
272122	string	---BEGIN\040PGP\040PUBLIC\040KEY\040BLOCK-	PGP public key block
27213!:mime	application/pgp-keys
27214!:ext	asc
27215>10	search/100	\n\n
27216>>&0	use		pgp
272170	string	-----BEGIN\040PGP\040MESSAGE-		PGP message
27218# https://reposcope.com/mimetype/application/pgp-encrypted
27219#!:mime	application/pgp
27220!:mime	application/pgp-encrypted
27221!:ext	asc
27222#!:ext	asc/pgp/gpg
27223>10	search/100	\n\n
27224>>&0	use		pgp
27225# Reference:	https://www.gnupg.org/gph/en/manual/x135.html
272260	string	-----BEGIN\040PGP\040SIGNED\040MESSAGE-	PGP signed message
27227#!:mime	text/plain
27228!:mime	text/PGP
27229#!:mime	application/pgp
27230!:ext	asc
272310	string	-----BEGIN\040PGP\040SIGNATURE-		PGP signature
27232# https://reposcope.com/mimetype/application/pgp-signature
27233!:mime	application/pgp-signature
27234!:ext	asc
27235>10	search/100	\n\n
27236>>&0	use		pgp
27237
27238# Decode the type of the packet based on it's base64 encoding.
27239# Idea from Mark Martinec
27240# The specification is in RFC 4880, section 4.2 and 4.3:
27241# https://tools.ietf.org/html/rfc4880#section-4.2
27242
272430	name		pgp
27244>0	byte		0x67		Reserved (old)
27245>0	byte		0x68		Public-Key Encrypted Session Key (old)
27246>0	byte		0x69		Signature (old)
27247>0	byte		0x6a		Symmetric-Key Encrypted Session Key (old)
27248>0	byte		0x6b		One-Pass Signature (old)
27249>0	byte		0x6c		Secret-Key (old)
27250>0	byte		0x6d		Public-Key (old)
27251>0	byte		0x6e		Secret-Subkey (old)
27252>0	byte		0x6f		Compressed Data (old)
27253>0	byte		0x70		Symmetrically Encrypted Data (old)
27254>0	byte		0x71		Marker (old)
27255>0	byte		0x72		Literal Data (old)
27256>0	byte		0x73		Trust (old)
27257>0	byte		0x74		User ID (old)
27258>0	byte		0x75		Public-Subkey (old)
27259>0	byte		0x76		Unused (old)
27260>0	byte		0x77
27261>>1	byte&0xc0	0x00		Reserved
27262>>1	byte&0xc0	0x40		Public-Key Encrypted Session Key
27263>>1	byte&0xc0	0x80		Signature
27264>>1	byte&0xc0	0xc0		Symmetric-Key Encrypted Session Key
27265>0	byte		0x78
27266>>1	byte&0xc0	0x00		One-Pass Signature
27267>>1	byte&0xc0	0x40		Secret-Key
27268>>1	byte&0xc0	0x80		Public-Key
27269>>1	byte&0xc0	0xc0		Secret-Subkey
27270>0	byte		0x79
27271>>1	byte&0xc0	0x00		Compressed Data
27272>>1	byte&0xc0	0x40		Symmetrically Encrypted Data
27273>>1	byte&0xc0	0x80		Marker
27274>>1	byte&0xc0	0xc0		Literal Data
27275>0	byte		0x7a
27276>>1	byte&0xc0	0x00		Trust
27277>>1	byte&0xc0	0x40		User ID
27278>>1	byte&0xc0	0x80		Public-Subkey
27279>>1	byte&0xc0	0xc0		Unused [z%x]
27280>0	byte		0x30
27281>>1	byte&0xc0	0x00		Unused [0%x]
27282>>1	byte&0xc0	0x40		User Attribute
27283>>1	byte&0xc0	0x80		Sym. Encrypted and Integrity Protected Data
27284>>1	byte&0xc0	0xc0		Modification Detection Code
27285
27286# magic signatures to detect PGP crypto material (from stef)
27287# detects and extracts metadata from:
27288#  - symmetric encrypted packet header
27289#  - RSA (e=65537) secret (sub-)keys
27290
27291# 1024b RSA encrypted data
27292
272930	string	\x84\x8c\x03		PGP RSA encrypted session key -
27294>3	belong	x			keyid: %08X
27295>7	belong	x			%08X
27296>11	byte	0x01			RSA (Encrypt or Sign) 1024b
27297>11	byte	0x02			RSA Encrypt-Only 1024b
27298>12	string	\x04\x00
27299>12	string	\x03\xff
27300>12	string	\x03\xfe
27301>12	string	\x03\xfd
27302>12	string	\x03\xfc
27303>12	string	\x03\xfb
27304>12	string	\x03\xfa
27305>12	string	\x03\xf9
27306>142	byte	0xd2			.
27307
27308# 2048b RSA encrypted data
27309
273100	string	\x85\x01\x0c\x03	PGP RSA encrypted session key -
27311>4	belong	x			keyid: %08X
27312>8	belong	x			%08X
27313>12	byte	0x01			RSA (Encrypt or Sign) 2048b
27314>12	byte	0x02			RSA Encrypt-Only 2048b
27315>13	string	\x08\x00
27316>13	string	\x07\xff
27317>13	string	\x07\xfe
27318>13	string	\x07\xfd
27319>13	string	\x07\xfc
27320>13	string	\x07\xfb
27321>13	string	\x07\xfa
27322>13	string	\x07\xf9
27323>271	byte	0xd2			.
27324
27325# 3072b RSA encrypted data
27326
273270	string	\x85\x01\x8c\x03	PGP RSA encrypted session key -
27328>4	belong	x			keyid: %08X
27329>8	belong	x			%08X
27330>12	byte	0x01			RSA (Encrypt or Sign) 3072b
27331>12	byte	0x02			RSA Encrypt-Only 3072b
27332>13	string	\x0c\x00
27333>13	string	\x0b\xff
27334>13	string	\x0b\xfe
27335>13	string	\x0b\xfd
27336>13	string	\x0b\xfc
27337>13	string	\x0b\xfb
27338>13	string	\x0b\xfa
27339>13	string	\x0b\xf9
27340>399	byte	0xd2			.
27341
27342# 4096b RSA encrypted data
27343
273440	string	\x85\x02\x0c\x03	PGP RSA encrypted session key -
27345>4	belong	x			keyid: %08X
27346>8	belong	x			%08X
27347>12	byte	0x01			RSA (Encrypt or Sign) 4096b
27348>12	byte	0x02			RSA Encrypt-Only 4096b
27349>13	string	\x10\x00
27350>13	string	\x0f\xff
27351>13	string	\x0f\xfe
27352>13	string	\x0f\xfd
27353>13	string	\x0f\xfc
27354>13	string	\x0f\xfb
27355>13	string	\x0f\xfa
27356>13	string	\x0f\xf9
27357>527	byte	0xd2			.
27358
27359# 8192b RSA encrypted data
27360
273610	string	\x85\x04\x0c\x03	PGP RSA encrypted session key -
27362>4	belong	x			keyid: %08X
27363>8	belong	x			%08X
27364>12	byte	0x01			RSA (Encrypt or Sign) 8192b
27365>12	byte	0x02			RSA Encrypt-Only 8192b
27366>13	string	\x20\x00
27367>13	string	\x1f\xff
27368>13	string	\x1f\xfe
27369>13	string	\x1f\xfd
27370>13	string	\x1f\xfc
27371>13	string	\x1f\xfb
27372>13	string	\x1f\xfa
27373>13	string	\x1f\xf9
27374>1039	byte	0xd2			.
27375
27376# 1024b Elgamal encrypted data
27377
273780	string	\x85\x01\x0e\x03	PGP Elgamal encrypted session key -
27379>4	belong	x			keyid: %08X
27380>8	belong	x			%08X
27381>12	byte	0x10			Elgamal Encrypt-Only 1024b.
27382>13	string	\x04\x00
27383>13	string	\x03\xff
27384>13	string	\x03\xfe
27385>13	string	\x03\xfd
27386>13	string	\x03\xfc
27387>13	string	\x03\xfb
27388>13	string	\x03\xfa
27389>13	string	\x03\xf9
27390
27391# 2048b Elgamal encrypted data
27392
273930	string	\x85\x02\x0e\x03	PGP Elgamal encrypted session key -
27394>4	belong	x			keyid: %08X
27395>8	belong	x			%08X
27396>12	byte	0x10			Elgamal Encrypt-Only 2048b.
27397>13	string	\x08\x00
27398>13	string	\x07\xff
27399>13	string	\x07\xfe
27400>13	string	\x07\xfd
27401>13	string	\x07\xfc
27402>13	string	\x07\xfb
27403>13	string	\x07\xfa
27404>13	string	\x07\xf9
27405
27406# 3072b Elgamal encrypted data
27407
274080	string	\x85\x03\x0e\x03	PGP Elgamal encrypted session key -
27409>4	belong	x			keyid: %08X
27410>8	belong	x			%08X
27411>12	byte	0x10			Elgamal Encrypt-Only 3072b.
27412>13	string	\x0c\x00
27413>13	string	\x0b\xff
27414>13	string	\x0b\xfe
27415>13	string	\x0b\xfd
27416>13	string	\x0b\xfc
27417>13	string	\x0b\xfb
27418>13	string	\x0b\xfa
27419>13	string	\x0b\xf9
27420
27421# crypto algo mapper
27422
274230	name	crypto
27424>0	byte	0x00			Plaintext or unencrypted data
27425>0	byte	0x01			IDEA
27426>0	byte	0x02			TripleDES
27427>0	byte	0x03			CAST5 (128 bit key)
27428>0	byte	0x04			Blowfish (128 bit key, 16 rounds)
27429>0	byte	0x07			AES with 128-bit key
27430>0	byte	0x08			AES with 192-bit key
27431>0	byte	0x09			AES with 256-bit key
27432>0	byte	0x0a			Twofish with 256-bit key
27433
27434# hash algo mapper
27435
274360	name	hash
27437>0	byte	0x01			MD5
27438>0	byte	0x02			SHA-1
27439>0	byte	0x03			RIPE-MD/160
27440>0	byte	0x08			SHA256
27441>0	byte	0x09			SHA384
27442>0	byte	0x0a			SHA512
27443>0	byte	0x0b			SHA224
27444
27445# display public key algorithms as human readable text
274460	name	key_algo
27447>0	byte	0x01			RSA (Encrypt or Sign)
27448# keep old look of version 5.28 without parentheses
27449>0	byte	0x02			RSA Encrypt-Only
27450>0	byte	0x03			RSA (Sign-Only)
27451>0	byte	16			ElGamal (Encrypt-Only)
27452>0	byte	17			DSA
27453>0	byte	18			Elliptic Curve
27454>0	byte	19			ECDSA
27455>0	byte	20			ElGamal (Encrypt or Sign)
27456>0	byte	21			Diffie-Hellman
27457>0	default	x
27458>>0	ubyte	<22			unknown (pub %d)
27459# this should never happen
27460>>0	ubyte	>21			invalid (%d)
27461
27462# pgp symmetric encrypted data
27463
274640	byte	0x8c			PGP symmetric key encrypted data -
27465>1	byte	0x0d
27466>1	byte	0x0c
27467>2	byte	0x04
27468>3	use	crypto
27469>4	byte	0x01			salted -
27470>>5	use	hash
27471>>14	byte	0xd2			.
27472>>14	byte	0xc9			.
27473>4	byte	0x03			salted & iterated -
27474>>5	use	hash
27475>>15	byte	0xd2			.
27476>>15	byte	0xc9			.
27477
27478# encrypted keymaterial needs s2k & can be checksummed/hashed
27479
274800	name	chkcrypto
27481>0	use	crypto
27482>1	byte	0x00			Simple S2K
27483>1	byte	0x01			Salted S2K
27484>1	byte	0x03			Salted&Iterated S2K
27485>2	use	hash
27486
27487# all PGP keys start with this prolog
27488# containing version, creation date, and purpose
27489
274900	name	keyprolog
27491>0	byte	0x04
27492>1	beldate	x			created on %s -
27493>5	byte	0x01			RSA (Encrypt or Sign)
27494>5	byte	0x02			RSA Encrypt-Only
27495
27496# end of secret keys known signature
27497# contains e=65537 and the prolog to
27498# the encrypted parameters
27499
275000	name	keyend
27501>0	string	\x00\x11\x01\x00\x01	e=65537
27502>5	use	crypto
27503>5	byte	0xff			checksummed
27504>>6	use	chkcrypto
27505>5	byte	0xfe			hashed
27506>>6	use	chkcrypto
27507
27508# PGP secret keys contain also the public parts
27509# these vary by bitsize of the key
27510
275110	name	x1024
27512>0	use	keyprolog
27513>6	string	\x03\xfe
27514>6	string	\x03\xff
27515>6	string	\x04\x00
27516>136	use	keyend
27517
275180	name	x2048
27519>0	use	keyprolog
27520>6	string	\x80\x00
27521>6	string	\x07\xfe
27522>6	string	\x07\xff
27523>264	use	keyend
27524
275250	name	x3072
27526>0	use	keyprolog
27527>6	string	\x0b\xfe
27528>6	string	\x0b\xff
27529>6	string	\x0c\x00
27530>392	use	keyend
27531
275320	name	x4096
27533>0	use	keyprolog
27534>6	string	\x10\x00
27535>6	string	\x0f\xfe
27536>6	string	\x0f\xff
27537>520	use	keyend
27538
27539# \x00|\x1f[\xfe\xff]).{1024})'
275400	name	x8192
27541>0	use	keyprolog
27542>6	string	\x20\x00
27543>6	string	\x1f\xfe
27544>6	string	\x1f\xff
27545>1032	use	keyend
27546
27547# depending on the size of the pkt
27548# we branch into the proper key size
27549# signatures defined as x{keysize}
27550
275510	name	pgpkey
27552>0	string	\x01\xd8	1024b
27553>>2	use	x1024
27554>0	string	\x01\xeb	1024b
27555>>2	use	x1024
27556>0	string	\x01\xfb	1024b
27557>>2	use	x1024
27558>0	string	\x01\xfd	1024b
27559>>2	use	x1024
27560>0	string	\x01\xf3	1024b
27561>>2	use	x1024
27562>0	string	\x01\xee	1024b
27563>>2	use	x1024
27564>0	string	\x01\xfe	1024b
27565>>2	use	x1024
27566>0	string	\x01\xf4	1024b
27567>>2	use	x1024
27568>0	string	\x02\x0d	1024b
27569>>2	use	x1024
27570>0	string	\x02\x03	1024b
27571>>2	use	x1024
27572>0	string	\x02\x05	1024b
27573>>2	use	x1024
27574>0	string	\x02\x15	1024b
27575>>2	use	x1024
27576>0	string	\x02\x00	1024b
27577>>2	use	x1024
27578>0	string	\x02\x10	1024b
27579>>2	use	x1024
27580>0	string	\x02\x04	1024b
27581>>2	use	x1024
27582>0	string	\x02\x06	1024b
27583>>2	use	x1024
27584>0	string	\x02\x16	1024b
27585>>2	use	x1024
27586>0	string	\x03\x98	2048b
27587>>2	use	x2048
27588>0	string	\x03\xab	2048b
27589>>2	use	x2048
27590>0	string	\x03\xbb	2048b
27591>>2	use	x2048
27592>0	string	\x03\xbd	2048b
27593>>2	use	x2048
27594>0	string	\x03\xcd	2048b
27595>>2	use	x2048
27596>0	string	\x03\xb3	2048b
27597>>2	use	x2048
27598>0	string	\x03\xc3	2048b
27599>>2	use	x2048
27600>0	string	\x03\xc5	2048b
27601>>2	use	x2048
27602>0	string	\x03\xd5	2048b
27603>>2	use	x2048
27604>0	string	\x03\xae	2048b
27605>>2	use	x2048
27606>0	string	\x03\xbe	2048b
27607>>2	use	x2048
27608>0	string	\x03\xc0	2048b
27609>>2	use	x2048
27610>0	string	\x03\xd0	2048b
27611>>2	use	x2048
27612>0	string	\x03\xb4	2048b
27613>>2	use	x2048
27614>0	string	\x03\xc4	2048b
27615>>2	use	x2048
27616>0	string	\x03\xc6	2048b
27617>>2	use	x2048
27618>0	string	\x03\xd6	2048b
27619>>2	use	x2048
27620>0	string	\x05X		3072b
27621>>2	use	x3072
27622>0	string	\x05k		3072b
27623>>2	use	x3072
27624>0	string	\x05{		3072b
27625>>2	use	x3072
27626>0	string	\x05}		3072b
27627>>2	use	x3072
27628>0	string	\x05\x8d	3072b
27629>>2	use	x3072
27630>0	string	\x05s		3072b
27631>>2	use	x3072
27632>0	string	\x05\x83	3072b
27633>>2	use	x3072
27634>0	string	\x05\x85	3072b
27635>>2	use	x3072
27636>0	string	\x05\x95	3072b
27637>>2	use	x3072
27638>0	string	\x05n		3072b
27639>>2	use	x3072
27640>0	string	\x05\x7e	3072b
27641>>2	use	x3072
27642>0	string	\x05\x80	3072b
27643>>2	use	x3072
27644>0	string	\x05\x90	3072b
27645>>2	use	x3072
27646>0	string	\x05t		3072b
27647>>2	use	x3072
27648>0	string	\x05\x84	3072b
27649>>2	use	x3072
27650>0	string	\x05\x86	3072b
27651>>2	use	x3072
27652>0	string	\x05\x96	3072b
27653>>2	use	x3072
27654>0	string	\x07[		4096b
27655>>2	use	x4096
27656>0	string	\x07\x18	4096b
27657>>2	use	x4096
27658>0	string	\x07+		4096b
27659>>2	use	x4096
27660>0	string	\x07;		4096b
27661>>2	use	x4096
27662>0	string	\x07=		4096b
27663>>2	use	x4096
27664>0	string	\x07M		4096b
27665>>2	use	x4096
27666>0	string	\x073		4096b
27667>>2	use	x4096
27668>0	string	\x07C		4096b
27669>>2	use	x4096
27670>0	string	\x07E		4096b
27671>>2	use	x4096
27672>0	string	\x07U		4096b
27673>>2	use	x4096
27674>0	string	\x07.		4096b
27675>>2	use	x4096
27676>0	string	\x07>		4096b
27677>>2	use	x4096
27678>0	string	\x07@		4096b
27679>>2	use	x4096
27680>0	string	\x07P		4096b
27681>>2	use	x4096
27682>0	string	\x074		4096b
27683>>2	use	x4096
27684>0	string	\x07D		4096b
27685>>2	use	x4096
27686>0	string	\x07F		4096b
27687>>2	use	x4096
27688>0	string	\x07V		4096b
27689>>2	use	x4096
27690>0	string	\x0e[		8192b
27691>>2	use	x8192
27692>0	string	\x0e\x18	8192b
27693>>2	use	x8192
27694>0	string	\x0e+		8192b
27695>>2	use	x8192
27696>0	string	\x0e;		8192b
27697>>2	use	x8192
27698>0	string	\x0e=		8192b
27699>>2	use	x8192
27700>0	string	\x0eM		8192b
27701>>2	use	x8192
27702>0	string	\x0e3		8192b
27703>>2	use	x8192
27704>0	string	\x0eC		8192b
27705>>2	use	x8192
27706>0	string	\x0eE		8192b
27707>>2	use	x8192
27708>0	string	\x0eU		8192b
27709>>2	use	x8192
27710>0	string	\x0e.		8192b
27711>>2	use	x8192
27712>0	string	\x0e>		8192b
27713>>2	use	x8192
27714>0	string	\x0e@		8192b
27715>>2	use	x8192
27716>0	string	\x0eP		8192b
27717>>2	use	x8192
27718>0	string	\x0e4		8192b
27719>>2	use	x8192
27720>0	string	\x0eD		8192b
27721>>2	use	x8192
27722>0	string	\x0eF		8192b
27723>>2	use	x8192
27724>0	string	\x0eV		8192b
27725>>2	use	x8192
27726
27727# PGP RSA (e=65537) secret (sub-)key header
27728
277290	byte	0x97			PGP Secret Sub-key -
27730>1	use	pgpkey
277310	byte	0x9d
27732# Update: Joerg Jenderek
27733# secret subkey packet (tag 7) with same structure as secret key packet (tag 5)
27734# skip Fetus.Sys16 CALIBUS.MAIN OrbFix.Sys16.Ex by looking for positive len
27735>1	ubeshort	>0
27736#>1	ubeshort	x		\b, body length 0x%x
27737# next packet type often 88h,89h~(tag 2)~Signature Packet
27738#>>(1.S+3)	ubyte	x		\b, next packet type 0x%x
27739# skip Dragon.SHR DEMO.INIT by looking for positive version
27740>>3	ubyte		>0
27741# skip BUISSON.13 GUITAR1 by looking for low version number
27742>>>3	ubyte		<5		PGP Secret Sub-key
27743# sub-key are normally part of secret key. So it does not occur as standalone file
27744#!:ext	bin
27745# version 2,3~old 4~new . Comment following line for version 5.28 look
27746>>>>3	ubyte		x		(v%d)
27747>>>>3	ubyte		x		-
27748# old versions 2 or 3 but no real example found
27749>>>>3	ubyte		<4
27750# 2 byte for key bits in version 5.28 look
27751>>>>>11		ubeshort	x	%db
27752>>>>>4		beldate		x	created on %s -
27753# old versions use 2 additional bytes after time stamp
27754#>>>>>8		ubeshort	x	0x%x
27755# display key algorithm 1~RSA Encrypt|Sign - 21~Diffie-Hellman
27756>>>>>10	  	use		key_algo
27757>>>>>(11.S/8)	ubequad		x
27758# look after first key
27759>>>>>>&5	use		keyend
27760# new version
27761>>>>3	ubyte		>3
27762>>>>>9		ubeshort	x	%db
27763>>>>>4		beldate		x	created on %s -
27764# display key algorithm
27765>>>>>8		use		key_algo
27766>>>>>(9.S/8)	ubequad		x
27767# look after first key for something like s2k
27768>>>>>>&3	use		keyend
27769
27770#------------------------------------------------------------------------------
27771# $File: pgp-binary-keys,v 1.1 2020/10/14 21:07:29 christos Exp $
27772# pgp-binary-keys: This file handles pgp binary keys.
27773#
27774# An PGP certificate or message doesn't have a fixed header.  Instead,
27775# they are sequences of packets:
27776#
27777#   https://tools.ietf.org/html/rfc4880#section-4.3
27778#
27779# whose order conforms to a grammar:
27780#
27781#   https://tools.ietf.org/html/rfc4880#section-11
27782#
27783# Happily most packets have a few fields that are constrained, which
27784# allow us to fingerprint them with relatively high certainty.
27785#
27786# A PGP packet is described by a single byte: the so-called CTB.  The
27787# high-bit is always set.  If bit 6 is set, then it is a so-called
27788# new-style CTB; if bit 6 is clear, then it is a so-called old-style
27789# CTB.  Old-style CTBs have only four bits of type information; bits
27790# 1-0 are used to describe the length.  New-style CTBs have 6 bits of
27791# type information.
27792#
27793# Following the CTB is the packet's length in bytes.  If we blindly
27794# advance the file cursor by this amount past the end of the length
27795# information we come to the next packet.
27796#
27797# Data Structures
27798# ===============
27799#
27800# New Style CTB
27801# -------------
27802#
27803# https://tools.ietf.org/html/rfc4880#section-4.2.2
27804#
27805#   76543210
27806#   ||\----/
27807#   ||  tag
27808#   |always 1
27809#   always 1
27810#
27811#      Tag   bits 7 and 6 set
27812#       0       0xC0        -- Reserved - a packet tag MUST NOT have this value
27813#       1       0xC1        -- Public-Key Encrypted Session Key Packet
27814#       2       0xC2        -- Signature Packet
27815#       3       0xC3        -- Symmetric-Key Encrypted Session Key Packet
27816#       4       0xC4        -- One-Pass Signature Packet
27817#       5       0xC5        -- Secret-Key Packet
27818#       6       0xC6        -- Public-Key Packet
27819#       7       0xC7        -- Secret-Subkey Packet
27820#       8       0xC8        -- Compressed Data Packet
27821#       9       0xC9        -- Symmetrically Encrypted Data Packet
27822#       10      0xCA        -- Marker Packet
27823#       11      0xCB        -- Literal Data Packet
27824#       12      0xCC        -- Trust Packet
27825#       13      0xCD        -- User ID Packet
27826#       14      0xCE        -- Public-Subkey Packet
27827#       17      0xD1        -- User Attribute Packet
27828#       18      0xD2        -- Sym. Encrypted and Integrity Protected Data Packet
27829#       19      0xD3        -- Modification Detection Code Packet
27830#       60 to 63 -- Private or Experimental Values
27831#
27832# The CTB is followed by the length header, which is densely encoded:
27833#
27834#   if length[0] is:
27835#     0..191: one byte length (length[0])
27836#     192..223: two byte length ((length[0] - 192) * 256 + length[2] + 192
27837#     224..254: four byte length (big endian interpretation of length[1..5])
27838#     255: partial body encoding
27839#
27840# The partial body encoding is similar to HTTP's chunk encoding.  It
27841# is only allowed for container packets (SEIP, Compressed Data and
27842# Literal).
27843#
27844# Old Style CTB
27845# -------------
27846#
27847#  https://tools.ietf.org/html/rfc4880#section-4.2.1
27848#
27849# CTB:
27850#
27851#   76543210
27852#   ||\--/\/
27853#   ||  |  length encoding
27854#   ||  tag
27855#   |always 0
27856#   always 1
27857#
27858# Tag:
27859#
27860#      Tag   bit 7 set, bits 6, 1, 0 clear
27861#       0       0x80        -- Reserved - a packet tag MUST NOT have this value
27862#       1       0x84        -- Public-Key Encrypted Session Key Packet
27863#       2       0x88        -- Signature Packet
27864#       3       0x8C        -- Symmetric-Key Encrypted Session Key Packet
27865#       4       0x90        -- One-Pass Signature Packet
27866#       5       0x94        -- Secret-Key Packet
27867#       6       0x98        -- Public-Key Packet
27868#       7       0x9C        -- Secret-Subkey Packet
27869#       8       0xA0        -- Compressed Data Packet
27870#       9       0xA4        -- Symmetrically Encrypted Data Packet
27871#       10      0xA8        -- Marker Packet
27872#       11      0xAC        -- Literal Data Packet
27873#       12      0xB0        -- Trust Packet
27874#       13      0xB4        -- User ID Packet
27875#       14      0xB8        -- Public-Subkey Packet
27876#
27877# Length encoding:
27878#
27879#     Value
27880#       0      1 byte length (following byte is the length)
27881#       1      2 byte length (following two bytes are the length)
27882#       2      4 byte length (following four bytes are the length)
27883#       3      indeterminate length: natural end of packet, e.g., EOF
27884#
27885# An indeterminate length is only allowed for container packets
27886# (SEIP, Compressed Data and Literal).
27887#
27888# Certificates
27889# ------------
27890#
27891# We check the first three packets to determine if a sequence of
27892# OpenPGP packets is likely to be a certificate.  The grammar allows
27893# the following prefixes:
27894#
27895#   [Primary Key] [SIG] (EOF or another certificate)
27896#   [Primary Key] [SIG]            [User ID]        [SIG]...
27897#   [Primary Key] [SIG]            [User Attribute] [SIG]...
27898#   [Primary Key] [SIG]            [Subkey]         [SIG]...
27899#   [Primary Key] [User ID]        [SIG]...
27900#   [Primary Key] [User Attribute] [SIG]...
27901#   [Primary Key] [Subkey]         [SIG]...
27902#
27903# Any number of marker packets are also allowed between each packet,
27904# but they are not normally used and we don't currently check for
27905# them.
27906#
27907# The keys and subkeys may be public or private.
27908#
27909
27910# Key packets and signature packets are versioned.  There are two
27911# packet versions that we need to worry about in practice: v3 and v4.
27912# v4 packets were introduced in RFC 2440, which was published in 1998.
27913# It also deprecated v3 packets.  There are no actively used v3
27914# certificates (GnuPG removed the code to support them in November
27915# 2014).  But there are v3 keys lying around and it is useful to
27916# identify them.  The next version of OpenPGP will introduce v5 keys.
27917# The document has not yet been standardized so changes are still
27918# possible.  But, for our purposes, it appears that v5 data structures
27919# will be identical to v4 data structures modulo the version number.
27920#
27921#   https://tools.ietf.org/html/rfc2440
27922#   https://lists.gnupg.org/pipermail/gnupg-announce/2014q4/000358.html
27923#   https://www.ietf.org/id/draft-ietf-openpgp-rfc4880bis-09.html#name-key-material-packet
27924
27925
27926
27927
27928# The first packet has to be a public key or a secret key.
27929#
27930# New-Style Public Key
279310	ubyte			=0xC6	OpenPGP Public Key
27932>&0	use			primary_key_length_new
27933# New-Style Secret Key
279340	ubyte			=0xC5	OpenPGP Secret Key
27935>&0	use			primary_key_length_new
27936# Old-Style Public Key
279370	ubyte&0xFC		=0x98	OpenPGP Public Key
27938>&-1	use			primary_key_length_old
27939# Old-Style Secret Key
279400	ubyte&0xFC		=0x94	OpenPGP Secret Key
27941>&-1	use			primary_key_length_old
27942
27943# Parse the length, check the packet's body and finally advance to the
27944# next packet.
27945
27946# There are 4 different new-style length encodings, but the partial
27947# body encoding is only acceptable for the SEIP, Compressed Data, and
27948# Literal packets, which isn't valid for any packets in a certificate
27949# so we ignore it.
279500		name		primary_key_length_new
27951>&0		ubyte		<192
27952#>>&0		ubyte		x		(1 byte length encoding, %d bytes)
27953>>&0		use		pgp_binary_key_pk_check
27954>>>&(&-1.B)	use		sig_or_component_1
27955>&0		ubyte		>191
27956>>&-1		ubyte		<225
27957# offset = ((offset[0] - 192) << 8) + offset[1] + 192 (for the length header)
27958# raw - (192 * 256 - 192)
27959# = 48960
27960#>>>&0		ubeshort		x	(2 byte length encoding, %d bytes)
27961>>>&1		use		pgp_binary_key_pk_check
27962>>>>&(&-2.S-48960)	use	sig_or_component_1
27963>&0		ubyte		=255
27964#>>&0   	belong		x		(5 byte length encoding, %d bytes)
27965>>&4		use		pgp_binary_key_pk_check
27966>>>&(&-4.L)	use		sig_or_component_1
27967# Partial body encoding (only valid for container packets).
27968# >&0		ubyte	>224
27969# >>&0		ubyte		<255		partial body encoding
27970
27971# There are 4 different old-style length encodings, but the
27972# indeterminate length encoding is only acceptable for the SEIP,
27973# Compressed Data, and Literal packets, which isn't valid for any
27974# packets in a certificate.
279750		name		primary_key_length_old
27976#>&0		ubyte		x		(ctb: %x)
27977>&0		ubyte&0x3	=0
27978#>>&0    	ubyte		x		(1 byte length encoding, %d bytes)
27979>>&1		use		pgp_binary_key_pk_check
27980>>>&(&-1.B)	use		sig_or_component_1
27981>&0		ubyte&0x3	=1
27982#>>&0    	ubeshort	x		(2 byte length encoding, %d bytes)
27983>>&2		use		pgp_binary_key_pk_check
27984>>>&(&-2.S)	use		sig_or_component_1
27985>&0		ubyte&0x3	=2
27986#>>&0    	ubelong	x		(4 byte length encoding, %d bytes)
27987>>&4		use		pgp_binary_key_pk_check
27988>>>&(&-4.L)	use		sig_or_component_1
27989
27990# Check the Key.
27991#
27992# https://tools.ietf.org/html/rfc4880#section-5.5.2
279930		name		pgp_binary_key_pk_check
27994# Valid versions are: 2, 3, 4.  5 is proposed in RFC 4880bis.
27995# Anticipate a v6 / v7 format that like v5 is compatible with v4.
27996# key format in a decade or so :D.
27997>&0		ubyte		>1
27998>>&-1		ubyte		<8
27999>>>&-1		byte		x		Version %d
28000# Check that keys were created after 1990.
28001# (1990 - 1970) * 365.2524 * 24 * 60 * 60 = 631156147
28002>>>&0		bedate		>631156147      \b, Created %s
28003>>>>&-5		ubyte		>3
28004>>>>>&4		use		pgp_binary_key_algo
28005>>>>&-5		ubyte		<4
28006>>>>>&6		use		pgp_binary_key_algo
28007
28008# Print out the key's algorithm and the number of bits, if this is
28009# relevant (ECC keys are a fixed size).
280100		name		pgp_binary_key_algo
28011>0		clear		x
28012>&0		ubyte		=1	\b, RSA (Encrypt or Sign,
28013>>&0		ubeshort	x	\b %d bits)
28014>&0		ubyte		=2	\b, RSA (Encrypt,
28015>>&0		ubeshort	x	\b %d bits)
28016>&0		ubyte		=3	\b, RSA (Sign,
28017>>&0		ubeshort	x	\b %d bits)
28018>&0		ubyte		=16	\b, El Gamal (Encrypt,
28019>>&0		ubeshort	x	\b %d bits)
28020>&0		ubyte		=17	\b, DSA
28021>>&0		ubeshort	x	\b (%d bits)
28022>&0		ubyte		=18	\b, ECDH
28023>&0		ubyte		=19	\b, ECDSA
28024>&0		ubyte		=20	\b, El Gamal (Encrypt or Sign,
28025>>&0		ubeshort	x	\b %d bits)
28026>&0		ubyte		=22	\b, EdDSA
28027>&0		default         x
28028>>&0		ubyte		x	\b, Unknown Algorithm (0x%x)
28029
28030# Match all possible second packets.
280310	name		sig_or_component_1
28032#>0	ubyte		x	(ctb: %x)
28033>&0	ubyte		=0xC2
28034>>0	ubyte		x	\b; Signature
28035>>&0	use		sig_or_component_1_length_new
28036>&0	ubyte		=0xCD
28037>>0	ubyte		x	\b; User ID
28038>>&0	use		sig_or_component_1_length_new
28039>&0	ubyte		=0xCE
28040>>0	ubyte		x	\b; Public Subkey
28041>>&0	use		sig_or_component_1_length_new
28042>&0	ubyte		=0xC7
28043>>0	ubyte		x	\b; Secret Subkey
28044>>&0	use		sig_or_component_1_length_new
28045>&0	ubyte		=0xD1
28046>>0	ubyte		x	\b; User Attribute
28047>>&0	use		sig_or_component_1_length_new
28048>&0	ubyte&0xFC	=0x88
28049>>0	ubyte		x	\b; Signature
28050>>&-1	use		sig_or_component_1_length_old
28051>&0	ubyte&0xFC	=0xB4
28052>>0	ubyte		x	\b; User ID
28053>>&-1	use		sig_or_component_1_length_old
28054>&0	ubyte&0xFC	=0xB8
28055>>0	ubyte		x	\b; Public Subkey
28056>>&-1	use		sig_or_component_1_length_old
28057>&0	ubyte&0xFC	=0x9C
28058>>0	ubyte		x	\b; Secret Subkey
28059>>&-1	use		sig_or_component_1_length_old
28060
28061# Copy of 'primary_key_length_new', but calls cert_packet_3.
280620		name		sig_or_component_1_length_new
28063>&0		ubyte		<192
28064#>>&0		ubyte		x		(1 byte new length encoding, %d bytes)
28065>>&(&-1.B)	use		cert_packet_3
28066>&0		ubyte		>191
28067>>&-1		ubyte		<225
28068# offset = ((offset[0] - 192) << 8) + offset[1] + 192 + 1 (for the length header)
28069# raw - (192 * 256 - 192 - 1)
28070# = 48959
28071#>>>&-1		ubeshort		x	(2 byte new length encoding, %d bytes)
28072>>>&(&-1.S-48959)	use	cert_packet_3
28073>&0		ubyte		=255
28074#>>&0   	belong		x		(5 byte new length encoding, %d bytes)
28075>>&(&-4.L)	use		cert_packet_3
28076# Partial body encoding (only valid for container packets).
28077# >&0		ubyte	>224
28078# >>&0		ubyte		<255		partial body encoding
28079
280800		name		sig_or_component_1_length_old
28081#>&0		ubyte		x		(ctb: %x)
28082>&0		ubyte&0x3	=0
28083#>>&0    	ubyte		x		(1 byte old length encoding, %d bytes)
28084>>&(&0.B+1)	use		cert_packet_3
28085>&0		ubyte&0x3	=1
28086#>>&0    	ubeshort	x		(2 byte old length encoding, %d bytes)
28087>>&(&0.S+2)	use		cert_packet_3
28088>&0		ubyte&0x3	=2
28089#>>&0    	ubelong	x		(4 byte old length encoding, %d bytes)
28090>>&(&0.L+4)	use		cert_packet_3
28091
28092# Copy of above.
280930	name		cert_packet_3
28094#>0	ubyte		x	(ctb: %x)
28095>&0	ubyte		=0xC2
28096>>0	ubyte		x	\b; Signature
28097>>&0	use		cert_packet_3_length_new
28098>&0	ubyte		=0xCD
28099>>0	ubyte		x	\b; User ID
28100>>&0	use		cert_packet_3_length_new
28101>&0	ubyte		=0xCE
28102>>0	ubyte		x	\b; Public Subkey
28103>>&0	use		cert_packet_3_length_new
28104>&0	ubyte		=0xC7
28105>>0	ubyte		x	\b; Secret Subkey
28106>>&0	use		cert_packet_3_length_new
28107>&0	ubyte		=0xD1
28108>>0	ubyte		x	\b; User Attribute
28109>>&0	use		cert_packet_3_length_new
28110>&0	ubyte&0xFC	=0x88
28111>>0	ubyte		x	\b; Signature
28112>>&-1	use		cert_packet_3_length_old
28113>&0	ubyte&0xFC	=0xB4
28114>>0	ubyte		x	\b; User ID
28115>>&-1	use		cert_packet_3_length_old
28116>&0	ubyte&0xFC	=0xB8
28117>>0	ubyte		x	\b; Public Subkey
28118>>&-1	use		cert_packet_3_length_old
28119>&0	ubyte&0xFC	=0x9C
28120>>0	ubyte		x	\b; Secret Subkey
28121>>&-1	use		cert_packet_3_length_old
28122
28123# Copy of above.
281240		name		cert_packet_3_length_new
28125>&0		ubyte		<192
28126#>>&0		ubyte		x		(1 byte new length encoding, %d bytes)
28127>>&(&-1.B)	use		pgp_binary_keys_end
28128>&0		ubyte		>191
28129>>&-1		ubyte		<225
28130# offset = ((offset[0] - 192) << 8) + offset[1] + 192 + 1 (for the length header)
28131# raw - (192 * 256 - 192 - 1)
28132# = 48959
28133#>>>&-1		ubeshort		x	(2 byte new length encoding, %d bytes)
28134>>>&(&-1.S-48959)	use	pgp_binary_keys_end
28135>&0		ubyte		=255
28136#>>&0   	belong		x		(5 byte new length encoding, %d bytes)
28137>>&(&-4.L)	use		pgp_binary_keys_end
28138
281390		name		cert_packet_3_length_old
28140#>&0		ubyte		x		(ctb: %x)
28141>&0		ubyte&0x3	=0
28142#>>&0    	ubyte		x		(1 byte old length encoding, %d bytes)
28143>>&(&0.B+1)	use		pgp_binary_keys_end
28144>&0		ubyte&0x3	=1
28145#>>&0    	ubeshort	x		(2 byte old length encoding, %d bytes)
28146>>&(&0.S+2)	use		pgp_binary_keys_end
28147>&0		ubyte&0x3	=2
28148#>>&0    	ubelong	x		(4 byte old length encoding, %d bytes)
28149>>&(&0.L+4)	use		pgp_binary_keys_end
28150
28151# We managed to parse the first three packets of the certificate.  Declare
28152# victory.
281530		name		pgp_binary_keys_end
28154>0		byte		x		\b; OpenPGP Certificate
28155!:mime		application/pgp-keys
28156!:ext		pgp/gpg/pkr/asd
28157
28158#------------------------------------------------------------------------------
28159# $File: pkgadd,v 1.6 2009/09/19 16:28:11 christos Exp $
28160# pkgadd:  file(1) magic for SysV R4 PKG Datastreams
28161#
281620       string          #\ PaCkAgE\ DaTaStReAm  pkg Datastream (SVR4)
28163!:mime	application/x-svr4-package
28164
28165#------------------------------------------------------------------------------
28166# $File: plan9,v 1.5 2009/09/19 16:28:11 christos Exp $
28167# plan9:  file(1) magic for AT&T Bell Labs' Plan 9 executables
28168# From: "Stefan A. Haubenthal" <polluks@web.de>
28169#
281700	belong		0x00000107	Plan 9 executable, Motorola 68k
281710	belong		0x000001EB	Plan 9 executable, Intel 386
281720	belong		0x00000247	Plan 9 executable, Intel 960
281730	belong		0x000002AB	Plan 9 executable, SPARC
281740	belong		0x00000407	Plan 9 executable, MIPS R3000
281750	belong		0x0000048B	Plan 9 executable, AT&T DSP 3210
281760	belong		0x00000517	Plan 9 executable, MIPS R4000 BE
281770	belong		0x000005AB	Plan 9 executable, AMD 29000
281780	belong		0x00000647	Plan 9 executable, ARM 7-something
281790	belong		0x000006EB	Plan 9 executable, PowerPC
281800	belong		0x00000797	Plan 9 executable, MIPS R4000 LE
281810	belong		0x0000084B	Plan 9 executable, DEC Alpha
28182
28183#------------------------------------------------------------------------------
28184# $File: plus5,v 1.6 2009/09/19 16:28:11 christos Exp $
28185# plus5:  file(1) magic for Plus Five's UNIX MUMPS
28186#
28187# XXX - byte order?  Paging Hokey....
28188#
281890	short		0x259		mumps avl global
28190>2	byte		>0		(V%d)
28191>6	byte		>0		with %d byte name
28192>7	byte		>0		and %d byte data cells
281930	short		0x25a		mumps blt global
28194>2	byte		>0		(V%d)
28195>8	short		>0		- %d byte blocks
28196>15	byte		0x00		- P/D format
28197>15	byte		0x01		- P/K/D format
28198>15	byte		0x02		- K/D format
28199>15	byte		>0x02		- Bad Flags
28200
28201#------------------------------------------------------------------------------
28202# $File: pmem,v 1.3 2019/06/13 11:45:44 christos Exp $
28203# pmem: file(1) magic for Persistent Memory Development Kit pool files
28204#
282050	string		PMEM
28206>4	string		POOLSET		Persistent Memory Poolset file
28207>>11	search		REPLICA		with replica
28208>4	regex		LOG|BLK|OBJ	Persistent Memory Pool file, type: %s,
28209>>8	lelong		>0		version: 0x%x,
28210>>12	lelong		x		compat: 0x%x,
28211>>16	lelong		x		incompat: 0x%x,
28212>>20	lelong		x		ro_compat: 0x%x,
28213
28214
28215>>120	leqldate	x		crtime: %s,
28216>>128	lequad		x		alignment_desc: 0x%016llx,
28217
28218>>136	clear		x
28219>>136	byte		2		machine_class: 64-bit,
28220>>136	default		x		machine_class: unknown
28221>>>136	byte		x		(0x%d),
28222
28223>>137	clear		x
28224>>137	byte		1		data: little-endian,
28225>>137	byte		2		data: big-endian,
28226>>137	default		x		data: unknown
28227>>>137	byte		x		(0x%d),
28228
28229>>138	byte		!0		reserved[0]: %d,
28230>>139	byte		!0		reserved[1]: %d,
28231>>140	byte		!0		reserved[2]: %d,
28232>>141	byte		!0		reserved[3]: %d,
28233
28234>>142	clear		x
28235>>142	leshort		62		machine: x86_64
28236>>142	leshort		183		machine: aarch64
28237>>142	default		x		machine: unknown
28238>>>142	leshort		x		(0x%d)
28239
28240>4	string		BLK
28241>>4096	lelong		x		\b, blk.bsize: %d
28242
28243>4	string		OBJ
28244>>4096	string		>0		\b, obj.layout: '%s'
28245>>4096	string		<0		\b, obj.layout: NULL
28246
28247#------------------------------------------------------------------------------
28248# $File: polyml,v 1.2 2019/04/19 00:42:27 christos Exp $
28249# polyml:  file(1) magic for PolyML
28250#
28251# PolyML
28252# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)
28253# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)
28254
28255# [0]: https://www.polyml.org/
28256# [1]: https://github.com/polyml/polyml/blob/master/\
28257#	libpolyml/savestate.cpp#L146-L147
28258# [2]: https://github.com/polyml/polyml/blob/master/\
28259#	libpolyml/savestate.cpp#L1262-L1263
28260
28261# Type: Poly/ML saved data
28262# From: Matthew Fernandez <matthew.fernandez@gmail.com>
28263
282640	string	POLYSAVE	Poly/ML saved state
28265>8	long	x		version %u
28266
282670	string  POLYMODU	Poly/ML saved module
28268>8	long	x		version %u
28269
28270#------------------------------------------------------------------------------
28271# $File: printer,v 1.29 2019/04/19 00:42:27 christos Exp $
28272# printer:  file(1) magic for printer-formatted files
28273#
28274
28275# PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com)
282760	string		%!		PostScript document text
28277!:mime	application/postscript
28278!:apple	ASPSTEXT
28279>2	string		PS-Adobe-	conforming
28280>>11	string		>\0		DSC level %.3s
28281>>>15	string		EPS		\b, type %s
28282>>>15	string		Query		\b, type %s
28283>>>15	string		ExitServer	\b, type %s
28284>>>15   search/1000		%%LanguageLevel:\040
28285>>>>&0	string		>\0		\b, Level %s
28286# Some PCs have the annoying habit of adding a ^D as a document separator
282870	string		\004%!		PostScript document text
28288!:mime	application/postscript
28289!:apple	ASPSTEXT
28290>3	string		PS-Adobe-	conforming
28291>>12	string		>\0		DSC level %.3s
28292>>>16	string		EPS		\b, type %s
28293>>>16	string		Query		\b, type %s
28294>>>16	string		ExitServer	\b, type %s
28295>>>16   search/1000		%%LanguageLevel:\040
28296>>>>&0	string		>\0		\b, Level %s
282970	string		\033%-12345X%!PS	PostScript document
28298
28299# DOS EPS Binary File Header
28300# From: Ed Sznyter <ews@Black.Market.NET>
283010       belong          0xC5D0D3C6      DOS EPS Binary File
28302>4      long            >0              Postscript starts at byte %d
28303>>8     long            >0              length %d
28304>>>12   long            >0              Metafile starts at byte %d
28305>>>>16  long            >0              length %d
28306>>>20   long            >0              TIFF starts at byte %d
28307>>>>24  long            >0              length %d
28308
28309# Summary: Adobe's PostScript Printer Description File
28310# Extension: .ppd
28311# Reference: https://partners.adobe.com/public/developer/en/ps/5003.PPD_Spec_v4.3.pdf, Section 3.8
28312# Submitted by: Yves Arrouye <arrouye@marin.fdn.fr>
28313#
283140	string		*PPD-Adobe:\x20	PPD file
28315>&0	string		x		\b, version %s
28316
28317# HP Printer Job Language
283180	string		\033%-12345X@PJL	HP Printer Job Language data
28319# HP Printer Job Language
28320# The header found on Win95 HP plot files is the "Silliest Thing possible"
28321# (TM)
28322# Every driver puts the language at some random position, with random case
28323# (LANGUAGE and Language)
28324# For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10
28325# From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de>
28326#
283270	string		\033%-12345X@PJL	HP Printer Job Language data
28328>&0	string		>\0			%s
28329>>&0	string		>\0			%s
28330>>>&0	string		>\0			%s
28331>>>>&0	string		>\0			%s
28332#>15	string		\ ENTER\ LANGUAGE\ =
28333#>31	string		PostScript		PostScript
28334
28335# From: Stefan Thurner <thurners@nicsys.de>
283360	string		\033%-12345X@PJL
28337>&0	search/10000	%!			PJL encapsulated PostScript document text
28338
28339# Rick Richardson <rickrich@gmail.com>
28340
28341# For Fuji-Xerox Printers - HBPL stands for Host Based Printer Language
28342# For Oki Data Printers - HIPERC
28343# For Konica Minolta Printers - LAVAFLOW
28344# For Samsung Printers - QPDL
28345# For HP Printers - ZJS stands for Zenographics ZJStream
283460	string		\033%-12345X@PJL	HP Printer Job Language data
28347>0	search/10000	@PJL\ ENTER\ LANGUAGE=HBPL	- HBPL
28348>0	search/10000	@PJL\ ENTER\ LANGUAGE=HIPERC	- Oki Data HIPERC
28349>0	search/10000	@PJL\ ENTER\ LANGUAGE=LAVAFLOW	- Konica Minolta LAVAFLOW
28350>0	search/10000	@PJL\ ENTER\ LANGUAGE=QPDL	- Samsung QPDL
28351>0	search/10000	@PJL\ ENTER\ LANGUAGE\ =\ QPDL	- Samsung QPDL
28352>0	search/10000	@PJL\ ENTER\ LANGUAGE=ZJS	- HP ZJS
28353
28354
28355# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com)
283560	string		\033E\033	HP PCL printer data
28357>3	string		\&l0A		- default page size
28358>3	string		\&l1A		- US executive page size
28359>3	string		\&l2A		- US letter page size
28360>3	string		\&l3A		- US legal page size
28361>3	string		\&l26A		- A4 page size
28362>3	string		\&l80A		- Monarch envelope size
28363>3	string		\&l81A		- No. 10 envelope size
28364>3	string		\&l90A		- Intl. DL envelope size
28365>3	string		\&l91A		- Intl. C5 envelope size
28366>3	string		\&l100A		- Intl. B5 envelope size
28367>3	string		\&l-81A		- No. 10 envelope size (landscape)
28368>3	string		\&l-90A		- Intl. DL envelope size (landscape)
28369
28370# IMAGEN printer-ready files:
283710	string	@document(		Imagen printer
28372# this only works if "language xxx" is first item in Imagen header.
28373>10	string	language\ impress	(imPRESS data)
28374>10	string	language\ daisy		(daisywheel text)
28375>10	string	language\ diablo	(daisywheel text)
28376>10	string	language\ printer	(line printer emulation)
28377>10	string	language\ tektronix	(Tektronix 4014 emulation)
28378# Add any other languages that your Imagen uses - remember
28379# to keep the word `text' if the file is human-readable.
28380# [GRR 950115:  missing "postscript" or "ultrascript" (whatever it was called)]
28381#
28382# Now magic for IMAGEN font files...
283830	string		Rast		RST-format raster font data
28384>45	string		>0		face %s
28385# From Jukka Ukkonen
283860	string		\033[K\002\0\0\017\033(a\001\0\001\033(g	Canon Bubble Jet BJC formatted data
28387
28388# From <mike@flyn.org>
28389# These are the /etc/magic entries to decode data sent to an Epson printer.
283900       string          \x1B\x40\x1B\x28\x52\x08\x00\x00REMOTE1P        Epson Stylus Color 460 data
28391
28392
28393#------------------------------------------------------------------------------
28394# zenographics:  file(1) magic for Zenographics ZjStream printer data
28395# Rick Richardson <rickrich@gmail.com>
283960	string		JZJZ
28397>0x12	string		ZZ		Zenographics ZjStream printer data (big-endian)
283980	string		ZJZJ
28399>0x12	string		ZZ		Zenographics ZjStream printer data (little-endian)
28400
28401
28402#------------------------------------------------------------------------------
28403# Oak Technologies printer stream
28404# Rick Richardson <rickrich@gmail.com>
284050       string          OAK
28406>0x07	byte		0
28407>0x0b	byte		0	Oak Technologies printer stream
28408
28409# This would otherwise be recognized as PostScript - nick@debian.org
284100	string		%!VMF 		SunClock's Vector Map Format data
28411
28412#------------------------------------------------------------------------------
28413# HP LaserJet 1000 series downloadable firmware file
284140	string	\xbe\xefABCDEFGH	HP LaserJet 1000 series downloadable firmware
28415
28416# From: Paolo <oopla@users.sf.net>
28417# Epson ESC/Page, ESC/PageColor
284180	string	\x1b\x01@EJL	Epson ESC/Page language printer data
28419
28420#------------------------------------------------------------------------------
28421# $File: project,v 1.5 2017/03/17 21:35:28 christos Exp $
28422# project:  file(1) magic for Project management
28423#
28424# Magic strings for ftnchek project files. Alexander Mai
284250	string	FTNCHEK_\ P	project file for ftnchek
28426>10	string	1		version 2.7
28427>10	string	2		version 2.8 to 2.10
28428>10	string	3		version 2.11 or later
28429
28430#------------------------------------------------------------------------------
28431# $File: psdbms,v 1.8 2017/03/17 21:35:28 christos Exp $
28432# psdbms:  file(1) magic for psdatabase
28433#
28434# Update: Joerg Jenderek
28435# GRR: line below too general as it catches also some Panorama database *.pan ,
28436# AppleWorks word processor
284370	belong&0xff00ffff	0x56000000
28438# assume version starts with digit
28439>1	regex/s			=^[0-9]		ps database
28440>>1	string	>\0	version %s
28441# kernel name
28442>>4	string	>\0	from kernel %s
28443
28444#------------------------------------------------------------------------------
28445# $File: psl,v 1.3 2019/04/19 00:42:27 christos Exp $
28446# psl:  file(1) magic for Public Suffix List representations
28447# From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
28448# URL: https://publicsuffix.org
28449# see also: https://thread.gmane.org/gmane.network.dns.libpsl.bugs/162/focus=166
28450
284510	search/512	\n\n//\ ===BEGIN\ ICANN\ DOMAINS===\n\n Public Suffix List data
28452
284530	string	.DAFSA@PSL_
28454>15	string	\n	Public Suffix List data (optimized)
28455>>11	byte	>0x2f
28456>>>11	byte	<0x3a   (Version %c)
28457
28458#------------------------------------------------------------------------------
28459# $File: pulsar,v 1.5 2009/09/19 16:28:12 christos Exp $
28460# pulsar:  file(1) magic for Pulsar POP3 daemon binary files
28461#
28462# http://pulsar.sourceforge.net
28463# mailto:rok.papez@lugos.si
28464#
28465
284660	belong	0x1ee7f11e	Pulsar POP3 daemon mailbox cache file.
28467>4	ubelong	x		Version: %d.
28468>8	ubelong	x		\b%d
28469
28470
28471#------------------------------------------------------------------------------
28472# $File: pwsafe,v 1.2 2019/04/19 00:42:27 christos Exp $
28473# pwsafe: file(1) magic for passwordsafe file
28474#
28475# Password Safe
28476# http://passwordsafe.sourceforge.net/
28477# file format specs
28478# https://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV3.txt
28479# V2 https://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV2.txt
28480# V1 https://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/notes.txt
28481# V2 and V1 have no easy identifier that I can find
28482# .psafe3
284830	string	PWS3	Password Safe V3 database
28484
28485#------------------------------------------------------------------------------
28486# $File: pyramid,v 1.7 2009/09/19 16:28:12 christos Exp $
28487# pyramid:  file(1) magic for Pyramids
28488#
28489# XXX - byte order?
28490#
284910	long		0x50900107	Pyramid 90x family executable
284920	long		0x50900108	Pyramid 90x family pure executable
28493>16	long		>0		not stripped
284940	long		0x5090010b	Pyramid 90x family demand paged pure executable
28495>16	long		>0		not stripped
28496
28497#------------------------------------------------------------------------------
28498# $File: python,v 1.42 2020/06/04 00:22:50 christos Exp $
28499# python:  file(1) magic for python
28500#
28501# Outlook puts """ too for urgent messages
28502# From: David Necas <yeti@physics.muni.cz>
28503# often the module starts with a multiline string
285040	string/t	"""	Python script text executable
28505# MAGIC as specified in Python/import.c (1.0 to 3.7)
28506# two bytes of magic followed by "\r\n" in little endian order
285070	belong		0x02099900	python 1.0 byte-compiled
28508!:mime text/x-bytecode.python
285090	belong		0x03099900	python 1.1/1.2 byte-compiled
28510!:mime text/x-bytecode.python
285110	belong		0x892e0d0a	python 1.3 byte-compiled
28512!:mime text/x-bytecode.python
285130	belong		0x04170d0a	python 1.4 byte-compiled
28514!:mime text/x-bytecode.python
285150	belong		0x994e0d0a	python 1.5 byte-compiled
28516!:mime text/x-bytecode.python
285170	belong		0xfcc40d0a	python 1.6 byte-compiled
28518!:mime text/x-bytecode.python
285190	belong		0xfdc40d0a	python 1.6 byte-compiled
28520!:mime text/x-bytecode.python
285210	belong		0x87c60d0a	python 2.0 byte-compiled
28522!:mime text/x-bytecode.python
285230	belong		0x88c60d0a	python 2.0 byte-compiled
28524!:mime text/x-bytecode.python
285250	belong		0x2aeb0d0a	python 2.1 byte-compiled
28526!:mime text/x-bytecode.python
285270	belong		0x2beb0d0a	python 2.1 byte-compiled
28528!:mime text/x-bytecode.python
285290	belong		0x2ded0d0a	python 2.2 byte-compiled
28530!:mime text/x-bytecode.python
285310	belong		0x2eed0d0a	python 2.2 byte-compiled
28532!:mime text/x-bytecode.python
285330	belong		0x3bf20d0a	python 2.3 byte-compiled
28534!:mime text/x-bytecode.python
285350	belong		0x3cf20d0a	python 2.3 byte-compiled
28536!:mime text/x-bytecode.python
285370	belong		0x45f20d0a	python 2.3 byte-compiled
28538!:mime text/x-bytecode.python
285390	belong		0x59f20d0a	python 2.4 byte-compiled
28540!:mime text/x-bytecode.python
285410	belong		0x63f20d0a	python 2.4 byte-compiled
28542!:mime text/x-bytecode.python
285430	belong		0x6df20d0a	python 2.4 byte-compiled
28544!:mime text/x-bytecode.python
285450	belong		0x6ef20d0a	python 2.4 byte-compiled
28546!:mime text/x-bytecode.python
285470	belong		0x77f20d0a	python 2.5 byte-compiled
28548!:mime text/x-bytecode.python
285490	belong		0x81f20d0a	python 2.5 byte-compiled
28550!:mime text/x-bytecode.python
285510	belong		0x8bf20d0a	python 2.5 byte-compiled
28552!:mime text/x-bytecode.python
285530	belong		0x8cf20d0a	python 2.5 byte-compiled
28554!:mime text/x-bytecode.python
285550	belong		0x95f20d0a	python 2.5 byte-compiled
28556!:mime text/x-bytecode.python
285570	belong		0x9ff20d0a	python 2.5 byte-compiled
28558!:mime text/x-bytecode.python
285590	belong		0xa9f20d0a	python 2.5 byte-compiled
28560!:mime text/x-bytecode.python
285610	belong		0xb3f20d0a	python 2.5 byte-compiled
28562!:mime text/x-bytecode.python
285630	belong		0xb4f20d0a	python 2.5 byte-compiled
28564!:mime text/x-bytecode.python
285650	belong		0xc7f20d0a	python 2.6 byte-compiled
28566!:mime text/x-bytecode.python
285670	belong		0xd1f20d0a	python 2.6 byte-compiled
28568!:mime text/x-bytecode.python
285690	belong		0xd2f20d0a	python 2.6 byte-compiled
28570!:mime text/x-bytecode.python
285710	belong		0xdbf20d0a	python 2.7 byte-compiled
28572!:mime text/x-bytecode.python
285730	belong		0xe5f20d0a	python 2.7 byte-compiled
28574!:mime text/x-bytecode.python
285750	belong		0xeff20d0a	python 2.7 byte-compiled
28576!:mime text/x-bytecode.python
285770	belong		0xf9f20d0a	python 2.7 byte-compiled
28578!:mime text/x-bytecode.python
285790	belong		0x03f30d0a	python 2.7 byte-compiled
28580!:mime text/x-bytecode.python
285810	belong		0x04f30d0a	python 2.7 byte-compiled
28582!:mime text/x-bytecode.python
285830	belong		0xb80b0d0a	python 3.0 byte-compiled
28584!:mime text/x-bytecode.python
285850	belong		0xc20b0d0a	python 3.0 byte-compiled
28586!:mime text/x-bytecode.python
285870	belong		0xcc0b0d0a	python 3.0 byte-compiled
28588!:mime text/x-bytecode.python
285890	belong		0xd60b0d0a	python 3.0 byte-compiled
28590!:mime text/x-bytecode.python
285910	belong		0xe00b0d0a	python 3.0 byte-compiled
28592!:mime text/x-bytecode.python
285930	belong		0xea0b0d0a	python 3.0 byte-compiled
28594!:mime text/x-bytecode.python
285950	belong		0xf40b0d0a	python 3.0 byte-compiled
28596!:mime text/x-bytecode.python
285970	belong		0xf50b0d0a	python 3.0 byte-compiled
28598!:mime text/x-bytecode.python
285990	belong		0xff0b0d0a	python 3.0 byte-compiled
28600!:mime text/x-bytecode.python
286010	belong		0x090c0d0a	python 3.0 byte-compiled
28602!:mime text/x-bytecode.python
286030	belong		0x130c0d0a	python 3.0 byte-compiled
28604!:mime text/x-bytecode.python
286050	belong		0x1d0c0d0a	python 3.0 byte-compiled
28606!:mime text/x-bytecode.python
286070	belong		0x1f0c0d0a	python 3.0 byte-compiled
28608!:mime text/x-bytecode.python
286090	belong		0x270c0d0a	python 3.0 byte-compiled
28610!:mime text/x-bytecode.python
286110	belong		0x3b0c0d0a	python 3.0 byte-compiled
28612!:mime text/x-bytecode.python
286130	belong		0x450c0d0a	python 3.1 byte-compiled
28614!:mime text/x-bytecode.python
286150	belong		0x4f0c0d0a	python 3.1 byte-compiled
28616!:mime text/x-bytecode.python
286170	belong		0x580c0d0a	python 3.2 byte-compiled
28618!:mime text/x-bytecode.python
286190	belong		0x620c0d0a	python 3.2 byte-compiled
28620!:mime text/x-bytecode.python
286210	belong		0x6c0c0d0a	python 3.2 byte-compiled
28622!:mime text/x-bytecode.python
286230	belong		0x760c0d0a	python 3.3 byte-compiled
28624!:mime text/x-bytecode.python
286250	belong		0x800c0d0a	python 3.3 byte-compiled
28626!:mime text/x-bytecode.python
286270	belong		0x8a0c0d0a	python 3.3 byte-compiled
28628!:mime text/x-bytecode.python
286290	belong		0x940c0d0a	python 3.3 byte-compiled
28630!:mime text/x-bytecode.python
286310	belong		0x9e0c0d0a	python 3.3 byte-compiled
28632!:mime text/x-bytecode.python
286330	belong		0xb20c0d0a	python 3.4 byte-compiled
28634!:mime text/x-bytecode.python
286350	belong		0xbc0c0d0a	python 3.4 byte-compiled
28636!:mime text/x-bytecode.python
286370	belong		0xc60c0d0a	python 3.4 byte-compiled
28638!:mime text/x-bytecode.python
286390	belong		0xd00c0d0a	python 3.4 byte-compiled
28640!:mime text/x-bytecode.python
286410	belong		0xda0c0d0a	python 3.4 byte-compiled
28642!:mime text/x-bytecode.python
286430	belong		0xe40c0d0a	python 3.4 byte-compiled
28644!:mime text/x-bytecode.python
286450	belong		0xee0c0d0a	python 3.4 byte-compiled
28646!:mime text/x-bytecode.python
286470	belong		0xf80c0d0a	python 3.5.1- byte-compiled
28648!:mime text/x-bytecode.python
286490	belong		0x020d0d0a	python 3.5.1- byte-compiled
28650!:mime text/x-bytecode.python
286510	belong		0x0c0d0d0a	python 3.5.1- byte-compiled
28652!:mime text/x-bytecode.python
286530	belong		0x160d0d0a	python 3.5.1- byte-compiled
28654!:mime text/x-bytecode.python
286550	belong		0x170d0d0a	python 3.5.2+ byte-compiled
28656!:mime text/x-bytecode.python
286570	belong		0x200d0d0a	python 3.6 byte-compiled
28658!:mime text/x-bytecode.python
286590	belong		0x210d0d0a	python 3.6 byte-compiled
28660!:mime text/x-bytecode.python
286610	belong		0x2a0d0d0a	python 3.6 byte-compiled
28662!:mime text/x-bytecode.python
286630	belong		0x2b0d0d0a	python 3.6 byte-compiled
28664!:mime text/x-bytecode.python
286650	belong		0x2c0d0d0a	python 3.6 byte-compiled
28666!:mime text/x-bytecode.python
286670	belong		0x2d0d0d0a	python 3.6 byte-compiled
28668!:mime text/x-bytecode.python
286690	belong		0x2f0d0d0a	python 3.6 byte-compiled
28670!:mime text/x-bytecode.python
286710	belong		0x300d0d0a	python 3.6 byte-compiled
28672!:mime text/x-bytecode.python
286730	belong		0x310d0d0a	python 3.6 byte-compiled
28674!:mime text/x-bytecode.python
286750	belong		0x320d0d0a	python 3.6 byte-compiled
28676!:mime text/x-bytecode.python
286770	belong		0x330d0d0a	python 3.6 byte-compiled
28678!:mime text/x-bytecode.python
286790	belong		0x3e0d0d0a	python 3.7 byte-compiled
28680!:mime text/x-bytecode.python
286810	belong		0x3f0d0d0a	python 3.7 byte-compiled
28682!:mime text/x-bytecode.python
286830	belong		0x400d0d0a	python 3.7 byte-compiled
28684!:mime text/x-bytecode.python
286850	belong		0x410d0d0a	python 3.7 byte-compiled
28686!:mime text/x-bytecode.python
286870	belong		0x420d0d0a	python 3.7 byte-compiled
28688!:mime text/x-bytecode.python
286890	belong		0x480d0d0a	python 3.8 byte-compiled
28690!:mime text/x-bytecode.python
286910	belong		0x490d0d0a	python 3.8 byte-compiled
28692!:mime text/x-bytecode.python
286930	belong		0x520d0d0a	python 3.8 byte-compiled
28694!:mime text/x-bytecode.python
286950	belong		0x530d0d0a	python 3.8 byte-compiled
28696!:mime text/x-bytecode.python
286970	belong		0x540d0d0a	python 3.8 byte-compiled
28698!:mime text/x-bytecode.python
286990	belong		0x550d0d0a	python 3.8 byte-compiled
28700!:mime text/x-bytecode.python
287010	belong		0x5c0d0d0a	python 3.9 byte-compiled
28702!:mime text/x-bytecode.python
287030	belong		0x5d0d0d0a	python 3.9 byte-compiled
28704!:mime text/x-bytecode.python
287050	belong		0x5e0d0d0a	python 3.9 byte-compiled
28706!:mime text/x-bytecode.python
287070	belong		0x5f0d0d0a	python 3.9 byte-compiled
28708!:mime text/x-bytecode.python
287090	belong		0x600d0d0a	python 3.9 byte-compiled
28710!:mime text/x-bytecode.python
287110	belong		0x610d0d0a	python 3.9 byte-compiled
28712!:mime text/x-bytecode.python
28713
287140	search/1/w	#!\040/usr/bin/python	Python script text executable
28715!:strength + 15
28716!:mime text/x-script.python
287170	search/1/w	#!\040/usr/local/bin/python	Python script text executable
28718!:strength + 15
28719!:mime text/x-script.python
287200	search/10/w	#!\040/usr/bin/env\040python	Python script text executable
28721!:strength + 15
28722!:mime text/x-script.python
28723
28724
28725# from module.submodule import func1, func2
287260	search/8192	import
28727>0	regex		\^from[\040\t]+([A-Za-z0-9_]|\\.)+[\040\t]+import.*$	Python script text executable
28728!:strength + 15
28729!:mime text/x-script.python
28730
28731# def __init__ (self, ...):
287320	search/4096	def\ __init__
28733>&0	search/64 self	Python script text executable
28734!:strength + 15
28735!:mime text/x-script.python
28736
28737# if __name__ == "__main__":
287380 search/4096 if\ __name__
28739>&0 search/64 '__main__'	Python script text executable
28740>&0 search/64 "__main__"	Python script text executable
28741!:strength + 15
28742!:mime text/x-script.python
28743
28744# import module [as abrev]
287450	search/8192	import
28746>0	regex	\^import\ [_[:alpha:]]+\ as\ [[:alpha:]][[:space:]]*$ Python script text executable
28747!:mime text/x-script.python
28748
28749# comments
28750#0	search/4096	'''
28751#>&0	regex	.*'''$	Python script text executable
28752#!:mime text/x-script.python
28753
28754#0	search/4096	"""
28755#>&0	regex	.*"""$	Python script text executable
28756#!:mime text/x-script.python
28757
28758# try:
28759# except: or finally:
28760# block
287610	search/4096	try:
28762>&0	regex	\^[[:space:]]*except.*:$	Python script text executable
28763!:strength + 15
28764!:mime text/x-script.python
28765>&0	search/4096	finally:	Python script text executable
28766!:mime text/x-script.python
28767
28768# class name[(base classes,)]: [pass]
287690	search/8192	class
28770>0	regex	\^class\ [_[:alpha:]]+(\\(.*\\))?(\ )*:([\ \t]+pass)?$		Python script text executable
28771!:strength + 15
28772!:mime text/x-script.python
28773
28774# def name(*args, **kwargs):
287750	search/8192	def\
28776>0	regex	 \^[[:space:]]{0,50}def\ {1,50}[_a-zA-Z]{1,100}
28777>>&0	regex	 \\(([[:alpha:]*_,\ ]){0,255}\\):$ Python script text executable
28778!:strength + 15
28779!:mime text/x-script.python
28780
28781# https://numpy.org/devdocs/reference/generated/numpy.lib.format.html
287820	string	\223NUMPY		NumPy data file
28783!:mime  application/x-numpy-data
28784>6	byte	x			\b, version %d
28785>7	byte	x			\b.%d
28786#>8	leshort	x			\b, header length=%d
28787>10	string	x			\b, description %s
28788
28789#------------------------------------------------------------------------------
28790# $File: qt,v 1.3 2019/04/19 00:42:27 christos Exp $
28791# qt:  file(1) magic for Qt
28792
28793# https://doc.qt.io/qt-5/resources.html
287940	string		\<!DOCTYPE\040RCC\>	Qt Resource Collection file
28795
28796# https://qt.gitorious.org/qt/qtbase/source/\
28797# 5367fa356233da4c0f28172a8f817791525f5457:\
28798# src/tools/rcc/rcc.cpp#L840
287990	string		qres\0\0		Qt Binary Resource file
288000	search/1024	The\040Resource\040Compiler\040for\040Qt	Qt C-code resource file
28801
28802# https://qt.gitorious.org/qt/qtbase/source/\
28803# 5367fa356233da4c0f28172a8f817791525f5457:\
28804# src/corelib/kernel/qtranslator.cpp#L62
288050	string		\x3c\xb8\x64\x18\xca\xef\x9c\x95
28806>8	string		\xcd\x21\x1c\xbf\x60\xa1\xbd\xdd	Qt Translation file
28807
28808#------------------------------------------------------------------------------
28809# $File: revision,v 1.11 2019/04/19 00:42:27 christos Exp $
28810# file(1) magic for revision control files
28811# From Hendrik Scholz <hendrik@scholz.net>
288120	string/t	/1\ :pserver:	cvs password text file
28813
28814# Conary changesets
28815# From: Jonathan Smith <smithj@rpath.com>
288160	belong	0xea3f81bb	Conary changeset data
28817
28818# Type: Git bundles (git-bundle)
28819# From: Josh Triplett <josh@freedesktop.org>
288200	string	#\ v2\ git\ bundle\n	Git bundle
28821
28822# Type: Git pack
28823# From: Adam Buchbinder <adam.buchbinder@gmail.com>
28824# Update: Joerg Jenderek
28825# URL: http://fileformats.archiveteam.org/wiki/Git
28826# reference: https://github.com/git/git/blob/master/Documentation/technical/pack-format.txt
28827# The actual magic is 'PACK', but that clashes with Doom/Quake packs. However,
28828# those have a little-endian offset immediately following the magic 'PACK',
28829# the first byte of which is never 0, while the first byte of the Git pack
28830# version, since it's a tiny number stored in big-endian format, is always 0.
288310	string	PACK
28832# GRR: line above is too general as it matches also PackDir archive ./acorn
28833# test for major version. Git 2017 accepts version number 2 or 3
28834>4	ubelong	<9
28835# Acorn PackDir with method 0 compression has root like ADFS::HardDisc4.$.AsylumSrc
28836# or SystemDevice::foobar
28837>>9	search/13 ::
28838# but in git binary
28839>>9	default	x	Git pack
28840!:mime	application/x-git
28841!:ext	pack
28842# 4 GB limit implies unsigned integer
28843>>>4	ubelong	x		\b, version %u
28844>>>8	ubelong	x		\b, %u objects
28845
28846# Type: Git pack index
28847# From: Adam Buchbinder <adam.buchbinder@gmail.com>
288480	string	\377tOc		Git pack index
28849>4	belong	=2		\b, version 2
28850
28851# Type: Git index file
28852# From: Frederic Briare <fbriere@fbriere.net>
288530	string	DIRC		Git index
28854>4	belong	>0		\b, version %d
28855>>8	belong	>0		\b, %d entries
28856
28857# Type:	Mercurial bundles
28858# From:	Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr>
288590	string	HG10		Mercurial bundle,
28860>4	string	UN		uncompressed
28861>4	string	BZ		bzip2 compressed
28862
28863# Type:	Subversion (SVN) dumps
28864# From:	Uwe Zeisberger <zeisberg@informatik.uni-freiburg.de>
288650	string	SVN-fs-dump-format-version:	Subversion dumpfile
28866>28	string	>\0				(version: %s)
28867
28868# Type:	Bazaar revision bundles and merge requests
28869# URL:	https://www.bazaar-vcs.org/
28870# From:	Jelmer Vernooij <jelmer@samba.org>
288710	string	#\ Bazaar\ revision\ bundle\ v Bazaar Bundle
288720	string	#\ Bazaar\ merge\ directive\ format Bazaar merge directive
28873
28874#------------------------------------------------------------------------------
28875# $File: riff,v 1.42 2020/07/17 19:18:56 christos Exp $
28876# riff:  file(1) magic for RIFF format
28877# See
28878#
28879#	https://www.seanet.com/users/matts/riffmci/riffmci.htm
28880#	http://www-mmsp.ece.mcgill.ca/Documents/AudioFormats/WAVE/Docs/riffmci.pdf
28881#	https://www.iana.org/assignments/wave-avi-codec-registry/wave-avi-codec-registry.xml
28882#
28883
28884# audio format tag. Assume limits: max 1024 bit, 128 channels, 1 MHz
288850   name    riff-wave
28886>0	leshort		0x01		\b, Microsoft PCM
28887>>14	leshort		>0
28888>>>14	leshort		<1024	\b, %d bit
28889>0	leshort		0x02		\b, Microsoft ADPCM
28890>0	leshort		0x03		\b, IEEE Float
28891>0	leshort		0x04		\b, Compaq VSELP
28892>0	leshort		0x05		\b, IBM CVSD
28893>0	leshort		0x06		\b, ITU G.711 A-law
28894>0	leshort		0x07		\b, ITU G.711 mu-law
28895>0	leshort		0x08		\b, Microsoft DTS
28896>0	leshort		0x10		\b, OKI ADPCM
28897>0	leshort		0x11		\b, IMA ADPCM
28898>0	leshort		0x12		\b, MediaSpace ADPCM
28899>0	leshort		0x13		\b, Sierra ADPCM
28900>0	leshort		0x14		\b, ITU G.723 ADPCM (Yamaha)
28901>0	leshort		0x15		\b, DSP Solutions DIGISTD
28902>0	leshort		0x16		\b, DSP Solutions DIGIFIX
28903>0	leshort		0x17		\b, Dialogic OKI ADPCM
28904>0	leshort		0x18		\b, MediaVision ADPCM
28905>0	leshort		0x19		\b, HP CU
28906>0	leshort		0x20		\b, Yamaha ADPCM
28907>0	leshort		0x21		\b, Speech Compression SONARC
28908>0	leshort		0x22		\b, DSP Group True Speech
28909>0	leshort		0x23		\b, Echo Speech EchoSC1
28910>0	leshort		0x24		\b, AudioFile AF36
28911>0	leshort		0x25		\b, APTX
28912>0	leshort		0x26		\b, AudioFile AF10
28913>0	leshort		0x27		\b, Prosody 1612
28914>0	leshort		0x28		\b, LRC
28915>0	leshort		0x30		\b, Dolby AC2
28916>0	leshort		0x31		\b, GSM 6.10
28917>0	leshort		0x32		\b, MSN Audio
28918>0	leshort		0x33		\b, Antex ADPCME
28919>0	leshort		0x34		\b, Control Res VQLPC
28920>0	leshort		0x35		\b, Digireal
28921>0	leshort		0x36		\b, DigiADPCM
28922>0	leshort		0x37		\b, Control Res CR10
28923>0	leshort		0x38		\b, NMS VBXADPCM
28924>0	leshort		0x39		\b, Roland RDAC
28925>0	leshort		0x3A		\b, Echo Speech EchoSC3
28926>0	leshort		0x3B		\b, Rockwell ADPCM
28927>0	leshort		0x3C		\b, Rockwell Digitalk
28928>0	leshort		0x3D		\b, Xebec
28929>0	leshort		0x40		\b, ITU G.721 ADPCM
28930>0	leshort		0x41		\b, ITU G.728 CELP
28931>0	leshort		0x42		\b, MSG723
28932>0	leshort		0x50		\b, MPEG
28933>0	leshort		0x52		\b, RT24
28934>0	leshort		0x53		\b, PAC
28935>0	leshort		0x55		\b, MPEG Layer 3
28936>0	leshort		0x59		\b, Lucent G.723
28937>0	leshort		0x60		\b, Cirrus
28938>0	leshort		0x61		\b, ESPCM
28939>0	leshort		0x62		\b, Voxware
28940>0	leshort		0x63		\b, Canopus Atrac
28941>0	leshort		0x64		\b, ITU G.726 ADPCM
28942>0	leshort		0x65		\b, ITU G.722 ADPCM
28943>0	leshort		0x66		\b, DSAT
28944>0	leshort		0x67		\b, DSAT Display
28945>0	leshort		0x69		\b, Voxware Byte Aligned
28946>0	leshort		0x70		\b, Voxware AC8
28947>0	leshort		0x71		\b, Voxware AC10
28948>0	leshort		0x72		\b, Voxware AC16
28949>0	leshort		0x73		\b, Voxware AC20
28950>0	leshort		0x74		\b, Voxware MetaVoice
28951>0	leshort		0x75		\b, Voxware MetaSound
28952>0	leshort		0x76		\b, Voxware RT29HW
28953>0	leshort		0x77		\b, Voxware VR12
28954>0	leshort		0x78		\b, Voxware VR18
28955>0	leshort		0x79		\b, Voxware TQ40
28956>0	leshort		0x80		\b, Softsound
28957>0	leshort		0x81		\b, Voxware TQ60
28958>0	leshort		0x82		\b, MSRT24
28959>0	leshort		0x83		\b, ITU G.729A
28960>0	leshort		0x84		\b, MVI MV12
28961>0	leshort		0x85		\b, DF G.726
28962>0	leshort		0x86		\b, DF GSM610
28963>0	leshort		0x88		\b, ISIAudio
28964>0	leshort		0x89		\b, Onlive
28965>0	leshort		0x91		\b, SBC24
28966>0	leshort		0x92		\b, Dolby AC3 S/PDIF
28967>0	leshort		0x97		\b, ZyXEL ADPCM
28968>0	leshort		0x98		\b, Philips LPCBB
28969>0	leshort		0x99		\b, Packed
28970>0	leshort		0x100		\b, Rhetorex ADPCM
28971>0	leshort		0x101		\b, BeCubed Software IRAT
28972>0	leshort		0x111		\b, Vivo G.723
28973>0	leshort		0x112		\b, Vivo Siren
28974>0	leshort		0x123		\b, Digital G.723
28975>0	leshort		0x200		\b, Creative ADPCM
28976>0	leshort		0x202		\b, Creative FastSpeech8
28977>0	leshort		0x203		\b, Creative FastSpeech10
28978>0	leshort		0x220		\b, Quarterdeck
28979>0	leshort		0x300		\b, FM Towns Snd
28980>0	leshort		0x400		\b, BTV Digital
28981>0	leshort		0x680		\b, VME VMPCM
28982>0	leshort		0x1000		\b, OLIGSM
28983>0	leshort		0x1001		\b, OLIADPCM
28984>0	leshort		0x1002		\b, OLICELP
28985>0	leshort		0x1003		\b, OLISBC
28986>0	leshort		0x1004		\b, OLIOPR
28987>0	leshort		0x1100		\b, LH Codec
28988>0	leshort		0x1400		\b, Norris
28989>0	leshort		0x1401		\b, ISIAudio
28990>0	leshort		0x1500		\b, Soundspace Music Compression
28991>0	leshort		0x2000		\b, AC3 DVM
28992>0	leshort		0x2001		\b, DTS
28993>2	leshort		=1		\b, mono
28994>2	leshort		=2		\b, stereo
28995>2	leshort		>2
28996>>2	leshort		<128	\b, %d channels
28997>4	lelong		>0
28998>>4	lelong		<1000000	%d Hz
28999
29000# try to find "fmt "
290010   name    riff-walk
29002>0  string  fmt\x20
29003>>4 lelong  >15
29004>>>8 use    riff-wave
29005>0  string  LIST
29006>>&(4.l+4)  use riff-walk
29007>0  string  DISP
29008>>&(4.l+4)  use riff-walk
29009>0  string  bext
29010>>&(4.l+4)  use riff-walk
29011>0  string  Fake
29012>>&(4.l+4)  use riff-walk
29013>0  string  fact
29014>>&(4.l+4)  use riff-walk
29015>0  string  VP8
29016>>11		byte		0x9d
29017>>>12		byte		0x01
29018>>>>13		byte		0x2a	\b, VP8 encoding
29019>>>>>14		leshort&0x3fff	x	\b, %d
29020>>>>>16		leshort&0x3fff	x	\bx%d, Scaling:
29021>>>>>14		leshort&0xc000	0x0000	\b [none]
29022>>>>>14		leshort&0xc000	0x1000	\b [5/4]
29023>>>>>14		leshort&0xc000	0x2000	\b [5/3]
29024>>>>>14		leshort&0xc000	0x3000	\b [2]
29025>>>>>14		leshort&0xc000	0x0000	\bx[none]
29026>>>>>14		leshort&0xc000	0x1000	\bx[5/4]
29027>>>>>14		leshort&0xc000	0x2000	\bx[5/3]
29028>>>>>14		leshort&0xc000	0x3000	\bx[2]
29029>>>>>15		byte&0x80	=0x00	\b, YUV color
29030>>>>>15		byte&0x80	=0x80	\b, bad color specification
29031>>>>>15		byte&0x40	=0x40	\b, no clamping required
29032>>>>>15		byte&0x40	=0x00	\b, decoders should clamp
29033#>0  string  x		we got %s
29034#>>&(4.l+4)  use riff-walk
29035
29036# AVI section extended by Patrik Radman <patrik+file-magic@iki.fi>
29037#
290380	string		RIFF		RIFF (little-endian) data
29039# RIFF Palette format
29040# Update: Joerg Jenderek
29041# URL: https://en.wikipedia.org/wiki/Resource_Interchange_File_Format
29042# Reference: https://worms2d.info/Palette_file
29043# WAVE/AVI codec registry: https://www.iana.org/assignments/wave-avi-codec-registry/wave-avi-codec-registry.xml
29044>8	string		PAL\ 		\b, palette
29045!:mime	application/x-riff
29046# color palette by Microsoft Corporation
29047!:ext	pal
29048# file size =  chunk size + 8 in most cases
29049>>4	ulelong+8	x		\b, %u bytes
29050# Extended PAL Format
29051>>12	string		plth		\b, extended
29052# Simple PAL Format
29053>>12	string		data
29054# data chunk size = color entries * 4 + 4 + sometimes extra (4) appended bytes
29055>>>16	ulelong		x		\b, data size %u
29056# palVersion is always 0x0300
29057#>>>20	leshort		x		\b, version 0x%4.4x
29058# palNumEntries specifies the number of palette color entries
29059>>>22	uleshort	x		\b, %u entries
29060# after palPalEntry sized (number of color entries * 4 ) vector
29061>>>(22.s*4)	ubequad	x
29062# jump relative 22 ( 8 + 16) bytes forward points after end of file or to
29063# appended extra bytes like in http://safecolours.rigdenage.com/set(ms).zip/Protan(MS).pal
29064>>>>&16		ubelong	x		\b, extra bytes
29065>>>>>&-4	ubelong	>0		0x%8.8x
29066# RIFF Device Independent Bitmap format
29067# URL: http://fileformats.archiveteam.org/wiki/RDIB
29068>8	string		RDIB		\b, device-independent bitmap
29069!:ext	rdi/dib
29070>>16	string		BM
29071>>>30	leshort		12		\b, OS/2 1.x format
29072>>>>34	leshort		x		\b, %d x
29073>>>>36	leshort		x		%d
29074>>>30	leshort		64		\b, OS/2 2.x format
29075>>>>34	leshort		x		\b, %d x
29076>>>>36	leshort		x		%d
29077>>>30	leshort		40		\b, Windows 3.x format
29078>>>>34	lelong		x		\b, %d x
29079>>>>38	lelong		x		%d x
29080>>>>44	leshort		x		%d
29081# RIFF MIDI format
29082# URL:	http://fileformats.archiveteam.org/wiki/RIFF_MIDI
29083>8	string		RMID		\b, MIDI
29084# http://extension.nirsoft.net/rmi
29085!:mime	audio/mid
29086#!:mime	audio/x-rmid
29087!:ext	rmi
29088# RIFF Multimedia Movie File format
29089# URL:	http://fileformats.archiveteam.org/wiki/RIFF_Multimedia_Movie
29090>8	string		RMMP		\b, multimedia movie
29091!:mime	video/x-mmm
29092!:ext	mmm
29093# RIFF wrapper for MP3
29094>8	string		RMP3		\b, MPEG Layer 3 audio
29095#!:mime	audio/x-rmp3
29096# Microsoft WAVE format (*.wav)
29097# URL:		http://fileformats.archiveteam.org/wiki/WAV
29098>8	string		WAVE		\b, WAVE audio
29099#!:mime	audio/vnd.wave
29100!:mime	audio/x-wav
29101# https://www.macdisk.com/macsigen.php
29102#!:apple	????WAVE
29103!:ext	wav/wave
29104>>12    string  >\0
29105>>>12   use     riff-walk
29106# Update:	Joerg Jenderek
29107# lower case for Corel Draw version 8 Bidi
29108>8	string/c	cdr
29109# skip Corel CCX Clipart
29110>>8	string		!CDRXcont
29111# Corel Draw Picture
29112>>>0	use     corel-draw
29113# URL:		http://fileformats.archiveteam.org/wiki/CCX_(Corel)
29114# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/c/ccx-corel.trid.xml
29115>>8	string		=CDRXcont	\b, Corel Clipart
29116!:mime	application/x-corel-ccx
29117!:ext	ccx
29118# 3rd chunk data {Corel\040Binary\040Meta\040File}
29119#>>>20	string		x		\b, 3rd '%-s'
29120>>>4	ulelong+8	x		\b, %u bytes
29121# From:		Joerg Jenderek
29122# URL:		https://en.wikipedia.org/wiki/CorelDRAW
29123# Reference:	http://fileformats.archiveteam.org/wiki/CorelDRAW
29124# Picture templates created by newer software start with RIFF type CDT
29125>8	string		CDT
29126>>0	use		corel-draw
29127# Picture templates with version 4.4
29128>8	string		CDST
29129>>0	use		corel-draw
29130# pattern created by newer software start with RIFF type PAT
29131>8	string		PAT
29132>>0	use		corel-draw
29133# From:		Joerg Jenderek
29134# URL:		https://en.wikipedia.org/wiki/Corel_Designer
29135# Reference:	http://fileformats.archiveteam.org/wiki/Corel_Designer
29136>8	string		DES
29137>>8	string		!DESC
29138>>>0	use		corel-des
29139# Corel Draw templates with version 12.5 or Corel Designer illustration 12
29140>>8	string		=DESC
29141# MORE TESTS NEEDED HERE!
29142#>>>0	use		corel-des
29143#>>>0	use		corel-draw
29144>8	string		NUNDROOT	\b, Steinberg CuBase
29145# AVI == Audio Video Interleave
29146# Reference:	http://fileformats.archiveteam.org/wiki/AVI
29147>8	string		AVI\040		\b, AVI
29148# https://reposcope.com/mimetype/video/x-msvideo
29149!:mime	video/x-msvideo
29150# https://www.iana.org/assignments/wave-avi-codec-registry/wave-avi-codec-registry.xml
29151#!:mime	video/vnd.avi
29152!:ext	avi/divx
29153>>12    string          LIST
29154>>>20   string          hdrlavih
29155>>>>&36 lelong          x               \b, %u x
29156>>>>&40 lelong          x               %u,
29157>>>>&4  lelong          >1000000        <1 fps,
29158>>>>&4  lelong          1000000         1.00 fps,
29159>>>>&4  lelong          500000          2.00 fps,
29160>>>>&4  lelong          333333          3.00 fps,
29161>>>>&4  lelong          250000          4.00 fps,
29162>>>>&4  lelong          200000          5.00 fps,
29163>>>>&4  lelong          166667          6.00 fps,
29164>>>>&4  lelong          142857          7.00 fps,
29165>>>>&4  lelong          125000          8.00 fps,
29166>>>>&4  lelong          111111          9.00 fps,
29167>>>>&4  lelong          100000          10.00 fps,
29168# ]9.9,10.1[
29169>>>>&4  lelong          <101010
29170>>>>>&-4        lelong  >99010
29171>>>>>>&-4       lelong  !100000         ~10 fps,
29172>>>>&4  lelong          83333           12.00 fps,
29173# ]11.9,12.1[
29174>>>>&4  lelong          <84034
29175>>>>>&-4        lelong  >82645
29176>>>>>>&-4       lelong  !83333          ~12 fps,
29177>>>>&4  lelong          66667           15.00 fps,
29178# ]14.9,15.1[
29179>>>>&4  lelong          <67114
29180>>>>>&-4        lelong  >66225
29181>>>>>>&-4       lelong  !66667          ~15 fps,
29182>>>>&4  lelong          50000           20.00 fps,
29183>>>>&4  lelong          41708           23.98 fps,
29184>>>>&4  lelong          41667           24.00 fps,
29185# ]23.9,24.1[
29186>>>>&4  lelong          <41841
29187>>>>>&-4        lelong  >41494
29188>>>>>>&-4       lelong  !41708
29189>>>>>>>&-4      lelong  !41667          ~24 fps,
29190>>>>&4  lelong          40000           25.00 fps,
29191# ]24.9,25.1[
29192>>>>&4  lelong          <40161
29193>>>>>&-4        lelong  >39841
29194>>>>>>&-4       lelong  !40000          ~25 fps,
29195>>>>&4  lelong          33367           29.97 fps,
29196>>>>&4  lelong          33333           30.00 fps,
29197# ]29.9,30.1[
29198>>>>&4  lelong          <33445
29199>>>>>&-4        lelong  >33223
29200>>>>>>&-4       lelong  !33367
29201>>>>>>>&-4      lelong  !33333          ~30 fps,
29202>>>>&4  lelong          <32224          >30 fps,
29203##>>>>&4  lelong          x               (%lu)
29204##>>>>&20 lelong          x               %lu frames,
29205# Note: The tests below assume that the AVI has 1 or 2 streams,
29206#       "vids" optionally followed by "auds".
29207#       (Should cover 99.9% of all AVIs.)
29208# assuming avih length = 56
29209>>>88   string  LIST
29210>>>>96  string  strlstrh
29211>>>>>108        string  vids    video:
29212>>>>>>&0        lelong  0               uncompressed
29213# skip past vids strh
29214>>>>>>(104.l+108)       string  strf
29215>>>>>>>(104.l+132)      lelong          1       RLE 8bpp
29216>>>>>>>(104.l+132)      string/c        anim    Intel RDX
29217>>>>>>>(104.l+132)      string/c        aur2    AuraVision Aura 2
29218>>>>>>>(104.l+132)      string/c        aura    AuraVision Aura
29219>>>>>>>(104.l+132)      string/c        bt20    Brooktree MediaStream
29220>>>>>>>(104.l+132)      string/c        btcv    Brooktree Composite Video
29221>>>>>>>(104.l+132)      string/c        cc12    Intel YUV12
29222>>>>>>>(104.l+132)      string/c        cdvc    Canopus DV
29223>>>>>>>(104.l+132)      string/c        cham    Winnov Caviara Cham
29224>>>>>>>(104.l+132)      string/c        cljr    Proprietary YUV 4 pixels
29225>>>>>>>(104.l+132)      string/c        cmyk    Common Data Format in Printing
29226>>>>>>>(104.l+132)      string/c        cpla    Weitek 4:2:0 YUV Planar
29227>>>>>>>(104.l+132)      string/c        cvid    Cinepak
29228>>>>>>>(104.l+132)      string/c        cwlt    Microsoft Color WLT DIB
29229>>>>>>>(104.l+132)      string/c        cyuv    Creative Labs YUV
29230>>>>>>>(104.l+132)      string/c        d261    H.261
29231>>>>>>>(104.l+132)      string/c        d263    H.263
29232>>>>>>>(104.l+132)      string/c        duck    TrueMotion 1.0
29233>>>>>>>(104.l+132)      string/c        dve2    DVE-2 Videoconferencing
29234>>>>>>>(104.l+132)      string/c        fljp    Field Encoded Motion JPEG
29235>>>>>>>(104.l+132)      string/c        fvf1    Fractal Video Frame
29236>>>>>>>(104.l+132)      string/c        gwlt    Microsoft Greyscale WLT DIB
29237>>>>>>>(104.l+132)      string/c        h260    H.260
29238>>>>>>>(104.l+132)      string/c        h261    H.261
29239>>>>>>>(104.l+132)      string/c        h262    H.262
29240>>>>>>>(104.l+132)      string/c        h263    H.263
29241>>>>>>>(104.l+132)      string/c        h264    H.264
29242>>>>>>>(104.l+132)      string/c        h265    H.265
29243>>>>>>>(104.l+132)      string/c        h266    H.266
29244>>>>>>>(104.l+132)      string/c        h267    H.267
29245>>>>>>>(104.l+132)      string/c        h268    H.268
29246>>>>>>>(104.l+132)      string/c        h269    H.269
29247>>>>>>>(104.l+132)      string/c        i263    Intel I.263
29248>>>>>>>(104.l+132)      string/c        i420    Intel Indeo 4
29249>>>>>>>(104.l+132)      string/c        ian     Intel RDX
29250>>>>>>>(104.l+132)      string/c        iclb    CellB Videoconferencing Codec
29251>>>>>>>(104.l+132)      string/c        ilvc    Intel Layered Video
29252>>>>>>>(104.l+132)      string/c        ilvr    ITU-T H.263+
29253>>>>>>>(104.l+132)      string/c        iraw    Intel YUV Uncompressed
29254>>>>>>>(104.l+132)      string/c        iv30    Intel Indeo 3
29255>>>>>>>(104.l+132)      string/c        iv31    Intel Indeo 3.1
29256>>>>>>>(104.l+132)      string/c        iv32    Intel Indeo 3.2
29257>>>>>>>(104.l+132)      string/c        iv33    Intel Indeo 3.3
29258>>>>>>>(104.l+132)      string/c        iv34    Intel Indeo 3.4
29259>>>>>>>(104.l+132)      string/c        iv35    Intel Indeo 3.5
29260>>>>>>>(104.l+132)      string/c        iv36    Intel Indeo 3.6
29261>>>>>>>(104.l+132)      string/c        iv37    Intel Indeo 3.7
29262>>>>>>>(104.l+132)      string/c        iv38    Intel Indeo 3.8
29263>>>>>>>(104.l+132)      string/c        iv39    Intel Indeo 3.9
29264>>>>>>>(104.l+132)      string/c        iv40    Intel Indeo 4.0
29265>>>>>>>(104.l+132)      string/c        iv41    Intel Indeo 4.1
29266>>>>>>>(104.l+132)      string/c        iv42    Intel Indeo 4.2
29267>>>>>>>(104.l+132)      string/c        iv43    Intel Indeo 4.3
29268>>>>>>>(104.l+132)      string/c        iv44    Intel Indeo 4.4
29269>>>>>>>(104.l+132)      string/c        iv45    Intel Indeo 4.5
29270>>>>>>>(104.l+132)      string/c        iv46    Intel Indeo 4.6
29271>>>>>>>(104.l+132)      string/c        iv47    Intel Indeo 4.7
29272>>>>>>>(104.l+132)      string/c        iv48    Intel Indeo 4.8
29273>>>>>>>(104.l+132)      string/c        iv49    Intel Indeo 4.9
29274>>>>>>>(104.l+132)      string/c        iv50    Intel Indeo 5.0
29275>>>>>>>(104.l+132)      string/c        mpeg    MPEG 1 Video Frame
29276>>>>>>>(104.l+132)      string/c        mjpg    Motion JPEG
29277>>>>>>>(104.l+132)      string/c        mp42    Microsoft MPEG-4 v2
29278>>>>>>>(104.l+132)      string/c        mp43    Microsoft MPEG-4 v3
29279>>>>>>>(104.l+132)      string/c        mrca    MR Codec
29280>>>>>>>(104.l+132)      string/c        mrle    Run Length Encoding
29281>>>>>>>(104.l+132)      string/c        msvc    Microsoft Video 1
29282>>>>>>>(104.l+132)      string/c        phmo    Photomotion
29283>>>>>>>(104.l+132)      string/c        qpeq    QPEG 1.1 Format Video
29284>>>>>>>(104.l+132)      string/c        rgbt    RGBT
29285>>>>>>>(104.l+132)      string/c        rle4    Run Length Encoded 4
29286>>>>>>>(104.l+132)      string/c        rle8    Run Length Encoded 8
29287>>>>>>>(104.l+132)      string/c        rt21    Intel Indeo 2.1
29288>>>>>>>(104.l+132)      string/c        rvx     Intel RDX
29289>>>>>>>(104.l+132)      string/c        sdcc    Sun Digital Camera Codec
29290>>>>>>>(104.l+132)      string/c        sfmc    Crystal Net SFM Codec
29291>>>>>>>(104.l+132)      string/c        smsc    SMSC
29292>>>>>>>(104.l+132)      string/c        smsd    SMSD
29293>>>>>>>(104.l+132)      string/c        splc    Splash Studios ACM Audio Codec
29294>>>>>>>(104.l+132)      string/c        sqz2    Microsoft VXtreme Video Codec
29295>>>>>>>(104.l+132)      string/c        sv10    Sorenson Video R1
29296>>>>>>>(104.l+132)      string/c        tlms    TeraLogic Motion Intraframe Codec A
29297>>>>>>>(104.l+132)      string/c        tlst    TeraLogic Motion Intraframe Codec B
29298>>>>>>>(104.l+132)      string/c        tm20    TrueMotion 2.0
29299>>>>>>>(104.l+132)      string/c        tmic    TeraLogic Motion Intraframe Codec 2
29300>>>>>>>(104.l+132)      string/c        tmot    TrueMotion Video Compression
29301>>>>>>>(104.l+132)      string/c        tr20    TrueMotion RT 2.0
29302>>>>>>>(104.l+132)      string/c        ulti    Ultimotion
29303>>>>>>>(104.l+132)      string/c        uyvy    UYVY 4:2:2 byte ordering
29304>>>>>>>(104.l+132)      string/c        v422    24-bit YUV 4:2:2 format
29305>>>>>>>(104.l+132)      string/c        v655    16-bit YUV 4:2:2 format
29306>>>>>>>(104.l+132)      string/c        vcr1    ATI VCR 1.0
29307>>>>>>>(104.l+132)      string/c        vcr2    ATI VCR 2.0
29308>>>>>>>(104.l+132)      string/c        vcr3    ATI VCR 3.0
29309>>>>>>>(104.l+132)      string/c        vcr4    ATI VCR 4.0
29310>>>>>>>(104.l+132)      string/c        vcr5    ATI VCR 5.0
29311>>>>>>>(104.l+132)      string/c        vcr6    ATI VCR 6.0
29312>>>>>>>(104.l+132)      string/c        vcr7    ATI VCR 7.0
29313>>>>>>>(104.l+132)      string/c        vcr8    ATI VCR 8.0
29314>>>>>>>(104.l+132)      string/c        vcr9    ATI VCR 9.0
29315>>>>>>>(104.l+132)      string/c        vdct    Video Maker Pro DIB
29316>>>>>>>(104.l+132)      string/c        vids    YUV 4:2:2 CCIR 601 for V422
29317>>>>>>>(104.l+132)      string/c        vivo    Vivo H.263
29318>>>>>>>(104.l+132)      string/c        vixl    VIXL
29319>>>>>>>(104.l+132)      string/c        vlv1    VLCAP.DRV
29320>>>>>>>(104.l+132)      string/c        wbvc    W9960
29321>>>>>>>(104.l+132)      string/c        x263    mmioFOURCC('X','2','6','3')
29322>>>>>>>(104.l+132)      string/c        xlv0    XL Video Decoder
29323>>>>>>>(104.l+132)      string/c        y211    YUV 2:1:1 Packed
29324>>>>>>>(104.l+132)      string/c        y411    YUV 4:1:1 Packed
29325>>>>>>>(104.l+132)      string/c        y41b    YUV 4:1:1 Planar
29326>>>>>>>(104.l+132)      string/c        y41p    PC1 4:1:1
29327>>>>>>>(104.l+132)      string/c        y41t    PC1 4:1:1 with transparency
29328>>>>>>>(104.l+132)      string/c        y42b    YUV 4:2:2 Planar
29329>>>>>>>(104.l+132)      string/c        y42t    PC1 4:2:2 with transparency
29330>>>>>>>(104.l+132)      string/c        yc12    Intel YUV12 Codec
29331>>>>>>>(104.l+132)      string/c        yuv8    Winnov Caviar YUV8
29332>>>>>>>(104.l+132)      string/c        yuv9    YUV9
29333>>>>>>>(104.l+132)      string/c        yuy2    YUY2 4:2:2 byte ordering packed
29334>>>>>>>(104.l+132)      string/c        yuyv    BI_YUYV, Canopus
29335>>>>>>>(104.l+132)      string/c        fmp4    FFMpeg MPEG-4
29336>>>>>>>(104.l+132)      string/c        div3    DivX 3
29337>>>>>>>>112             string/c        div3    Low-Motion
29338>>>>>>>>112             string/c        div4    Fast-Motion
29339>>>>>>>(104.l+132)      string/c        divx    DivX 4
29340>>>>>>>(104.l+132)      string/c        dx50    DivX 5
29341>>>>>>>(104.l+132)      string/c        xvid    XviD
29342>>>>>>>(104.l+132)	string/c	h264	H.264
29343>>>>>>>(104.l+132)      string/c        wmv3    Windows Media Video 9
29344>>>>>>>(104.l+132)      string/c        h264    X.264 or H.264
29345>>>>>>>(104.l+132)      lelong  0
29346##>>>>>>>(104.l+132)      string  x       (%.4s)
29347# skip past first (video) LIST
29348>>>>(92.l+96)   string  LIST
29349>>>>>(92.l+104) string  strlstrh
29350>>>>>>(92.l+116)        string          auds    \b, audio:
29351# auds strh length = 56:
29352>>>>>>>(92.l+172)       string          strf
29353>>>>>>>>(92.l+180)      leshort 0x0001  uncompressed PCM
29354>>>>>>>>(92.l+180)      leshort 0x0002  ADPCM
29355>>>>>>>>(92.l+180)      leshort 0x0006  aLaw
29356>>>>>>>>(92.l+180)      leshort 0x0007  uLaw
29357>>>>>>>>(92.l+180)      leshort 0x0050  MPEG-1 Layer 1 or 2
29358>>>>>>>>(92.l+180)      leshort 0x0055  MPEG-1 Layer 3
29359>>>>>>>>(92.l+180)      leshort 0x2000  Dolby AC3
29360>>>>>>>>(92.l+180)      leshort 0x0161  DivX
29361##>>>>>>>>(92.l+180)      leshort x       (0x%.4x)
29362>>>>>>>>(92.l+182)      leshort 1       (mono,
29363>>>>>>>>(92.l+182)      leshort 2       (stereo,
29364>>>>>>>>(92.l+182)      leshort >2      (%d channels,
29365>>>>>>>>(92.l+184)      lelong  x       %d Hz)
29366# auds strh length = 64:
29367>>>>>>>(92.l+180)       string          strf
29368>>>>>>>>(92.l+188)      leshort 0x0001  uncompressed PCM
29369>>>>>>>>(92.l+188)      leshort 0x0002  ADPCM
29370>>>>>>>>(92.l+188)      leshort 0x0055  MPEG-1 Layer 3
29371>>>>>>>>(92.l+188)      leshort 0x2000  Dolby AC3
29372>>>>>>>>(92.l+188)      leshort 0x0161  DivX
29373##>>>>>>>>(92.l+188)      leshort x       (0x%.4x)
29374>>>>>>>>(92.l+190)      leshort 1       (mono,
29375>>>>>>>>(92.l+190)      leshort 2       (stereo,
29376>>>>>>>>(92.l+190)      leshort >2      (%d channels,
29377>>>>>>>>(92.l+192)      lelong  x       %d Hz)
29378# From:		Joerg Jenderek
29379# URL:		http://fileformats.archiveteam.org/wiki/VDR_(VirtualDub)
29380# Reference:	http://sourceforge.net/projects/virtualdub/files/virtualdub-win/
29381#		1.10.4.35491/VirtualDub-1.10.4-src.7z/src/vdremote/Main.cpp
29382# VirtualDub link handler
29383>8	string		VDRM		\b, VirtualDub link
29384!:mime	video/x-vdr
29385!:ext	vdr
29386>>12	string		PATH		\b, PATH
29387# remote-path to video file
29388>>16	pstring/l	x		%s
29389# Animated Cursor format
29390# Update:	Joerg Jenderek
29391# URL:		http://fileformats.archiveteam.org/wiki/Windows_Animated_Cursor
29392# Reference:	https://www.gdgsoft.com/anituner/help/aniformat.htm
29393>8	string		ACON		\b, animated cursor
29394!:mime	application/x-navi-animation
29395# http://extension.nirsoft.net/ani
29396#!:mime	image/ani
29397!:ext	ani
29398# INAM tag followed by length of title
29399>>24	string		INAM
29400>>>28	pstring/l	x		"%s"
29401# IART tag followed by length of author
29402>>>(28.l+32)	ubelong	0x49415254
29403>>>>&0	pstring/l	x		%s
29404# SoundFont 2 <mpruett@sgi.com>
29405# URL:	http://fileformats.archiveteam.org/wiki/SoundFont_2.0
29406>8	string		sfbk		\b, SoundFont/Bank
29407!:mime	audio/x-sfbk
29408!:ext	sf2
29409# MPEG-1 wrapped in a RIFF, apparently
29410# URL:	http://file.fyicenter.com/17_Video_.DAT_File_Extension_for_VCD_Files.html
29411>8      string          CDXA            \b, wrapped MPEG-1 (CDXA)
29412!:mime	video/x-cdxa
29413!:ext	mpg/dat
29414# URL:	http://fileformats.archiveteam.org/wiki/4X_IMA_ADPCM
29415>8	string		4XMV		\b, 4X Movie file
29416!:mime	video/x-4xmv
29417!:ext	4xm/4xa
29418# AMV-type AVI file: https://wiki.multimedia.cx/index.php?title=AMV
29419>8	string		AMV\040		\b, AMV
29420# http://fileformats.archiveteam.org/wiki/MTV_Video_(.AMV)
29421!:mime	video/x-amv
29422!:ext	amv
29423#!:ext	amv/mtv
29424# URL:	http://fileformats.archiveteam.org/wiki/WebP
29425>8      string          WEBP            \b, Web/P image
29426!:mime	image/webp
29427!:ext	webp
29428>>12	use		riff-walk
29429# From:		Joerg Jenderek
29430# URL:		http://fileformats.archiveteam.org/wiki/RIFF_MIDS
29431>8      string          MIDS            \b, MIDI Stream
29432!:mime	audio/x-mids
29433!:ext	mds
29434# From:		Joerg Jenderek
29435# URL:		http://mark0.net/soft-trid-e.html
29436# Reference:	http://fileformats.archiveteam.org/wiki/Trd_(TRID)
29437>8      string          TRID            \b, TrID defs package
29438!:mime	application/x-trid-trd
29439!:ext	trd
29440# From:		Joerg Jenderek
29441# URL:		https://en.wikipedia.org/wiki/CorelDRAW
29442# Reference:	http://fileformats.archiveteam.org/wiki/CorelDRAW
29443# Note:		Since version 3 CorelDraw Pictures are RIFF based
29444# but data chunks remain proprietary.
29445# Since version 14 til 15 packed as "content/riffData.cdr" and
29446# since 16 "content/root.dat" in ZIP container
29447# TODO:		distinguish templates with version 12.5 from Designer illustration 12
29448#	display information of RIFF based Corel Draw pictures, templates and patterns
294490	name   	corel-draw
29450# display second chunk for debugging
29451#>8	string		x		\b, [8]=%.8s
29452>0	string		x		\b, Corel Draw
29453#!:mime	image/x-coreldraw
29454!:mime	application/vnd.corel-draw
29455# used by newer pictures templates
29456>>8	string		CDT
29457# used by templates with newer versions since 16
29458>>>12	string		=fver		Picture template (root.dat)
29459!:ext	dat
29460# used by templates with older versions with vrsn tag
29461>>>12	string		!fver
29462# used by templates with older versions 14-15
29463>>>>11	string		>E		Picture template (riffData.cdr)
29464!:ext	cdr
29465# used by templates with older versions 11-13
29466>>>>11	string		<F		Picture template
29467!:ext	cdt/cdrt
29468# used by older templates with version 4.4
29469>>8	string		CDST		Picture template
29470!:ext	cdt
29471# used by templates with version 12.5
29472>>8	string		DESC		Picture template
29473!:ext	cdt
29474# used by newer patterns with version 22
29475>>8	string		PAT		Pattern
29476!:ext	dat
29477# remaining older templates, patterns, drawings
29478>>8	default		x
29479# pattern with old version 4.y
29480>>>26	ulelong		=0x0000206C	Pattern
29481!:ext	pat
29482# pattern with newer versions
29483>>>26	ulelong		=0x00000D2C	Pattern
29484!:ext	pat
29485# remaining older templates or pictures
29486>>>26	default		x
29487# used by older versions 5 - 15
29488>>>>12	string		=vrsn
29489# 4th chunk size unequal 282Ch only found for CDR
29490>>>>>26	ulelong		!0x0000282c	Picture
29491!:ext	cdr
29492>>>>>26	default		x		Picture or template
29493!:ext	cdr/cdt
29494# used by newer versions since 16
29495>>>>12	string		=fver		Picture (root.dat)
29496!:ext	dat
29497# version marked by 1 ASCII char: space~3, ... , F~15,  ... , N~22, ... R~22 template
29498>11	string		x		\b, version
29499>11	string		>\040		'%-.1s'
29500>0	use		corel-version
29501>4	ulelong+8	x		\b, %u bytes
29502#
29503#	display numeric version of RIFF based Corel after 3rd RIFF tag
295040	name   	corel-version
29505# for debugging purpose; vrsn for short content; fver for 16 byte size
29506#>12	string		x		\b, TAG "%-4.4s"
29507# 1st data chunk length 2 implies short content version
29508>16	ulelong		2
29509# vrsn chunk short content interpreted by MajorVersion * 100 + MinorVersion
29510>>20	uleshort/100	x		%u
29511>>20	uleshort%100	>0		\b.%u
29512# for debugging purpose display next chunk like: DISP LIST
29513#>>22	string		x		\b, 4th "%-4.4s"
29514#>>26	ulelong		x		\b, 4th SIZE 0x%x
29515# for debugging purpose display 5th chunk like: LIST DISP ccmm osfp
29516#>>(26.l+30)	string	x		\b, 5th "%-4.4s"
29517# 1st data chunk length 10h implies 16 byte content with version info
29518>16	ulelong		0x10
29519>>34	ubyte		x		%u
29520>>>33	ubyte		>0		\b.%u
29521#	display information of RIFF based Corel Design formats
295220	name   	corel-des
29523# display second chunk for debugging
29524#>8	string		x		\b, [8]=%.8s
29525>12	string		x		\b, Corel DESIGNER
29526!:mime	image/x-corel-des
29527#!:mime	application/x-vnd.corel.designer.document
29528# used by Corel Designer with newer versions since 16
29529>12	string		=fver		graphics (root.dat)
29530!:ext	dat
29531# used by Corel Designer templates with older versions with vrsn tag
29532>12	string		!fver
29533# used by Corel Designer with versions 14-15
29534>>11	string		>D		graphics (riffData.cdr)
29535!:ext	cdr
29536# used by Corel Designer with versions 10-12
29537>>11	string		<E		graphics
29538!:ext	des
29539# version indicated by last ASCII char of second chunk tag
29540>11	string		x		\b, version '%-.1s'
29541# but vrsn short content is not always version indicator
29542# exceptions: 'A'~11.4 'B'~12 'C'~12.5
29543>11	string		>D
29544>>0	use		corel-version
29545# for debugging purpose display next chunk like: DISP LIST
29546#>>22	string		x		\b, 4th "%-4.4s"
29547#>>26	ulelong		x		\b, 4th SIZE 0x%x
29548# for debugging purpose display 5th chunk like: LIST osfp
29549#>>(26.l+30)	string	x		\b, 5th "%-4.4s"
29550>4	ulelong+8	x		\b, %u bytes
29551#
29552# XXX - some of the below may only appear in little-endian form.
29553#
29554# Also "MV93" appears to be for one form of Macromedia Director
29555# files, and "GDMF" appears to be another multimedia format.
29556#
295570	string		RIFX		RIFF (big-endian) data
29558# RIFF Palette format
29559>8	string		PAL		\b, palette
29560>>16	beshort		x		\b, version %d
29561>>18	beshort		x		\b, %d entries
29562# RIFF Device Independent Bitmap format
29563>8	string		RDIB		\b, device-independent bitmap
29564>>16	string		BM
29565>>>30	beshort		12		\b, OS/2 1.x format
29566>>>>34	beshort		x		\b, %d x
29567>>>>36	beshort		x		%d
29568>>>30	beshort		64		\b, OS/2 2.x format
29569>>>>34	beshort		x		\b, %d x
29570>>>>36	beshort		x		%d
29571>>>30	beshort		40		\b, Windows 3.x format
29572>>>>34	belong		x		\b, %d x
29573>>>>38	belong		x		%d x
29574>>>>44	beshort		x		%d
29575# RIFF MIDI format
29576>8	string		RMID		\b, MIDI
29577# RIFF Multimedia Movie File format
29578>8	string		RMMP		\b, multimedia movie
29579# Microsoft WAVE format (*.wav)
29580>8	string		WAVE		\b, WAVE audio
29581>>20	leshort		1		\b, Microsoft PCM
29582>>>34	leshort		>0		\b, %d bit
29583>>22	beshort		=1		\b, mono
29584>>22	beshort		=2		\b, stereo
29585>>22	beshort		>2		\b, %d channels
29586>>24	belong		>0		%d Hz
29587# Corel Draw Picture big endian not tested by real examples
29588#>8	string		CDRA		\b, Corel Draw Picture
29589#>8	string		CDR6		\b, Corel Draw Picture, version 6
29590>8	string		CDR
29591>>0	use     \^corel-draw
29592
29593# AVI == Audio Video Interleave
29594>8	string		AVI\040		\b, AVI
29595# Animated Cursor format
29596>8	string		ACON		\b, animated cursor
29597# Notation Interchange File Format (big-endian only)
29598>8	string		NIFF		\b, Notation Interchange File Format
29599# SoundFont 2 <mpruett@sgi.com>
29600>8	string		sfbk		SoundFont/Bank
29601
29602#------------------------------------------------------------------------------
29603# Sony Wave64
29604# see http://www.vcs.de/fileadmin/user_upload/MBS/PDF/Whitepaper/Informations_about_Sony_Wave64.pdf
29605# 128 bit RIFF-GUID { 66666972-912E-11CF-A5D6-28DB04C10000 } in little-endian
296060	string	riff\x2E\x91\xCF\x11\xA5\xD6\x28\xDB\x04\xC1\x00\x00		Sony Wave64 RIFF data
29607# 128 bit + total file size (64 bits) so 24 bytes
29608# then WAVE-GUID { 65766177-ACF3-11D3-8CD1-00C04F8EDB8A }
29609>24	string		wave\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A		\b, WAVE 64 audio
29610!:mime	audio/x-w64
29611# FMT-GUID { 20746D66-ACF3-11D3-8CD1-00C04F8EDB8A }
29612>>40	search/256	fmt\x20\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A		\b
29613>>>&10	leshort		=1		\b, mono
29614>>>&10	leshort		=2		\b, stereo
29615>>>&10	leshort		>2		\b, %d channels
29616>>>&12	lelong		>0		%d Hz
29617
29618#------------------------------------------------------------------------------
29619# MBWF/RF64
29620# see EBU TECH 3306 https://tech.ebu.ch/docs/tech/tech3306-2009.pdf
296210	string	RF64\xff\xff\xff\xffWAVEds64		MBWF/RF64 audio
29622!:mime	audio/x-wav
29623>40	search/256	fmt\x20		\b
29624>>&6	leshort		=1		\b, mono
29625>>&6	leshort		=2		\b, stereo
29626>>&6	leshort		>2		\b, %d channels
29627>>&8	lelong		>0		%d Hz
29628
29629#------------------------------------------------------------------------------
29630# $File: rpi,v 1.2 2019/10/02 02:07:30 christos Exp $
29631# rpi:  file(1) magic for Raspberry Pi images
29632-44		lelong	0
29633>4		lelong	0
29634>>8		lelong	1
29635>>12		lelong	4
29636>>>16		string	283x
29637>>>>20		lelong	1
29638>>>>>24		lelong	4
29639>>>>>>28	string	DTOK
29640>>>>>>>32	lelong	44
29641>>>>>>>>36	lelong	4
29642>>>>>>>>>40	string	RPTL		Raspberry PI kernel image
29643
29644-56		lelong	0
29645>4		lelong	0
29646>>8		lelong	1
29647>>12		lelong	4
29648>>>16		string	283x
29649>>>>20		lelong	1
29650>>>>>24		lelong	4
29651>>>>>>28	string	DTOK
29652>>>>>>>32	lelong	1
29653>>>>>>>>36	lelong	4
29654>>>>>>>>>40	string	DDTK8
29655>>>>>>>>>>48	lelong	4
29656>>>>>>>>>>>52	string	RPTL		Raspberry PI kernel image
29657
29658#------------------------------------------------------------------------------
29659# $File: rpm,v 1.12 2013/01/11 16:45:23 christos Exp $
29660#
29661# RPM: file(1) magic for Red Hat Packages   Erik Troan (ewt@redhat.com)
29662#
296630	belong		0xedabeedb	RPM
29664!:mime	application/x-rpm
29665>4	byte		x		v%d
29666>5	byte		x		\b.%d
29667>6	beshort		1		src
29668>6	beshort		0		bin
29669>>8	beshort		1		i386/x86_64
29670>>8	beshort		2		Alpha/Sparc64
29671>>8	beshort		3		Sparc
29672>>8	beshort		4		MIPS
29673>>8	beshort		5		PowerPC
29674>>8	beshort		6		68000
29675>>8	beshort		7		SGI
29676>>8	beshort		8		RS6000
29677>>8	beshort		9		IA64
29678>>8	beshort		10		Sparc64
29679>>8	beshort		11		MIPSel
29680>>8	beshort		12		ARM
29681>>8	beshort		13		MiNT
29682>>8	beshort		14		S/390
29683>>8	beshort		15		S/390x
29684>>8	beshort		16		PowerPC64
29685>>8	beshort		17		SuperH
29686>>8	beshort		18		Xtensa
29687>>8	beshort		255		noarch
29688>>10	string		x		%s
29689
29690#delta RPM    Daniel Novotny (dnovotny@redhat.com)
296910	string		drpm		Delta RPM
29692!:mime  application/x-rpm
29693>12	string 	x	%s
29694>>8	beshort		11		MIPSel
29695>>8	beshort		12		ARM
29696>>8	beshort		13		MiNT
29697>>8	beshort		14		S/390
29698>>8	beshort		15		S/390x
29699>>8	beshort		16		PowerPC64
29700>>8	beshort		17		SuperH
29701>>8	beshort		18		Xtensa
29702>>10	string		x		%s
29703
29704#------------------------------------------------------------------------------
29705# $File: rpmsg,v 1.1 2019/04/19 00:40:47 christos Exp $
29706# rpmsg: file(1) magic for restricted-permission messages (or "rights-protected" messages)
29707# see https://en.wikipedia.org/wiki/Rpmsg
29708
297090	string	\x76\xe8\x04\x60\xc4\x11\xe3\x86	rpmsg Restricted Permission Message
29710
29711#------------------------------------------------------------------------------
29712# $File: rst,v 1.3 2020/04/27 01:50:36 christos Exp $
29713# rst: ReStructuredText http://docutils.sourceforge.net/rst.html
297140	search/256	\=\=
29715!:strength + 30
29716>&0	regex/256	\^[\=]+$
29717>>&0	search/512	:Author:	ReStructuredText file
29718>>&0	default		x
29719>>>&0	regex/512	\^\\.\\.[A-Za-z]	ReStructuredText file
29720!:ext	rst
29721
29722#------------------------------------------------------------------------------
29723# $File: rtf,v 1.9 2020/12/12 20:01:47 christos Exp $
29724# rtf:	file(1) magic for Rich Text Format (RTF)
29725#
29726# Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk
29727# Update:	Joerg Jenderek
29728# URL:		https://en.wikipedia.org/wiki/Rich_Text_Format
29729# Reference:	http://www.snake.net/software/RTF/RTF-Spec-1.7.rtf
29730#		http://www.kleinlercher.at/tools/Windows_Protocols/Word2007RTFSpec9.pdf
297310	string		{\\rtf
29732# skip DROID fmt-355-signature-id-522.rtf by looking for valid version
29733>5	ubyte		!0xAB
29734# skip also \ in DROID fmt-50-signature-id-158.rtf by looking for valid version
29735>>5	ubyte		!0x5C		Rich Text Format data
29736!:mime	text/rtf
29737!:apple	????RTF
29738!:ext	rtf
29739>>>0	use		rtf-info
29740#	display information like version, language and code page of RTF
297410	name		rtf-info
29742# 1 mostly, 2 for newer Pocket Word documents, space for test like fdo78502.rtf, { for some urtf
29743>5	ubyte		!0x7b		\b, version %c
29744# The word for character set must precede any text or most other control words
29745>6	string		\\mac		\b, Apple Macintosh
29746>6	string		\\pc
29747# control word \pca
29748>>9	ubyte		=0x61		\b, IBM PS/2, code page 850
29749>>9	ubyte		!0x61		\b, IBM PC, code page 437
29750# unknown character set or ANSI later after control words like
29751# \adeflang1025 \info \title \author \category \manager
29752# "Burow, Steffanie - Im Tal des Schneeleoparden.rtf"
29753#>6	search/105	\\ansi		\b, ANSI
29754>6	search/502	\\ansi		\b, ANSI
29755>6	default		x		\b, unknown character set
29756# look for explicit codepage keyword
29757# "Burow, Steffanie - Im Tal des Schneeleoparden.rtf"
29758#>5	search/110	\\ansicpg
29759>5	search/500	\\ansicpg
29760# skip unknown or buggy codepage string 0 like in fdo78502.rtf
29761>>&0	ubyte		!0x30		\b, code page
29762# codepage string: 437~United States IBM, ..., 1252~WesternEuropean, ..., 57011~Punjabi
29763>>>&-1		string	x		%-.3s
29764# skip space or \ and display possible 4th digit of code page string
29765>>>&2		ubyte	>0x2F
29766>>>>&-1		ubyte	<0x3A		\b%c
29767# possible 5th digit of code page string
29768>>>>>&0		ubyte	>0x2F
29769>>>>>>&-1	ubyte	<0x3A		\b%c
29770# look again at version byte to use default clause
29771>5	ubyte		x
29772# Default language ID for South Asian/Middle Eastern text
29773# language ID: 1025, ..., 1065~Persian, ..., 2057~English_UnitedKingdom, ..., 58380~French_NorthAfrica
29774# Readme-0.72-Persian.rtf
29775#>6	search/1	\\adeflang	\b, default middle east language ID
29776>>6	search/497	\\adeflang	\b, default middle east language ID
29777# https://docs.microsoft.com/en-us/openspecs/office_standards/ms-oe376/6c085406-a698-4e12-9d4d-c3b0ee3dbc4a
29778>>>&0	string		x		%.4s
29779# skip \ and NL and show possible 5th digit of language string
29780>>>&4	ubyte		>0x2F
29781>>>>&-1	ubyte		<0x3A		\b%c
29782# else look for default language to be used when the \plain control word is encountered
29783>>6	default		x
29784# "Burow, Steffanie - Im Tal des Schneeleoparden.rtf"
29785#>>>6	search/127	\\deflang
29786>>>6	search/505	\\deflang
29787>>>>&0	string		>0		\b, default language ID %-.4s
29788# possible 5th digit of language string
29789>>>>&4		ubyte	>0x2F
29790>>>>>&-1	ubyte	<0x3A		\b%c
29791
29792# Reference:	http://latex2rtf.sourceforge.net/rtfspec_63.html
29793# Note:		no real world example found
297940	string		{\\urtf		Rich Text Format unicoded data
29795!:mime	text/rtf
29796#!:apple	????RTF
29797!:ext	rtf
29798>1	use		rtf-info
29799
29800# URL:		https://en.wikipedia.org/wiki/Microsoft_Word
29801# Reference:	http://fileformats.archiveteam.org/wiki/Microsoft_Word
29802# Note:	called by TrID "Pocket Word document"
29803#	by PlanMaker "Pocket Word-Handheld PC" for pwd
29804#	by PlanMaker "Pocket Word-Pocket PC" for psw
298050	string		{\\pwd		Pocket Word document or template
29806# by SoftMaker Office	http://extension.nirsoft.net/pwd
29807#!:mime	application/msword
29808# https://reposcope.com/mimetype/application/x-pocket-word
29809!:mime	application/x-pocket-word
29810# PWD for Handheld PC variant and PSW for Pocket PC variant
29811# PWT for template
29812!:ext	pwd/psw/pwt
29813>0	use		rtf-info
29814
29815
29816#------------------------------------------------------------------------------
29817# $File: ruby,v 1.10 2019/07/21 09:40:17 christos Exp $
29818# ruby:  file(1) magic for Ruby scripting language
29819# URL:  https://www.ruby-lang.org/
29820# From: Reuben Thomas <rrt@sc3d.org>
29821
29822# Ruby scripts
298230	search/1/w	#!\ /usr/bin/ruby				Ruby script text executable
29824!:strength + 15
29825!:mime text/x-ruby
298260	search/1/w	#!\ /usr/local/bin/ruby	Ruby script text executable
29827!:strength + 15
29828!:mime text/x-ruby
298290	search/1	#!/usr/bin/env\ ruby				Ruby script text executable
29830!:strength + 15
29831!:mime text/x-ruby
298320	search/1	#!\ /usr/bin/env\ ruby			Ruby script text executable
29833!:strength + 15
29834!:mime text/x-ruby
29835
29836# What looks like ruby, but does not have a shebang
29837# (modules and such)
29838# From: Lubomir Rintel <lkundrak@v3.sk>
298390	search/8192	require
29840>0	regex		\^[[:space:]]*require[[:space:]]'[A-Za-z_/.]+'
29841>>0	regex		def\ [a-z]|\ do$
29842>>>&0	regex		\^[[:space:]]*end([[:space:]]+[;#].*)?$		Ruby script text
29843!:strength + 30
29844!:mime	text/x-ruby
298450	regex		\^[[:space:]]*(class|module)[[:space:]][A-Z]
29846>0	regex		(modul|includ)e\ [A-Z]|def\ [a-z]
29847>>&0	regex		\^[[:space:]]*end([[:space:]]+[;#].*)?$		Ruby script text
29848!:strength + 30
29849!:mime	text/x-ruby
29850# Classes with no modules or defs, beats simple ASCII
298510	regex		\^[[:space:]]*(class|module)[[:space:]][A-Z]
29852>&0	regex	\^[[:space:]]*end([[:space:]]+[;#if].*)?$		Ruby script text
29853!:strength + 10
29854!:mime	text/x-ruby
29855# Looks for function definition to balance python magic
29856# def name (args)
29857# end
298580	search/8192	def\
29859>0	regex		\^[[:space:]]*def\ [a-z]|def\ [[:alpha:]]+::[a-z]
29860>>&0	regex		\^[[:space:]]*end([[:space:]]+[;#].*)?$		Ruby script text
29861!:strength + 10
29862!:mime	text/x-ruby
29863
298640	search/8192	require
29865>0	regex		\^[[:space:]]*require[[:space:]]'[A-Za-z_/.]+'	Ruby script text
29866!:mime	text/x-ruby
298670	search/8192	include
29868>0 regex 	\^[[:space:]]*include\ ([A-Z]+[a-z]*(::))+	Ruby script text
29869!:mime	text/x-ruby
29870
29871#------------------------------------------------------------------------------
29872# $File: sc,v 1.6 2009/09/19 16:28:12 christos Exp $
29873# sc:  file(1) magic for "sc" spreadsheet
29874#
2987538	string		Spreadsheet	sc spreadsheet file
29876!:mime	application/x-sc
29877
29878#------------------------------------------------------------------------------
29879# $File: sccs,v 1.8 2020/06/20 21:32:52 christos Exp $
29880# sccs:  file(1) magic for SCCS archives
29881#
29882# SCCS v4 archive structure:
29883# \001h01207
29884# \001s 00276/00000/00000
29885# \001d D 1.1 87/09/23 08:09:20 ian 1 0
29886# \001c date and time created 87/09/23 08:09:20 by ian
29887# \001e
29888# \001u
29889# \001U
29890# ... etc.
29891# Now '\001h' happens to be the same as the 3B20's a.out magic number (0550).
29892# *Sigh*. And these both came from various parts of the USG.
29893# Maybe we should just switch everybody from SCCS to RCS!
29894# Further, you can't just say '\001h0', because the five-digit number
29895# is a checksum that could (presumably) have any leading digit,
29896# Fortunately we have regular expression matching:
298970	string		\001h
29898>2	regex		[0-9][0-9][0-9][0-9][0-9]$
29899>>8	string		\001s\040 		SCCS v4 archive data
29900>2	string		V6,sum=			SCCS v6 archive data
29901
29902#------------------------------------------------------------------------------
29903# $File: scientific,v 1.13 2019/04/19 00:42:27 christos Exp $
29904# scientific:  file(1) magic for scientific formats
29905#
29906# From: Joe Krahn <krahn@niehs.nih.gov>
29907
29908########################################################
29909# CCP4 data and plot files:
299100	string		MTZ\040		MTZ reflection file
29911
2991292	string		PLOT%%84	Plot84 plotting file
29913>52	byte		1		, Little-endian
29914>55	byte		1		, Big-endian
29915
29916########################################################
29917# Electron density MAP/MASK formats
29918
299190	string		EZD_MAP	NEWEZD Electron Density Map
29920109	string		MAP\040(  Old EZD Electron Density Map
29921
299220	string/c	:-)\040Origin	BRIX Electron Density Map
29923>170	string		>0	, Sigma:%.12s
29924#>4	string		>0	%.178s
29925#>4	addr		x	%.178s
29926
299277	string		18\040!NTITLE	XPLOR ASCII Electron Density Map
299289	string		\040!NTITLE\012\040REMARK	CNS ASCII electron density map
29929
29930208	string		MAP\040	CCP4 Electron Density Map
29931# Assumes same stamp for float and double (normal case)
29932>212	byte		17	\b, Big-endian
29933>212	byte		34	\b, VAX format
29934>212	byte		68	\b, Little-endian
29935>212	byte		85	\b, Convex native
29936
29937############################################################
29938# X-Ray Area Detector images
299390	string	R-AXIS4\ \ \ 	R-Axis Area Detector Image:
29940>796	lelong	<20		Little-endian, IP #%d,
29941>>768	lelong	>0		Size=%dx
29942>>772	lelong	>0		\b%d
29943>796	belong	<20		Big-endian, IP #%d,
29944>>768	belong	>0		Size=%dx
29945>>772	belong	>0		\b%d
29946
299470	string	RAXIS\ \ \ \ \ 	R-Axis Area Detector Image, Win32:
29948>796	lelong	<20		Little-endian, IP #%d,
29949>>768	lelong	>0		Size=%dx
29950>>772	lelong	>0		\b%d
29951>796	belong	<20		Big-endian, IP #%d,
29952>>768	belong	>0		Size=%dx
29953>>772	belong	>0		\b%d
29954
29955
299561028	string	MMX\000\000\000\000\000\000\000\000\000\000\000\000\000	MAR Area Detector Image,
29957>1072	ulong	>1		Compressed(%d),
29958>1100	ulong	>1		%d headers,
29959>1104	ulong	>0		%d x
29960>1108	ulong	>0		%d,
29961>1120	ulong	>0		%d bits/pixel
29962
29963# Type: GEDCOM genealogical (family history) data
29964# From: Giuseppe Bilotta
299650       search/1/c	0\ HEAD         GEDCOM genealogy text
29966>&0     search		1\ GEDC
29967>>&0    search		2\ VERS         version
29968>>>&1   string		>\0		%s
29969# From: Phil Endecott <phil05@chezphil.org>
299700	string	\000\060\000\040\000\110\000\105\000\101\000\104		GEDCOM data
299710	string	\060\000\040\000\110\000\105\000\101\000\104\000		GEDCOM data
299720	string	\376\377\000\060\000\040\000\110\000\105\000\101\000\104	GEDCOM data
299730	string	\377\376\060\000\040\000\110\000\105\000\101\000\104\000	GEDCOM data
29974
29975# PDB: Protein Data Bank files
29976# Adam Buchbinder <adam.buchbinder@gmail.com>
29977#
29978# https://www.wwpdb.org/documentation/format32/sect2.html
29979# https://www.ch.ic.ac.uk/chemime/
29980#
29981# The PDB file format is fixed-field, 80 columns. From the spec:
29982#
29983# COLS        DATA
29984#  1 -  6      "HEADER"
29985#  11 - 50     String(40)
29986#  51 - 59     Date
29987#  63 - 66     IDcode
29988#
29989# Thus, positions 7-10, 60-62 and 67-80 are spaces. The Date must be in the
29990# format DD-MMM-YY, e.g., 01-JAN-70, and the IDcode consists of numbers and
29991# uppercase letters. However, examples have been seen without the date string,
29992# e.g., the example on the chemime site.
299930	string	HEADER\ \ \ \040
29994>&0	regex/1l	\^.{40}
29995>>&0	regex/1l	[0-9]{2}-[A-Z]{3}-[0-9]{2}\ {3}
29996>>>&0	regex/1ls	[A-Z0-9]{4}.{14}$
29997>>>>&0	regex/1l	[A-Z0-9]{4}	Protein Data Bank data, ID Code %s
29998!:mime	chemical/x-pdb
29999>>>>0	regex/1l	[0-9]{2}-[A-Z]{3}-[0-9]{2}	\b, %s
30000
30001# Type:	GDSII Stream file
300020	belong	0x00060002	GDSII Stream file
30003>4	byte	0x00
30004>>5	byte	x		version %d.0
30005>4	byte	>0x00		version %d
30006>>5	byte	x		\b.%d
30007
30008# Type: LXT (interLaced eXtensible Trace)
30009# chrysn <chrysn@fsfe.org>
300100	beshort	0x0138	interLaced eXtensible Trace (LXT) file
30011>2	beshort	>0	(Version %u)
30012
30013#------------------------------------------------------------------------------
30014# $File: securitycerts,v 1.4 2009/09/19 16:28:12 christos Exp $
300150	search/1		-----BEGIN\ CERTIFICATE------	RFC1421 Security Certificate text
300160	search/1		-----BEGIN\ NEW\ CERTIFICATE	RFC1421 Security Certificate Signing Request text
300170	belong	0xedfeedfe	Sun 'jks' Java Keystore File data
30018
300190	string \0volume_key	volume_key escrow packet
30020# Type:	SE Linux policy modules *.pp reference policy
30021#	for Fedora 5 to 9, RHEL5, and Debian Etch and Lenny.
30022# URL:	https://doc.coker.com.au/computers/selinux-magic
30023# From:	Russell Coker <russell@coker.com.au>
30024
300250		lelong	0xf97cff8f	SE Linux modular policy
30026>4		lelong	x		version %d,
30027>8		lelong	x		%d sections,
30028>>(12.l)	lelong	0xf97cff8d
30029>>>(12.l+27)	lelong	x		mod version %d,
30030>>>(12.l+31)	lelong	0		Not MLS,
30031>>>(12.l+31)	lelong	1		MLS,
30032>>>(12.l+23)	lelong	2
30033>>>>(12.l+47)	string	>\0		module name %s
30034>>>(12.l+23)	lelong	1		base
30035
300361	string	policy_module(	SE Linux policy module source
300372	string	policy_module(	SE Linux policy module source
30038
300390	string	##\ <summary>	SE Linux policy interface source
30040
30041#0	search	gen_context(	SE Linux policy file contexts
30042
30043#0	search	gen_sens(	SE Linux policy MLS constraints source
30044
30045#------------------------------------------------------------------------------
30046# $File: sendmail,v 1.11 2019/04/19 00:42:27 christos Exp $
30047# sendmail:  file(1) magic for sendmail config files
30048#
30049# XXX - byte order?
30050#
30051# Update: Joerg Jenderek
30052# GRR: this test is too general as it catches also
30053# READ.ME.FIRST.AWP Sendmail frozen configuration
30054# - version ====|====|====|====|====|====|====|====|====|====|====|====|===
30055# Email_23_f217153422.ts Sendmail frozen configuration
30056# - version \330jK\354
300570	byte	046
30058# https://www.sendmail.com/sm/open_source/docs/older_release_notes/
30059# freezed configuration file (dbm format?) created from sendmal.cf with -bz
30060# by older sendmail. til version 8.6 support for frozen configuration files is removed
30061# valid version numbers look like "7.14.4" and should be similar to output of commands
30062# "sendmail -d0 -bt < /dev/null |grep -i Version" or "egrep '^DZ' /etc/sendmail.cf"
30063>16	regex/s	=^[0-78][0-9.]{4}	Sendmail frozen configuration
30064# normally only /etc/sendmail.fc or /var/adm/sendmail/sendmail.fc
30065!:ext fc
30066>>16	string	>\0			- version %s
300670	short	0x271c
30068# look for valid version number
30069>16	regex/s	=^[0-78][0-9.]{4}	Sendmail frozen configuration
30070!:ext fc
30071>>16	string	>\0			- version %s
30072
30073#------------------------------------------------------------------------------
30074# sendmail:  file(1) magic for sendmail m4(1) files
30075#
30076# From Hendrik Scholz <hendrik@scholz.net>
30077# i.e. files in /usr/share/sendmail/cf/
30078#
300790   string  divert(-1)\n    sendmail m4 text file
30080
30081
30082#------------------------------------------------------------------------------
30083# $File: sequent,v 1.14 2019/04/19 00:42:27 christos Exp $
30084# sequent:  file(1) magic for Sequent machines
30085#
30086# Sequent information updated by Don Dwiggins <atsun!dwiggins>.
30087# For Sequent's multiprocessor systems (incomplete).
300880	lelong	0x00ea        	BALANCE NS32000 .o
30089>16	lelong	>0		not stripped
30090>124	lelong	>0		version %d
300910	lelong	0x10ea        	BALANCE NS32000 executable (0 @ 0)
30092>16	lelong  >0            	not stripped
30093>124	lelong	>0		version %d
300940	lelong	0x20ea        	BALANCE NS32000 executable (invalid @ 0)
30095>16	lelong  >0            	not stripped
30096>124	lelong	>0		version %d
300970	lelong	0x30ea        	BALANCE NS32000 standalone executable
30098>16	lelong  >0          	not stripped
30099>124	lelong	>0		version %d
30100#
30101# Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>.
30102# Symmetry magic nums will not be reached if DOS COM comes before them;
30103# byte 0xeb is matched before these get a chance.
301040	leshort	0x12eb		SYMMETRY i386 .o
30105>16	lelong	>0		not stripped
30106>124	lelong	>0		version %d
301070	leshort	0x22eb		SYMMETRY i386 executable (0 @ 0)
30108>16	lelong	>0		not stripped
30109>124	lelong	>0		version %d
301100	leshort	0x32eb		SYMMETRY i386 executable (invalid @ 0)
30111>16	lelong	>0		not stripped
30112>124	lelong	>0		version %d
30113# https://en.wikipedia.org/wiki/Sequent_Computer_Systems
30114# below test line conflicts with MS-DOS 2.11 floppies and Acronis loader
30115#0	leshort	0x42eb		SYMMETRY i386 standalone executable
301160	leshort	0x42eb
30117# skip unlike negative version
30118>124	lelong	>-1
30119# assuming version 28867614 is very low probable
30120>>124	lelong	!28867614	SYMMETRY i386 standalone executable
30121>>>16	lelong	>0		not stripped
30122>>>124	lelong	>0		version %d
30123
30124#------------------------------------------------------------------------------
30125# $File: sereal,v 1.3 2015/02/05 19:14:45 christos Exp $
30126# sereal: file(1) magic the Sereal binary serialization format
30127#
30128# From: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
30129#
30130# See the specification of the format at
30131# https://github.com/Sereal/Sereal/blob/master/sereal_spec.pod#document-header-format
30132#
30133# I'd have liked to do the byte&0xF0 matching against 0, 1, 2 ... by
30134# doing (byte&0xF0)>>4 here, but unfortunately that's not
30135# supported. So when we print out a message about an unknown format
30136# we'll print out e.g. 0x30 instead of the more human-readable
30137# 0x30>>4.
30138#
30139# See https://github.com/Sereal/Sereal/commit/35372ae01d in the
30140# Sereal.git repository for test Sereal data.
301410	name		sereal
30142>4	byte&0x0F	x		(version %d,
30143>4	byte&0xF0	0x00		uncompressed)
30144>4	byte&0xF0	0x10		compressed with non-incremental Snappy)
30145>4	byte&0xF0	0x20		compressed with incremental Snappy)
30146>4	byte&0xF0	>0x20		unknown subformat, flag: %d>>4)
30147
301480	string/b	\=srl		Sereal data packet
30149!:mime application/sereal
30150>&0	use		sereal
301510	string/b	\=\xF3rl	Sereal data packet
30152!:mime application/sereal
30153>&0	use		sereal
301540	string/b	\=\xC3\xB3rl	Sereal data packet, UTF-8 encoded
30155!:mime application/sereal
30156>&0	use		sereal
30157
30158
30159#------------------------------------------------------------------------------
30160# $File: sgi,v 1.23 2018/05/29 02:26:56 christos Exp $
30161# sgi:  file(1) magic for Silicon Graphics operating systems and applications
30162#
30163# Executable images are handled either in aout (for old-style a.out
30164# files for 68K; they are indistinguishable from other big-endian 32-bit
30165# a.out files) or in mips (for MIPS ECOFF and Ucode files)
30166#
30167
30168# kbd file definitions
301690	string	kbd!map		kbd map file
30170>8	byte	>0		Ver %d:
30171>10	short	>0		with %d table(s)
30172
301730	beshort	0x8765		disk quotas file
30174
301750	beshort	0x0506		IRIS Showcase file
30176>2	byte	0x49		-
30177>3	byte	x		- version %d
301780	beshort	0x0226		IRIS Showcase template
30179>2	byte	0x63		-
30180>3	byte	x		- version %d
301810	belong	0x5343464d	IRIS Showcase file
30182>4	byte	x		- version %d
301830	belong	0x5443464d	IRIS Showcase template
30184>4	byte	x		- version %d
301850	belong	0xdeadbabe	IRIX Parallel Arena
30186>8	belong	>0		- version %d
30187
30188# core files
30189#
30190# 32bit core file
301910	belong	0xdeadadb0	IRIX core dump
30192>4	belong	1		of
30193>16	string	>\0		'%s'
30194# 64bit core file
301950	belong	0xdeadad40	IRIX 64-bit core dump
30196>4	belong	1		of
30197>16	string	>\0		'%s'
30198# N32bit core file
301990       belong	0xbabec0bb	IRIX N32 core dump
30200>4      belong	1               of
30201>16     string	>\0             '%s'
30202# New style crash dump file
302030	string	\x43\x72\x73\x68\x44\x75\x6d\x70	IRIX vmcore dump of
30204>36	string	>\0					'%s'
30205
30206# Trusted IRIX info
302070	string	SGIAUDIT	SGI Audit file
30208>8	byte	x		- version %d
30209>9	byte	x		\b.%d
30210#
302110	string	WNGZWZSC	Wingz compiled script
302120	string	WNGZWZSS	Wingz spreadsheet
302130	string	WNGZWZHP	Wingz help file
30214#
302150	string	#Inventor\040V	IRIS Inventor 1.0 file
302160	string	#Inventor\040V2	Open Inventor 2.0 file
30217# GLF is OpenGL stream encoding
302180	string	glfHeadMagic();		GLF_TEXT
302194	belong	0x7d000000		GLF_BINARY_LSB_FIRST
30220!:strength -30
302214	belong	0x0000007d		GLF_BINARY_MSB_FIRST
30222!:strength -30
30223# GLS is OpenGL stream encoding; GLS is the successor of GLF
302240	string	glsBeginGLS(		GLS_TEXT
302254	belong	0x10000000		GLS_BINARY_LSB_FIRST
30226!:strength -30
302274	belong	0x00000010		GLS_BINARY_MSB_FIRST
30228!:strength -30
30229
30230# Performance Co-Pilot file types
302310	string	PmNs				PCP compiled namespace (V.0)
302320	string	PmN				PCP compiled namespace
30233>3	string	>\0				(V.%1.1s)
30234#3	lelong	0x84500526			PCP archive
302353	belong	0x84500526			PCP archive
30236>7	byte	x				(V.%d)
30237#>20	lelong	-2				temporal index
30238#>20	lelong	-1				metadata
30239#>20	lelong	0				log volume #0
30240#>20	lelong	>0				log volume #%d
30241>20	belong	-2				temporal index
30242>20	belong	-1				metadata
30243>20	belong	0				log volume #0
30244>20	belong	>0				log volume #%d
30245>24	string	>\0				host: %s
302460	string	PCPFolio			PCP
30247>9	string	Version:			Archive Folio
30248>18	string	>\0				(V.%s)
302490	string	#pmchart			PCP pmchart view
30250>9	string	Version
30251>17	string	>\0				(V%-3.3s)
302520	string	#kmchart			PCP kmchart view
30253>9	string	Version
30254>17	string	>\0				(V.%s)
302550	string	pmview				PCP pmview config
30256>7	string	Version
30257>15	string	>\0				(V%-3.3s)
302580	string	#pmlogger			PCP pmlogger config
30259>10	string	Version
30260>18	string	>\0				(V%1.1s)
302610	string	#pmdahotproc			PCP pmdahotproc config
30262>13	string	Version
30263>21	string	>\0				(V%-3.3s)
302640	string	PcPh				PCP Help
30265>4	string	1				Index
30266>4	string	2				Text
30267>5	string	>\0				(V.%1.1s)
302680	string	#pmieconf-rules			PCP pmieconf rules
30269>16	string	>\0				(V.%1.1s)
302703	string	pmieconf-pmie			PCP pmie config
30271>17	string	>\0				(V.%1.1s)
302720	string	MMV				PCP memory mapped values
30273>4	long	x				(V.%d)
30274
30275# SpeedShop data files
302760	lelong	0x13130303			SpeedShop data file
30277
30278# mdbm files
302790	lelong	0x01023962			mdbm file, version 0 (obsolete)
302800	string	mdbm				mdbm file,
30281>5	byte	x				version %d,
30282>6	byte	x				2^%d pages,
30283>7	byte	x				pagesize 2^%d,
30284>17	byte	x				hash %d,
30285>11	byte	x				dataformat %d
30286
30287# Alias Maya files
302880	string/t	//Maya\040ASCII	Alias Maya Ascii File,
30289>13	string	>\0	version %s
302908	string	MAYAFOR4	Alias Maya Binary File,
30291>32	string	>\0	version %s scene
302928	string	MayaFOR4	Alias Maya Binary File,
30293>32	string	>\0	version %s scene
302948	string	CIMG		Alias Maya Image File
302958	string	DEEP		Alias Maya Image File
30296
30297#------------------------------------------------------------------------------
30298# $File: sgml,v 1.42 2020/12/12 20:01:47 christos Exp $
30299# Type:	SVG Vectorial Graphics
30300# From:	Noel Torres <tecnico@ejerciciosresueltos.com>
303010	string/bt		\<?xml\ version=
30302>14	regex		['"\ \t]*[0-9.]+['"\ \t]*
30303>>19	search/4096	\<svg			SVG Scalable Vector Graphics image
30304!:strength +50
30305!:mime	image/svg+xml
30306>>19	search/4096	\<gnc-v2		GnuCash file
30307!:mime	application/x-gnucash
303080	string/bt		\<svg			SVG Scalable Vector Graphics image
30309!:mime	image/svg+xml
30310
30311# Sitemap file
303120	string/t		\<?xml\ version=
30313>14	regex		['"\ \t]*[0-9.]+['"\ \t]*
30314>>19	search/4096	\<urlset		XML Sitemap document text
30315!:mime	application/xml-sitemap
30316
30317# OpenStreetMap XML (.osm)
30318# https://wiki.openstreetmap.org/wiki/OSM_XML
30319# From: Markus Heidelberg <markus.heidelberg@web.de>
303200	string		\<?xml\ version=
30321>14	regex		['"\ \t]*[0-9.]+['"\ \t]*
30322>>19	search/4096	\<osm			OpenStreetMap XML data
30323
30324# xhtml
303250	string/t		\<?xml\ version="
30326>19	search/4096/cWbt	\<!doctype\ html	XHTML document text
30327>>15	string		>\0	(version %.3s)
30328!:mime	text/html
303290	string/t		\<?xml\ version='
30330>19	search/4096/cWbt	\<!doctype\ html	XHTML document text
30331>>15	string		>\0	(version %.3s)
30332!:mime	text/html
303330	string/t		\<?xml\ version="
30334>19	search/4096/cWbt	\<html	broken XHTML document text
30335>>15	string		>\0	(version %.3s)
30336!:mime	text/html
30337
30338#------------------------------------------------------------------------------
30339# sgml:  file(1) magic for Standard Generalized Markup Language
30340# HyperText Markup Language (HTML) is an SGML document type,
30341# from Daniel Quinlan (quinlan@yggdrasil.com)
30342# adapted to string extensions by Anthon van der Neut <anthon@mnt.org)
303430	search/4096/cWt	\<!doctype\ html	HTML document text
30344!:mime	text/html
30345!:strength + 5
30346
30347# SVG document
30348# https://www.w3.org/TR/SVG/single-page.html
303490	search/4096/cWbt	\<!doctype\ svg	SVG XML document
30350!:mime  image/svg+xml
30351!:strength + 5
30352
303530	search/4096/cwt	\<head\>		HTML document text
30354!:mime	text/html
30355!:strength + 5
303560	search/4096/cWt	\<head\ 		HTML document text
30357!:mime	text/html
30358!:strength + 5
303590	search/4096/cwt	\<title\>		HTML document text
30360!:mime	text/html
30361!:strength + 5
303620	search/4096/cWt	\<title\ 		HTML document text
30363!:mime	text/html
30364!:strength + 5
303650	search/4096/cwt	\<html\>		HTML document text
30366!:mime	text/html
30367!:strength + 5
303680	search/4096/cWt	\<html\ 		HTML document text
30369!:mime	text/html
30370!:strength + 5
303710	search/4096/cwt	\<script\> 		HTML document text
30372!:mime	text/html
30373!:strength + 5
303740	search/4096/cWt	\<script\ 		HTML document text
30375!:mime	text/html
30376!:strength + 5
303770	search/4096/cwt	\<style\> 		HTML document text
30378!:mime	text/html
30379!:strength + 5
303800	search/4096/cWt	\<style\  		HTML document text
30381!:mime	text/html
30382!:strength + 5
303830	search/4096/cwt	\<table\>		HTML document text
30384!:mime	text/html
30385!:strength + 5
303860	search/4096/cWt	\<table\ 		HTML document text
30387!:mime	text/html
30388!:strength + 5
30389
303900	search/4096/cwt	\<a\ href=		HTML document text
30391!:mime	text/html
30392!:strength + 5
30393
30394# Extensible markup language (XML), a subset of SGML
30395# from Marc Prud'hommeaux (marc@apocalypse.org)
303960	search/1/cwt	\<?xml			XML document text
30397!:mime	text/xml
30398!:strength + 5
303990	string/t		\<?xml\ version\ "	XML
30400!:mime	text/xml
30401!:strength + 5
304020	string/t		\<?xml\ version="	XML
30403!:mime	text/xml
30404!:strength + 5
30405>15	string/t	>\0			%.3s document text
30406>>23	search/1	\<xsl:stylesheet	(XSL stylesheet)
30407>>24	search/1	\<xsl:stylesheet	(XSL stylesheet)
304080	string/t	\<?xml\ version='	XML
30409!:mime	text/xml
30410!:strength + 5
30411>15	string/t	>\0			%.3s document text
30412>>23	search/1	\<xsl:stylesheet	(XSL stylesheet)
30413>>24	search/1	\<xsl:stylesheet	(XSL stylesheet)
304140	search/1/wt	\<?XML			broken XML document text
30415!:mime	text/xml
30416!:strength - 10
30417
30418
30419# SGML, mostly from rph@sq
304200	search/4096/cwt	\<!doctype		exported SGML document text
304210	search/4096/cwt	\<!subdoc		exported SGML subdocument text
304220	search/4096/cwt	\<!--			exported SGML document text
30423!:strength - 10
30424
30425# Web browser cookie files
30426# (Mozilla, Galeon, Netscape 4, Konqueror..)
30427# Ulf Harnhammar <ulfh@update.uu.se>
304280	search/1	#\ HTTP\ Cookie\ File	Web browser cookie text
304290	search/1	#\ Netscape\ HTTP\ Cookie\ File	Netscape cookie text
304300	search/1	#\ KDE\ Cookie\ File	Konqueror cookie text
30431
30432# XML-based format representing braille pages in a digital format.
30433#
30434# Specification:
30435# http://files.pef-format.org/specifications/pef-2008-1/pef-specification.html
30436#
30437# Simon Aittamaa <simon.aittamaa@gmail.com>
304380   string      \<?xml\ version=
30439>14 regex       ['"\ \t]*[0-9.]+['"\ \t]*
30440>>19    search/4096 \<pef           Portable Embosser Format
30441!:mime  application/x-pef+xml
30442
30443#------------------------------------------------------------------------
30444# $File: sharc,v 1.8 2017/03/17 21:35:28 christos Exp $
30445# file(1) magic for sharc files
30446#
30447# SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by
30448# FutureGroove Music (dsp@futuregroove.de)
30449
30450#------------------------------------------------------------------------
30451#0	string			Draw		RiscOS Drawfile
30452#0	string			PACK		RiscOS PackdDir archive
30453
30454#------------------------------------------------------------------------
30455# SHARC DSP stuff (based on the FGM SHARC DSP SDK)
30456
30457#0	string			=!		Assembler source
30458#0	string			Analog		ADi asm listing file
304590	string			.SYSTEM		SHARC architecture file
304600	string			.system		SHARC architecture file
30461
304620	leshort			0x521C		SHARC COFF binary
30463>2	leshort			>1		, %d sections
30464>>12	lelong			>0		, not stripped
30465
30466#------------------------------------------------------------------------------
30467# $File: sinclair,v 1.6 2015/11/14 13:38:35 christos Exp $
30468# sinclair:  file(1) sinclair QL
30469
30470# additions to /etc/magic by Thomas M. Ott (ThMO)
30471
30472# Sinclair QL floppy disk formats (ThMO)
304730	string	=QL5		QL disk dump data,
30474>3	string	=A		720 KB,
30475>3	string	=B		1.44 MB,
30476>3	string	=C		3.2 MB,
30477>4	string	>\0		label:%.10s
30478
30479# Sinclair QL OS dump (ThMO)
304800		belong	=0x30000
30481>49124		belong	<47104
30482>>49128		belong	<47104
30483>>>49132	belong	<47104
30484>>>>49136	belong	<47104	QL OS dump data,
30485>>>>>49148	string	>\0	type %.3s,
30486>>>>>49142	string	>\0	version %.4s
30487
30488# Sinclair QL firmware executables (ThMO)
304890	string	NqNqNq`\004	QL firmware executable (BCPL)
30490
30491# Sinclair QL libraries (was ThMO)
304920	beshort	0xFB01		QDOS object
30493>2	pstring	x		'%s'
30494
30495# Sinclair QL executables (was ThMO)
304964	belong	0x4AFB		QDOS executable
30497>9	pstring	x		'%s'
30498
30499# Sinclair QL ROM (ThMO)
305000	belong	=0x4AFB0001	QL plugin-ROM data,
30501>9	pstring	=\0		un-named
30502>9	pstring	>\0		named: %s
30503# Type: SiSU Markup Language
30504# URL:  http://www.sisudoc.org/
30505# From: Ralph Amissah <ralph.amissah@gmail.com>
30506
305070	regex	\^%?[\ \t]*SiSU[\ \t]+insert	SiSU text insert
30508>5	regex	[0-9.]+				%s
30509
305100	regex	\^%[\ \t]+SiSU[\ \t]+master	SiSU text master
30511>5	regex	[0-9.]+				%s
30512
305130	regex	\^%?[\ \t]*SiSU[\ \t]+text	SiSU text
30514>5	regex	[0-9.]+				%s
30515
305160	regex	\^%?[\ \t]*SiSU[\ \t][0-9.]+	SiSU text
30517>5	regex	[0-9.]+				%s
30518
305190	regex	\^%*[\ \t]*sisu-[0-9.]+		SiSU text
30520>5	regex	[0-9.]+				%s
30521
30522#------------------------------------------------------------------------------
30523# $File: sketch,v 1.5 2017/03/17 21:35:28 christos Exp $
30524# Sketch Drawings: http://sketch.sourceforge.net/
30525# From: Edwin Mons <e@ik.nu>
305260	search/1	##Sketch	Sketch document text
30527
30528#-----------------------------------------------
30529# $File: smalltalk,v 1.5 2009/09/19 16:28:12 christos Exp $
30530# GNU Smalltalk image, starting at version 1.6.2
30531# From: catull_us@yahoo.com
30532#
305330	string	GSTIm\0\0	GNU SmallTalk
30534# little-endian
30535>7	byte&1	=0		LE image version
30536>>10	byte	x		%d.
30537>>9	byte	x		\b%d.
30538>>8	byte	x		\b%d
30539#>>12	lelong	x		, data: %ld
30540#>>16	lelong	x		, table: %ld
30541#>>20	lelong	x		, memory: %ld
30542# big-endian
30543>7	byte&1	=1		BE image version
30544>>8	byte	x		%d.
30545>>9	byte	x		\b%d.
30546>>10	byte	x		\b%d
30547#>>12	belong	x		, data: %ld
30548#>>16	belong	x		, table: %ld
30549#>>20	belong	x		, memory: %ld
30550
30551
30552
30553#------------------------------------------------------------------------------
30554# $File: smile,v 1.1 2011/08/17 17:37:18 christos Exp $
30555# smile:  file(1) magic for Smile serialization
30556#
30557# The Smile serialization format uses a 4-byte header:
30558#
30559#   Constant byte #0: 0x3A (ASCII ':')
30560#   Constant byte #1: 0x29 (ASCII ')')
30561#   Constant byte #2: 0x0A (ASCII linefeed, '\n')
30562#   Variable byte #3, consisting of bits:
30563#     Bits 4-7 (4 MSB): 4-bit version number
30564#     Bits 3: Reserved
30565#     Bit 2 (mask 0x04): Whether raw binary (unescaped 8-bit) values may be present in content
30566#     Bit 1 (mask 0x02): Whether shared String value checking was enabled during encoding, default false
30567#     Bit 0 (mask 0x01): Whether shared property name checking was enabled during encoding, default true
30568#
30569# Reference: http://wiki.fasterxml.com/SmileFormatSpec
30570# Created by: Pierre-Alexandre Meyer <pierre@mouraf.org>
30571
30572# Detection
305730	string		:)\n	Smile binary data
30574
30575# Versioning
30576>3	byte&0xF0	x		version %d:
30577
30578# Properties
30579>3	byte&0x04	0x04		binary raw,
30580>3	byte&0x04	0x00		binary encoded,
30581>3	byte&0x02	0x02		shared String values enabled,
30582>3	byte&0x02	0x00		shared String values disabled,
30583>3	byte&0x01	0x01		shared field names enabled
30584>3	byte&0x01	0x00		shared field names disabled
30585
30586
30587#------------------------------------------------------------------------------
30588# $File: sniffer,v 1.29 2021/03/13 18:51:51 christos Exp $
30589# sniffer:  file(1) magic for packet capture files
30590#
30591# From: guy@alum.mit.edu (Guy Harris)
30592#
30593
30594#
30595# Microsoft Network Monitor 1.x capture files.
30596#
305970	string		RTSS		NetMon capture file
30598>5	byte		x		- version %d
30599>4	byte		x		\b.%d
30600>6	leshort		0		(Unknown)
30601>6	leshort		1		(Ethernet)
30602>6	leshort		2		(Token Ring)
30603>6	leshort		3		(FDDI)
30604>6	leshort		4		(ATM)
30605>6	leshort		>4		(type %d)
30606
30607#
30608# Microsoft Network Monitor 2.x capture files.
30609#
306100	string		GMBU		NetMon capture file
30611>5	byte		x		- version %d
30612>4	byte		x		\b.%d
30613>6	leshort		0		(Unknown)
30614>6	leshort		1		(Ethernet)
30615>6	leshort		2		(Token Ring)
30616>6	leshort		3		(FDDI)
30617>6	leshort		4		(ATM)
30618>6	leshort		5		(IP-over-IEEE 1394)
30619>6	leshort		6		(802.11)
30620>6	leshort		7		(Raw IP)
30621>6	leshort		8		(Raw IP)
30622>6	leshort		9		(Raw IP)
30623>6	leshort		>9		(type %d)
30624
30625#
30626# Network General Sniffer capture files.
30627# Sorry, make that "Network Associates Sniffer capture files."
30628# Sorry, make that "Network General old DOS Sniffer capture files."
30629#
306300	string		TRSNIFF\040data\040\040\040\040\032	Sniffer capture file
30631>33	byte		2		(compressed)
30632>23	leshort		x		- version %d
30633>25	leshort		x		\b.%d
30634>32	byte		0		(Token Ring)
30635>32	byte		1		(Ethernet)
30636>32	byte		2		(ARCNET)
30637>32	byte		3		(StarLAN)
30638>32	byte		4		(PC Network broadband)
30639>32	byte		5		(LocalTalk)
30640>32	byte		6		(Znet)
30641>32	byte		7		(Internetwork Analyzer)
30642>32	byte		9		(FDDI)
30643>32	byte		10		(ATM)
30644
30645#
30646# Cinco Networks NetXRay capture files.
30647# Sorry, make that "Network General Sniffer Basic capture files."
30648# Sorry, make that "Network Associates Sniffer Basic capture files."
30649# Sorry, make that "Network Associates Sniffer Basic, and Windows
30650# Sniffer Pro", capture files."
30651# Sorry, make that "Network General Sniffer capture files."
30652# Sorry, make that "NetScout Sniffer capture files."
30653#
306540	string		XCP\0		NetXRay capture file
30655>4	string		>\0		- version %s
30656>44	leshort		0		(Ethernet)
30657>44	leshort		1		(Token Ring)
30658>44	leshort		2		(FDDI)
30659>44	leshort		3		(WAN)
30660>44	leshort		8		(ATM)
30661>44	leshort		9		(802.11)
30662
30663#
30664# "libpcap" capture files.
30665# https://www.tcpdump.org/manpages/pcap-savefile.5.html
30666# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
30667# the main program that uses that format, but there are other programs
30668# that use "libpcap", or that use the same capture file format.)
30669#
306700	name		pcap-be
30671>4	beshort		x		- version %d
30672>6	beshort		x		\b.%d
30673# clear that continuation level match
30674>20	clear		x
30675>20	belong&0x03FFFFFF		0		(No link-layer encapsulation
30676>20	belong&0x03FFFFFF		1		(Ethernet
30677>20	belong&0x03FFFFFF		2		(3Mb Ethernet
30678>20	belong&0x03FFFFFF		3		(AX.25
30679>20	belong&0x03FFFFFF		4		(ProNET
30680>20	belong&0x03FFFFFF		5		(CHAOS
30681>20	belong&0x03FFFFFF		6		(Token Ring
30682>20	belong&0x03FFFFFF		7		(BSD ARCNET
30683>20	belong&0x03FFFFFF		8		(SLIP
30684>20	belong&0x03FFFFFF		9		(PPP
30685>20	belong&0x03FFFFFF		10		(FDDI
30686>20	belong&0x03FFFFFF		11		(RFC 1483 ATM
30687>20	belong&0x03FFFFFF		12		(Raw IP
30688>20	belong&0x03FFFFFF		13		(BSD/OS SLIP
30689>20	belong&0x03FFFFFF		14		(BSD/OS PPP
30690>20	belong&0x03FFFFFF		19		(Linux ATM Classical IP
30691>20	belong&0x03FFFFFF		50		(PPP or Cisco HDLC
30692>20	belong&0x03FFFFFF		51		(PPP-over-Ethernet
30693>20	belong&0x03FFFFFF		99		(Symantec Enterprise Firewall
30694>20	belong&0x03FFFFFF		100		(RFC 1483 ATM
30695>20	belong&0x03FFFFFF		101		(Raw IP
30696>20	belong&0x03FFFFFF		102		(BSD/OS SLIP
30697>20	belong&0x03FFFFFF		103		(BSD/OS PPP
30698>20	belong&0x03FFFFFF		104		(BSD/OS Cisco HDLC
30699>20	belong&0x03FFFFFF		105		(802.11
30700>20	belong&0x03FFFFFF		106		(Linux Classical IP over ATM
30701>20	belong&0x03FFFFFF		107		(Frame Relay
30702>20	belong&0x03FFFFFF		108		(OpenBSD loopback
30703>20	belong&0x03FFFFFF		109		(OpenBSD IPsec encrypted
30704>20	belong&0x03FFFFFF		112		(Cisco HDLC
30705>20	belong&0x03FFFFFF		113		(Linux cooked v1
30706>20	belong&0x03FFFFFF		114		(LocalTalk
30707>20	belong&0x03FFFFFF		117		(OpenBSD PFLOG
30708>20	belong&0x03FFFFFF		119		(802.11 with Prism header
30709>20	belong&0x03FFFFFF		122		(RFC 2625 IP over Fibre Channel
30710>20	belong&0x03FFFFFF		123		(SunATM
30711>20	belong&0x03FFFFFF		127		(802.11 with radiotap header
30712>20	belong&0x03FFFFFF		129		(Linux ARCNET
30713>20	belong&0x03FFFFFF		130		(Juniper Multi-Link PPP
30714>20	belong&0x03FFFFFF		131		(Juniper Multi-Link Frame Relay
30715>20	belong&0x03FFFFFF		132		(Juniper Encryption Services PIC
30716>20	belong&0x03FFFFFF		133		(Juniper GGSN PIC
30717>20	belong&0x03FFFFFF		134		(Juniper FRF.16 Frame Relay
30718>20	belong&0x03FFFFFF		135		(Juniper ATM2 PIC
30719>20	belong&0x03FFFFFF		136		(Juniper Advanced Services PIC
30720>20	belong&0x03FFFFFF		137		(Juniper ATM1 PIC
30721>20	belong&0x03FFFFFF		138		(Apple IP over IEEE 1394
30722>20	belong&0x03FFFFFF		139		(SS7 MTP2 with pseudo-header
30723>20	belong&0x03FFFFFF		140		(SS7 MTP2
30724>20	belong&0x03FFFFFF		141		(SS7 MTP3
30725>20	belong&0x03FFFFFF		142		(SS7 SCCP
30726>20	belong&0x03FFFFFF		143		(DOCSIS
30727>20	belong&0x03FFFFFF		144		(Linux IrDA
30728>20	belong&0x03FFFFFF		147		(Private use 0
30729>20	belong&0x03FFFFFF		148		(Private use 1
30730>20	belong&0x03FFFFFF		149		(Private use 2
30731>20	belong&0x03FFFFFF		150		(Private use 3
30732>20	belong&0x03FFFFFF		151		(Private use 4
30733>20	belong&0x03FFFFFF		152		(Private use 5
30734>20	belong&0x03FFFFFF		153		(Private use 6
30735>20	belong&0x03FFFFFF		154		(Private use 7
30736>20	belong&0x03FFFFFF		155		(Private use 8
30737>20	belong&0x03FFFFFF		156		(Private use 9
30738>20	belong&0x03FFFFFF		157		(Private use 10
30739>20	belong&0x03FFFFFF		158		(Private use 11
30740>20	belong&0x03FFFFFF		159		(Private use 12
30741>20	belong&0x03FFFFFF		160		(Private use 13
30742>20	belong&0x03FFFFFF		161		(Private use 14
30743>20	belong&0x03FFFFFF		162		(Private use 15
30744>20	belong&0x03FFFFFF		163		(802.11 with AVS header
30745>20	belong&0x03FFFFFF		164		(Juniper Passive Monitor PIC
30746>20	belong&0x03FFFFFF		165		(BACnet MS/TP
30747>20	belong&0x03FFFFFF		166		(PPPD
30748>20	belong&0x03FFFFFF		167		(Juniper PPPoE
30749>20	belong&0x03FFFFFF		168		(Juniper PPPoE/ATM
30750>20	belong&0x03FFFFFF		169		(GPRS LLC
30751>20	belong&0x03FFFFFF		170		(GPF-T
30752>20	belong&0x03FFFFFF		171		(GPF-F
30753>20	belong&0x03FFFFFF		174		(Juniper PIC Peer
30754>20	belong&0x03FFFFFF		175		(Ethernet with Endace ERF header
30755>20	belong&0x03FFFFFF		176		(Packet-over-SONET with Endace ERF header
30756>20	belong&0x03FFFFFF		177		(Linux LAPD
30757>20	belong&0x03FFFFFF		178		(Juniper Ethernet
30758>20	belong&0x03FFFFFF		179		(Juniper PPP
30759>20	belong&0x03FFFFFF		180		(Juniper Frame Relay
30760>20	belong&0x03FFFFFF		181		(Juniper C-HDLC
30761>20	belong&0x03FFFFFF		182		(FRF.16 Frame Relay
30762>20	belong&0x03FFFFFF		183		(Juniper Voice PIC
30763>20	belong&0x03FFFFFF		184		(Arinc 429
30764>20	belong&0x03FFFFFF		185		(Arinc 653 Interpartition Communication
30765>20	belong&0x03FFFFFF		186		(USB with FreeBSD header
30766>20	belong&0x03FFFFFF		187		(Bluetooth HCI H4
30767>20	belong&0x03FFFFFF		188		(802.16 MAC Common Part Sublayer
30768>20	belong&0x03FFFFFF		189		(Linux USB
30769>20	belong&0x03FFFFFF		190		(Controller Area Network (CAN) v. 2.0B
30770>20	belong&0x03FFFFFF		191		(802.15.4 with Linux padding
30771>20	belong&0x03FFFFFF		192		(PPI
30772>20	belong&0x03FFFFFF		193		(802.16 MAC Common Part Sublayer plus radiotap header
30773>20	belong&0x03FFFFFF		194		(Juniper Integrated Service Module
30774>20	belong&0x03FFFFFF		195		(802.15.4 with FCS
30775>20	belong&0x03FFFFFF		196		(SITA
30776>20	belong&0x03FFFFFF		197		(Endace ERF
30777>20	belong&0x03FFFFFF		198		(Ethernet with u10 Networks pseudo-header
30778>20	belong&0x03FFFFFF		199		(IPMB
30779>20	belong&0x03FFFFFF		200		(Juniper Secure Tunnel
30780>20	belong&0x03FFFFFF		201		(Bluetooth HCI H4 with pseudo-header
30781>20	belong&0x03FFFFFF		202		(AX.25 with KISS header
30782>20	belong&0x03FFFFFF		203		(LAPD
30783>20	belong&0x03FFFFFF		204		(PPP with direction pseudo-header
30784>20	belong&0x03FFFFFF		205		(Cisco HDLC with direction pseudo-header
30785>20	belong&0x03FFFFFF		206		(Frame Relay with direction pseudo-header
30786>20	belong&0x03FFFFFF		209		(Linux IPMB
30787>20	belong&0x03FFFFFF		215		(802.15.4 with non-ASK PHY header
30788>20	belong&0x03FFFFFF		216		(Linux evdev events
30789>20	belong&0x03FFFFFF		219		(MPLS with label as link-layer header
30790>20	belong&0x03FFFFFF		220		(Memory-mapped Linux USB
30791>20	belong&0x03FFFFFF		221		(DECT
30792>20	belong&0x03FFFFFF		222		(AOS Space Data Link protocol
30793>20	belong&0x03FFFFFF		223		(Wireless HART
30794>20	belong&0x03FFFFFF		224		(Fibre Channel FC-2
30795>20	belong&0x03FFFFFF		225		(Fibre Channel FC-2 with frame delimiters
30796>20	belong&0x03FFFFFF		226		(Solaris IPNET
30797>20	belong&0x03FFFFFF		227		(SocketCAN
30798>20	belong&0x03FFFFFF		228		(Raw IPv4
30799>20	belong&0x03FFFFFF		229		(Raw IPv6
30800>20	belong&0x03FFFFFF		230		(802.15.4 without FCS
30801>20	belong&0x03FFFFFF		231		(D-Bus messages
30802>20	belong&0x03FFFFFF		232		(Juniper Virtual Server
30803>20	belong&0x03FFFFFF		233		(Juniper SRX E2E
30804>20	belong&0x03FFFFFF		234		(Juniper Fibre Channel
30805>20	belong&0x03FFFFFF		235		(DVB-CI
30806>20	belong&0x03FFFFFF		236		(MUX27010
30807>20	belong&0x03FFFFFF		237		(STANAG 5066 D_PDUs
30808>20	belong&0x03FFFFFF		238		(Juniper ATM CEMIC
30809>20	belong&0x03FFFFFF		239		(Linux netfilter log messages
30810>20	belong&0x03FFFFFF		240		(Hilscher netAnalyzer
30811>20	belong&0x03FFFFFF		241		(Hilscher netAnalyzer with delimiters
30812>20	belong&0x03FFFFFF		242		(IP-over-Infiniband
30813>20	belong&0x03FFFFFF		243		(MPEG-2 Transport Stream packets
30814>20	belong&0x03FFFFFF		244		(ng4t ng40
30815>20	belong&0x03FFFFFF		245		(NFC LLCP
30816>20	belong&0x03FFFFFF		246		(Packet filter state syncing
30817>20	belong&0x03FFFFFF		247		(InfiniBand
30818>20	belong&0x03FFFFFF		248		(SCTP
30819>20	belong&0x03FFFFFF		249		(USB with USBPcap header
30820>20	belong&0x03FFFFFF		250		(Schweitzer Engineering Laboratories RTAC packets
30821>20	belong&0x03FFFFFF		251		(Bluetooth Low Energy air interface
30822>20	belong&0x03FFFFFF		252		(Wireshark Upper PDU export
30823>20	belong&0x03FFFFFF		253		(Linux netlink
30824>20	belong&0x03FFFFFF		254		(Bluetooth Linux Monitor
30825>20	belong&0x03FFFFFF		255		(Bluetooth Basic Rate/Enhanced Data Rate baseband packets
30826>20	belong&0x03FFFFFF		256		(Bluetooth Low Energy air interface with pseudo-header
30827>20	belong&0x03FFFFFF		257		(PROFIBUS data link layer
30828>20	belong&0x03FFFFFF		258		(Apple DLT_PKTAP
30829>20	belong&0x03FFFFFF		259		(Ethernet with 802.3 Clause 65 EPON preamble
30830>20	belong&0x03FFFFFF		260		(IPMI trace packets
30831>20	belong&0x03FFFFFF		261		(Z-Wave RF profile R1 and R2 packets
30832>20	belong&0x03FFFFFF		262		(Z-Wave RF profile R3 packets
30833>20	belong&0x03FFFFFF		263		(WattStopper Digital Lighting Mngmt/Legrand Nitoo Open Proto
30834>20	belong&0x03FFFFFF		264		(ISO 14443 messages
30835>20	belong&0x03FFFFFF		265		(IEC 62106 Radio Data System groups
30836>20	belong&0x03FFFFFF		266		(USB with Darwin header
30837>20	belong&0x03FFFFFF		267		(OpenBSD DLT_OPENFLOW
30838>20	belong&0x03FFFFFF		268		(IBM SDLC frames
30839>20	belong&0x03FFFFFF		269		(TI LLN sniffer frames
30840>20	belong&0x03FFFFFF		271		(Linux vsock
30841>20	belong&0x03FFFFFF		272		(Nordic Semiconductor Bluetooth LE sniffer frames
30842>20	belong&0x03FFFFFF		273		(Excentis XRA-31 DOCSIS 3.1 RF sniffer frames
30843>20	belong&0x03FFFFFF		274		(802.3br mPackets
30844>20	belong&0x03FFFFFF		275		(DisplayPort AUX channel monitoring data
30845>20	belong&0x03FFFFFF		276		(Linux cooked v2
30846>20	belong&0x03FFFFFF		278		(OpenVizsla USB
30847>20	belong&0x03FFFFFF		279		(Elektrobit High Speed Capture and Replay (EBHSCR)
30848>20	belong&0x03FFFFFF		281		(Broadcom tag
30849>20	belong&0x03FFFFFF		282		(Broadcom tag (prepended)
30850>20	belong&0x03FFFFFF		284		(Marvell DSA
30851>20	belong&0x03FFFFFF		285		(Marvell EDSA
30852>20	belong&0x03FFFFFF		286		(ELEE lawful intercept
30853>20	belong&0x03FFFFFF		287		(Z-Wave serial
30854>20	belong&0x03FFFFFF		288		(USB 2.0
30855>20	belong&0x03FFFFFF		289		(ATSC ALP
30856>20	belong&0x03FFFFFF		290		(Event Tracing for Windows
30857# print default match
30858>20	default		x
30859>>20	belong		x		(linktype#%u
30860>16	belong		x		\b, capture length %u)
30861
30862# packets time stamps in seconds and microseconds.
308630	ubelong		0xa1b2c3d4	pcap capture file, microseconds ts (big-endian)
30864!:mime	application/vnd.tcpdump.pcap
30865>0	use	pcap-be
308660	ulelong		0xa1b2c3d4	pcap capture file, microsecond ts (little-endian)
30867!:mime	application/vnd.tcpdump.pcap
30868>0	use	\^pcap-be
30869
30870# packets time stamps in seconds and nanoseconds.
308710	ubelong		0xa1b23c4d	pcap capture file, nanosecond ts (big-endian)
30872!:mime	application/vnd.tcpdump.pcap
30873>0	use	pcap-be
308740	ulelong		0xa1b23c4d	pcap capture file, nanosecond ts (little-endian)
30875!:mime	application/vnd.tcpdump.pcap
30876>0	use	\^pcap-be
30877
30878#
30879# "libpcap"-with-Alexey-Kuznetsov's-patches capture files.
30880#
308810	ubelong		0xa1b2cd34	pcap capture file, microsecond ts, extensions (big-endian)
30882>0	use	pcap-be
308830	ulelong		0xa1b2cd34	pcap capture file, microsecond ts, extensions (little-endian)
30884>0	use	\^pcap-be
30885
30886#
30887# "pcapng" capture files.
30888# https://github.com/pcapng/pcapng
30889# Pcapng files can contain multiple sections. Printing the endianness,
30890# snaplen, or other information from the first SHB may be misleading.
30891#
308920	ubelong		0x0a0d0d0a
30893>8	ubelong		0x1a2b3c4d	pcapng capture file
30894>>12	beshort		x		- version %d
30895>>14	beshort		x		\b.%d
308960	ulelong		0x0a0d0d0a
30897>8	ulelong		0x1a2b3c4d	pcapng capture file
30898>>12	leshort		x		- version %d
30899>>14	leshort		x		\b.%d
30900
30901#
30902# AIX "iptrace" capture files.
30903#
309040	string		iptrace\0401.0	AIX iptrace capture file
309050	string		iptrace\0402.0	AIX iptrace capture file
30906
30907#
30908# Novell LANalyzer capture files.
30909#
309100	leshort		0x1001		Novell LANalyzer capture file
309110	leshort		0x1007		Novell LANalyzer capture file
30912
30913#
30914# HP-UX "nettl" capture files.
30915#
309160	string		\x54\x52\x00\x64\x00	HP/UX nettl capture file
30917
30918#
30919# RADCOM WAN/LAN Analyzer capture files.
30920#
309210	string		\x42\xd2\x00\x34\x12\x66\x22\x88	RADCOM WAN/LAN Analyzer capture file
30922
30923#
30924# NetStumbler log files.  Not really packets, per se, but about as
30925# close as you can get.  These are log files from NetStumbler, a
30926# Windows program, that scans for 802.11b networks.
30927#
309280	string		NetS		NetStumbler log file
30929>8	lelong		x		\b, %d stations found
30930
30931#
30932# *Peek tagged capture files.
30933#
309340	string		\177ver		EtherPeek/AiroPeek/OmniPeek capture file
30935
30936#
30937# Visual Networks traffic capture files.
30938#
309390	string		\x05VNF		Visual Networks traffic capture file
30940
30941#
30942# Network Instruments Observer capture files.
30943#
309440	string		ObserverPktBuffe	Network Instruments Observer capture file
30945
30946#
30947# Files from Accellent Group's 5View products.
30948#
309490	string		\xaa\xaa\xaa\xaa	5View capture file
30950
30951#------------------------------------------------------------------------------
30952# $File: softquad,v 1.13 2009/09/19 16:28:12 christos Exp $
30953# softquad:  file(1) magic for SoftQuad Publishing Software
30954#
30955# Author/Editor and RulesBuilder
30956#
30957# XXX - byte order?
30958#
309590	string		\<!SQ\ DTD>	Compiled SGML rules file
30960>9	string		>\0		 Type %s
309610	string		\<!SQ\ A/E>	A/E SGML Document binary
30962>9	string		>\0		 Type %s
309630	string		\<!SQ\ STS>	A/E SGML binary styles file
30964>9	string		>\0		 Type %s
309650	short		0xc0de		Compiled PSI (v1) data
309660	short		0xc0da		Compiled PSI (v2) data
30967>3	string		>\0		(%s)
30968# Binary sqtroff font/desc files...
309690	short		0125252		SoftQuad DESC or font file binary
30970>2	short		>0		- version %d
30971# Bitmaps...
309720	search/1	SQ\ BITMAP1	SoftQuad Raster Format text
30973#0	string		SQ\ BITMAP2	SoftQuad Raster Format data
30974# sqtroff intermediate language (replacement for ditroff int. lang.)
309750	string		X\ 		SoftQuad troff Context intermediate
30976>2	string		495		for AT&T 495 laser printer
30977>2	string		hp		for Hewlett-Packard LaserJet
30978>2	string		impr		for IMAGEN imPRESS
30979>2	string		ps		for PostScript
30980
30981# From: Michael Piefel <piefel@debian.org>
30982# sqtroff intermediate language (replacement for ditroff int. lang.)
309830	string		X\ 495		SoftQuad troff Context intermediate for AT&T 495 laser printer
309840	string		X\ hp		SoftQuad troff Context intermediate for HP LaserJet
309850	string		X\ impr		SoftQuad troff Context intermediate for IMAGEN imPRESS
309860	string		X\ ps		SoftQuad troff Context intermediate for PostScript
30987
30988#------------------------------------------------------------------------------
30989# $File: sosi,v 1.2 2021/02/23 00:51:10 christos Exp $
30990# SOSI
30991# Summary: Systematic Organization of Spatial Information
30992# Long description: Norwegian text based map format
30993# File extension: .sos
30994# Full name:    Petter Reinholdtsen (pere@hungry.com)
30995# Reference: https://en.wikipedia.org/wiki/SOSI
30996#
30997# Example SOSI files available from
30998# https://trac.osgeo.org/gdal/ticket/3638
30999# https://nedlasting.geonorge.no/geonorge/Basisdata/N50Kartdata/SOSI/
31000# https://nedlasting.geonorge.no/geonorge/Samferdsel/Elveg/SOSI/
31001#
31002# Start with optional comments (from "!" to the next line end)
31003# followed by ".HODE" and end with "\n.SLUTT" followed by an optional
31004# separator (any number of " ", "\t", "\n" or "\r"), might have BOM at
31005# the start and following ".HODE" near the start there is "..OMR=C3=85DE"
31006# (either UTF-8, ISO-8859-1 or some 7 bit Norwegian charset based on
31007# ASCII) , "..TRANSPAR", "..TEGNSETT " followed by the charset and a
31008# separator, as well as "..SOSI-VERSJON " followed by the format
31009# version and a separator.
31010#
31011# FIXME figure out how to accept any of [space], [tab], [newline] and
31012# [carriage return] as separators, not only line end.
31013
31014# Not searching for full "OMR=C3=85DE" to match also for non-UTF-8
31015# character sets
310160	search	..OMR
31017>0	search	..TRANSPAR
31018>>0       search  .HODE           SOSI map data
31019>>>&0      search  ..SOSI-VERSJON
31020>>>>&1	string	x		\b, version %s
31021# FIXME could not figure out way to make a match for .SLUTT at the end required
31022#>-7      string  \n.SLUTT	slutt
31023#>-8      string  \n.SLUTT\n	slutt-nl
31024#>-9      string  \n.SLUTT\r\n	slutt-crnl2
31025!:mime text/vnd.sosi
31026!:ext sos
31027
31028#------------------------------------------------------------------------------
31029# $File: spec,v 1.4 2009/09/19 16:28:12 christos Exp $
31030# spec:  file(1) magic for SPEC raw results (*.raw, *.rsf)
31031#
31032# Cloyce D. Spradling <cloyce@headgear.org>
31033
310340	string	spec			SPEC
31035>4	string	.cpu			CPU
31036>>8	string	<:			\b%.4s
31037>>12	string	.			raw result text
31038
3103917	string	version=SPECjbb		SPECjbb
31040>32	string	<:			\b%.4s
31041>>37	string	<:			v%.4s raw result text
31042
310430	string	BEGIN\040SPECWEB	SPECweb
31044>13	string	<:			\b%.2s
31045>>15	string	_SSL			\b_SSL
31046>>>20	string	<:			v%.4s raw result text
31047>>16	string	<:			v%.4s raw result text
31048
31049#------------------------------------------------------------------------------
31050# $File: spectrum,v 1.8 2017/09/11 23:51:12 christos Exp $
31051# spectrum:  file(1) magic for Spectrum emulator files.
31052#
31053# John Elliott <jce@seasip.demon.co.uk>
31054
31055#
31056# Spectrum +3DOS header
31057#
310580       string          PLUS3DOS\032    Spectrum +3 data
31059>15     byte            0               - BASIC program
31060>15     byte            1               - number array
31061>15     byte            2               - character array
31062>15     byte            3               - memory block
31063>>16    belong          0x001B0040      (screen)
31064>15     byte            4               - Tasword document
31065>15     string          TAPEFILE        - ZXT tapefile
31066#
31067# Tape file. This assumes the .TAP starts with a Spectrum-format header,
31068# which nearly all will.
31069#
31070# Update: Sanity-check string contents to be printable.
31071#  -Adam Buchbinder <adam.buchbinder@gmail.com>
31072#
310730       string          \023\000\000
31074>4      string          >\0
31075>>4     string          <\177           Spectrum .TAP data "%-10.10s"
31076>>>3    byte            0               - BASIC program
31077>>>3    byte            1               - number array
31078>>>3    byte            2               - character array
31079>>>3    byte            3               - memory block
31080>>>>14  belong          0x001B0040      (screen)
31081
31082# The following three blocks are from pak21-spectrum@srcf.ucam.org
31083# TZX tape images
310840      string          ZXTape!\x1a     Spectrum .TZX data
31085>8     byte            x               version %d
31086>9     byte            x               \b.%d
31087
31088# RZX input recording files
310890      string          RZX!            Spectrum .RZX data
31090>4     byte            x               version %d
31091>5     byte            x               \b.%d
31092
31093# Floppy disk images
310940      string          MV\ -\ CPCEMU\ Disk-Fil Amstrad/Spectrum .DSK data
310950      string          MV\ -\ CPC\ format\ Dis Amstrad/Spectrum DU54 .DSK data
310960      string          EXTENDED\ CPC\ DSK\ Fil Amstrad/Spectrum Extended .DSK data
310970      string          SINCLAIR        Spectrum .SCL Betadisk image
31098
31099# Hard disk images
311000      string          RS-IDE\x1a      Spectrum .HDF hard disk image
31101>7     byte            x               \b, version 0x%02x
31102
31103# SZX snapshots (fuse and spectaculator)
31104# Martin M. S. Pedersen <martin@linux.com>
31105# http://www.spectaculator.com/docs/zx-state/header.shtml
31106#
311070      string		ZXST	       zx-state snapshot
31108>4     byte		x	       version %d
31109>5     byte		x	       \b.%d
31110>>6    byte		0	       16k ZX Spectrum
31111>>6    byte		1	       48k ZX Spectrum/ZX Spectrum+
31112>>6    byte		2	       ZX Spectrum 128
31113>>6    byte		3	       ZX Spectrum +2
31114>>6    byte		4	       ZX Spectrum +2A/+2B
31115>>6    byte		5	       ZX Spectrum +3
31116>>6    byte		6	       ZX Spectrum +3e
31117>>6    byte		7	       Pentagon 128
31118>>6    byte		8	       Timex Sinclair TC2048
31119>>6    byte		9	       Timex Sinclair TC2068
31120>>6    byte	       10	       Scorpion ZS-256
31121>>6    byte	       11	       ZX Spectrum SE
31122>>6    byte	       12	       Timex Sinclair TS2068
31123>>6    byte	       13	       Pentagon 512
31124>>6    byte	       14	       Pentagon 1024
31125>>6    byte	       15	       48k ZX Spectrum (NTSC)
31126>>6    byte	       16	       ZX Spectrum 12Ke
31127>>>7   byte		1	       (alternate timings)
31128
31129#------------------------------------------------------------------------------
31130# $File: sql,v 1.22 2019/04/19 00:42:27 christos Exp $
31131# sql:  file(1) magic for SQL files
31132#
31133# From: "Marty Leisner" <mleisner@eng.mc.xerox.com>
31134# Recognize some MySQL files.
31135# Elan Ruusamae <glen@delfi.ee>, added MariaDB signatures
31136# from https://bazaar.launchpad.net/~maria-captains/maria/5.5/view/head:/support-files/magic
31137#
311380	beshort			0xfe01		MySQL table definition file
31139>2	byte			x		Version %d
31140>3	byte			0		\b, type UNKNOWN
31141>3	byte			1		\b, type DIAM_ISAM
31142>3	byte			2		\b, type HASH
31143>3	byte			3		\b, type MISAM
31144>3	byte			4		\b, type PISAM
31145>3	byte			5		\b, type RMS_ISAM
31146>3	byte			6		\b, type HEAP
31147>3	byte			7		\b, type ISAM
31148>3	byte			8		\b, type MRG_ISAM
31149>3	byte			9		\b, type MYISAM
31150>3	byte			10		\b, type MRG_MYISAM
31151>3	byte			11		\b, type BERKELEY_DB
31152>3	byte			12		\b, type INNODB
31153>3	byte			13		\b, type GEMINI
31154>3	byte			14		\b, type NDBCLUSTER
31155>3	byte			15		\b, type EXAMPLE_DB
31156>3	byte			16		\b, type CSV_DB
31157>3	byte			17		\b, type FEDERATED_DB
31158>3	byte			18		\b, type BLACKHOLE_DB
31159>3	byte			19		\b, type PARTITION_DB
31160>3	byte			20		\b, type BINLOG
31161>3	byte			21		\b, type SOLID
31162>3	byte			22		\b, type PBXT
31163>3	byte			23		\b, type TABLE_FUNCTION
31164>3	byte			24		\b, type MEMCACHE
31165>3	byte			25		\b, type FALCON
31166>3	byte			26		\b, type MARIA
31167>3	byte			27		\b, type PERFORMANCE_SCHEMA
31168>3	byte			127		\b, type DEFAULT
31169>0x0033	ulong			x		\b, MySQL version %d
311700	belong&0xffffff00	0xfefe0500	MySQL ISAM index file
31171>3	byte			x		Version %d
311720	belong&0xffffff00	0xfefe0600	MySQL ISAM compressed data file
31173>3	byte			x		Version %d
311740	belong&0xffffff00	0xfefe0700	MySQL MyISAM index file
31175>3	byte			x		Version %d
31176>14	beshort			x		\b, %d key parts
31177>16	beshort			x		\b, %d unique key parts
31178>18	byte			x		\b, %d keys
31179>28	bequad			x		\b, %lld records
31180>36	bequad			x		\b, %lld deleted records
311810	belong&0xffffff00	0xfefe0800	MySQL MyISAM compressed data file
31182>3	byte			x		Version %d
311830	belong&0xffffff00	0xfefe0900	MySQL Maria index file
31184>3	byte			x		Version %d
311850	belong&0xffffff00	0xfefe0a00	MySQL Maria compressed data file
31186>3	byte			x		Version %d
311870	belong&0xffffff00	0xfefe0c00
31188>4	string			MACF		MySQL Maria control file
31189>>3	byte			x		Version %d
311900	string			\376bin	MySQL replication log,
31191>9	long			x		server id %d
31192>8	byte			1
31193>>13	long			69		\b, MySQL V3.2.3
31194>>>19	string			x		\b, server version %s
31195>>13	long			75		\b, MySQL V4.0.2-V4.1
31196>>>25	string			x		\b, server version %s
31197>8	byte			15		MySQL V5+,
31198>>25	string			x		server version %s
31199>4	string			MARIALOG	MySQL Maria transaction log file
31200>>3	byte			x		Version %d
31201
31202#------------------------------------------------------------------------------
31203# iRiver H Series database file
31204# From Ken Guest <ken@linux.ie>
31205# As observed from iRivNavi.iDB and unencoded firmware
31206#
312070   string		iRivDB	iRiver Database file
31208>11  string	>\0	Version %s
31209>39  string		iHP-100	[H Series]
31210
31211#------------------------------------------------------------------------------
31212# SQLite database files
31213# Ken Guest <ken@linux.ie>, Ty Sarna, Zack Weinberg
31214#
31215# Version 1 used GDBM internally; its files cannot be distinguished
31216# from other GDBM files.
31217#
31218# Version 2 used this format:
312190	string	**\ This\ file\ contains\ an\ SQLite  SQLite 2.x database
31220
31221# Version 3 of SQLite allows applications to embed their own "user version"
31222# number in the database at offset 60.  Later, SQLite added an "application id"
31223# at offset 68 that is preferred over "user version" for indicating the
31224# associated application.
31225#
312260   string  SQLite\ format\ 3	SQLite 3.x database
31227!:mime	application/x-sqlite3
31228# seldom found extension sqlite3 like in SyncData.sqlite3
31229# db
31230# Avira Antivir use extension "dbe" like in avevtdb.dbe, avguard_tchk.dbe
31231# Unfortunately extension sqlite also used for other databases starting with string
31232# "TTCONTAINER" like in tracks.sqlite contentconsumer.sqlite contentproducerrepository.sqlite
31233# and with string "ZV-zlib" in like extra.sqlite
31234!:ext sqlite/sqlite3/db/dbe
31235>60 belong  =0x5f4d544e  (Monotone source repository)
31236>68 belong  =0x0f055112  (Fossil checkout)
31237>68 belong  =0x0f055113  (Fossil global configuration)
31238>68 belong  =0x0f055111  (Fossil repository)
31239>68 belong  =0x42654462  (Bentley Systems BeSQLite Database)
31240>68 belong  =0x42654c6e  (Bentley Systems Localization File)
31241>68 belong  =0x47504b47  (OGC GeoPackage file)
31242>68 default x
31243>>68 belong  !0          \b, application id %u
31244>>60 belong  !0          \b, user version %d
31245>96 belong  x            \b, last written using SQLite version %d
31246
31247
31248# SQLite Write-Ahead Log from SQLite version >= 3.7.0
31249# https://www.sqlite.org/fileformat.html#walformat
312500	belong&0xfffffffe	0x377f0682	SQLite Write-Ahead Log,
31251!:ext sqlite-wal/db-wal
31252>4	belong	x	version %d
31253
31254# SQLite Rollback Journal
31255# https://www.sqlite.org/fileformat.html#rollbackjournal
312560	string	\xd9\xd5\x05\xf9\x20\xa1\x63\xd7	SQLite Rollback Journal
31257
31258# Panasonic channel list database svl.bin or svl.db added by Joerg Jenderek
31259# https://github.com/PredatH0r/ChanSort
312600	string		PSDB\0			Panasonic channel list DataBase
31261!:ext db/bin
31262#!:mime	application/x-db-svl-panasonic
31263>126	string		SQLite\ format\ 3
31264#!:mime	application/x-panasonic-sqlite3
31265>>&-15	indirect	x			\b; contains
31266
31267# H2 Database from https://www.h2database.com/
312680	string		--\ H2\ 0.5/B\ --\ \n	H2 Database file
31269# Type:	OpenSSH key files
31270# From:	Nicolas Collignon <tsointsoin@gmail.com>
31271
312720	string	SSH\ PRIVATE\ KEY	OpenSSH RSA1 private key,
31273>28	string	>\0			version %s
312740	string	-----BEGIN\ OPENSSH\ PRIVATE\ KEY-----	OpenSSH private key
31275
312760	string	ssh-dss\ 		OpenSSH DSA public key
312770	string	ssh-rsa\ 		OpenSSH RSA public key
312780	string	ecdsa-sha2-nistp256	OpenSSH ECDSA public key
312790	string	ecdsa-sha2-nistp384	OpenSSH ECDSA public key
312800	string	ecdsa-sha2-nistp521	OpenSSH ECDSA public key
312810	string	ssh-ed25519		OpenSSH ED25519 public key
31282
312830	string	SSHKRL\n\0
31284>8	ubelong	1		OpenSSH key/certificate revocation list, format %u
31285>>12	ubequad	x		\b, version %llx
31286>>>20	beqdate	x		\b, generated %s
31287
31288# From:		Joerg Jenderek
31289# URL:		https://en.wikipedia.org/wiki/PuTTY
31290# Reference:	https://the.earth.li/~sgtatham/putty/latest/putty-0.73.tar.gz
31291#		/sshpubk.c
312920	string		PuTTY-User-Key-File-	PuTTY Private Key File
31293#!:mime	text/plain
31294# https://github.com/github/putty/blob/master/windows/installer.wxs
31295!:mime	application/x-putty-private-key
31296!:ext	ppk
31297# version 1 or 2
31298>20	string		x			\b, version %.1s
31299# name of the algorithm like: ssh-dss ssh-rsa ecdsa-sha2-nistp256 ssh-ed25519
31300>23	string		x			\b, algorithm %s
31301# next line says "Encryption: " plus an encryption type like aes256-cbc or none
31302>32	search/13	Encryption:\040		\b, Encryption
31303>>&0	string		x			%s
31304# next line says "Comment: " plus the comment string
31305>>>&0	search/3	Comment:\040
31306>>>>&0	string		x			"%s"
31307
31308
31309#------------------------------------------------------------------------------
31310# $File: ssl,v 1.5 2017/12/29 04:00:07 christos Exp $
31311# ssl:  file(1) magic for SSL file formats
31312
31313# Type: OpenSSL certificates/key files
31314# From: Nicolas Collignon <tsointsoin@gmail.com>
31315
313160	string	-----BEGIN\040CERTIFICATE-----	PEM certificate
313170	string	-----BEGIN\040CERTIFICATE\040REQ	PEM certificate request
313180	string	-----BEGIN\040RSA\040PRIVATE	PEM RSA private key
313190	string	-----BEGIN\040DSA\040PRIVATE	PEM DSA private key
313200	string	-----BEGIN\040EC\040PRIVATE	PEM EC private key
313210	string	-----BEGIN\040ECDSA\040PRIVATE	PEM ECDSA private key
31322
31323# From Luc Gommans
31324# OpenSSL enc file (recognized by a magic string preceding the password's salt)
313250	string	Salted__	openssl enc'd data with salted password
31326# Using the -a or -base64 option, OpenSSL will base64-encode the data.
313270	string U2FsdGVkX1	openssl enc'd data with salted password, base64 encoded
31328
31329#------------------------------------------------------------------------------
31330# $File: statistics,v 1.2 2020/10/08 17:51:53 christos Exp $
31331# statistics:  file(1) magic for statistics related software
31332#
31333
31334# From Remy Rampin
31335
31336# Stata is a statistical software tool that was created in 1985. While I
31337# don't personally use it, data files in its native (proprietary) format
31338# are common (.dta files).
31339#
31340# Because they are so common, especially in statistical and social
31341# sciences, Stata files and SPSS files can be opened by a lot of modern
31342# software, for example Python's pandas package provides built-in
31343# support for them (read_stata() and read_spss()).
31344#
31345# I noticed that the magic database includes an entry for SPSS files but
31346# not Stata files. Stata files for Stata 13 and newer (formats 117, 118,
31347# and 119) always begin with the string "<stata_dta><header>" as per
31348# https://www.stata.com/help.cgi?dta#definition
31349#
31350# The format version number always follows, for example:
31351#    <stata_dta><header><release>117</release>
31352#    <stata_dta><header><release>118</release>
31353#
31354# Therefore the following line would do the trick:
31355#    0       string  <stata_dta><header>     Stata Data File
31356#
31357# (I'm sure the version number could be captured as well but I did not
31358# manage this without a regex)
31359#
31360# Unfortunately the previous formats (created by Stata before 13, which
31361# was released 2013) are harder to recognize. Format 115 starts with the
31362# four bytes 0x73010100 or 0x73020100, format 114 with 0x72010100 or
31363# 0x72020100, format 113 with 0x71010101 or 0x71020101.
31364#
31365# For additional reference, the Library of Congress website has an entry
31366# for the Stata Data File Format 118:
31367# https://www.loc.gov/preservation/digital/formats/fdd/fdd000471.shtml
31368#
31369# Example of those files can be found on Zenodo:
31370# https://zenodo.org/search?page=1&size=20&q=&file_type=dta
313710	string	\<stata_dta\>\<header\>\<release\>	Stata Data File
31372>&0	regex	[0-9]*					(Release %s)
31373
31374#------------------------------------------------------------------------------
31375# $File: sun,v 1.28 2019/04/19 00:42:27 christos Exp $
31376# sun:  file(1) magic for Sun machines
31377#
31378# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x
31379# releases.  (5.x uses ELF.)  Entries for executables without an
31380# architecture type, used before the 68020-based Sun-3's came out,
31381# are in aout, as they're indistinguishable from other big-endian
31382# 32-bit a.out files.
31383#
313840	belong&077777777	0600413		a.out SunOS SPARC demand paged
31385>0	byte		&0x80
31386>>20	belong		<4096		shared library
31387>>20	belong		=4096		dynamically linked executable
31388>>20	belong		>4096		dynamically linked executable
31389>0	byte		^0x80		executable
31390>16	belong		>0		not stripped
31391
313920	belong&077777777	0600410		a.out SunOS SPARC pure
31393>0	byte		&0x80		dynamically linked executable
31394>0	byte		^0x80		executable
31395>16	belong		>0		not stripped
31396
313970	belong&077777777	0600407		a.out SunOS SPARC
31398>0	byte		&0x80		dynamically linked executable
31399>0	byte		^0x80		executable
31400>16	belong		>0		not stripped
31401
314020	belong&077777777	0400413		a.out SunOS mc68020 demand paged
31403>0	byte		&0x80
31404>>20	belong		<4096		shared library
31405>>20	belong		=4096		dynamically linked executable
31406>>20	belong		>4096		dynamically linked executable
31407>0	byte		^0x80		executable
31408>16	belong		>0		not stripped
31409
314100	belong&077777777	0400410		a.out SunOS mc68020 pure
31411>0	byte		&0x80		dynamically linked executable
31412>0	byte		^0x80		executable
31413>16	belong		>0		not stripped
31414
314150	belong&077777777	0400407		a.out SunOS mc68020
31416>0	byte		&0x80		dynamically linked executable
31417>0	byte		^0x80		executable
31418>16	belong		>0		not stripped
31419
314200	belong&077777777	0200413		a.out SunOS mc68010 demand paged
31421>0	byte		&0x80
31422>>20	belong		<4096		shared library
31423>>20	belong		=4096		dynamically linked executable
31424>>20	belong		>4096		dynamically linked executable
31425>0	byte		^0x80		executable
31426>16	belong		>0		not stripped
31427
314280	belong&077777777	0200410		a.out SunOS mc68010 pure
31429>0	byte		&0x80		dynamically linked executable
31430>0	byte		^0x80		executable
31431>16	belong		>0		not stripped
31432
314330	belong&077777777	0200407		a.out SunOS mc68010
31434>0	byte		&0x80		dynamically linked executable
31435>0	byte		^0x80		executable
31436>16	belong		>0		not stripped
31437
31438#
31439# Core files.  "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC
31440# binary executed in compatibility mode under SunOS 5.x".
31441#
314420	belong		0x080456	SunOS core file
31443>4	belong		432		(SPARC)
31444>>132	string		>\0		from '%s'
31445>>116	belong		=3		(quit)
31446>>116	belong		=4		(illegal instruction)
31447>>116	belong		=5		(trace trap)
31448>>116	belong		=6		(abort)
31449>>116	belong		=7		(emulator trap)
31450>>116	belong		=8		(arithmetic exception)
31451>>116	belong		=9		(kill)
31452>>116	belong		=10		(bus error)
31453>>116	belong		=11		(segmentation violation)
31454>>116	belong		=12		(bad argument to system call)
31455>>116	belong		=29		(resource lost)
31456>>120	belong		x		(T=%dK,
31457>>124	belong		x		D=%dK,
31458>>128	belong		x		S=%dK)
31459>4	belong		826		(68K)
31460>>128	string		>\0		from '%s'
31461>4	belong		456		(SPARC 4.x BCP)
31462>>152	string		>\0		from '%s'
31463# Sun SunPC
314640	long		0xfa33c08e	SunPC 4.0 Hard Disk
314650	string		#SUNPC_CONFIG	SunPC 4.0 Properties Values
31466# Sun snoop (see RFC 1761, which describes the capture file format,
31467# RFC 3827, which describes some additional datalink types, and
31468# https://www.iana.org/assignments/snoop-datalink-types/snoop-datalink-types.xml,
31469# which is the IANA registry of Snoop datalink types)
31470#
314710	string		snoop		Snoop capture file
31472>8	belong		>0		- version %d
31473>12	belong		0		(IEEE 802.3)
31474>12	belong		1		(IEEE 802.4)
31475>12	belong		2		(IEEE 802.5)
31476>12	belong		3		(IEEE 802.6)
31477>12	belong		4		(Ethernet)
31478>12	belong		5		(HDLC)
31479>12	belong		6		(Character synchronous)
31480>12	belong		7		(IBM channel-to-channel adapter)
31481>12	belong		8		(FDDI)
31482>12	belong		9		(Other)
31483>12	belong		10		(type %d)
31484>12	belong		11		(type %d)
31485>12	belong		12		(type %d)
31486>12	belong		13		(type %d)
31487>12	belong		14		(type %d)
31488>12	belong		15		(type %d)
31489>12	belong		16		(Fibre Channel)
31490>12	belong		17		(ATM)
31491>12	belong		18		(ATM Classical IP)
31492>12	belong		19		(type %d)
31493>12	belong		20		(type %d)
31494>12	belong		21		(type %d)
31495>12	belong		22		(type %d)
31496>12	belong		23		(type %d)
31497>12	belong		24		(type %d)
31498>12	belong		25		(type %d)
31499>12	belong		26		(IP over Infiniband)
31500>12	belong		>26		(type %d)
31501
31502#---------------------------------------------------------------------------
31503# The following entries have been tested by Duncan Laurie <duncan@sun.com> (a
31504# lead Sun/Cobalt developer) who agrees that they are good and worthy of
31505# inclusion.
31506
31507# Boot ROM images for Sun/Cobalt Linux server appliances
315080       string  Cobalt\ Networks\ Inc.\nFirmware\ v     Paged COBALT boot rom
31509>38     string x        V%.4s
31510
31511# New format for Sun/Cobalt boot ROMs is annoying, it stores the version code
31512# at the very end where file(1) can't get it.
315130       string CRfs     COBALT boot rom data (Flat boot rom or file system)
31514
31515#------------------------------------------------------------------------------
31516# $File: sylk,v 1.1 2020/04/05 22:18:34 christos Exp $
31517# sylk:  file(1) magic for SYLK text files
31518
31519# From:	Joerg Jenderek
31520# URL:	https://en.wikipedia.org/wiki/SYmbolic_LinK_%28SYLK%29
31521#	http://fileformats.archiveteam.org/wiki/SYLK
31522# Note:	called by TrID "SYLK - SYmbolic LinK data",
31523#	by DROID "Microsoft Symbolic Link (SYLK) File"
31524#	by FreeDesktop.org "spreadsheet interchange document"
315250	string		ID;P
31526# skip short DROID x-fmt-106-signature-id-603.slk
31527>7	ubyte		>0		spreadsheet interchange document
31528# https://reposcope.com/mimetype/text/spreadsheet
31529#!:mime	text/spreadsheet
31530# https://reposcope.com/mimetype/application/x-sylk	by Gnumeric
31531!:mime	application/x-sylk
31532!:ext	slk/sylk
31533>>4	ubyte		>037		\b, created by
31534# Gnumeric, pmw~PlanMaker, CALCOOO32~LibreOffice OpenOffice, SCALC3~StarOffice
31535# MP~Multiplan, XL~Excel WXL~Excel Windows
31536>>>4	string		Gnumeric	Gnumeric
31537>>>4	string		pmw		PlanMaker
31538>>>4	string		CALCOOO32	Libre/OpenOffice Calc
31539>>>4	string		SCALC3		StarOffice Calc
31540>>>4	string		XL		Excel
31541# Excel, version probably running on Windows
31542>>>4	string		WXL		Excel
31543# not tested
31544>>>4	string		MP		Multiplan
31545# unknown spreadsheet software
31546>>>4	default		x
31547>>>>4	string		x		%s
31548
31549
31550
31551#------------------------------------------------------------------------------
31552# msx:  file(1) magic for the SymbOS operating system
31553# http://www.symbos.de
31554# Fabio R. Schmidlin <frs@pop.com.br>
31555
31556# SymbOS EXE file
315570x30	string		SymExe		SymbOS executable
31558>0x36	ubyte		x		v%c
31559>0x37	ubyte		x		\b.%c
31560>0xF	string		x		\b, name: %s
31561
31562# SymbOS DOX document
315630	string		INFOq\0		SymbOS DOX document
31564
31565# Symbos driver
315660	string		SMD1		SymbOS driver
31567>19	byte		x		\b, name: %c
31568>20	byte		x		\b%c
31569>21	byte		x		\b%c
31570>22	byte		x		\b%c
31571>23	byte		x		\b%c
31572>24	byte		x		\b%c
31573>25	byte		x		\b%c
31574>26	byte		x		\b%c
31575>27	byte		x		\b%c
31576>28	byte		x		\b%c
31577>29	byte		x		\b%c
31578>30	byte		x		\b%c
31579>31	byte		x		\b%c
31580
31581# Symbos video
315820	string		SymVid		SymbOS video
31583>6	ubyte		x		v%c
31584>7	ubyte		x		\b.%c
31585
31586# Soundtrakker 128 ST2 music
315870	byte		0
31588>0xC	string		\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x40\x00	Soundtrakker 128 ST2 music,
31589>>1	string		x		name: %s
31590
31591
31592
31593#------------------------------------------------------------------------
31594# $File: sysex,v 1.10 2019/04/19 00:42:27 christos Exp $
31595# sysex: file(1) magic for MIDI sysex files
31596#
31597# GRR: original 1 byte test at offset was too general as it catches also many FATs of DOS filesystems
31598# where real SYStem EXclusive messages at offset 1 are limited to seven bits
31599# https://en.wikipedia.org/wiki/MIDI
316000	ubeshort&0xFF80		0xF000		SysEx File -
31601
31602# North American Group
31603>1	byte			0x01		Sequential
31604>1	byte			0x02		IDP
31605>1	byte			0x03		OctavePlateau
31606>1	byte			0x04		Moog
31607>1	byte			0x05		Passport
31608>1	byte			0x06		Lexicon
31609>1	byte			0x07		Kurzweil/Future Retro
31610>>3	byte			0x77		777
31611>>4	byte			0x00		Bank
31612>>4	byte			0x01		Song
31613>>5	byte			0x0f		16
31614>>5	byte			0x0e		15
31615>>5	byte			0x0d		14
31616>>5	byte			0x0c		13
31617>>5	byte			0x0b		12
31618>>5	byte			0x0a		11
31619>>5	byte			0x09		10
31620>>5	byte			0x08		9
31621>>5	byte			0x07		8
31622>>5	byte			0x06		7
31623>>5	byte			0x05		6
31624>>5	byte			0x04		5
31625>>5	byte			0x03		4
31626>>5	byte			0x02		3
31627>>5	byte			0x01		2
31628>>5	byte			0x00		1
31629>>5	byte			0x10		(ALL)
31630>>2	byte			x			\b, Channel %d
31631>1	byte			0x08		Fender
31632>1	byte			0x09		Gulbransen
31633>1	byte			0x0a		AKG
31634>1	byte			0x0b		Voyce
31635>1	byte			0x0c		Waveframe
31636>1	byte			0x0d		ADA
31637>1	byte			0x0e		Garfield
31638>1	byte			0x0f		Ensoniq
31639>1	byte			0x10		Oberheim
31640>>2	byte			0x06		Matrix 6 series
31641>>3	byte			0x0A		Dump (All)
31642>>3	byte			0x01		Dump (Bank)
31643>>4 belong			0x0002040E		Matrix 1000
31644>>>11 byte			<2			User bank %d
31645>>>11 byte			>1			Preset bank %d
31646>1	byte			0x11		Apple
31647>1	byte			0x12		GreyMatter
31648>1	byte			0x14		PalmTree
31649>1	byte			0x15		JLCooper
31650>1	byte			0x16		Lowrey
31651>1	byte			0x17		AdamsSmith
31652>1	byte			0x18		E-mu
31653>1	byte			0x19		Harmony
31654>1	byte			0x1a		ART
31655>1	byte			0x1b		Baldwin
31656>1	byte			0x1c		Eventide
31657>1	byte			0x1d		Inventronics
31658>1	byte			0x1f		Clarity
31659
31660# European Group
31661>1	byte			0x21		SIEL
31662>1	byte			0x22		Synthaxe
31663>1	byte			0x24		Hohner
31664>1	byte			0x25		Twister
31665>1	byte			0x26		Solton
31666>1	byte			0x27		Jellinghaus
31667>1	byte			0x28		Southworth
31668>1	byte			0x29		PPG
31669>1	byte			0x2a		JEN
31670>1	byte			0x2b		SSL
31671>1	byte			0x2c		AudioVertrieb
31672
31673>1	byte			0x2f		ELKA
31674>>3	byte			0x09		EK-44
31675
31676>1	byte			0x30		Dynacord
31677>1	byte			0x31		Jomox
31678>1	byte			0x33		Clavia
31679>1	byte			0x39		Soundcraft
31680# Some Waldorf info from http://Stromeko.Synth.net/Downloads#WaldorfDocs
31681>1	byte			0x3e		Waldorf
31682>>2	byte			0x00		microWave
31683>>2	byte			0x0E		microwave2 / XT
31684>>2	byte			0x0F		Q / Q+
31685>>3	byte			=0			(default id)
31686>>3 byte			>0			(
31687>>>3 byte			<0x7F		\bdevice %d)
31688>>>3 byte			=0x7F		\bbroadcast id)
31689>>3	byte			0x7f		Microwave I
31690>>>4	byte			0x00		SNDR (Sound Request)
31691>>>4	byte			0x10		SNDD (Sound Dump)
31692>>>4	byte			0x20		SNDP (Sound Parameter Change)
31693>>>4	byte			0x30		SNDQ (Sound Parameter Inquiry)
31694>>>4	byte			0x70		BOOT (Sound Reserved)
31695>>>4	byte			0x01		MULR (Multi Request)
31696>>>4	byte			0x11		MULD (Multi Dump)
31697>>>4	byte			0x21		MULP (Multi Parameter Change)
31698>>>4	byte			0x31		MULQ (Multi Parameter Inquiry)
31699>>>4	byte			0x71		OS (Multi Reserved)
31700>>>4	byte			0x02		DRMR (Drum Map Request)
31701>>>4	byte			0x12		DRMD (Drum Map Dump)
31702>>>4	byte			0x22		DRMP (Drum Map Parameter Change)
31703>>>4	byte			0x32		DRMQ (Drum Map Parameter Inquiry)
31704>>>4	byte			0x72		BIN (Drum Map Reserved)
31705>>>4	byte			0x03		PATR (Sequencer Pattern Request)
31706>>>4	byte			0x13		PATD (Sequencer Pattern Dump)
31707>>>4	byte			0x23		PATP (Sequencer Pattern Parameter Change)
31708>>>4	byte			0x33		PATQ (Sequencer Pattern Parameter Inquiry)
31709>>>4	byte			0x73		AFM (Sequencer Pattern Reserved)
31710>>>4	byte			0x04		GLBR (Global Parameter Request)
31711>>>4	byte			0x14		GLBD (Global Parameter Dump)
31712>>>4	byte			0x24		GLBP (Global Parameter Parameter Change)
31713>>>4	byte			0x34		GLBQ (Global Parameter Parameter Inquiry)
31714>>>4	byte			0x07		MODR (Mode Parameter Request)
31715>>>4	byte			0x17		MODD (Mode Parameter Dump)
31716>>>4	byte			0x27		MODP (Mode Parameter Parameter Change)
31717>>>4	byte			0x37		MODQ (Mode Parameter Parameter Inquiry)
31718>>2	byte			0x10		microQ
31719>>>4	byte			0x00		SNDR (Sound Request)
31720>>>4	byte			0x10		SNDD (Sound Dump)
31721>>>4	byte			0x20		SNDP (Sound Parameter Change)
31722>>>4	byte			0x30		SNDQ (Sound Parameter Inquiry)
31723>>>4	byte			0x70		(Sound Reserved)
31724>>>4	byte			0x01		MULR (Multi Request)
31725>>>4	byte			0x11		MULD (Multi Dump)
31726>>>4	byte			0x21		MULP (Multi Parameter Change)
31727>>>4	byte			0x31		MULQ (Multi Parameter Inquiry)
31728>>>4	byte			0x71		OS (Multi Reserved)
31729>>>4	byte			0x02		DRMR (Drum Map Request)
31730>>>4	byte			0x12		DRMD (Drum Map Dump)
31731>>>4	byte			0x22		DRMP (Drum Map Parameter Change)
31732>>>4	byte			0x32		DRMQ (Drum Map Parameter Inquiry)
31733>>>4	byte			0x72		BIN (Drum Map Reserved)
31734>>>4	byte			0x04		GLBR (Global Parameter Request)
31735>>>4	byte			0x14		GLBD (Global Parameter Dump)
31736>>>4	byte			0x24		GLBP (Global Parameter Parameter Change)
31737>>>4	byte			0x34		GLBQ (Global Parameter Parameter Inquiry)
31738>>2	byte			0x11		rackAttack
31739>>>4	byte			0x00		SNDR (Sound Parameter Request)
31740>>>4	byte			0x10		SNDD (Sound Parameter Dump)
31741>>>4	byte			0x20		SNDP (Sound Parameter Parameter Change)
31742>>>4	byte			0x30		SNDQ (Sound Parameter Parameter Inquiry)
31743>>>4	byte			0x01		PRGR (Program Parameter Request)
31744>>>4	byte			0x11		PRGD (Program Parameter Dump)
31745>>>4	byte			0x21		PRGP (Program Parameter Parameter Change)
31746>>>4	byte			0x31		PRGQ (Program Parameter Parameter Inquiry)
31747>>>4	byte			0x71		OS (Program Parameter Reserved)
31748>>>4	byte			0x03		PATR (Pattern Parameter Request)
31749>>>4	byte			0x13		PATD (Pattern Parameter Dump)
31750>>>4	byte			0x23		PATP (Pattern Parameter Parameter Change)
31751>>>4	byte			0x33		PATQ (Pattern Parameter Parameter Inquiry)
31752>>>4	byte			0x04		GLBR (Global Parameter Request)
31753>>>4	byte			0x14		GLBD (Global Parameter Dump)
31754>>>4	byte			0x24		GLBP (Global Parameter Parameter Change)
31755>>>4	byte			0x34		GLBQ (Global Parameter Parameter Inquiry)
31756>>>4	byte			0x05		EFXR (FX Parameter Request)
31757>>>4	byte			0x15		EFXD (FX Parameter Dump)
31758>>>4	byte			0x25		EFXP (FX Parameter Parameter Change)
31759>>>4	byte			0x35		EFXQ (FX Parameter Parameter Inquiry)
31760>>>4	byte			0x07		MODR (Mode Command Request)
31761>>>4	byte			0x17		MODD (Mode Command Dump)
31762>>>4	byte			0x27		MODP (Mode Command Parameter Change)
31763>>>4	byte			0x37		MODQ (Mode Command Parameter Inquiry)
31764>>2	byte			0x03		Wave
31765>>>4	byte			0x00		SBPR (Soundprogram)
31766>>>4	byte			0x01		SAPR (Performance)
31767>>>4	byte			0x02		SWAVE (Wave)
31768>>>4	byte			0x03		SWTBL (Wave control table)
31769>>>4	byte			0x04		SVT (Velocity Curve)
31770>>>4	byte			0x05		STT (Tuning Table)
31771>>>4	byte			0x06		SGLB (Global Parameters)
31772>>>4	byte			0x07		SARRMAP (Performance Program Change Map)
31773>>>4	byte			0x08		SBPRMAP (Sound Program Change Map)
31774>>>4	byte			0x09		SBPRPAR (Sound Parameter)
31775>>>4	byte			0x0A		SARRPAR (Performance Parameter)
31776>>>4	byte			0x0B		SINSPAR (Instrument/External Parameter)
31777>>>4	byte			0x0F		SBULK (Bulk Switch on/off)
31778
31779# Japanese Group
31780>1	byte			0x40		Kawai
31781>>3	byte			0x20		K1
31782>>3	byte			0x22		K4
31783
31784>1	byte			0x41		Roland
31785>>3	byte			0x14		D-50
31786>>3	byte			0x2b		U-220
31787>>3	byte			0x02		TR-707
31788
31789>1	byte			0x42		Korg
31790>>3	byte			0x19		M1
31791
31792>1	byte			0x43		Yamaha
31793>1	byte			0x44		Casio
31794>1	byte			0x46		Kamiya
31795>1	byte			0x47		Akai
31796>1	byte			0x48		Victor
31797>1	byte			0x49		Mesosha
31798>1	byte			0x4b		Fujitsu
31799>1	byte			0x4c		Sony
31800>1	byte			0x4e		Teac
31801>1	byte			0x50		Matsushita
31802>1	byte			0x51		Fostex
31803>1	byte			0x52		Zoom
31804>1	byte			0x54		Matsushita
31805>1	byte			0x57		Acoustic tech. lab.
31806# https://www.midi.org/techspecs/manid.php
31807>1	belong&0xffffff00	0x00007400	Ta Horng
31808>1	belong&0xffffff00	0x00007500	e-Tek
31809>1	belong&0xffffff00	0x00007600	E-Voice
31810>1	belong&0xffffff00	0x00007700	Midisoft
31811>1	belong&0xffffff00	0x00007800	Q-Sound
31812>1	belong&0xffffff00	0x00007900	Westrex
31813>1	belong&0xffffff00	0x00007a00	Nvidia*
31814>1	belong&0xffffff00	0x00007b00	ESS
31815>1	belong&0xffffff00	0x00007c00	Mediatrix
31816>1	belong&0xffffff00	0x00007d00	Brooktree
31817>1	belong&0xffffff00	0x00007e00	Otari
31818>1	belong&0xffffff00	0x00007f00	Key Electronics
31819>1	belong&0xffffff00	0x00010000	Shure
31820>1	belong&0xffffff00	0x00010100	AuraSound
31821>1	belong&0xffffff00	0x00010200	Crystal
31822>1	belong&0xffffff00	0x00010300	Rockwell
31823>1	belong&0xffffff00	0x00010400	Silicon Graphics
31824>1	belong&0xffffff00	0x00010500	Midiman
31825>1	belong&0xffffff00	0x00010600	PreSonus
31826>1	belong&0xffffff00	0x00010800	Topaz
31827>1	belong&0xffffff00	0x00010900	Cast Lightning
31828>1	belong&0xffffff00	0x00010a00	Microsoft
31829>1	belong&0xffffff00	0x00010b00	Sonic Foundry
31830>1	belong&0xffffff00	0x00010c00	Line 6
31831>1	belong&0xffffff00	0x00010d00	Beatnik Inc.
31832>1	belong&0xffffff00	0x00010e00	Van Koerving
31833>1	belong&0xffffff00	0x00010f00	Altech Systems
31834>1	belong&0xffffff00	0x00011000	S & S Research
31835>1	belong&0xffffff00	0x00011100	VLSI Technology
31836>1	belong&0xffffff00	0x00011200	Chromatic
31837>1	belong&0xffffff00	0x00011300	Sapphire
31838>1	belong&0xffffff00	0x00011400	IDRC
31839>1	belong&0xffffff00	0x00011500	Justonic Tuning
31840>1	belong&0xffffff00	0x00011600	TorComp
31841>1	belong&0xffffff00	0x00011700	Newtek Inc.
31842>1	belong&0xffffff00	0x00011800	Sound Sculpture
31843>1	belong&0xffffff00	0x00011900	Walker Technical
31844>1	belong&0xffffff00	0x00011a00	Digital Harmony
31845>1	belong&0xffffff00	0x00011b00	InVision
31846>1	belong&0xffffff00	0x00011c00	T-Square
31847>1	belong&0xffffff00	0x00011d00	Nemesys
31848>1	belong&0xffffff00	0x00011e00	DBX
31849>1	belong&0xffffff00	0x00011f00	Syndyne
31850>1	belong&0xffffff00	0x00012000	Bitheadz
31851>1	belong&0xffffff00	0x00012100	Cakewalk
31852>1	belong&0xffffff00	0x00012200	Staccato
31853>1	belong&0xffffff00	0x00012300	National Semicon.
31854>1	belong&0xffffff00	0x00012400	Boom Theory
31855>1	belong&0xffffff00	0x00012500	Virtual DSP Corp
31856>1	belong&0xffffff00	0x00012600	Antares
31857>1	belong&0xffffff00	0x00012700	Angel Software
31858>1	belong&0xffffff00	0x00012800	St Louis Music
31859>1	belong&0xffffff00	0x00012900	Lyrrus dba G-VOX
31860>1	belong&0xffffff00	0x00012a00	Ashley Audio
31861>1	belong&0xffffff00	0x00012b00	Vari-Lite
31862>1	belong&0xffffff00	0x00012c00	Summit Audio
31863>1	belong&0xffffff00	0x00012d00	Aureal Semicon.
31864>1	belong&0xffffff00	0x00012e00	SeaSound
31865>1	belong&0xffffff00	0x00012f00	U.S. Robotics
31866>1	belong&0xffffff00	0x00013000	Aurisis
31867>1	belong&0xffffff00	0x00013100	Nearfield Multimedia
31868>1	belong&0xffffff00	0x00013200	FM7 Inc.
31869>1	belong&0xffffff00	0x00013300	Swivel Systems
31870>1	belong&0xffffff00	0x00013400	Hyperactive
31871>1	belong&0xffffff00	0x00013500	MidiLite
31872>1	belong&0xffffff00	0x00013600	Radical
31873>1	belong&0xffffff00	0x00013700	Roger Linn
31874>1	belong&0xffffff00	0x00013800	Helicon
31875>1	belong&0xffffff00	0x00013900	Event
31876>1	belong&0xffffff00	0x00013a00	Sonic Network
31877>1	belong&0xffffff00	0x00013b00	Realtime Music
31878>1	belong&0xffffff00	0x00013c00	Apogee Digital
31879
31880>1	belong&0xffffff00	0x00202b00	Medeli Electronics
31881>1	belong&0xffffff00	0x00202c00	Charlie Lab
31882>1	belong&0xffffff00	0x00202d00	Blue Chip Music
31883>1	belong&0xffffff00	0x00202e00	BEE OH Corp
31884>1	belong&0xffffff00	0x00202f00	LG Semicon America
31885>1	belong&0xffffff00	0x00203000	TESI
31886>1	belong&0xffffff00	0x00203100	EMAGIC
31887>1	belong&0xffffff00	0x00203200	Behringer
31888>1	belong&0xffffff00	0x00203300	Access Music
31889>1	belong&0xffffff00	0x00203400	Synoptic
31890>1	belong&0xffffff00	0x00203500	Hanmesoft Corp
31891>1	belong&0xffffff00	0x00203600	Terratec
31892>1	belong&0xffffff00	0x00203700	Proel SpA
31893>1	belong&0xffffff00	0x00203800	IBK MIDI
31894>1	belong&0xffffff00	0x00203900	IRCAM
31895>1	belong&0xffffff00	0x00203a00	Propellerhead Software
31896>1	belong&0xffffff00	0x00203b00	Red Sound Systems
31897>1	belong&0xffffff00	0x00203c00	Electron ESI AB
31898>1	belong&0xffffff00	0x00203d00	Sintefex Audio
31899>1	belong&0xffffff00	0x00203e00	Music and More
31900>1	belong&0xffffff00	0x00203f00	Amsaro
31901>1	belong&0xffffff00	0x00204000	CDS Advanced Technology
31902>1	belong&0xffffff00	0x00204100	Touched by Sound
31903>1	belong&0xffffff00	0x00204200	DSP Arts
31904>1	belong&0xffffff00	0x00204300	Phil Rees Music
31905>1	belong&0xffffff00	0x00204400	Stamer Musikanlagen GmbH
31906>1	belong&0xffffff00	0x00204500	Soundart
31907>1	belong&0xffffff00	0x00204600	C-Mexx Software
31908>1	belong&0xffffff00	0x00204700	Klavis Tech.
31909>1	belong&0xffffff00	0x00204800	Noteheads AB
31910
319110	string			T707		Roland TR-707 Data
31912#------------------------------------------------------------------------------
31913# file:  file(1) magic for Tcl scripting language
31914# URL:  https://www.tcl.tk/
31915# From: gustaf neumann
31916
31917# Tcl scripts
319180	search/1/w	#!\ /usr/bin/tcl	Tcl script text executable
31919!:mime	text/x-tcl
319200	search/1/w	#!\ /usr/local/bin/tcl	Tcl script text executable
31921!:mime	text/x-tcl
319220	search/1	#!/usr/bin/env\ tcl	Tcl script text executable
31923!:mime	text/x-tcl
319240	search/1	#!\ /usr/bin/env\ tcl	Tcl script text executable
31925!:mime	text/x-tcl
319260	search/1/w	#!\ /usr/bin/wish	Tcl/Tk script text executable
31927!:mime	text/x-tcl
319280	search/1/w	#!\ /usr/local/bin/wish	Tcl/Tk script text executable
31929!:mime	text/x-tcl
319300	search/1	#!/usr/bin/env\ wish	Tcl/Tk script text executable
31931!:mime	text/x-tcl
319320	search/1	#!\ /usr/bin/env\ wish	Tcl/Tk script text executable
31933!:mime	text/x-tcl
31934
31935# check the first line
319360	search/1	package\ req
31937>0	regex		\^package[\ \t]+req	Tcl script
31938# not 'p', check other lines
319390	search/1	!p
31940>0	regex		\^package[\ \t]+req	Tcl script
31941
31942#------------------------------------------------------------------------------
31943# $File: teapot,v 1.4 2009/09/19 16:28:12 christos Exp $
31944# teapot:  file(1) magic for "teapot" spreadsheet
31945#
319460       string          #!teapot\012xdr      teapot work sheet (XDR format)
31947
31948#------------------------------------------------------------------------------
31949# $File: terminfo,v 1.12 2021/02/23 00:51:10 christos Exp $
31950# terminfo:  file(1) magic for terminfo
31951#
31952# URL: https://invisible-island.net/ncurses/man/term.5.html
31953# URL: https://invisible-island.net/ncurses/man/scr_dump.5.html
31954#
31955# Workaround for Targa image type by Joerg Jenderek
31956# GRR: line below too general as it catches also
31957# Targa image type 1 with 26 long identification field
31958# and HELP.DSK
319590	string		\032\001
31960# 5th character of terminal name list, but not Targa image pixel size (15 16 24 32)
31961>16	ubyte		>32
31962# namelist, if more than 1 separated by "|" like "st|stterm| simpleterm 0.4.1"
31963>>12	regex		\^[a-zA-Z0-9][a-zA-Z0-9.][^|]*	Compiled terminfo entry "%-s"
31964!:mime	application/x-terminfo
31965# no extension
31966#!:ext
31967#
31968#------------------------------------------------------------------------------
31969# The following was added for ncurses6 development:
31970#------------------------------------------------------------------------------
31971#
319720	string		\036\002
31973# imitate the legacy compiled-format, to get the entry-name printed
31974>16	ubyte		>32
31975# namelist, if more than 1 separated by "|" like "st|stterm| simpleterm 0. 4.1"
31976>>12	regex		\^[a-zA-Z0-9][a-zA-Z0-9.][^|]*	Compiled 32-bit terminfo entry "%-s"
31977!:mime	application/x-terminfo2
31978#
31979# While the compiled terminfo uses little-endian format regardless of
31980# platform, SystemV screen dumps do not.  They came later, and that detail was
31981# overlooked.
31982#
31983# AIX and HPUX use the SVr4 big-endian format
31984# Solaris uses the SVr3 formats (sparc and x86 differ endian-ness)
319850	beshort		0433 		SVr2 curses screen image, big-endian
319860	beshort		0434		SVr3 curses screen image, big-endian
319870	beshort		0435		SVr4 curses screen image, big-endian
31988#
319890	leshort		0433		SVr2 curses screen image, little-endian
319900	leshort		0434		SVr3 curses screen image, little-endian
319910	leshort		0435		SVr4 curses screen image, little-endian
31992#
31993# Rather than SVr4, Solaris "xcurses" writes this header:
319940	regex		\^MAX=[0-9]+,[0-9]+$
31995>1	regex		\^BEG=[0-9]+,[0-9]+$
31996>2	regex		\^SCROLL=[0-9]+,[0-9]+$
31997>3	regex		\^VMIN=[0-9]+$
31998>4	regex		\^VTIME=[0-9]+$
31999>5	regex		\^FLAGS=0x[[:xdigit:]]+$
32000>6	regex		\^FG=[0-9],[0-9]+$
32001>7	regex		\^BG=[0-9]+,[0-9]+,	Solaris xcurses screen image
32002#
32003# ncurses5 (and before) did not use a magic number, making screen dumps "data".
32004# ncurses6 (2015) uses this format, ignoring byte-order
320050	string	\210\210\210\210ncurses	ncurses6 screen image
32006#
32007# PDCurses added this in 2005
320080	string		PDC\001		PDCurses screen image
32009
32010#------------------------------------------------------------------------------
32011# $File: tex,v 1.21 2019/04/19 00:42:27 christos Exp $
32012# tex:  file(1) magic for TeX files
32013#
32014# XXX - needs byte-endian stuff (big-endian and little-endian DVI?)
32015#
32016# From <conklin@talisman.kaleida.com>
32017
32018# Although we may know the offset of certain text fields in TeX DVI
32019# and font files, we can't use them reliably because they are not
32020# zero terminated. [but we do anyway, christos]
320210	string		\367\002	TeX DVI file
32022!:mime	application/x-dvi
32023>16	string		>\0		(%s)
320240	string		\367\203	TeX generic font data
320250	string		\367\131	TeX packed font data
32026>3	string		>\0		(%s)
320270	string		\367\312	TeX virtual font data
320280	search/1	This\ is\ TeX,	TeX transcript text
320290	search/1	This\ is\ METAFONT,	METAFONT transcript text
32030
32031# There is no way to detect TeX Font Metric (*.tfm) files without
32032# breaking them apart and reading the data.  The following patterns
32033# match most *.tfm files generated by METAFONT or afm2tfm.
320342	string		\000\021	TeX font metric data
32035!:mime	application/x-tex-tfm
32036>33	string		>\0		(%s)
320372	string		\000\022	TeX font metric data
32038!:mime	application/x-tex-tfm
32039>33	string		>\0		(%s)
32040
32041# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com)
320420	search/1	\\input\ texinfo	Texinfo source text
32043!:mime	text/x-texinfo
320440	search/1	This\ is\ Info\ file	GNU Info text
32045!:mime	text/x-info
32046
32047# TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com)
320480	search/4096	\\input		TeX document text
32049!:mime	text/x-tex
32050!:strength + 15
320510	search/4096	\\begin		LaTeX document text
32052!:mime	text/x-tex
32053!:strength + 15
320540	search/4096	\\section	LaTeX document text
32055!:mime	text/x-tex
32056!:strength + 18
320570	search/4096	\\setlength	LaTeX document text
32058!:mime	text/x-tex
32059!:strength + 15
320600	search/4096	\\documentstyle	LaTeX document text
32061!:mime	text/x-tex
32062!:strength + 18
320630	search/4096	\\chapter	LaTeX document text
32064!:mime	text/x-tex
32065!:strength + 18
320660	search/4096	\\documentclass	LaTeX 2e document text
32067!:mime	text/x-tex
32068!:strength + 15
320690	search/4096	\\relax		LaTeX auxiliary file
32070!:mime	text/x-tex
32071!:strength + 15
320720	search/4096	\\contentsline	LaTeX table of contents
32073!:mime	text/x-tex
32074!:strength + 15
320750	search/4096	%\ -*-latex-*-	LaTeX document text
32076!:mime	text/x-tex
32077
32078# Tex document, from Hendrik Scholz <hendrik@scholz.net>
320790   	search/1	\\ifx		TeX document text
32080
32081# Index and glossary files
320820	search/4096	\\indexentry	LaTeX raw index file
320830	search/4096	\\begin{theindex}	LaTeX sorted index
320840	search/4096	\\glossaryentry	LaTeX raw glossary
320850	search/4096	\\begin{theglossary}	LaTeX sorted glossary
320860	search/4096	This\ is\ makeindex	Makeindex log file
32087
32088# End of TeX
32089
32090#------------------------------------------------------------------------------
32091# file(1) magic for BibTex text files
32092# From Hendrik Scholz <hendrik@scholz.net>
32093
320940	search/1/c	@article{	BibTeX text file
320950	search/1/c	@book{		BibTeX text file
320960	search/1/c	@inbook{	BibTeX text file
320970	search/1/c	@incollection{	BibTeX text file
320980	search/1/c	@inproceedings{	BibTeX text file
320990	search/1/c	@manual{	BibTeX text file
321000	search/1/c	@misc{		BibTeX text file
321010	search/1/c	@preamble{	BibTeX text file
321020	search/1/c	@phdthesis{	BibTeX text file
321030	search/1/c	@techreport{	BibTeX text file
321040	search/1/c	@unpublished{	BibTeX text file
32105
3210673	search/1	%%%\ \ 		BibTeX-file{ BibTex text file (with full header)
32107
3210873	search/1	%%%\ \ @BibTeX-style-file{   BibTeX style text file (with full header)
32109
321100	search/1	%\ BibTeX\ standard\ bibliography\ 	BibTeX standard bibliography style text file
32111
321120	search/1	%\ BibTeX\ `	BibTeX custom bibliography style text file
32113
321140	search/1	@c\ @mapfile{	TeX font aliases text file
32115
321160	string		#LyX		LyX document text
32117
32118# ConTeXt documents
32119#	https://wiki.contextgarden.net/
321200	search/4096	\\setupcolors[		ConTeXt document text
32121!:strength + 15
321220	search/4096	\\definecolor[		ConTeXt document text
32123!:strength + 15
321240	search/4096	\\setupinteraction[	ConTeXt document text
32125!:strength + 15
321260	search/4096	\\useURL[		ConTeXt document text
32127!:strength + 15
321280	search/4096	\\setuppapersize[	ConTeXt document text
32129!:strength + 15
321300	search/4096	\\setuplayout[		ConTeXt document text
32131!:strength + 15
321320	search/4096	\\setupfooter[		ConTeXt document text
32133!:strength + 15
321340	search/4096	\\setupfootertexts[	ConTeXt document text
32135!:strength + 15
321360	search/4096	\\setuppagenumbering[	ConTeXt document text
32137!:strength + 15
321380	search/4096	\\setupbodyfont[	ConTeXt document text
32139!:strength + 15
321400	search/4096	\\setuphead[		ConTeXt document text
32141!:strength + 15
321420	search/4096	\\setupitemize[		ConTeXt document text
32143!:strength + 15
321440	search/4096	\\setupwhitespace[	ConTeXt document text
32145!:strength + 15
321460	search/4096	\\setupindenting[	ConTeXt document text
32147!:strength + 15
32148
32149#------------------------------------------------------------------------------
32150# $File: tgif,v 1.7 2010/09/20 19:03:46 rrt Exp $
32151# file(1) magic for tgif(1) files
32152# From Hendrik Scholz <hendrik@scholz.net>
321530	string	%TGIF\ 			Tgif file version
32154>6	string	x			%s
32155
32156#------------------------------------------------------------------------------
32157# $File: ti-8x,v 1.8 2020/02/12 22:13:01 christos Exp $
32158# ti-8x: file(1) magic for the TI-8x and TI-9x Graphing Calculators.
32159#
32160# From: Ryan McGuire (rmcguire@freenet.columbus.oh.us).
32161#
32162# Update: Romain Lievin (roms@lpg.ticalc.org).
32163#
32164# NOTE: This list is not complete.
32165# Files for the TI-80 and TI-81 are pretty rare. I'm not going to put the
32166# program/group magic numbers in here because I cannot find any.
321670		string		**TI80**	TI-80 Graphing Calculator File.
321680		string		**TI81**	TI-81 Graphing Calculator File.
32169#
32170# Magic Numbers for the TI-73
32171#
321720		string		**TI73**	TI-73 Graphing Calculator
32173>0x00003B	byte		0x00		(real number)
32174>0x00003B	byte		0x01		(list)
32175>0x00003B	byte		0x02		(matrix)
32176>0x00003B	byte		0x03		(equation)
32177>0x00003B	byte		0x04		(string)
32178>0x00003B	byte		0x05		(program)
32179>0x00003B	byte		0x06		(assembly program)
32180>0x00003B	byte		0x07		(picture)
32181>0x00003B	byte		0x08		(gdb)
32182>0x00003B	byte		0x0C		(complex number)
32183>0x00003B	byte		0x0F		(window settings)
32184>0x00003B	byte		0x10		(zoom)
32185>0x00003B	byte		0x11		(table setup)
32186>0x00003B	byte		0x13		(backup)
32187
32188# Magic Numbers for the TI-82
32189#
321900		string		**TI82**	TI-82 Graphing Calculator
32191>0x00003B	byte		0x00		(real)
32192>0x00003B	byte		0x01		(list)
32193>0x00003B	byte		0x02		(matrix)
32194>0x00003B	byte		0x03		(Y-variable)
32195>0x00003B	byte		0x05		(program)
32196>0x00003B	byte		0x06		(protected prgm)
32197>0x00003B	byte		0x07		(picture)
32198>0x00003B	byte		0x08		(gdb)
32199>0x00003B	byte		0x0B		(window settings)
32200>0x00003B	byte		0x0C		(window settings)
32201>0x00003B	byte		0x0D		(table setup)
32202>0x00003B	byte		0x0E		(screenshot)
32203>0x00003B	byte		0x0F		(backup)
32204#
32205# Magic Numbers for the TI-83
32206#
322070		string		**TI83**	TI-83 Graphing Calculator
32208>0x00003B	byte		0x00		(real)
32209>0x00003B	byte		0x01		(list)
32210>0x00003B	byte		0x02		(matrix)
32211>0x00003B	byte		0x03		(Y-variable)
32212>0x00003B	byte		0x04		(string)
32213>0x00003B	byte		0x05		(program)
32214>0x00003B	byte		0x06		(protected prgm)
32215>0x00003B	byte		0x07		(picture)
32216>0x00003B	byte		0x08		(gdb)
32217>0x00003B	byte		0x0B		(window settings)
32218>0x00003B	byte		0x0C		(window settings)
32219>0x00003B	byte		0x0D		(table setup)
32220>0x00003B	byte		0x0E		(screenshot)
32221>0x00003B	byte		0x13		(backup)
32222#
32223# Magic Numbers for the TI-83+
32224#
322250		string		**TI83F*	TI-83+ Graphing Calculator
32226>0x00003B	byte		0x00		(real number)
32227>0x00003B	byte		0x01		(list)
32228>0x00003B	byte		0x02		(matrix)
32229>0x00003B	byte		0x03		(equation)
32230>0x00003B	byte		0x04		(string)
32231>0x00003B	byte		0x05		(program)
32232>0x00003B	byte		0x06		(assembly program)
32233>0x00003B	byte		0x07		(picture)
32234>0x00003B	byte		0x08		(gdb)
32235>0x00003B	byte		0x0C		(complex number)
32236>0x00003B	byte		0x0F		(window settings)
32237>0x00003B	byte		0x10		(zoom)
32238>0x00003B	byte		0x11		(table setup)
32239>0x00003B	byte		0x13		(backup)
32240>0x00003B	byte		0x15		(application variable)
32241>0x00003B	byte		0x17		(group of variable)
32242
32243#
32244# Magic Numbers for the TI-85
32245#
322460		string		**TI85**	TI-85 Graphing Calculator
32247>0x00003B	byte		0x00		(real number)
32248>0x00003B	byte		0x01		(complex number)
32249>0x00003B	byte		0x02		(real vector)
32250>0x00003B	byte		0x03		(complex vector)
32251>0x00003B	byte		0x04		(real list)
32252>0x00003B	byte		0x05		(complex list)
32253>0x00003B	byte		0x06		(real matrix)
32254>0x00003B	byte		0x07		(complex matrix)
32255>0x00003B	byte		0x08		(real constant)
32256>0x00003B	byte		0x09		(complex constant)
32257>0x00003B	byte		0x0A		(equation)
32258>0x00003B	byte		0x0C		(string)
32259>0x00003B	byte		0x0D		(function GDB)
32260>0x00003B	byte		0x0E		(polar GDB)
32261>0x00003B	byte		0x0F		(parametric GDB)
32262>0x00003B	byte		0x10		(diffeq GDB)
32263>0x00003B	byte		0x11		(picture)
32264>0x00003B	byte		0x12		(program)
32265>0x00003B	byte		0x13		(range)
32266>0x00003B	byte		0x17		(window settings)
32267>0x00003B	byte		0x18		(window settings)
32268>0x00003B	byte		0x19		(window settings)
32269>0x00003B	byte		0x1A		(window settings)
32270>0x00003B	byte		0x1B		(zoom)
32271>0x00003B	byte		0x1D		(backup)
32272>0x00003B	byte		0x1E		(unknown)
32273>0x00003B	byte		0x2A		(equation)
32274>0x000032	string		ZS4		- ZShell Version 4 File.
32275>0x000032	string		ZS3		- ZShell Version 3 File.
32276#
32277# Magic Numbers for the TI-86
32278#
322790		string		**TI86**	TI-86 Graphing Calculator
32280>0x00003B	byte		0x00		(real number)
32281>0x00003B	byte		0x01		(complex number)
32282>0x00003B	byte		0x02		(real vector)
32283>0x00003B	byte		0x03		(complex vector)
32284>0x00003B	byte		0x04		(real list)
32285>0x00003B	byte		0x05		(complex list)
32286>0x00003B	byte		0x06		(real matrix)
32287>0x00003B	byte		0x07		(complex matrix)
32288>0x00003B	byte		0x08		(real constant)
32289>0x00003B	byte		0x09		(complex constant)
32290>0x00003B	byte		0x0A		(equation)
32291>0x00003B	byte		0x0C		(string)
32292>0x00003B	byte		0x0D		(function GDB)
32293>0x00003B	byte		0x0E		(polar GDB)
32294>0x00003B	byte		0x0F		(parametric GDB)
32295>0x00003B	byte		0x10		(diffeq GDB)
32296>0x00003B	byte		0x11		(picture)
32297>0x00003B	byte		0x12		(program)
32298>0x00003B	byte		0x13		(range)
32299>0x00003B	byte		0x17		(window settings)
32300>0x00003B	byte		0x18		(window settings)
32301>0x00003B	byte		0x19		(window settings)
32302>0x00003B	byte		0x1A		(window settings)
32303>0x00003B	byte		0x1B		(zoom)
32304>0x00003B	byte		0x1D		(backup)
32305>0x00003B	byte		0x1E		(unknown)
32306>0x00003B	byte		0x2A		(equation)
32307#
32308# Magic Numbers for the TI-89
32309#
323100		string		**TI89**	TI-89 Graphing Calculator
32311>0x000048	byte		0x00		(expression)
32312>0x000048	byte		0x04		(list)
32313>0x000048	byte		0x06		(matrix)
32314>0x000048	byte		0x0A		(data)
32315>0x000048	byte		0x0B		(text)
32316>0x000048	byte		0x0C		(string)
32317>0x000048	byte		0x0D		(graphic data base)
32318>0x000048	byte		0x0E		(figure)
32319>0x000048	byte		0x10		(picture)
32320>0x000048	byte		0x12		(program)
32321>0x000048	byte		0x13		(function)
32322>0x000048	byte		0x14		(macro)
32323>0x000048	byte		0x1C		(zipped)
32324>0x000048	byte		0x21		(assembler)
32325#
32326# Magic Numbers for the TI-92
32327#
323280		string		**TI92**	TI-92 Graphing Calculator
32329>0x000048	byte		0x00		(expression)
32330>0x000048	byte		0x04		(list)
32331>0x000048	byte		0x06		(matrix)
32332>0x000048	byte		0x0A		(data)
32333>0x000048	byte		0x0B		(text)
32334>0x000048	byte		0x0C		(string)
32335>0x000048	byte		0x0D		(graphic data base)
32336>0x000048	byte		0x0E		(figure)
32337>0x000048	byte		0x10		(picture)
32338>0x000048	byte		0x12		(program)
32339>0x000048	byte		0x13		(function)
32340>0x000048	byte		0x14		(macro)
32341>0x000048	byte		0x1D		(backup)
32342#
32343# Magic Numbers for the TI-92+/V200
32344#
323450		string		**TI92P*	TI-92+/V200 Graphing Calculator
32346>0x000048	byte		0x00		(expression)
32347>0x000048	byte		0x04		(list)
32348>0x000048	byte		0x06		(matrix)
32349>0x000048	byte		0x0A		(data)
32350>0x000048	byte		0x0B		(text)
32351>0x000048	byte		0x0C		(string)
32352>0x000048	byte		0x0D		(graphic data base)
32353>0x000048	byte		0x0E		(figure)
32354>0x000048	byte		0x10		(picture)
32355>0x000048	byte		0x12		(program)
32356>0x000048	byte		0x13		(function)
32357>0x000048	byte		0x14		(macro)
32358>0x000048	byte		0x1C		(zipped)
32359>0x000048	byte		0x21		(assembler)
32360#
32361# Magic Numbers for the TI-73/83+/89/92+/V200 FLASH upgrades
32362#
32363#0x0000016	string		Advanced	TI-XX Graphing Calculator (FLASH)
323640		string		**TIFL**	TI-XX Graphing Calculator (FLASH)
32365>8		byte		>0		- Revision %d
32366>>9 		byte		x		\b.%d,
32367>12		byte		>0		Revision date %02x
32368>>13		byte		x		\b/%02x
32369>>14		beshort		x		\b/%04x,
32370>17		string		>/0		name: '%s',
32371>48		byte		0x74		device: TI-73,
32372>48		byte		0x73		device: TI-83+,
32373>48		byte		0x98		device: TI-89,
32374>48		byte		0x88		device: TI-92+,
32375>49		byte		0x23		type: OS upgrade,
32376>49		byte		0x24		type: application,
32377>49		byte		0x25		type: certificate,
32378>49		byte		0x3e		type: license,
32379>74		lelong		>0		size: %d bytes
32380
32381# VTi & TiEmu skins (TI Graphing Calculators).
32382# From: Romain Lievin (roms@lpg.ticalc.org).
32383# Magic Numbers for the VTi skins
323840               string          VTI		Virtual TI skin
32385>3		string		v		- Version
32386>>4		byte		>0		\b %c
32387>>6		byte		x		\b.%c
32388# Magic Numbers for the TiEmu skins
323890		string		TiEmu		TiEmu skin
32390>6              string          v               - Version
32391>>7             byte            >0              \b %c
32392>>9             byte            x               \b.%c
32393>>10		byte		x		\b%c
32394
32395#------------------------------------------------------------------------------
32396# $File: timezone,v 1.12 2020/12/28 15:59:23 christos Exp $
32397# timezone:  file(1) magic for timezone data
32398#
32399# from Daniel Quinlan (quinlan@yggdrasil.com)
32400# this should work on Linux, SunOS, and maybe others
32401# Added new official magic number for recent versions of the Olson code
324020	string	TZif	timezone data
32403>4	byte	0	\b, old version
32404>4	byte	>0	\b, version %c
32405>20	belong	0	\b, no gmt time flags
32406>20	belong	1	\b, 1 gmt time flag
32407>20	belong	>1	\b, %d gmt time flags
32408>24	belong	0	\b, no std time flags
32409>24	belong	1	\b, 1 std time flag
32410>24	belong	>1	\b, %d std time flags
32411>28	belong	0	\b, no leap seconds
32412>28	belong	1	\b, 1 leap second
32413>28	belong  >1	\b, %d leap seconds
32414>32	belong	0	\b, no transition times
32415>32	belong	1	\b, 1 transition time
32416>32	belong  >1	\b, %d transition times
32417>36	belong	0	\b, no local time types
32418>36	belong	1	\b, 1 local time type
32419>36	belong	>1	\b, %d local time types
32420>40	belong	0	\b, no abbreviation chars
32421>40	belong	1	\b, 1 abbreviation char
32422>40	belong	>1	\b, %d abbreviation chars
324230	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0	old timezone data
324240	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0	old timezone data
324250	string  \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0	old timezone data
324260	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0	old timezone data
324270	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0	old timezone data
324280	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0	old timezone data
32429
32430#------------------------------------------------------------------------------
32431# $File: tplink,v 1.6 2020/12/12 20:01:47 christos Exp $
32432# tplink: File magic for openwrt firmware files
32433
32434# URL: https://wiki.openwrt.org/doc/techref/header
32435# Reference: https://git.openwrt.org/?p=openwrt.git;a=blob;f=tools/firmware-utils/src/mktplinkfw.c
32436# From: Joerg Jenderek
32437# check for valid header version 1 or 2
324380		ulelong		<3
32439>0		ulelong		!0
32440# test for header padding with nulls
32441>>0x100		long		0
32442# skip Norton Commander Cleanup Utility NCCLEAN.INI by looking for valid vendor
32443>>>4		ubelong		>0x1F000000
32444# skip user.dbt by looking for positive hardware id
32445>>>>0x40	ubeshort	>0
32446>>>>>0		use		firmware-tplink
32447
324480		name		firmware-tplink
32449>0		ubyte		x		firmware
32450!:mime application/x-tplink-bin
32451!:ext	bin
32452# hardware id like 10430001 07410001 09410004 09410006
32453>0x40		ubeshort	x		%x
32454>0x42		ubeshort	x		v%x
32455# hardware revision like 1
32456>0x44		ubelong		!1		(revision %u)
32457# vendor_name[24] like OpenWrt or TP-LINK Technologies
32458>4		string		x		%.24s
32459# fw_version[36] like r49389 or ver. 1.0
32460>0x1c		string		x		%.36s
32461# header version 1 or 2
32462>0		ubyte		!1		V%X
32463# ver_hi.ver_mid.ver_lo
32464>0x98		long		!0		\b, version
32465>>0x98		ubeshort	x		%u
32466>>0x9A		ubeshort	x		\b.%u
32467>>0x9C		ubeshort	x		\b.%u
32468# region code 0~universal 1~US
32469>0x48		ubelong		x
32470#>>0x48		ubelong		0		(universal)
32471>>0x48		ubelong		1		(US)
32472>>0x48		ubelong		>1		(region %u)
32473# total length of the firmware. not always true
32474>0x7C		ubelong		x		\b, %u bytes or less
32475# unknown 1
32476>0x48		ubelong		!0		\b, UNKNOWN1 0x%x
32477# md5sum1[16]
32478#>0x4c		ubequad		x		\b, MD5 %llx
32479#>>0x54		ubequad		x		\b%llx
32480# unknown 2
32481>0x5c		ubelong		!0		\b, UNKNOWN2 0x%x
32482# md5sum2[16]
32483#>0x60		ubequad		!0		\b, 2nd MD5 %llx
32484#>>0x68		ubequad		x		\b%llx
32485# unknown 3
32486>0x70		ubelong		!0		\b, UNKNOWN3 0x%x
32487# kernel load address
32488#>0x74		ubelong		x		\b, 0x%x load
32489# kernel entry point
32490#>0x78		ubelong		x		\b, 0x%x entry
32491# kernel data offset. 200h means direct after header
32492>0x80		ubelong		x		\b, at 0x%x
32493# kernel data length and 1 space
32494>0x84		ubelong		x		%u bytes
32495# look for kernel type (gzip compressed vmlinux.bin by ./compress)
32496>(0x80.L)	indirect	x
32497# root file system data offset
32498# WRONG in 5.35 with above indirect expression
32499>0x88		ubelong		x		\b, at 0x%x
32500# rootfs data length and 1 space
32501>0x8C		ubelong		x		%u bytes
32502# in 5.32 only true for offset ~< FILE_BYTES_MAX=9 MB defined in ../../src/file.h
32503>(0x88.L)	indirect	x
32504# 'qshs' for wr940nv1_en_3_13_7_up(111228).bin
32505#>(0x88.L)	string		x		\b, file system '%.4s'
32506#>(0x88.L)	ubequad		x		\b, file system 0x%llx
32507# bootloader data offset
32508>0x90		ubelong		!0		\b, at 0x%x
32509# bootloader data length only reasonable if bootloader offset not null
32510>>0x94		ubelong		!0		%u bytes
32511# pad[354] should be 354 null bytes.
32512#>0x9E		ubequad		!0		\b, padding 0x%llx
32513# But at 0x120 18 non null bytes in examples like
32514# wr940nv4_eu_3_16_9_up_boot(160620).bin
32515# wr940nv6_us_3_18_1_up_boot(171030).bin
32516#>0x120		ubequad		!0		\b, other padding 0x%llx
32517
32518#------------------------------------------------------------------------------
32519# $File: troff,v 1.13 2020/05/30 23:12:34 christos Exp $
32520# troff:  file(1) magic for *roff
32521#
32522# updated by Daniel Quinlan (quinlan@yggdrasil.com)
32523
32524# troff input
325250	search/1	.\\"		troff or preprocessor input text
32526!:mime	text/troff
325270	search/1	'\\"		troff or preprocessor input text
32528!:mime	text/troff
325290	search/1	'.\\"		troff or preprocessor input text
32530!:mime	text/troff
325310	search/1	\\"		troff or preprocessor input text
32532!:mime	text/troff
32533#0	search/1	'''		troff or preprocessor input text
32534#!:mime	text/troff
325350	regex/20l	\^\\.[A-Za-z][A-Za-z0-9][\ \t]	troff or preprocessor input text
32536!:mime	text/troff
325370	regex/20l	\^\\.[A-Za-z][A-Za-z0-9]$	troff or preprocessor input text
32538!:mime	text/troff
32539
32540# ditroff intermediate output text
325410	search/1	x\ T		ditroff output text
32542>4	search/1	cat		for the C/A/T phototypesetter
32543>4	search/1	ps		for PostScript
32544>4	search/1	dvi		for DVI
32545>4	search/1	ascii		for ASCII
32546>4	search/1	lj4		for LaserJet 4
32547>4	search/1	latin1		for ISO 8859-1 (Latin 1)
32548>4	search/1	X75		for xditview at 75dpi
32549>>7	search/1	-12		(12pt)
32550>4	search/1	X100		for xditview at 100dpi
32551>>8	search/1	-12		(12pt)
32552
32553# output data formats
325540	string		\100\357	very old (C/A/T) troff output data
32555
32556#------------------------------------------------------------------------------
32557# $File: tuxedo,v 1.4 2009/09/19 16:28:13 christos Exp $
32558# tuxedo:	file(1) magic for BEA TUXEDO data files
32559#
32560# from Ian Springer <ispringer@hotmail.com>
32561#
325620	string		\0\0\1\236\0\0\0\0\0\0\0\0\0\0\0\0	BEA TUXEDO DES mask data
32563
32564#------------------------------------------------------------------------------
32565# $File: typeset,v 1.8 2009/09/19 16:28:13 christos Exp $
32566# typeset:  file(1) magic for other typesetting
32567#
325680	string		Interpress/Xerox	Xerox InterPress data
32569>16	string		/			(version
32570>>17	string		>\0			%s)
32571
32572#------------------------------------------------------------------------------
32573# $File: unicode,v 1.7 2019/02/19 20:34:42 christos Exp $
32574# Unicode:  BOM prefixed text files - Adrian Havill <havill@turbolinux.co.jp>
32575# These types are recognised in file_ascmagic so these encodings can be
32576# treated by text patterns.  Missing types are already dealt with internally.
32577#
325780	string	+/v8			Unicode text, UTF-7
325790	string	+/v9			Unicode text, UTF-7
325800	string	+/v+			Unicode text, UTF-7
325810	string	+/v/			Unicode text, UTF-7
325820	string	\335\163\146\163	Unicode text, UTF-8-EBCDIC
325830	string	\000\000\376\377	Unicode text, UTF-32, big-endian
325840	string	\377\376\000\000	Unicode text, UTF-32, little-endian
325850	string	\016\376\377		Unicode text, SCSU (Standard Compression Scheme for Unicode)
32586
32587#------------------------------------------------------------------------------
32588# $File: unisig,v 1.1 2020/04/09 19:05:44 christos Exp $
32589# unisig:  file(1) magic for files carrying a uniform signature (Unisig)
32590# From: Lassi Kortela, John Cowan
32591# URL:	https://github.com/unisig
32592#
325930	string	\xDC\xDC\x0D\x0A\x1A\x0A\x00	Unisig:
32594>7	ubyte	=0				UUID
32595>>8	guid	x				%s
32596>7	ubyte	>0				URI
32597>>7	pstring x				%s
32598
32599#------------------------------------------------------------------------------
32600# $File: unknown,v 1.8 2013/01/09 22:37:24 christos Exp $
32601# unknown:  file(1) magic for unknown machines
32602#
32603# 0x107 is 0407, 0x108 is 0410, and 0x109 is 0411; those are all PDP-11
32604# (executable, pure, and split I&D, respectively), but the PDP-11 version
32605# doesn't have the "version %ld", which may be a bogus COFFism (I don't
32606# think there was ever COFF for the PDP-11).
32607#
32608# 0x10B is 0413; that's VAX demand-paged, but this is a short, not a
32609# long, as it would be on a VAX.  In any case, that could collide with
32610# VAX demand-paged files, as the magic number is little-endian on those
32611# binaries, so the first 16 bits of the file would contain 0x10B.
32612#
32613# Therefore, those entries are commented out.
32614#
32615# 0x10C is 0414 and 0x10E is 0416; those *are* unknown.
32616#
32617#0	short		0x107		unknown machine executable
32618#>8	short		>0		not stripped
32619#>15	byte		>0		- version %ld
32620#0	short		0x108		unknown pure executable
32621#>8	short		>0		not stripped
32622#>15	byte		>0		- version %ld
32623#0	short		0x109		PDP-11 separate I&D
32624#>8	short		>0		not stripped
32625#>15	byte		>0		- version %ld
32626#0	short		0x10b		unknown pure executable
32627#>8	short		>0		not stripped
32628#>15	byte		>0		- version %ld
326290	long		0x10c		unknown demand paged pure executable
32630>16	long		>0		not stripped
326310	long		0x10e		unknown readable demand paged pure executable
32632
32633#------------------------------------------------------------------------------
32634# $File: usd,v 1.2 2020/05/21 22:17:00 christos Exp $
32635#
32636# From Christian Schmidbauer
32637#
32638# https://github.com/PixarAnimationStudios/USD
32639
32640# USD crate file
32641# https://github.com/PixarAnimationStudios/USD/blob/ebac0a8b6703f4fa1c27115f1f013bb9819662f4/pxr/usd/usd/crateFile.h#L441-L450
326420	string		PXR-USDC	USD crate
32643>8	byte		x		\b, version %x.
32644>9	byte		x		\b%x.
32645>10	byte		x		\b%x
32646!:ext	usd
32647
32648# USD ASCII file
326490	string		#usda\040	USD ASCII
32650>6	string		x		\b, version %s
32651!:mime	text/plain
32652!:ext	usd
32653
32654#------------------------------------------------------------------------------
32655# $File: uterus,v 1.3 2014/04/30 21:41:02 christos Exp $
32656# file(1) magic for uterus files
32657# http://freecode.com/projects/uterus
32658#
326590	string		UTE+	uterus file
32660>4	string		v	\b, version
32661>5	byte		x	%c
32662>6	string		.	\b.
32663>7	byte		x	\b%c
32664>8	string		\<\>	\b, big-endian
32665>>16	belong		>0	\b, slut size %u
32666>8	string		\>\<	\b, litte-endian
32667>>16	lelong		>0	\b, slut size %u
32668>10	byte		&8	\b, compressed
32669
32670#------------------------------------------------------------------------------
32671# $File: uuencode,v 1.8 2019/12/14 20:40:26 christos Exp $
32672# uuencode:  file(1) magic for ASCII-encoded files
32673#
32674
32675# GRR:  the first line of xxencoded files is identical to that in uuencoded
32676# files, but the first character in most subsequent lines is 'h' instead of
32677# 'M'.  (xxencoding uses lowercase letters in place of most of uuencode's
32678# punctuation and survives BITNET gateways better.)  If regular expressions
32679# were supported, this entry could possibly be split into two with
32680# "begin\040\.\*\012M" or "begin\040\.\*\012h" (where \. and \* are REs).
326810	search/1	begin\ 		uuencoded or xxencoded text
32682
32683# btoa(1) is an alternative to uuencode that requires less space.
326840	search/1	xbtoa\ Begin	btoa'd text
32685
32686# ship(1) is another, much cooler alternative to uuencode.
32687# Greg Roelofs, newt@uchicago.edu
326880	search/1	$\012ship	ship'd binary text
32689
32690# bencode(8) is used to encode compressed news batches (Bnews/Cnews only?)
32691# Greg Roelofs, newt@uchicago.edu
326920	search/1	Decode\ the\ following\ with\ bdeco	bencoded News text
32693
32694# GRR: handle BASE64
32695
32696#------------------------------------------------------------------------------
32697# $File: vacuum-cleaner,v 1.1 2015/11/14 13:38:35 christos Exp $
32698# vacuum cleaner magic by Thomas M. Ott (ThMO)
32699#
32700# navigation map for LG robot vacuum cleaner models VR62xx, VR64xx, VR63xx
32701# file: MAPDATAyyyymmddhhmmss_xxxxxx_cc.blk
32702# -> yyyymmdd: year, month, day of cleaning
32703# -> hhmmss: hour, minute, second of cleaning
32704# -> xxxxxx: 6 digits
32705# -> cc: cleaning runs counter
32706# size: 136044 bytes
32707#
32708# struct maphdr {
32709#     int32_t  map_cnt;	     /*  0: single map */
32710#     int32_t  min_ceil;     /*  4: 100 mm == 10 cm == min. ceil */
32711#     int32_t  max_ceil;     /*  8: 10000 mm == 100 m == max. ceil */
32712#     int32_t  max_climb;    /* 12: 50 mm = 5 cm == max. height to climb */
32713#     int32_t  unknown;	     /* 16: 50000 ??? */
32714#     int32_t  cell_bytes;   /* 20: # of bytes for cells per block */
32715#     int32_t  block_max;    /* 24: 1000 == max. # of blocks */
32716#     int32_t  route_max;    /* 28: 1000 == max. # of routes */
32717#     int32_t  used_blocks;  /* 32: 5/45/33/... == # of block entries used! */
32718#     int32_t  cell_dim;     /* 36: 10 == cell dimension */
32719#     int32_t  clock_tick;   /* 40: 100 == clock ticks */
32720# #if	0
32721#     struct {		     /* 44: 1000 blocks for 10x10 cells */
32722#         int32_t  yoffset;
32723#         int32_t  xoffset;
32724#         int32_t  posxy;
32725#         int32_t  timecode;
32726#       }      blocks[ 1000];
32727#     char     cells[ 1000* 100]; /* 16044: 1000 10x10 cells */
32728#     int16_t  routes[ 1000* 10]; /* 116044: 1000 10-routes */
32729# #endif
32730#   };
32731
327320                lelong =1
32733>4               lelong =100
32734>>8              lelong =10000
32735>>>12            lelong =50
32736>>>>16           lelong =50000
32737>>>>>20          lelong =100
32738>>>>>>24         lelong =1000
32739>>>>>>>28        lelong =1000
32740>>>>>>>>36       lelong =10
32741>>>>>>>>>40      lelong =100
32742>>>>>>>>>>32     lelong x       LG robot VR6[234]xx %dm^2 navigation
32743>>>>>>>>>>136040 lelong =-1     reuse map data
32744>>>>>>>>>>136040 lelong =0      map data
32745>>>>>>>>>>136040 lelong >0      spurious map data
32746>>>>>>>>>>136040 lelong <-1     spurious map data
32747
32748
32749
32750#------------------------------------------------------------------------------
32751# $File: varied.out,v 1.23 2014/04/30 21:41:02 christos Exp $
32752# varied.out:  file(1) magic for various USG systems
32753#
32754#	Herewith many of the object file formats used by USG systems.
32755#	Most have been moved to files for a particular processor,
32756#	and deleted if they duplicate other entries.
32757#
327580	short		0610		Perkin-Elmer executable
32759# AMD 29K
327600	beshort		0572		amd 29k coff noprebar executable
327610	beshort		01572		amd 29k coff prebar executable
327620	beshort		0160007		amd 29k coff archive
32763# Cray
327646	beshort		0407		unicos (cray) executable
32765# Ultrix 4.3
32766596	string		\130\337\377\377	Ultrix core file
32767>600	string		>\0		from '%s'
32768# BeOS and MAcOS PEF executables
32769# From: hplus@zilker.net (Jon Watte)
327700	string		Joy!peffpwpc	header for PowerPC PEF executable
32771#
32772# ava assembler/linker Uros Platise <uros.platise@ijs.si>
327730       string          avaobj  AVR assembler object code
32774>7      string          >\0     version '%s'
32775# gnu gmon magic From: Eugen Dedu <dedu@ese-metz.fr>
327760	string		gmon		GNU prof performance data
32777>4	long		x		- version %d
32778# From: Dave Pearson <davep@davep.org>
32779# Harbour <URL:http://harbour-project.org/> HRB files.
327800	string		\xc0HRB		Harbour HRB file
32781>4	leshort		x		version %d
32782# Harbour HBV files
327830	string		\xc0HBV		Harbour variable dump file
32784>4	leshort		x		version %d
32785
32786# From: Alex Beregszaszi <alex@fsn.hu>
32787# 0	string		exec 		BugOS executable
32788# 0	string		pack		BugOS archive
32789
32790# From: Jason Spence <jspence@lightconsulting.com>
32791# Generated by the "examples" in STM's ST40 devkit, and derived code.
327920	lelong		0x13a9f17e	ST40 component image format
32793>4	string		>\0		\b, name '%s'
32794
32795#------------------------------------------------------------------------------
32796# $File: varied.script,v 1.13 2019/10/11 14:35:29 christos Exp $
32797# varied.script:  file(1) magic for various interpreter scripts
32798
327990	string/t		#!\ /			a
32800>3	string		>\0			%s script text executable
32801!:strength / 2
32802
328030	string/b		#!\ /			a
32804>3	string		>\0			%s script executable (binary data)
32805!:strength / 2
32806
328070	string/t		#!\t/			a
32808>3	string		>\0			%s script text executable
32809!:strength / 2
32810
328110	string/b		#!\t/			a
32812>3	string		>\0			%s script executable (binary data)
32813!:strength / 2
32814
328150	string/t		#!/			a
32816>2	string		>\0			%s script text executable
32817!:strength / 2
32818
328190	string/b		#!/			a
32820>2	string		>\0			%s script executable (binary data)
32821!:strength / 2
32822
328230	string/t		#!\ 			script text executable
32824>3	string		>\0			for %s
32825!:strength / 2
32826
328270	string/b		#!\ 			script executable
32828>3	string		>\0			for %s (binary data)
32829!:strength / 2
32830
32831# using env
328320	string/t	#!/usr/bin/env		a
32833>15	string/t	>\0			%s script text executable
32834!:strength / 10
32835
328360	string/b	#!/usr/bin/env		a
32837>15	string/b	>\0			%s script executable (binary data)
32838!:strength / 10
32839
328400	string/t	#!\ /usr/bin/env	a
32841>16	string/t	>\0			%s script text executable
32842!:strength / 10
32843
328440	string/b	#!\ /usr/bin/env	a
32845>16	string/b	>\0			%s script executable (binary data)
32846!:strength / 10
32847
32848# From: arno <arenevier@fdn.fr>
32849# mozilla xpconnect typelib
32850# see https://www.mozilla.org/scriptable/typelib_file.html
328510	string 		XPCOM\nTypeLib\r\n\032		XPConnect Typelib
32852>0x10  byte        x       version %d
32853>>0x11 byte        x      \b.%d
32854
32855#------------------------------------------------------------------------------
32856# $File: vax,v 1.10 2019/10/04 18:07:46 christos Exp $
32857# vax:  file(1) magic for VAX executable/object and APL workspace
32858#
328590	lelong		0101557		VAX single precision APL workspace
328600	lelong		0101556		VAX double precision APL workspace
32861
32862#
32863# VAX a.out (BSD; others collide with 386 and other 32-bit little-endian
32864# executables, and are handled in aout)
32865#
328660	lelong		0420		a.out VAX demand paged (first page unmapped) pure executable
32867>16	lelong		>0		not stripped
32868
32869#
32870# VAX COFF
32871#
32872# The `versions' were commented out, but have been un-commented out.
32873# (Was the problem just one of endianness?)
32874#
328750	leshort		0570
32876>2	uleshort	<100		VAX COFF executable, sections %d
32877>>4	ledate		x		\b, created %s
32878>>12	lelong		>0		\b, not stripped
32879>>22	leshort		>0		\b, version %d
32880
328810	leshort		0575
32882>2	uleshort	<100		VAX COFF pure executable, sections %d
32883>>4	ledate		x		\b, created %s
32884>>12	lelong		>0		\b, not stripped
32885>>22	leshort		>0		\b, version %d
32886
32887#------------------------------------------------------------------------------
32888# $File: vicar,v 1.4 2009/09/19 16:28:13 christos Exp $
32889# vicar:  file(1) magic for VICAR files.
32890#
32891# From: Ossama Othman <othman@astrosun.tn.cornell.edu
32892# VICAR is JPL's in-house spacecraft image processing program
32893# VICAR image
328940	string	LBLSIZE=	VICAR image data
32895>32	string	BYTE		\b, 8 bits  = VAX byte
32896>32	string	HALF		\b, 16 bits = VAX word     = Fortran INTEGER*2
32897>32	string	FULL		\b, 32 bits = VAX longword = Fortran INTEGER*4
32898>32	string	REAL		\b, 32 bits = VAX longword = Fortran REAL*4
32899>32	string	DOUB		\b, 64 bits = VAX quadword = Fortran REAL*8
32900>32	string	COMPLEX		\b, 64 bits = VAX quadword = Fortran COMPLEX*8
32901# VICAR label file
3290243	string	SFDU_LABEL	VICAR label file
32903
32904#------------------------------------------------------------------------------
32905# $File: virtual,v 1.13 2021/02/23 00:51:10 christos Exp $
32906# From: James Nobis <quel@quelrod.net>
32907# Microsoft hard disk images for:
32908# Virtual Server
32909# Virtual PC
32910# VirtualBox
32911# URL: http://fileformats.archiveteam.org/wiki/VHD_(Virtual_Hard_Disk)
32912# Reference: https://download.microsoft.com/download/f/f/e/ffef50a5-07dd-4cf8-aaa3-442c0673a029/
32913# Virtual%20Hard%20Disk%20Format%20Spec_10_18_06.doc
329140	string	connectix	Microsoft Disk Image, Virtual Server or Virtual PC
32915# alternative shorter names
32916#0	string	connectix	Microsoft Virtual Hard Disk image
32917#0	string	connectix	Microsoft Virtual HD image
32918!:mime	application/x-virtualbox-vhd
32919!:ext   vhd
32920# Features is a bit field used to indicate specific feature support
32921#>8	ubelong		!0x00000002	\b, Features 0x%x
32922# Reserved. This bit must always be set to 1.
32923#>8	ubelong		&0x00000002	\b, Reserved 0x%x
32924# File Format Version for the current specification 0x00010000
32925#>12	ubelong		!0x00010000	\b, Version 0x%8.8x
32926# Data Offset only found 0x200
32927#>16	ubequad		!0x200		\b, Data Offset 0x%llx
32928#>16	ubequad		x		\b, at 0x%llx
32929# Dynamic Disk Header cookie like cxsparse
32930#>(16.Q)	string		x		"%-.8s"
32931# This field contains a Unicode string (UTF-16) of the parent hard disk filename
32932#>(16.Q+64)	ubequad	x		\b, parent name 0x%llx
32933# Creator Application
32934# vpc~Microsoft Virtual PC, vs~Microsoft Virtual Server, vbox~VirtualBox, d2v~disk2vhd
32935>28	string		x		\b, Creator %-4.4s
32936# Creator Version: 0x00010000~Virtual Server 2004, 0x00050000~Virtual PC 2004
32937# holds the major/minor version of the application that created the image
32938>32	ubeshort	x		%x
32939>34	ubeshort	x		\b.%x
32940#>32	ubelong		x		\b, Version 0x%8.8x
32941# Creator Host OS: 0x5769326B~Windows (Wi2k), 0x4D616320~Macintosh (Mac)
32942>36	ubelong		x		(
32943>>36	ubelong		0x5769326B	\bW2k
32944>>36	ubelong		0x4D616320	\bMac
32945>>36	default		x		\b0x
32946>>>36	ubelong		x		\b%8.8x
32947# creation Time in seconds since 1 Jan 2000 UTC~946684800 sec. since Unix Epoch
32948>24	bedate+946684800	x	\b) %s
32949# Original Size
32950#>40	ubequad		x		\b, o.-Size 0x%llx
32951# Current Size is same as original size, but change when disk is expanded
32952#>48	ubequad		x		\b, Size 0x%llx
32953>48	ubequad		x		\b, %llu bytes
32954# Disk Geometry: cylinder, heads, and sectors/track for hard disk
32955#>56	ubeshort	x		\b, Cylinder 0x%x
32956>56	ubeshort	x		\b, CHS %u
32957# Heads
32958#>58	ubyte		x		\b, Heads 0x%x
32959>58	ubyte		x		\b/%u
32960# Sectors per track
32961#>59	ubyte		x		\b, Sectors 0x%x
32962>59	ubyte		x		\b/%u
32963# Disk Type: 3~Dynamic hard disk
32964>60	ubelong		!0x3		\b, type 0x%x
32965# Checksum
32966#>64	ubelong		x		\b, cksum 0x%x
32967# universally unique identifier (UUID) to associate a parent with its differencing image
32968#>68	ubequad		x		\b, id 0x%16.16llx
32969#>76	ubequad		x		\b-%16.16llx
32970# Saved State: 1~Saved State
32971>84	ubyte		!0		\b, State 0x%x
32972# Reserved 427 bytes with nils
32973#>85	ubequad	!0			\b, Reserved 0x%16.16llx
32974
32975# From: Joerg Jenderek
32976# URL: https://msdn.microsoft.com/en-us/library/mt740058.aspx
32977# Reference: https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/
32978# MS-VHDX/[MS-VHDX].pdf
32979# Note: extends the VHD format with new capabilities, such as a 16TB maximum size
32980# TODO:	find and display values like virtual size, disk size, cluster_size, etc
32981#	display id in GUID format
32982#
32983# VHDX_FILE_IDENTIFIER signature 0x656C696678646876
329840	string			vhdxfile
32985# VHDX_HEADER signature. 1 header is stored at offset 64KB and the other at 128KB
32986>0x10000	string		head		Microsoft Disk Image eXtended
32987#>0x20000	string			head	\b, 2nd header
32988#!:mime	application/x-virtualbox-vhdx
32989!:ext	vhdx
32990# Creator[256] like "QEMU v3.0.0", "Microsoft Windows 6.3.9600.18512"
32991>>8		lestring16		x	\b, by %.256s
32992# The Checksum field is a CRC-32C hash over the entire 4 KB structure
32993#>>0x10004	ulelong			x	\b, CRC 0x%x
32994# SequenceNumber
32995>>0x10008	ulequad			x	\b, sequence 0x%llx
32996# FileWriteGuid
32997#>>0x10010	ubequad			x	\b, file id 0x%llx
32998#>>>0x10018	ubequad			x	\b-%llx
32999# DataWriteGuid
33000#>>0x10020	ubequad			x	\b, data id 0x%llx
33001#>>>0x10028	ubequad			x	\b-%llx
33002# LogGuid. If this field is zero, then the log is empty or has no valid entries
33003>>0x10030	ubequad			>0	\b, log id 0x%llx
33004>>>0x10038	ubequad			x	\b-%llx
33005# LogVersion. If not 0 there is a log to replay
33006>>0x10040	uleshort		>0	\b, LogVersion 0x%x
33007# Version. This field must be set to 1
33008>>0x10042	uleshort		!1	\b, Version 0x%x
33009# LogLength must be multiples of 1 MB
33010>>0x10044	ulelong/1048576		>1	\b, LogLength %u MB
33011# LogOffset (normally 0x100000 when log direct after header); multiples of 1 MB
33012>>0x10048	ulequad			!0x100000 \b, LogOffset 0x%llx
33013# Log Entry Signature must be 0x65676F6C~loge
33014>>(0x10048.q)	ulelong			!0x65676F6C \b, NO Log Signature
33015>>(0x10048.q)	ulelong			=0x65676F6C	\b; LOG
33016# Log Entry Checksum
33017#>>>(0x10048.q+4)	ulelong		x	\b, Log CRC 0x%x
33018# Log Entry Length must be a multiple of 4 KB
33019>>>(0x10048.q+8)	ulelong/1024	>4	\b, EntryLength %u KB
33020# Log Entry Tail must be a multiple of 4 KB
33021#>>>(0x10048.q+12)	ulelong		x	\b, Tail 0x%x
33022# Log Entry SequenceNumber
33023#>>>(0x10048.q+16)	ulequad		x	\b, # 0x%llx
33024# Log Entry DescriptorCount may be zero. only 4 bytes in other docs instead 8
33025#>>>(0x10048.q+24)	ulelong		x	\b, DescriptorCount 0x%llx
33026# Log Entry Reserved must be set to 0
33027>>>(0x10048.q+28)	ulelong		!0	\b, Reserved 0x%x
33028# Log Entry LogGuid
33029#>>>(0x10048.q+32)	ubequad		x	\b, Log id 0x%llx
33030#>>>(0x10048.q+40)	ubequad		x	\b-%llx
33031# Log Entry FlushedFileOffset should VHDX size when entry is written.
33032#>>>(0x10048.q+48)	ulequad		x	\b, FlushedFileOffset %llu
33033# Log Entry LastFileOffset
33034#>>>(0x10048.q+56)	ulequad		x	\b, LastFileOffset %llu
33035# filling
33036#>>>(0x10048.q+64)	ulequad		>0	\b, filling %llx
33037# Reserved[4016]
33038#>>0x10050	ulequad			>0	\b, Reserved 0x%llx
33039# VHDX_REGION_TABLE_HEADER Signature 0x69676572~regi at offset 192 KB and 256 KB
33040>0x30000	ulelong			!0x69676572 \b, 1st region INVALID
33041>0x30000	ulelong			=0x69676572 \b; region
33042# region Checksum. CRC-32C hash over the entire 64-KB table
33043#>>0x30004	ulelong			x	\b, CRC 0x%x
33044# The EntryCount specifies number of valid entries; Found 2; This must be =< 2047.
33045>>0x30008	ulelong			x	\b, %u entries
33046# reserved must be zero
33047#>>0x3000C	ulelong			!0	\b, RESERVED 0x%x
33048# Region Table Entry starts with identifier for the object. often BAT id
33049>>0x30010	use			vhdx-id
33050# FileOffset
33051>>0x30020	ulequad		x		\b, at 0x%llx
33052# Length. Specifies the length of the object within the file
33053#>>0x30028	ulelong		x		\b, Length 0x%x
33054# 1 means region entry is required. if region not recognized, then REFUSE to load VHDX
33055>>0x3002C	ulelong		x		\b, Required %u
33056# 2nd region entry often metadata id
33057>>0x30030	use			vhdx-id
33058# 2nd entry FileOffset
33059>>0x30040	ulequad		x		\b, at 0x%llx
33060# 1 means region entry is required. if region not recognized, then REFUSE to load VHDX
33061>>0x3004C	ulelong		x		\b, Required %u
33062# 2nd region
33063>>0x40000	ulelong		!0x69676572	\b, 2nd region INVALID
33064# check in vhdx images for known id and show names instead hexadecimal
330650	name		vhdx-id
33066# https://www.windowstricks.in/online-windows-guid-converter
33067# 2DC27766-F623-4200-9D64-115E9BFD4A08		BAT GUID
33068# 6677C22D23F600429D64115E9BFD4A08		BAT ID
33069>0	ubequad		=0x6677C22D23F60042
33070>>8	ubequad		=0x9D64115E9BFD4A08	\b, id BAT
33071# no BAT id
33072>>8	default		x
33073>>>0	use		vhdx-id-hex
33074# 8B7CA206-4790-4B9A-B8FE-575F050F886E		Metadata region GUID
33075# 06A27C8B90479A4BB8FE575F050F886E		Metadata region ID
33076>0	ubequad		=0x06A27C8B90479A4B
33077>>8	ubequad		=0xB8FE575F050F886E	\b, id Metadata
33078# no Metadata id
33079>>8	default		x
33080>>>0	use		vhdx-id-hex
33081# 2FA54224-CD1B-4876-B211-5DBED83BF4B8		Virtual Disk Size GUID
33082# 2442A52F1BCD7648B2115DBED83BF4B8		Virtual Disk Size ID
33083# value "virtual size" can be verified by command `qemu-img info `
33084>0	ubequad		=0x2442A52F1BCD7648
33085>>8	ubequad		=0xB2115DBED83BF4B8	\b, id vsize
33086# no Virtual Disk Size ID
33087>>8	default		x
33088>>>0	use		vhdx-id-hex
33089# other ids
33090>0	default		x
33091>>0	use		vhdx-id-hex
33092# in vhdx images show id as hexadecimal
330930	name		vhdx-id-hex
33094>0	ubequad		x			\b, ID 0x%16.16llx
33095>8	ubequad		x			\b-%16.16llx
33096#
33097# libvirt
33098# From: Philipp Hahn <hahn@univention.de>
330990	string	LibvirtQemudSave	Libvirt QEMU Suspend Image
33100>0x10	lelong	x	\b, version %u
33101>0x14	lelong	x	\b, XML length %u
33102>0x18	lelong	1	\b, running
33103>0x1c	lelong	1	\b, compressed
33104
331050	string	LibvirtQemudPart	Libvirt QEMU partial Suspend Image
33106# From: Alex Beregszaszi <alex@fsn.hu>
331070	string/b	COWD		VMWare3
33108>4	byte	3		disk image
33109>>32	lelong	x		(%d/
33110>>36	lelong	x		\b%d/
33111>>40	lelong	x		\b%d)
33112>4	byte	2		undoable disk image
33113>>32	string	>\0		(%s)
33114
331150	string/b	VMDK		 VMware4 disk image
331160	string/b	KDMV		 VMware4 disk image
33117
33118#--------------------------------------------------------------------
33119# Qemu Emulator Images
33120# Lines written by Friedrich Schwittay (f.schwittay@yousable.de)
33121# Updated by Adam Buchbinder (adam.buchbinder@gmail.com)
33122# Made by reading sources, reading documentation, and doing trial and error
33123# on existing QCOW files
331240	string/b	QFI\xFB
33125
33126# Uncomment the following line to display Magic (only used for debugging
33127# this magic number)
33128#>0	string/b	x	, Magic: %s
33129
33130# There are currently 2 Versions: "1" and "2".
33131# https://www.gnome.org/~markmc/qcow-image-format-version-1.html
33132>4	belong		!1	QEMU QCOW2 Image
33133>4	belong		1	QEMU QCOW Image (v1)
33134
33135# Using the existence of the Backing File Offset to determine whether
33136# to read Backing File Information
33137>>12	belong	 >0	 \b, has backing file (
33138# Note that this isn't a null-terminated string; the length is actually
33139# (16.L). Assuming a null-terminated string happens to work usually, but it
33140# may spew junk until it reaches a \0 in some cases.
33141>>>(12.L)	 string >\0	\bpath %s
33142
33143# Modification time of the Backing File
33144# Really useful if you want to know if your backing
33145# file is still usable together with this image
33146>>>>20	bedate >0	\b, mtime %s)
33147>>>>20	default x	\b)
33148
33149# Size is stored in bytes in a big-endian u64.
33150>>24	bequad	x	 \b, %lld bytes
33151
33152# 1 for AES encryption, 0 for none.
33153>>36	belong	1	\b, AES-encrypted
33154
33155# https://www.gnome.org/~markmc/qcow-image-format.html
33156>4	belong	2	(v2)
33157# Using the existence of the Backing File Offset to determine whether
33158# to read Backing File Information
33159>>8	bequad  >0	 \b, has backing file
33160# Note that this isn't a null-terminated string; the length is actually
33161# (16.L). Assuming a null-terminated string happens to work usually, but it
33162# may spew junk until it reaches a \0 in some cases. Also, since there's no
33163# .Q modifier, we just use the bottom four bytes as an offset. Note that if
33164# the file is over 4G, and the backing file path is stored after the first 4G,
33165# the wrong filename will be printed. (This should be (8.Q), when that syntax
33166# is introduced.)
33167>>>(12.L)	 string >\0	(path %s)
33168>>24	bequad	x	\b, %lld bytes
33169>>32	belong	1	\b, AES-encrypted
33170
33171>4	belong	3	(v3)
33172# Using the existence of the Backing File Offset to determine whether
33173# to read Backing File Information
33174>>8	bequad  >0	 \b, has backing file
33175# Note that this isn't a null-terminated string; the length is actually
33176# (16.L). Assuming a null-terminated string happens to work usually, but it
33177# may spew junk until it reaches a \0 in some cases. Also, since there's no
33178# .Q modifier, we just use the bottom four bytes as an offset. Note that if
33179# the file is over 4G, and the backing file path is stored after the first 4G,
33180# the wrong filename will be printed. (This should be (8.Q), when that syntax
33181# is introduced.)
33182>>>(12.L)	 string >\0	(path %s)
33183>>24	bequad	x	\b, %lld bytes
33184>>32	belong	1	\b, AES-encrypted
33185
33186>4	default x	(unknown version)
33187
331880	string/b	QEVM		QEMU suspend to disk image
33189
33190# QEMU QED Image
33191# https://wiki.qemu.org/Features/QED/Specification
331920	string/b	QED\0		QEMU QED Image
33193
33194# VDI Image
33195# Sun xVM VirtualBox Disk Image
33196# From: Richard W.M. Jones <rich@annexia.org>
33197# VirtualBox Disk Image
331980x40	ulelong		0xbeda107f	VirtualBox Disk Image
33199>0x44	uleshort	>0		\b, major %u
33200>0x46	uleshort	>0		\b, minor %u
33201>0	string		>\0		(%s)
33202>368	lequad		x		 \b, %lld bytes
33203
332040	string/b	Bochs\ Virtual\ HD\ Image	Bochs disk image,
33205>32	string	x				type %s,
33206>48	string	x				subtype %s
33207
332080	lelong	0x02468ace			Bochs Sparse disk image
33209
33210
33211#------------------------------------------------------------------------------
33212# $File: virtutech,v 1.4 2009/09/19 16:28:13 christos Exp $
33213# Virtutech Compressed Random Access File Format
33214#
33215# From <gustav@virtutech.com>
332160      string          \211\277\036\203        Virtutech CRAFF
33217>4     belong          x               v%d
33218>20    belong          0               uncompressed
33219>20    belong          1               bzipp2ed
33220>20    belong          2               gzipped
33221>24    belong          0               not clean
33222
33223#------------------------------------------------------------------------------
33224# $File: visx,v 1.5 2009/09/19 16:28:13 christos Exp $
33225# visx:  file(1) magic for Visx format files
33226#
332270	short		0x5555		VISX image file
33228>2	byte		0		(zero)
33229>2	byte		1		(unsigned char)
33230>2	byte		2		(short integer)
33231>2	byte		3		(float 32)
33232>2	byte		4		(float 64)
33233>2	byte		5		(signed char)
33234>2	byte		6		(bit-plane)
33235>2	byte		7		(classes)
33236>2	byte		8		(statistics)
33237>2	byte		10		(ascii text)
33238>2	byte		15		(image segments)
33239>2	byte		100		(image set)
33240>2	byte		101		(unsigned char vector)
33241>2	byte		102		(short integer vector)
33242>2	byte		103		(float 32 vector)
33243>2	byte		104		(float 64 vector)
33244>2	byte		105		(signed char vector)
33245>2	byte		106		(bit plane vector)
33246>2	byte		121		(feature vector)
33247>2	byte		122		(feature vector library)
33248>2	byte		124		(chain code)
33249>2	byte		126		(bit vector)
33250>2	byte		130		(graph)
33251>2	byte		131		(adjacency graph)
33252>2	byte		132		(adjacency graph library)
33253>2	string		.VISIX		(ascii text)
33254
33255#------------------------------------------------------------------------------
33256# $File: vms,v 1.10 2017/03/17 21:35:28 christos Exp $
33257# vms:  file(1) magic for VMS executables (experimental)
33258#
33259# VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu)
33260
33261# GRR 950122:  I'm just guessing on these, based on inspection of the headers
33262# of three executables each for Alpha and VAX architectures.  The VAX files
33263# all had headers similar to this:
33264#
33265#   00000  b0 00 30 00 44 00 60 00  00 00 00 00 30 32 30 35  ..0.D.`.....0205
33266#   00010  01 01 00 00 ff ff ff ff  ff ff ff ff 00 00 00 00  ................
33267#
332680	string	\xb0\0\x30\0	VMS VAX executable
33269>44032	string	PK\003\004	\b, Info-ZIP SFX archive v5.12 w/decryption
33270#
33271# The AXP files all looked like this, except that the byte at offset 0x22
33272# was 06 in some of them and 07 in others:
33273#
33274#   00000  03 00 00 00 00 00 00 00  ec 02 00 00 10 01 00 00  ................
33275#   00010  68 00 00 00 98 00 00 00  b8 00 00 00 00 00 00 00  h...............
33276#   00020  00 00 07 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
33277#   00030  00 00 00 00 01 00 00 00  00 00 00 00 00 00 00 00  ................
33278#   00040  00 00 00 00 ff ff ff ff  ff ff ff ff 02 00 00 00  ................
33279#
33280# GRR this test is still too general as it catches example adressen.dbt
332810	belong	0x03000000
33282>8	ubelong	0xec020000	VMS Alpha executable
33283>>75264	string	PK\003\004	\b, Info-ZIP SFX archive v5.12 w/decryption
33284
33285#------------------------------------------------------------------------------
33286# $File: vmware,v 1.8 2017/03/17 21:35:28 christos Exp $
33287# VMware specific files (deducted from version 1.1 and log file entries)
33288# Anthon van der Neut (anthon@mnt.org)
332890	belong	0x4d52564e	VMware nvram
33290
33291#------------------------------------------------------------------------------
33292# $File: vorbis,v 1.26 2020/08/22 18:30:55 christos Exp $
33293# vorbis:  file(1) magic for Ogg/Vorbis files
33294#
33295# From Felix von Leitner <leitner@fefe.de>
33296# Extended by Beni Cherniavsky <cben@crosswinds.net>
33297# Further extended by Greg Wooledge <greg@wooledge.org>
33298#
33299# Most (everything but the number of channels and bitrate) is commented
33300# out with `##' as it's not interesting to the average user.  The most
33301# probable things advanced users would want to uncomment are probably
33302# the number of comments and the encoder version.
33303#
33304# FIXME: The first match has been made a search, so that it can skip
33305# over prepended ID3 tags. This will work for MIME type detection, but
33306# won't work for detecting other properties of the file (they all need
33307# to be made relative to the search). In any case, if the file has ID3
33308# tags, the ID3 information will be printed, not the Ogg information,
33309# so until that's fixed, this doesn't matter.
33310# FIXME[2]: Disable the above for now, since search assumes text mode.
33311#
33312# --- Ogg Framing ---
33313#0		search/1000	OggS		Ogg data
333140		string	OggS		Ogg data
33315>4		byte		!0		UNKNOWN REVISION %u
33316##>4		byte		0		revision 0
33317>4		byte		0
33318##>>14		lelong		x		(Serial %lX)
33319# non-Vorbis content: FLAC (Free Lossless Audio Codec, http://flac.sourceforge.net)
33320>>28		string		\x7fFLAC	\b, FLAC audio
33321# non-Vorbis content: Theora
33322!:mime		audio/ogg
33323>>28		string		\x80theora	\b, Theora video
33324!:mime		video/ogg
33325# non-Vorbis content: Kate
33326>>28		string		\x80kate\0\0\0\0	\b, Kate (Karaoke and Text)
33327!:mime		application/ogg
33328>>>37		ubyte		x		v%u
33329>>>38		ubyte		x		\b.%u,
33330>>>40		byte		0		utf8 encoding,
33331>>>40		byte		!0		unknown character encoding,
33332>>>60		string		>\0		language %s,
33333>>>60		string		\0		no language set,
33334>>>76		string		>\0		category %s
33335>>>76		string		\0		no category set
33336# non-Vorbis content: Skeleton
33337>>28		string		fishead\0	\b, Skeleton
33338!:mime		video/ogg
33339>>>36		leshort		x		v%u
33340>>>40		leshort		x		\b.%u
33341# non-Vorbis content: Speex
33342>>28		string		Speex\ \ \ 	\b, Speex audio
33343!:mime		audio/ogg
33344# non-Vorbis content: OGM
33345>>28		string		\x01video\0\0\0	\b, OGM video
33346!:mime		video/ogg
33347>>>37		string/c	div3		(DivX 3)
33348>>>37		string/c	divx		(DivX 4)
33349>>>37		string/c	dx50		(DivX 5)
33350>>>37		string/c	xvid		(XviD)
33351# --- First vorbis packet - general header ---
33352>>28		string		\x01vorbis	\b, Vorbis audio,
33353!:mime		audio/ogg
33354>>>35		lelong		!0		UNKNOWN VERSION %u,
33355##>>>35		lelong		0		version 0,
33356>>>35		lelong		0
33357>>>>39		ubyte		1		mono,
33358>>>>39		ubyte		2		stereo,
33359>>>>39		ubyte		>2		%u channels,
33360>>>>40		lelong		x		%u Hz
33361# Minimal, nominal and maximal bitrates specified when encoding
33362>>>>48		string		<\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff	\b,
33363# The above tests if at least one of these is specified:
33364>>>>>52		lelong		!-1
33365# Vorbis RC2 has a bug which puts -1000 in the min/max bitrate fields
33366# instead of -1.
33367# Vorbis 1.0 uses 0 instead of -1.
33368>>>>>>52	lelong		!0
33369>>>>>>>52	lelong		!-1000
33370>>>>>>>>52	lelong		x		<%u
33371>>>>>48		lelong		!-1
33372>>>>>>48	lelong		x		~%u
33373>>>>>44		lelong		!-1
33374>>>>>>44	lelong		!-1000
33375>>>>>>>44	lelong		!0
33376>>>>>>>>44	lelong		x		>%u
33377>>>>>48		string		<\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff	bps
33378# -- Second vorbis header packet - the comments
33379# A kludge to read the vendor string.  It's a counted string, not a
33380# zero-terminated one, so file(1) can't read it in a generic way.
33381# libVorbis is the only one existing currently, so I detect specifically
33382# it.  The interesting value is the cvs date (8 digits decimal).
33383# Post-RC1 Ogg files have the second header packet (and thus the version)
33384# in a different place, so we must use an indirect offset.
33385>>>(84.b+85)		string		\x03vorbis
33386>>>>(84.b+96)		string/c	Xiphophorus\ libVorbis\ I	\b, created by: Xiphophorus libVorbis I
33387>>>>>(84.b+120)		string		>00000000
33388# Map to beta version numbers:
33389>>>>>>(84.b+120)	string		<20000508	(<beta1, prepublic)
33390>>>>>>(84.b+120)	string		20000508	(1.0 beta 1 or beta 2)
33391>>>>>>(84.b+120)	string		>20000508
33392>>>>>>>(84.b+120)	string		<20001031	(beta2-3)
33393>>>>>>(84.b+120)	string		20001031	(1.0 beta 3)
33394>>>>>>(84.b+120)	string		>20001031
33395>>>>>>>(84.b+120)	string		<20010225	(beta3-4)
33396>>>>>>(84.b+120)	string		20010225	(1.0 beta 4)
33397>>>>>>(84.b+120)	string		>20010225
33398>>>>>>>(84.b+120)	string		<20010615	(beta4-RC1)
33399>>>>>>(84.b+120)	string		20010615	(1.0 RC1)
33400>>>>>>(84.b+120)	string		20010813	(1.0 RC2)
33401>>>>>>(84.b+120)	string		20010816	(RC2 - Garf tuned v1)
33402>>>>>>(84.b+120)	string		20011014	(RC2 - Garf tuned v2)
33403>>>>>>(84.b+120)	string		20011217	(1.0 RC3)
33404>>>>>>(84.b+120)	string		20011231	(1.0 RC3)
33405# Some pre-1.0 CVS snapshots still had "Xiphphorus"...
33406>>>>>>(84.b+120)	string		>20011231	(pre-1.0 CVS)
33407# For the 1.0 release, Xiphophorus is replaced by Xiph.Org
33408>>>>(84.b+96)		string/c	Xiph.Org\ libVorbis\ I	\b, created by: Xiph.Org libVorbis I
33409>>>>>(84.b+117)		string		>00000000
33410>>>>>>(84.b+117)	string		<20020717	(pre-1.0 CVS)
33411>>>>>>(84.b+117)	string		20020717	(1.0)
33412>>>>>>(84.b+117)	string		20030909	(1.0.1)
33413>>>>>>(84.b+117)	string		20040629	(1.1.0 RC1)
33414>>>>>>(84.b+117)	string		20050304	(1.1.2)
33415>>>>>>(84.b+117)	string		20070622	(1.2.0)
33416>>>>>>(84.b+117)	string		20090624	(1.2.2)
33417>>>>>>(84.b+117)	string		20090709	(1.2.3)
33418>>>>>>(84.b+117)	string		20100325	(1.3.1)
33419>>>>>>(84.b+117)	string		20101101	(1.3.2)
33420>>>>>>(84.b+117)	string		20120203	(1.3.3)
33421>>>>>>(84.b+117)	string		20140122	(1.3.4)
33422>>>>>>(84.b+117)	string		20150105	(1.3.5)
33423
33424# non-Vorbis content: Opus https://tools.ietf.org/html/rfc7845#section-5
33425>>28		string		OpusHead	\b, Opus audio,
33426!:mime		audio/ogg
33427>>>36		ubyte		>0x0F		UNKNOWN VERSION %u,
33428>>>36		ubyte&0x0F	!0		version 0.%u,
33429>>>>46		ubyte		>1
33430>>>>>46		ubyte		!255		unknown channel mapping family %u,
33431>>>>>37		ubyte		x		%u channels
33432>>>>46		ubyte		0
33433>>>>>37		ubyte		1		mono
33434>>>>>37		ubyte		2		stereo
33435>>>>46		ubyte		1
33436>>>>>37		ubyte		1		mono
33437>>>>>37		ubyte		2		stereo
33438>>>>>37		ubyte		3		linear surround
33439>>>>>37		ubyte		4		quadraphonic
33440>>>>>37		ubyte		5		5.0 surround
33441>>>>>37		ubyte		6		5.1 surround
33442>>>>>37		ubyte		7		6.1 surround
33443>>>>>37		ubyte		8		7.1 surround
33444>>>>40		lelong		!0		\b, %u Hz (Input Sample Rate)
33445#------------------------------------------------------------------------------
33446# $File: vxl,v 1.4 2009/09/19 16:28:13 christos Exp $
33447# VXL: file(1) magic for VXL binary IO data files
33448#
33449# from Ian Scott <scottim@sf.net>
33450#
33451# VXL is a collection of C++ libraries for Computer Vision.
33452# See the vsl chapter in the VXL Book for more info
33453# http://www.isbe.man.ac.uk/public_vxl_doc/books/vxl/book.html
33454# http:/vxl.sf.net
33455
334562	lelong	0x472b2c4e	VXL data file,
33457>0	leshort	>0		schema version no %d
33458
33459#------------------------------------------------------------------------------
33460# $File: warc,v 1.4 2019/04/19 00:42:27 christos Exp $
33461# warc:  file(1) magic for WARC files
33462
334630	string	WARC/	WARC Archive
33464>5	string	x	version %.4s
33465!:mime application/warc
33466
33467#------------------------------------------------------------------------------
33468# Arc File Format from Internet Archive
33469# see https://www.archive.org/web/researcher/ArcFileFormat.php
334700      string          filedesc://     Internet Archive File
33471!:mime application/x-ia-arc
33472>11    search/256      \x0A    \b
33473>>&0   ubyte   >0      \b version %c
33474
33475#------------------------------------------------------------------------------
33476# weak:  file(1) magic for very weak magic entries, disabled by default
33477#
33478# These entries are so weak that they might interfere identification of
33479# other formats. Example include:
33480# - Only identify for 1 or 2 bytes
33481# - Match against very wide range of values
33482# - Match against generic word in some spoken languages (e.g. English)
33483
33484# Summary: Computer Graphics Metafile
33485# Extension: .cgm
33486#0	beshort&0xffe0	0x0020		binary Computer Graphics Metafile
33487#0	beshort		0x3020		character Computer Graphics Metafile
33488
33489#0	string		=!!		Bennet Yee's "face" format
33490
33491#------------------------------------------------------------------------------
33492# $File: web,v 1.1 2020/05/17 19:14:28 christos Exp $
33493
33494# http://www.rdfhdt.org/
33495# From Christoph Biedl
33496# http://www.rdfhdt.org/hdt-internals/
33497# https://github.com/rdfhdt/hdt-cpp
33498
334990	string	$HDT\x01 HDT file (binary compressed indexed RDF triples) type 1
33500!:mime application/vnd.hdt
33501!:ext hdt
33502#------------------------------------------------------------------------------
33503# $File: webassembly,v 1.3 2019/04/19 00:42:27 christos Exp $
33504# webassembly:  file(1) magic for WebAssembly modules
33505#
33506# WebAssembly is a virtual architecture developed by a W3C Community
33507# Group at https://webassembly.org/. The file extension is .wasm, and
33508# the MIME type is application/wasm.
33509#
33510# https://webassembly.org/docs/binary-encoding/ is the main
33511# document describing the binary format.
33512# From: Pip Cet <pipcet@gmail.com> and Joel Martin
33513
335140	string	\0asm	WebAssembly (wasm) binary module
33515>4	lelong	=1	version %#x (MVP)
33516>4	lelong	>1	version %#x
33517
33518#------------------------------------------------------------------------------
33519# $File: windows,v 1.36 2021/02/05 22:29:07 christos Exp $
33520# windows:  file(1) magic for Microsoft Windows
33521#
33522# This file is mainly reserved for files where programs
33523# using them are run almost always on MS Windows 3.x or
33524# above, or files only used exclusively in Windows OS,
33525# where there is no better category to allocate for.
33526# For example, even though WinZIP almost run on Windows
33527# only, it is better to treat them as "archive" instead.
33528# For format usable in DOS, such as generic executable
33529# format, please specify under "msdos" file.
33530#
33531
33532
33533# Summary: Outlook Express DBX file
33534# Extension: .dbx
33535# Created by: Christophe Monniez
335360	string	\xCF\xAD\x12\xFE	MS Outlook Express DBX file
33537>4	byte	=0xC5			\b, message database
33538>4	byte	=0xC6			\b, folder database
33539>4	byte	=0xC7			\b, account information
33540>4	byte	=0x30			\b, offline database
33541
33542
33543# Summary: Windows crash dump
33544# Extension: .dmp
33545# Created by: Andreas Schuster (https://computer.forensikblog.de/)
33546# Reference (1): https://computer.forensikblog.de/en/2008/02/64bit_magic.html
33547# Modified by (1): Abel Cheung (Avoid match with first 4 bytes only)
335480	string		PAGE
33549>4	string		DUMP		MS Windows 32bit crash dump
33550>>0x05c	byte            0		\b, no PAE
33551>>0x05c	byte            1		\b, PAE
33552>>0xf88	lelong		1		\b, full dump
33553>>0xf88	lelong		2		\b, kernel dump
33554>>0xf88	lelong		3		\b, small dump
33555>>0x068	lelong		x		\b, %d pages
33556>4	string		DU64		MS Windows 64bit crash dump
33557>>0xf98	lelong		1		\b, full dump
33558>>0xf98	lelong		2		\b, kernel dump
33559>>0xf98	lelong		3		\b, small dump
33560>>0x090	lequad		x		\b, %lld pages
33561
33562
33563# Summary: Vista Event Log
33564# Extension: .evtx
33565# Created by: Andreas Schuster (https://computer.forensikblog.de/)
33566# Reference (1): https://computer.forensikblog.de/en/2007/05/some_magic.html
335670	string		ElfFile\0	MS Windows Vista Event Log
33568>0x2a	leshort		x		\b, %d chunks
33569>>0x10	lelong		x		\b (no. %d in use)
33570>0x18	lelong		>1		\b, next record no. %d
33571>0x18	lelong		=1		\b, empty
33572>0x78	lelong		&1		\b, DIRTY
33573>0x78	lelong		&2		\b, FULL
33574
33575# Summary: Windows System Deployment Image
33576# Created by: Joerg Jenderek
33577# URL: http://en.wikipedia.org/wiki/System_Deployment_Image
33578# Reference: http://skolk.livejournal.com/1320.html
335790	string			$SDI
33580>4	string			0001		System Deployment Image
33581!:mime	application/x-ms-sdi
33582#!:mime	application/octet-stream
33583# \Boot\boot.sdi
33584!:ext	sdi
33585# MDBtype: 0~Unspecified 1~RAM 2~ROM
33586>>8	ulequad			!0		\b, MDBtype 0x%llx
33587# BootCodeOffset
33588>>16	ulequad			!0		\b, BootCodeOffset 0x%llx
33589# BootCodeSize
33590>>24	ulequad			!0		\b, BootCodeSize 0x%llx
33591# VendorID
33592>>32	ulequad			!0		\b, VendorID 0x%llx
33593# DeviceID
33594>>40	ulequad			!0		\b, DeviceID 0x%llx
33595# DeviceModel
33596>>48	ulequad			!0		\b, DeviceModel 0x%llx
33597>>>56	ulequad			!0		\b%llx
33598# DeviceRole
33599>>64	ulequad			!0		\b, DeviceRole 0x%llx
33600# Reserved1; reserved fields and gaps between BLOBs are padded with \0
33601#>>72	ulequad			!0		\b, Reserved1 0x%llx
33602# RuntimeGUID
33603>>80	ulequad			!0		\b, RuntimeGUID 0x%llx
33604>>>88	ulequad			!0		\b%llx
33605# RuntimeOEMrev
33606>>96	ulequad			!0		\b, RuntimeOEMrev 0x%llx
33607# Reserved2
33608#>>104	ulequad			!0		\b, Reserved2 0x%llx
33609# BLOB alignment value in pages, as specified in sdimgr /pack: 1~4K 2~8k
33610>>112	ulequad			!0		\b, PageAlignment %llu
33611# Reserved3[48]
33612#>>120	ulequad			!0		\b, Reserved3 0x%llx
33613# SDI checksum 39h
33614>>0x1f8	ulequad			x		\b, checksum 0x%llx
33615# BLOBtype[8] \0-padded: PART, WIM , BOOT, LOAD, DISK
33616>>0x400	string			>\0		\b, type %-3.8s
33617# 0~non-filesystem 7~NTFS 6~BIGFAT
33618>>>0x420	ulequad		!0		(0x%llx)
33619# ATTRibutes
33620>>>0x408	ulequad		!0		0x%llx attributes
33621# Offset
33622>>>0x410	ulequad		x		at 0x%llx
33623# print 1 space after size and then handles NTFS boot sector by ./filesystems
33624>>>0x418	ulequad		>0		%llu bytes
33625>>>>(0x410.l)	indirect	x
33626# 2nd BLOB: WIM
33627>>0x440		string		>\0		\b, type %-3.8s
33628>>>0x428	ulequad		!0		(0x%llx)
33629# ATTRibutes
33630>>>0x448	ulequad		!0		0x%llx attributes
33631# Offset
33632>>>0x450	ulequad		x		at 0x%llx
33633>>>0x458	ulequad		>0		%llu bytes
33634>>>>(0x450.l)	indirect	x
33635# 3rd BLOB
33636>>0x480		string		>\0		\b, type %-3.8s
33637
33638# Summary:	Windows boot status log BOOTSTAT.DAT
33639# From:		Joerg Jenderek
33640# Reference:	https://www.geoffchappell.com/notes/windows/boot/bsd.htm
33641# Note:		mainly refers to older Windows Vista, sometimes
33642#		BOOTSTAT.DAT only contains nulls or invalid data
33643# checking for valid version below 5
336440		ulelong		<5
33645# skip many ISO images by checking for valid 64 KiB file size
33646>8		ulelong		=0x00010000
33647>>0		use		bootstat-dat
33648# display information of BOOTSTAT.DAT
336490	name		bootstat-dat
33650>0		ulelong		x		Windows boot log
33651#!:mime	application/octet-stream
33652!:mime	application/x-ms-dat
33653# BOOTSTAT.DAT in BOOT subdirectory
33654!:ext	dat
33655# apparently a version number: 2 for older like Vista, 3, 4 Windows 10
33656>0		ulelong		>2		\b, version %u
33657# apparently the size of the header: often 10h in older Windows, 14h, 18h
33658>4		ulelong		!0x10		\b, header size 0x%x
33659#>4		ulelong		!0x10		\b, header size %u
33660# apparently the size of the file: always 0x00010000~64KiB
33661# the file is acceptable to BOOTMGR only if it is exactly 64 KiB
33662>8		ulelong		!0x00010000	\b, file size 0x%x
33663# size of valid data, in bytes: C8h 50h 172h 5D5Ch
33664>0xc		ulelong		x		\b, 0x%x valid bytes
33665# skip header and jump to first bootstat entry and display information
33666>(0x4.l-1)	ubyte		x
33667>>&0		use		bootstat-entry
33668# jump to first entry again because pointer are bad after "use"
33669>(0x4.l-1)	ubyte		x
33670# by 1st entry size jump to 2nd entry and display information
33671>>&(&0x18.l-1)	ubyte		x
33672>>>&0		use		bootstat-entry
33673# jump to possible 3rd boot entry and display information
33674# >(0x4.l-1)	ubyte		x
33675# >>&(&0x18.l-1)	ubyte		x
33676# >>>&(&0x18.l-1)	ubyte		x
33677# >>>>&0		use		bootstat-entry
33678#	display BOOTSTAT.DAT entry
336790	name		bootstat-entry
33680#>0x00		ubequad		x		\b, ENTRY %16.16llx
33681# size of entry, in bytes: 40h(init) 78h(launced) 9Ch
33682#>0x18		ulelong		x		\b; entry size %u
33683>0x18		ulelong		x		\b; entry size 0x%x
33684# time stamp, in seconds
33685>0x00		ulelong		x		\b, 0x%x seconds
33686# always zero, significance unknown
33687>0x04		ulelong		!0		\b, not null %u
33688# GUID of event source; but empty if event source is BOOTMGR
33689>0x08		ubequad		!0		\b, GUID 0x%16.16llx
33690>>0x10		ubequad		x		\b%16.16llx
33691# severity code: 1~informational 3~errors
33692>0x1C		ulelong		!1		\b, severity 0x%x
33693# apparently a version number: 2
33694>0x20		ulelong		!2		\b, version %u
33695# event identifier 1~log file initialised 11h~boot application launched
33696#>0x24		ulelong		x		\b, event 0x%x
33697>0x24		ulelong		!1
33698>>0x24		ulelong		!0x11		\b, event 0x%x
33699# entry data; size depends on event identifier
33700#>0x28		ubequad		x		\b, data 0x%16.16llx
33701>0x24		ulelong		=0x1		\b, Init
33702# always 0, significance unknown
33703>>0x34		uleshort	!0		\b, not null %u
33704# always 7, significance unknown
33705>>0x36		uleshort	!7		\b, not seven %u
33706# year
33707>>0x28		uleshort	x		%u
33708# month
33709>>0x2A		uleshort	x		\b-%u
33710# day
33711>>0x2C		uleshort	x		\b-%u
33712# hour
33713>>0x2E		uleshort	x		%u
33714# minute
33715>>0x30		uleshort	x		\b:%u
33716# second
33717>>0x32		uleshort	x		\b:%u
33718# boot application launched
33719>0x24		ulelong		=0x11		\b, launched
33720# type of start: 0 normally, 1 or 2 maybe in a recovery sequence
33721>>0x38		uleshort	!0		\b, type %u
33722# pathname of boot application, as null-terminated Unicode string; typically
33723# \Windows\system32\winload.exe \Windows\system32\winload.efi
33724>>0x3C		lestring16	x		%s
33725
33726# Summary:	Windows Error Report text files
33727# URL:		https://en.wikipedia.org/wiki/Windows_Error_Reporting
33728# Reference:	https://www.nirsoft.net/utils/app_crash_view.html
33729# Created by:	Joerg Jenderek
33730# Note:		in directories	%ProgramData%\Microsoft\Windows\WER\{ReportArchive,ReportQueue}
33731#				%LOCALAPPDATA%\Microsoft\Windows\WER\{ReportArchive,ReportQueue}
337320	lestring16	Version=
33733>22	lestring16	EventType	Windows Error Report
33734!:mime	text/plain
33735# Report.wer
33736!:ext	wer
33737
33738# Summary: Windows 3.1 group files
33739# Extension: .grp
33740# Created by: unknown
337410	string		\120\115\103\103	MS Windows 3.1 group files
33742
33743
33744# Summary: Old format help files
33745# URL: https://en.wikipedia.org/wiki/WinHelp
33746# Reference: https://www.oocities.org/mwinterhoff/helpfile.htm
33747# Update: Joerg Jenderek
33748# Created by: Dirk Jagdmann <doj@cubic.org>
33749#
33750# check and then display version and date inside MS Windows HeLP file fragment
337510	name				help-ver-date
33752# look for Magic of SYSTEMHEADER
33753>0	leshort		0x036C
33754# version Major		1 for right file fragment
33755>>4	leshort		1		Windows
33756# print non empty string above to avoid error message
33757# Warning: Current entry does not yet have a description for adding a MIME type
33758!:mime	application/winhelp
33759!:ext	hlp
33760# version Minor of help file format is hint for windows version
33761>>>2	leshort		0x0F		3.x
33762>>>2	leshort		0x15		3.0
33763>>>2	leshort		0x21		3.1
33764>>>2	leshort		0x27		x.y
33765>>>2	leshort		0x33		95
33766>>>2	default		x		y.z
33767>>>>2	leshort		x		0x%x
33768# to complete message string like "MS Windows 3.x help file"
33769>>>2	leshort		x		help
33770# GenDate often older than file creation date
33771>>>6	ldate		x		\b, %s
33772#
33773# Magic for HeLP files
337740	lelong		0x00035f3f
33775# ./windows (version 5.25) labeled the entry as "MS Windows 3.x help file"
33776# file header magic 0x293B at DirectoryStart+9
33777>(4.l+9)	uleshort	0x293B		MS
33778# look for @VERSION	bmf.. like IBMAVW.ANN
33779>>0xD4		string	=\x62\x6D\x66\x01\x00	Windows help annotation
33780!:mime	application/x-winhelp
33781!:ext	ann
33782>>0xD4		string	!\x62\x6D\x66\x01\x00
33783# "GID Help index" by TrID
33784>>>(4.l+0x65)	string	=|Pete			Windows help Global Index
33785!:mime	application/x-winhelp
33786!:ext	gid
33787# HeLP Bookmark or
33788# "Windows HELP File" by TrID
33789>>>(4.l+0x65)		string		!|Pete
33790# maybe there exist a cleaner way to detect HeLP fragments
33791# brute search for Magic 0x036C with matching Major maximal 7 iterations
33792# discapp.hlp
33793>>>>16			search/0x49AF/s	\x6c\x03
33794>>>>>&0			use 		help-ver-date
33795>>>>>&4			leshort		!1
33796# putty.hlp
33797>>>>>>&0		search/0x69AF/s	\x6c\x03
33798>>>>>>>&0		use 		help-ver-date
33799>>>>>>>&4		leshort		!1
33800>>>>>>>>&0		search/0x49AF/s	\x6c\x03
33801>>>>>>>>>&0		use 		help-ver-date
33802>>>>>>>>>&4		leshort		!1
33803>>>>>>>>>>&0		search/0x49AF/s	\x6c\x03
33804>>>>>>>>>>>&0		use 		help-ver-date
33805>>>>>>>>>>>&4		leshort		!1
33806>>>>>>>>>>>>&0		search/0x49AF/s	\x6c\x03
33807>>>>>>>>>>>>>&0		use 		help-ver-date
33808>>>>>>>>>>>>>&4		leshort		!1
33809>>>>>>>>>>>>>>&0	search/0x49AF/s	\x6c\x03
33810>>>>>>>>>>>>>>>&0	use 		help-ver-date
33811>>>>>>>>>>>>>>>&4	leshort		!1
33812>>>>>>>>>>>>>>>>&0	search/0x49AF/s	\x6c\x03
33813# GCC.HLP is detected after 7 iterations
33814>>>>>>>>>>>>>>>>>&0	use 		help-ver-date
33815# this only happens if bigger hlp file is detected after used search iterations
33816>>>>>>>>>>>>>>>>>&4	leshort		!1		Windows y.z help
33817!:mime	application/winhelp
33818!:ext	hlp
33819# repeat search again or following default line does not work
33820>>>>16			search/0x49AF/s	\x6c\x03
33821# remaining files should be HeLP Bookmark WinHlp32.BMK (XP 32-bit) or WinHlp32 (Windows 8.1 64-bit)
33822>>>>16	default				x	Windows help Bookmark
33823!:mime	application/x-winhelp
33824!:ext	bmk
33825## FirstFreeBlock normally FFFFFFFFh 10h for *ANN
33826##>>8	lelong			x		\b, FirstFreeBlock 0x%8.8x
33827# EntireFileSize
33828>>12	lelong			x		\b, %d bytes
33829## ReservedSpace normally 042Fh AFh for *.ANN
33830#>>(4.l)	lelong		x		\b, ReservedSpace 0x%8.8x
33831## UsedSpace normally 0426h A6h for *.ANN
33832#>>(4.l+4)	lelong		x		\b, UsedSpace 0x%8.8x
33833## FileFlags normally 04...
33834#>>(4.l+5)	lelong		x		\b, FileFlags 0x%8.8x
33835## file header magic 0x293B
33836#>>(4.l+9)	uleshort	x		\b, file header magic 0x%4.4x
33837## file header Flags		0x0402
33838#>>(4.l+11)	uleshort	x		\b, file header Flags 0x%4.4x
33839## file header PageSize	0400h 80h for *.ANN
33840#>>(4.l+13)	uleshort	x		\b, PageSize 0x%4.4x
33841## Structure[16]		z4
33842#>>(4.l+15)	string		>\0		\b, Structure_"%-.16s"
33843## MustBeZero			0
33844#>>(4.l+31)	uleshort	x		\b, MustBeZero 0x%4.4x
33845## PageSplits
33846#>>(4.l+33)	uleshort	x		\b, PageSplits 0x%4.4x
33847## RootPage
33848#>>(4.l+35)	uleshort	x		\b, RootPage 0x%4.4x
33849## MustBeNegOne			0xffff
33850#>>(4.l+37)	uleshort	x		\b, MustBeNegOne 0x%4.4x
33851## TotalPages			1
33852#>>(4.l+39)	uleshort	x		\b, TotalPages 0x%4.4x
33853## NLevels			0x0001
33854#>>(4.l+41)	uleshort	x		\b, NLevels 0x%4.4x
33855## TotalBtreeEntries
33856#>>(4.l+43)	ulelong		x		\b, TotalBtreeEntries 0x%8.8x
33857## pages of the B+ tree
33858#>>(4.l+47)	ubequad		x		\b, PageStart 0x%16.16llx
33859
33860# start with colon or semicolon for comment line like Back2Life.cnt
338610		regex		\^(:|;)
33862# look for first keyword Base
33863>0		search/45	:Base
33864>>&0				use 		cnt-name
33865# only solution to search again from beginning , because relative offsets changes when use is called
33866>0		search/45	:Base
33867>0		default		x
33868# look for other keyword Title like in putty.cnt
33869>>0		search/45	:Title
33870>>>&0				use 		cnt-name
33871#
33872# display mime type and name of Windows help Content source
338730	name				cnt-name
33874# skip space at beginning
33875>0     string		\040
33876# name without extension and greater character or name with hlp extension
33877>>1	regex/c		\^([^\xd>]*|.*\.hlp)	MS Windows help file Content, based "%s"
33878!:mime	text/plain
33879!:apple	????TEXT
33880!:ext	cnt
33881#
33882# Windows creates a full text search from hlp file, if the user clicks the "Find" tab and enables keyword indexing
338830	string		tfMR			MS Windows help Full Text Search index
33884!:mime application/x-winhelp-fts
33885!:ext	fts
33886>16	string		>\0			for "%s"
33887
33888# Summary: Hyper terminal
33889# Extension: .ht
33890# Created by: unknown
338910	string		HyperTerminal\040
33892>15	string		1.0\ --\ HyperTerminal\ data\ file	MS Windows HyperTerminal profile
33893
33894# https://ithreats.files.wordpress.com/2009/05/\040
33895# lnk_the_windows_shortcut_file_format.pdf
33896# Summary: Windows shortcut
33897# Extension: .lnk
33898# Created by: unknown
33899# 'L' + GUUID
339000	string		\114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106	MS Windows shortcut
33901>20	lelong&1	1	\b, Item id list present
33902>20	lelong&2	2	\b, Points to a file or directory
33903>20	lelong&4	4	\b, Has Description string
33904>20	lelong&8	8	\b, Has Relative path
33905>20	lelong&16	16	\b, Has Working directory
33906>20	lelong&32	32	\b, Has command line arguments
33907>20	lelong&64	64	\b, Icon
33908>>56	lelong		x	\b number=%d
33909>24	lelong&1	1	\b, Read-Only
33910>24	lelong&2	2	\b, Hidden
33911>24	lelong&4	4	\b, System
33912>24	lelong&8	8	\b, Volume Label
33913>24	lelong&16	16	\b, Directory
33914>24	lelong&32	32	\b, Archive
33915>24	lelong&64	64	\b, Encrypted
33916>24	lelong&128	128	\b, Normal
33917>24	lelong&256	256	\b, Temporary
33918>24	lelong&512	512	\b, Sparse
33919>24	lelong&1024	1024	\b, Reparse point
33920>24	lelong&2048	2048	\b, Compressed
33921>24	lelong&4096	4096	\b, Offline
33922>28	leqwdate	x	\b, ctime=%s
33923>36	leqwdate	x	\b, mtime=%s
33924>44	leqwdate	x	\b, atime=%s
33925>52	lelong		x	\b, length=%u, window=
33926>60	lelong&1	1	\bhide
33927>60	lelong&2	2	\bnormal
33928>60	lelong&4	4	\bshowminimized
33929>60	lelong&8	8	\bshowmaximized
33930>60	lelong&16	16	\bshownoactivate
33931>60	lelong&32	32	\bminimize
33932>60	lelong&64	64	\bshowminnoactive
33933>60	lelong&128	128	\bshowna
33934>60	lelong&256	256	\brestore
33935>60	lelong&512	512	\bshowdefault
33936#>20	lelong&1	0
33937#>>20	lelong&2	2
33938#>>>(72.l-64)	pstring/h	x	\b [%s]
33939#>20	lelong&1	1
33940#>>20	lelong&2	2
33941#>>>(72.s)	leshort	x
33942#>>>&75	pstring/h	x	\b [%s]
33943
33944# Summary: Outlook Personal Folders
33945# Created by: unknown
339460	lelong		0x4E444221	Microsoft Outlook email folder
33947>10	leshort		0x0e		(<=2002)
33948>10	leshort		0x17		(>=2003)
33949
33950
33951# Summary: Windows help cache
33952# Created by: unknown
339530	string		\164\146\115\122\012\000\000\000\001\000\000\000	MS Windows help cache
33954
33955
33956# Summary: IE cache file
33957# Created by: Christophe Monniez
339580	string	Client\ UrlCache\ MMF 	Internet Explorer cache file
33959>20	string	>\0			version %s
33960
33961
33962# Summary: Registry files
33963# Created by: unknown
33964# Modified by (1): Joerg Jenderek
339650	string		regf		MS Windows registry file, NT/2000 or above
339660	string		CREG		MS Windows 95/98/ME registry file
339670	string		SHCC3		MS Windows 3.1 registry file
33968
33969
33970# Summary: Windows Registry text
33971# URL: https://en.wikipedia.org/wiki/Windows_Registry#.REG_files
33972# Reference: http://fileformats.archiveteam.org/wiki/Windows_Registry
33973# Submitted by: Abel Cheung <abelcheung@gmail.com>
33974# Update: Joerg Jenderek
33975#		Windows 3-9X variant
339760	string		REGEDIT
33977# skip ASCII text like "REGEDITor.txt" but match
33978# L1WMAP.REG with only 1 CRNL or org.gnome.gnumeric.reg with 2 NL
33979>7	search/3	\n			Windows Registry text
33980!:mime	text/x-ms-regedit
33981!:ext	reg
33982#		Windows 9X variant
33983>>0	string		REGEDIT4		(Win95 or above)
33984#		Windows 2K ANSI variant
339850	string		Windows\ Registry\ Editor\
33986>&0	string		Version\ 5.00\r\n\r\n	Windows Registry text (Win2K or above)
33987!:mime	text/x-ms-regedit
33988!:ext	reg
33989#		Windows 2K UTF-16 variant
339902	lestring16	Windows\ Registry\ Editor\
33991>0x32	lestring16	Version\ 5.00\r\n\r\n	Windows Registry little-endian text (Win2K or above)
33992# relative offset not working
33993#>&0	lestring16	Version\ 5.00\r\n\r\n	Windows Registry little-endian text (Win2K or above)
33994!:mime	text/x-ms-regedit
33995!:ext	reg
33996#		WINE variant
33997# URL: https://en.wikipedia.org/wiki/Wine_(software)
33998# Reference: https://www.winehq.org/pipermail/wine-cvs/2005-October/018763.html
33999# Note:	WINE use text based registry (system.reg,user.reg,userdef.reg)
34000#	instead binary hiv structure like Windows
340010	string	WINE\ REGISTRY\ Version\ 	WINE registry text
34002# version 2
34003>&0	string	x				\b, version %s
34004!:mime	text/x-wine-extension-reg
34005!:ext	reg
34006
34007# Windows *.INF *.INI files updated by Joerg Jenderek at Apr 2013, Feb 2018
34008# empty ,comment , section
34009# PR/383: remove unicode BOM because it is not portable across regex impls
34010#0	regex/s		\\`(\\r\\n|;|[[])
34011# empty line CRLF
340120	ubeshort	0x0D0A
34013>0	use		ini-file
34014# comment line
340150	string		;
34016>0	use		ini-file
34017# section line
340180	string		[
34019>0	use		ini-file
34020# check and then display Windows INItialization configuration
340210	name		ini-file
34022# look for left bracket in section line
34023>0	search/8192	[
34024# https://en.wikipedia.org/wiki/Autorun.inf
34025# https://msdn.microsoft.com/en-us/library/windows/desktop/cc144200.aspx
34026# space after right bracket
34027# or AutoRun.Amd64 for 64 bit systems
34028# or only NL separator
34029>>&0	regex/c		\^(autorun)
34030# but sometimes total commander directory tree file "treeinfo.wc" with lines like
34031# [AUTORUN]
34032# [boot]
34033>>>&0	string		=]\r\n[					Total commander directory treeinfo.wc
34034!:mime text/plain
34035!:ext	wc
34036# From: Pal Tamas <folti@balabit.hu>
34037# Autorun File
34038>>>&0	string		!]\r\n[					Microsoft Windows Autorun file
34039!:mime application/x-setupscript
34040!:ext	inf
34041# https://msdn.microsoft.com/en-us/library/windows/hardware/ff549520(v=vs.85).aspx
34042# version strings ASCII coded case-independent for Windows setup information script file
34043>>&0	regex/c		\^(version|strings)]				Windows setup INFormation
34044!:mime	application/x-setupscript
34045#!:mime application/x-wine-extension-inf
34046!:ext	inf
34047# NETCRC.INF OEMCPL.INF
34048>>&0	regex/c		\^(WinsockCRCList|OEMCPL)]			Windows setup INFormation
34049!:mime	application/x-setupscript
34050!:ext	inf
34051# http://www.winfaq.de/faq_html/Content/tip2500/onlinefaq.php?h=tip2653.htm
34052# https://msdn.microsoft.com/en-us/library/windows/desktop/cc144102.aspx
34053# .ShellClassInfo DeleteOnCopy LocalizedFileNames ASCII coded case-independent
34054>>&0	regex/c	\^(\.ShellClassInfo|DeleteOnCopy|LocalizedFileNames)]	Windows desktop.ini
34055!:mime application/x-wine-extension-ini
34056#!:mime text/plain
34057# https://support.microsoft.com/kb/84709/
34058>>&0	regex/c		\^(don't\ load)]				Windows CONTROL.INI
34059!:mime application/x-wine-extension-ini
34060!:ext	ini
34061>>&0	regex/c		\^(ndishlp\\$|protman\\$|NETBEUI\\$)]		Windows PROTOCOL.INI
34062!:mime application/x-wine-extension-ini
34063!:ext	ini
34064# https://technet.microsoft.com/en-us/library/cc722567.aspx
34065# http://www.winfaq.de/faq_html/Content/tip0000/onlinefaq.php?h=tip0137.htm
34066>>&0	regex/c		\^(windows|Compatibility|embedding)]		Windows WIN.INI
34067!:mime application/x-wine-extension-ini
34068!:ext	ini
34069# https://en.wikipedia.org/wiki/SYSTEM.INI
34070>>&0	regex/c		\^(boot|386enh|drivers)]			Windows SYSTEM.INI
34071!:mime application/x-wine-extension-ini
34072!:ext	ini
34073# http://www.mdgx.com/newtip6.htm
34074>>&0	regex/c		\^(SafeList)]					Windows IOS.INI
34075!:mime application/x-wine-extension-ini
34076!:ext	ini
34077# https://en.wikipedia.org/wiki/NTLDR	Windows Boot Loader information
34078>>&0	regex/c		\^(boot\x20loader)]				Windows boot.ini
34079!:mime application/x-wine-extension-ini
34080!:ext	ini
34081# https://en.wikipedia.org/wiki/CONFIG.SYS
34082>>&0	regex/c		\^(menu)]					MS-DOS CONFIG.SYS
34083# @CONFIG.UI configuration file of previous DOS version saved by Caldera OPENDOS INSTALL.EXE
34084# CONFIG.PSS saved version of file CONFIG.SYS created by %WINDIR%\SYSTEM\MSCONFIG.EXE
34085# CONFIG.TSH renamed file CONFIG.SYS.BAT by %WINDIR%\SYSTEM\MSCONFIG.EXE
34086# dos and w40 used in dual booting scene
34087!:ext	sys/dos/w40
34088# https://support.microsoft.com/kb/118579/
34089>>&0	regex/c		\^(Paths)]\r\n					MS-DOS MSDOS.SYS
34090!:ext	sys/dos
34091# http://chmspec.nongnu.org/latest/INI.html#HHP
34092>>&0	regex/c		\^(options)]\r\n				Microsoft HTML Help Project
34093!:mime text/plain
34094!:ext	hhp
34095# From:		Joerg Jenderek
34096# URL:		https://documentation.basis.com/BASISHelp/WebHelp/b3odbc/obdcdriv_character_translation.htm
34097# Reference:	https://www.garykessler.net/library/file_sigs.html
34098# Note:		stored in directory %WINDIR%\SysWOW64 or %WINDIR%\system
34099>>&0	regex/c		\^(Windows\ Latin)				Windows codepage translator
34100!:mime	text/plain
34101!:ext	cpx
34102# unknown keyword after opening bracket
34103>>&0	default				x
34104#>>>&0	string/c			x	UNKNOWN [%s
34105# look for left bracket of second section
34106>>>&0	search/8192			[
34107# version Strings FileIdentification
34108>>>>&0	string/c			version				Windows setup INFormation
34109!:mime application/x-setupscript
34110!:ext	inf
34111# https://en.wikipedia.org/wiki/Initialization_file	Windows Initialization File or other
34112>>>>&0	default				x
34113>>>>>&0	ubyte				x
34114# characters, digits, underscore and white space followed by right bracket
34115# terminated by CR implies section line to skip BOOTLOG.TXT DETLOG.TXT
34116>>>>>>&-1	regex/T			\^([A-Za-z0-9_\(\)\ ]+)\]\r	Generic INItialization configuration [%-.40s
34117# NETDEF.INF multiarc.ini
34118#!:mime	application/x-setupscript
34119!:mime	application/x-wine-extension-ini
34120#!:mime	text/plain
34121!:ext	ini/inf
34122# UTF-16 BOM followed by CR~0D00 , comment~semicolon~3B00 , section~bracket~5B00
341230	ubelong&0xFFff89FF	=0xFFFE0900
34124# look for left bracket in section line
34125>2	search/8192		[
34126# keyword without 1st letter which is maybe up-/down-case
34127>>&3	lestring16		ersion]			Windows setup INFormation
34128!:mime	application/x-setupscript
34129!:ext	inf
34130>>&3	lestring16		trings]			Windows setup INFormation
34131!:mime	application/x-setupscript
34132!:ext	inf
34133>>&3	lestring16		ourceDisksNames]	Windows setup INFormation
34134!:mime	application/x-setupscript
34135!:ext	inf
34136# netnwcli.inf start with ;---[ NetNWCli.INX ]
34137>>&3	default			x
34138# look for NL followed by left bracket
34139>>>&0	search/8192		\x0A\x00\x5b
34140>>>>&3	lestring16		ersion]			Windows setup INFormation
34141!:mime	application/x-setupscript
34142!:ext	inf
34143
34144# Windows Precompiled INF files *.PNF added by Joerg Jenderek at Mar 2013 of _PNF_HEADER inf.h
34145# http://read.pudn.com/downloads3/sourcecode/windows/248345/win2k/private/windows/setup/setupapi/inf.h__.htm
34146# URL:		http://fileformats.archiveteam.org/wiki/INF_(Windows)
34147# Reference:	http://en.verysource.com/code/10350344_1/inf.h.html
34148# Note:		stored in %Windir%\Inf %Windir%\System32\DriverStore\FileRepository
34149# check for valid major and minor versions: 101h - 303h
341500		leshort&0xFcFc	=0x0000
34151# GRR: line above (strength 50) is too general as it catches also "PDP-11 UNIX/RT ldp" ./pdp
34152>0		leshort&0x0303	!0x0000
34153# test for valid InfStyles: 1 2
34154>>2		uleshort	>0
34155>>>2		uleshort	<3
34156# look for colon in WinDirPath after PNF header
34157#>>>>0x59	search/18	:
34158>>>>0	use	PreCompiledInf
341590	name	PreCompiledInf
34160>0		uleshort	x	Windows Precompiled iNF
34161!:mime	application/x-pnf
34162!:ext	pnf
34163# major version 1 for older Windows like XP and 3 since about Windows Vista
34164# 101h~98-XP; 301h~Windows Vista-7 ; 302h~Windows 10 14393; 303h~Windows 10 18362
34165>1		ubyte		x		\b, version %u
34166>0		ubyte		x		\b.%u
34167>0		uleshort	=0x0101		(Windows
34168>>4	ulelong&0x00000001	!0x00000001	98)
34169>>4	ulelong&0x00000001	=0x00000001	XP)
34170>0		uleshort	=0x0301		(Windows Vista-8.1)
34171>0		uleshort	=0x0302		(Windows 10 older)
34172>0		uleshort	=0x0303		(Windows 10)
34173# 1 ,2 (windows 98 SE)
34174>2		uleshort	!2		\b, InfStyle %u
34175#	PNF_FLAG_IS_UNICODE		0x00000001
34176#	PNF_FLAG_HAS_STRINGS		0x00000002
34177#	PNF_FLAG_SRCPATH_IS_URL		0x00000004
34178#	PNF_FLAG_HAS_VOLATILE_DIRIDS	0x00000008
34179#	PNF_FLAG_INF_VERIFIED		0x00000010
34180#	PNF_FLAG_INF_DIGITALLY_SIGNED	0x00000020
34181#	UNKNOWN8			0x00000080
34182#	UNKNOWN				0x00000100
34183#	UNKNOWN1			0x01000000
34184#	UNKNOWN2			0x02000000
34185>4	ulelong&0x03000180	>0		\b, flags
34186>>4	ulelong			x		0x%x
34187>4	ulelong&0x00000001	0x00000001	\b, unicoded
34188>4	ulelong&0x00000002	0x00000002	\b, has strings
34189>4	ulelong&0x00000004	0x00000004	\b, src URL
34190>4	ulelong&0x00000008	0x00000008	\b, volatile dir ids
34191>4	ulelong&0x00000010	0x00000010	\b, verified
34192>4	ulelong&0x00000020	0x00000020	\b, digitally signed
34193# >4	ulelong&0x00000080	0x00000080	\b, UNKNOWN8
34194# >4	ulelong&0x00000100	0x00000100	\b, UNKNOWN
34195# >4	ulelong&0x01000000	0x01000000	\b, UNKNOWN1
34196# >4	ulelong&0x02000000	0x02000000	\b, UNKNOWN2
34197#>8		ulelong		x		\b, InfSubstValueListOffset 0x%x
34198# many 0, 1 lmouusb.PNF, 2 linkfx10.PNF , f webfdr16.PNF
34199# , 6 bth.PNF, 9 usbport.PNF, d netnwifi.PNF, 10h nettcpip.PNF
34200#>12		uleshort	x		\b, InfSubstValueCount 0x%x
34201# only < 9 found: 8 hcw85b64.PNF
34202#>14		uleshort	x		\b, InfVersionDatumCount 0x%x
34203# only found values lower 0x0000ffff ??
34204#>16		ulelong		x		\b, InfVersionDataSize 0x%x
34205# only found positive values lower 0x00ffFFff for InfVersionDataOffset
34206>20		ulelong		x		\b, at 0x%x
34207>4	ulelong&0x00000001	=0x00000001
34208# case independent: CatalogFile Class DriverVer layoutfile LayoutFile SetupClass signature Signature
34209>>(20.l)	lestring16	x		"%s"
34210>4	ulelong&0x00000001	!0x00000001
34211>>(20.l)	string		x		"%s"
34212# FILETIME is number of 100-nanosecond intervals since 1 January 1601
34213#>24		ulequad		x		\b, InfVersionLastWriteTime %16.16llx
34214#>24		foodate-0xbar	x		\b, InfVersionLastWriteTime %s
34215# for Windows 98, XP
34216>0		uleshort	<0x0102
34217# only found values lower 0x00ffFFff
34218# often 70 but also 78h for corelist.PNF
34219# >>32		ulelong		x		\b, StringTableBlockOffset 0x%x
34220# >>36		ulelong		x		\b, StringTableBlockSize 0x%x
34221# >>40		ulelong		x		\b, InfSectionCount 0x%x
34222# >>44		ulelong		x		\b, InfSectionBlockOffset 0x%x
34223# >>48		ulelong		x		\b, InfSectionBlockSize 0x%x
34224# >>52		ulelong		x		\b, InfLineBlockOffset 0x%x
34225# >>56		ulelong		x		\b, InfLineBlockSize 0x%x
34226# >>60		ulelong		x		\b, InfValueBlockOffset 0x%x
34227# >>64		ulelong		x		\b, InfValueBlockSize 0x%x
34228# WinDirPathOffset
34229# like 58h, which means direct after PNF header
34230#>>68		ulelong		x		\b, at 0x%x
34231>>68		ulelong		x
34232>>>4	ulelong&0x00000001	=0x00000001
34233#>>>>(68.l)	ubequad		=0x43003a005c005700
34234# normally unicoded C:\Windows
34235#>>>>>(68.l)	lestring16	x		\b, WinDirPath "%s"
34236>>>>(68.l)	ubequad		!0x43003a005c005700
34237>>>>>(68.l)	lestring16	x		\b, WinDirPath "%s"
34238>>>4	ulelong&0x00000001	!0x00000001
34239# normally ASCII C:\WINDOWS
34240#>>>>(68.l)	string		=C:\\WINDOWS	\b, WinDirPath "%s"
34241>>>>(68.l)	string		!C:\\WINDOWS
34242>>>>>(68.l)	string		x		\b, WinDirPath "%s"
34243# found OsLoaderPathOffset values often 0 , once 70h corelist.PNF, once 68h ASCII machine.PNF
34244>>>72		ulelong		>0		\b,
34245>>>>4	ulelong&0x00000001	=0x00000001
34246>>>>>(72.l)	lestring16	x		OsLoaderPath "%s"
34247>>>>4	ulelong&0x00000001	!0x00000001
34248# seldom C:\ instead empty
34249>>>>>(72.l)	string		x		OsLoaderPath "%s"
34250# 1fdh
34251#>>>76		uleshort	x		\b, StringTableHashBucketCount 0x%x
34252# only 407h found
34253>>>78		uleshort	!0x409		\b, LanguageID %x
34254#>>>78		uleshort	=0x409		\b, LanguageID %x
34255# InfSourcePathOffset often 0
34256>>>80		ulelong		>0		\b, at 0x%x
34257>>>>4	ulelong&0x00000001	=0x00000001
34258>>>>>(80.l)	lestring16	x		SourcePath "%s"
34259>>>>4	ulelong&0x00000001	!0x00000001
34260>>>>>(80.l)	string		>\0		SourcePath "%s"
34261# OriginalInfNameOffset often 0
34262>>>84		ulelong		>0		\b, at 0x%x
34263>>>>4	ulelong&0x00000001	=0x00000001
34264>>>>>(84.l)	lestring16	x		InfName "%s"
34265>>>>4	ulelong&0x00000001	!0x00000001
34266>>>>>(84.l)	string		>\0		InfName "%s"
34267
34268# for newer Windows like Vista, 7 , 8.1 , 10
34269>0		uleshort	>0x0101
34270>>80	ulelong			x		\b, at 0x%x WinDirPath
34271>>>4	ulelong&0x00000001	0x00000001
34272# normally unicoded C:\Windows
34273#>>>>(80.l)	ubequad		=0x43003a005c005700
34274#>>>>>(80.l)	lestring16	x		"%s"
34275>>>>(80.l)	ubequad		!0x43003a005c005700
34276>>>>>(80.l)	lestring16	x		"%s"
34277# language id: 0 407h~german 409h~English_US
34278>>90		uleshort	!0x409		\b, LanguageID %x
34279#>>90		uleshort	=0x409		\b, LanguageID %x
34280>>92	ulelong			>0		\b, at 0x%x
34281>>>4	ulelong&0x00000001	0x00000001
34282# language string like: de-DE en-US
34283>>>>(92.l)	lestring16	x		language %s
34284
34285# Summary: backup file created with utility like NTBACKUP.EXE shipped with Windows NT/2K/XP/2003
34286# Extension: .bkf
34287# Created by: Joerg Jenderek
34288# URL: https://en.wikipedia.org/wiki/NTBackup
34289# Reference: http://laytongraphics.com/mtf/MTF_100a.PDF
34290# Descriptor BloCK name of Microsoft Tape Format
342910	string			TAPE
34292# Format Logical Address is zero
34293>20	ulequad			0
34294# Reserved for MBC is zero
34295>>28	uleshort		0
34296# Control Block ID is zero
34297>>>36	ulelong			0
34298# BIT4-BIT15, BIT18-BIT31 of block attributes are unused
34299>>>>4	ulelong&0xFFfcFFe0	0		Windows NTbackup archive
34300#!:mime application/x-ntbackup
34301!:ext bkf
34302# OS ID
34303>>>>>10	ubyte			1		\b NetWare
34304>>>>>10	ubyte			13		\b NetWare SMS
34305>>>>>10	ubyte			14		\b NT
34306>>>>>10	ubyte			24		\b 3
34307>>>>>10	ubyte			25		\b OS/2
34308>>>>>10	ubyte			26		\b 95
34309>>>>>10	ubyte			27		\b Macintosh
34310>>>>>10	ubyte			28		\b UNIX
34311# OS Version (2)
34312#>>>>>11	ubyte			x		OS V=%x
34313# MTF_CONTINUATION	Media Sequence Number > 1
34314#>>>>>4	ulelong&0x00000001	!0		\b, continued
34315# MTF_COMPRESSION
34316>>>>>4	ulelong&0x00000004	!0		\b, compressed
34317# MTF_EOS_AT_EOM	End Of Medium was hit during end of set processing
34318>>>>>4	ulelong&0x00000008	!0		\b, End Of Medium hit
34319>>>>>4	ulelong&0x00020000	0
34320# MTF_SET_MAP_EXISTS	A Media Based Catalog Set Map may exist on tape
34321>>>>>>4	ulelong&0x00010000	!0		\b, with catalog
34322# MTF_FDD_ALLOWED	However File/Directory Detail can only exist if a Set Map is also present
34323>>>>>4	ulelong&0x00020000	!0		\b, with file catalog
34324# Offset To First Event 238h,240h,28Ch
34325#>>>>>8	uleshort		x		\b, event offset %4.4x
34326# Displayable Size (20e0230h 20e024ch 20e0224h)
34327#>>>>>8	ulequad			x		dis. size %16.16llx
34328# Media Family ID (455288C4h 4570BD1Ah 45708F2Fh 4570BBF5h)
34329#>>>>>52	ulelong			x		family ID %8.8x
34330# TAPE Attributes (3)
34331#>>>>>56	ulelong			x		TAPE %8.8x
34332# Media Sequence Number
34333>>>>>60	uleshort		>1		\b, sequence %u
34334# Password Encryption Algorithm (3)
34335>>>>>62	uleshort		>0		\b, 0x%x encrypted
34336# Soft Filemark Block Size * 512 (2)
34337#>>>>>64	uleshort		=2		\b, soft size %u*512
34338>>>>>64	uleshort		!2		\b, soft size %u*512
34339# Media Based Catalog Type (1,2)
34340#>>>>>66	uleshort		x		\b, catalog type %4.4x
34341# size of Media Name (66,68,6Eh)
34342>>>>>68	uleshort		>0
34343# offset of Media Name (5Eh)
34344>>>>>>70	uleshort	>0
34345# 0~, 1~ANSI, 2~UNICODE
34346>>>>>>>48	ubyte		1
34347# size terminated ansi coded string normally followed by "MTF Media Label"
34348>>>>>>>>(70.s)	string		>\0		\b, name: %s
34349>>>>>>>48	ubyte		2
34350# Not null, but size terminated unicoded string
34351>>>>>>>>(70.s)	lestring16	x		\b, name: %s
34352# size of Media Label (104h)
34353>>>>>72	uleshort		>0
34354# offset of Media Label (C4h,C6h,CCh)
34355>>>>>74		uleshort	>0
34356>>>>>>48	ubyte		1
34357#Tag|Version|Vendor|Vendor ID|Creation Time Stamp|Cartridge Label|Side|Media ID|Media Domain ID|Vendor Specific fields
34358>>>>>>>(74.s)	string		>\0		\b, label: %s
34359>>>>>>48	ubyte		2
34360>>>>>>>(74.s)	lestring16	x		\b, label: %s
34361# size of password name (0,1Ch)
34362#>>>>>76	uleshort		>0		\b, password size %4.4x
34363# Software Vendor ID (CBEh)
34364>>>>>86	uleshort		x		\b, software (0x%x)
34365# size of Software Name (6Eh)
34366>>>>>80	uleshort		>0
34367# offset of Software Name (1C8h,1CAh,1D0h)
34368>>>>>>82	uleshort	>0
34369# 1~ANSI, 2~UNICODE
34370>>>>>>>48	ubyte		1
34371>>>>>>>>(82.s)	string		>\0		\b: %s
34372>>>>>>>48	ubyte		2
34373# size terminated unicoded coded string normally followed by "SPAD"
34374>>>>>>>>(82.s)	lestring16	x		\b: %s
34375# Format Logical Block Size (512,1024)
34376#>>>>>84	uleshort		=1024		\b, block size %u
34377>>>>>84	uleshort		!1024		\b, block size %u
34378# Media Date of MTF_DATE_TIME type with 5 bytes
34379#>>>>>>88	ubequad			x		DATE %16.16llx
34380# MTF Major Version (1)
34381#>>>>>>93	ubyte		x		\b, MFT version %x
34382#
34383
34384# URL: https://en.wikipedia.org/wiki/PaintShop_Pro
34385# Reference: https://www.cryer.co.uk/file-types/p/pal.htm
34386# Created by: Joerg Jenderek
34387# Note: there exist other color palette formats also with .pal extension
343880	string	JASC-PAL\r\n	PaintShop Pro color palette
34389#!:mime	text/plain
34390# PspPalette extension is used by newer (probably 8) PaintShopPro versions
34391!:ext	pal/PspPalette
34392# 2nd line contains palette file version. For example "0100"
34393>10	string	!0100		\b, version %.4s
34394# third line contains the number of colours: 16 256 ...
34395>16	string	x		\b, %.3s colors
34396
34397# URL: https://en.wikipedia.org/wiki/Innosetup
34398# Reference: https://github.com/jrsoftware/issrc/blob/master/Projects/Undo.pas
34399# Created by: Joerg Jenderek
34400# Note:	created by like "InnoSetup self-extracting archive" inside ./msdos
34401# TrID labeles the entry as "Inno Setup Uninstall Log"
34402#	TUninstallLogID
344030	string	Inno\ Setup\ Uninstall\ Log\ (b)	InnoSetup Log
34404!:mime	application/x-innosetup
34405# unins000.dat, unins001.dat, ...
34406!:ext	dat
34407# " 64-bit" variant
34408>0x1c	string		>\0				\b%.7s
34409# AppName[0x80] like "Minimal SYStem", ClamWin Free Antivirus , ...
34410>0xc0	string		x				%s
34411# AppId[0x80] is similar to AppName or
34412# GUID like {4BB0DCDC-BC24-49EC-8937-72956C33A470} start with left brace
34413>0x40	ubyte		0x7b
34414>>0x40	string		x				%-.38s
34415# do not know how this log version correlates to program version
34416>0x140	ulelong		x				\b, version 0x%x
34417# NumRecs
34418#>0x144	ulelong		x				\b, 0x%4.4x records
34419# EndOffset means files size
34420>0x148	ulelong		x				\b, %u bytes
34421# Flags 5 25h 35h
34422#>0x14c	ulelong		x				\b, flags %8.8x
34423# Reserved: array[0..26] of Longint
34424# the non Unicode HighestSupportedVersion may never become greater than or equal to 1000
34425>0x140	ulelong		<1000
34426# hostname
34427>>0x1d6	pstring		x				\b, %s
34428# user name
34429>>>&0	pstring		x				\b\%s
34430# directory like C:\Program Files (x86)\GnuWin32
34431>>>>&0	pstring		x				\b, "%s"
34432# version 1000 or higher implies unicode
34433>0x140	ulelong		>999
34434# hostname
34435>>0x1db	lestring16	x				\b, %-.9s
34436# utf string variant with prepending fe??ffFFff
34437>>0x1db	search/43	\xFF\xFF\xFF
34438# user name
34439>>>&0	lestring16	x				\b\%-.9s
34440>>>&0	search/43	\xFF\xFF\xFF
34441# directory like C:\Program Files\GIMP 2
34442>>>>&0	lestring16	x				\b, %-.42s
34443
34444# URL:      https://jrsoftware.org/ishelp/index.php?topic=setup_signeduninstaller
34445# Reference:https://github.com/jrsoftware/issrc/blob/main/Projects/Struct.pas
34446# From:     Joerg Jenderek
344470	string	Inno\ Setup\ Messages\ (
34448# null padded til 0x40 boundary
34449>0x38	quad		0				InnoSetup messages
34450!:mime	application/x-innosetup-msg
34451# unins000.msg, unins001.msg, ...
34452!:ext	msg
34453# version like 5.1.1 5.1.11 5.5.0 5.5.3 6.0.0
34454>>0x15	string		x				\b, version %.5s
34455# look for 6th char of version string or terminating right parentheses
34456>>>0x1a	ubyte		!0x29				\b%c
34457# NumMessages
34458>>0x40	ulelong		x				\b, %u messages
34459# TotalSize: Cardinal;
34460#>>0x44	ulelong		x				\b, TotalSize %u
34461# NotTotalSize: Cardinal;
34462#>>0x48	ulelong		x				\b, NotTotalSize %u
34463# CRCMessages: Longint;
34464#>>0x4C	ulelong		x				\b, CRC 0x%x
34465>>0x40	ulelong		x
34466# (u) after version means unicoded messages
34467>>>0x1c	search/2	(u)				(UTF-16),
34468>>>>0x50 lestring16	x				%s
34469# ASCII coded message
34470>>>0x1c	default		x				(ASCII),
34471>>>>0x50 string		x				%s
34472
34473# Windows Imaging (WIM) Image
34474# Update: Joerg Jenderek at Mar 2019, 2021
34475# URL: https://en.wikipedia.org/wiki/Windows_Imaging_Format
34476#      http://fileformats.archiveteam.org/wiki/Windows_Imaging_Format
34477# Reference: https://download.microsoft.com/download/f/e/f/
34478# fefdc36e-392d-4678-9e4e-771ffa2692ab/Windows%20Imaging%20File%20Format.rtf
34479# Note: verified by like `7z t boot.wim` `wiminfo install.esd --header`
344800	string		MSWIM\000\000\000
34481>0	use		wim-archive
34482# https://wimlib.net/man1/wimoptimize.html
344830	string		WLPWM\000\000\000
34484>0	use		wim-archive
344850	name		wim-archive
34486# _WIMHEADER_V1_PACKED ImageTag[8]
34487>0	string		x			Windows imaging
34488!:mime	application/x-ms-wim
34489# TO avoid in file version 5.36 error like
34490# Magdir/windows, 760: Warning: Current entry does not yet have a description
34491# file: could not find any valid magic files! (No error)
34492# split WIM
34493>16	ulelong		&0x00000008		(SWM
34494!:ext	swm
34495# usPartNumber; 1, unless the file was split into multiple parts
34496>>40	uleshort	x			\b %u
34497# usTotalParts; The total number of WIM file parts in a spanned set
34498>>42	uleshort	x			\b of %u) image
34499# non split WIM
34500>16	ulelong		^0x00000008
34501# https://wimlib.net/man1/wimmount.html
34502# solid WIMs; version 3584; usually contain LZMS-compressed and the .esd extension
34503>>12	ulelong		3584			(ESD) image
34504!:ext	esd
34505>>12	ulelong		!3584			(
34506# look for archive member RunTime.xml like in Microsoft.Windows.Cosa.Desktop.Client.ppkg
34507>>>156	search/68233/s		RunTime.xml	\bWindows provisioning package)
34508!:ext	ppkg
34509# if is is not a Windows provisioning package, then it is a WIM
34510>>>156	default			x		\bWIM) image
34511# second disk image part created by Microsoft's RecoveryDrive.exe has name Reconstruct.WIM2
34512!:ext	wim/wim2
34513>0	string/b	WLPWM\000\000\000	\b, wimlib pipable format
34514# cbSize size of the WIM header in bytes like 208
34515#>8	ulelong		x			\b, headersize %u
34516# dwVersion version of the WIM file 00010d00h~1.13 00000e00h~0.14
34517>14	uleshort	x			v%u
34518>13	ubyte		x			\b.%u
34519# dwImageCount; The number of images contained in the WIM file
34520>44	ulelong		>1			\b, %u images
34521# dwBootIndex
34522# 1-based index of the bootable image of the WIM, or 0 if no image is bootable
34523>0x78	ulelong		>0			\b, bootable no. %u
34524# dwFlags
34525#>16	ulelong		x			\b, flags 0x%8.8x
34526#define FLAG_HEADER_COMPRESSION		0x00000002
34527#define FLAG_HEADER_READONLY            0x00000004
34528#define FLAG_HEADER_SPANNED		0x00000008
34529#define FLAG_HEADER_RESOURCE_ONLY       0x00000010
34530#define FLAG_HEADER_METADATA_ONLY       0x00000020
34531#define FLAG_HEADER_WRITE_IN_PROGRESS   0x00000040
34532#define FLAG_HEADER_RP_FIX		0x00000080 reparse point fixup
34533#define FLAG_HEADER_COMPRESS_RESERVED   0x00010000
34534#define FLAG_HEADER_COMPRESS_XPRESS     0x00020000
34535#define FLAG_HEADER_COMPRESS_LZX	0x00040000
34536#define FLAG_HEADER_COMPRESS_LZMS	0x00080000
34537#define FLAG_HEADER_COMPRESS_XPRESS2    0x00100000 wimlib-1.13.0\include\wimlib\header.h
34538# XPRESS, with small chunk size
34539>16	ulelong		&0x00100000		\b, XPRESS2
34540>16	ulelong		&0x00080000		\b, LZMS
34541>16	ulelong		&0x00040000		\b, LZX
34542>16	ulelong		&0x00020000		\b, XPRESS
34543>16	ulelong		&0x00000002		compressed
34544>16	ulelong		&0x00000004		\b, read only
34545>16	ulelong		&0x00000010		\b, resource only
34546>16	ulelong		&0x00000020		\b, metadata only
34547>16	ulelong		&0x00000080		\b, reparse point fixup
34548#>16	ulelong		&0x00010000		\b, RESERVED
34549# dwCompressionSize; Uncompressed chunk size for resources or 0 if uncompressed
34550#>20	ulelong		>0			\b, chunk size %u bytes
34551# gWIMGuid
34552#>24	ubequad		x			\b, GUID 0x%16.16llx
34553#>>32	ubequad		x			\b%16.16llx
34554# rhOffsetTable; the location of the resource lookup table
34555# wim_reshdr_disk[24]= u8 size_in_wim[7] + u8 flags + le64 offset_in_wim + le64 uncompressed_size
34556#>48	ubequad		x			\b, rhOffsetTable 0x%16.16llx
34557# rhXmlData; the location of the XML data
34558#>0x50	ulelong		x			\b, at 0x%8.8x
34559# NOT WORKING \xff\xfe<\0W\0I\0M\0
34560#>(0x50.l)	ubequad	x			\b, xml=%16.16llx
34561# rhBootMetadata; the location of the metadata resource
34562#>0x60	ubequad		x			\b, rhBootMetadata 0x%16.16llx
34563# rhIntegrity; the location of integrity table used to verify files
34564#>0x7c	ubequad		x			\b, rhIntegrity 0x%16.16llx
34565# Unused[60]
34566#>148	ubequad		!0			\b,unused 0x%16.16llx
34567#
34568
34569# From:		Joerg Jenderek
34570# URL:		https://en.wikipedia.org/wiki/Windows_Easy_Transfer
34571# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/m/mig.trid.xml
34572# Note:		called "Windows Easy Transfer migration data" by TrID,
34573#		"Migration Store" or "EasyTransfer file" by Microsoft
345740		string		1giM	Windows Easy Transfer migration data
34575#!:mime		application/octet-stream
34576!:mime		application/x-ms-mig
34577!:ext		mig
34578>0x18		string		=MRTS	without password
34579# data offset with 1 space at end
34580>>0x1c		ulelong+0x38	x	\b, at 0x%x
34581# look for zlib compressed data by ./compress
34582>>(0x1c.l+0x38)	ubyte		x
34583>>>&-1	indirect	x
34584# in password protected examples MRTS comes some bytes further
34585>0x18		string		!MRTS	with password
34586# look for first MRTS tag
34587>0x18		search/29/b	MRTS
34588# probably first file name length like 178, ...
34589#>>&0		ulelong		x	\b, 1st length %u
34590# URL like File\C:\Users\nutzer\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini
34591>>&20		lestring16	x	\b, 1st %-s
34592
34593# Microsoft SYLK
34594# https://en.wikipedia.org/wiki/SYmbolic_LinK_(SYLK)
34595# https://outflank.nl/upload/sylksum.txt
345960	string	ID;P	Microsoft SYLK program
34597>4	string	>0	\b, created by %s
34598!:ext	slk/sylk
34599
34600#------------------------------------------------------------------------------
34601# $File: wireless,v 1.2 2009/09/19 16:28:13 christos Exp $
34602# wireless-regdb:        file(1) magic for CRDA wireless-regdb file format
34603#
346040	string	RGDB	CRDA wireless regulatory database file
34605>4	belong	19	(Version 1)
34606
34607#------------------------------------------------------------------------------
34608# $File: wordprocessors,v 1.24 2020/05/22 19:28:47 christos Exp $
34609# wordprocessors:  file(1) magic fo word processors.
34610#
34611####### PWP file format used on Smith Corona Personal Word Processors:
346122	string	\040\040\040\040\040\040\040\040\040\040\040ML4D\040'92	Smith Corona PWP
34613>24	byte	2	\b, single spaced
34614>24	byte	3	\b, 1.5 spaced
34615>24	byte	4	\b, double spaced
34616>25	byte	0x42	\b, letter
34617>25	byte	0x54	\b, legal
34618>26	byte	0x46	\b, A4
34619
34620# URL:	http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
34621# reference:	http://mark0.net/download/triddefs_xml.7z
34622#		/defs/w/wps-works-dos.trid.xml
34623# From:	Joerg Jenderek
34624# Note:	older non OLE 2 Compound based versions
346250	ubeshort	=0x01FE
34626>112	ubeshort	=0x0100		Microsoft Works 1-3 (DOS) or 2 (Windows) document
34627# title like THE GREAT KHAN GAME
34628>>0x100	string		x		%s
34629!:mime	application/vnd-ms-works
34630#!:mime	application/x-msworks
34631# https://www.macdisk.com/macsigen.php
34632!:apple	????AWWP
34633!:ext	wps
34634
34635# Corel/WordPerfect
346360	string	\xffWPC
34637# WordPerfect
34638>8	byte	1
34639>>9	byte	1	WordPerfect macro
34640>>9	byte	2	WordPerfect help file
34641>>9	byte	3	WordPerfect keyboard file
34642>>9	byte	10	WordPerfect document
34643>>9	byte	11	WordPerfect dictionary
34644>>9	byte	12	WordPerfect thesaurus
34645>>9	byte	13	WordPerfect block
34646>>9	byte	14	WordPerfect rectangular block
34647>>9	byte	15	WordPerfect column block
34648>>9	byte	16	WordPerfect printer data
34649>>9	byte	19	WordPerfect printer data
34650>>9	byte	20	WordPerfect driver resource data
34651>>9	byte	22	WordPerfect graphic image
34652>>9	byte	23	WordPerfect hyphenation code
34653>>9	byte	24	WordPerfect hyphenation data
34654>>9	byte	25	WordPerfect macro resource data
34655>>9	byte	27	WordPerfect hyphenation lex
34656>>9	byte	29	WordPerfect wordlist
34657>>9	byte	30	WordPerfect equation resource data
34658>>9	byte	33	WordPerfect spell rules
34659>>9	byte	34	WordPerfect dictionary rules
34660>>9	byte	39	WordPerfect spell rules (Microlytics)
34661>>9	byte	43	WordPerfect settings file
34662>>9	byte	44	WordPerfect 3.5 document
34663>>9	byte	45	WordPerfect 4.2 document
34664>>9	byte	69	WordPerfect dialog file
34665>>9	byte	76	WordPerfect button bar
34666>>9	default x
34667>>>9	byte	x	Corel WordPerfect: Unknown filetype %d
34668# Corel Shell
34669>8	byte	2
34670>>9	byte	1	Corel shell macro
34671>>9	byte	10	Corel shell definition
34672>>9	default x
34673>>>9	byte	x	Corel Shell: Unknown filetype %d
34674# Corel Notebook
34675>8	byte	3
34676>>9	byte	1	Corel Notebook macro
34677>>9	byte	2	Corel Notebook help file
34678>>9	byte	3	Corel Notebook keyboard file
34679>>9	byte	10	Corel Notebook definition
34680>>9	default	x
34681>>>9	byte	x	Corel Notebook: Unknown filetype %d
34682# Corel Calculator
34683>8	byte	4
34684>>9	byte	2	Corel Calculator help file
34685>>9	default	x
34686>>>9	byte	x	Corel Calculator: Unknown filetype %d
34687# Corel File Manager
34688>8	byte	5
34689>>9	default	x
34690>>>9	byte	x	Corel File Manager: Unknown filetype %d
34691# Corel Calendar
34692>8	byte	6
34693>>9	byte 	2	Corel Calendar help file
34694>>9	byte 	10	Corel Calendar data file
34695>>9	default	x
34696>>>9	byte	x	Corel Calendar: Unknown filetype %d
34697# Corel Program Editor/Ed Editor
34698>8	byte	7
34699>>9	byte	1	Corel Editor macro
34700>>9	byte	2	Corel Editor help file
34701>>9	byte	3	Corel Editor keyboard file
34702>>9	byte	25	Corel Editor macro resource file
34703>>9	default	x
34704>>>9	byte	x	Corel Program Editor/Ed Editor: Unknown filetype %d
34705# Corel Macro Editor
34706>8	byte	8
34707>>9	byte 	1	Corel Macro editor macro
34708>>9	byte 	2	Corel Macro editor help file
34709>>9	byte	3	Corel Macro editor keyboard file
34710>>9	default	x
34711>>>9	byte	x	Corel Macro Editor: Unknown filetype %d
34712# Corel Plan Perfect
34713>8	byte	9
34714>>9	default	x
34715>>>9	byte	x	Corel Plan Perfect: Unknown filetype %d
34716# Corel DataPerfect
34717>8	byte	10
34718# CHECK: Don't these belong into product 9?
34719>>9	byte	1	Corel PlanPerfect macro
34720>>9	byte	2	Corel PlanPerfect help file
34721>>9	byte	3	Corel PlanPerfect keyboard file
34722>>9	byte	10	Corel PlanPerfect worksheet
34723>>9	byte	15	Corel PlanPerfect printer definition
34724>>9	byte	18	Corel PlanPerfect graphic definition
34725>>9	byte	19	Corel PlanPerfect data
34726>>9	byte	20	Corel PlanPerfect temporary printer
34727>>9	byte	25	Corel PlanPerfect macro resource data
34728>>9	default	x
34729>>>9	byte	x	Corel DataPerfect: Unknown filetype %d
34730# Corel Mail
34731>8	byte	11
34732>>9	byte	2	Corel Mail help file
34733>>9	byte	5	Corel Mail distribution list
34734>>9	byte	10	Corel Mail out box
34735>>9	byte	11	Corel Mail in box
34736>>9	byte	20	Corel Mail users archived mailbox
34737>>9	byte	21	Corel Mail archived message database
34738>>9	byte	22	Corel Mail archived attachments
34739>>9	default	x
34740>>>9	byte	x	Corel Mail: Unknown filetype %d
34741# Corel Printer
34742>8	byte	12
34743>>9	byte	11	Corel Printer temporary file
34744>>9	default	x
34745>>>9	byte	x	Corel Printer: Unknown filetype %d
34746# Corel Scheduler
34747>8	byte	13
34748>>9	byte	2	Corel Scheduler help file
34749>>9	byte	10	Corel Scheduler in file
34750>>9	byte	11	Corel Scheduler out file
34751>>9	default	x
34752>>>9	byte	x	Corel Scheduler: Unknown filetype %d
34753# Corel WordPerfect Office
34754>8	byte	14
34755>>9	byte	10	Corel GroupWise settings file
34756>>9	byte	17	Corel GroupWise directory services
34757>>9	byte	43	Corel GroupWise settings file
34758>>9	default	x
34759>>>9	byte	x	Corel WordPerfect Office: Unknown filetype %d
34760# Corel DrawPerfect
34761>8	byte	15
34762>>9	default	x
34763>>>9	byte	x	Corel DrawPerfect: Unknown filetype %d
34764# Corel LetterPerfect
34765>8	byte	16
34766>>9	default	x
34767>>>9	byte	x	Corel LetterPerfect: Unknown filetype %d
34768# Corel Terminal
34769>8	byte	17
34770>>9	byte	10	Corel Terminal resource data
34771>>9	byte	11	Corel Terminal resource data
34772>>9	byte	43	Corel Terminal resource data
34773>>9	default	x
34774>>>9	byte	x	Corel Terminal: Unknown filetype %d
34775# Corel loadable file
34776>8	byte	18
34777>>9	byte	10	Corel loadable file
34778>>9	byte	11	Corel GUI loadable text
34779>>9	byte	12	Corel graphics resource data
34780>>9	byte	13	Corel printer settings file
34781>>9	byte	14	Corel port definition file
34782>>9	byte	15	Corel print queue parameters
34783>>9	byte	16	Corel compressed file
34784>>9	default	x
34785>>>9	byte	x	Corel loadable file: Unknown filetype %d
34786>>15	byte	0	\b, optimized for Intel
34787>>15	byte	1	\b, optimized for Non-Intel
34788# Network service
34789>8	byte	20
34790>>9	byte	10	Corel Network service msg file
34791>>9	byte	11	Corel Network service msg file
34792>>9	byte	12	Corel Async gateway login msg
34793>>9	byte	14	Corel GroupWise message file
34794>>9	default	x
34795>>>9	byte	x	Corel Network service: Unknown filetype %d
34796# GroupWise
34797>8	byte	31
34798>>9	byte	20	GroupWise admin domain database
34799>>9	byte	21	GroupWise admin host database
34800>>9	byte	23	GroupWise admin remote host database
34801>>9	byte	24	GroupWise admin ADS deferment data file
34802>>9	default	x
34803>>>9	byte	x	GroupWise: Unknown filetype %d
34804# IntelliTAG
34805>8	byte	33
34806>>9	byte	10	IntelliTAG (SGML) compiled DTD
34807>>9	default	x
34808>>>9	byte	x	IntelliTAG: Unknown filetype %d
34809# everything else
34810>8	default x
34811>>8	byte	x	Unknown Corel/Wordperfect product %d,
34812>>>9	byte	x	file type %d
34813>10	byte	0	\b, v5.
34814>10	byte	!0	\b, v%d.
34815>11	byte	x	\b%d
34816
34817# Hangul (Korean) Word Processor File
348180	string	HWP\ Document\ File	Hangul (Korean) Word Processor File 3.0
34819
34820# CosmicBook, from Benoit Rouits
348210       string  CSBK    Ted Neslson's CosmicBook hypertext file
34822
348232       string  EYWR    AmigaWriter file
34824
34825# chi:  file(1) magic for ChiWriter files
348260       string          \\1cw\          ChiWriter file
34827>5      string          >\0             version %s
348280       string          \\1cw           ChiWriter file
34829
34830# Quark Express from https://www.garykessler.net/library/file_sigs.html
348312	string	IIXPR3			Intel Quark Express Document (English)
348322	string	IIXPRa			Intel Quark Express Document (Korean)
348332	string	MMXPR3			Motorola Quark Express Document (English)
34834!:mime	application/x-quark-xpress-3
348352	string	MMXPRa			Motorola Quark Express Document (Korean)
34836
34837# adobe indesign (document, whatever...) from querkan
348380	belong	0x0606edf5		Adobe InDesign
34839>16	string	DOCUMENT		Document
34840
34841#------------------------------------------------------------------------------
34842# ichitaro456: file(1) magic for Just System Word Processor Ichitaro
34843#
34844# Contributor kenzo-:
34845# Reversed-engineered JS Ichitaro magic numbers
34846#
34847
348480	string		DOC
34849>43	byte		0x14	Just System Word Processor Ichitaro v4
34850!:mime	application/x-ichitaro4
34851>144	string	JDASH		application/x-ichitaro4
34852
348530	string		DOC
34854>43	byte		0x15	Just System Word Processor Ichitaro v5
34855!:mime	application/x-ichitaro5
34856
348570	string		DOC
34858>43	byte		0x16	Just System Word Processor Ichitaro v6
34859!:mime	application/x-ichitaro6
34860
34861# Type: Freemind mindmap documents
34862# From: Jamie Thompson <debian-bugs@jamie-thompson.co.uk>
348630	string/w	\<map\ version	Freemind document
34864!:mime	application/x-freemind
34865
34866# Type: Freeplane mindmap documents
34867# From: Felix Natter <fnatter@gmx.net>
348680       string/w        \<map\ version="freeplane  Freeplane document
34869!:mime  application/x-freeplane
34870
34871# Type:        Scribus
34872# From:        Werner Fink <werner@suse.de>
348730	string	\<SCRIBUSUTF8\ Version		Scribus Document
348740	string	\<SCRIBUSUTF8NEW\ Version	Scribus Document
34875!:mime	application/x-scribus
34876
34877# help files .hlp compiled from html and used by gfxboot added by Joerg Jenderek
34878# markups page=0x04,label=0x12, followed by strings like "opt" or "main" and title=0x14
348790	ulelong&0x8080FFFF	0x00001204	gfxboot compiled html help file
34880
34881# From:		Joerg Jenderek
34882# URL:		https://en.wikipedia.org/wiki/StarOffice
34883# Note:		used in Star-, Open- and Libre-Office
34884# named as soffice.StarConfigFile.6 or OpenOffice.org configuration by others
348850		ubeshort	0x0400
34886#>(2.s+8)	ubequad		x		\b, gap 0x%16.16llx
34887# test for null value in gap after theme name maybe unreliable
34888#>(2.s+9)	ubyte		0		\b, 0-byte
34889# look for keyword GALRESRV near the end
34890# "C:\Program Files (x86)\StarOffice6.0\share\gallery\sg27.thm" Navigation, 238 objects
34891#>0		search/8415	GALRESRV	\b, GALRESRV found
34892# "neues thema6.thm" MorePictures, 315 objects
34893#>0		search/19299	GALRESRV	\b, GALRESRV FOUND
34894#>2		uleshort	x		\b, name length %u
34895# skip file2147.chk by check for positive name length like for sg16.thm "3D"
34896>2		uleshort	>0		StarOffice Gallery theme
34897!:mime		application/x-stargallery-thm
34898!:ext		thm
34899# gallery name
34900>>2		pstring/h	x		%s
34901# number of objects
34902>>(2.s+4)	ulelong		x		\b, %u object
34903# plural s
34904>>(2.s+4)	ulelong		!1		\bs
34905# if available then display first object name
34906>>(2.s+4)	ulelong		>0
34907# partial file name, URL or internal name like "dd2*" of 1st object or RESRV
34908>>>(2.s+11)	pstring/h	x		\b, 1st %s
34909
34910# From:	Joerg Jenderek
34911# URL:	http://fileformats.archiveteam.org/wiki/StarOffice_Gallery
34912# Note:	used in Star-, Open- and Libre-Office and found in directories like
34913#	%APPDATA%\Roaming\LibreOffice\4\user\gallery
34914#	$HOME/.config/libreoffice/4/user/gallery
349150	string		SGA3	StarOffice Gallery thumbnails
34916# Unknown like 0x04000?0001000142
34917#>4	ubequad		x	\b, UNKNOWN 0x%16.16llx
34918#!:mime	application/x-sdg
34919!:mime	application/x-stargallery-sdg
34920!:ext	sdg
34921# display image magic for debugging purpose like 'BM'
34922# looking like PC bitmap, Windows 3.x format with unknown compression
34923#>11	string		x	\b, image magic '%-.2s'
34924# inspect 1st GALLERY thumbnail magic by ./images with 1 space at end
34925#>11	indirect	x	\b; contains
34926
34927
34928#------------------------------------------------------------------------------
34929# $File: wsdl,v 1.5 2019/04/19 00:42:27 christos Exp $
34930# wsdl: PHP WSDL Cache, https://www.php.net/manual/en/book.soap.php
34931# Cache format extracted from source:
34932# https://svn.php.net/viewvc/php/php-src/trunk/ext/soap/php_sdl.c?revision=HEAD&view=markup
34933# Requires file >= 5.05
34934# By Elan Ruusamae <glen@delfi.ee>, Patryk Zawadzki <patrys@pld-linux.org>, 2010-2011
349350		string		wsdl		PHP WSDL cache,
34936>4		byte		x		version 0x%02x
34937>6		ledate		x		\b, created %s
34938
34939# uri
34940>10		lelong		<0x7fffffff
34941>>10		pstring/l	x		\b, uri: "%s"
34942
34943# source
34944>>>&0		lelong		<0x7fffffff
34945>>>>&-4		pstring/l	x		\b, source: "%s"
34946
34947# target_ns
34948>>>>>&0		lelong		<0x7fffffff
34949>>>>>>&-4	pstring/l	x		\b, target_ns: "%s"
34950#------------------------------------------------------------------------------
34951# x68000:  file(1) magic for the Sharp Home Computer
34952# v1.0
34953# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
34954
34955# Yanagisawa PIC picture
349560	string		PIC
34957>3	search/0x200	\x1A
34958>>&0	search/0x200	\x0
34959>>>&0	ubyte		0		Yanagisawa PIC image file,
34960>>>>&0	ubyte&15	0		model: X68000,
34961>>>>&0	ubyte&15	1		model: PC-88VA,
34962>>>>&0	ubyte&15	2		model: FM-TOWNS,
34963>>>>&0	ubyte&15	3		model: MAC,
34964>>>>&0	ubyte&15	15		model: Generic,
34965>>>>&3	ubeshort	x		%dx
34966>>>>&5	ubeshort	x		\b%d,
34967>>>>&1	ubeshort	4		colors: 16
34968>>>>&1	ubeshort	8		colors: 256
34969>>>>&1	ubeshort	12		colors: 4096
34970>>>>&1	ubeshort	15		colors: 32768
34971>>>>&1	ubeshort	16		colors: 65536
34972>>>>&1	ubeshort	>16		colors: %d-bit
34973
34974
34975
34976#------------------------------------------------------------------------------
34977# $File: xdelta,v 1.5 2011/08/08 09:01:05 christos Exp $
34978# file(1) magic(5) data for xdelta  Josh MacDonald <jmacd@CS.Berkeley.EDU>
34979#
349800	string	%XDELTA%	XDelta binary patch file 0.14
349810	string	%XDZ000%	XDelta binary patch file 0.18
349820	string	%XDZ001%	XDelta binary patch file 0.20
349830	string	%XDZ002%	XDelta binary patch file 1.0
349840	string	%XDZ003%	XDelta binary patch file 1.0.4
349850	string	%XDZ004%	XDelta binary patch file 1.1
34986
349870	string \xD6\xC3\xC4\x00	VCDIFF binary diff
34988
34989#------------------------------------------------------------------------------
34990# $File: xenix,v 1.12 2021/02/23 00:51:10 christos Exp $
34991# xenix:  file(1) magic for Microsoft Xenix
34992#
34993# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small
34994# model" lifted from "magic.xenix", with comment "derived empirically;
34995# treat as folklore until proven"
34996#
34997# "small model", "large model", "huge model" stuff lifted from XXX
34998#
34999# XXX - "x.out" collides with PDP-11 archives
35000#
350010	string		core		core file (Xenix)
35002# URL: http://www.polarhome.com/service/man/?qf=86rel&tf=2&of=Xenix
35003# Reference: http://www.azillionmonkeys.com/qed/Omfg.pdf
35004# Update: Joerg Jenderek
35005# recordtype~TranslatorHEADerRecord
350060	byte		0x80
35007# GRR: line above is too general as it catches also Extensible storage engine DataBase
35008# skip examples like GENA.SND Switch.Snd by looking for record length maximal 1024-3
35009>1	uleshort	<1022
35010# skip examples like GAME.PICTURE Strange.Pic by looking for positive record length
35011>>1	uleshort	>0
35012# skip examples like Xtable.Data FRACTAL.GEN SHR.VIEW by looking for positive string length
35013>>>3	ubyte		>0
35014# skip examples like OMBRE.6 with "UUUUUU" by looking for filename like "hello.c"
35015>>>>4	regex	[a-zA-Z_/]{1,8}[.]	8086 relocatable (Microsoft)
35016#!:mime	application/octet-stream
35017!:mime	application/x-object
35018!:ext	o/a
35019>>>>>3	pstring		x		\b, "%s"
35020# checksum
35021#>>>>>(3.b+4)	ubyte	x		\b, checksum 0x%2.2x
350220	leshort		0xff65		x.out
35023>2	string		__.SYMDEF	 randomized
35024>0	byte		x		archive
350250	leshort		0x206		Microsoft a.out
35026>8	leshort		1		Middle model
35027>0x1e	leshort		&0x10		overlay
35028>0x1e	leshort		&0x2		separate
35029>0x1e	leshort		&0x4		pure
35030>0x1e	leshort		&0x800		segmented
35031>0x1e	leshort		&0x400		standalone
35032>0x1e	leshort		&0x8		fixed-stack
35033>0x1c	byte		&0x80		byte-swapped
35034>0x1c	byte		&0x40		word-swapped
35035>0x10	lelong		>0		not-stripped
35036>0x1e	leshort		^0xc000		pre-SysV
35037>0x1e	leshort		&0x4000		V2.3
35038>0x1e	leshort		&0x8000		V3.0
35039>0x1c	byte		&0x4		86
35040>0x1c	byte		&0xb		186
35041>0x1c	byte		&0x9		286
35042>0x1c	byte		&0xa		386
35043>0x1f	byte		<0x040		small model
35044>0x1f	byte		=0x048		large model
35045>0x1f	byte		=0x049		huge model
35046>0x1e	leshort		&0x1		executable
35047>0x1e	leshort		^0x1		object file
35048>0x1e	leshort		&0x40		Large Text
35049>0x1e	leshort		&0x20		Large Data
35050>0x1e	leshort		&0x120		Huge Objects Enabled
35051>0x10	lelong		>0		not stripped
35052
350530	leshort		0x140		old Microsoft 8086 x.out
35054>0x3	byte		&0x4		separate
35055>0x3	byte		&0x2		pure
35056>0	byte		&0x1		executable
35057>0	byte		^0x1		relocatable
35058>0x14	lelong		>0		not stripped
35059
350600	lelong		0x206		b.out
35061>0x1e	leshort		&0x10		overlay
35062>0x1e	leshort		&0x2		separate
35063>0x1e	leshort		&0x4		pure
35064>0x1e	leshort		&0x800		segmented
35065>0x1e	leshort		&0x400		standalone
35066>0x1e	leshort		&0x1		executable
35067>0x1e	leshort		^0x1		object file
35068>0x1e	leshort		&0x4000		V2.3
35069>0x1e	leshort		&0x8000		V3.0
35070>0x1c	byte		&0x4		86
35071>0x1c	byte		&0xb		186
35072>0x1c	byte		&0x9		286
35073>0x1c	byte		&0x29		286
35074>0x1c	byte		&0xa		386
35075>0x1e	leshort		&0x4		Large Text
35076>0x1e	leshort		&0x2		Large Data
35077>0x1e	leshort		&0x102		Huge Objects Enabled
35078
350790	leshort		0x580		XENIX 8086 relocatable or 80286 small model
35080
35081#------------------------------------------------------------------------------
35082# $File: xilinx,v 1.8 2017/03/17 21:35:28 christos Exp $
35083# This is Aaron's attempt at a MAGIC file for Xilinx .bit files.
35084# Xilinx-Magic@RevRagnarok.com
35085# Got the info from FPGA-FAQ 0026
35086#
35087# Rewritten to use pstring/H instead of hardcoded lengths by O. Freyermuth,
35088# fixes at least reading of bitfiles from Spartan 2, 3, 6.
35089# http://www.fpga-faq.com/FAQ_Pages/0026_Tell_me_about_bit_files.htm
35090#
35091# First there is the sync header and its length
350920	beshort 0x0009
35093>2 	belong	=0x0ff00ff0
35094>>&0	belong  =0x0ff00ff0
35095>>>&0	byte    =0x00
35096>>>&1   beshort =0x0001
35097>>>&3	string	a	Xilinx BIT data
35098# Next is a Pascal-style string with the NCD name. We want to capture that.
35099>>>>&0	   pstring/H	x	- from %s
35100# And then 'b'
35101>>>>>&1    string b
35102# Then the model / part number:
35103>>>>>>&0   pstring/H    x       - for %s
35104# Then 'c'
35105>>>>>>>&1 string c
35106# Then the build-date
35107>>>>>>>>&0 pstring/H    x       - built %s
35108# Then 'd'
35109>>>>>>>>>&1   string d
35110# Then the build-time
35111>>>>>>>>>>&0  pstring/H x        \b(%s)
35112# Then 'e'
35113>>>>>>>>>>>&1  string e
35114# And length of data
35115>>>>>>>>>>>>&0 belong x          - data length 0x%x
35116
35117# Raw bitstream files
351180      long    0xffffffff
35119>&0    belong  0xaa995566      Xilinx RAW bitstream (.BIN)
35120
35121#------------------------------------------------------------------------------
35122# $File: xo65,v 1.4 2009/09/19 16:28:13 christos Exp $
35123# xo65 object files
35124# From: "Ullrich von Bassewitz" <uz@cc65.org>
35125#
351260	string		\x55\x7A\x6E\x61	xo65 object,
35127>4	leshort		x			version %d,
35128>6	leshort&0x0001 =0x0001			with debug info
35129>6	leshort&0x0001 =0x0000			no debug info
35130
35131# xo65 library files
351320	string		\x6E\x61\x55\x7A	xo65 library,
35133>4	leshort		x			version %d
35134
35135# o65 object files
351360	string		\x01\x00\x6F\x36\x35	o65
35137>6	leshort&0x1000	=0x0000			executable,
35138>6	leshort&0x1000	=0x1000			object,
35139>5	byte		x			version %d,
35140>6	leshort&0x8000	=0x8000			65816,
35141>6	leshort&0x8000	=0x0000			6502,
35142>6	leshort&0x2000	=0x2000			32 bit,
35143>6	leshort&0x2000	=0x0000			16 bit,
35144>6	leshort&0x4000	=0x4000			page reloc,
35145>6	leshort&0x4000	=0x0000			byte reloc,
35146>6	leshort&0x0003	=0x0000			alignment 1
35147>6	leshort&0x0003	=0x0001			alignment 2
35148>6	leshort&0x0003	=0x0002			alignment 4
35149>6	leshort&0x0003	=0x0003			alignment 256
35150
35151#------------------------------------------------------------------------------
35152# $File: xwindows,v 1.11 2019/04/19 00:42:27 christos Exp $
35153# xwindows:  file(1) magic for various X/Window system file formats.
35154
35155# Compiled X Keymap
35156# XKM (compiled X keymap) files (including version and byte ordering)
351571	string	mkx				Compiled XKB Keymap: lsb,
35158>0	byte	>0				version %d
35159>0	byte	=0				obsolete
351600	string	xkm				Compiled XKB Keymap: msb,
35161>3	byte	>0				version %d
35162>3	byte	=0				obsolete
35163
35164# xfsdump archive
351650	string	xFSdump0			xfsdump archive
35166>8	belong	x	(version %d)
35167
35168# Jaleo XFS files
351690	long	395726				Jaleo XFS file
35170>4	long	x				- version %d
35171>8	long	x				- [%d -
35172>20	long	x				\b%dx
35173>24	long	x				\b%dx
35174>28	long	1008				\bYUV422]
35175>28	long	1000				\bRGB24]
35176
35177# Xcursor data
35178# X11 mouse cursor format defined in libXcursor, see
35179# https://www.x.org/archive/X11R6.8.1/doc/Xcursor.3.html
35180# https://cgit.freedesktop.org/xorg/lib/libXcursor/tree/include/X11/Xcursor/Xcursor.h
351810	string		Xcur		Xcursor data
35182!:mime	image/x-xcursor
35183>10	leshort		x		version %d
35184>>8	leshort		x		\b.%d
35185
35186
35187#------------------------------------------------------------------------------
35188# $File: yara,v 1.3 2019/04/19 00:42:27 christos Exp $
35189# yara:  file(1) magic for https://virustotal.github.io/yara/
35190#
35191
351920	string	YARA
35193>4	lelong	>2047
35194>8	byte	<20	YARA 3.x compiled rule set
35195# version
35196>>8	clear	x
35197>>8	byte	6	created with version 3.3.0
35198>>8	byte	8	created with version 3.4.0
35199>>8	byte	11	created with version 3.5.0
35200>>8	default	x
35201>>>8	byte	x	development version 0x%02x
35202#------------------------------------------------------------------------------
35203# zfs:	file(1) magic for ZFS dumps
35204#
35205# From <rea-fbsd@codelabs.ru>
35206# ZFS dump header has the following structure (as per zfs_ioctl.h
35207# in FreeBSD with drr_type is set to DRR_BEGIN)
35208#
35209#   enum {
35210#	DRR_BEGIN, DRR_OBJECT, DRR_FREEOBJECTS,
35211#	DRR_WRITE, DRR_FREE, DRR_END,
35212#   } drr_type;
35213#   uint32_t drr_pad;
35214#   uint64_t drr_magic;
35215#   uint64_t drr_version;
35216#   uint64_t drr_creation_time;
35217#   dmu_objset_type_t drr_type;
35218#   uint32_t drr_pad;
35219#   uint64_t drr_toguid;
35220#   uint64_t drr_fromguid;
35221#   char drr_toname[MAXNAMELEN];
35222#
35223# Backup magic is 0x00000002f5bacbac (quad word)
35224# The drr_type is defined as
35225#   typedef enum dmu_objset_type {
35226#	  DMU_OST_NONE,
35227#	  DMU_OST_META,
35228#	  DMU_OST_ZFS,
35229#	  DMU_OST_ZVOL,
35230#	  DMU_OST_OTHER,		  /* For testing only! */
35231#	  DMU_OST_ANY,			  /* Be careful! */
35232#	  DMU_OST_NUMTYPES
35233#  } dmu_objset_type_t;
35234#
35235# Almost all uint64_t fields are printed as the 32-bit ones (with high
35236# 32 bits zeroed), because there is no simple way to print them as the
35237# full 64-bit values.
35238
35239# Big-endian values
352408	string	\000\000\000\002\365\272\313\254 ZFS shapshot (big-endian machine),
35241>20	belong	x	version %u,
35242>32	belong	0	type: NONE,
35243>32	belong	1	type: META,
35244>32	belong	2	type: ZFS,
35245>32	belong	3	type: ZVOL,
35246>32	belong	4	type: OTHER,
35247>32	belong	5	type: ANY,
35248>32	belong	>5	type: UNKNOWN (%u),
35249>40	byte	x	destination GUID: %02X
35250>41	byte	x	%02X
35251>42	byte	x	%02X
35252>43	byte	x	%02X
35253>44	byte	x	%02X
35254>45	byte	x	%02X
35255>46	byte	x	%02X
35256>47	byte	x	%02X,
35257>48	ulong	>0
35258>>52	ulong	>0
35259>>>48	byte	x	source GUID: %02X
35260>>>49	byte	x	%02X
35261>>>50	byte	x	%02X
35262>>>51	byte	x	%02X
35263>>>52	byte	x	%02X
35264>>>53	byte	x	%02X
35265>>>54	byte	x	%02X
35266>>>55	byte	x	%02X,
35267>56	string	>\0	name: '%s'
35268
35269# Little-endian values
352708	string	\254\313\272\365\002\000\000\000	ZFS shapshot (little-endian machine),
35271>16	lelong	x	version %u,
35272>32	lelong	0	type: NONE,
35273>32	lelong	1	type: META,
35274>32	lelong	2	type: ZFS,
35275>32	lelong	3	type: ZVOL,
35276>32	lelong	4	type: OTHER,
35277>32	lelong	5	type: ANY,
35278>32	lelong	>5	type: UNKNOWN (%u),
35279>47	byte	x	destination GUID: %02X
35280>46	byte	x	%02X
35281>45	byte	x	%02X
35282>44	byte	x	%02X
35283>43	byte	x	%02X
35284>42	byte	x	%02X
35285>41	byte	x	%02X
35286>40	byte	x	%02X,
35287>48	ulong	>0
35288>>52	ulong	>0
35289>>>55	byte	x	source GUID: %02X
35290>>>54	byte	x	%02X
35291>>>53	byte	x	%02X
35292>>>52	byte	x	%02X
35293>>>51	byte	x	%02X
35294>>>50	byte	x	%02X
35295>>>49	byte	x	%02X
35296>>>48	byte	x	%02X,
35297>56	string	>\0	name: '%s'
35298
35299#------------------------------------------------------------------------------
35300# $File: zilog,v 1.7 2009/09/19 16:28:13 christos Exp $
35301# zilog:  file(1) magic for Zilog Z8000.
35302#
35303# Was it big-endian or little-endian?  My Product Specification doesn't
35304# say.
35305#
353060	long		0xe807		object file (z8000 a.out)
353070	long		0xe808		pure object file (z8000 a.out)
353080	long		0xe809		separate object file (z8000 a.out)
353090	long		0xe805		overlay object file (z8000 a.out)
35310#------------------------------------------------------------------------------
35311# $File: zip,v 1.6 2021/02/05 22:55:36 christos Exp $
35312# zip:  file(1) magic for zip files; this is not use
35313# Note the version of magic in archive is currently stronger, this is
35314# just an example until negative offsets are supported better
35315
35316# Zip Central Directory record
353170	name		zipcd
35318>0	string		PK\001\002	Zip archive data
35319!:mime	application/zip
35320>>4	leshort		x		\b, made by
35321>>4	use		zipversion
35322>>4	use		ziphost
35323>>6	leshort		x		\b, extract using at least
35324>>6	use		zipversion
35325>>12	ledate		x		\b, last modified %s
35326>>24	lelong		>0		\b, uncompressed size %d
35327>>10	leshort		x		\b, method=
35328>>10	use		zipcompression
35329
35330# URL:		https://en.wikipedia.org/wiki/Zip_(file_format)
35331# reference:	https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT (Version: 6.3.9)
35332# Zip known compressions
353330	name		zipcompression
35334>0	leshort		0		\bstore
35335>0	leshort		1		\bShrinking
35336>0	leshort		6		\bImploding
35337>0	leshort		7		\bTokenizing
35338>0	leshort		8		\bdeflate
35339>0	leshort		9		\bdeflate64
35340>0	leshort		10		\bLibrary imploding
35341#>0	leshort		11 		\bReserved by PKWARE
35342>0	leshort		12		\bbzip2
35343#>0	leshort		13 		\bReserved by PKWARE
35344>0	leshort		14		\blzma
35345#>0	leshort		15 		\bReserved by PKWARE
35346>0	leshort		16		\bCMPSC (IBM z/OS)
35347#>0	leshort		17 		\bReserved by PKWARE
35348>0	leshort		18		\bIBM TERSE
35349>0	leshort		19		\bIBM LZ77 (z/Architecture)
35350>0	leshort		20		\bZstd (deprecated)
35351>0	leshort		93		\bZstd
35352>0	leshort		94		\bMP3
35353>0	leshort		95		\bxz
35354>0	leshort		96		\bJpeg
35355>0	leshort		97		\bWavPack
35356>0	leshort		98		\bPPMd
35357>0	leshort		99		\bAES Encrypted
35358>0	default		x
35359>>0	leshort		x		\b[%#x]
35360
35361# Zip known versions
353620	name		zipversion
35363# The lower byte indicates the ZIP version of this file. The value/10 indicates
35364# the major version number, and the value mod 10 is the minor version number.
35365>0	ubyte/10	x		v%u
35366>0	ubyte%10	x		\b.%u
35367# >0	leshort		0x09		v0.9
35368# >0	leshort		0x0a		v1.0
35369# >0	leshort		0x0b		v1.1
35370# >0	leshort		0x14		v2.0
35371# >0	leshort		0x15		v2.1
35372# >0	leshort		0x19		v2.5
35373# >0	leshort		0x1b		v2.7
35374# >0	leshort		0x2d		v4.5
35375# >0	leshort		0x2e		v4.6
35376# >0	leshort		0x32		v5.0
35377# >0	leshort		0x33		v5.1
35378# >0	leshort		0x34		v5.2
35379# >0	leshort		0x3d		v6.1
35380# >0	leshort		0x3e		v6.2
35381# >0	leshort		0x3f		v6.3
35382# >0	default		x
35383# >>0	leshort		x		v?[%#x]
35384
35385#	display compatible host system name of ZIP archive
353860	name		ziphost
35387# The upper byte indicates the compatibility of the file attribute information.
35388# If the file is compatible with MS-DOS (v 2.04g) then this value will be zero.
35389#>1	ubyte		0		DOS
35390>1	ubyte		1 		Amiga
35391>1	ubyte		2		OpenVMS
35392>1	ubyte		3		UNIX
35393>1	ubyte		4		VM/CMS
35394>1	ubyte		6		OS/2
35395>1	ubyte		7		Macintosh
35396>1	ubyte		11		MVS
35397>1	ubyte		13		Acorn Risc
35398>1	ubyte		16		BeOS
35399>1	ubyte		17		Tandem
35400# 9 untested
35401>1	ubyte		5		Atari ST
35402>1	ubyte		8		Z-System
35403>1	ubyte		9		CP/M
35404>1	ubyte		10		Windows NTFS
35405>1	ubyte		12		VSE
35406>1	ubyte		14		VFAT
35407>1	ubyte		15		alternate MVS
35408>1	ubyte		18		OS/400
35409>1	ubyte		19		OS X
35410# unused
35411#>1	ubyte		>19		unused 0x%x
35412
35413# Zip End Of Central Directory record
35414-22	string		PK\005\006
35415#>4	leshort		>1		\b, %d disks
35416#>6	leshort		>1		\b, central directory disk %d
35417#>8	leshort		>1		\b, %d central directories on this disk
35418#>10	leshort		>1		\b, %d central directories
35419#>12	lelong		x		\b, %d central directory bytes
35420>(16.l)	use		zipcd
35421>>20	pstring/l	>0		\b, %s
35422
35423#------------------------------------------------------------------------------
35424# $File: zyxel,v 1.6 2009/09/19 16:28:13 christos Exp $
35425# zyxel:  file(1) magic for ZyXEL modems
35426#
35427# From <rob@pe1chl.ampr.org>
35428# These are the /etc/magic entries to decode datafiles as used for the
35429# ZyXEL U-1496E DATA/FAX/VOICE modems.  (This header conforms to a
35430# ZyXEL-defined standard)
35431
354320	string		ZyXEL\002	ZyXEL voice data
35433>10	byte		0		- CELP encoding
35434>10	byte&0x0B	1		- ADPCM2 encoding
35435>10	byte&0x0B	2		- ADPCM3 encoding
35436>10	byte&0x0B	3		- ADPCM4 encoding
35437>10	byte&0x0B	8		- New ADPCM3 encoding
35438>10	byte&0x04	4		with resync
35439