xref: /PHP-8.3/ext/fileinfo/tests/magic (revision bd24c562)
1# Magic data for file(1) command.
2# Format is described in magic(files), where:
3# files is 5 on V7 and BSD, 4 on SV, and ?? on SVID.
4# Don't edit this file, edit /etc/magic or send your magic improvements
5# to the maintainers, at file@astron.com
6
7#------------------------------------------------------------------------------
8# Localstuff:  file(1) magic for locally observed files
9#
10# $File: Localstuff,v 1.5 2007/01/12 17:38:27 christos Exp $
11# Add any locally observed files here.  Remember:
12# text if readable, executable if runnable binary, data if unreadable.
13
14#------------------------------------------------------------------------------
15# $File: acorn,v 1.8 2021/04/26 15:56:00 christos Exp $
16# acorn:  file(1) magic for files found on Acorn systems
17#
18
19# RISC OS Chunk File Format
20# From RISC OS Programmer's Reference Manual, Appendix D
21# We guess the file type from the type of the first chunk.
220	lelong		0xc3cbc6c5	RISC OS Chunk data
23>12	string		OBJ_		\b, AOF object
24>12	string		LIB_		\b, ALF library
25
26# RISC OS AIF, contains "SWI OS_Exit" at offset 16.
2716	lelong		0xef000011	RISC OS AIF executable
28
29# RISC OS Draw files
30# From RISC OS Programmer's Reference Manual, Appendix E
310	string 		Draw		RISC OS Draw file data
32
33# RISC OS new format font files
34# From RISC OS Programmer's Reference Manual, Appendix E
350	string		FONT\0		RISC OS outline font data,
36>5	byte		x		version %d
370	string		FONT\1		RISC OS 1bpp font data,
38>5	byte		x		version %d
390	string		FONT\4		RISC OS 4bpp font data
40>5	byte		x		version %d
41
42# RISC OS Music files
43# From RISC OS Programmer's Reference Manual, Appendix E
440	string		Maestro\r	RISC OS music file
45>8	byte		x		version %d
46
47>8	byte		x		type %d
48
49# Digital Symphony data files
50# From: Bernard Jungen (bern8817@euphonynet.be)
510		string	\x02\x01\x13\x13\x13\x01\x0d\x10	Digital Symphony sound sample (RISC OS),
52>8		byte	x	version %d,
53>9		pstring	x	named "%s",
54>(9.b+19)	byte	=0	8-bit logarithmic
55>(9.b+19)	byte	=1	LZW-compressed linear
56>(9.b+19)	byte	=2	8-bit linear signed
57>(9.b+19)	byte	=3	16-bit linear signed
58>(9.b+19)	byte	=4	SigmaDelta-compressed linear
59>(9.b+19)	byte	=5	SigmaDelta-compressed logarithmic
60>(9.b+19)	byte	>5	unknown format
61
620	string	\x02\x01\x13\x13\x14\x12\x01\x0b	Digital Symphony song (RISC OS),
63>8	byte	x	version %d,
64>9	byte	=1	1 voice,
65>9	byte	!1	%d voices,
66>10	leshort	=1	1 track,
67>10	leshort	!1	%d tracks,
68>12	leshort	=1	1 pattern
69>12	leshort	!1	%d patterns
70
710	string	\x02\x01\x13\x13\x10\x14\x12\x0e
72>9	byte	=0	Digital Symphony sequence (RISC OS),
73>>8	byte	x	version %d,
74>>10	byte	=1	1 line,
75>>10	byte	!1	%d lines,
76>>11	leshort	=1	1 position
77>>11	leshort	!1	%d positions
78>9	byte	=1	Digital Symphony pattern data (RISC OS),
79>>8	byte	x	version %d,
80>>10	leshort	=1	1 pattern
81>>10	leshort	!1	%d patterns
82
83# From: Joerg Jenderek
84# URL: https://www.kyzer.me.uk/pack/xad/#PackDir
85# reference: https://www.kyzer.me.uk/pack/xad/xad_PackDir.lha/PackDir.c
86# GRR: line below is too general as it matches also "Git pack" in ./revision
870	string	PACK\0
88# check for valid compression method 0-4
89>5	ulelong	<5
90# https://www.riscosopen.org/wiki/documentation/show/Introduction%20To%20Filing%20Systems
91# To skip "Git pack" version 0 test for root directory object like
92# ADFS::RPC.$.websitezip.FONTFIX
93>>9	string	>ADFS\  PackDir archive (RISC OS)
94# TrID labels above as "Acorn PackDir compressed Archive"
95# compression mode y (0 - 4) for GIF LZW with a maximum n bits
96# (y~n,0~12,1~13,2~14,3~15,4~16)
97>>>5	ulelong+12 x	\b, LZW %u-bits compression
98# https://www.filebase.org.uk/filetypes
99# !Packdir compressed archive has three hexadecimal digits code 68E
100!:mime	application/x-acorn-68E
101!:ext	pkd/bin
102# null terminated root directory object like IDEFS::IDE-4.$.Apps.GRAPHICS.!XFMPdemo
103>>>9	string	x	\b, root "%s"
104# load address 0xFFFtttdd, ttt is the object filetype and dddddddddd is time
105>>>>&1	ulelong	x	\b, load address %#x
106# execution address 0xdddddddd dddddddddd is 40 bit unsigned centiseconds since 1.1.1900 UTC
107>>>>&5	ulelong	x	\b, exec address %#x
108# attributes (bits: 0~owner read,1~owner write,3~no delete,4~public read,5~public write)
109>>>>&9	ulelong	x	\b, attributes %#x
110# number of entries in this directory. for root dir 0
111#>>>&13	ulelong	x	\b, entries %#x
112# the entries start here with object name
113>>>>&17	string	x	\b, 1st object "%s"
114
115
116#------------------------------------------------------------------------------
117# $File: adi,v 1.4 2009/09/19 16:28:07 christos Exp $
118# adi: file(1) magic for ADi's objects
119# From Gregory McGarry <g.mcgarry@ieee.org>
120#
1210	leshort		0x521c		COFF DSP21k
122>18	lelong		&02		executable,
123>18	lelong		^02
124>>18	lelong		&01		static object,
125>>18	lelong		^01		relocatable object,
126>18	lelong		&010		stripped
127>18	lelong		^010		not stripped
128
129#------------------------------------------------------------------------------
130# $File: adventure,v 1.18 2019/04/19 00:42:27 christos Exp $
131# adventure: file(1) magic for Adventure game files
132#
133# from Allen Garvin <earendil@faeryland.tamu-commerce.edu>
134# Edited by Dave Chapeskie <dchapes@ddm.on.ca> Jun 28, 1998
135# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
136#
137# ALAN
138# I assume there are other, lower versions, but these are the only ones I
139# saw in the archive.
1400	beshort	0x0206	ALAN game data
141>2	byte	<10	version 2.6%d
142
143
144# Infocom (see z-machine)
145#------------------------------------------------------------------------------
146# Z-machine:  file(1) magic for Z-machine binaries.
147# Sanity checks by David Griffith <dave@661.org>
148# Updated by Adam Buchbinder <adam.buchbinder@gmail.com>
149#
150#http://www.gnelson.demon.co.uk/zspec/sect11.html
151#https://www.jczorkmid.net/~jpenney/ZSpec11-latest.txt
152#https://en.wikipedia.org/wiki/Z-machine
153# The first byte is the Z-machine revision; it is always between 1 and 8. We
154# had false matches (for instance, inbig5.ocp from the Omega TeX extension as
155# well as an occasional MP3 file), so we sanity-check the version number.
156#
157# It might be possible to sanity-check the release number as well, as it seems
158# (at least in classic Infocom games) to always be a relatively small number,
159# always under 150 or so, but as this isn't rigorous, we'll wait on that until
160# it becomes clear that it's needed.
161#
1620	ubyte			>0
163>0	ubyte			<9
164>>16	belong&0xfe00f0f0	0x3030
165>>>0	ubyte			< 10
166>>>>2	ubeshort		x
167>>>>>18	regex			[0-9][0-9][0-9][0-9][0-9][0-9]
168>>>>>>0	ubyte			< 10	Infocom (Z-machine %d
169>>>>>>>2	ubeshort	x 	\b, Release %d
170>>>>>>>>18	string		>\0	\b, Serial %.6s
171>>>>>>>>18	string		x	\b)
172!:strength + 40
173!:mime	application/x-zmachine
174
175#------------------------------------------------------------------------------
176# Glulx:  file(1) magic for Glulx binaries.
177#
178# David Griffith <dave@661.org>
179# I haven't checked for false matches yet.
180#
1810	string			Glul	Glulx game data
182>4	beshort			x	(Version %d
183>>6	byte			x	\b.%d
184>>8	byte			x	\b.%d)
185>36	string			Info	Compiled by Inform
186!:mime	application/x-glulx
187
188
189# For Quetzal and blorb magic see iff
190
191
192# TADS (Text Adventure Development System) version 2
193#  All files are machine-independent (games compile to byte-code) and are tagged
194#  with a version string of the form "V2.<digit>.<digit>\0".
195#  Game files start with "TADS2 bin\n\r\032\0" then the compiler version.
1960	string	TADS2\ bin	TADS
197>9	belong  !0x0A0D1A00	game data, CORRUPTED
198>9	belong	 0x0A0D1A00
199>>13	string	>\0		%s game data
200!:mime	application/x-tads
201#  Resource files start with "TADS2 rsc\n\r\032\0" then the compiler version.
2020	string	TADS2\ rsc	TADS
203>9	belong  !0x0A0D1A00	resource data, CORRUPTED
204>9	belong	 0x0A0D1A00
205>>13	string	>\0		%s resource data
206!:mime	application/x-tads
207#  Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian
208#  2-byte length N, the N-char name of the game file *without* a NUL (darn!),
209# "TADS2 save\n\r\032\0" and the interpreter version.
2100	string	TADS2\ save/g	TADS
211>12	belong	!0x0A0D1A00	saved game data, CORRUPTED
212>12	belong	 0x0A0D1A00
213>>(16.s+32) string >\0		%s saved game data
214!:mime	application/x-tads
215#  Other saved game files start with "TADS2 save\n\r\032\0" and the interpreter
216#  version.
2170	string	TADS2\ save	TADS
218>10	belong	!0x0A0D1A00	saved game data, CORRUPTED
219>10	belong	 0x0A0D1A00
220>>14	string	>\0		%s saved game data
221!:mime	application/x-tads
222
223# TADS (Text Adventure Development System) version 3
224#  Game files start with "T3-image\015\012\032"
2250	string	T3-image\015\012\032
226>11	leshort	x		TADS 3 game data (format version %d)
227#  Saved game files start with "T3-state-v####\015\012\032"
228#  where #### is a format version number
2290	string	T3-state-v
230>14	string	\015\012\032	TADS 3 saved game data (format version
231>>10	byte	x		%c
232>>11	byte	x		\b%c
233>>12	byte	x		\b%c
234>>13	byte	x		\b%c)
235!:mime	application/x-t3vm-image
236
237# edited by David Griffith <dave@661.org>
238# Danny Milosavljevic <danny.milo@gmx.net>
239# These are ADRIFT (adventure game standard) game files, extension .taf
240# Checked from source at (http://www.adrift.co/) and various taf files
241# found at the Interactive Fiction Archive (https://ifarchive.org/)
2420	belong  0x3C423FC9
243>4	belong  0x6A87C2CF	Adrift game file version
244>>8	belong  0x94453661	3.80
245>>8	belong  0x94453761	3.90
246>>8	belong  0x93453E61	4.0
247>>8	belong  0x92453E61	5.0
248>>8	default x		unknown
249!:mime	application/x-adrift
250
251#------------------------------------------------------------------------------
252# $File: aes,v 1.1 2020/08/18 21:20:22 christos Exp $
253#
254# aes: magic file for AES encrypted files
255
256# Summary:	AES Crypt Encrypted Data File
257# From:		Joerg Jenderek
258# URL:		https://en.wikipedia.org/wiki/Advanced_Encryption_Standard
259# Reference:	https://www.aescrypt.com/aes_file_format.html
2600	string		AES
261>3	ubyte		<3		AES encrypted data, version %u
262#!:mime	application/aes
263!:mime	application/x-aes-encrypted
264!:ext	aes
265# For Version 2 the encrypted file can have text tags
266>>3	ubyte		=2
267# length of an extension identifier and contents like: 0 24 33 38
268#>>5	ubeshort	x		\b, tag length %u
269#>>5	pstring/H	x		'%s'
270# standard extension tags like CREATED_BY
271>>>7	string		CREATED_BY	\b, created by
272# software product, manufacturer like "SharpAESCrypt v1.3.3.0" "aescrypt (Windows GUI) 3.10" ...
273>>>>&1	string		x		"%s"
274# TODO: more other tags
275# tag CREATED_DATE like YYYY-MM-DD
276# tag CREATED_TIME like HH:MM:SS
277#
278
279
280#------------------------------------------------------------------------------
281# $File: algol68,v 1.4 2021/08/15 06:00:55 christos Exp $
282# algol68:  file(1) magic for Algol 68 source
283#
284# URL: 		https://en.wikipedia.org/wiki/ALGOL_68
285# Reference:	http://www.softwarepreservation.org/projects/ALGOL/report/Algol68_revised_report-AB.pdf
286# Update:	Joerg Jenderek
2870	search/8192	(input,
288>0	use		algol_68
289# graph_2d.a68
2900	regex/4006	\^PROC
291#>&-4	string		x			\b, dBase or Algol "%s"
292# most xBase scripts *.prg with PROCEDURE like: Areacode BarCount Def_mens Vendors
293#>&-4	string		=PROCEDURE		\b, dBase PROCEDURE
294# skip xBase program scripts *.prg with PROCEDURE keyword
295# keyword proc probably followed by white space used to specify algol procedures
296>&-4	string		!PROCEDURE
297>>0	use		algol_68
2980	regex/1024	\bMODE[\t\ ]
299>0	use		algol_68
3000	regex/1024	\bMODE[\t\ ]
301>0	use		algol_68
3020	regex/1024	\bREF[\t\ ]
303>0	use		algol_68
3040	regex/1024	\bFLEX[\t\ ]\*\\[
305>0	use		algol_68
306
307# display information like mime type and file name extension of Algol 68 source text
3080	name		algol_68		Algol 68 source text
309!:mime	text/x-Algol68
310# https://file-extension.net/seeker/file_extension_a68
311!:ext   a68
312#!:ext   a68/alg
313
314#0	regex          	[\t\ ]OD		Algol 68 source text
315#>0	use		algol_68
316#!:mime	text/x-Algol68
317#0	regex          	[\t\ ]FI		Algol 68 source text
318#>0	use		algol_68
319#!:mime	text/x-Algol68
320
321#------------------------------------------------------------------------------
322# $File: allegro,v 1.4 2009/09/19 16:28:07 christos Exp $
323# allegro:  file(1) magic for Allegro datafiles
324# Toby Deshane <hac@shoelace.digivill.net>
325#
3260 belong 0x736C6821   Allegro datafile (packed)
3270 belong 0x736C682E   Allegro datafile (not packed/autodetect)
3280 belong 0x736C682B   Allegro datafile (appended exe data)
329
330#------------------------------------------------------------------------------
331# $File: alliant,v 1.7 2009/09/19 16:28:07 christos Exp $
332# alliant:  file(1) magic for Alliant FX series a.out files
333#
334# If the FX series is the one that had a processor with a 68K-derived
335# instruction set, the "short" should probably become "beshort" and the
336# "long" should probably become "belong".
337# If it's the i860-based one, they should probably become either the
338# big-endian or little-endian versions, depending on the mode they ran
339# the 860 in....
340#
3410	short		0420		0420 Alliant virtual executable
342>2	short		&0x0020		common library
343>16	long		>0		not stripped
3440	short		0421		0421 Alliant compact executable
345>2	short		&0x0020		common library
346>16	long		>0		not stripped
347
348#------------------------------------------------------------------------------
349# $File: amanda,v 1.6 2017/03/17 21:35:28 christos Exp $
350# amanda:  file(1) magic for amanda file format
351#
3520	string	AMANDA:\ 		AMANDA
353>8	string	TAPESTART\ DATE		tape header file,
354>>23	string	X
355>>>25	string	>\ 			Unused %s
356>>23	string	>\ 			DATE %s
357>8	string	FILE\ 			dump file,
358>>13	string	>\ 			DATE %s
359
360#------------------------------------------------------------------------------
361# $File: amigaos,v 1.20 2021/09/20 00:42:19 christos Exp $
362# amigaos:  file(1) magic for AmigaOS binary formats:
363
364#
365# From ignatios@cs.uni-bonn.de (Ignatios Souvatzis)
366#
3670	belong		0x000003fa	AmigaOS shared library
3680	belong		0x000003f3	AmigaOS loadseg()ble executable/binary
3690	belong		0x000003e7	AmigaOS object/library data
370#
3710	beshort		0xe310		Amiga Workbench
372>2	beshort		1
373>>48	byte		1		disk icon
374>>48	byte		2		drawer icon
375>>48	byte		3		tool icon
376>>48	byte		4		project icon
377>>48	byte		5		garbage icon
378>>48	byte		6		device icon
379>>48	byte		7		kickstart icon
380>>48	byte		8		workbench application icon
381>2	beshort		>1		icon, vers. %d
382#
383# various sound formats from the Amiga
384# G=F6tz Waschk <waschk@informatik.uni-rostock.de>
385#
3860	string		FC14		Future Composer 1.4 Module sound file
3870	string		SMOD		Future Composer 1.3 Module sound file
3880	string		AON4artofnoise	Art Of Noise Module sound file
3891	string		MUGICIAN/SOFTEYES Mugician Module sound file
39058	string		SIDMON\ II\ -\ THE	Sidmon 2.0 Module sound file
3910	string		Synth4.0	Synthesis Module sound file
3920	string		ARP.		The Holy Noise Module sound file
3930	string		BeEp\0		JamCracker Module sound file
3940	string		COSO\0		Hippel-COSO Module sound file
395# Too simple (short, pure ASCII, deep), MPi
396#26	string		V.3		Brian Postma's Soundmon Module sound file v3
397#26	string		BPSM		Brian Postma's Soundmon Module sound file v3
398#26	string		V.2		Brian Postma's Soundmon Module sound file v2
399
400# The following are from: "Stefan A. Haubenthal" <polluks@web.de>
401# Update:	Joerg Jenderek
402# URL:		http://fileformats.archiveteam.org/wiki/Amiga_bitmap_font
403# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/f/font-amiga.trid.xml
404#		https://wiki.amigaos.net/wiki/Graphics_Library_and_Text
405# fch_FileID=FCH_ID=0x0f00
4060	beshort		0x0f00
407# skip some AVM powerline firmware images by check for positive number of font elements
408# https://download.avm.de/fritzpowerline/fritzpowerline-1000e-t/other/fritz.os/fritz.powerline_1000ET_01_05.image
409>2	ubeshort	>0		AmigaOS bitmap font
410#!:mime	application/octet-stream
411!:mime	font/x-amiga-font
412!:ext	font
413# struct FontContents fch_FC; 1st fc_FileName [MAXFONTPATH=256]; ~ filename "/" fc_YSize
414# like: topazb/6 suits/8  Excel/9e emerald/17 Franklin/23 DIAMONDS/60.8C
415>>4	string		x		"%.256s"
416# fc_YSize ~number after slash in fc_FileName; like: 6 7 8 9 11 12 16 17 21 23 45 60
417>>260	beshort		x		\b, fc_YSize %u
418# fch_NumEntries; number of FontContents elements like:
419# 1 (often) 2 3 (IconCondensed.font tempfont.font) 4 (Franklin.font) 6 (mcoop.font)
420>>2	ubeshort	>1		\b, %u elements
421#>>2	beshort		x		\b, %u element
422# plural s
423#>>2	beshort		!1		\bs
424# like: 6 7 8 9 11 12 16 17 21 23 45 60
425#>>262	beshort		x		\b, FLAGS_STYLE
426>>2	beshort		>1		\b, 2nd
427# 2nd fc_FileName like: Franklin/36
428>>>264	string		x		"%.256s"
429>>2	beshort		>2		\b, 3rd
430# 3rd fc_FileName like: Franklin/18
431>>>524	string		x		"%.256s"
432# URL:		http://fileformats.archiveteam.org/wiki/Amiga_bitmap_font
433# Reference:	https://wiki.amigaos.net/wiki/Graphics_Library_and_Text
434#		http://mark0.net/download/triddefs_xml.7z/defs/f/font-amiga-var2.trid.xml
435# Note:		called by TrID "Amiga bitmap Font (var.2)"
436# fch_FileID=TFCH_ID=0x0f02
4370	beshort		0x0f02
438# skip possible misidentified foo by check for positive number of font elements
439>2	ubeshort	>0		AmigaOS bitmap font (TFCH)
440#!:mime	application/octet-stream
441!:mime	font/x-amiga-font
442!:ext	font
443# struct TFontContents fch_TFC[]; 1st tfc_FileName [254]; ~ filename "/" fc_YSize
444# like: Abbey/45 XScript/75 XTriumvirate/45
445>>4	string		x		"%.254s"
446# tfc_TagCount; including the TAG_END tag like: 4
447>>258	ubeshort	x		\b, tfc_TagCount %u
448# tfc_YSize ~number after slash in tfc_FileName; like: 45 75
449>>260	beshort		x		\b, tfc_YSize %u
450# tfc_Style; tfc_Flags like: 8022h 8222h
451#>>262	ubeshort	x		\b, FLAGS_STYLE %#x
452# fch_NumEntries; number of FontContents elements like: 1 (abbey.font) 2 (xscript.font xtriumvirate.font)
453>>2	ubeshort	>1		\b, %u elements
454>>2	beshort		>1		\b, 2nd
455# 2nd tfc_FileName like: XScript/45 XTriumvirate/30
456>>>264	string		x		"%.254s"
4570	beshort		0x0f03		AmigaOS outline font
4580	belong		0x80001001	AmigaOS outline tag
4590	string		##\ version	catalog translation
4600	string		EMOD\0		Amiga E module
4618	string		ECXM\0		ECX module
4620	string/c	@database	AmigaGuide file
463
464# Amiga disk types
465#	display information like volume name of root block on Amiga (floppy) disk
4660	name   	adf-rootblock
467# block primary type = T_HEADER (value 2)
468>0x000	ubelong		!2		\b, type %u
469# header_key; unused in rootblock (value 0)
470>0x004	ubelong		!0		\b, header_key %u
471# high_seq; unused (value 0)
472>0x008	ubelong		!0		\b, high_seq %u
473# ht_size; hash table size; 0x48 for flopies
474>0x00c	ubelong		!0x48		\b, hash table size %#x
475# bm_flag; bitmap flag, -1 means VALID
476>0x138	belong		!-1		\b, bitmap flag %#x
477# bm_ext; first bitmap extension block (Hard disks only)
478>0x1A0	ubelong		!0		\b, bitmap extension block %#x
479# name_len; volume name length; diskname[30]; volume name
480>0x1B0	pstring		>\0		\b, "%s"
481# first directory cache block for FFS; otherwise 0
482>0x1F8	ubelong		!0		\b, directory cache block %#x
483# block secondary type = ST_ROOT (value 1)
484>0x1FC	ubelong		!1		\b, sec_type %#x
485#
4860	string		RDSK		Rigid Disk Block
487>160	string		x		on %.24s
488# URL:		http://fileformats.archiveteam.org/wiki/ADF_(Amiga)
489#		https://en.wikipedia.org/wiki/Amiga_Fast_File_System
490# Reference:	http://lclevy.free.fr/adflib/adf_info.html
491# Update:	Joerg Jenderek
492# Note:		created by ADFOpus.exe
493# 		and verified by `unadf -l TURBO_SILVER_SV.ADF`
4940	string		DOS
495# skip DOS Client Message Files like IPXODI.MSG DOSRQSTR.MSG
496>3	ubyte		<8		Amiga
497# https://reposcope.com/mimetype/application/x-amiga-disk-format
498!:mime	application/x-amiga-disk-format
499!:ext	adf
500>>3	ubyte		0		DOS disk
501>>3	ubyte		1		FFS disk
502>>3	ubyte		2		Inter DOS disk
503>>3	ubyte		3		Inter FFS disk
504# For Fastdir mode the international mode is also enabled,
505>>3	ubyte		4		Fastdir DOS disk
506>>3	ubyte		5		Fastdir FFS dis
507# called by TrID "Amiga Disk image File (OFS+INTL+DIRC)"
508>>3	ubyte		6		Inter Fastdir DOS disk
509# called by TrID "Amiga Disk image File (FFS+INTL+DIRC)"
510>>3	ubyte		7		Inter Fastdir FFS disk
511# but according to Wikipedia variants with long name support
512#>>3	ubyte		6		long name DOS disk
513#>>3	ubyte		7		long name FFS disk
514# DOES NOT only work! Partly for file size  ~< FILE_BYTES_MAX=1 MiB defined in ../../src/file.h
515#>>-0		offset	x		\b, %lld bytes
516# Correct file size, but next lines are NOT executed
517#>>-0		offset	901120		(DD 880 KiB floppy)
518# 880 KiB Double Density floppy disk by characteristic hash table size 0x48 and T_HEADER=2
519>>0x6E00C	ubelong	0x48
520>>>0x6E000	ubelong	2		(DD 880 KiB)
521# 1760 KiB High Density floppy disk (1802240 bytes) by characteristic hash table size 0x48
522>>0xDC00C	ubelong	0x48
523>>>0xDC000	ubelong	2		(HD 1760 KiB)
524# Chksum; special block checksum like: 0 0x44ccf4c0 0x51f32cac 0xe33d0e7d ...
525#>>4	ubelong		x		\b, CRC %#x
526# Rootblock: 0 880 (often for DD and HD) 1146049280 (IMAGINE_1_0_DISK_01.ADF TURBO_SILVER_SV.ADF)
527>>8	ubelong		>0		\b, probably root block %d
528# bootblock code
529>>12	quad		!0		\b, bootable
530# assembler instructions: lea exp(pc),a1; moveq 25h,d0; jsr -552(a6)
531>>>12	ubequad	=0x43fa003e70254eae	AmigaDOS 3.0
532>>>12	default	x
533>>>>12	ubequad	!0x43fa003e70254eae	%#llx..
534# 880 KiB Double Density floppy disk (901120 bytes)
535>>0x6E00C	ubelong	0x48
536>>>0x6E000	ubelong	2
537>>>>0x6E000	use			adf-rootblock
538# 1760 KiB High Density floppy disk (1802240 bytes)
539>>0xDC00C	ubelong	0x48
540>>>0xDC000	ubelong	2
541>>>>0xDC000	use			adf-rootblock
542# 1 MiB hard disc by test for T_HEADER=2 and header_key=0=high_seq
543>>0x80000	ubelong	2
544>>>0x80004	quad	0
545>>>>0x80000	use			adf-rootblock
546# 2 MiB hard disc; only works if in ../../src/file.h FILE_BYTES_MAX is raised to 2 MiB
547#>>0x100000	ubelong	x		2 MiB TEST
548#>>0x100000	ubelong	2		\b, 2 MiB hard disc rootblock
549#>>>0x100000	use			adf-rootblock
5500	string		KICK		Kickstart disk
551
552# From: Alex Beregszaszi <alex@fsn.hu>
5530	string		LZX		LZX compressed archive (Amiga)
554
555# From: Przemek Kramarczyk <pkramarczyk@gmail.com>
5560	string 		.KEY		AmigaDOS script
5570	string 		.key		AmigaDOS script
558
559# AMOS Basic file formats
560# https://www.exotica.org.uk/wiki/AMOS_file_formats
5610	string		AMOS\040Basic\040 	AMOS Basic source code
562>11	byte		=0x56 			\b, tested
563>11	byte		=0x76 			\b, untested
5640 	string		AMOS\040Pro		AMOS Basic source code
565>11	byte		=0x56 			\b, tested
566>11	byte		=0x76 			\b, untested
5670	string		AmSp			AMOS Basic sprite bank
568>4	beshort		x			\b, %d sprites
5690	string		AmIc			AMOS Basic icon bank
570>4	beshort		x			\b, %d icons
5710	string		AmBk			AMOS Basic memory bank
572>4	beshort		x			\b, bank number %d
573>8	belong&0xFFFFFFF	x		\b, length %d
574>12	regex		.{8}			\b, type %s
5750	string		AmBs			AMOS Basic memory banks
576>4	beshort		x			\b, %d banks
577
578#------------------------------------------------------------
579# $File: android,v 1.19 2021/04/26 15:56:00 christos Exp $
580# Various android related magic entries
581#------------------------------------------------------------
582
583# Dalvik .dex format. http://retrodev.com/android/dexformat.html
584# From <mkf@google.com> "Mike Fleming"
585# Fixed to avoid regexec 17 errors on some dex files
586# From <diff@lookout.com> "Tim Strazzere"
5870	string	dex\n
588>0	regex	dex\n[0-9]{2}\0	Dalvik dex file
589>4	string	>000			version %s
5900	string	dey\n
591>0	regex	dey\n[0-9]{2}\0	Dalvik dex file (optimized for host)
592>4	string	>000			version %s
593
594# Android bootimg format
595# From https://android.googlesource.com/\
596# platform/system/core/+/master/mkbootimg/bootimg.h
597# https://github.com/djrbliss/loki/blob/master/loki.h#L43
5980		string	ANDROID!	Android bootimg
599>1024	string	LOKI		\b, LOKI'd
600>>1028	lelong	0			\b (boot)
601>>1028	lelong	1			\b (recovery)
602>8		lelong	>0			\b, kernel
603>>12	lelong	>0			\b (%#x)
604>16		lelong	>0			\b, ramdisk
605>>20	lelong	>0			\b (%#x)
606>24		lelong	>0			\b, second stage
607>>28	lelong	>0			\b (%#x)
608>36		lelong	>0			\b, page size: %d
609>38		string	>0			\b, name: %s
610>64		string	>0		 	\b, cmdline (%s)
611
612# Android Backup archive
613# From: Ariel Shkedi
614# Update: Joerg Jenderek
615# URL: https://github.com/android/platform_frameworks_base/blob/\
616# 0bacfd2ba68d21a68a3df345b830bc2a1e515b5a/services/java/com/\
617# android/server/BackupManagerService.java#L2367
618# Reference: https://sourceforge.net/projects/adbextractor/
619#            android-backup-extractor/perl/backupencrypt.pl
620# Note:	only unix line feeds "\n" found
621# After the header comes a tar file
622# If compressed, the entire tar file is compressed with JAVA deflate
623#
624# Include the version number hardcoded with the magic string to avoid
625# false positives
6260	string/b	ANDROID\ BACKUP\n	Android Backup
627# maybe look for some more characteristics like linefeed '\n' or version
628#>16	string		\n
629# No mime-type defined officially
630!:mime	application/x-google-ab
631!:ext	ab
632# on 2nd line version (often 1, 2 on kitkat 4.4.3+, 4 on 7.1.2)
633>15	string		>\0			\b, version %s
634# "1" on 3rd line means compressed
635>17	string		0\n			\b, Not-Compressed
636>17	string		1\n			\b, Compressed
637# The 4th line is encryption "none" or "AES-256"
638# any string as long as it's not the word none (which is matched below)
639>19	string		none\n			\b, Not-Encrypted
640# look for backup content after line with encryption info
641#>>19	search/7	\n
642# data part after header for not encrypted Android Backup
643#>>>&0	ubequad		x	\b, content %#16.16llx...
644# look for zlib compressed by ./compress after message with 1 space at end
645#>>>&0	indirect	x	\b; contains
646# look for tar archive block by ./archive for package name manifest
647>>288	string		ustar	\b; contains
648>>>31	use	tar-file
649# look for zip/jar archive by ./archive ./zip after message with 1 space at end
650#>>2079	search/1025/s	PK\003\004	\b; contains
651#>>>&0	indirect	x
652>19	string		!none
653>>19    regex/1l	\^([^n\n]|n[^o]|no[^n]|non[^e]|none.+).*	\b, Encrypted (%s)
654# Commented out because they don't seem useful to print
655# (but they are part of the header - the tar file comes after them):
656# The 5th line is User Password Salt (128 Hex)
657# string length too high with standard src configuration
658#>>>&1		string	>\0	\b, PASSWORD salt: "%-128.128s"
659#>>>&1		regex/1l .*	\b, Password salt: %s
660# The 6th line is Master Key Checksum Salt (128 Hex)
661#>>>>&1		regex/1l .*	\b, Master salt: %s
662# The 7th line is Number of PBDKF2 Rounds (10000)
663#>>>>>&1	regex/1l .*	\b, PBKDF2 rounds: %s
664# The 8th line is User key Initialization Vector (IV) (32 Hex)
665#>>>>>>&1	regex/1l .*	\b, IV: %s
666#>>>>>>&1	regex/1l .*	\b, IV: %s
667# The 9th line is Master IV+Key+Checksum (192 Hex)
668#>>>>>>>&1	regex/1l .*	\b, Key: %s
669# look for new line separator char after line number 9
670#>>>0x204	ubyte	0x0a	NL found
671#>>>>&1		ubequad	x	\b, Content magic %16.16llx
672
673# *.pit files by Joerg Jenderek
674# https://forum.xda-developers.com/showthread.php?p=9122369
675# https://forum.xda-developers.com/showthread.php?t=816449
676# Partition Information Table for Samsung's smartphone with Android
677# used by flash software Odin
6780		ulelong			0x12349876
679# 1st pit entry marker
680>0x01C	ulequad&0xFFFFFFFCFFFFFFFC	=0x0000000000000000
681# minimal 13 and maximal 18 PIT entries found
682>>4		ulelong			<128	Partition Information Table for Samsung smartphone
683>>>4		ulelong			x	\b, %d entries
684# 1. pit entry
685>>>4		ulelong			>0	\b; #1
686>>>0x01C	use				PIT-entry
687>>>4		ulelong			>1	\b; #2
688>>>0x0A0	use				PIT-entry
689>>>4		ulelong			>2	\b; #3
690>>>0x124	use				PIT-entry
691>>>4		ulelong			>3	\b; #4
692>>>0x1A8	use				PIT-entry
693>>>4		ulelong			>4	\b; #5
694>>>0x22C	use				PIT-entry
695>>>4		ulelong			>5	\b; #6
696>>>0x2B0	use				PIT-entry
697>>>4		ulelong			>6	\b; #7
698>>>0x334	use				PIT-entry
699>>>4		ulelong			>7 	\b; #8
700>>>0x3B8	use				PIT-entry
701>>>4		ulelong			>8 	\b; #9
702>>>0x43C	use				PIT-entry
703>>>4		ulelong			>9	\b; #10
704>>>0x4C0	use				PIT-entry
705>>>4		ulelong			>10	\b; #11
706>>>0x544	use				PIT-entry
707>>>4		ulelong			>11	\b; #12
708>>>0x5C8	use				PIT-entry
709>>>4		ulelong			>12	\b; #13
710>>>>0x64C	use				PIT-entry
711# 14. pit entry
712>>>4		ulelong			>13	\b; #14
713>>>>0x6D0	use				PIT-entry
714>>>4		ulelong			>14	\b; #15
715>>>0x754	use				PIT-entry
716>>>4		ulelong			>15	\b; #16
717>>>0x7D8	use				PIT-entry
718>>>4		ulelong			>16	\b; #17
719>>>0x85C	use				PIT-entry
720# 18. pit entry
721>>>4		ulelong			>17	\b; #18
722>>>0x8E0	use				PIT-entry
723
7240	name			PIT-entry
725# garbage value implies end of pit entries
726>0x00		ulequad&0xFFFFFFFCFFFFFFFC	=0x0000000000000000
727# skip empty partition name
728>>0x24		ubyte				!0
729# partition name
730>>>0x24		string				>\0			%-.32s
731# flags
732>>>0x0C		ulelong&0x00000002		2			\b+RW
733# partition ID:
734# 0~IPL,MOVINAND,GANG;1~PIT,GPT;2~HIDDEN;3~SBL,HIDDEN;4~SBL2,HIDDEN;5~BOOT;6~kernel,RECOVER,misc;7~RECOVER
735# ;11~MODEM;20~efs;21~PARAM;22~FACTORY,SYSTEM;23~DBDATAFS,USERDATA;24~CACHE;80~BOOTLOADER;81~TZSW
736>>>0x08	ulelong		x			(%#x)
737# filename
738>>>0x44		string				>\0			"%-.64s"
739#>>>0x18	ulelong				>0
740# blocksize in 512 byte units ?
741#>>>>0x18	ulelong				x			\b, %db
742# partition size in blocks ?
743#>>>>0x22	ulelong				x			\b*%d
744
745# Android sparse img format
746# From https://android.googlesource.com/\
747# platform/system/core/+/master/libsparse/sparse_format.h
7480		lelong	0xed26ff3a		Android sparse image
749>4		leshort	x			\b, version: %d
750>6		leshort	x			\b.%d
751>16		lelong	x			\b, Total of %d
752>12		lelong	x			\b %d-byte output blocks in
753>20		lelong	x			\b %d input chunks.
754
755# Android binary XML magic
756# In include/androidfw/ResourceTypes.h:
757# RES_XML_TYPE = 0x0003 followed by the size of the header (ResXMLTree_header),
758# which is 8 bytes (2 bytes type + 2 bytes header size + 4 bytes size).
7590	lelong	0x00080003	Android binary XML
760
761# Android cryptfs footer
762# From https://android.googlesource.com/\
763# platform/system/vold/+/refs/heads/master/cryptfs.h
7640	lelong	0xd0b5b1c4	Android cryptfs footer
765>4	leshort	x	\b, version: %d
766>6	leshort	x	\b.%d
767
768# Android Vdex format
769# From https://android.googlesource.com/\
770# platform/art/+/master/runtime/vdex_file.h
7710	string	vdex	Android vdex file,
772>4	string	>000	verifier deps version: %s,
773>8	string	>000	dex section version: %s,
774>12	lelong	>0	number of dex files: %d,
775>16	lelong	>0	verifier deps size: %d
776
777# Android Vdex format, dexfile is currently being updated
778# by android system
779# From https://android.googlesource.com/\
780# platform/art/+/master/dex2oat/dex2oat.cc
7810	string	wdex	Android vdex file, being processed by dex2oat,
782>4	string	>000	verifier deps version: %s,
783>8	string	>000	dex section version: %s,
784>12	lelong	>0	number of dex files: %d,
785>16	lelong	>0	verifier deps size: %d
786
787#------------------------------------------------------------------------------
788# $File: animation,v 1.90 2022/08/16 11:16:39 christos Exp $
789# animation:  file(1) magic for animation/movie formats
790#
791# animation formats
792# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)
793# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)
794
795# SGI and Apple formats
7960	string		MOVI		Silicon Graphics movie file
797!:mime	video/x-sgi-movie
7984       string          moov            Apple QuickTime
799!:mime	video/quicktime
800>12     string          mvhd            \b movie (fast start)
801>12     string          mdra            \b URL
802>12     string          cmov            \b movie (fast start, compressed header)
803>12     string          rmra            \b multiple URLs
8044       string          mdat            Apple QuickTime movie (unoptimized)
805!:mime	video/quicktime
806#4       string          wide            Apple QuickTime movie (unoptimized)
807#!:mime	video/quicktime
808#4       string          skip            Apple QuickTime movie (modified)
809#!:mime	video/quicktime
810#4       string          free            Apple QuickTime movie (modified)
811#!:mime	video/quicktime
8124       string          idsc            Apple QuickTime image (fast start)
813!:mime	image/x-quicktime
814#4       string          idat            Apple QuickTime image (unoptimized)
815#!:mime	image/x-quicktime
8164       string          pckg            Apple QuickTime compressed archive
817!:mime	application/x-quicktime-player
818
819#### MP4 ####
820# https://www.ftyps.com/ with local additions
821# https://cconcolato.github.io/mp4ra/filetype.html
8224	string		ftyp		ISO Media
823# https://aeroquartet.com/wordpress/2016/03/05/3-xavc-s/
824>8	string		XAVC		\b, MPEG v4 system, Sony XAVC Codec
825>>96	string		x		\b, Audio "%.4s"
826>>118	beshort		x		at %dHz
827>>140	string		x		\b, Video "%.4s"
828>>168	beshort		x		%d
829>>170	beshort		x		\bx%d
830>8	string		3g2		\b, MPEG v4 system, 3GPP2
831!:mime	video/3gpp2
832>>11	byte		4		\b v4 (H.263/AMR GSM 6.10)
833>>11	byte		5		\b v5 (H.263/AMR GSM 6.10)
834>>11	byte		6		\b v6 (ITU H.264/AMR GSM 6.10)
835# https://www.3gpp2.org/Public_html/Specs/C.S0050-B_v1.0_070521.pdf
836# Section 8.1.1, corresponds to a, b, c
837>>11	byte		0x61		\b C.S0050-0 V1.0
838>>11	byte		0x62		\b C.S0050-0-A V1.0.0
839>>11	byte		0x63		\b C.S0050-0-B V1.0
840>8	string		3ge		\b, MPEG v4 system, 3GPP
841!:mime	video/3gpp
842>>11	byte		6		\b, Release %d MBMS Extended Presentations
843>>11	byte		7		\b, Release %d MBMS Extended Presentations
844>>11	byte		9		\b, Release %d MBMS Extended Presentations
845>8	string		3gf		\b, MPEG v4 system, 3GPP
846>>11	byte		9		\b, Release %d File-delivery profile
847>8	string		3gg		\b, MPEG v4 system, 3GPP
848!:mime	video/3gpp
849>>11	byte		6		\b, Release %d General Profile
850>>11	byte		9		\b, Release %d General Profile
851>8	string		3gh		\b, MPEG v4 system, 3GPP
852!:mime	video/3gpp
853>>11	byte		9		\b, Release %d Adaptive Streaming Profile
854>8	string		3gm		\b, MPEG v4 system, 3GPP
855!:mime	video/3gpp
856>>11	byte		9		\b, Release %d Media Segment Profile
857>8	string		3gp		\b, MPEG v4 system, 3GPP
858!:mime	video/3gpp
859>>11	byte		1		\b, Release %d (non existent)
860>>11	byte		2		\b, Release %d (non existent)
861>>11	byte		3		\b, Release %d (non existent)
862>>11	byte		4		\b, Release %d
863>>11	byte		5		\b, Release %d
864>>11	byte		6		\b, Release %d
865>>11	byte		7		\b, Release %d Streaming Servers
866>8	string		3gr		\b, MPEG v4 system, 3GPP
867!:mime	video/3gpp
868>>11	byte		6		\b, Release %d Progressive Download Profile
869>>11	byte		9		\b, Release %d Progressive Download Profile
870>8	string		3gs		\b, MPEG v4 system, 3GPP
871!:mime	video/3gpp
872>>11	byte		6		\b, Release %d Streaming Servers
873>>11	byte		7		\b, Release %d Streaming Servers
874>>11	byte		9		\b, Release %d Streaming Servers
875>8	string		3gt		\b, MPEG v4 system, 3GPP
876!:mime	video/3gpp
877>>11	byte		8		\b, Release %d Media Stream Recording Profile
878>>11	byte		9		\b, Release %d Media Stream Recording Profile
879>8	string		ARRI		\b, MPEG v4 system, ARRI Digital Camera
880!:mime	video/mp4
881>8	string		avc1		\b, MPEG v4 system, 3GPP JVT AVC [ISO 14496-12:2005]
882!:mime	video/mp4
883>8	string		bbxm		\b, Blinkbox Master File: H.264 video/16-bit LE LPCM audio
884!:mime	video/mp4
885>8	string/W	qt		\b, Apple QuickTime movie
886!:mime	video/quicktime
887>8	string		CAEP		\b, Canon Digital Camera
888>8	string		caqv		\b, Casio Digital Camera
889>8	string		CDes		\b, Convergent Design
890>8	string		caaa		\b, CMAF Media Profile - AAC Adaptive Audio
891>8	string		caac		\b, CMAF Media Profile - AAC Core
892>8	string		caqv		\b, Casio Digital Camera	Casio
893>8	string		ccea		\b, CMAF Supplemental Data - CEA-608/708
894>8	string		ccff		\b, Common container file format
895>8	string		cfhd		\b, CMAF Media Profile - AVC HD
896>8	string		cfsd		\b, CMAF Media Profile - AVC SD
897>8	string		chd1		\b, CMAF Media Profile - HEVC HDR10
898>8	string		chdf		\b, CMAF Media Profile - AVC HDHF
899>8	string		chhd		\b, CMAF Media Profile - HEVC HHD8
900>8	string		chh1		\b, CMAF Media Profile - HEVC HHD10
901>8	string		clg1		\b, CMAF Media Profile - HEVC HLG10
902>8	string		cmfc		\b, CMAF Track Format
903>8	string		cmff		\b, CMAF Fragment Format
904>8	string		cmfl		\b, CMAF Chunk Format
905>8	string		cmfs		\b, CMAF Segment Format
906>8	string		cud1		\b, CMAF Media Profile - HEVC UHD10
907>8	string		cud8		\b, CMAF Media Profile - HEVC UHD8
908>8	string		cwvt		\b, CMAF Media Profile - WebVTT
909>8	string		da0a		\b, DMB MAF w/ MPEG Layer II aud, MOT slides, DLS, JPG/PNG/MNG
910>8	string		da0b		\b, DMB MAF, ext DA0A, with 3GPP timed text, DID, TVA, REL, IPMP
911>8	string		da1a		\b, DMB MAF audio with ER-BSAC audio, JPG/PNG/MNG images
912>8	string		da1b		\b, DMB MAF, ext da1a, with 3GPP timed text, DID, TVA, REL, IPMP
913>8	string		da2a		\b, DMB MAF aud w/ HE-AAC v2 aud, MOT slides, DLS, JPG/PNG/MNG
914>8	string		da2b		\b, DMB MAF, ext da2a, with 3GPP timed text, DID, TVA, REL, IPMP
915>8	string		da3a		\b, DMB MAF aud with HE-AAC aud, JPG/PNG/MNG images
916>8	string		da3b		\b, DMB MAF, ext da3a w/ BIFS, 3GPP, DID, TVA, REL, IPMP
917>8	string		dash		\b, MPEG v4 system, Dynamic Adaptive Streaming over HTTP
918!:mime	video/mp4
919>8	string		dby1		\b, MP4 files with Dolby content
920>8	string		dsms		\b, Media Segment DASH conformant
921>8	string		dts1		\b, MP4 track file with audio codecs dtsc dtsh or dtse
922>8	string		dts2		\b, MP4 track file with audio codec dtsx
923>8	string		dts3		\b, MP4 track file with audio codec dtsy
924>8	string		dxo$20		\b, DxO ONE camera
925>8	string		dmb1		\b, DMB MAF supporting all the components defined in the spec
926>8	string		dmpf		\b, Digital Media Project
927>8	string		drc1		\b, Dirac (wavelet compression), encap in ISO base media (MP4)
928>8	string		dv1a		\b, DMB MAF vid w/ AVC vid, ER-BSAC aud, BIFS, JPG/PNG/MNG, TS
929>8	string		dv1b		\b, DMB MAF, ext dv1a, with 3GPP timed text, DID, TVA, REL, IPMP
930>8	string		dv2a		\b, DMB MAF vid w/ AVC vid, HE-AAC v2 aud, BIFS, JPG/PNG/MNG, TS
931>8	string		dv2b		\b, DMB MAF, ext dv2a, with 3GPP timed text, DID, TVA, REL, IPMP
932>8	string		dv3a		\b, DMB MAF vid w/ AVC vid, HE-AAC aud, BIFS, JPG/PNG/MNG, TS
933>8	string		dv3b		\b, DMB MAF, ext dv3a, with 3GPP timed text, DID, TVA, REL, IPMP
934>8	string		dvr1		\b, DVB (.DVB) over RTP
935!:mime	video/vnd.dvb.file
936>8	string		dvt1		\b, DVB (.DVB) over MPEG-2 Transport Stream
937>8	string		emsg		\b, Event message box present
938!:mime	video/vnd.dvb.file
939>8	string		F4V		\b, Video for Adobe Flash Player 9+ (.F4V)
940!:mime	video/mp4
941>8	string		F4P		\b, Protected Video for Adobe Flash Player 9+ (.F4P)
942!:mime	video/mp4
943>8	string		F4A		\b, Audio for Adobe Flash Player 9+ (.F4A)
944!:mime	audio/mp4
945>8	string		F4B		\b, Audio Book for Adobe Flash Player 9+ (.F4B)
946!:mime	audio/mp4
947>8	string		ifrm		\b, Apple iFrame Specification, Version 8.1 Jan 2013
948>8	string		im1i		\b, CMAF Media Profile - IMSC1 Image
949>8	string		im1t		\b, CMAF Media Profile - IMSC1 Text
950>8	string		isc2		\b, ISMACryp 2.0 Encrypted File
951#	?/enc-isoff-generic
952>8	string		iso		\b, MP4 Base Media
953!:mime	video/mp4
954!:ext	mp4
955>>11	string		m 		v1 [ISO 14496-12:2003]
956>>11	string		2		v2 [ISO 14496-12:2005]
957>>11	string		4		v4
958>>11	string		5		v5
959>>11	string		6		v6
960>8	string		isml		\b, MP4 Base Media v2 [ISO 14496-12:2005]
961!:mime	video/mp4
962>8	string		J2P0		\b, JPEG2000 Profile 0
963>8	string		J2P1		\b, JPEG2000 Profile 1
964>8	string/W	jp2		\b, JPEG 2000
965!:mime	image/jp2
966>8	string		JP2		\b, JPEG 2000 Image (.JP2) [ISO 15444-1 ?]
967!:mime	image/jp2
968>8	string		JP20		\b, Unknown, from GPAC samples (prob non-existent)
969>8	string		jpm		\b, JPEG 2000 Compound Image (.JPM) [ISO 15444-6]
970!:mime	image/jpm
971>8	string		jpsi		\b, The JPSearch data interchange format
972>8	string		jpx		\b, JPEG 2000 w/ extensions (.JPX) [ISO 15444-2]
973!:mime	image/jpx
974>8	string		KDDI		\b, 3GPP2 EZmovie for KDDI 3G cellphones
975!:mime	video/3gpp2
976>8	string		LCAG		\b,  Leica digital camera
977>8	string		lmsg		\b, Last Media Segment indicator for ISO base media file format.
978>8	string		M4A 		\b, Apple iTunes ALAC/AAC-LC (.M4A) Audio
979!:mime	audio/x-m4a
980>8	string		M4B 		\b, Apple iTunes ALAC/AAC-LC (.M4B) Audio Book
981!:mime	audio/mp4
982>8	string		M4P 		\b, Apple iTunes ALAC/AAC-LC (.M4P) AES Protected Audio
983!:mime	video/mp4
984>8	string		M4V 		\b, Apple iTunes Video (.M4V) Video
985!:mime	video/x-m4v
986>8	string		M4VH		\b, Apple TV (.M4V)
987!:mime	video/x-m4v
988>8	string		M4VP		\b, Apple iPhone (.M4V)
989!:mime	video/x-m4v
990>8	string		mj2s		\b, Motion JPEG 2000 [ISO 15444-3] Simple Profile
991!:mime	video/mj2
992>8	string		mjp2		\b, Motion JPEG 2000 [ISO 15444-3] General Profile
993>8	string		MFSM		\b, Media File for Samsung video Metadata
994>8	string		MGSV		\b, Sony Home and Mobile Multimedia Platform (HMMP)
995!:mime	video/mj2
996>8	string		mmp4		\b, MPEG-4/3GPP Mobile Profile (.MP4 / .3GP) (for NTT)
997!:mime	video/mp4
998>8	string		mobi		\b, MPEG-4, MOBI format
999!:mime	video/mp4
1000>8	string		mp21		\b, MPEG-21 [ISO/IEC 21000-9]
1001>8	string		mp41		\b, MP4 v1 [ISO 14496-1:ch13]
1002!:mime	video/mp4
1003>8	string		mp42		\b, MP4 v2 [ISO 14496-14]
1004!:mime	video/mp4
1005>8	string		mp71		\b, MP4 w/ MPEG-7 Metadata [per ISO 14496-12]
1006>8	string		mp7t		\b, MPEG v4 system, MPEG v7 XML
1007>8	string		mp7b		\b, MPEG v4 system, MPEG v7 binary XML
1008>8	string		mpuf		\b, Compliance with the MMT Processing Unit format
1009>8	string		msdh		\b, Media Segment conforming to ISO base media file format.
1010>8	string		msix		\b, Media Segment conforming to ISO base media file format.
1011>8	string		mmp4		\b, MPEG v4 system, 3GPP Mobile
1012!:mime	video/mp4
1013>8	string		MPPI		\b, Photo Player, MAF [ISO/IEC 23000-3]
1014>8	string		mqt		\b, Sony / Mobile QuickTime (.MQV) US Pat 7,477,830
1015!:mime	video/quicktime
1016>8	string		MSNV		\b, MPEG-4 (.MP4) for SonyPSP
1017!:mime	audio/mp4
1018>8	string		NDAS		\b, MP4 v2 [ISO 14496-14] Nero Digital AAC Audio
1019!:mime	audio/mp4
1020>8	string		NDSC		\b, MPEG-4 (.MP4) Nero Cinema Profile
1021!:mime	video/mp4
1022>8	string		NDSH		\b, MPEG-4 (.MP4) Nero HDTV Profile
1023!:mime	video/mp4
1024>8	string		NDSM		\b, MPEG-4 (.MP4) Nero Mobile Profile
1025!:mime	video/mp4
1026>8	string		NDSP		\b, MPEG-4 (.MP4) Nero Portable Profile
1027!:mime	video/mp4
1028>8	string		NDSS		\b, MPEG-4 (.MP4) Nero Standard Profile
1029!:mime	video/mp4
1030>8	string		NDXC		\b, H.264/MPEG-4 AVC (.MP4) Nero Cinema Profile
1031!:mime	video/mp4
1032>8	string		NDXH		\b, H.264/MPEG-4 AVC (.MP4) Nero HDTV Profile
1033!:mime	video/mp4
1034>8	string		NDXM		\b, H.264/MPEG-4 AVC (.MP4) Nero Mobile Profile
1035!:mime	video/mp4
1036>8	string		NDXP		\b, H.264/MPEG-4 AVC (.MP4) Nero Portable Profile
1037!:mime	video/mp4
1038>8	string		NDXS		\b, H.264/MPEG-4 AVC (.MP4) Nero Standard Profile
1039>8	string		niko		\b, Nikon Digital Camera
1040!:mime	video/mp4
1041>8	string		odcf  		\b, OMA DCF DRM Format 2.0 (OMA-TS-DRM-DCF-V2_0-20060303-A)
1042>8	string		opf2 		\b, OMA PDCF DRM Format 2.1 (OMA-TS-DRM-DCF-V2_1-20070724-C)
1043>8	string		opx2  		\b, OMA PDCF DRM + XBS ext (OMA-TS-DRM_XBS-V1_0-20070529-C)
1044>8	string		pana		\b, Panasonic Digital Camera
1045>8	string		piff		\b, Protected Interoperable File Format
1046>8	string		pnvi		]b, Panasonic Video Intercom
1047>8	string		qt  		\b, Apple QuickTime (.MOV/QT)
1048!:mime	video/quicktime
1049# HEIF image format
1050# see https://nokiatech.github.io/heif/technical.html
1051>8	string		mif1		\b, HEIF Image
1052!:mime image/heif
1053>8	string		msf1		\b, HEIF Image Sequence
1054!:mime image/heif-sequence
1055>8	string		heic		\b, HEIF Image HEVC Main or Main Still Picture Profile
1056!:mime image/heic
1057>8	string		heix		\b, HEIF Image HEVC Main 10 Profile
1058!:mime image/heic
1059>8	string		hevc		\b, HEIF Image Sequenz HEVC Main or Main Still Picture Profile
1060!:mime image/heic-sequence
1061>8	string		hevx		\b, HEIF Image Sequence HEVC Main 10 Profile
1062!:mime image/heic-sequence
1063# following HEIF brands are not mentioned in the heif technical info currently (Oct 2017)
1064# but used in the reference implementation:
1065# https://github.com/nokiatech/heif/blob/d5e9a21c8ba8df712bdf643021dd9f6518134776/Srcs/reader/hevcimagefilereader.cpp
1066>8	string		heim		\b, HEIF Image L-HEVC
1067!:mime image/heif
1068>8	string		heis		\b, HEIF Image L-HEVC
1069!:mime image/heif
1070>8	string		avic		\b, HEIF Image AVC
1071!:mime image/heif
1072>8	string		hevm		\b, HEIF Image Sequence L-HEVC
1073!:mime image/heif-sequence
1074>8	string		hevs		\b, HEIF Image Sequence L-HEVC
1075!:mime image/heif-sequence
1076>8	string		avcs		\b, HEIF Image Sequence AVC
1077!:mime image/heif-sequence
1078# AVIF image format
1079# see https://aomediacodec.github.io/av1-avif/
1080>8	string		avif		\b, AVIF Image
1081!:mime image/avif
1082>8	string		avis		\b, AVIF Image Sequence
1083!:mime image/avif
1084>8	string		risx		\b, Representation Index Segment for MPEG-2 TS Segments
1085>8	string		ROSS		\b, Ross Video
1086>8	string		sdv		\b, SD Memory Card Video
1087>8	string		ssc1		\b, Samsung stereo, single stream (patent pending)
1088>8	string		ssc2		\b, Samsung stereo, dual stream (patent pending)
1089>8	string		SEAU		\b, Sony Home and Mobile Multimedia Platform (HMMP)
1090>8	string		SEBK		\b, Sony Home and Mobile Multimedia Platform (HMMP)
1091>8	string		senv		\b, Video contents Sony Entertainment Network
1092>8	string		sims		\b, Media Segment for Sub-Indexed Media Segment format
1093>8	string		sisx		\b, Single Index Segment forindex MPEG-2 TS
1094>8	string		ssss		\b, Subsegment Index Segment used to index MPEG-2 Segments
1095>8	string		uvvu		\b, UltraViolet file brand for DECE Common Format
1096
1097# MPEG sequences
1098# Scans for all common MPEG header start codes
10990	 belong		    0x00000001
1100>4	 byte&0x1F	    0x07	   JVT NAL sequence, H.264 video
1101>>5      byte               66             \b, baseline
1102>>5      byte               77             \b, main
1103>>5      byte               88             \b, extended
1104>>7      byte               x              \b @ L %u
11050        belong&0xFFFFFF00  0x00000100
1106>3       byte               0xBA           MPEG sequence
1107!:mime  video/mpeg
1108# http://fileformats.archiveteam.org/wiki/Enhanced_VOB
1109# https://reposcope.com/mimetype/video/mpeg
1110!:ext	vob/evo/mpg/mpeg
1111>>4      byte               &0x40          \b, v2, program multiplex
1112>>4      byte               ^0x40          \b, v1, system multiplex
1113>3       byte               0xBB           MPEG sequence, v1/2, multiplex (missing pack header)
1114>3       byte&0x1F          0x07           MPEG sequence, H.264 video
1115>>4      byte               66             \b, baseline
1116>>4      byte               77             \b, main
1117>>4      byte               88             \b, extended
1118>>6      byte               x              \b @ L %u
1119# GRR too general as it catches also FoxPro Memo example NG.FPT
1120>3       byte               0xB0           MPEG sequence, v4
1121# TODO: maybe this extra line exclude FoxPro Memo example NG.FPT starting with 000001b0 00000100 00000000
1122#>>4      byte               !0             MPEG sequence, v4
1123!:mime  video/mpeg4-generic
1124>>5      belong             0x000001B5
1125>>>9     byte               &0x80
1126>>>>10   byte&0xF0          16             \b, video
1127>>>>10   byte&0xF0          32             \b, still texture
1128>>>>10   byte&0xF0          48             \b, mesh
1129>>>>10   byte&0xF0          64             \b, face
1130>>>9     byte&0xF8          8              \b, video
1131>>>9     byte&0xF8          16             \b, still texture
1132>>>9     byte&0xF8          24             \b, mesh
1133>>>9     byte&0xF8          32             \b, face
1134>>4      byte               1              \b, simple @ L1
1135>>4      byte               2              \b, simple @ L2
1136>>4      byte               3              \b, simple @ L3
1137>>4      byte               4              \b, simple @ L0
1138>>4      byte               17             \b, simple scalable @ L1
1139>>4      byte               18             \b, simple scalable @ L2
1140>>4      byte               33             \b, core @ L1
1141>>4      byte               34             \b, core @ L2
1142>>4      byte               50             \b, main @ L2
1143>>4      byte               51             \b, main @ L3
1144>>4      byte               53             \b, main @ L4
1145>>4      byte               66             \b, n-bit @ L2
1146>>4      byte               81             \b, scalable texture @ L1
1147>>4      byte               97             \b, simple face animation @ L1
1148>>4      byte               98             \b, simple face animation @ L2
1149>>4      byte               99             \b, simple face basic animation @ L1
1150>>4      byte               100            \b, simple face basic animation @ L2
1151>>4      byte               113            \b, basic animation text @ L1
1152>>4      byte               114            \b, basic animation text @ L2
1153>>4      byte               129            \b, hybrid @ L1
1154>>4      byte               130            \b, hybrid @ L2
1155>>4      byte               145            \b, advanced RT simple @ L!
1156>>4      byte               146            \b, advanced RT simple @ L2
1157>>4      byte               147            \b, advanced RT simple @ L3
1158>>4      byte               148            \b, advanced RT simple @ L4
1159>>4      byte               161            \b, core scalable @ L1
1160>>4      byte               162            \b, core scalable @ L2
1161>>4      byte               163            \b, core scalable @ L3
1162>>4      byte               177            \b, advanced coding efficiency @ L1
1163>>4      byte               178            \b, advanced coding efficiency @ L2
1164>>4      byte               179            \b, advanced coding efficiency @ L3
1165>>4      byte               180            \b, advanced coding efficiency @ L4
1166>>4      byte               193            \b, advanced core @ L1
1167>>4      byte               194            \b, advanced core @ L2
1168>>4      byte               209            \b, advanced scalable texture @ L1
1169>>4      byte               210            \b, advanced scalable texture @ L2
1170>>4      byte               211            \b, advanced scalable texture @ L3
1171>>4      byte               225            \b, simple studio @ L1
1172>>4      byte               226            \b, simple studio @ L2
1173>>4      byte               227            \b, simple studio @ L3
1174>>4      byte               228            \b, simple studio @ L4
1175>>4      byte               229            \b, core studio @ L1
1176>>4      byte               230            \b, core studio @ L2
1177>>4      byte               231            \b, core studio @ L3
1178>>4      byte               232            \b, core studio @ L4
1179>>4      byte               240            \b, advanced simple @ L0
1180>>4      byte               241            \b, advanced simple @ L1
1181>>4      byte               242            \b, advanced simple @ L2
1182>>4      byte               243            \b, advanced simple @ L3
1183>>4      byte               244            \b, advanced simple @ L4
1184>>4      byte               245            \b, advanced simple @ L5
1185>>4      byte               247            \b, advanced simple @ L3b
1186>>4      byte               248            \b, FGS @ L0
1187>>4      byte               249            \b, FGS @ L1
1188>>4      byte               250            \b, FGS @ L2
1189>>4      byte               251            \b, FGS @ L3
1190>>4      byte               252            \b, FGS @ L4
1191>>4      byte               253            \b, FGS @ L5
1192>3       byte               0xB5           MPEG sequence, v4
1193!:mime  video/mpeg4-generic
1194>>4      byte               &0x80
1195>>>5     byte&0xF0          16             \b, video (missing profile header)
1196>>>5     byte&0xF0          32             \b, still texture (missing profile header)
1197>>>5     byte&0xF0          48             \b, mesh (missing profile header)
1198>>>5     byte&0xF0          64             \b, face (missing profile header)
1199>>4      byte&0xF8          8              \b, video (missing profile header)
1200>>4      byte&0xF8          16             \b, still texture (missing profile header)
1201>>4      byte&0xF8          24             \b, mesh (missing profile header)
1202>>4      byte&0xF8          32             \b, face (missing profile header)
1203>3       byte               0xB3           MPEG sequence
1204!:mime  video/mpeg
1205>>12     belong             0x000001B8     \b, v1, progressive Y'CbCr 4:2:0 video
1206>>12     belong             0x000001B2     \b, v1, progressive Y'CbCr 4:2:0 video
1207>>12     belong             0x000001B5     \b, v2,
1208>>>16    byte&0x0F          1              \b HP
1209>>>16    byte&0x0F          2              \b Spt
1210>>>16    byte&0x0F          3              \b SNR
1211>>>16    byte&0x0F          4              \b MP
1212>>>16    byte&0x0F          5              \b SP
1213>>>17    byte&0xF0          64             \b@HL
1214>>>17    byte&0xF0          96             \b@H-14
1215>>>17    byte&0xF0          128            \b@ML
1216>>>17    byte&0xF0          160            \b@LL
1217>>>17    byte               &0x08          \b progressive
1218>>>17    byte               ^0x08          \b interlaced
1219>>>17    byte&0x06          2              \b Y'CbCr 4:2:0 video
1220>>>17    byte&0x06          4              \b Y'CbCr 4:2:2 video
1221>>>17    byte&0x06          6              \b Y'CbCr 4:4:4 video
1222>>11     byte               &0x02
1223>>>75    byte               &0x01
1224>>>>140  belong             0x000001B8     \b, v1, progressive Y'CbCr 4:2:0 video
1225>>>>140  belong             0x000001B2     \b, v1, progressive Y'CbCr 4:2:0 video
1226>>>>140  belong             0x000001B5     \b, v2,
1227>>>>>144 byte&0x0F          1              \b HP
1228>>>>>144 byte&0x0F          2              \b Spt
1229>>>>>144 byte&0x0F          3              \b SNR
1230>>>>>144 byte&0x0F          4              \b MP
1231>>>>>144 byte&0x0F          5              \b SP
1232>>>>>145 byte&0xF0          64             \b@HL
1233>>>>>145 byte&0xF0          96             \b@H-14
1234>>>>>145 byte&0xF0          128            \b@ML
1235>>>>>145 byte&0xF0          160            \b@LL
1236>>>>>145 byte               &0x08          \b progressive
1237>>>>>145 byte               ^0x08          \b interlaced
1238>>>>>145 byte&0x06          2              \b Y'CbCr 4:2:0 video
1239>>>>>145 byte&0x06          4              \b Y'CbCr 4:2:2 video
1240>>>>>145 byte&0x06          6              \b Y'CbCr 4:4:4 video
1241>>76    belong             0x000001B8     \b, v1, progressive Y'CbCr 4:2:0 video
1242>>76    belong             0x000001B2     \b, v1, progressive Y'CbCr 4:2:0 video
1243>>76    belong             0x000001B5     \b, v2,
1244>>>80   byte&0x0F          1              \b HP
1245>>>80   byte&0x0F          2              \b Spt
1246>>>80   byte&0x0F          3              \b SNR
1247>>>80   byte&0x0F          4              \b MP
1248>>>80   byte&0x0F          5              \b SP
1249>>>81   byte&0xF0          64             \b@HL
1250>>>81   byte&0xF0          96             \b@H-14
1251>>>81   byte&0xF0          128            \b@ML
1252>>>81   byte&0xF0          160            \b@LL
1253>>>81   byte               &0x08          \b progressive
1254>>>81   byte               ^0x08          \b interlaced
1255>>>81   byte&0x06          2              \b Y'CbCr 4:2:0 video
1256>>>81   byte&0x06          4              \b Y'CbCr 4:2:2 video
1257>>>81   byte&0x06          6              \b Y'CbCr 4:4:4 video
1258>>4      belong&0xFFFFFF00  0x78043800     \b, HD-TV 1920P
1259>>>7     byte&0xF0          0x10           \b, 16:9
1260>>4      belong&0xFFFFFF00  0x50002D00     \b, SD-TV 1280I
1261>>>7     byte&0xF0          0x10           \b, 16:9
1262>>4      belong&0xFFFFFF00  0x30024000     \b, PAL Capture
1263>>>7     byte&0xF0          0x10           \b, 4:3
1264>>4      beshort&0xFFF0     0x2C00         \b, 4CIF
1265>>>5     beshort&0x0FFF     0x01E0         \b NTSC
1266>>>5     beshort&0x0FFF     0x0240         \b PAL
1267>>>7     byte&0xF0          0x20           \b, 4:3
1268>>>7     byte&0xF0          0x30           \b, 16:9
1269>>>7     byte&0xF0          0x40           \b, 11:5
1270>>>7     byte&0xF0          0x80           \b, PAL 4:3
1271>>>7     byte&0xF0          0xC0           \b, NTSC 4:3
1272>>4      belong&0xFFFFFF00  0x2801E000     \b, LD-TV 640P
1273>>>7     byte&0xF0          0x10           \b, 4:3
1274>>4      belong&0xFFFFFF00  0x1400F000     \b, 320x240
1275>>>7     byte&0xF0          0x10           \b, 4:3
1276>>4      belong&0xFFFFFF00  0x0F00A000     \b, 240x160
1277>>>7     byte&0xF0          0x10           \b, 4:3
1278>>4      belong&0xFFFFFF00  0x0A007800     \b, 160x120
1279>>>7     byte&0xF0          0x10           \b, 4:3
1280>>4      beshort&0xFFF0     0x1600         \b, CIF
1281>>>5     beshort&0x0FFF     0x00F0         \b NTSC
1282>>>5     beshort&0x0FFF     0x0120         \b PAL
1283>>>7     byte&0xF0          0x20           \b, 4:3
1284>>>7     byte&0xF0          0x30           \b, 16:9
1285>>>7     byte&0xF0          0x40           \b, 11:5
1286>>>7     byte&0xF0          0x80           \b, PAL 4:3
1287>>>7     byte&0xF0          0xC0           \b, NTSC 4:3
1288>>>5     beshort&0x0FFF     0x0240         \b PAL 625
1289>>>>7    byte&0xF0          0x20           \b, 4:3
1290>>>>7    byte&0xF0          0x30           \b, 16:9
1291>>>>7    byte&0xF0          0x40           \b, 11:5
1292>>4      beshort&0xFFF0     0x2D00         \b, CCIR/ITU
1293>>>5     beshort&0x0FFF     0x01E0         \b NTSC 525
1294>>>5     beshort&0x0FFF     0x0240         \b PAL 625
1295>>>7     byte&0xF0          0x20           \b, 4:3
1296>>>7     byte&0xF0          0x30           \b, 16:9
1297>>>7     byte&0xF0          0x40           \b, 11:5
1298>>4      beshort&0xFFF0     0x1E00         \b, SVCD
1299>>>5     beshort&0x0FFF     0x01E0         \b NTSC 525
1300>>>5     beshort&0x0FFF     0x0240         \b PAL 625
1301>>>7     byte&0xF0          0x20           \b, 4:3
1302>>>7     byte&0xF0          0x30           \b, 16:9
1303>>>7     byte&0xF0          0x40           \b, 11:5
1304>>7      byte&0x0F          1              \b, 23.976 fps
1305>>7      byte&0x0F          2              \b, 24 fps
1306>>7      byte&0x0F          3              \b, 25 fps
1307>>7      byte&0x0F          4              \b, 29.97 fps
1308>>7      byte&0x0F          5              \b, 30 fps
1309>>7      byte&0x0F          6              \b, 50 fps
1310>>7      byte&0x0F          7              \b, 59.94 fps
1311>>7      byte&0x0F          8              \b, 60 fps
1312>>11     byte               &0x04          \b, Constrained
1313
1314# MPEG ADTS Audio (*.mpx/mxa/aac)
1315# from dreesen@math.fu-berlin.de
1316# modified to fully support MPEG ADTS
1317
1318# MP3, M1A
1319# modified by Joerg Jenderek
1320# GRR the original test are too common for many DOS files
1321# so don't accept as MP3 until we've tested the rate
1322# But also beat GEMDOS fonts
13230       beshort&0xFFFE  0xFFFA
1324# rates
1325>2	byte&0xF0	!0
1326>>2	byte&0xF0	!0xF0		MPEG ADTS, layer III, v1
1327!:strength +20
1328!:mime	audio/mpeg
1329>2	byte&0xF0	0x10		\b, 32 kbps
1330>2	byte&0xF0	0x20		\b, 40 kbps
1331>2	byte&0xF0	0x30		\b, 48 kbps
1332>2	byte&0xF0	0x40		\b, 56 kbps
1333>2	byte&0xF0	0x50		\b, 64 kbps
1334>2	byte&0xF0	0x60		\b, 80 kbps
1335>2	byte&0xF0	0x70		\b, 96 kbps
1336>2	byte&0xF0	0x80		\b, 112 kbps
1337>2	byte&0xF0	0x90		\b, 128 kbps
1338>2	byte&0xF0	0xA0		\b, 160 kbps
1339>2	byte&0xF0	0xB0		\b, 192 kbps
1340>2	byte&0xF0	0xC0		\b, 224 kbps
1341>2	byte&0xF0	0xD0		\b, 256 kbps
1342>2	byte&0xF0	0xE0		\b, 320 kbps
1343# timing
1344>2	byte&0x0C	0x00		\b, 44.1 kHz
1345>2	byte&0x0C	0x04		\b, 48 kHz
1346>2	byte&0x0C	0x08		\b, 32 kHz
1347# channels/options
1348>3	byte&0xC0	0x00		\b, Stereo
1349>3	byte&0xC0	0x40		\b, JntStereo
1350>3	byte&0xC0	0x80		\b, 2x Monaural
1351>3	byte&0xC0	0xC0		\b, Monaural
1352#>1	byte		^0x01		\b, Data Verify
1353#>2	byte		&0x02		\b, Packet Pad
1354#>2	byte		&0x01		\b, Custom Flag
1355#>3	byte		&0x08		\b, Copyrighted
1356#>3	byte		&0x04		\b, Original Source
1357#>3	byte&0x03	1		\b, NR: 50/15 ms
1358#>3	byte&0x03	3		\b, NR: CCIT J.17
1359
1360# MP2, M1A
13610       beshort&0xFFFE  0xFFFC         MPEG ADTS, layer II, v1
1362!:mime	audio/mpeg
1363# rates
1364>2      byte&0xF0       0x10           \b,  32 kbps
1365>2      byte&0xF0       0x20           \b,  48 kbps
1366>2      byte&0xF0       0x30           \b,  56 kbps
1367>2      byte&0xF0       0x40           \b,  64 kbps
1368>2      byte&0xF0       0x50           \b,  80 kbps
1369>2      byte&0xF0       0x60           \b,  96 kbps
1370>2      byte&0xF0       0x70           \b, 112 kbps
1371>2      byte&0xF0       0x80           \b, 128 kbps
1372>2      byte&0xF0       0x90           \b, 160 kbps
1373>2      byte&0xF0       0xA0           \b, 192 kbps
1374>2      byte&0xF0       0xB0           \b, 224 kbps
1375>2      byte&0xF0       0xC0           \b, 256 kbps
1376>2      byte&0xF0       0xD0           \b, 320 kbps
1377>2      byte&0xF0       0xE0           \b, 384 kbps
1378# timing
1379>2      byte&0x0C       0x00           \b, 44.1 kHz
1380>2      byte&0x0C       0x04           \b, 48 kHz
1381>2      byte&0x0C       0x08           \b, 32 kHz
1382# channels/options
1383>3      byte&0xC0       0x00           \b, Stereo
1384>3      byte&0xC0       0x40           \b, JntStereo
1385>3      byte&0xC0       0x80           \b, 2x Monaural
1386>3      byte&0xC0       0xC0           \b, Monaural
1387#>1     byte            ^0x01          \b, Data Verify
1388#>2     byte            &0x02          \b, Packet Pad
1389#>2     byte            &0x01          \b, Custom Flag
1390#>3     byte            &0x08          \b, Copyrighted
1391#>3     byte            &0x04          \b, Original Source
1392#>3     byte&0x03       1              \b, NR: 50/15 ms
1393#>3     byte&0x03       3              \b, NR: CCIT J.17
1394
1395# MPA, M1A
1396# updated by Joerg Jenderek
1397# GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448
1398# GRR this test is still too general as it catches a BOM of UTF-16 files (0xFFFE)
1399# FIXME: Almost all little endian UTF-16 text with BOM are clobbered by these entries
1400#0	beshort&0xFFFE		0xFFFE
1401#>2	ubyte&0xF0	>0x0F
1402#>>2	ubyte&0xF0	<0xE1		MPEG ADTS, layer I, v1
1403## rate
1404#>>>2      byte&0xF0       0x10           \b,  32 kbps
1405#>>>2      byte&0xF0       0x20           \b,  64 kbps
1406#>>>2      byte&0xF0       0x30           \b,  96 kbps
1407#>>>2      byte&0xF0       0x40           \b, 128 kbps
1408#>>>2      byte&0xF0       0x50           \b, 160 kbps
1409#>>>2      byte&0xF0       0x60           \b, 192 kbps
1410#>>>2      byte&0xF0       0x70           \b, 224 kbps
1411#>>>2      byte&0xF0       0x80           \b, 256 kbps
1412#>>>2      byte&0xF0       0x90           \b, 288 kbps
1413#>>>2      byte&0xF0       0xA0           \b, 320 kbps
1414#>>>2      byte&0xF0       0xB0           \b, 352 kbps
1415#>>>2      byte&0xF0       0xC0           \b, 384 kbps
1416#>>>2      byte&0xF0       0xD0           \b, 416 kbps
1417#>>>2      byte&0xF0       0xE0           \b, 448 kbps
1418## timing
1419#>>>2      byte&0x0C       0x00           \b, 44.1 kHz
1420#>>>2      byte&0x0C       0x04           \b, 48 kHz
1421#>>>2      byte&0x0C       0x08           \b, 32 kHz
1422## channels/options
1423#>>>3      byte&0xC0       0x00           \b, Stereo
1424#>>>3      byte&0xC0       0x40           \b, JntStereo
1425#>>>3      byte&0xC0       0x80           \b, 2x Monaural
1426#>>>3      byte&0xC0       0xC0           \b, Monaural
1427##>1     byte            ^0x01          \b, Data Verify
1428##>2     byte            &0x02          \b, Packet Pad
1429##>2     byte            &0x01          \b, Custom Flag
1430##>3     byte            &0x08          \b, Copyrighted
1431##>3     byte            &0x04          \b, Original Source
1432##>3     byte&0x03       1              \b, NR: 50/15 ms
1433##>3     byte&0x03       3              \b, NR: CCIT J.17
1434
1435# MP3, M2A
14360       beshort&0xFFFE  0xFFF2         MPEG ADTS, layer III, v2
1437!:mime	audio/mpeg
1438# rate
1439>2      byte&0xF0       0x10           \b,   8 kbps
1440>2      byte&0xF0       0x20           \b,  16 kbps
1441>2      byte&0xF0       0x30           \b,  24 kbps
1442>2      byte&0xF0       0x40           \b,  32 kbps
1443>2      byte&0xF0       0x50           \b,  40 kbps
1444>2      byte&0xF0       0x60           \b,  48 kbps
1445>2      byte&0xF0       0x70           \b,  56 kbps
1446>2      byte&0xF0       0x80           \b,  64 kbps
1447>2      byte&0xF0       0x90           \b,  80 kbps
1448>2      byte&0xF0       0xA0           \b,  96 kbps
1449>2      byte&0xF0       0xB0           \b, 112 kbps
1450>2      byte&0xF0       0xC0           \b, 128 kbps
1451>2      byte&0xF0       0xD0           \b, 144 kbps
1452>2      byte&0xF0       0xE0           \b, 160 kbps
1453# timing
1454>2      byte&0x0C       0x00           \b, 22.05 kHz
1455>2      byte&0x0C       0x04           \b, 24 kHz
1456>2      byte&0x0C       0x08           \b, 16 kHz
1457# channels/options
1458>3      byte&0xC0       0x00           \b, Stereo
1459>3      byte&0xC0       0x40           \b, JntStereo
1460>3      byte&0xC0       0x80           \b, 2x Monaural
1461>3      byte&0xC0       0xC0           \b, Monaural
1462#>1     byte            ^0x01          \b, Data Verify
1463#>2     byte            &0x02          \b, Packet Pad
1464#>2     byte            &0x01          \b, Custom Flag
1465#>3     byte            &0x08          \b, Copyrighted
1466#>3     byte            &0x04          \b, Original Source
1467#>3     byte&0x03       1              \b, NR: 50/15 ms
1468#>3     byte&0x03       3              \b, NR: CCIT J.17
1469
1470# MP2, M2A
14710       beshort&0xFFFE  0xFFF4         MPEG ADTS, layer II, v2
1472!:mime	audio/mpeg
1473# rate
1474>2      byte&0xF0       0x10           \b,   8 kbps
1475>2      byte&0xF0       0x20           \b,  16 kbps
1476>2      byte&0xF0       0x30           \b,  24 kbps
1477>2      byte&0xF0       0x40           \b,  32 kbps
1478>2      byte&0xF0       0x50           \b,  40 kbps
1479>2      byte&0xF0       0x60           \b,  48 kbps
1480>2      byte&0xF0       0x70           \b,  56 kbps
1481>2      byte&0xF0       0x80           \b,  64 kbps
1482>2      byte&0xF0       0x90           \b,  80 kbps
1483>2      byte&0xF0       0xA0           \b,  96 kbps
1484>2      byte&0xF0       0xB0           \b, 112 kbps
1485>2      byte&0xF0       0xC0           \b, 128 kbps
1486>2      byte&0xF0       0xD0           \b, 144 kbps
1487>2      byte&0xF0       0xE0           \b, 160 kbps
1488# timing
1489>2      byte&0x0C       0x00           \b, 22.05 kHz
1490>2      byte&0x0C       0x04           \b, 24 kHz
1491>2      byte&0x0C       0x08           \b, 16 kHz
1492# channels/options
1493>3      byte&0xC0       0x00           \b, Stereo
1494>3      byte&0xC0       0x40           \b, JntStereo
1495>3      byte&0xC0       0x80           \b, 2x Monaural
1496>3      byte&0xC0       0xC0           \b, Monaural
1497#>1     byte            ^0x01          \b, Data Verify
1498#>2     byte            &0x02          \b, Packet Pad
1499#>2     byte            &0x01          \b, Custom Flag
1500#>3     byte            &0x08          \b, Copyrighted
1501#>3     byte            &0x04          \b, Original Source
1502#>3     byte&0x03       1              \b, NR: 50/15 ms
1503#>3     byte&0x03       3              \b, NR: CCIT J.17
1504
1505# MPA, M2A
15060       beshort&0xFFFE  0xFFF6         MPEG ADTS, layer I, v2
1507!:mime	audio/mpeg
1508# rate
1509>2      byte&0xF0       0x10           \b,  32 kbps
1510>2      byte&0xF0       0x20           \b,  48 kbps
1511>2      byte&0xF0       0x30           \b,  56 kbps
1512>2      byte&0xF0       0x40           \b,  64 kbps
1513>2      byte&0xF0       0x50           \b,  80 kbps
1514>2      byte&0xF0       0x60           \b,  96 kbps
1515>2      byte&0xF0       0x70           \b, 112 kbps
1516>2      byte&0xF0       0x80           \b, 128 kbps
1517>2      byte&0xF0       0x90           \b, 144 kbps
1518>2      byte&0xF0       0xA0           \b, 160 kbps
1519>2      byte&0xF0       0xB0           \b, 176 kbps
1520>2      byte&0xF0       0xC0           \b, 192 kbps
1521>2      byte&0xF0       0xD0           \b, 224 kbps
1522>2      byte&0xF0       0xE0           \b, 256 kbps
1523# timing
1524>2      byte&0x0C       0x00           \b, 22.05 kHz
1525>2      byte&0x0C       0x04           \b, 24 kHz
1526>2      byte&0x0C       0x08           \b, 16 kHz
1527# channels/options
1528>3      byte&0xC0       0x00           \b, Stereo
1529>3      byte&0xC0       0x40           \b, JntStereo
1530>3      byte&0xC0       0x80           \b, 2x Monaural
1531>3      byte&0xC0       0xC0           \b, Monaural
1532#>1     byte            ^0x01          \b, Data Verify
1533#>2     byte            &0x02          \b, Packet Pad
1534#>2     byte            &0x01          \b, Custom Flag
1535#>3     byte            &0x08          \b, Copyrighted
1536#>3     byte            &0x04          \b, Original Source
1537#>3     byte&0x03       1              \b, NR: 50/15 ms
1538#>3     byte&0x03       3              \b, NR: CCIT J.17
1539
1540# MP3, M25A
15410       beshort&0xFFFE  0xFFE2         MPEG ADTS, layer III,  v2.5
1542!:mime	audio/mpeg
1543# rate
1544>2      byte&0xF0       0x10           \b,   8 kbps
1545>2      byte&0xF0       0x20           \b,  16 kbps
1546>2      byte&0xF0       0x30           \b,  24 kbps
1547>2      byte&0xF0       0x40           \b,  32 kbps
1548>2      byte&0xF0       0x50           \b,  40 kbps
1549>2      byte&0xF0       0x60           \b,  48 kbps
1550>2      byte&0xF0       0x70           \b,  56 kbps
1551>2      byte&0xF0       0x80           \b,  64 kbps
1552>2      byte&0xF0       0x90           \b,  80 kbps
1553>2      byte&0xF0       0xA0           \b,  96 kbps
1554>2      byte&0xF0       0xB0           \b, 112 kbps
1555>2      byte&0xF0       0xC0           \b, 128 kbps
1556>2      byte&0xF0       0xD0           \b, 144 kbps
1557>2      byte&0xF0       0xE0           \b, 160 kbps
1558# timing
1559>2      byte&0x0C       0x00           \b, 11.025 kHz
1560>2      byte&0x0C       0x04           \b, 12 kHz
1561>2      byte&0x0C       0x08           \b, 8 kHz
1562# channels/options
1563>3      byte&0xC0       0x00           \b, Stereo
1564>3      byte&0xC0       0x40           \b, JntStereo
1565>3      byte&0xC0       0x80           \b, 2x Monaural
1566>3      byte&0xC0       0xC0           \b, Monaural
1567#>1     byte            ^0x01          \b, Data Verify
1568#>2     byte            &0x02          \b, Packet Pad
1569#>2     byte            &0x01          \b, Custom Flag
1570#>3     byte            &0x08          \b, Copyrighted
1571#>3     byte            &0x04          \b, Original Source
1572#>3     byte&0x03       1              \b, NR: 50/15 ms
1573#>3     byte&0x03       3              \b, NR: CCIT J.17
1574
1575# AAC (aka MPEG-2 NBC audio) and MPEG-4 audio
1576
1577# Stored AAC streams (instead of the MP4 format)
15780       string          ADIF           MPEG ADIF, AAC
1579!:mime	audio/x-hx-aac-adif
1580>4      byte            &0x80
1581>>13    byte            &0x10          \b, VBR
1582>>13    byte            ^0x10          \b, CBR
1583>>16    byte&0x1E       0x02           \b, single stream
1584>>16    byte&0x1E       0x04           \b, 2 streams
1585>>16    byte&0x1E       0x06           \b, 3 streams
1586>>16    byte            &0x08          \b, 4 or more streams
1587>>16    byte            &0x10          \b, 8 or more streams
1588>>4    byte            &0x80          \b, Copyrighted
1589>>13   byte            &0x40          \b, Original Source
1590>>13   byte            &0x20          \b, Home Flag
1591>4      byte            ^0x80
1592>>4     byte            &0x10          \b, VBR
1593>>4     byte            ^0x10          \b, CBR
1594>>7     byte&0x1E       0x02           \b, single stream
1595>>7     byte&0x1E       0x04           \b, 2 streams
1596>>7     byte&0x1E       0x06           \b, 3 streams
1597>>7     byte            &0x08          \b, 4 or more streams
1598>>7     byte            &0x10          \b, 8 or more streams
1599>>4    byte            &0x40          \b, Original Stream(s)
1600>>4    byte            &0x20          \b, Home Source
1601
1602# Live or stored single AAC stream (used with MPEG-2 systems)
16030       beshort&0xFFF6  0xFFF0         MPEG ADTS, AAC
1604!:mime	audio/x-hx-aac-adts
1605>1      byte            &0x08          \b, v2
1606>1      byte            ^0x08          \b, v4
1607# profile
1608>>2     byte            &0xC0          \b LTP
1609>2      byte&0xc0       0x00           \b Main
1610>2      byte&0xc0       0x40           \b LC
1611>2      byte&0xc0       0x80           \b SSR
1612# timing
1613>2      byte&0x3c       0x00           \b, 96 kHz
1614>2      byte&0x3c       0x04           \b, 88.2 kHz
1615>2      byte&0x3c       0x08           \b, 64 kHz
1616>2      byte&0x3c       0x0c           \b, 48 kHz
1617>2      byte&0x3c       0x10           \b, 44.1 kHz
1618>2      byte&0x3c       0x14           \b, 32 kHz
1619>2      byte&0x3c       0x18           \b, 24 kHz
1620>2      byte&0x3c       0x1c           \b, 22.05 kHz
1621>2      byte&0x3c       0x20           \b, 16 kHz
1622>2      byte&0x3c       0x24           \b, 12 kHz
1623>2      byte&0x3c       0x28           \b, 11.025 kHz
1624>2      byte&0x3c       0x2c           \b, 8 kHz
1625# channels
1626>2      beshort&0x01c0  0x0040         \b, monaural
1627>2      beshort&0x01c0  0x0080         \b, stereo
1628>2      beshort&0x01c0  0x00c0         \b, stereo + center
1629>2      beshort&0x01c0  0x0100         \b, stereo+center+LFE
1630>2      beshort&0x01c0  0x0140         \b, surround
1631>2      beshort&0x01c0  0x0180         \b, surround + LFE
1632>2      beshort         &0x01C0        \b, surround + side
1633#>1     byte            ^0x01           \b, Data Verify
1634#>2     byte            &0x02           \b, Custom Flag
1635#>3     byte            &0x20           \b, Original Stream
1636#>3     byte            &0x10           \b, Home Source
1637#>3     byte            &0x08           \b, Copyrighted
1638
1639# Live MPEG-4 audio streams (instead of RTP FlexMux)
16400       beshort&0xFFE0  0x56E0         MPEG-4 LOAS
1641!:mime	audio/x-mp4a-latm
1642#>1     beshort&0x1FFF  x              \b, %hu byte packet
1643>3      byte&0xE0       0x40
1644>>4     byte&0x3C       0x04           \b, single stream
1645>>4     byte&0x3C       0x08           \b, 2 streams
1646>>4     byte&0x3C       0x0C           \b, 3 streams
1647>>4     byte            &0x08          \b, 4 or more streams
1648>>4     byte            &0x20          \b, 8 or more streams
1649>3      byte&0xC0       0
1650>>4     byte&0x78       0x08           \b, single stream
1651>>4     byte&0x78       0x10           \b, 2 streams
1652>>4     byte&0x78       0x18           \b, 3 streams
1653>>4     byte            &0x20          \b, 4 or more streams
1654>>4     byte            &0x40          \b, 8 or more streams
1655# This magic isn't strong enough (matches plausible ISO-8859-1 text)
1656#0       beshort         0x4DE1         MPEG-4 LO-EP audio stream
1657#!:mime	audio/x-mp4a-latm
1658
1659# Summary: FLI animation format
1660# Created by: Daniel Quinlan <quinlan@yggdrasil.com>
1661# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection)
16624	leshort		0xAF11
1663# standard FLI always has 320x200 resolution and 8 bit color
1664>8	leshort		320
1665>>10	leshort		200
1666>>>12	leshort		8			FLI animation, 320x200x8
1667!:mime	video/x-fli
1668>>>>6	leshort		x			\b, %d frames
1669# frame speed is multiple of 1/70s
1670>>>>16	leshort		x			\b, %d/70s per frame
1671
1672# Summary: FLC animation format
1673# Created by: Daniel Quinlan <quinlan@yggdrasil.com>
1674# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection)
16754	leshort		0xAF12
1676# standard FLC always use 8 bit color
1677>12	leshort		8			FLC animation
1678!:mime	video/x-flc
1679>>8	leshort		x			\b, %d
1680>>10	leshort		x			\bx%dx8
1681>>6	uleshort	x			\b, %d frames
1682>>16	uleshort	x			\b, %dms per frame
1683
1684# DL animation format
1685# XXX - collision with most `mips' magic
1686#
1687# I couldn't find a real magic number for these, however, this
1688# -appears- to work.  Note that it might catch other files, too, so be
1689# careful!
1690#
1691# Note that title and author appear in the two 20-byte chunks
1692# at decimal offsets 2 and 22, respectively, but they are XOR'ed with
1693# 255 (hex FF)!  The DL format is really bad.
1694#
1695#0	byte	1	DL version 1, medium format (160x100, 4 images/screen)
1696#!:mime	video/x-unknown
1697#>42	byte	x	- %d screens,
1698#>43	byte	x	%d commands
1699#0	byte	2	DL version 2
1700#!:mime	video/x-unknown
1701#>1	byte	1	- large format (320x200,1 image/screen),
1702#>1	byte	2	- medium format (160x100,4 images/screen),
1703#>1	byte	>2	- unknown format,
1704#>42	byte	x	%d screens,
1705#>43	byte	x	%d commands
1706# Based on empirical evidence, DL version 3 have several nulls following the
1707# \003.  Most of them start with non-null values at hex offset 0x34 or so.
1708#0	string	\3\0\0\0\0\0\0\0\0\0\0\0	DL version 3
1709
1710# iso 13818 transport stream
1711#
1712# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1)
1713# syncbyte      8 bit	0x47
1714# error_ind     1 bit	-
1715# payload_start 1 bit	1
1716# priority      1 bit	-
1717# PID          13 bit	0x0000
1718# scrambling    2 bit	-
1719# adaptfld_ctrl 2 bit	1 or 3
1720# conti_count   4 bit	-
17210	belong&0xFF5FFF10	0x47400010
1722>188	byte			0x47		MPEG transport stream data
1723!:mime  video/MP2T
1724!:ext	ts
1725
1726# DIF digital video file format <mpruett@sgi.com>
17270	belong&0xffffff00	0x1f070000      DIF
1728!:mime  video/x-dv
1729>4	byte			&0x01		(DVCPRO) movie file
1730>4	byte			^0x01		(DV) movie file
1731>3	byte			&0x80		(PAL)
1732>3	byte			^0x80		(NTSC)
1733
1734# MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
17350	string			\x8aMNG		MNG video data,
1736!:mime	video/x-mng
1737>4	belong			!0x0d0a1a0a	CORRUPTED,
1738>4	belong			0x0d0a1a0a
1739>>16    belong	x				%d x
1740>>20    belong	x				%d
1741
1742# JNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
17430	string			\x8bJNG		JNG video data,
1744!:mime	video/x-jng
1745>4	belong			!0x0d0a1a0a	CORRUPTED,
1746>4	belong			0x0d0a1a0a
1747>>16    belong	x				%d x
1748>>20    belong	x				%d
1749
1750# Vivo video (Wolfram Kleff)
17513	string		\x0D\x0AVersion:Vivo	Vivo video data
1752
1753# ABC (alembic.io 3d models)
17540	string	0gawa		ABC 3d model
1755
1756#---------------------------------------------------------------------------
1757# HVQM4: compressed movie format designed by Hudson for Nintendo GameCube
1758# From Mark Sheppard <msheppard@climax.co.uk>, 2002-10-03
1759#
17600	string		HVQM4		%s
1761>6	string		>\0		v%s
1762>0	byte		x		GameCube movie,
1763>0x34	ubeshort	x		%d x
1764>0x36	ubeshort	x		%d,
1765>0x26	ubeshort	x		%dus,
1766>0x42	ubeshort	0		no audio
1767>0x42	ubeshort	>0		%dHz audio
1768
1769# From: Stefan A. Haubenthal <polluks@sdf.lonestar.org>
1770# Update: Joerg Jenderek
1771# URL: https://en.wikipedia.org/wiki/VOB
17720	string		DVDVIDEO-VTS	Video title set,
1773!:mime	video/x-ifo
1774!:ext	ifo/bup
1775>0x21	byte		x		v%x
17760	string		DVDVIDEO-VMG	Video manager,
1777!:mime	video/x-ifo
1778!:ext	ifo/bup
1779>0x21	byte		x		v%x
1780
1781# From: Stefan A. Haubenthal <polluks@sdf.lonestar.org>
17820 string xMovieSetter MovieSetter movie
17830 string xSceneEditor MovieSetter movie
1784
1785# From: Behan Webster <behanw@websterwood.com>
1786# NuppelVideo used by Mythtv (*.nuv)
1787# Note: there are two identical stanzas here differing only in the
1788# initial string matched. It used to be done with a regex, but we're
1789# trying to get rid of those.
17900	string		NuppelVideo	MythTV NuppelVideo
1791>12	string		x		v%s
1792>20	lelong		x		(%d
1793>24	lelong		x		\bx%d),
1794>36	string		P		\bprogressive,
1795>36	string		I		\binterlaced,
1796>40	ledouble	x		\baspect:%.2f,
1797>48	ledouble	x		\bfps:%.2f
17980	string		MythTV		MythTV NuppelVideo
1799>12	string		x		v%s
1800>20	lelong		x		(%d
1801>24	lelong		x		\bx%d),
1802>36	string		P		\bprogressive,
1803>36	string		I		\binterlaced,
1804>40	ledouble	x		\baspect:%.2f,
1805>48	ledouble	x		\bfps:%.2f
1806
1807#						MPEG file
1808# MPEG sequences
1809# FIXME: This section is from the old magic.mime file and needs
1810# integrating with the rest
1811#0       belong             0x000001BA
1812#>4      byte               &0x40
1813#!:mime	video/mp2p
1814#>4      byte               ^0x40
1815#!:mime	video/mpeg
1816#0       belong             0x000001BB
1817#!:mime	video/mpeg
1818#0       belong             0x000001B0
1819#!:mime	video/mp4v-es
1820#0       belong             0x000001B5
1821#!:mime	video/mp4v-es
1822#0       belong             0x000001B3
1823#!:mime	video/mpv
1824#0       belong&0xFF5FFF10  0x47400010
1825#!:mime	video/mp2t
1826#0       belong             0x00000001
1827#>4      byte&0x1F	   0x07
1828#!:mime	video/h264
1829
1830# Type: Bink Video
1831# Extension: .bik
1832# URL:  https://wiki.multimedia.cx/index.php?title=Bink_Container
1833# From: <hoehle@users.sourceforge.net>  2008-07-18
18340	name		bik
1835#>4	ulelong		x	size %d
1836>20	ulelong		x	\b, %d
1837>24	ulelong		x	\bx%d
1838>8	ulelong		x	\b, %d frames
1839>32	ulelong		x	at rate %d/
1840>28	ulelong		>1	\b%d
1841>40	ulelong		=0	\b, no audio
1842>40	ulelong		!0	\b, %d audio track
1843>>40	ulelong		!1	\bs
1844# follow properties of the first audio track only
1845>>48	uleshort	x	%dHz
1846>>51	byte&0x20	0	mono
1847>>51	byte&0x20	!0	stereo
1848#>>51	byte&0x10	0	FFT
1849#>>51	byte&0x10	!0	DCT
1850
18510	string		BIK
1852>3	regex		=[bdfghi]	Bink Video rev.%s
1853>>0	use		bik
1854
18550	string		KB2
1856>3	regex		=[adfghi]	Bink Video 2 rev.%s
1857>>0	use		bik
1858
1859# Type:	NUT Container
1860# URL:	https://wiki.multimedia.cx/index.php?title=NUT
1861# From:	Adam Buchbinder <adam.buchbinder@gmail.com>
18620	string	nut/multimedia\ container\0	NUT multimedia container
1863
1864# Type: Nullsoft Video (NSV)
1865# URL:  https://wiki.multimedia.cx/index.php?title=Nullsoft_Video
1866# From: Mike Melanson <mike@multimedia.cx>
18670	string	NSVf	Nullsoft Video
1868
1869# Type: REDCode Video
1870# URL:  https://www.red.com/ ; https://wiki.multimedia.cx/index.php?title=REDCode
1871# From: Mike Melanson <mike@multimedia.cx>
18724	string	RED1	REDCode Video
1873
1874# Type: MTV Multimedia File
1875# URL:  https://wiki.multimedia.cx/index.php?title=MTV
1876# From: Mike Melanson <mike@multimedia.cx>
18770	string	AMVS	MTV Multimedia File
1878
1879# Type: ARMovie
1880# URL:  https://wiki.multimedia.cx/index.php?title=ARMovie
1881# From: Mike Melanson <mike@multimedia.cx>
18820	string	ARMovie\012	ARMovie
1883
1884# Type: Interplay MVE Movie
1885# URL:  https://wiki.multimedia.cx/index.php?title=Interplay_MVE
1886# From: Mike Melanson <mike@multimedia.cx>
18870	string	Interplay\040MVE\040File\032	Interplay MVE Movie
1888
1889# Type: Windows Television DVR File
1890# URL:  https://wiki.multimedia.cx/index.php?title=WTV
1891# From: Mike Melanson <mike@mutlimedia.cx>
1892# This takes the form of a Windows-style GUID
18930	bequad	0xB7D800203749DA11
1894>8	bequad	0xA64E0007E95EAD8D	Windows Television DVR Media
1895
1896# Type: Sega FILM/CPK Multimedia
1897# URL:  https://wiki.multimedia.cx/index.php?title=Sega_FILM
1898# From: Mike Melanson <mike@multimedia.cx>
18990	string	FILM	Sega FILM/CPK Multimedia,
1900>32	belong	x	%d x
1901>28	belong	x	%d
1902
1903# Type: Nintendo THP Multimedia
1904# URL:  https://wiki.multimedia.cx/index.php?title=THP
1905# From: Mike Melanson <mike@multimedia.cx>
19060	string	THP\0	Nintendo THP Multimedia
1907
1908# Type: BBC Dirac Video
1909# URL:  https://wiki.multimedia.cx/index.php?title=Dirac
1910# From: Mike Melanson <mike@multimedia.cx>
19110	string	BBCD	BBC Dirac Video
1912
1913# Type: RAD Game Tools Smacker Multimedia
1914# URL:  https://wiki.multimedia.cx/index.php?title=Smacker
1915# From: Mike Melanson <mike@multimedia.cx>
19160	string	SMK	RAD Game Tools Smacker Multimedia
1917>3	byte	x	version %c,
1918>4	lelong	x	%d x
1919>8	lelong	x	%d,
1920>12	lelong	x	%d frames
1921
1922# Material Exchange Format
1923# More information:
1924# https://en.wikipedia.org/wiki/Material_Exchange_Format
1925# http://www.freemxf.org/
19260	string	\x06\x0e\x2b\x34\x02\x05\x01\x01\x0d\x01\x02\x01\x01\x02	Material exchange container format
1927!:ext	mxf
1928!:mime	application/mxf
1929
1930# Recognize LucasArts Smush video files (cf.
1931# https://wiki.multimedia.cx/index.php/Smush)
19320	string	ANIM
1933>8	string	AHDR	LucasArts Smush Animation Format (SAN) video
19340	string	SANM
1935>8	string	SHDR	LucasArts Smush v2 (SANM) video
1936
1937# Type: Scaleform video
1938# Extension: .usm
1939# URL:  https://wiki.multimedia.cx/index.php/USM
1940# From: David Korth <gerbilsoft@gerbilsoft.com>
19410	string	CRID
1942>32	string	@UTF	Scaleform video
1943
1944# http://www.jerrysguide.com/tips/demystify-tvs-file-format.html
19450	string	TVS\015\012
1946>&0	string	Version\040	TeamViewer Session File
1947>>&0	string	x		\b, version %s
1948
1949# SER file format - simple uncompressed video format for astronomical use
1950# Initially developed by Lucam Recorder,
1951# as of 2021 maintained by Heiko Wilkens, Grischa Hahn
1952# Typical extensions: .SER
1953# http://www.grischa-hahn.homepage.t-online.de/astro/ser/SER%20Doc%20V3b.pdf
19540	string	LUCAM-RECORDER	SER video sequence
1955!:ext	ser
1956>18	lelong	0	\b, bayer: mono
1957>18	lelong	8	\b, bayer: RGGB
1958>18	lelong	9	\b, bayer: GRBG
1959>18	lelong	10	\b, bayer: GBRG
1960>18	lelong	11	\b, bayer: BGGR
1961>18	lelong	16	\b, bayer: CYYM
1962>18	lelong	17	\b, bayer: YCMY
1963>18	lelong	18	\b, bayer: YMCY
1964>18	lelong	19	\b, bayer: MYYC
1965>18	lelong	100	\b, bayer: RGB
1966>18	lelong	101	\b, bayer: BGR
1967>22	lelong	0	\b, big-endian
1968>22	lelong	1	\b, little-endian
1969>26	lelong	x	\b, width: %d
1970>30	lelong	x	\b, height: %d
1971>34	lelong	x	\b, %d bit
1972>38	lelong	x	\b, frames: %d
1973
1974#------------------------------------------------------------------------------
1975# $File: aout,v 1.1 2013/01/09 22:37:23 christos Exp $
1976# aout:  file(1) magic for a.out executable/object/etc entries that
1977# handle executables on multiple platforms.
1978#
1979
1980#
1981# Little-endian 32-bit-int a.out, merged from bsdi (for BSD/OS, from
1982# BSDI), netbsd, and vax (for UNIX/32V and BSD)
1983#
1984# XXX - is there anything we can look at to distinguish BSD/OS 386 from
1985# NetBSD 386 from various VAX binaries?  The BSD/OS shared library flag
1986# works only for binaries using shared libraries.  Grabbing the entry
1987# point from the a.out header, using it to find the first code executed
1988# in the program, and looking at that might help.
1989#
19900	lelong		0407		a.out little-endian 32-bit executable
1991>16	lelong		>0		not stripped
1992>32	byte		0x6a		(uses BSD/OS shared libs)
1993
19940	lelong		0410		a.out little-endian 32-bit pure executable
1995>16	lelong		>0		not stripped
1996>32	byte		0x6a		(uses BSD/OS shared libs)
1997
19980	lelong		0413		a.out little-endian 32-bit demand paged pure executable
1999>16	lelong		>0		not stripped
2000>32	byte		0x6a		(uses BSD/OS shared libs)
2001
2002#
2003# Big-endian 32-bit-int a.out, merged from sun (for old 68010 SunOS a.out),
2004# mips (for old 68020(!) SGI a.out), and netbsd (for old big-endian a.out).
2005#
2006# XXX - is there anything we can look at to distinguish old SunOS 68010
2007# from old 68020 IRIX from old NetBSD?  Again, I guess we could look at
2008# the first instruction or instructions in the program.
2009#
20100	belong		0407		a.out big-endian 32-bit executable
2011>16	belong		>0		not stripped
2012
20130	belong		0410		a.out big-endian 32-bit pure executable
2014>16	belong		>0		not stripped
2015
20160	belong		0413		a.out big-endian 32-bit demand paged executable
2017>16	belong		>0		not stripped
2018
2019
2020#------------------------------------------------------------------------------
2021# $File: apache,v 1.1 2017/04/11 14:52:15 christos Exp $
2022# apache: file(1) magic for Apache Big Data formats
2023
2024# Avro files
20250	string		Obj		Apache Avro
2026>3	byte		x		version %d
2027
2028# ORC files
2029# Important information is in file footer, which we can't index to :(
20300	string		ORC		Apache ORC
2031
2032# Parquet files
20330	string		PAR1		Apache Parquet
2034
2035# Hive RC files
20360	string		RCF		Apache Hive RC file
2037>3	byte		x		version %d
2038
2039# Sequence files (and the careless first version of RC file)
2040
20410	string		SEQ
2042>3	byte		<6		Apache Hadoop Sequence file version %d
2043>3	byte		>6		Apache Hadoop Sequence file version %d
2044>3	byte		=6
2045>>5	string		org.apache.hadoop.hive.ql.io.RCFile$KeyBuffer  Apache Hive RC file version 0
2046>>3	default		x		Apache Hadoop Sequence file version 6
2047
2048#------------------------------------------------------------------------------
2049# $File: apl,v 1.6 2009/09/19 16:28:07 christos Exp $
2050# apl:  file(1) magic for APL (see also "pdp" and "vax" for other APL
2051#       workspaces)
2052#
20530	long		0100554		APL workspace (Ken's original?)
2054
2055#------------------------------------------------------------------------------
2056# $File: apple,v 1.45 2021/04/26 15:56:00 christos Exp $
2057# apple:  file(1) magic for Apple file formats
2058#
20590	search/1/t	FiLeStArTfIlEsTaRt	binscii (apple ][) text
20600	string		\x0aGL			Binary II (apple ][) data
20610	string		\x76\xff		Squeezed (apple ][) data
20620	string		NuFile			NuFile archive (apple ][) data
20630	string		N\xf5F\xe9l\xe5		NuFile archive (apple ][) data
20640	belong		0x00051600		AppleSingle encoded Macintosh file
20650	belong		0x00051607		AppleDouble encoded Macintosh file
2066
2067# Type: Apple Emulator WOZ format
2068# From: Greg Wildman <greg@apple2.org.za>
2069# Ref: https://applesaucefdc.com/woz/reference/
2070# Ref: https://applesaucefdc.com/woz/reference2/
2071#
2072# Note: The following test are mostly identical. I would rather not
2073# use a regex to identify the WOZ format number.
20740	string		WOZ1
2075>4	string		\xFF\x0A\x0D\x0A	Apple ][ WOZ 1.0 Disk Image
2076>12	string		INFO
2077>>21	byte		01			\b, 5.25 inch
2078>>21	byte		02			\b, 3.5 inch
2079>>22	byte		01			\b, write protected
2080>>23	byte		01			\b, cross track synchronized
2081>>25	string/T	x			\b, %.32s
20820	string		WOZ2
2083>4	string		\xFF\x0A\x0D\x0A	Apple ][ WOZ 2.0 Disk Image
2084>12	string		INFO
2085>>21	byte		01			\b, 5.25 inch
2086>>21	byte		02			\b, 3.5 inch
2087>>22	byte		01			\b, write protected
2088>>23	byte		01			\b, cross track synchronized
2089>>25	string/T	x			\b, %.32s
2090
2091# Type: Apple Emulator disk images
2092# From: Greg Wildman <greg@apple2.org.za>
2093# ProDOS boot loader?
20940		string	\x01\x38\xB0\x03\x4C	Apple ProDOS Image
2095# Detect Volume Directory block ($02)
2096>0x400		string	\x00\x00\x03\x00
2097>>0x404		byte	&0xF0
2098>>>0x405	string	x			\b, Volume /%s
2099>>>0x429	leshort	x			\b, %u Blocks
2100# ProDOS ordered ?
2101>0xb00		string	\x00\x00\x03\x00
2102>>0xb04		byte	&0xF0
2103>>>0xb05	string	x			\b, Volume /%s
2104>>>0xb29	leshort	x			\b, %u Blocks
2105#
2106# DOS3.3 boot loader?
21070		string	\x01\xA5\x27\xC9\x09\xD0\x18\xA5\x2B
2108>0x11001	string	\x11\x0F\x03	Apple DOS 3.3 Image
2109>>0x11006	byte	x		\b, Volume %u
2110>>0x11034	byte	x		\b, %u Tracks
2111>>0x11035	byte	x		\b, %u Sectors
2112>>0x11036	leshort	x		\b, %u bytes per sector
2113# DOS3.2 ?
2114>0x11001	string	\x11\x0C\x02	Apple DOS 3.2 Image
2115>>0x11006	byte	x		\b, Volume %u
2116>>0x11034	byte	x		\b, %u Tracks
2117>>0x11035	byte	x		\b, %u Sectors
2118>>0x11036	leshort	x		\b, %u bytes per sector
2119# DOS3.1 ?
2120>0x11001	string	\x11\x0C\x01
2121>>0x11c00	string	\x00\x11\x0B	Apple DOS 3.1 Image
2122#
2123# Pascal boot loader?
21240		string	\x01\xE0\x60\xF0\x03\x4C\xE3\x08\xAD
2125>0xd6		pstring SYSTEM.APPLE
2126>>0xb00		leshort	0x0000
2127>>>0xb04	leshort 0x0000		Apple Pascal Image
2128>>>>0xb06	pstring x		\b, Volume %s:
2129>>>>0xb0e	leshort x		\b, %u Blocks
2130>>>>0xb10	leshort x		\b, %u Files
2131#
2132# Diversi Dos boot loader?
21330		string	\x01\xA8\xAD\x81\xC0\xEE\x09\x08\xAD
2134>0x11001	string	\x11\x0F\x03	Apple Diversi Dos Image
2135>>0x11006	byte	x		\b, Volume %u
2136>>0x11034	byte	x		\b, %u Tracks
2137>>0x11035	byte	x		\b, %u Sectors
2138>>0x11036	leshort	x		\b, %u bytes per sector
2139
2140# Type: Apple Emulator 2IMG format
2141# From: Radek Vokal <rvokal@redhat.com>
2142# Update: Greg Wildman <greg@apple2.org.za>
21430		string	2IMG		Apple ][ 2IMG Disk Image
2144>4		clear	x
2145>4		string	XGS!		\b, XGS
2146>4		string	CTKG		\b, Catakig
2147>4		string	ShIm		\b, Sheppy's ImageMaker
2148>4		string	SHEP		\b, Sheppy's ImageMaker
2149>4		string	WOOF		\b, Sweet 16
2150>4		string	B2TR		\b, Bernie ][ the Rescue
2151>4		string	\!nfc		\b, ASIMOV2
2152>4		string	\>BD\<		\b, Brutal Deluxe's Cadius
2153>4		string	CdrP		\b, CiderPress
2154>4		string	Vi][		\b, Virtual ][
2155>4		string	PRFS		\b, ProFUSE
2156>4		string	FISH		\b, FishWings
2157>4		string	RVLW		\b, Revival for Windows
2158>4		default	x
2159>>4		string	x		\b, Creator tag "%-4.4s"
2160>0xc		byte	00		\b, DOS 3.3 sector order
2161>>0x10		byte	00		\b, Volume 254
2162>>0x10		byte&0x7f x		\b, Volume %u
2163>0xc		byte	01		\b, ProDOS sector order
2164# Detect Volume Directory block ($02) + 2mg header offset
2165>>0x440		string	\x00\x00\x03\x00
2166>>>0x444	byte	&0xF0
2167>>>>0x445	string	x		\b, Volume /%s
2168>>>>0x469	leshort	x		\b, %u Blocks
2169>0xc		byte	02		\b, NIB data
2170
2171# magic for Newton PDA package formats
2172# from Ruda Moura <ruda@helllabs.org>
21730	string	package0	Newton package, NOS 1.x,
2174>12	belong	&0x80000000	AutoRemove,
2175>12	belong	&0x40000000	CopyProtect,
2176>12	belong	&0x10000000	NoCompression,
2177>12	belong	&0x04000000	Relocation,
2178>12	belong	&0x02000000	UseFasterCompression,
2179>16	belong	x		version %d
2180
21810	string	package1	Newton package, NOS 2.x,
2182>12	belong	&0x80000000	AutoRemove,
2183>12	belong	&0x40000000	CopyProtect,
2184>12	belong	&0x10000000	NoCompression,
2185>12	belong	&0x04000000	Relocation,
2186>12	belong	&0x02000000	UseFasterCompression,
2187>16	belong	x		version %d
2188
21890	string	package4	Newton package,
2190>8	byte	8		NOS 1.x,
2191>8	byte	9		NOS 2.x,
2192>12	belong	&0x80000000	AutoRemove,
2193>12	belong	&0x40000000	CopyProtect,
2194>12	belong	&0x10000000	NoCompression,
2195
2196# The following entries for the Apple II are for files that have
2197# been transferred as raw binary data from an Apple, without having
2198# been encapsulated by any of the above archivers.
2199#
2200# In general, Apple II formats are hard to identify because Apple DOS
2201# and especially Apple ProDOS have strong typing in the file system and
2202# therefore programmers never felt much need to include type information
2203# in the files themselves.
2204#
2205# Eric Fischer <enf@pobox.com>
2206
2207# AppleWorks word processor:
2208# URL: https://en.wikipedia.org/wiki/AppleWorks
2209# Reference: http://www.gno.org/pub/apple2/doc/apple/filetypes/ftn.1a.xxxx
2210# Update: Joerg Jenderek
2211# NOTE:
2212# The "O" is really the magic number, but that's so common that it's
2213# necessary to check the tab stops that follow it to avoid false positives.
2214# and/or look for unused bits of booleans bytes like zoom, paginated, mail merge
2215# the newer AppleWorks is from claris with extension CWK
22164	string		O
2217# test for unused bits of zoom- , paginated-boolean bytes
2218>84	ubequad		^0x00Fe00000000Fe00
2219# look for tabstop definitions "=" no tab, "|" no tab
2220# "<" left tab,"^" center tab,">" right tab, "." decimal tab,
2221# unofficial "!" other , "\x8a" other
2222# official only if SFMinVers is nonzero
2223>>5	regex/s	[=.<>|!^\x8a]{79}	AppleWorks Word Processor
2224# AppleWorks Word Processor File (Apple II)
2225# ./apple (version 5.25) labeled the entry as "AppleWorks word processor data"
2226# application/x-appleworks is mime type for claris version with cwk extension
2227!:mime	application/x-appleworks3
2228# http://home.earthlink.net/~hughhood/appleiiworksenvoy/
2229# ('p' + 1-byte ProDOS File Type + 2-byte ProDOS Aux Type')
2230# $70 $1A $F8 $FF is this the apple type ?
2231#:apple pdosp^Z\xf8\xff
2232!:ext awp
2233# minimum version needed to read this files. SFMinVers (0 , 30~3.0 )
2234>>>183	ubyte		30	3.0
2235>>>183	ubyte		!30
2236>>>>183	ubyte		!0	%#x
2237# usual tabstop start sequence "=====<"
2238>>>5	string		x	\b, tabstop ruler "%6.6s"
2239# tabstop ruler
2240#>>>5	string		>\0	\b, tabstops "%-79s"
2241# zoom switch
2242>>>85	  byte&0x01	>0	\b, zoomed
2243# whether paginated
2244>>>90	  byte&0x01	>0	\b, paginated
2245# contains any mail-merge commands
2246>>>92	  byte&0x01	>0	\b, with mail merge
2247# left margin in 1/10 inches ( normally 0 or 10 )
2248>>>91	ubyte		>0
2249>>>>91	ubyte		x	\b, %d/10 inch left margin
2250
2251# AppleWorks database:
2252#
2253# This isn't really a magic number, but it's the closest thing to one
2254# that I could find.  The 1 and 2 really mean "order in which you defined
2255# categories" and "left to right, top to bottom," respectively; the D and R
2256# mean that the cursor should move either down or right when you press Return.
2257
2258#30	string		\x01D	AppleWorks database data
2259#30	string		\x02D	AppleWorks database data
2260#30	string		\x01R	AppleWorks database data
2261#30	string		\x02R	AppleWorks database data
2262
2263# AppleWorks spreadsheet:
2264#
2265# Likewise, this isn't really meant as a magic number.  The R or C means
2266# row- or column-order recalculation; the A or M means automatic or manual
2267# recalculation.
2268
2269#131	string		RA	AppleWorks spreadsheet data
2270#131	string		RM	AppleWorks spreadsheet data
2271#131	string		CA	AppleWorks spreadsheet data
2272#131	string		CM	AppleWorks spreadsheet data
2273
2274# Applesoft BASIC:
2275#
2276# This is incredibly sloppy, but will be true if the program was
2277# written at its usual memory location of 2048 and its first line
2278# number is less than 256.  Yuck.
2279# update by Joerg Jenderek at Feb 2013
2280
2281# GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000)
2282#0       belong&0xff00ff 0x80000 Applesoft BASIC program data
22830	belong&0x00ff00ff	0x00080000
2284# assuming that line number must be positive
2285>2	leshort			>0		Applesoft BASIC program data, first line number %d
2286#>2     leshort         x       \b, first line number %d
2287
2288# ORCA/EZ assembler:
2289#
2290# This will not identify ORCA/M source files, since those have
2291# some sort of date code instead of the two zero bytes at 6 and 7
2292# XXX Conflicts with ELF
2293#4       belong&0xff00ffff       0x01000000      ORCA/EZ assembler source data
2294#>5      byte                    x               \b, build number %d
2295
2296# Broderbund Fantavision
2297#
2298# I don't know what these values really mean, but they seem to recur.
2299# Will they cause too many conflicts?
2300
2301# Probably :-)
2302#2	belong&0xFF00FF		0x040008	Fantavision movie data
2303
2304# Some attempts at images.
2305#
2306# These are actually just bit-for-bit dumps of the frame buffer, so
2307# there's really no reasonably way to distinguish them except for their
2308# address (if preserved) -- 8192 or 16384 -- and their length -- 8192
2309# or, occasionally, 8184.
2310#
2311# Nevertheless this will manage to catch a lot of images that happen
2312# to have a solid-colored line at the bottom of the screen.
2313
2314# GRR: Magic too weak
2315#8144	string	\x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F	Apple II image with white background
2316#8144	string	\x55\x2A\x55\x2A\x55\x2A\x55\x2A	Apple II image with purple background
2317#8144	string	\x2A\x55\x2A\x55\x2A\x55\x2A\x55	Apple II image with green background
2318#8144	string	\xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA	Apple II image with blue background
2319#8144	string	\xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5	Apple II image with orange background
2320
2321# Beagle Bros. Apple Mechanic fonts
2322
23230	belong&0xFF00FFFF	0x6400D000	Apple Mechanic font
2324
2325# Apple Universal Disk Image Format (UDIF) - dmg files.
2326# From Johan Gade.
2327# These entries are disabled for now until we fix the following issues.
2328#
2329# Note there might be some problems with the "VAX COFF executable"
2330# entry. Note this entry should be placed before the mac filesystem section,
2331# particularly the "Apple Partition data" entry.
2332#
2333# The intended meaning of these tests is, that the file is only of the
2334# specified type if both of the lines are correct - i.e. if the first
2335# line matches and the second doesn't then it is not of that type.
2336#
2337#0	long	0x7801730d
2338#>4	long	0x62626060	UDIF read-only zlib-compressed image (UDZO)
2339#
2340# Note that this entry is recognized correctly by the "Apple Partition
2341# data" entry - however since this entry is more specific - this
2342# information seems to be more useful.
2343#0	long	0x45520200
2344#>0x410	string	disk\ image	UDIF read/write image (UDRW)
2345
2346# From: Toby Peterson <toby@apple.com>
23470	string	bplist00	Apple binary property list
2348
2349# Apple binary property list (bplist)
2350#  Assumes version bytes are hex.
2351#  Provides content hints for version 0 files. Assumes that the root
2352#  object is the first object (true for CoreFoundation implementation).
2353# From: David Remahl <dremahl@apple.com>
23540		string	bplist
2355>6		byte	x	\bCoreFoundation binary property list data, version %#c
2356>>7		byte	x	\b%c
2357>6		string		00		\b
2358>>8		byte&0xF0	0x00	\b
2359>>>8	byte&0x0F	0x00	\b, root type: null
2360>>>8	byte&0x0F	0x08	\b, root type: false boolean
2361>>>8	byte&0x0F	0x09	\b, root type: true boolean
2362>>8		byte&0xF0	0x10	\b, root type: integer
2363>>8		byte&0xF0	0x20	\b, root type: real
2364>>8		byte&0xF0	0x30	\b, root type: date
2365>>8		byte&0xF0	0x40    \b, root type: data
2366>>8		byte&0xF0	0x50	\b, root type: ascii string
2367>>8		byte&0xF0	0x60	\b, root type: unicode string
2368>>8		byte&0xF0	0x80	\b, root type: uid (CORRUPT)
2369>>8		byte&0xF0	0xa0	\b, root type: array
2370>>8		byte&0xF0	0xd0	\b, root type: dictionary
2371
2372# Apple/NeXT typedstream data
2373#  Serialization format used by NeXT and Apple for various
2374#  purposes in YellowStep/Cocoa, including some nib files.
2375# From: David Remahl <dremahl@apple.com>
23762		string		typedstream	NeXT/Apple typedstream data, big endian
2377>0		byte		x		\b, version %d
2378>0		byte		<5		\b
2379>>13	byte		0x81	\b
2380>>>14	ubeshort	x		\b, system %d
23812		string		streamtyped NeXT/Apple typedstream data, little endian
2382>0		byte		x		\b, version %d
2383>0		byte		<5		\b
2384>>13	byte		0x81	\b
2385>>>14	uleshort	x		\b, system %d
2386
2387#------------------------------------------------------------------------------
2388# CAF: Apple CoreAudio File Format
2389#
2390# Container format for high-end audio purposes.
2391# From: David Remahl <dremahl@apple.com>
2392#
23930	string		caff		CoreAudio Format audio file
2394>4	beshort		<10		version %d
2395>6	beshort		x
2396
2397
2398#------------------------------------------------------------------------------
2399# Keychain database files
24000	string		kych		Mac OS X Keychain File
2401
2402#------------------------------------------------------------------------------
2403# Code Signing related file types
24040	belong		0xfade0c00	Mac OS X Code Requirement
2405>8	belong		1			(opExpr)
2406>4	belong		x			- %d bytes
2407
24080	belong		0xfade0c01	Mac OS X Code Requirement Set
2409>8	belong		>1			containing %d items
2410>4	belong		x			- %d bytes
2411
24120	belong		0xfade0c02	Mac OS X Code Directory
2413>8	belong		x			version %x
2414>12	belong		>0			flags %#x
2415>4	belong		x			- %d bytes
2416
24170	belong		0xfade0cc0	Mac OS X Detached Code Signature (non-executable)
2418>4	belong		x			- %d bytes
2419
24200	belong		0xfade0cc1	Mac OS X Detached Code Signature
2421>8	belong		>1			(%d elements)
2422>4	belong		x			- %d bytes
2423
2424# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
2425# .vdi
24264	string innotek\ VirtualBox\ Disk\ Image %s
2427
2428# Apple disk partition stuff
2429# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
2430# Reference: https://ftp.netbsd.org/pub/NetBSD/NetBSD-current/src/sys/sys/bootblock.h
2431# Update: Joerg Jenderek
2432# "ER" is APPLE_DRVR_MAP_MAGIC signature
24330	beshort	0x4552
2434# display Apple Driver Map (strength=50) after Syslinux bootloader (71)
2435#!:strength +0
2436# strengthen the magic by looking for used blocksizes 512 2048
2437>2	ubeshort&0xf1FF		0	Apple Driver Map
2438# last 6 bytes for padding found are 0 or end with 55AAh marker for MBR hybrid
2439#>>504	ubequad&0x0000FFffFFff0000	0
2440!:mime	application/x-apple-diskimage
2441!:apple	????devr
2442# https://en.wikipedia.org/wiki/Apple_Disk_Image
2443!:ext	dmg/iso
2444# sbBlkSize for driver descriptor map 512 2048
2445>>2	beshort	x			\b, blocksize %d
2446# sbBlkCount sometimes garbish like
2447# 0xb0200000 for unzlibed install_flash_player_19.0.0.245_osx.dmg
2448# 0xf2720100 for bunziped Firefox 48.0-2.dmg
2449# 0xeb02ffff for super_grub2_disk_hybrid_2.02s3.iso
2450# 0x00009090 by syslinux-6.03/utils/isohybrid.c
2451>>4	ubelong	x			\b, blockcount %u
2452# following device/driver information not very useful
2453# device type 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
2454>>8	ubeshort	x		\b, devtype %u
2455# device id 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
2456>>10	ubeshort	x		\b, devid %u
2457# driver data 0 (2425393296 garbage for super_grub2_disk_hybrid_2.02s3.iso)
2458>>12	ubelong		>0
2459>>>12	ubelong		x		\b, driver data %u
2460# number of driver descriptors sbDrvrCount <= 61
2461# (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
2462>>16	ubeshort	x		\b, driver count %u
2463# 61 * apple_drvr_descriptor[8]. information not very useful or same as in partition map
2464# >>18	use		apple-driver-map
2465# >>26	use		apple-driver-map
2466# # ...
2467# >>500	use		apple-driver-map
2468# number of partitions is always same in every partition (map block count)
2469#>>0x0204	ubelong		x	\b, %u partitions
2470>>0x0204	ubelong		>0	\b, contains[@0x200]:
2471>>>0x0200	use		apple-apm
2472>>0x0204	ubelong		>1	\b, contains[@0x400]:
2473>>>0x0400	use		apple-apm
2474>>0x0204	ubelong		>2	\b, contains[@0x600]:
2475>>>0x0600	use		apple-apm
2476>>0x0204	ubelong		>3	\b, contains[@0x800]:
2477>>>0x0800	use		apple-apm
2478>>0x0204	ubelong		>4	\b, contains[@0xA00]:
2479>>>0x0A00	use		apple-apm
2480>>0x0204	ubelong		>5	\b, contains[@0xC00]:
2481>>>0x0C00	use		apple-apm
2482>>0x0204	ubelong		>6	\b, contains[@0xE00]:
2483>>>0x0E00	use		apple-apm
2484>>0x0204	ubelong		>7	\b, contains[@0x1000]:
2485>>>0x1000	use		apple-apm
2486#	display apple driver descriptor map (start-block, # blocks in sbBlkSize sizes, type)
24870	name				apple-driver-map
2488>0	ubequad		!0
2489# descBlock first block of driver
2490>>0	ubelong	x			\b, driver start block %u
2491# descSize driver size in blocks
2492>>4	ubeshort	x		\b, size %u
2493# descType driver system type 1 701h F8FFh FFFFh
2494>>6	ubeshort	x		\b, type %#x
2495
2496# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
2497# Reference: https://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h
2498# Update: Joerg Jenderek
2499# Yes, the 3rd and 4th bytes pmSigPad are reserved, but we use them to make the
2500# magic stronger.
2501# for apple partition map stored as a single file
25020	belong	0x504d0000
2503# to display Apple Partition Map (strength=70) after Syslinux bootloader (71)
2504#!:strength +0
2505>0	use		apple-apm
2506# magic/Magdir/apple14.test, 365: Warning: Current entry does not yet have a description for adding a EXTENSION type
2507# file: could not find any valid magic files!
2508#!:ext	bin
2509#	display apple partition map. Normally called after Apple driver map
25100	name				apple-apm
2511>0	belong	0x504d0000		Apple Partition Map
2512# number of partitions
2513>>4	ubelong	x			\b, map block count %u
2514# logical block (512 bytes) start of partition
2515>>8	ubelong	x			\b, start block %u
2516>>12	ubelong	x			\b, block count %u
2517>>16	string >0			\b, name %s
2518>>48	string >0			\b, type %s
2519# processor type dpme_process_id[16] e.g. "68000" "68020"
2520>>120	string >0			\b, processor %s
2521# A/UX boot arguments BootArgs[128]
2522>>136	string >0			\b, boot arguments %s
2523# status of partition dpme_flags
2524>>88	belong	& 1			\b, valid
2525>>88	belong	& 2			\b, allocated
2526>>88	belong	& 4			\b, in use
2527>>88	belong	& 8			\b, has boot info
2528>>88	belong	& 16			\b, readable
2529>>88	belong	& 32			\b, writable
2530>>88	belong	& 64			\b, pic boot code
2531>>88	belong	& 128			\b, chain compatible driver
2532>>88	belong	& 256			\b, real driver
2533>>88	belong	& 512			\b, chain driver
2534# mount automatically at startup APPLE_PS_AUTO_MOUNT
2535>>88	ubelong	&0x40000000		\b, mount at startup
2536# is the startup partition APPLE_PS_STARTUP
2537>>88	ubelong	&0x80000000		\b, is the startup partition
2538
2539#https://wiki.mozilla.org/DS_Store_File_Format
2540#https://en.wikipedia.org/wiki/.DS_Store
25410	string	\0\0\0\1Bud1\0		Apple Desktop Services Store
2542
2543# HFS/HFS+ Resource fork files (andrew.roazen@nau.edu Apr 13 2015)
2544# Usually not in separate files, but have either filename rsrc with
2545# no extension, or a filename corresponding to another file, with
2546# extensions rsr/rsrc
25470	string  \000\000\001\000
2548>4	leshort 0
2549>>16	lelong  0			Apple HFS/HFS+ resource fork
2550
2551#https://en.wikipedia.org/wiki/AppleScript
25520	string	FasdUAS			AppleScript compiled
2553
2554# AppleWorks/ClarisWorks
2555# https://github.com/joshenders/appleworks_format
2556# http://fileformats.archiveteam.org/wiki/AppleWorks
25570	name			appleworks
2558>0	belong&0x00ffffff	0x07e100	AppleWorks CWK Document
2559>0	belong&0x00ffffff	0x008803	ClarisWorks CWK Document
2560>0	default			x
2561>>0	belong			x		AppleWorks/ClarisWorks CWK Document
2562>0	byte			x		\b, version %d
2563>30	beshort			x		\b, %d
2564>32	beshort			x		\bx%d
2565!:ext cwk
2566
25674	string	BOBO
2568>0	byte	>4
2569>>12	belong	0
2570>>>26	belong	0
2571>>>>0	use	appleworks
2572>0	belong	0x0481ad00
2573>>0	use 	appleworks
2574
2575# magic for Apple File System (APFS)
2576# from Alex Myczko <alex@aiei.ch>
257732		string	NXSB		Apple File System (APFS)
2578>36		ulelong	x		\b, blocksize %u
2579
2580# iTunes cover art (versions 1 and 2)
25814		string	itch
2582>24		string	artw
2583>>0x1e8		string	data		iTunes cover art
2584>>>0x1ed	string	PNG		(PNG)
2585>>>0x1ec	beshort 0xffd8		(JPEG)
2586
2587# MacPaint image
258865		string	PNTGMPNT	MacPaint image data
2589#0		belong	2		MacPaint image data
2590
2591#------------------------------------------------------------------------------
2592# $File: application,v 1.1 2016/10/17 12:13:01 christos Exp $
2593# application:  file(1) magic for applications on small devices
2594#
2595# Pebble Application
25960	string	PBLAPP\000\000	Pebble application
2597
2598#------------------------------------------------------------------------------
2599# $File: applix,v 1.5 2009/09/19 16:28:08 christos Exp $
2600# applix:  file(1) magic for Applixware
2601# From: Peter Soos <sp@osb.hu>
2602#
26030	string		*BEGIN		Applixware
2604>7	string		WORDS			Words Document
2605>7	string		GRAPHICS		Graphic
2606>7	string		RASTER			Bitmap
2607>7	string		SPREADSHEETS		Spreadsheet
2608>7	string		MACRO			Macro
2609>7	string		BUILDER			Builder Object
2610
2611#------------------------------------------------------------------------------
2612# $File: apt,v 1.1 2016/10/17 19:51:57 christos Exp $
2613# apt: file(1) magic for APT Cache files
2614# <http://www.fifi.org/doc/libapt-pkg-doc/cache.html/ch2.html>
2615# <https://anonscm.debian.org/cgit/apt/apt.git/tree/apt-pkg/pkgcache.h#n292>
2616
2617# before version 10 ("old format"), data was in arch-specific long/short
2618
2619# old format 64 bit
26200   	name		apt-cache-64bit-be
2621>12	beshort		1		\b, dirty
2622>40 	bequad		x		\b, %llu packages
2623>48 	bequad		x		\b, %llu versions
2624
2625# old format 32 bit
26260   	name    	apt-cache-32bit-be
2627>8  	beshort 	1		\b, dirty
2628>40 	belong  	x		\b, %u packages
2629>44 	belong  	x		\b, %u versions
2630
2631# new format
26320	name		apt-cache-be
2633>6	byte    	1		\b, dirty
2634>24	belong  	x		\b, %u packages
2635>28	belong		x		\b, %u versions
2636
26370	bequad		0x98FE76DC
2638>8	ubeshort	<10		APT cache data, version %u
2639>>10	beshort	    	x	  	\b.%u, 64 bit big-endian
2640>>0	use		apt-cache-64bit-be
2641
26420	lequad	    	0x98FE76DC
2643>8	uleshort    	<10		APT cache data, version %u
2644>>10	leshort		x		\b.%u, 64 bit little-endian
2645>>0	use		\^apt-cache-64bit-be
2646
26470	belong	    	0x98FE76DC
2648>4	ubeshort    	<10	 	APT cache data, version %u
2649>>6	ubeshort    	x		\b.%u, 32 bit big-endian
2650>>0	use  		apt-cache-32bit-be
2651>4	ubyte	    	>9		APT cache data, version %u
2652>>5	ubyte	    	x		\b.%u, big-endian
2653>>0	use 		apt-cache-be
2654
26550	lelong	    	0x98FE76DC
2656>4	uleshort    	<10		APT cache data, version %u
2657>>6	uleshort   	x		\b.%u, 32 bit little-endian
2658>>0	use 		\^apt-cache-32bit-be
2659>4	ubyte	    	>9		APT cache data, version %u
2660>>5	ubyte	    	x		\b.%u, little-endian
2661>>0	use		\^apt-cache-be
2662#------------------------------------------------------------------------------
2663# $File: archive,v 1.169 2022/09/12 13:13:28 christos Exp $
2664# archive:  file(1) magic for archive formats (see also "msdos" for self-
2665#           extracting compressed archives)
2666#
2667# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
2668# pre-POSIX "tar" archives are also handled in the C code ../../src/is_tar.c.
2669
2670# POSIX tar archives
2671# URL: https://en.wikipedia.org/wiki/Tar_(computing)
2672# Reference: https://www.freebsd.org/cgi/man.cgi?query=tar&sektion=5&manpath=FreeBSD+8-current
2673# header mainly padded with nul bytes
2674500	quad		0
2675!:strength /2
2676# filename or extended attribute printable strings in range space null til umlaut ue
2677>0	ubeshort	>0x1F00
2678>>0	ubeshort	<0xFCFD
2679# last 4 header bytes often null but tar\0 in gtarfail2.tar gtarfail.tar-bad
2680# at https://sourceforge.net/projects/s-tar/files/testscripts/
2681>>>508	ubelong&0x8B9E8DFF	0
2682# nul, space or ascii digit 0-7 at start of mode
2683>>>>100	ubyte&0xC8	=0
2684>>>>>101 ubyte&0xC8	=0
2685# nul, space at end of check sum
2686>>>>>>155 ubyte&0xDF	=0
2687# space or ascii digit 0 at start of check sum
2688>>>>>>>148	ubyte&0xEF	=0x20
2689# FOR DEBUGGING:
2690#>>>>>>>>0	regex		\^[0-9]{2,4}[.](png|jpg|jpeg|tif|tiff|gif|bmp)	NAME "%s"
2691# check for 1st image main name with digits used for sorting
2692# and for name extension case insensitive like: PNG JPG JPEG TIF TIFF GIF BMP
2693>>>>>>>>0	regex		\^[0-9]{2,4}[.](png|jpg|jpeg|tif|tiff|gif|bmp)
2694#foo
2695>>>>>>>>>0	use	tar-cbt
2696# if 1st member name without digits and without used image suffix then it is a TAR archive
2697>>>>>>>>0	default		x
2698>>>>>>>>>0	use	tar-file
2699#	minimal check and then display tar archive information which can also be
2700#	embedded inside others like Android Backup, Clam AntiVirus database
27010	name		tar-file
2702>257	string		!ustar
2703# header padded with nuls
2704>>257	ulong		=0
2705# GNU tar version 1.29 with non pax format option without refusing
2706# creates misleading V7 header for Long path, Multi-volume, Volume type
2707>>>156	ubyte		0x4c		GNU tar archive
2708!:mime	application/x-gtar
2709!:ext	tar/gtar
2710>>>156	ubyte		0x4d		GNU tar archive
2711!:mime	application/x-gtar
2712!:ext	tar/gtar
2713>>>156	ubyte		0x56		GNU tar archive
2714!:mime	application/x-gtar
2715!:ext	tar/gtar
2716>>>156	default		x		tar archive (V7)
2717!:mime	application/x-tar
2718!:ext	tar
2719# other stuff in padding
2720# some implementations add new fields to the blank area at the end of the header record
2721# created for example by DOS TAR 3.20g 1994 Tim V.Shapore with -j option
2722>>257	ulong		!0		tar archive (old)
2723!:mime	application/x-tar
2724!:ext	tar
2725# magic in newer, GNU, posix variants
2726>257	string		=ustar
2727# 2 last char of magic and UStar version because string expression does not work
2728# 2 space characters followed by a null for GNU variant
2729>>261	ubelong		=0x72202000	POSIX tar archive (GNU)
2730!:mime	application/x-gtar
2731!:ext	tar/gtar
2732# UStar version with ASCII "00"
2733>>261	ubelong		0x72003030	POSIX
2734# gLOBAL and ExTENSION type only found in POSIX.1-2001 format
2735>>>156	ubyte		0x67		\b.1-2001
2736>>>156	ubyte		0x78		\b.1-2001
2737>>>156	ubyte		x		tar archive
2738!:mime	application/x-ustar
2739!:ext	tar/ustar
2740# version with 2 binary nuls embedded in Android Backup like com.android.settings.ab
2741>>261	ubelong		0x72000000	tar archive (ustar)
2742!:mime	application/x-ustar
2743!:ext	tar/ustar
2744# not seen ustar variant with garbish version
2745>>261	default		x		tar archive (unknown ustar)
2746!:mime	application/x-ustar
2747!:ext	tar/ustar
2748# type flag of 1st tar archive member
2749#>156	ubyte		x		\b, %c-type
2750>156	ubyte		x
2751>>156	ubyte		0		\b, file
2752>>156	ubyte		0x30		\b, file
2753>>156	ubyte		0x31		\b, hard link
2754>>156	ubyte		0x32		\b, symlink
2755>>156	ubyte		0x33		\b, char device
2756>>156	ubyte		0x34		\b, block device
2757>>156	ubyte		0x35		\b, directory
2758>>156	ubyte		0x36		\b, fifo
2759>>156	ubyte		0x37		\b, reserved
2760>>156	ubyte		0x4c		\b, long path
2761>>156	ubyte		0x4d		\b, multi volume
2762>>156	ubyte		0x56		\b, volume
2763>>156	ubyte		0x67		\b, global
2764>>156	ubyte		0x78		\b, extension
2765>>156	default		x		\b, type
2766>>>156	ubyte		x		'%c'
2767# name[100]
2768>0	string		>\0		%-.60s
2769# mode mainly stored as an octal number in ASCII null or space terminated
2770>100	string		>\0		\b, mode %-.7s
2771# user id mainly as octal numbers in ASCII null or space terminated
2772>108	string		>\0		\b, uid %-.7s
2773# group id mainly as octal numbers in ASCII null or space terminated
2774>116	string		>\0		\b, gid %-.7s
2775# size mainly as octal number in ASCII
2776>124	ubyte		<0x38
2777>>124	string		>\0		\b, size %-.12s
2778# coding indicated by setting the high-order bit of the leftmost byte
2779>124	ubyte		>0xEF		\b, size 0x
2780>>124	ubyte		!0xff		\b%2.2x
2781>>125	ubyte		!0xff		\b%2.2x
2782>>126	ubyte		!0xff		\b%2.2x
2783>>127	ubyte		!0xff		\b%2.2x
2784>>128	ubyte		!0xff		\b%2.2x
2785>>129	ubyte		!0xff		\b%2.2x
2786>>130	ubyte		!0xff		\b%2.2x
2787>>131	ubyte		!0xff		\b%2.2x
2788>>132	ubyte		!0xff		\b%2.2x
2789>>133	ubyte		!0xff		\b%2.2x
2790>>134	ubyte		!0xff		\b%2.2x
2791>>135	ubyte		!0xff		\b%2.2x
2792# seconds since 0:0:0 1 jan 1970 UTC as octal number mainly in ASCII null or space terminated
2793>136	string		>\0		\b, seconds %-.11s
2794# header checksum stored as an octal number in ASCII null or space terminated
2795#>148	string		x		\b, cksum %.7s
2796# linkname[100]
2797>157	string		>\0		\b, linkname %-.40s
2798# additional fields for ustar
2799>257	string		=ustar
2800# owner user name null terminated
2801>>265	string		>\0		\b, user %-.32s
2802# group name null terminated
2803>>297	string		>\0		\b, group %-.32s
2804# device major minor if not zero
2805>>329	ubequad&0xCFCFCFCFcFcFcFdf	!0
2806>>>329	string		x		\b, devmaj %-.7s
2807>>337	ubequad&0xCFCFCFCFcFcFcFdf	!0
2808>>>337	string		x		\b, devmin %-.7s
2809# prefix[155]
2810>>345	string		>\0		\b, prefix %-.155s
2811# old non ustar/POSIX tar
2812>257	string		!ustar
2813>>508	string		=tar\0
2814# padding[255] in old star
2815>>>257	string		>\0		\b, padding: %-.40s
2816>>508	default		x
2817# padding[255] in old tar sometimes comment field
2818>>>257	string		>\0		\b, comment: %-.40s
2819# Summary:	Comic Book Archive *.CBT with TAR format
2820# URL:		https://en.wikipedia.org/wiki/Comic_book_archive
2821#		http://fileformats.archiveteam.org/wiki/Comic_Book_Archive
2822# Note:		there exist also RAR, ZIP, ACE and 7Z packed variants
28230	name		tar-cbt
2824>0	string		x		Comic Book archive, tar archive
2825#!:mime	application/x-tar
2826!:mime	application/vnd.comicbook
2827#!:mime	application/vnd.comicbook+tar
2828!:ext	cbt
2829# name[100] probably like: 19.jpg 0001.png 0002.png
2830# or maybe like ComicInfo.xml
2831>0	string		>\0		\b, 1st image %-.60s
2832
2833# Incremental snapshot gnu-tar format from:
2834# https://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html
28350	string		GNU\ tar-	GNU tar incremental snapshot data
2836>&0	regex		[0-9]\\.[0-9]+-[0-9]+	version %s
2837
2838# cpio archives
2839#
2840# Yes, the top two "cpio archive" formats *are* supposed to just be "short".
2841# The idea is to indicate archives produced on machines with the same
2842# byte order as the machine running "file" with "cpio archive", and
2843# to indicate archives produced on machines with the opposite byte order
2844# from the machine running "file" with "byte-swapped cpio archive".
2845#
2846# The SVR4 "cpio(4)" hints that there are additional formats, but they
2847# are defined as "short"s; I think all the new formats are
2848# character-header formats and thus are strings, not numbers.
28490	short		070707		cpio archive
2850!:mime	application/x-cpio
28510	short		0143561		byte-swapped cpio archive
2852!:mime	application/x-cpio # encoding: swapped
28530	string		070707		ASCII cpio archive (pre-SVR4 or odc)
2854!:mime	application/x-cpio
28550	string		070701		ASCII cpio archive (SVR4 with no CRC)
2856!:mime	application/x-cpio
28570	string		070702		ASCII cpio archive (SVR4 with CRC)
2858!:mime	application/x-cpio
2859
2860#
2861# Various archive formats used by various versions of the "ar"
2862# command.
2863#
2864
2865#
2866# Original UNIX archive formats.
2867# They were written with binary values in host byte order, and
2868# the magic number was a host "int", which might have been 16 bits
2869# or 32 bits.  We don't say "PDP-11" or "VAX", as there might have
2870# been ports to little-endian 16-bit-int or 32-bit-int platforms
2871# (x86?) using some of those formats; if none existed, feel free
2872# to use "PDP-11" for little-endian 16-bit and "VAX" for little-endian
2873# 32-bit.  There might have been big-endian ports of that sort as
2874# well.
2875#
28760	leshort		0177555		very old 16-bit-int little-endian archive
28770	beshort		0177555		very old 16-bit-int big-endian archive
28780	lelong		0177555		very old 32-bit-int little-endian archive
28790	belong		0177555		very old 32-bit-int big-endian archive
2880
28810	leshort		0177545		old 16-bit-int little-endian archive
2882>2	string		__.SYMDEF	random library
28830	beshort		0177545		old 16-bit-int big-endian archive
2884>2	string		__.SYMDEF	random library
28850	lelong		0177545		old 32-bit-int little-endian archive
2886>4	string		__.SYMDEF	random library
28870	belong		0177545		old 32-bit-int big-endian archive
2888>4	string		__.SYMDEF	random library
2889
2890#
2891# From "pdp" (but why a 4-byte quantity?)
2892#
28930	lelong		0x39bed		PDP-11 old archive
28940	lelong		0x39bee		PDP-11 4.0 archive
2895
2896#
2897# XXX - what flavor of APL used this, and was it a variant of
2898# some ar archive format?  It's similar to, but not the same
2899# as, the APL workspace magic numbers in pdp.
2900#
29010	long		0100554		apl workspace
2902
2903#
2904# System V Release 1 portable(?) archive format.
2905#
29060	string		=<ar>		System V Release 1 ar archive
2907!:mime	application/x-archive
2908
2909#
2910# Debian package; it's in the portable archive format, and needs to go
2911# before the entry for regular portable archives, as it's recognized as
2912# a portable archive whose first member has a name beginning with
2913# "debian".
2914#
2915# Update: Joerg Jenderek
2916# URL: https://en.wikipedia.org/wiki/Deb_(file_format)
29170	string		=!<arch>\ndebian
2918# https://manpages.debian.org/testing/dpkg/dpkg-split.1.en.html
2919>14	string		-split	part of multipart Debian package
2920!:mime	application/vnd.debian.binary-package
2921# udeb is used for stripped down deb file
2922!:ext	deb/udeb
2923>14	string		-binary	Debian binary package
2924!:mime	application/vnd.debian.binary-package
2925# For ipk packager see also https://en.wikipedia.org/wiki/Opkg
2926!:ext	deb/udeb/ipk
2927# This should not happen
2928>14	default		x	Unknown Debian package
2929# NL terminated version; for most Debian cases this is 2.0 or 2.1 for split
2930>68	string		>\0		(format %s)
2931#>68	string		!2.0\n
2932#>>68	string		x		(format %.3s)
2933>68	string		=2.0\n
2934# 2nd archive name=control archive name like control.tar.gz or control.tar.xz
2935>>72	string		>\0		\b, with %.14s
2936# look for 3rd archive name=data archive name like data.tar.{gz,xz,bz2,lzma}
2937>>0	search/0x93e4f	data.tar.	\b, data compression
2938# the above line only works if FILE_BYTES_MAX in ../../src/file.h is raised
2939# for example like libreoffice-dev-doc_1%3a5.2.7-1+rpi1+deb9u3_all.deb
2940>>>&0	string		x		%.2s
2941# skip space (0x20 BSD) and slash (0x2f System V) character marking end of name
2942>>>&2	ubyte		!0x20
2943>>>>&-1	ubyte		!0x2f
2944# display 3rd character of file name extension like 2 of bz2 or m of lzma
2945>>>>>&-1	ubyte	x		\b%c
2946>>>>>>&0	ubyte	!0x20
2947>>>>>>>&-1	ubyte	!0x2f
2948# display 4th character of file name extension like a of lzma
2949>>>>>>>>&-1	ubyte	x		\b%c
2950# split debian package case
2951>68	string		=2.1\n
2952# dpkg-1.18.25/dpkg-split/info.c
2953# NL terminated ASCII package name like ckermit
2954>>&0	string		x		\b, %s
2955# NL terminated package version like 302-5.3
2956>>>&1	string		x		%s
2957# NL terminated MD5 checksum
2958>>>>&1	string		x		\b, MD5 %s
2959# NL terminated original package length
2960>>>>>&1	string		x		\b, unsplitted size %s
2961# NL terminated part length
2962>>>>>>&1	string	x		\b, part length %s
2963# NL terminated package part like n/m
2964>>>>>>>&1	string	x		\b, part %s
2965# NL terminated package architecture like armhf since dpkg 1.16.1 or later
2966>>>>>>>>&1	string	x		\b, %s
2967
2968#
2969# MIPS archive; they're in the portable archive format, and need to go
2970# before the entry for regular portable archives, as it's recognized as
2971# a portable archive whose first member has a name beginning with
2972# "__________E".
2973#
29740	string	=!<arch>\n__________E	MIPS archive
2975!:mime	application/x-archive
2976>20	string	U			with MIPS Ucode members
2977>21	string	L			with MIPSEL members
2978>21	string	B			with MIPSEB members
2979>19	string	L			and an EL hash table
2980>19	string	B			and an EB hash table
2981>22	string	X			-- out of date
2982
2983#
2984# BSD/SVR2-and-later portable archive formats.
2985#
2986# Update: Joerg Jenderek
2987# URL:		http://fileformats.archiveteam.org/wiki/AR
2988# Reference:	https://www.unix.com/man-page/opensolaris/3HEAD/ar.h/
2989# Note:		Mach-O universal binary in ./cafebabe is dependent
2990# TODO:		unify current ar archive, MIPS archive, Debian package
2991#		distinguish BSD, SVR; 32, 64 bit; HP from other 32-bit SVR;
2992#		*.ar packages from *.a libraries. handle empty archive
29930	string		=!<arch>\n		current ar archive
2994# print first and possibly second ar_name[16] for debugging purpose
2995#>8			string	x	\b, 1st "%.16s"
2996#>68			string	x	\b, 2nd "%.16s"
2997!:mime	application/x-archive
2998# a in most case for libraries; lib for Microsoft libraries; ar else cases
2999!:ext	a/lib/ar
3000>8	string		__.SYMDEF	random library
3001# first member with long marked name __.SYMDEF SORTED implies BSD library
3002>68	string		__.SYMDEF\ SORTED	random library
3003# Reference: https://parisc.wiki.kernel.org/images-parisc/b/b2/Rad_11_0_32.pdf
3004# "archive file" entry moved from ./hp
3005# LST header system_id 0210h~PA-RISC 1.1,... identifies the target architecture
3006# LST header a_magic 0619h~relocatable library
3007>68	belong 		0x020b0619	- PA-RISC1.0 relocatable library
3008>68	belong	 	0x02100619	- PA-RISC1.1 relocatable library
3009>68	belong 		0x02110619	- PA-RISC1.2 relocatable library
3010>68	belong 		0x02140619	- PA-RISC2.0 relocatable library
3011#EOF for common ar archives
3012
3013#
3014# "Thin" archive, as can be produced by GNU ar.
3015#
30160	string		=!<thin>\n	thin archive with
3017>68	belong		0		no symbol entries
3018>68	belong		1		%d symbol entry
3019>68	belong		>1		%d symbol entries
3020
30210	search/1	-h-		Software Tools format archive text
3022
3023# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
3024#
3025# The first byte is the magic (0x1a), byte 2 is the compression type for
3026# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
3027# filename of the first file (null terminated).  Since some types collide
3028# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),
3029# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%).  0x01 collides with terminfo.
30300	lelong&0x8080ffff	0x0000081a	ARC archive data, dynamic LZW
3031!:mime	application/x-arc
30320	lelong&0x8080ffff	0x0000091a	ARC archive data, squashed
3033!:mime	application/x-arc
30340	lelong&0x8080ffff	0x0000021a	ARC archive data, uncompressed
3035!:mime	application/x-arc
30360	lelong&0x8080ffff	0x0000031a	ARC archive data, packed
3037!:mime	application/x-arc
30380	lelong&0x8080ffff	0x0000041a	ARC archive data, squeezed
3039!:mime	application/x-arc
30400	lelong&0x8080ffff	0x0000061a	ARC archive data, crunched
3041!:mime	application/x-arc
3042# [JW] stuff taken from idarc, obviously ARC successors:
30430	lelong&0x8080ffff	0x00000a1a	PAK archive data
3044!:mime	application/x-arc
30450	lelong&0x8080ffff	0x0000141a	ARC+ archive data
3046!:mime	application/x-arc
30470	lelong&0x8080ffff	0x0000481a	HYP archive data
3048!:mime	application/x-arc
3049
3050# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
3051# I can't create either SPARK or ArcFS archives so I have not tested this stuff
3052# [GRR:  the original entries collide with ARC, above; replaced with combined
3053#  version (not tested)]
3054#0	byte		0x1a		RISC OS archive (spark format)
30550	string		\032archive	RISC OS archive (ArcFS format)
30560       string          Archive\000     RISC OS archive (ArcFS format)
3057
3058# All these were taken from idarc, many could not be verified. Unfortunately,
3059# there were many low-quality sigs, i.e. easy to trigger false positives.
3060# Please notify me of any real-world fishy/ambiguous signatures and I'll try
3061# to get my hands on the actual archiver and see if I find something better. [JW]
3062# probably many can be enhanced by finding some 0-byte or control char near the start
3063
3064# idarc calls this Crush/Uncompressed... *shrug*
30650	string	CRUSH Crush archive data
3066# Squeeze It (.sqz)
30670	string	HLSQZ Squeeze It archive data
3068# SQWEZ
30690	string	SQWEZ SQWEZ archive data
3070# HPack (.hpk)
30710	string	HPAK HPack archive data
3072# HAP
30730	string	\x91\x33HF HAP archive data
3074# MD/MDCD
30750	string	MDmd MDCD archive data
3076# LIM
30770	string	LIM\x1a LIM archive data
3078# SAR
30793	string	LH5 SAR archive data
3080# BSArc/BS2
30810	string	\212\3SB\020\0	BSArc/BS2 archive data
3082# Bethesda Softworks Archive (Oblivion)
30830	string	BSA\0 		BSArc archive data
3084>4	lelong	x		version %d
3085# MAR
30862	string	=-ah MAR archive data
3087# ACB
3088#0	belong&0x00f800ff	0x00800000 ACB archive data
3089# CPZ
3090# TODO, this is what idarc says: 0	string	\0\0\0 CPZ archive data
3091# JRC
30920	string	JRchive JRC archive data
3093# Quantum
30940	string	DS\0 Quantum archive data
3095# ReSOF
30960	string	PK\3\6 ReSOF archive data
3097# QuArk
30980	string	7\4 QuArk archive data
3099# YAC
310014	string	YC YAC archive data
3101# X1
31020	string	X1 X1 archive data
31030	string	XhDr X1 archive data
3104# CDC Codec (.dqt)
31050	belong&0xffffe000	0x76ff2000 CDC Codec archive data
3106# AMGC
31070	string	\xad6" AMGC archive data
3108# NuLIB
31090	string	N\xc3\xb5F\xc3\xa9lx\xc3\xa5 NuLIB archive data
3110# PakLeo
31110	string	LEOLZW PAKLeo archive data
3112# ChArc
31130	string	SChF ChArc archive data
3114# PSA
31150	string	PSA PSA archive data
3116# CrossePAC
31170	string	DSIGDCC CrossePAC archive data
3118# Freeze
31190	string	\x1f\x9f\x4a\x10\x0a Freeze archive data
3120# KBoom
31210	string	\xc2\xa8MP\xc2\xa8 KBoom archive data
3122# NSQ, must go after CDC Codec
31230	string	\x76\xff NSQ archive data
3124# DPA
31250	string	Dirk\ Paehl DPA archive data
3126# BA
3127# TODO: idarc says "bytes 0-2 == bytes 3-5"
3128# TTComp
3129# URL: http://fileformats.archiveteam.org/wiki/TTComp_archive
3130# Update: Joerg Jenderek
3131# GRR: line below is too general as it matches also Panorama database "TCDB 2003-10 demo.pan", others
31320	string	\0\6
3133# look for first keyword of Panorama database *.pan
3134>12	search/261	DESIGN
3135# skip keyword with low entropy
3136>12	default		x
3137# skip DOS 2.0 backup id file, sequence 6 with many nils like BACKUPID_xx6.@@@ handled by ./msdos
3138>>8	quad		!0
3139>>>0	use	ttcomp
3140# variant ASCII, 4K dictionary (strength=48=50-2). With strength=49 wrong order! WHY?
31410	string	\1\6
3142# TODO:
3143# skip VAX-order 68k Blit mpx/mux executable (strength=50) handled by ./blit
3144!:strength	-2
3145>0	use	ttcomp
31460	string	\0\5
3147# skip some DOS 2.0 backup id file, sequence 5 with many nils like BACKUPID_075.@@@ handled by ./msdos
3148>8	quad	!0
3149>>0	use	ttcomp
31500	string	\1\5
3151# TODO:
3152# variant ASCII, 2K dictionary (strength=48=50-2). With strength=49 wrong order! WHY?
3153# skip ctab data (strength=50) handled by ./ibm6000
3154# skip locale data table (strength=50) handled by ./digital
3155!:strength	-2
3156>0	use	ttcomp
31570	string	\0\4
3158# skip many Maple help database *.hdb with version tag handled by ./maple
3159>1028	string	!version
3160# skip veclib maple.hdb by looking for Mable keyword
3161>>4	search/1091	Maple\040
3162#>4	search/34090	Maple\040
3163>>4	default		x
3164# skip DOS 2.0-3.2 backed up sequence 4 with many nils like LOTUS5.RAR handled by ./msdos
3165# skip xBASE Compound Index file *.CDX with many nils
3166>>>0x54	quad		!0
3167>>>>0	use	ttcomp
31680	string	\1\4
3169# TODO:
3170# skip Commodore PET BASIC 4.0 program *.prg
3171# variant ASCII, 1K dictionary (strength=48=50-2). With strength=49 wrong order! WHY?
3172# skip shared library (strength=50) handled by ./ibm6000
3173!:strength	-2
3174>0	use	ttcomp
3175#	display information of TTComp archive
31760	name	ttcomp
3177# (version 5.25) labeled the entry as "TTComp archive data"
3178>0	ubyte	x	TTComp archive data
3179!:mime	application/x-compress-ttcomp
3180# PBACKSCR.PI1
3181!:ext	$xe/$ts/pi1/__d
3182# compression type: 0~binary compression 1~ASCII compression
3183>0	ubyte	0	\b, binary
3184>0	ubyte	1	\b, ASCII
3185# size of the dictionary:  4~1024 bytes 5~2048 bytes 6~4096 bytes
3186>1	ubyte	4	\b, 1K
3187>1	ubyte	5	\b, 2K
3188>1	ubyte	6	\b, 4K
3189>1	ubyte	x	dictionary
3190#	https://mark0.net/forum/index.php?topic=848
3191# last 3 bytes probably have only 8 possible bit sequences
3192# xxxxxxxx 0000000x 11111111	____FFh
3193# xxxxxxxx 10000000 01111111	__807Fh
3194# 0xxxxxxx 11000000 00111111	__C03Fh
3195# 00xxxxxx 11100000 00011111	__E01Fh
3196# 000xxxxx 11110000 00001111	__F00Fh
3197# 0000xxxx 11111000 00000111	__F807h
3198# 00000xxx 11111100 00000011	__FC03h
3199# 000000xx 11111110 00000001	__FE01h
3200# but for quickgif.__d 0A7DD4h
3201#>-3	ubyte		x	\b, last 3 bytes 0x%2.2x
3202#>-2	ubeshort	x	\b%4.4x
3203# From:		Joerg Jenderek
3204# URL:		https://en.wikipedia.org/wiki/Disk_Copy
3205# reference:	http://nulib.com/library/FTN.e00005.htm
32060x52	ubeshort	0x0100
3207# test for disk image size equal or above 400k
3208>0x40	ubelong		>409599
3209# test also for disk image size equal or below 1440k to skip
3210# windows7en.mbr UNICODE.DAT
3211#>>0x40	ubelong		<1474561
3212# test now for "low" disk image size equal or below 64 MiB to skip
3213# windows7en.mbr (B441BBAAh) UNICODE.DAT (0400AF05h)
3214>>0x40	ubelong		<0x04000001
3215# To skip Flags$StringJoiner.class with size 00106A61h test also for valid disk image sizes
3216# 00064000 for  400k GCR disks	dc42-400k-gcr.trid.xml
3217# 000c8000 for  800k GCR disks	dc42-800k-gcr.trid.xml
3218# 000b4000 for  720k MFM disks	dc42-720k-mfm.trid.xml
3219# 00168000 for 1440k MFM disks	dc42-1440k-mfm.trid.xml
3220#	https://lisaem.sunder.net/LisaProjectDocs.txt
3221# 00500000	05M	available
3222# 00A00000	10M	available
3223# 01800000	24M	possible
3224# 02000000	32M	uncertain
3225# 04000000	64M	uncertain
3226>>>0x40	ubelong&0xf8003fFF	0
3227# skip samples with invalid disk name length like:
3228# 181 (biosmd80.rom) 202 (Flags$StringJoiner.class) 90 (UNICODE.DAT)
3229>>>>0x0	ubyte			<64
3230>>>>>0	use			dc42-floppy
3231#	display information of Apple DiskCopy 4.2 floppy image
32320	name		dc42-floppy
3233# disk name length; maximal 63
3234#>0	ubyte	    	x	DISK NAME LENGTH %u
3235# ASCII image pascal (maximal 63 bytes) name padded with NULs like:
3236# "Microsoft Mail" "Disquette 2" "IIe Installer Disk"
3237# "-lisaem.sunder.net hd-" (dc42-lisaem.trid.xml) "-not a Macintosh disk" (dc42-nonmac.trid.xml)
3238>00	pstring/B	x	Apple DiskCopy 4.2 image %s
3239#!:mime	application/octet-stream
3240!:mime	application/x-dc42-floppy-image
3241!:apple	dCpydImg
3242# probably also img like: "Utilitaires 2.img" "Installation 7.img"
3243!:ext	image/dc42/img
3244# data size in bytes like: 409600 737280 819200 1474560
3245>0x40	ubelong		x	\b, %u bytes
3246# for debugging purpose size in hexadecimal
3247#>0x40	ubelong		x	(%#8.8x)
3248# tag size in bytes like: 0 (often) 2580h (PUID fmt/625) 4B00h (Microsoft Mail.image)
3249>0x44	ubelong		>0	\b, %#x tag size
3250# data checksum
3251#>0x48	ubelong		x	\b, %#x checksum
3252# tag checksum
3253#>0x4c	ubelong		x	\b, %#x tag checksum
3254# disk encoding like: 0 1 2 3 (PUID: fmt/625)
3255>0x50	ubyte		0	\b, GCR CLV ssdd (400k)
3256>0x50	ubyte		1	\b, GCR CLV dsdd (800k)
3257>0x50	ubyte		2	\b, MFM CAV dsdd (720k)
3258>0x50	ubyte		3	\b, MFM CAV dshd (1440k)
3259>0x50	ubyte		>3	\b, %#x encoding
3260# format byte like: 12h (Lisa 400K) 24h (400K Macintosh) 96h (800K Apple II disk)
3261# 2 (Mac 400k "Disquette Installation 13.image")
3262# 22h (double-sided MFM or Mac 800k "Disco 12.image" "IIe Installer Disk.image")
3263>0x51	ubyte		x	\b, %#x format
3264#>0x54	ubequad		x	\b, data %#16.16llx
3265# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation?
32660	string	ESP ESP archive data
3267# ZPack
32680	string	\1ZPK\1 ZPack archive data
3269# Sky
32700	string	\xbc\x40 Sky archive data
3271# UFA
32720	string	UFA UFA archive data
3273# Dry
32740	string	=-H2O DRY archive data
3275# FoxSQZ
32760	string	FOXSQZ FoxSQZ archive data
3277# AR7
32780	string	,AR7 AR7 archive data
3279# PPMZ
32800	string	PPMZ PPMZ archive data
3281# MS Compress
3282# Update: Joerg Jenderek
3283# URL: http://fileformats.archiveteam.org/wiki/MS-DOS_installation_compression
3284# Reference: https://hwiegman.home.xs4all.nl/fileformats/compress/szdd_kwaj_format.html
3285# Note: use correct version of extracting tool like EXPAND, UNPACK, DECOMP or 7Z
32864	string	\x88\xf0\x27
3287#		KWAJ variant
3288>0	string	KWAJ		MS Compress archive data, KWAJ variant
3289!:mime	application/x-ms-compress-kwaj
3290# extension not working in version 5.32
3291# magic/Magdir/archive, 284: Warning: EXTENSION type ` ??_' has bad char '?'
3292# file: line 284: Bad magic entry '   ??_'
3293!:ext	??_
3294# compression method (0-4)
3295>>8	uleshort	x	\b, %u method
3296# offset of compressed data
3297>>10	uleshort	x	\b, %#x offset
3298#>>(10.s)	uleshort	x
3299#>>>&-6		string	x	\b, TEST extension %-.3s
3300# header flags to mark header extensions
3301>>12	uleshort	>0	\b, %#x flags
3302# 4 bytes: decompressed length of file
3303>>12	uleshort	&0x01
3304>>>14	ulelong		x	\b, original size: %u bytes
3305# 2 bytes: unknown purpose
3306# 2 bytes: length of unknown data + mentioned bytes
3307# 1-9 bytes: null-terminated file name
3308# 1-4 bytes: null-terminated file extension
3309>>12	uleshort	&0x08
3310>>>12	uleshort				^0x01
3311>>>>12		uleshort			^0x02
3312>>>>>12			uleshort		^0x04
3313>>>>>>12			uleshort	^0x10
3314>>>>>>>14				string	x	\b, %-.8s
3315>>>>>>12			uleshort	&0x10
3316>>>>>>>14				string	x	\b, %-.8s
3317>>>>>>>>&1				string	x	\b.%-.3s
3318>>>>>12			uleshort		&0x04
3319>>>>>>12			uleshort	^0x10
3320>>>>>>>(14.s)			uleshort	x
3321>>>>>>>>&14				string	x	\b, %-.8s
3322>>>>>>12			uleshort	&0x10
3323>>>>>>>(14.s)			uleshort	x
3324>>>>>>>>&14				string	x	\b, %-.8s
3325>>>>>>>>>&1				string	x	\b.%-.3s
3326>>>>12		uleshort			&0x02
3327>>>>>12			uleshort		^0x04
3328>>>>>>12			uleshort	^0x10
3329>>>>>>>16				string	x	\b, %-.8s
3330>>>>>>12			uleshort	&0x10
3331>>>>>>>16				string	x	\b, %-.8s
3332>>>>>>>>&1				string	x	\b.%-.3s
3333>>>>>12			uleshort		&0x04
3334>>>>>>12			uleshort	^0x10
3335>>>>>>>(16.s)			uleshort	x
3336>>>>>>>>&16				string	x	\b, %-.8s
3337>>>>>>12			uleshort	&0x10
3338>>>>>>>(16.s)			uleshort	x
3339>>>>>>>&16				string	x	%-.8s
3340>>>>>>>>&1				string	x	\b.%-.3s
3341>>>12	uleshort				&0x01
3342>>>>12		uleshort			^0x02
3343>>>>>12			uleshort		^0x04
3344>>>>>>12			uleshort	^0x10
3345>>>>>>>18				string	x	\b, %-.8s
3346>>>>>>12			uleshort	&0x10
3347>>>>>>>18				string	x	\b, %-.8s
3348>>>>>>>>&1				string	x	\b.%-.3s
3349>>>>>12			uleshort		&0x04
3350>>>>>>12			uleshort	^0x10
3351>>>>>>>(18.s)			uleshort	x
3352>>>>>>>>&18				string	x	\b, %-.8s
3353>>>>>>12			uleshort	&0x10
3354>>>>>>>(18.s)			uleshort	x
3355>>>>>>>>&18				string	x	\b, %-.8s
3356>>>>>>>>>&1				string	x	\b.%-.3s
3357>>>>12		uleshort			&0x02
3358>>>>>12			uleshort		^0x04
3359>>>>>>12			uleshort	^0x10
3360>>>>>>>20				string	x	\b, %-.8s
3361>>>>>>12			uleshort	&0x10
3362>>>>>>>20				string	x	\b, %-.8s
3363>>>>>>>>&1				string	x	\b.%-.3s
3364>>>>>12			uleshort		&0x04
3365>>>>>>12			uleshort	^0x10
3366>>>>>>>(20.s)			uleshort	x
3367>>>>>>>>&20				string	x	\b, %-.8s
3368>>>>>>12			uleshort	&0x10
3369>>>>>>>(20.s)			uleshort	x
3370>>>>>>>>&20				string	x	\b, %-.8s
3371>>>>>>>>>&1				string	x	\b.%-.3s
3372# 2 bytes: length of data + mentioned bytes
3373#
3374#		SZDD variant Haruhiko Okumura's LZSS or 7z type MsLZ
3375# URL:		http://fileformats.archiveteam.org/wiki/MS-DOS_installation_compression
3376# Reference:	http://www.cabextract.org.uk/libmspack/doc/szdd_kwaj_format.html
3377#		http://mark0.net/download/triddefs_xml.7z/defs/s/szdd.trid.xml
3378# Note:		called "Microsoft SZDD compressed (Haruhiko Okumura's LZSS)" by TrID
3379#		verfied by 7-Zip `7z l -tMsLZ -slt *.??_` as MsLZ
3380#		`deark -l -m lzss_oku -d2 setup-1-41.bin` as "LZSS.C by Haruhiko Okumura"
3381>0	string	SZDD		MS Compress archive data, SZDD variant
3382# 2nd part of signature
3383#>>4	ubelong	0x88F02733	\b, SIGNATURE OK
3384!:mime	application/x-ms-compress-szdd
3385!:ext	??_
3386# The character missing from the end of the filename (0=unknown)
3387>>9	string	>\0		\b, %-.1s is last character of original name
3388# https://www.betaarchive.com/forum/viewtopic.php?t=26161
3389# Compression mode: "A" (0x41) found but sometimes "B" in Windows 3.1 builds 026 and 034e
3390>>8	string	!A		\b, %-.1s method
3391>>10	ulelong	>0		\b, original size: %u bytes
3392# Summary:	InstallShield archive with SZDD compressed
3393# URL:		https://community.flexera.com/t5/InstallShield-Knowledge-Base/InstallShield-Redistributable-Files/ta-p/5647
3394# From:		Joerg Jenderek
33951	search/48/bs	SZDD\x88\xF0\x27\x33	InstallShield archive
3396#!:mime	application/octet-stream
3397!:mime	application/x-installshield-compress-szdd
3398!:ext	ibt
3399# name of compressed archive member like: setup.dl_ _setup7int.dl_ _setup2k.dl_ _igdi.dl_ cabinet.dl_
3400>0	string	x		%s
3401# name of uncompressed archive member like: setup.dll _Setup.dll IGdi.dll CABINET.DLL
3402>>&1	string	x		(%s)
3403# probably version like: 9.0.0.333 9.1.0.429 11.50.0.42618
3404>>>&1	string	x		\b, version %s
3405# SZDD member length like: 168048 169333 181842
3406>>>>&1	string	x		\b, %s bytes
3407# MS Compress archive data
3408#>&0	string		SZDD	\b, SIGNATURE FOUND
3409>&0	indirect	x
3410#		QBasic SZDD variant
34113	string	\x88\xf0\x27
3412>0	string	SZ\x20		MS Compress archive data, QBasic variant
3413!:mime	application/x-ms-compress-sz
3414!:ext	??$
3415>>8	ulelong	>0		\b, original size: %u bytes
3416
3417# Summary:	CAZIP compressed file
3418# From:		Joerg Jenderek
3419# URL:		http://fileformats.archiveteam.org/wiki/CAZIP
3420# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/c/caz.trid.xml
3421# Note:		Format is distinct from CAZIPXP compressed
34220	string	\x0D\x0A\x1ACAZIP	CAZIP compressed file
3423#!:mime	application/octet-stream
3424!:mime	application/x-compress-cazip
3425# like: BLINKER.WR_ CLIPDEFS._ CAOSETUP.EX_ CLIPPER.EX_ FILEIO.C_
3426!:ext	??_/?_/_
3427
3428# Summary:	FTCOMP compressed archive
3429# From:		Joerg Jenderek
3430# URL:		http://fileformats.archiveteam.org/wiki/FTCOMP
3431# Reference:    http://mark0.net/download/triddefs_xml.7z/defs/a/ark-ftcomp.trid.xml
3432# Note:		called by TrID "FTCOMP compressed archive"
3433#		extracted by `unpack seahelp.hl_`
343424	string/b	FTCOMP		FTCOMP compressed archive
3435#!:mime	application/octet-stream
3436!:mime	application/x-compress-ftcomp
3437!:ext	??_/??@/dll/drv/pk2/
3438# probably A596FDFF magic at the beginning
3439>0	ubelong		!0xA596FDFF	\b, at beginning %#x
3440# probably original file name with directory like: \OS2\unpack.exe \SYSTEM\8514.DRV MAHJONGG.EXE
3441>41	string		x		"%s"
3442
3443# MP3 (archiver, not lossy audio compression)
34440	string	MP3\x1a MP3-Archiver archive data
3445# ZET
34460	string	OZ\xc3\x9d ZET archive data
3447# TSComp
34480	string	\x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data
3449# ARQ
34500	string	gW\4\1 ARQ archive data
3451# Squash
34523	string	OctSqu Squash archive data
3453# Terse
34540	string	\5\1\1\0 Terse archive data
3455# PUCrunch
34560	string	\x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data
3457# UHarc
34580	string	UHA UHarc archive data
3459# ABComp
34600	string	\2AB ABComp archive data
34610	string	\3AB2 ABComp archive data
3462# CMP
34630	string	CO\0 CMP archive data
3464# Splint
34650	string	\x93\xb9\x06 Splint archive data
3466# InstallShield
34670	string	\x13\x5d\x65\x8c InstallShield Z archive Data
3468# Gather
34691	string	GTH Gather archive data
3470# BOA
34710	string	BOA BOA archive data
3472# RAX
34730	string	ULEB\xa RAX archive data
3474# Xtreme
34750	string	ULEB\0 Xtreme archive data
3476# Pack Magic
34770	string	@\xc3\xa2\1\0 Pack Magic archive data
3478# BTS
34790	belong&0xfeffffff	0x1a034465 BTS archive data
3480# ELI 5750
34810	string	Ora\  ELI 5750 archive data
3482# QFC
34830	string	\x1aFC\x1a QFC archive data
34840	string	\x1aQF\x1a QFC archive data
3485# PRO-PACK
34860	string	RNC PRO-PACK archive data
3487# 777
34880	string	777 777 archive data
3489# LZS221
34900	string	sTaC LZS221 archive data
3491# HPA
34920	string	HPA HPA archive data
3493# Arhangel
34940	string	LG Arhangel archive data
3495# EXP1, uses bzip2
34960	string	0123456789012345BZh EXP1 archive data
3497# IMP
34980	string	IMP\xa IMP archive data
3499# NRV
35000	string	\x00\x9E\x6E\x72\x76\xFF NRV archive data
3501# Squish
35020	string	\x73\xb2\x90\xf4 Squish archive data
3503# Par
35040	string	PHILIPP Par archive data
35050	string	PAR Par archive data
3506# HIT
35070	string	UB HIT archive data
3508# SBX
35090	belong&0xfffff000	0x53423000 SBX archive data
3510# NaShrink
35110	string	NSK NaShrink archive data
3512# SAPCAR
35130	string	#\ CAR\ archive\ header SAPCAR archive data
35140	string	CAR\ 2.00 SAPCAR archive data
35150	string	CAR\ 2.01 SAPCAR archive data
3516#!:mime	application/octet-stream
3517!:mime	application/vnd.sar
3518!:ext	sar
3519# Disintegrator
35200	string	DST Disintegrator archive data
3521# ASD
35220	string	ASD ASD archive data
3523# InstallShield CAB
3524# Update:	Joerg Jenderek at Nov 2021
3525# URL:		https://en.wikipedia.org/wiki/InstallShield
3526# Reference:	https://github.com/twogood/unshield/blob/master/lib/cabfile.h
3527# Note:		Not compatible with Microsoft CAB files
3528# http://mark0.net/download/triddefs_xml.7z/defs/a/ark-cab-ishield.trid.xml
3529# CAB_SIGNATURE 0x28635349
35300	string	ISc( InstallShield
3531#!:mime		application/octet-stream
3532!:mime		application/x-installshield
3533# http://mark0.net/download/triddefs_xml.7z/defs/a/ark-cab-ishield-hdr.trid.xml
3534>16	ulelong	!0	setup header
3535# like: _SYS1.HDR _USER1.HDR data1.hdr
3536!:ext	hdr
3537>16	ulelong	=0	CAB
3538# like: _SYS1.CAB _USER1.CAB DATA1.CAB  data2.cab
3539!:ext	cab
3540# https://github.com/twogood/unshield/blob/master/lib/helper.c
3541# version like:	0x1005201 0x100600c 0x1007000 0x1009500
3542#		0x2000578 0x20005dc 0x2000640 0x40007d0 0x4000834
3543>4	ulelong	x	\b, version %#x
3544# volume_info like: 0
3545>8	ulelong	!0	\b, volume_info %#x
3546# cab_descriptor_offset like: 0x200
3547>12	ulelong	!0x200	\b, offset %#x
3548#>0x200	ubequad	x	\b, at 0x200 %#16.16llx
3549# cab_descriptor_size like: 0 (*.cab) BD5 C8B DA5 E2A E36 116C 251D 4DA9 56F0 5CC2 6E4B 777D 779E 1F7C2
3550>16	ulelong	!0	\b, descriptor size %#x
3551# TOP4
35520	string	T4\x1a TOP4 archive data
3553# BatComp left out: sig looks like COM executable
3554# so TODO: get real 4dos batcomp file and find sig
3555# BlakHole
35560	string	BH\5\7 BlakHole archive data
3557# BIX
35580	string	BIX0 BIX archive data
3559# ChiefLZA
35600	string	ChfLZ ChiefLZA archive data
3561# Blink
35620	string	Blink Blink archive data
3563# Logitech Compress
35640	string	\xda\xfa Logitech Compress archive data
3565# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE)
35661	string	(C)\ STEPANYUK ARS-Sfx archive data
3567# AKT/AKT32
35680	string	AKT32 AKT32 archive data
35690	string	AKT AKT archive data
3570# NPack
35710	string	MSTSM NPack archive data
3572# PFT
35730	string	\0\x50\0\x14 PFT archive data
3574# SemOne
35750	string	SEM SemOne archive data
3576# PPMD
35770	string	\x8f\xaf\xac\x84 PPMD archive data
3578# FIZ
35790	string	FIZ FIZ archive data
3580# MSXiE
35810	belong&0xfffff0f0	0x4d530000 MSXiE archive data
3582# DeepFreezer
35830	belong&0xfffffff0	0x797a3030 DeepFreezer archive data
3584# DC
35850	string	=<DC- DC archive data
3586# TPac
35870	string	\4TPAC\3 TPac archive data
3588# Ai
35890	string	Ai\1\1\0 Ai archive data
35900	string	Ai\1\0\0 Ai archive data
3591# Ai32
35920	string	Ai\2\0 Ai32 archive data
35930	string	Ai\2\1 Ai32 archive data
3594# SBC
35950	string	SBC SBC archive data
3596# Ybs
35970	string	YBS Ybs archive data
3598# DitPack
35990	string	\x9e\0\0 DitPack archive data
3600# DMS
36010	string	DMS! DMS archive data
3602# EPC
36030	string	\x8f\xaf\xac\x8c EPC archive data
3604# VSARC
36050	string	VS\x1a VSARC archive data
3606# PDZ
36070	string	PDZ PDZ archive data
3608# ReDuq
36090	string	rdqx ReDuq archive data
3610# GCA
36110	string	GCAX GCA archive data
3612# PPMN
36130	string	pN PPMN archive data
3614# WinImage
36153	string	WINIMAGE WinImage archive data
3616# Compressia
36170	string	CMP0CMP Compressia archive data
3618# UHBC
36190	string	UHB UHBC archive data
3620# WinHKI
36210	string	\x61\x5C\x04\x05 WinHKI archive data
3622# WWPack data file
36230	string	WWP WWPack archive data
3624# BSN (BSA, PTS-DOS)
36250	string	\xffBSG BSN archive data
36261	string	\xffBSG BSN archive data
36273	string	\xffBSG BSN archive data
36281	string	\0\xae\2 BSN archive data
36291	string	\0\xae\3 BSN archive data
36301	string	\0\xae\7 BSN archive data
3631# AIN
36320	string	\x33\x18 AIN archive data
36330	string	\x33\x17 AIN archive data
3634# XPA32 test moved and merged with XPA by Joerg Jenderek at Sep 2015
3635# SZip (TODO: doesn't catch all versions)
36360	string	SZ\x0a\4 SZip archive data
3637# XPack DiskImage
3638# *.XDI updated by Joerg Jenderek Sep 2015
3639# ftp://ftp.sac.sk/pub/sac/pack/0index.txt
3640# GRR: this test is still too general as it catches also text files starting with jm
36410	string	jm
3642# only found examples with this additional characteristic 2 bytes
3643>2	string	\x2\x4	Xpack DiskImage archive data
3644#!:ext xdi
3645# XPack Data
3646# *.xpa updated by Joerg Jenderek Sep 2015
3647# ftp://ftp.elf.stuba.sk/pub/pc/pack/
36480	string	xpa	XPA
3649!:ext	xpa
3650# XPA32
3651# ftp://ftp.elf.stuba.sk/pub/pc/pack/xpa32.zip
3652# created by XPA32.EXE version 1.0.2 for Windows
3653>0	string	xpa\0\1 \b32 archive data
3654# created by XPACK.COM version 1.67m or 1.67r with short 0x1800
3655>3	ubeshort	!0x0001	\bck archive data
3656# XPack Single Data
3657# changed by Joerg Jenderek Sep 2015 back to like in version 5.12
3658# letter 'I'+ acute accent is equivalent to \xcd
36590	string	\xcd\ jm	Xpack single archive data
3660#!:mime	application/x-xpa-compressed
3661!:ext xpa
3662
3663# TODO: missing due to unknown magic/magic at end of file:
3664#DWC
3665#ARG
3666#ZAR
3667#PC/3270
3668#InstallIt
3669#RKive
3670#RK
3671#XPack Diskimage
3672
3673# These were inspired by idarc, but actually verified
3674# Dzip archiver (.dz)
3675# Update: Joerg Jenderek
3676# URL: http://speeddemosarchive.com/dzip/
3677# reference: http://speeddemosarchive.com/dzip/dz29src.zip/main.c
3678# GRR: line below is too general as it matches also ASCII texts like Doszip commander help dz.txt
36790	string	DZ
3680# latest version is 2.9 dated 7 may 2003
3681>2	byte	<4 Dzip archive data
3682!:mime	application/x-dzip
3683!:ext	dz
3684>>2	byte	x \b, version %i
3685>>3	byte	x \b.%i
3686>>4	ulelong	x \b, offset %#x
3687>>8	ulelong	x \b, %u files
3688# ZZip archiver (.zz)
36890	string	ZZ\ \0\0 ZZip archive data
36900	string	ZZ0 ZZip archive data
3691# PAQ archiver (.paq)
36920	string	\xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data
36930	string	PAQ PAQ archive data
3694>3	byte&0xf0	0x30
3695>>3	byte	x (v%c)
3696# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP)
3697# Update:	Joerg Jenderek
3698# URL:		http://fileformats.archiveteam.org/wiki/JAR_(ARJ_Software)
3699# reference:	http://mark0.net/download/triddefs_xml.7z/defs/a/ark-jar.trid.xml
3700#		https://www.sac.sk/download/pack/jar102x.exe/TECHNOTE.DOC
3701# Note:		called "JAR compressed archive" by TrID
37020xe	string	\x1aJar\x1b JAR (ARJ Software, Inc.) archive data
3703#!:mime	application/octet-stream
3704!:mime	application/x-compress-j
3705>0	ulelong	x		\b, CRC32 %#x
3706# standard suffix is ".j"; for multi volumes following order j01 j02 ... j99 100 ... 990
3707!:ext	j/j01/j02
3708# URL:		http://fileformats.archiveteam.org/wiki/JARCS
3709# reference:	http://mark0.net/download/triddefs_xml.7z/defs/a/ark-jarcs.trid.xml
3710# Note:		called "JARCS compressed archive" by TrID
37110	string	JARCS JAR (ARJ Software, Inc.) archive data
3712#!:mime	application/octet-stream
3713!:mime	application/x-compress-jar
3714!:ext	jar
3715
3716# ARJ archiver (jason@jarthur.Claremont.EDU)
3717# URL:		http://fileformats.archiveteam.org/wiki/ARJ
3718# reference:	http://mark0.net/download/triddefs_xml.7z/defs/a/ark-arj.trid.xml
3719#		https://github.com/FarGroup/FarManager/
3720#		blob/master/plugins/multiarc/arc.doc/arj.txt
3721# Note:		called "ARJ compressed archive" by TrID and
3722#		"ARJ File Format" by DROID via PUID fmt/610
3723#		verified by `7z l -tarj PHRACK1.ARJ` and
3724#		`arj.exe l TEST-hk9.ARJ`
37250	leshort		0xea60
3726# skip DROID fmt-610-signature-id-946.arj by check for valid file type of main header
3727>0xA	ubyte		2
3728>>0	use		arj-archive
37290	name		arj-archive
3730>0	leshort		x		ARJ archive
3731!:mime	application/x-arj
3732# look for terminating 0-character of filename
3733>0x26	search/1024	\0
3734# file name extension is normally .arj but not for parts of multi volume
3735#>>&-5	string		x		extension %.4s
3736>>&-5	string/c	.arj		data
3737!:ext	arj
3738>>&-5	default		x
3739# for multi volume first name is archive.arj then following parts archive.a01 archive.a02 ...
3740>>>8	byte		&0x04		data
3741!:ext	a01/a02
3742# for SFX first name is archive.exe then following parts archive.e01 archive.e02 ...
3743>>>8	byte		^0x04		data, SFX multi-volume
3744!:ext	e01/e02
3745# basic header size like: 0x002b 0x002c 0x04e0 0x04e3 0x04e7
3746#>2	uleshort	x		basic header size %#4.4x
3747# next fragment content like: 0x0a200a003a8fc713 0x524a000010bb3471 0x524a0000c73c70f9
3748#>(2.s)	ubequad		x		NEXT FRAGMENT CONTENT %#16.16llx
3749# first_hdr_size; seems to be same as basic header size
3750#>2	uleshort	x		1st header size %#x
3751# archiver version number like: 3 4 6 11 102
3752>5	byte		x		\b, v%d
3753# minimum archiver version to extract like: 1
3754>6	ubyte		!1		\b, minimum %u to extract
3755# FOR DEBUGGING
3756#>8	byte		x		\b, FLAGS %#x
3757# GARBLED_FLAG1; garble with password; g switch
3758>8	byte		&0x01		\b, password-protected
3759# encryption version: 0~old  1~old 2~new 3~reserved 4~40 bit key GOST
3760>>0x20	ubyte		x		(v%u)
3761#>8	byte		&0x02		\b, secured
3762# ANSIPAGE_FLAG; indicates ANSI codepage used by ARJ32; hy switch
3763>8	byte		&0x02		\b, ANSI codepage
3764# VOLUME_FLAG indicates presence of succeeding volume; but apparently not for SFX
3765>8	byte		&0x04		\b, multi-volume
3766#>8	byte		&0x08		\b, file-offset
3767# ARJPROT_FLAG; build with data protection record; hk switch
3768>8	byte		&0x08		\b, recoverable
3769# arj protection factor; maximal 10; switch hky -> factor=y+1
3770>>0x22	byte		x		(factor %u)
3771>8	byte		&0x10		\b, slash-switched
3772# BACKUP_FLAG; obsolete
3773>8	byte		&0x20		\b, backup
3774# SECURED_FLAG;
3775>8	byte		&0x40		\b, secured,
3776# ALTNAME_FLAG; indicates dual-name archive
3777>8	byte		&0x80		\b, dual-name
3778# security version; 0~old 2~current
3779>9	ubyte		!0
3780>>9	ubyte		!2		\b, security version %u
3781# file type; 2 in main header; 0~binary 1~7-bitText 2~comment 3~directory 4~VolumeLabel 5=ChapterLabel
3782>0xA	ubyte		!2		\b, file type %u
3783# date+time when original archive was created in MS-DOS format via ./msdos
3784>0xC	ulelong		x		\b, created
3785>0xC	use		dos-date
3786# or date and time by new internal function
3787#>0xE	lemsdosdate	x		%s
3788#>0xC	lemsdostime	x		%s
3789# FOR DEBUGGING
3790#>0x12	uleshort	x		RAW DATE %#4.4x
3791#>0x10	uleshort	x		RAW TIME %#4.4x
3792# date+time when archive was last modified; sometimes nil or
3793# maybe wrong like in HP4DRVR.ARJ
3794#>0x10	ulelong		>0		\b, modified
3795#>>0x10	use		dos-date
3796# or date and time by new internal function
3797#>>0x12	lemsdosdate	x		%s
3798#>>0x10	lemsdostime	x		%s
3799# archive size (currently used only for secured archives); MAYBE?
3800#>0x14	ulelong		!0		\b, file size %u
3801# security envelope file position; MAYBE?
3802#>0x18	ulelong		!0		\b, at %#x security envelope
3803# filespec position in filename; WHAT IS THAT?
3804#>0x1C	uleshort	>0		\b, filespec position %#x
3805# length in bytes of security envelope data like: 2CAh 301h 364h 471h
3806>0x1E	uleshort	!0		\b, security envelope length %#x
3807# last chapter like: 0 1
3808>0x21	ubyte		!0		\b, last chapter %u
3809# filename (null-terminated string); sometimes at 0x26 when 4 bytes for extra data
3810>34	byte		x		\b, original name:
3811# with extras data
3812>34	byte		<0x0B
3813>>38	string		x		%s
3814# without extras data
3815>34	byte		>0x0A
3816>>34	string		x		%s
3817# host OS: 0~MSDOS ... 11~WIN32
3818>7	byte		0		\b, os: MS-DOS
3819>7	byte		1		\b, os: PRIMOS
3820>7	byte		2		\b, os: Unix
3821>7	byte		3		\b, os: Amiga
3822>7	byte		4		\b, os: Macintosh
3823>7	byte		5		\b, os: OS/2
3824>7	byte		6		\b, os: Apple ][ GS
3825>7	byte		7		\b, os: Atari ST
3826>7	byte		8		\b, os: NeXT
3827>7	byte		9		\b, os: VAX/VMS
3828>7	byte		10		\b, os: WIN95
3829>7	byte		11		\b, os: WIN32
3830# [JW] idarc says this is also possible
38312	leshort		0xea60		ARJ archive data
3832#2	leshort		0xea60
3833#>2	use		arj-archive
3834
3835# HA archiver (Greg Roelofs, newt@uchicago.edu)
3836# This is a really bad format. A file containing HAWAII will match this...
3837#0	string		HA		HA archive data,
3838#>2	leshort		=1		1 file,
3839#>2	leshort		>1		%hu files,
3840#>4	byte&0x0f	=0		first is type CPY
3841#>4	byte&0x0f	=1		first is type ASC
3842#>4	byte&0x0f	=2		first is type HSC
3843#>4	byte&0x0f	=0x0e		first is type DIR
3844#>4	byte&0x0f	=0x0f		first is type SPECIAL
3845# suggestion: at least identify small archives (<1024 files)
38460  belong&0xffff00fc 0x48410000 HA archive data
3847>2	leshort		=1		1 file,
3848>2	leshort		>1		%u files,
3849>4	byte&0x0f	=0		first is type CPY
3850>4	byte&0x0f	=1		first is type ASC
3851>4	byte&0x0f	=2		first is type HSC
3852>4	byte&0x0f	=0x0e		first is type DIR
3853>4	byte&0x0f	=0x0f		first is type SPECIAL
3854
3855# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
38560	string		HPAK		HPACK archive data
3857
3858# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net
38590	string		\351,\001JAM\ 		JAM archive,
3860>7	string		>\0			version %.4s
3861>0x26	byte		=0x27			-
3862>>0x2b	string          >\0			label %.11s,
3863>>0x27	lelong		x			serial %08x,
3864>>0x36	string		>\0			fstype %.8s
3865
3866# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
3867# Update: Joerg Jenderek
3868# URL: https://en.wikipedia.org/wiki/LHA_(file_format)
3869# Reference: https://web.archive.org/web/20021005080911/http://www.osirusoft.com/joejared/lzhformat.html
3870#
3871#	check and display information of lharc (LHa,PMarc) file
38720	name				lharc-file
3873# check 1st character of method id like -lz4- -lh5- or -pm2-
3874>2	string		-
3875# check 5th character of method id
3876>>6	string		-
3877# check header level 0 1 2 3
3878>>>20	ubyte		<4
3879# check 2nd, 3th and 4th character of method id
3880>>>>3	regex		\^(lh[0-9a-ex]|lz[s2-8]|pm[012]|pc1)		\b
3881!:mime	application/x-lzh-compressed
3882# creator type "LHA "
3883!:apple	????LHA
3884# display archive type name like "LHa/LZS archive data" or "LArc archive"
3885>>>>>2	string		-lz		\b
3886!:ext	lzs
3887# already known  -lzs- -lz4- -lz5- with old names
3888>>>>>>2	string	-lzs		LHa/LZS archive data
3889>>>>>>3	regex	\^lz[45]	LHarc 1.x archive data
3890# missing -lz?- with wikipedia names
3891>>>>>>3	regex	\^lz[2378]	LArc archive
3892# display archive type name like "LHa (2.x) archive data"
3893>>>>>2	string		-lh		\b
3894# already known -lh0- -lh1- -lh2- -lh3-  -lh4- -lh5- -lh6- -lh7- -lhd- variants with old names
3895>>>>>>3	regex		\^lh[01]	LHarc 1.x/ARX archive data
3896# LHice archiver use ".ICE" as name extension instead usual one ".lzh"
3897# FOOBAR archiver use ".foo" as name extension instead usual one
3898# "Florain Orjanov's and Olga Bachetska's ARchiver" not found at the moment
3899>>>>>>>2	string	-lh1		\b
3900!:ext lha/lzh/ice
3901>>>>>>3	regex		\^lh[23d]	LHa 2.x? archive data
3902>>>>>>3	regex		\^lh[7]		LHa (2.x)/LHark archive data
3903>>>>>>3	regex		\^lh[456]	LHa (2.x) archive data
3904>>>>>>>2	string	-lh5		\b
3905# https://en.wikipedia.org/wiki/BIOS
3906# Some mainboard BIOS like Award use LHa compression. So archives with unusual extension are found like
3907# bios.rom , kd7_v14.bin, 1010.004, ...
3908!:ext lha/lzh/rom/bin
3909# missing -lh?- variants (Joe Jared)
3910>>>>>>3	regex		\^lh[89a-ce]	LHa (Joe Jared) archive
3911# UNLHA32 2.67a
3912>>>>>>2	string		-lhx		LHa (UNLHA32) archive
3913# lha archives with standard file name extensions ".lha" ".lzh"
3914>>>>>>3	regex		!\^(lh1|lh5)	\b
3915!:ext lha/lzh
3916# this should not happen if all -lh variants are described
3917>>>>>>2	default		x		LHa (unknown) archive
3918#!:ext	lha
3919# PMarc
3920>>>>>3	regex		\^pm[012]	PMarc archive data
3921!:ext pma
3922# append method id without leading and trailing minus character
3923>>>>>3	string		x		[%3.3s]
3924>>>>>>0	use	lharc-header
3925#
3926#	check and display information of lharc header
39270	name				lharc-header
3928# header size 0x4 , 0x1b-0x61
3929>0	ubyte		x
3930# compressed data size != compressed file size
3931#>7	ulelong		x		\b, data size %d
3932# attribute: 0x2~?? 0x10~symlink|target 0x20~normal
3933#>19	ubyte		x		\b, 19_%#x
3934# level identifier 0 1 2 3
3935#>20	ubyte		x		\b, level %d
3936# time stamp
3937#>15		ubelong	x		DATE %#8.8x
3938# OS ID for level 1
3939>20	ubyte		1
3940# 0x20 types find for *.rom files
3941>>(21.b+24)	ubyte	<0x21		\b, %#x OS
3942# ascii type like M for MSDOS
3943>>(21.b+24)	ubyte	>0x20		\b, '%c' OS
3944# OS ID for level 2
3945>20	ubyte		2
3946#>>23	ubyte		x		\b, OS ID %#x
3947>>23	ubyte		<0x21		\b, %#x OS
3948>>23	ubyte		>0x20		\b, '%c' OS
3949# filename only for level 0 and 1
3950>20	ubyte		<2
3951# length of filename
3952>>21		ubyte	>0		\b, with
3953# filename
3954>>>21		pstring	x		"%s"
3955#
3956#2	string		-lh0-		LHarc 1.x/ARX archive data [lh0]
3957#!:mime	application/x-lharc
39582	string		-lh0-
3959>0	use	lharc-file
3960#2	string		-lh1-		LHarc 1.x/ARX archive data [lh1]
3961#!:mime	application/x-lharc
39622	string		-lh1-
3963>0	use	lharc-file
3964# NEW -lz2- ... -lz8-
39652	string		-lz2-
3966>0	use	lharc-file
39672	string		-lz3-
3968>0	use	lharc-file
39692	string		-lz4-
3970>0	use	lharc-file
39712	string		-lz5-
3972>0	use	lharc-file
39732	string		-lz7-
3974>0	use	lharc-file
39752	string		-lz8-
3976>0	use	lharc-file
3977#	[never seen any but the last; -lh4- reported in comp.compression:]
3978#2	string		-lzs-		LHa/LZS archive data [lzs]
39792	string		-lzs-
3980>0	use	lharc-file
3981# According to wikipedia and others such a version does not exist
3982#2	string		-lh\40-		LHa 2.x? archive data [lh ]
3983#2	string		-lhd-		LHa 2.x? archive data [lhd]
39842	string		-lhd-
3985>0	use	lharc-file
3986#2	string		-lh2-		LHa 2.x? archive data [lh2]
39872	string		-lh2-
3988>0	use	lharc-file
3989#2	string		-lh3-		LHa 2.x? archive data [lh3]
39902	string		-lh3-
3991>0	use	lharc-file
3992#2	string		-lh4-		LHa (2.x) archive data [lh4]
39932	string		-lh4-
3994>0	use	lharc-file
3995#2	string		-lh5-		LHa (2.x) archive data [lh5]
39962	string		-lh5-
3997>0	use	lharc-file
3998#2	string		-lh6-		LHa (2.x) archive data [lh6]
39992	string		-lh6-
4000>0	use	lharc-file
4001#2	string		-lh7-		LHa (2.x)/LHark archive data [lh7]
40022	string		-lh7-
4003# !:mime	application/x-lha
4004# >20	byte		x		- header level %d
4005>0	use	lharc-file
4006# NEW -lh8- ... -lhe- , -lhx-
40072	string		-lh8-
4008>0	use	lharc-file
40092	string		-lh9-
4010>0	use	lharc-file
40112	string		-lha-
4012>0	use	lharc-file
40132	string		-lhb-
4014>0	use	lharc-file
40152	string		-lhc-
4016>0	use	lharc-file
40172	string		-lhe-
4018>0	use	lharc-file
40192	string		-lhx-
4020>0	use	lharc-file
4021# taken from idarc [JW]
40222   string      -lZ         PUT archive data
4023# already done by LHarc magics
4024# this should never happen if all sub types of LZS archive are identified
4025#2   string      -lz         LZS archive data
40262   string      -sw1-       Swag archive data
4027
40280	name		rar-file-header
4029>24	byte		15		\b, v1.5
4030>24	byte		20		\b, v2.0
4031>24	byte		29		\b, v4
4032>15	byte		0		\b, os: MS-DOS
4033>15	byte		1		\b, os: OS/2
4034>15	byte		2		\b, os: Win32
4035>15	byte		3		\b, os: Unix
4036>15	byte		4		\b, os: Mac OS
4037>15	byte		5		\b, os: BeOS
4038
40390	name		rar-archive-header
4040>3	leshort&0x1ff	>0		\b, flags:
4041>>3	leshort		&0x01		ArchiveVolume
4042>>3	leshort		&0x02		Commented
4043>>3	leshort		&0x04		Locked
4044>>3	leshort		&0x10		NewVolumeNaming
4045>>3	leshort		&0x08		Solid
4046>>3	leshort		&0x20		Authenticated
4047>>3	leshort		&0x40		RecoveryRecordPresent
4048>>3	leshort		&0x80		EncryptedBlockHeader
4049>>3	leshort		&0x100		FirstVolume
4050
4051# RAR (Roshal Archive) archive
40520	string		Rar!\x1a\7\0		RAR archive data
4053!:mime	application/x-rar
4054!:ext	rar/cbr
4055# file header
4056>(0xc.l+9)	byte	0x74
4057>>(0xc.l+7)	use	rar-file-header
4058# subblock seems to share information with file header
4059>(0xc.l+9)	byte	0x7a
4060>>(0xc.l+7)	use	rar-file-header
4061>9		byte	0x73
4062>>7		use	rar-archive-header
4063
40640	string		Rar!\x1a\7\1\0		RAR archive data, v5
4065!:mime	application/x-rar
4066!:ext	rar
4067
4068# Very old RAR archive
4069# https://jasonblanks.com/wp-includes/images/papers/KnowyourarchiveRAR.pdf
40700	string		RE\x7e\x5e  RAR archive data (<v1.5)
4071!:mime	application/x-rar
4072!:ext	rar/cbr
4073
4074# SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
40750	string		SQSH		squished archive data (Acorn RISCOS)
4076
4077# UC2 archiver (Greg Roelofs, newt@uchicago.edu)
4078# [JW] see exe section for self-extracting version
40790	string		UC2\x1a		UC2 archive data
4080
4081# PKZIP multi-volume archive
40820	string		PK\x07\x08PK\x03\x04	Zip multi-volume archive data, at least PKZIP v2.50 to extract
4083!:mime	application/zip
4084!:ext zip/cbz
4085
4086# Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
40870	string		PK\005\006	Zip archive data (empty)
4088!:mime application/zip
4089!:ext zip/cbz
4090!:strength +1
40910	string		PK\003\004
4092!:strength +1
4093
4094# Specialised zip formats which start with a member named 'mimetype'
4095# (stored uncompressed, with no 'extra field') containing the file's MIME type.
4096# Check for have 8-byte name, 0-byte extra field, name "mimetype", and
4097#  contents starting with "application/":
4098>26	string		\x8\0\0\0mimetypeapplication/
4099
4100#  KOffice / OpenOffice & StarOffice / OpenDocument formats
4101#    From: Abel Cheung <abel@oaka.org>
4102
4103#   KOffice (1.2 or above) formats
4104#    (mimetype contains "application/vnd.kde.<SUBTYPE>")
4105>>50	string	vnd.kde.		KOffice (>=1.2)
4106>>>58	string	karbon			Karbon document
4107>>>58	string	kchart			KChart document
4108>>>58	string	kformula		KFormula document
4109>>>58	string	kivio			Kivio document
4110>>>58	string	kontour			Kontour document
4111>>>58	string	kpresenter		KPresenter document
4112>>>58	string	kspread			KSpread document
4113>>>58	string	kword			KWord document
4114
4115#   OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7)
4116#    (mimetype contains "application/vnd.sun.xml.<SUBTYPE>")
4117# URL:		https://en.wikipedia.org/wiki/OpenOffice.org_XML
4118# reference:	http://fileformats.archiveteam.org/wiki/OpenOffice.org_XML
4119>>50	string	vnd.sun.xml.		OpenOffice.org 1.x
4120>>>62	string	writer			Writer
4121>>>>68	byte	!0x2e			document
4122!:mime	application/vnd.sun.xml.writer
4123!:ext	sxw
4124>>>>68	string	.template		template
4125!:mime	application/vnd.sun.xml.writer.template
4126!:ext	stw
4127>>>>68	string	.web			Web template
4128!:mime	application/vnd.sun.xml.writer.web
4129!:ext	stw
4130>>>>68	string	.global			global document
4131!:mime	application/vnd.sun.xml.writer.global
4132!:ext	sxg
4133>>>62	string	calc			Calc
4134>>>>66	byte	!0x2e			spreadsheet
4135!:mime	application/vnd.sun.xml.calc
4136!:ext	sxc
4137>>>>66	string	.template		template
4138!:mime	application/vnd.sun.xml.calc.template
4139!:ext	stc
4140>>>62	string	draw			Draw
4141>>>>66	byte	!0x2e			document
4142!:mime	application/vnd.sun.xml.draw
4143!:ext	sxd
4144>>>>66	string	.template		template
4145!:mime	application/vnd.sun.xml.draw.template
4146!:ext	std
4147>>>62	string	impress			Impress
4148>>>>69	byte	!0x2e			presentation
4149!:mime	application/vnd.sun.xml.impress
4150!:ext	sxi
4151>>>>69	string	.template		template
4152!:mime	application/vnd.sun.xml.impress.template
4153!:ext	sti
4154>>>62	string	math			Math document
4155!:mime	application/vnd.sun.xml.math
4156!:ext	sxm
4157>>>62	string	base			Database file
4158!:mime	application/vnd.sun.xml.base
4159!:ext	sdb
4160
4161# URL:	https://wiki.openoffice.org/wiki/Documentation/DevGuide/Extensions/File_Format
4162# From:	Joerg Jenderek
4163# Note:	only few OXT samples are detected here by mimetype member
4164#	is used by OpenOffice and LibreOffice and probably also NeoOffice
4165#	verified by `unzip -Zv *.oxt` or `7z l -slt *.oxt`
4166>>50	string	vnd.openofficeorg.		OpenOffice
4167>>>68	string	extension			\b/LibreOffice Extension
4168# http://extension.nirsoft.net/oxt
4169!:mime	application/vnd.openofficeorg.extension
4170# like: Gallery-Puzzle.2.1.0.1.oxt
4171!:ext	oxt
4172
4173#   OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8)
4174#   URL: http://fileformats.archiveteam.org/wiki/OpenDocument
4175#    https://lists.oasis-open.org/archives/office/200505/msg00006.html
4176#    (mimetype contains "application/vnd.oasis.opendocument.<SUBTYPE>")
4177>>50	string	vnd.oasis.opendocument.	OpenDocument
4178>>>73	string	text
4179>>>>77	byte	!0x2d			Text
4180!:mime	application/vnd.oasis.opendocument.text
4181!:ext	odt
4182>>>>77	string	-template		Text Template
4183!:mime	application/vnd.oasis.opendocument.text-template
4184!:ext	ott
4185>>>>77	string	-web			HTML Document Template
4186!:mime	application/vnd.oasis.opendocument.text-web
4187!:ext	oth
4188>>>>77	string	-master			Master Document
4189!:mime	application/vnd.oasis.opendocument.text-master
4190!:ext	odm
4191>>>73	string	graphics
4192>>>>81	byte	!0x2d			Drawing
4193!:mime	application/vnd.oasis.opendocument.graphics
4194!:ext	odg
4195>>>>81	string	-template		Drawing Template
4196!:mime	application/vnd.oasis.opendocument.graphics-template
4197!:ext	otg
4198>>>73	string	presentation
4199>>>>85	byte	!0x2d			Presentation
4200!:mime	application/vnd.oasis.opendocument.presentation
4201!:ext	odp
4202>>>>85	string	-template		Presentation Template
4203!:mime	application/vnd.oasis.opendocument.presentation-template
4204!:ext	otp
4205>>>73	string	spreadsheet
4206>>>>84	byte	!0x2d			Spreadsheet
4207!:mime	application/vnd.oasis.opendocument.spreadsheet
4208!:ext	ods
4209>>>>84	string	-template		Spreadsheet Template
4210!:mime	application/vnd.oasis.opendocument.spreadsheet-template
4211!:ext	ots
4212>>>73	string	chart
4213>>>>78	byte	!0x2d			Chart
4214!:mime	application/vnd.oasis.opendocument.chart
4215!:ext	odc
4216>>>>78	string	-template		Chart Template
4217!:mime	application/vnd.oasis.opendocument.chart-template
4218!:ext	otc
4219>>>73	string	formula
4220>>>>80	byte	!0x2d			Formula
4221!:mime	application/vnd.oasis.opendocument.formula
4222!:ext	odf
4223>>>>80	string	-template		Formula Template
4224!:mime	application/vnd.oasis.opendocument.formula-template
4225!:ext	otf
4226# https://www.loc.gov/preservation/digital/formats/fdd/fdd000441.shtml
4227>>>73	string	database		Database
4228!:mime	application/vnd.oasis.opendocument.database
4229!:ext	odb
4230# Valid for LibreOffice Base 6.0.1.1 at least
4231>>>73	string	base 			Database
4232# https://bugs.documentfoundation.org/show_bug.cgi?id=45854
4233!:mime	application/vnd.oasis.opendocument.database
4234#!:mime	application/vnd.oasis.opendocument.base
4235!:ext	odb
4236>>>73	string	image
4237>>>>78	byte	!0x2d			Image
4238!:mime	application/vnd.oasis.opendocument.image
4239!:ext	odi
4240>>>>78	string	-template		Image Template
4241!:mime	application/vnd.oasis.opendocument.image-template
4242!:ext	oti
4243
4244#  EPUB (OEBPS) books using OCF (OEBPS Container Format)
4245#    https://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4.
4246#    From: Ralf Brown <ralf.brown@gmail.com>
4247>>50	string	epub+zip	EPUB document
4248!:mime application/epub+zip
4249
4250# From:	Joerg Jenderek
4251# URL:	http://en.wikipedia.org/wiki/CorelDRAW
4252# NOTE:	version; til 2 WL-based; from 3 til 13 by ./riff; from 14 zip based
4253>>50	string	x-vnd.corel.	 Corel
4254>>>62	string	draw.document+zip	Draw drawing, version 14-16
4255!:mime	application/x-vnd.corel.draw.document+zip
4256!:ext	cdr
4257>>>62	string	draw.template+zip	Draw template, version 14-16
4258!:mime	application/x-vnd.corel.draw.template+zip
4259!:ext	cdrt
4260>>>62	string	zcf.draw.document+zip	Draw drawing, version 17-22
4261!:mime	application/x-vnd.corel.zcf.draw.document+zip
4262!:ext	cdr
4263>>>62	string	zcf.draw.template+zip	Draw template, version 17-22
4264!:mime	application/x-vnd.corel.zcf.draw.template+zip
4265!:ext	cdt/cdrt
4266# URL:	http://product.corel.com/help/CorelDRAW/540240626/Main/EN/Doc/CorelDRAW-Other-file-formats.html
4267>>>62	string	zcf.pattern+zip		Draw pattern, version 22
4268!:mime	application/x-vnd.corel.zcf.pattern+zip
4269!:ext	pat
4270# URL:		https://en.wikipedia.org/wiki/Corel_Designer
4271# Reference:	http://fileformats.archiveteam.org/wiki/Corel_Designer
4272# Note:		called by TrID "Corel DESIGN graphics"
4273>>>62	string	designer.document+zip		DESIGNER graphics, version 14-16
4274!:mime	application/x-vnd.corel.designer.document+zip
4275!:ext	des
4276>>>62	string	zcf.designer.document+zip	DESIGNER graphics, version 17-21
4277!:mime	application/x-vnd.corel.zcf.designer.document+zip
4278!:ext	des
4279# URL:	http://product.corel.com/help/CorelDRAW/540223850/Main/EN/Documentation/
4280#	CorelDRAW-Corel-Symbol-Library-CSL.html
4281>>>62	string	symbol.library+zip		Symbol Library, version 6-16.3
4282!:mime	application/x-vnd.corel.symbol.library+zip
4283!:ext	csl
4284>>>62	string	zcf.symbol.library+zip		Symbol Library, version 17-22
4285!:mime	application/x-vnd.corel.zcf.symbol.library+zip
4286!:ext	csl
4287
4288#  Catch other ZIP-with-mimetype formats
4289#	In a ZIP file, the bytes immediately after a member's contents are
4290#	always "PK". The 2 regex rules here print the "mimetype" member's
4291#	contents up to the first 'P'. Luckily, most MIME types don't contain
4292#	any capital 'P's. This is a kludge.
4293#    (mimetype contains "application/<OTHER>")
4294>>50		default	x			Zip data
4295>>>38		regex	[!-OQ-~]+		(MIME type "%s"?)
4296!:mime	application/zip
4297#    (mimetype contents other than "application/*")
4298>26		string	\x8\0\0\0mimetype
4299>>38		string	!application/
4300>>>38		regex	[!-OQ-~]+		Zip data (MIME type "%s"?)
4301!:mime	application/zip
4302
4303# Java Jar files
4304>(26.s+30)	leshort	0xcafe		Java archive data (JAR)
4305!:mime	application/java-archive
4306
4307# iOS App
4308>(26.s+30)	leshort	!0xcafe
4309>>26		string	!\x8\0\0\0mimetype
4310>>>30		string	Payload/
4311>>>>38		search/64       .app/   iOS App
4312!:mime application/x-ios-app
4313
4314# Dup, see above.
4315#>30	search/100/b application/epub+zip	EPUB document
4316#!:mime application/epub+zip
4317
4318# Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
4319#   Next line excludes specialized formats:
4320>(26.s+30)	leshort	!0xcafe
4321>>30	search/100/b !application/epub+zip
4322>>>26    string          !\x8\0\0\0mimetype	Zip archive data
4323!:mime	application/zip
4324>>>>4	beshort		x			\b, at least
4325>>>>4	use		zipversion
4326>>>>4	beshort		x			to extract
4327>>>>8	beshort		x			\b, compression method=
4328>>>>8	use		zipcompression
4329>>>>0x161	string		WINZIP		\b, WinZIP self-extracting
4330
4331# StarView Metafile
4332# From Pierre Ducroquet <pinaraf@pinaraf.info>
43330	string	VCLMTF	StarView MetaFile
4334>6	beshort	x	\b, version %d
4335>8	belong	x	\b, size %d
4336
4337# Zoo archiver
433820	lelong		0xfdc4a7dc	Zoo archive data
4339!:mime	application/x-zoo
4340>4	byte		>48		\b, v%c.
4341>>6	byte		>47		\b%c
4342>>>7	byte		>47		\b%c
4343>32	byte		>0		\b, modify: v%d
4344>>33	byte		x		\b.%d+
4345>42	lelong		0xfdc4a7dc	\b,
4346>>70	byte		>0		extract: v%d
4347>>>71	byte		x		\b.%d+
4348
4349# Shell archives
435010	string		#\ This\ is\ a\ shell\ archive	shell archive text
4351!:mime	application/octet-stream
4352
4353#
4354# LBR. NB: May conflict with the questionable
4355#          "binary Computer Graphics Metafile" format.
4356#
43570       string  \0\ \ \ \ \ \ \ \ \ \ \ \0\0    LBR archive data
4358#
4359# PMA (CP/M derivative of LHA)
4360# Update: Joerg Jenderek
4361# URL: https://en.wikipedia.org/wiki/LHA_(file_format)
4362#
4363#2       string          -pm0-           PMarc archive data [pm0]
43642	string		-pm0-
4365>0	use	lharc-file
4366#2       string          -pm1-           PMarc archive data [pm1]
43672	string		-pm1-
4368>0	use	lharc-file
4369#2       string          -pm2-           PMarc archive data [pm2]
43702	string		-pm2-
4371>0	use	lharc-file
43722       string          -pms-           PMarc SFX archive (CP/M, DOS)
4373#!:mime	application/x-foobar-exec
4374!:ext com
43755       string          -pc1-           PopCom compressed executable (CP/M)
4376#!:mime	application/x-
4377#!:ext com
4378
4379# From Rafael Laboissiere <rafael@laboissiere.net>
4380# The Project Revision Control System (see
4381# http://prcs.sourceforge.net) generates a packaged project
4382# file which is recognized by the following entry:
43830	leshort		0xeb81	PRCS packaged project
4384
4385# Microsoft cabinets
4386# by David Necas (Yeti) <yeti@physics.muni.cz>
4387#0	string	MSCF\0\0\0\0	Microsoft cabinet file data,
4388#>25	byte	x		v%d
4389#>24	byte	x		\b.%d
4390# MPi: All CABs have version 1.3, so this is pointless.
4391# Better magic in debian-additions.
4392
4393# GTKtalog catalogs
4394# by David Necas (Yeti) <yeti@physics.muni.cz>
43954	string	gtktalog\ 	GTKtalog catalog data,
4396>13	string	3		version 3
4397>>14	beshort	0x677a		(gzipped)
4398>>14	beshort	!0x677a		(not gzipped)
4399>13	string	>3		version %s
4400
4401############################################################################
4402# Parity archive reconstruction file, the 'par' file format now used on Usenet.
44030       string          PAR\0	PARity archive data
4404>48	leshort		=0	- Index file
4405>48	leshort		>0	- file number %d
4406
4407# Felix von Leitner <felix-file@fefe.de>
44080	string	d8:announce	BitTorrent file
4409!:mime	application/x-bittorrent
4410!:ext	torrent
4411# Durval Menezes, <jmgthbfile at durval dot com>
44120	string	d13:announce-list	BitTorrent file
4413!:mime	application/x-bittorrent
4414!:ext	torrent
44150	string	d7:comment	BitTorrent file
4416!:mime	application/x-bittorrent
4417!:ext	torrent
44180	string	d4:info		BitTorrent file
4419!:mime	application/x-bittorrent
4420!:ext	torrent
4421
4422# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi>
4423# URL:		http://fileformats.archiveteam.org/wiki/MSA_(Magic_Shadow_Archiver)
4424# Reference:	http://info-coach.fr/atari/documents/_mydoc/FD_Image_File_Format.pdf
4425#		http://mark0.net/download/triddefs_xml.7z/defs/m/msa.trid.xml
4426# Update:	Joerg Jenderek
4427# Note:		called by TrID "Atari MSA Disk Image" and verified by
4428#		command like `deark -l -m msa -d2 PDATS578.msa` as " Atari ST floppy disk image"
4429# GRR: line below is too general as it matches setup.skin
44300	beshort 0x0e0f
4431# skip foo setup.skin with unrealistic high number 52255 of sides by check for valid "low" value
4432>4	ubeshort <2		Atari MSA archive data
4433#!:mime	application/octet-stream
4434!:mime	application/x-atari-msa
4435!:ext	msa
4436# sectors per track like: 9 10
4437>>2	beshort x		\b, %d sectors per track
4438# sides (0 or 1; add 1 to this to get correct number of sides)
4439>>4	beshort 0		\b, 1 sided
4440>>4	beshort 1		\b, 2 sided
4441# starting track like: 0
4442>>6	beshort x		\b, starting track: %d
4443# ending track like: 39 79 80 81
4444>>8	beshort x		\b, ending track: %d
4445# tracks content
4446#>>10	ubequad x		\b, track content %#16.16llx
4447
4448# Alternate ZIP string (amc@arwen.cs.berkeley.edu)
44490	string	PK00PK\003\004	Zip archive data
4450!:mime	application/zip
4451!:ext zip/cbz
4452
4453# ACE archive (from http://www.wotsit.org/download.asp?f=ace)
4454# by Stefan `Sec` Zehl <sec@42.org>
44557	string		**ACE**		ACE archive data
4456!:mime	application/x-ace-compressed
4457!:ext	ace
4458>15	byte	>0		version %d
4459>16	byte	=0x00		\b, from MS-DOS
4460>16	byte	=0x01		\b, from OS/2
4461>16	byte	=0x02		\b, from Win/32
4462>16	byte	=0x03		\b, from Unix
4463>16	byte	=0x04		\b, from MacOS
4464>16	byte	=0x05		\b, from WinNT
4465>16	byte	=0x06		\b, from Primos
4466>16	byte	=0x07		\b, from AppleGS
4467>16	byte	=0x08		\b, from Atari
4468>16	byte	=0x09		\b, from Vax/VMS
4469>16	byte	=0x0A		\b, from Amiga
4470>16	byte	=0x0B		\b, from Next
4471>14	byte	x		\b, version %d to extract
4472>5	leshort &0x0080		\b, multiple volumes,
4473>>17	byte	x		\b (part %d),
4474>5	leshort &0x0002		\b, contains comment
4475>5	leshort	&0x0200		\b, sfx
4476>5	leshort	&0x0400		\b, small dictionary
4477>5	leshort	&0x0800		\b, multi-volume
4478>5	leshort	&0x1000		\b, contains AV-String
4479>>30	string	\x16*UNREGISTERED\x20VERSION*	(unregistered)
4480>5	leshort &0x2000		\b, with recovery record
4481>5	leshort &0x4000		\b, locked
4482>5	leshort &0x8000		\b, solid
4483# Date in MS-DOS format (whatever that is)
4484#>18	lelong	x		Created on
4485
4486# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann
4487# <doj@cubic.org>
44880x1A	string	sfArk		sfArk compressed Soundfont
4489>0x15	string	2
4490>>0x1	string	>\0		Version %s
4491>>0x2A	string	>\0		: %s
4492
4493# DR-DOS 7.03 Packed File *.??_
4494# Reference: http://www.antonis.de/dos/dos-tuts/mpdostip/html/nwdostip.htm
4495# Note:	unpacked by PNUNPACK.EXE
44960	string	Packed\ File\
4497# by looking for Control-Z skip ASCII text starting with Packed File
4498>0x18	ubyte	0x1a		Personal NetWare Packed File
4499!:mime	application/x-novell-compress
4500!:ext	??_
4501>>12	string	x		\b, was "%.12s"
4502# 1 or 2
4503#>>0x19	ubyte	x		\b, at 0x19 %u
4504>>0x1b	ulelong	x		with %u bytes
4505
4506# EET archive
4507# From: Tilman Sauerbeck <tilman@code-monkey.de>
45080	belong	0x1ee7ff00	EET archive
4509!:mime	application/x-eet
4510
4511# rzip archives
45120	string	RZIP		rzip compressed data
4513>4	byte	x		- version %d
4514>5	byte	x		\b.%d
4515>6	belong	x		(%d bytes)
4516
4517# From:		Joerg Jenderek
4518# URL:		https://help.foxitsoftware.com/kb/install-fzip-file.php
4519# reference:	http://mark0.net/download/triddefs_xml.7z/
4520#		defs/f/fzip.trid.xml
4521# Note: unknown compression; No "PK" zip magic; normally in directory like
4522#	"%APPDATA%\Foxit Software\Addon\Foxit Reader\Install"
45230	ubequad	0x2506781901010000	Foxit add-on/update
4524!:mime	application/x-fzip
4525!:ext	fzip
4526
4527# From: "Robert Dale" <robdale@gmail.com>
45280	belong	123		dar archive,
4529>4	belong	x		label "%.8x
4530>>8	belong	x		%.8x
4531>>>12	beshort	x		%.4x"
4532>14	byte	0x54		end slice
4533>14	beshort	0x4e4e		multi-part
4534>14	beshort	0x4e53		multi-part, with -S
4535
4536# Symbian installation files
4537#  https://www.thouky.co.uk/software/psifs/sis.html
4538#  http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf
45398	lelong	0x10000419	Symbian installation file
4540!:mime	application/vnd.symbian.install
4541>4	lelong	0x1000006D	(EPOC release 3/4/5)
4542>4	lelong	0x10003A12	(EPOC release 6)
45430	lelong	0x10201A7A	Symbian installation file (Symbian OS 9.x)
4544!:mime	x-epoc/x-sisx-app
4545
4546# From "Nelson A. de Oliveira" <naoliv@gmail.com>
45470	string	MPQ\032		MoPaQ (MPQ) archive
4548
4549# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
4550# .kgb
45510	string KGB_arch		KGB Archiver file
4552>10	string x		with compression level %.1s
4553
4554# xar (eXtensible ARchiver) archive
4555# URL: https://en.wikipedia.org/wiki/Xar_(archiver)
4556# xar archive format: https://code.google.com/p/xar/
4557# From: "David Remahl" <dremahl@apple.com>
4558# Update: Joerg Jenderek
4559# TODO: lzma compression; X509Data for pkg and xip
4560# Note: verified by `xar --dump-header -f FullBundleUpdate.xar` or
4561# 7z t -txar Xcode_10.2_beta_4.xip`
45620	string	xar!		xar archive
4563!:mime	application/x-xar
4564# pkg for Mac OSX installer package like FullBundleUpdate.pkg
4565# xip for signed Apple software like Xcode_10.2_beta_4.xip
4566!:ext	xar/pkg/xip
4567# always 28 in older archives
4568>4	ubeshort >28		\b, header size %u
4569# currently there exit only version 1 since about 2014
4570>6	ubeshort >1		version %u,
4571>8	ubequad	x		compressed TOC: %llu,
4572#>16	ubequad	x		uncompressed TOC: %llu,
4573# cksum_alg 0-2 in older and also 3-4 in newer
4574>24	belong	0		no checksum
4575>24	belong	1		SHA-1 checksum
4576>24	belong	2		MD5 checksum
4577>24	belong	3		SHA-256 checksum
4578>24	belong	4		SHA-512 checksum
4579>24	belong	>4		unknown %#x checksum
4580#>24	belong	>4		checksum
4581#			For no compression jump 0 bytes
4582>24	belong	0
4583>>0		ubyte	x
4584# jump more bytes forward by header size
4585>>>&(4.S)	ubyte	x
4586# jump more bytes forward by compressed table of contents size
4587#>>>>&(8.Q)	ubequad	x	\b, heap data %#llx
4588>>>>&(8.Q)	ubyte	x
4589# look for data by ./compress after message with 1 space at end
4590>>>>>&-3	indirect x	\b, contains
4591#			For SHA-1 jump 20 minus 2 bytes
4592>24	belong	1
4593>>18		ubyte	x
4594# jump more bytes forward by header size
4595>>>&(4.S)	ubyte	x
4596# jump more bytes forward by compressed table of contents size
4597>>>>&(8.Q)	ubyte	x
4598# data compressed by gzip, bzip, lzma or none
4599>>>>>&-1	indirect x	\b, contains
4600#			For SHA-256 jump 32 minus 2 bytes
4601>24	belong	3
4602>>30		ubyte	x
4603# jump more bytes forward by header size
4604>>>&(4.S)	ubyte	x
4605# jump more bytes forward by compressed table of contents size
4606>>>>&(8.Q)	ubyte	x
4607>>>>>&-1	indirect x	\b, contains
4608#			For SHA-512 jump 64 minus 2 bytes
4609>24	belong	4
4610>>62		ubyte	x
4611# jump more bytes forward by header size
4612>>>&(4.S)	ubyte	x
4613# jump more bytes forward by compressed table of contents size
4614>>>>&(8.Q)	ubyte	x
4615>>>>>&-1	indirect x	\b, contains
4616
4617# Type: Parity Archive
4618# From: Daniel van Eeden <daniel_e@dds.nl>
46190	string	PAR2		Parity Archive Volume Set
4620
4621# Bacula volume format. (Volumes always start with a block header.)
4622# URL: https://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html
4623# From: Adam Buchbinder <adam.buchbinder@gmail.com>
462412	string	BB02		Bacula volume
4625>20	bedate	x		\b, started %s
4626
4627# ePub is XHTML + XML inside a ZIP archive.  The first member of the
4628#   archive must be an uncompressed file called 'mimetype' with contents
4629#   'application/epub+zip'
4630
4631
4632# From: "Michael Gorny" <mgorny@gentoo.org>
4633# ZPAQ: http://mattmahoney.net/dc/zpaq.html
46340	string	zPQ	ZPAQ stream
4635>3	byte	x	\b, level %d
4636# From: Barry Carter <carter.barry@gmail.com>
4637# https://encode.ru/threads/456-zpaq-updates/page32
46380	string	7kSt	ZPAQ file
4639
4640# BBeB ebook, unencrypted (LRF format)
4641# URL: https://www.sven.de/librie/Librie/LrfFormat
4642# From: Adam Buchbinder <adam.buchbinder@gmail.com>
46430	string	L\0R\0F\0\0\0	BBeB ebook data, unencrypted
4644>8	beshort	x		\b, version %d
4645>36	byte	1		\b, front-to-back
4646>36	byte	16		\b, back-to-front
4647>42	beshort	x		\b, (%dx,
4648>44	beshort	x		%d)
4649
4650# Symantec GHOST image by Joerg Jenderek at May 2014
4651# https://us.norton.com/ghost/
4652# https://www.garykessler.net/library/file_sigs.html
46530		ubelong&0xFFFFf7f0	0xFEEF0100	Norton GHost image
4654# *.GHO
4655>2		ubyte&0x08		0x00		\b, first file
4656# *.GHS or *.[0-9] with cns program option
4657>2		ubyte&0x08		0x08		\b, split file
4658# part of split index interesting for *.ghs
4659>>4		ubyte			x		id=%#x
4660# compression tag minus one equals numeric compression command line switch z[1-9]
4661>3		ubyte			0		\b, no compression
4662>3		ubyte			2		\b, fast compression (Z1)
4663>3		ubyte			3		\b, medium compression (Z2)
4664>3		ubyte			>3
4665>>3		ubyte			<11		\b, compression (Z%d-1)
4666>2		ubyte&0x08		0x00
4667# ~ 30 byte password field only for *.gho
4668>>12		ubequad			!0		\b, password protected
4669>>44		ubyte			!1
4670# 1~Image All, sector-by-sector only for *.gho
4671>>>10		ubyte			1		\b, sector copy
4672# 1~Image Boot track only for *.gho
4673>>>43		ubyte			1		\b, boot track
4674# 1~Image Disc only for *.gho implies Image Boot track and sector copy
4675>>44		ubyte			1		\b, disc sector copy
4676# optional image description only *.gho
4677>>0xff		string			>\0		"%-.254s"
4678# look for DOS sector end sequence
4679>0xE08	search/7776		\x55\xAA
4680>>&-512	indirect		x		\b; contains
4681
4682# Google Chrome extensions
4683# https://developer.chrome.com/extensions/crx
4684# https://developer.chrome.com/extensions/hosting
46850	string	Cr24	Google Chrome extension
4686!:mime	application/x-chrome-extension
4687>4	ulong	x	\b, version %u
4688
4689# SeqBox - Sequenced container
4690# ext: sbx, seqbox
4691# Marco Pontello marcopon@gmail.com
4692# reference: https://github.com/MarcoPon/SeqBox
46930	string	SBx	SeqBox,
4694>3	byte	x	version %d
4695
4696# LyNX archive
469756	string	USE\040LYNX\040TO\040DISSOLVE\040THIS\040FILE	 LyNX archive
4698
4699# From: Joerg Jenderek
4700# URL: https://www.acronis.com/
4701# Reference: https://en.wikipedia.org/wiki/TIB_(file_format)
4702# Note: only tested with True Image 2013 Build 5962 and 2019 Build 14110
47030	ubequad		0xce24b9a220000000	Acronis True Image backup
4704!:mime	application/x-acronis-tib
4705!:ext	tib
4706# 01000000
4707#>20	ubelong		x			\b, at 20 %#x
4708# 20000000
4709#>28	ubelong		x			\b, at 28 %#x
4710# strings like "Generic- SD/MMC 1.00" "Unknown Disk" "Msft Virtual Disk 1.0"
4711# ???
4712# strings like "\Device\0000011e" "\Device\0000015a"
4713#>0	search/0x6852300/cs	\\Device\\
4714#>>&-1	pstring		x			\b, %s
4715# "\Device\HarddiskVolume30" "\Device\HarddiskVolume39"
4716#>>>&1	search/180/cs	\\Device\\
4717#>>>>&-1	pstring		x			\b, %s
4718#>>>>>&0	search/29/cs	\0\0\xc8\0
4719# disk label
4720#>>>>>>&10	lestring16	x		\b, disk label %11.11s
4721#>>>>>>&9	plestring16	x		\b, disk label "%11.11s"
4722#>>>>>>&10	ubequad	x			%16.16llx
4723
4724
4725# Gentoo XPAK binary package
4726# by Michal Gorny <mgorny@gentoo.org>
4727# https://gitweb.gentoo.org/proj/portage.git/tree/man/xpak.5
4728-4	string	STOP
4729>-16	string	XPAKSTOP	Gentoo binary package (XPAK)
4730
4731# From:		Joerg Jenderek
4732# URL:		https://kodi.wiki/view/TexturePacker
4733# Reference:	https://mirrors.kodi.tv/releases/source/17.3-Krypton.tar.gz
4734# /xbmc-Krypton/xbmc/guilib/XBTF.h
4735# /xbmc-Krypton/xbmc/guilib/XBTF.cpp
47360	string	XBTF
4737# skip ASCII text by looking for terminating \0 of path
4738>264	ubyte	0		XBMC texture package
4739!:mime	application/x-xbmc-xbt
4740!:ext	xbt
4741# XBTF_VERSION 2
4742>>4	string	!2		\b, version %-.1s
4743# nofFiles /xbmc-Krypton/xbmc/guilib/XBTFReader.cpp
4744>>5	ulelong	x		\b, %u file
4745# plural s
4746>>5	ulelong	>1		\bs
4747# path[CXBTFFile[MaximumPathLength=256]
4748>>9	string	x		\b, 1st %s
4749
4750# ALZIP archive
4751# by Hyungjun Park <hyungjun.park@worksmobile.com>, Hajin Jang <hajin_jang@worksmobile.com>
4752# http://kippler.com/win/unalz/
4753# https://salsa.debian.org/l10n-korean-team/unalz
47540	string	ALZ\001		ALZ archive data
4755!:ext   alz
4756
4757# https://cf-aldn.altools.co.kr/setup/EGG_Specification.zip
47580	string	EGGA		EGG archive data,
4759!:ext   egg
4760>5	byte	x		version %u
4761>4	byte	x		\b.%u
4762>>0x0E	ulelong	=0x08E28222
4763>>0x0E	ulelong	=0x24F5A262	\b, split
4764>>0x0E	ulelong	=0x24E5A060	\b, solid
4765>>0x0E	default	x		\b, unknown
4766
4767# PAQ9A archive
4768# URL: http://mattmahoney.net/dc/#paq9a
4769# Note: Line 1186 of paq9a.cpp gives the magic bytes
47700	string	pQ9\001		PAQ9A archive
4771
4772# From wof (wof@stachelkaktus.net)
47730	string	Unison\ archive\ format	Unison archive format
4774
4775#------------------------------------------------------------------------------
4776# URL: 		https://de.wikipedia.org/wiki/Aria_(Software)
4777# Reference:	https://github.com/aria2/aria2/blob/master/doc/manual-src/en/technical-notes.rst
4778# From:		Joerg Jenderek
4779# Note:		only version 1 suited
4780# check for valid version one
47810		beshort		0x0001
4782# skip most uncompressed DEGAS med-res bitmap *.PI2 and GEM bitmap (v1) *.IMG
4783# by test for valid infoHashCheck extension
4784>2		ubelong&0xffFFffFE	0x00000000
4785# skip DEGAS med-res bitmap DIAGRAM1.PI2 by test for valid length of download
4786>>(6.L+14)	ubequad			>0
4787>>>0	use     aria
47880	name	aria
4789# version; (0x0000) or (0x0001); for 0 all multi-byte are in host byte order. For 1 big endian
4790>0	beshort		x	aria2 control file, version %u
4791#!:mime	application/octet-stream
4792!:mime	application/x-aria
4793!:ext	aria2
4794# EXTension; if EXT[3]&1 == 1 checks whether saved InfoHash and current downloading the same; infoHashCheck extension
4795>2		ubelong		!0	\b, infoHashCheck %#x
4796# info hash length like: 0 14h
4797>6		ubelong		!0	\b, %#x bytes info hash
4798# info hash; BitTorrent InfoHash
4799>>10		ubequad		x	%#16.16llx...
4800# piece length; the length of the piece like: 400h 100000h
4801>(6.L+10)	ubelong		x	\b, piece length 0x%x
4802# total length; the total length of the download
4803>(6.L+14)	ubequad		x	\b, total length %llu
4804#>(6.L+14)	ubequad		x	\b, total length %#llx
4805# upload length; the uploaded length of download like: 0 400h
4806>(6.L+22)	ubequad		!0	\b, upload length %#llx
4807# bitfield length; the length of bitfield like: 4 6 Ah 10h 13h 167h
4808>(6.L+30)	ubelong		x	\b, %#x bytes bitfield
4809# bitfield; bitfield which represents current download progress
4810>(6.L+34)	ubequad		!0	%#llx...
4811
4812#------------------------------------------------------------------------------
4813# $File: arm,v 1.2 2021/07/14 17:40:31 christos Exp $
4814# arm: file(1) magic for ARM COFF
4815#
4816# https://docs.microsoft.com/en-us/windows/win32/debug/pe-format
4817
4818# Aarch64
48190	leshort		0xaa64
4820# test for unused flag bits in f_flags
4821>18	uleshort&0x8E80	0
4822# use little endian variant of subroutine to
4823# display name+variables+flags for common object formatted files
4824>>0	use				display-coff
4825!:strength -10
4826
4827# ARM
48280	leshort		0x01c0
4829# test for unused flag bits in f_flags
4830>18	uleshort&0x8E80	0
4831# use little endian variant of subroutine to
4832# display name+variables+flags for common object formatted files
4833>>0	use				display-coff
4834!:strength -10
4835
4836# ARM Thumb
48370	leshort		0x01c2
4838# test for unused flag bits in f_flags
4839>18	uleshort&0x8E80	0
4840# use little endian variant of subroutine to
4841# display name+variables+flags for common object formatted files
4842>>0	use				display-coff
4843!:strength -10
4844
4845# ARMv7 Thumb
48460	leshort		0x01c4
4847# test for unused flag bits in f_flags
4848>18	uleshort&0x8E80	0
4849# use little endian variant of subroutine to
4850# display name+variables+flags for common object formatted files
4851>>0	use				display-coff
4852!:strength -10
4853
4854#------------------------------------------------------------------------------
4855# $File: asf,v 1.3 2022/04/25 17:33:13 christos Exp $
4856# asf:  file(1) magic for Microsoft Advanced Systems Format (ASF) files
4857# http://www.staroceans.org/e-book/ASF_Specification.pdf
4858
48590	name	asf-name
4860# ASF_Data_Object
4861#>0	guid	75B22636-668E-11CF-A6D9-00AA0062CE6C
4862#>16	lequad	>0
4863#>>(16.q)	use	asf-object
4864# ASF_Simple_Index_Object
4865>0	guid	33000890-E5B1-11CF-89F4-00A0C90349CB
4866>0	guid	D6E229D3-35DA-11D1-9034-00A0C90349BE ASF_Index_Object
4867>0	guid	FEB103F8-12AD-4C64-840F-2A1D2F7AD48C ASF_Media_Object_Index_Object
4868>0	guid	3CB73FD0-0C4A-4803-953D-EDF7B6228F0C ASF_Timecode_Index_Object
4869
4870# ASF_File_Properties_Object
4871>0	guid	8CABDCA1-A947-11CF-8EE4-00C00C205365
4872
4873# ASF_Stream_Properties_Object
4874>0	guid	B7DC0791-A9B7-11CF-8EE6-00C00C205365
4875#>>56	lequad	x		Time Offset %lld
4876#>>64	lelong	x		Type-Specicic Data Length %d
4877#>>68	lelong	x		Error Correction Data Length %d
4878#>>72	leshort	x		Flags %#x
4879#>>74	lelong	x		Reserved %x
4880# ASF_Audio_Media
4881>>24	guid	F8699E40-5B4D-11CF-A8FD-00805F5C442B \b, Audio Media (
4882>>>78	leshort	x	\bCodec Id %d
4883>>>80	leshort	x	\b, Number of channels %d
4884>>>82	lelong	x	\b, Samples Per Second %d
4885>>>86	lelong	x	\b, Average Number of Bytes Per Second %d
4886>>>90	lelong	x	\b, Block Alignment %d
4887>>>94	leshort	x	\b, Bits Per Sample %d
4888# ASF_Video_Media
4889>>24	guid	BC19EFC0-5B4D-11CF-A8FD-00805F5C442B \b, Video Media (
4890>>>78	lelong	x	\bEncoded Image Width %d
4891>>>82	lelong	x	\b, Encoded Image Height %d
4892#>>>85	leshort	x	\b, Format Data Size %x
4893>>>93	lelong	x	\b, Image Width %d
4894>>>97	lelong	x	\b, Image Height %d
4895#>>>101	leshort	x	\b, Reserved %#x
4896>>>103	leshort	x	\b, Bits Per Pixel Count %d
4897#>>>105	lelong	x 	\b, Compression ID %d
4898#>>>109	lelong	x	\b, Image Size %d
4899#>>>113	lelong	x	\b, Horizontal Pixels Per Meter %d
4900#>>>117	lelong	x	\b, Vertical Pixels Per Meter %d
4901#>>>121	lelong	x	\b, Colors Used Count %d
4902#>>>125	lelong	x	\b, Important Colors Count %d
4903>>0	lelong	x	\b, Error correction type
4904>>40	use	asf-name
4905>>0	lelong	x	\b)
4906#ASF_Header_Extension_Object
4907>0	guid	5FBF03B5-A92E-11CF-8EE3-00C00C205365
4908# ASF_Codec_List_Object
4909>0	guid	86D15240-311D-11D0-A3A4-00A0C90348F6
4910>0	guid	1EFB1A30-0B62-11D0-A39B-00A0C90348F6 ASF_Script_Command_Object
4911>0	guid	F487CD01-A951-11CF-8EE6-00C00C205365 ASF_Marker_Object
4912>0	guid	D6E229DC-35DA-11D1-9034-00A0C90349BE ASF_Bitrate_Mutual_Exclusion_Object
4913>0	guid	75B22635-668E-11CF-A6D9-00AA0062CE6C ASF_Error_Correction_Object
4914# ASF_Content_Description_Object
4915>0	guid	75B22633-668E-11CF-A6D9-00AA0062CE6C
4916#>>24	leshort	title length %d
4917#>>26	leshort	author length %d
4918#>>28	leshort	copyright length %d
4919#>>30	leshort	descriptor length %d
4920#>>32	leshort	rating length %d
4921>0	guid	D2D0A440-E307-11D2-97F0-00A0C95EA850 ASF_Extended_Content_Description_Object
4922>0	guid	2211B3FA-BD23-11D2-B4B7-00A0C955FC6E ASF_Content_Branding_Object
4923>0	guid	7BF875CE-468D-11D1-8D82-006097C9A2B2 ASF_Stream_Bitrate_Properties_Object
4924>0	guid	2211B3FB-BD23-11D2-B4B7-00A0C955FC6E ASF_Content_Encryption_Object
4925>0	guid	298AE614-2622-4C17-B935-DAE07EE9289C ASF_Extended_Content_Encryption_Object
4926>0	guid	2211B3FC-BD23-11D2-B4B7-00A0C955FC6E ASF_Digital_Signature_Object
4927# ASF_Padding_Object
4928>0	guid	1806D474-CADF-4509-A4BA-9AABCB96AAE8
4929>0	guid	14E6A5CB-C672-4332-8399-A96952065B5A ASF_Extended_Stream_Properties_Object
4930>0	guid	A08649CF-4775-4670-8A16-6E35357566CD ASF_Advanced_Mutual_Exclusion_Object
4931>0	guid	D1465A40-5A79-4338-B71B-E36B8FD6C249 ASF_Group_Mutual_Exclusion_Object
4932>0	guid	D4FED15B-88D3-454F-81F0-ED5C45999E24 ASF_Stream_Prioritization_Object
4933>0	guid	A69609E6-517B-11D2-B6AF-00C04FD908E9 ASF_Bandwidth_Sharing_Object
4934>0	guid	7C4346A9-EFE0-4BFC-B229-393EDE415C85 ASF_Language_List_Object
4935>0	guid	C5F8CBEA-5BAF-4877-8467-AA8C44FA4CCA ASF_Metadata_Object
4936>0	guid	44231C94-9498-49D1-A141-1D134E457054 ASF_Metadata_Library_Object
4937>0	guid	D6E229DF-35DA-11D1-9034-00A0C90349BE ASF_Index_Parameters_Object
4938>0	guid	6B203BAD-3F11-48E4-ACA8-D7613DE2CFA7 ASF_Media_Object_Index_Parameters_Object
4939>0	guid	F55E496D-9797-4B5D-8C8B-604DFE9BFB24 ASF_Timecode_Index_Parameters_Object
4940>0	guid	26F18B5D-4584-47EC-9F5F-0E651F0452C9 ASF_Compatibility_Object
4941>0	guid	43058533-6981-49E6-9B74-AD12CB86D58C ASF_Advanced_Content_Encryption_Object
4942>0	guid	59DACFC0-59E6-11D0-A3AC-00A0C90348F6 ASF_Command_Media
4943>0	guid	B61BE100-5B4E-11CF-A8FD-00805F5C442B ASF_JFIF_Media
4944>0	guid	35907DE0-E415-11CF-A917-00805F5C442B ASF_Degradable_JPEG_Media
4945>0	guid	91BD222C-F21C-497A-8B6D-5AA86BFC0185 ASF_File_Transfer_Media
4946>0	guid	3AFB65E2-47EF-40F2-AC2C-70A90D71D343 ASF_Binary_Media
4947>0	guid	776257D4-C627-41CB-8F81-7AC7FF1C40CC ASF_Web_Stream_Media_Subtype
4948>0	guid	DA1E6B13-8359-4050-B398-388E965BF00C ASF_Web_Stream_Format
4949>0	guid	20FB5700-5B55-11CF-A8FD-00805F5C442B ASF_No_Error_Correction
4950>0	guid	BFC3CD50-618F-11CF-8BB2-00AA00B4E220 ASF_Audio_Spread
4951>0	guid	ABD3D211-A9BA-11cf-8EE6-00C00C205365 ASF_Reserved_1
4952>0	guid	7A079BB6-DAA4-4e12-A5CA-91D38DC11A8D ASF_Content_Encryption_System_Windows_Media_DRM
4953# _Network_Devices
4954>0	guid	86D15241-311D-11D0-A3A4-00A0C90348F6 ASF_Reserved_2
4955>0	guid	4B1ACBE3-100B-11D0-A39B-00A0C90348F6 ASF_Reserved_3
4956>0	guid	4CFEDB20-75F6-11CF-9C0F-00A0C90349CB ASF_Reserved_4
4957>0	guid	D6E22A00-35DA-11D1-9034-00A0C90349BE ASF_Mutex_Language
4958>0	guid	D6E22A01-35DA-11D1-9034-00A0C90349BE ASF_Mutex_Bitrate
4959>0	guid	D6E22A02-35DA-11D1-9034-00A0C90349BE ASF_Mutex_Unknown
4960>0	guid	AF6060AA-5197-11D2-B6AF-00C04FD908E9 ASF_Bandwidth_Sharing_Exclusive
4961>0	guid	AF6060AB-5197-11D2-B6AF-00C04FD908E9 ASF_Bandwidth_Sharing_Partial
4962>0	guid	399595EC-8667-4E2D-8FDB-98814CE76C1E ASF_Payload_Extension_System_Timecode
4963>0	guid	E165EC0E-19ED-45D7-B4A7-25CBD1E28E9B ASF_Payload_Extension_System_File_Name
4964>0	guid	D590DC20-07BC-436C-9CF7-F3BBFBF1A4DC ASF_Payload_Extension_System_Content_Type
4965>0	guid	1B1EE554-F9EA-4BC8-821A-376B74E4C4B8 ASF_Payload_Extension_System_Pixel_Aspect_Ratio
4966>0	guid	C6BD9450-867F-4907-83A3-C77921B733AD ASF_Payload_Extension_System_Sample_Duration
4967>0	guid	6698B84E-0AFA-4330-AEB2-1C0A98D7A44D ASF_Payload_Extension_System_Encryption_Sample_ID
4968>0	guid	00E1AF06-7BEC-11D1-A582-00C04FC29CFB ASF_Payload_Extension_System_Degradable_JPEG
4969
49700	name	asf-object
4971>0	use	asf-name
4972#>>16	lequad	>0					(size %lld) [
4973>>16	lequad	>0
4974>>>(16.q)	use	asf-object
4975#>>16	lequad	0	]
4976
4977# Microsoft Advanced Streaming Format (ASF) <mpruett@sgi.com>
49780	guid	75B22630-668E-11CF-A6D9-00AA0062CE6C	Microsoft ASF
4979!:mime  video/x-ms-asf
4980#>16	lequad	>0					(size %lld
4981#>>24	lelong	x					\b, %d header objects)
4982>16	lequad	>0
4983>>30	use	asf-object
4984>>(16.q)	use	asf-object
4985#------------------------------------------------------------------------------
4986# $File: assembler,v 1.6 2013/12/11 14:14:20 christos Exp $
4987# make:  file(1) magic for assembler source
4988#
49890	regex	\^[\040\t]{0,50}\\.asciiz		assembler source text
4990!:mime	text/x-asm
49910	regex	\^[\040\t]{0,50}\\.byte		assembler source text
4992!:mime	text/x-asm
49930	regex	\^[\040\t]{0,50}\\.even		assembler source text
4994!:mime	text/x-asm
49950	regex	\^[\040\t]{0,50}\\.globl		assembler source text
4996!:mime	text/x-asm
49970	regex	\^[\040\t]{0,50}\\.text		assembler source text
4998!:mime	text/x-asm
49990	regex	\^[\040\t]{0,50}\\.file		assembler source text
5000!:mime	text/x-asm
50010	regex	\^[\040\t]{0,50}\\.type		assembler source text
5002!:mime	text/x-asm
5003
5004#------------------------------------------------------------------------------
5005# $File: asterix,v 1.5 2009/09/19 16:28:08 christos Exp $
5006# asterix:  file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character
5007# strings as "long" - we assume they're just strings:
5008# From: guy@netapp.com (Guy Harris)
5009#
50100	string		*STA		Aster*x
5011>7	string		WORD			Words Document
5012>7	string		GRAP			Graphic
5013>7	string		SPRE			Spreadsheet
5014>7	string		MACR			Macro
50150	string		2278		Aster*x Version 2
5016>29	byte		0x36			Words Document
5017>29	byte		0x35			Graphic
5018>29	byte		0x32			Spreadsheet
5019>29	byte		0x38			Macro
5020
5021
5022#------------------------------------------------------------------------------
5023# $File: att3b,v 1.10 2017/03/17 21:35:28 christos Exp $
5024# att3b:  file(1) magic for AT&T 3B machines
5025#
5026# The `versions' should be un-commented if they work for you.
5027# (Was the problem just one of endianness?)
5028#
5029# 3B20
5030#
5031# The 3B20 conflicts with SCCS.
5032#0	beshort		0550		3b20 COFF executable
5033#>12	belong		>0		not stripped
5034#>22	beshort		>0		- version %d
5035#0	beshort		0551		3b20 COFF executable (TV)
5036#>12	belong		>0		not stripped
5037#>22	beshort		>0		- version %d
5038#
5039# WE32K
5040#
50410	beshort		0560		WE32000 COFF
5042>18	beshort		^00000020	object
5043>18	beshort		&00000020	executable
5044>12	belong		>0		not stripped
5045>18	beshort		^00010000	N/A on 3b2/300 w/paging
5046>18	beshort		&00020000	32100 required
5047>18	beshort		&00040000	and MAU hardware required
5048>20	beshort		0407		(impure)
5049>20	beshort		0410		(pure)
5050>20	beshort		0413		(demand paged)
5051>20	beshort		0443		(target shared library)
5052>22	beshort		>0		- version %d
50530	beshort		0561		WE32000 COFF executable (TV)
5054>12	belong		>0		not stripped
5055#>18	beshort		&00020000	- 32100 required
5056#>18	beshort		&00040000	and MAU hardware required
5057#>22	beshort		>0		- version %d
5058#
5059# core file for 3b2
50600	string		\000\004\036\212\200	3b2 core file
5061>364	string		>\0		of '%s'
5062
5063#------------------------------------------------------------------------------
5064# $File: audio,v 1.124 2022/08/28 08:58:20 christos Exp $
5065# audio:  file(1) magic for sound formats (see also "iff")
5066#
5067# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
5068# and others
5069#
5070
5071# Sun/NeXT audio data
50720	string		.snd		Sun/NeXT audio data:
5073>12	belong		1		8-bit ISDN mu-law,
5074!:mime	audio/basic
5075>12	belong		2		8-bit linear PCM [REF-PCM],
5076!:mime	audio/basic
5077>12	belong		3		16-bit linear PCM,
5078!:mime	audio/basic
5079>12	belong		4		24-bit linear PCM,
5080!:mime	audio/basic
5081>12	belong		5		32-bit linear PCM,
5082!:mime	audio/basic
5083>12	belong		6		32-bit IEEE floating point,
5084!:mime	audio/basic
5085>12	belong		7		64-bit IEEE floating point,
5086!:mime	audio/basic
5087>12	belong		8		Fragmented sample data,
5088>12	belong		10		DSP program,
5089>12	belong		11		8-bit fixed point,
5090>12	belong		12		16-bit fixed point,
5091>12	belong		13		24-bit fixed point,
5092>12	belong		14		32-bit fixed point,
5093>12	belong		18		16-bit linear with emphasis,
5094>12	belong		19		16-bit linear compressed,
5095>12	belong		20		16-bit linear with emphasis and compression,
5096>12	belong		21		Music kit DSP commands,
5097>12	belong		23		8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.),
5098!:mime  audio/x-adpcm
5099>12	belong		24		compressed (8-bit CCITT G.722 ADPCM)
5100>12	belong		25		compressed (3-bit CCITT G.723.3 ADPCM),
5101>12	belong		26		compressed (5-bit CCITT G.723.5 ADPCM),
5102>12	belong		27		8-bit A-law (CCITT G.711),
5103>20	belong		1		mono,
5104>20	belong		2		stereo,
5105>20	belong		4		quad,
5106>16	belong		>0		%d Hz
5107
5108# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format
5109# that uses little-endian encoding and has a different magic number
51100	lelong		0x0064732E	DEC audio data:
5111>12	lelong		1		8-bit ISDN mu-law,
5112!:mime	audio/x-dec-basic
5113>12	lelong		2		8-bit linear PCM [REF-PCM],
5114!:mime	audio/x-dec-basic
5115>12	lelong		3		16-bit linear PCM,
5116!:mime	audio/x-dec-basic
5117>12	lelong		4		24-bit linear PCM,
5118!:mime	audio/x-dec-basic
5119>12	lelong		5		32-bit linear PCM,
5120!:mime	audio/x-dec-basic
5121>12	lelong		6		32-bit IEEE floating point,
5122!:mime	audio/x-dec-basic
5123>12	lelong		7		64-bit IEEE floating point,
5124!:mime	audio/x-dec-basic
5125>12	belong		8		Fragmented sample data,
5126>12	belong		10		DSP program,
5127>12	belong		11		8-bit fixed point,
5128>12	belong		12		16-bit fixed point,
5129>12	belong		13		24-bit fixed point,
5130>12	belong		14		32-bit fixed point,
5131>12	belong		18		16-bit linear with emphasis,
5132>12	belong		19		16-bit linear compressed,
5133>12	belong		20		16-bit linear with emphasis and compression,
5134>12	belong		21		Music kit DSP commands,
5135>12	lelong		23		8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.),
5136!:mime	audio/x-dec-basic
5137>12	belong		24		compressed (8-bit CCITT G.722 ADPCM)
5138>12	belong		25		compressed (3-bit CCITT G.723.3 ADPCM),
5139>12	belong		26		compressed (5-bit CCITT G.723.5 ADPCM),
5140>12	belong		27		8-bit A-law (CCITT G.711),
5141>20	lelong		1		mono,
5142>20	lelong		2		stereo,
5143>20	lelong		4		quad,
5144>16	lelong		>0		%d Hz
5145
5146# Creative Labs AUDIO stuff
51470	string	MThd			Standard MIDI data
5148!:mime	audio/midi
5149>8 	beshort	x			(format %d)
5150>10	beshort	x			using %d track
5151>10	beshort		>1		\bs
5152>12	beshort&0x7fff	x		at 1/%d
5153>12	beshort&0x8000	>0		SMPTE
5154
51550	string	CTMF			Creative Music (CMF) data
5156!:mime	audio/x-unknown
51570	string	SBI			SoundBlaster instrument data
5158!:mime	audio/x-unknown
51590	string	Creative\ Voice\ File	Creative Labs voice data
5160!:mime	audio/x-unknown
5161# is this next line right?  it came this way...
5162>19	byte	0x1A
5163>23	byte	>0			- version %d
5164>22	byte	>0			\b.%d
5165
5166# first entry is also the string "NTRK"
51670	belong		0x4e54524b	MultiTrack sound data
5168>4	belong		x		- version %d
5169
5170# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED
5171# [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi]
51720	string		EMOD		Extended MOD sound data,
5173>4	byte&0xf0	x		version %d
5174>4	byte&0x0f	x		\b.%d,
5175>45	byte		x		%d instruments
5176>83	byte		0		(module)
5177>83	byte		1		(song)
5178
5179# Real Audio (Magic .ra\0375)
51800	belong		0x2e7261fd	RealAudio sound file
5181!:mime	audio/x-pn-realaudio
51820	string		.RMF\0\0\0	RealMedia file
5183!:mime	application/vnd.rn-realmedia
5184#video/x-pn-realvideo
5185#video/vnd.rn-realvideo
5186#application/vnd.rn-realmedia
5187#	sigh, there are many mimes for that but the above are the most common.
5188
5189# MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net]
5190# Oct 31, 1995
5191# fixed by <doj@cubic.org> 2003-06-24
5192# Too short...
5193#0	string		MTM		MultiTracker Module sound file
5194#0	string		if		Composer 669 Module sound data
5195#0	string		JN		Composer 669 Module sound data (extended format)
51960	string		MAS_U		ULT(imate) Module sound data
5197
5198#0	string		FAR		Module sound data
5199#>4	string		>\15		Title: "%s"
5200
52010x2c	string		SCRM		ScreamTracker III Module sound data
5202>0	string		>\0		Title: "%s"
5203!:mime	audio/x-s3m
5204
5205# .stm before it got above .s3m extension
52060x16	string		\!Scream\!	ScreamTracker Module sound data
5207>0	string		>\0		Title: "%s"
5208
5209# Gravis UltraSound patches
5210# From <ache@nagual.ru>
5211
52120	string		GF1PATCH110\0ID#000002\0	GUS patch
52130	string		GF1PATCH100\0ID#000002\0	Old GUS	patch
5214
5215# mime types according to http://www.geocities.com/nevilo/mod.htm:
5216#	audio/it	.it
5217#	audio/x-zipped-it	.itz
5218#	audio/xm	fasttracker modules
5219#	audio/x-s3m	screamtracker modules
5220#	audio/s3m	screamtracker modules
5221#	audio/x-zipped-mod	mdz
5222#	audio/mod	mod
5223#	audio/x-mod	All modules (mod, s3m, 669, mtm, med, xm, it, mdz, stm, itz, xmz, s3z)
5224
5225#
5226# Taken from loader code from mikmod version 2.14
5227# by Steve McIntyre (stevem@chiark.greenend.org.uk)
5228# <doj@cubic.org> added title printing on 2003-06-24
52290	string	MAS_UTrack_V00
5230>14	string	>/0		ultratracker V1.%.1s module sound data
5231!:mime	audio/x-mod
5232#audio/x-tracker-module
5233
52340	string	UN05		MikMod UNI format module sound data
5235
52360	string	Extended\ Module: Fasttracker II module sound data
5237!:mime	audio/x-mod
5238#audio/x-tracker-module
5239>17	string	>\0		Title: "%s"
5240
524121	string/c	=!SCREAM!	Screamtracker 2 module sound data
5242!:mime	audio/x-mod
5243#audio/x-screamtracker-module
524421	string	BMOD2STM	Screamtracker 2 module sound data
5245!:mime	audio/x-mod
5246#audio/x-screamtracker-module
52471080	string	M.K.		4-channel Protracker module sound data
5248!:mime	audio/x-mod
5249#audio/x-protracker-module
5250>0	string	>\0		Title: "%s"
52511080	string	M!K!		4-channel Protracker module sound data
5252!:mime	audio/x-mod
5253#audio/x-protracker-module
5254>0	string	>\0		Title: "%s"
52551080	string	FLT4		4-channel Startracker module sound data
5256!:mime	audio/x-mod
5257#audio/x-startracker-module
5258>0	string	>\0		Title: "%s"
52591080	string	FLT8		8-channel Startracker module sound data
5260!:mime	audio/x-mod
5261#audio/x-startracker-module
5262>0	string	>\0		Title: "%s"
52631080	string	4CHN		4-channel Fasttracker module sound data
5264!:mime	audio/x-mod
5265#audio/x-fasttracker-module
5266>0	string	>\0		Title: "%s"
52671080	string	6CHN		6-channel Fasttracker module sound data
5268!:mime	audio/x-mod
5269#audio/x-fasttracker-module
5270>0	string	>\0		Title: "%s"
52711080	string	8CHN		8-channel Fasttracker module sound data
5272!:mime	audio/x-mod
5273#audio/x-fasttracker-module
5274>0	string	>\0		Title: "%s"
52751080	string	CD81		8-channel Octalyser module sound data
5276!:mime	audio/x-mod
5277#audio/x-octalysertracker-module
5278>0	string	>\0		Title: "%s"
52791080	string	OKTA		8-channel Octalyzer module sound data
5280!:mime	audio/x-mod
5281#audio/x-octalysertracker-module
5282>0	string	>\0		Title: "%s"
5283# Not good enough.
5284#1082	string	CH
5285#>1080	string	>/0		%.2s-channel Fasttracker "oktalyzer" module sound data
52861080	string	16CN		16-channel Taketracker module sound data
5287!:mime	audio/x-mod
5288#audio/x-taketracker-module
5289>0	string	>\0		Title: "%s"
52901080	string	32CN		32-channel Taketracker module sound data
5291!:mime	audio/x-mod
5292#audio/x-taketracker-module
5293>0	string	>\0		Title: "%s"
5294
5295# TOC sound files -Trevor Johnson <trevor@jpj.net>
5296#
52970       string          TOC             TOC sound file
5298
5299# sidfiles <pooka@iki.fi>
5300# added name,author,(c) and new RSID type by <doj@cubic.org> 2003-06-24
53010	string		SIDPLAY\ INFOFILE	Sidplay info file
5302
53030	string		PSID			PlaySID v2.2+ (AMIGA) sidtune
5304>4	beshort		>0			w/ header v%d,
5305>14	beshort		=1			single song,
5306>14	beshort		>1			%d songs,
5307>16	beshort		>0			default song: %d
5308>0x16	string		>\0			name: "%s"
5309>0x36	string		>\0			author: "%s"
5310>0x56	string		>\0			copyright: "%s"
5311
53120	string		RSID			RSID sidtune PlaySID compatible
5313>4	beshort		>0			w/ header v%d,
5314>14	beshort		=1			single song,
5315>14	beshort		>1			%d songs,
5316>16	beshort		>0			default song: %d
5317>0x16	string		>\0			name: "%s"
5318>0x36	string		>\0			author: "%s"
5319>0x56	string		>\0			copyright: "%s"
5320
5321# IRCAM sound files - Michael Pruett <michael@68k.org>
5322# http://www-mmsp.ece.mcgill.ca/documents/AudioFormats/IRCAM/IRCAM.html
53230	belong		0x64a30100		IRCAM file (VAX little-endian)
53240	belong		0x0001a364		IRCAM file (VAX big-endian)
53250	belong		0x64a30200		IRCAM file (Sun big-endian)
53260	belong		0x0002a364		IRCAM file (Sun little-endian)
53270	belong		0x64a30300		IRCAM file (MIPS little-endian)
53280	belong		0x0003a364		IRCAM file (MIPS big-endian)
53290	belong		0x64a30400		IRCAM file (NeXT big-endian)
53300	belong		0x64a30400		IRCAM file (NeXT big-endian)
53310	belong		0x0004a364		IRCAM file (NeXT little-endian)
5332
5333# NIST SPHERE <mpruett@sgi.com>
53340	string		NIST_1A\n\ \ \ 1024\n	NIST SPHERE file
5335
5336# Sample Vision <mpruett@sgi.com>
53370	string		SOUND\ SAMPLE\ DATA\ 	Sample Vision file
5338
5339# Audio Visual Research <tonigonenstein@users.sourceforge.net>
53400	string		2BIT			Audio Visual Research file,
5341>12	beshort		=0			mono,
5342>12	beshort		=-1			stereo,
5343>14	beshort		x			%d bits
5344>16	beshort		=0			unsigned,
5345>16	beshort		=-1			signed,
5346>22	belong&0x00ffffff	x		%d Hz,
5347>18	beshort		=0			no loop,
5348>18	beshort		=-1			loop,
5349>21	ubyte		<128			note %d,
5350>22	byte		=0			replay 5.485 KHz
5351>22	byte		=1			replay 8.084 KHz
5352>22	byte		=2			replay 10.971 KHz
5353>22	byte		=3			replay 16.168 KHz
5354>22	byte		=4			replay 21.942 KHz
5355>22	byte		=5			replay 32.336 KHz
5356>22	byte		=6			replay 43.885 KHz
5357>22	byte		=7			replay 47.261 KHz
5358
5359# SGI SoundTrack <mpruett@sgi.com>
53600	string		_SGI_SoundTrack		SGI SoundTrack project file
5361# ID3 version 2 tags <waschk@informatik.uni-rostock.de>
53620	string		ID3	Audio file with ID3 version 2
5363>3	byte		x	\b.%d
5364>4	byte		x	\b.%d
5365>>5	byte		&0x80	\b, unsynchronized frames
5366>>5	byte		&0x40	\b, extended header
5367>>5	byte		&0x20	\b, experimental
5368>>5	byte		&0x10	\b, footer present
5369>(6.I+10)	indirect	x	\b, contains:
5370
5371# NSF (NES sound file) magic
53720	string		NESM\x1a	NES Sound File
5373>14	string		>\0		("%s" by
5374>46	string		>\0		%s, copyright
5375>78	string		>\0		%s),
5376>5	byte		x		version %d,
5377>6	byte		x		%d tracks,
5378>122	byte&0x2	=1		dual PAL/NTSC
5379>122	byte&0x1	=1		PAL
5380>122	byte&0x1	=0		NTSC
5381
5382# NSFE (Extended NES sound file) magic
5383# http://slickproductions.org/docs/NSF/nsfespec.txt
5384# From: David Pflug <david@pflug.email>
53850	string		NSFE		Extended NES Sound File
5386>48	search/0x1000	auth
5387>>&0	string		>\0		("%s"
5388>>>&1	string		>\0		by %s
5389>>>>&1	string		>\0		\b, copyright %s
5390>>>>>&1	string		>\0		\b, ripped by %s
5391>20	byte		x		\b), %d tracks,
5392>18	byte&0x2	=1		dual PAL/NTSC
5393>18     byte&0x2	=0
5394>>18	byte&0x1	=1		PAL
5395>>18	byte&0x1	=0		NTSC
5396
5397# Type: SNES SPC700 sound files
5398# From: Josh Triplett <josh@freedesktop.org>
53990	string	SNES-SPC700\ Sound\ File\ Data\ v	SNES SPC700 sound file
5400>&0	string	0.30					\b, version %s
5401>>0x23	byte	0x1B					\b, without ID666 tag
5402>>0x23	byte	0x1A					\b, with ID666 tag
5403>>>0x2E	string	>\0					\b, song "%.32s"
5404>>>0x4E	string	>\0					\b, game "%.32s"
5405
5406# Impulse tracker module (audio/x-it)
54070	string		IMPM		Impulse Tracker module sound data -
5408!:mime	audio/x-mod
5409>4	string		>\0		"%s"
5410>40	leshort		!0		compatible w/ITv%x
5411>42	leshort		!0		created w/ITv%x
5412
5413# Imago Orpheus module (audio/x-imf)
541460	string		IM10		Imago Orpheus module sound data -
5415>0	string		>\0		"%s"
5416
5417# From <collver1@attbi.com>
5418# These are the /etc/magic entries to decode modules, instruments, and
5419# samples in Impulse Tracker's native format.
5420
54210	string		IMPS		Impulse Tracker Sample
5422>18	byte		&2		16 bit
5423>18	byte		^2		8 bit
5424>18	byte		&4		stereo
5425>18	byte		^4		mono
54260	string		IMPI		Impulse Tracker Instrument
5427>28	leshort		!0		ITv%x
5428>30	byte		!0		%d samples
5429
5430# Yamaha TX Wave:  file(1) magic for Yamaha TX Wave audio files
5431# From <collver1@attbi.com>
54320	string		LM8953		Yamaha TX Wave
5433>22	byte		0x49		looped
5434>22	byte		0xC9		non-looped
5435>23	byte		1		33kHz
5436>23	byte		2		50kHz
5437>23	byte		3		16kHz
5438
5439# scream tracker:  file(1) magic for Scream Tracker sample files
5440#
5441# From <collver1@attbi.com>
544276	string		SCRS		Scream Tracker Sample
5443>0	byte		1		sample
5444>0	byte		2		adlib melody
5445>0	byte		>2		adlib drum
5446>31	byte		&2		stereo
5447>31	byte		^2		mono
5448>31	byte		&4		16bit little endian
5449>31	byte		^4		8bit
5450>30	byte		0		unpacked
5451>30	byte		1		packed
5452
5453# audio
5454# From: Cory Dikkers <cdikkers@swbell.net>
54550	string		MMD0		MED music file, version 0
54560	string		MMD1		OctaMED Pro music file, version 1
54570	string		MMD3		OctaMED Soundstudio music file, version 3
54580	string		OctaMEDCmpr	OctaMED Soundstudio compressed file
54590	string		MED		MED_Song
54600	string		SymM		Symphonie SymMOD music file
5461#
5462# Track Length (TRL), Tracks (TRK), Samples (SMP), Subsongs (SS)
5463# http://lclevy.free.fr/exotica/ahx/ahxformat.txt
54640	string		THX		AHX version
5465>3	byte		=0		1 module data
5466>3	byte		=1		2 module data
5467>11	ubyte		x		TRK: %u
5468>10	ubyte		x		TRL: %u
5469>12	ubyte		x		SMP: %u
5470>13	ubyte		x		SS: %u
5471>(4.H)		string		x		Title: "%.128s"
5472
5473# header is mostly AHX format
54740		string		HVL
5475>3		byte		<2	Hively Tracker Song
5476>3		byte		=0		v1 module data
5477>3		byte		=1		v2 module data
5478>11		ubyte		x		TRK: %u
5479>10		ubyte		x		TRL: %u
5480>12		ubyte		x		SMP: %u
5481>13		ubyte		x		SS: %u
5482>8		ubyte/4		=0		CHN: 4
5483>8		ubyte/4		>0		CHN: 4+%u
5484#>-0		offset		<0xffff
5485>(4.H)		string		x		Title: "%.128s"
5486
5487#
54880	string		OKTASONG	Oktalyzer module data
5489#
54900	string		DIGI\ Booster\ module\0	%s
5491>20	byte		>0		%c
5492>>21	byte		>0		\b%c
5493>>>22	byte		>0		\b%c
5494>>>>23	byte		>0		\b%c
5495>610	string		>\0		\b, "%s"
5496#
54970	string		DBM0	   	DIGI Booster Pro Module
5498>4	byte		>0		V%X.
5499>>5	byte		x		\b%02X
5500>16	string		>\0		\b, "%s"
5501#
55020	string		FTMN		FaceTheMusic module
5503>16	string		>\0d		\b, "%s"
5504
5505# From: <doj@cubic.org> 2003-06-24
55060	string		AMShdr\32	Velvet Studio AMS Module v2.2
55070	string		Extreme		Extreme Tracker AMS Module v1.3
55080	string		DDMF		Xtracker DMF Module
5509>4	byte		x		v%i
5510>0xD	string		>\0		Title: "%s"
5511>0x2B	string		>\0		Composer: "%s"
55120	string		DSM\32		Dynamic Studio Module DSM
55130	string		SONG		DigiTrekker DTM Module
55140	string		DMDL		DigiTrakker MDL Module
55150	string		PSM\32		Protracker Studio PSM Module
551644	string		PTMF		Poly Tracker PTM Module
5517>0	string		>\32		Title: "%s"
55180	string		MT20		MadTracker 2.0 Module MT2
55190	string		RAD\40by\40REALiTY!! RAD Adlib Tracker Module RAD
55200	string		RTMM		RTM Module
55210x426	string		MaDoKaN96	XMS Adlib Module
5522>0	string		>\0		Composer: "%s"
55230	string		AMF		AMF Module
5524>4	string		>\0		Title: "%s"
55250	string		MODINFO1	Open Cubic Player Module Information MDZ
55260	string		Extended\40Instrument: Fast Tracker II Instrument
5527
5528# From: Takeshi Hamasaki <hma@syd.odn.ne.jp>
5529# NOA Nancy Codec file
55300	string		\210NOA\015\012\032	NOA Nancy Codec Movie file
5531# Yamaha SMAF format
55320	string		MMMD		Yamaha SMAF file
5533# Sharp Jisaku Melody format for PDC
55340	string		\001Sharp\040JisakuMelody	SHARP Cell-Phone ringing Melody
5535>20	string		Ver01.00	Ver. 1.00
5536>>32	byte		x		, %d tracks
5537
5538# Free lossless audio codec <http://flac.sourceforge.net>
5539# From: Przemyslaw Augustyniak <silvathraec@rpg.pl>
55400	string			fLaC		FLAC audio bitstream data
5541!:mime	audio/flac
5542>4	byte&0x7f		>0		\b, unknown version
5543>4	byte&0x7f		0		\b
5544# some common bits/sample values
5545>>20	beshort&0x1f0		0x030		\b, 4 bit
5546>>20	beshort&0x1f0		0x050		\b, 6 bit
5547>>20	beshort&0x1f0		0x070		\b, 8 bit
5548>>20	beshort&0x1f0		0x0b0		\b, 12 bit
5549>>20	beshort&0x1f0		0x0f0		\b, 16 bit
5550>>20	beshort&0x1f0		0x170		\b, 24 bit
5551>>20	byte&0xe		0x0		\b, mono
5552>>20	byte&0xe		0x2		\b, stereo
5553>>20	byte&0xe		0x4		\b, 3 channels
5554>>20	byte&0xe		0x6		\b, 4 channels
5555>>20	byte&0xe		0x8		\b, 5 channels
5556>>20	byte&0xe		0xa		\b, 6 channels
5557>>20	byte&0xe		0xc		\b, 7 channels
5558>>20	byte&0xe		0xe		\b, 8 channels
5559# sample rates derived from known oscillator frequencies;
5560# 24.576 MHz (video/fs=48kHz), 22.5792 (audio/fs=44.1kHz) and
5561# 16.384 (other/fs=32kHz).
5562>>17	belong&0xfffff0       	0x02b110	\b, 11.025 kHz
5563>>17	belong&0xfffff0       	0x03e800	\b, 16 kHz
5564>>17	belong&0xfffff0       	0x056220	\b, 22.05 kHz
5565>>17	belong&0xfffff0       	0x05dc00	\b, 24 kHz
5566>>17	belong&0xfffff0       	0x07d000	\b, 32 kHz
5567>>17	belong&0xfffff0       	0x0ac440	\b, 44.1 kHz
5568>>17	belong&0xfffff0       	0x0bb800	\b, 48 kHz
5569>>17	belong&0xfffff0       	0x0fa000	\b, 64 kHz
5570>>17	belong&0xfffff0       	0x158880	\b, 88.2 kHz
5571>>17	belong&0xfffff0       	0x177000	\b, 96 kHz
5572>>17	belong&0xfffff0       	0x1f4000	\b, 128 kHz
5573>>17	belong&0xfffff0       	0x2b1100	\b, 176.4 kHz
5574>>17	belong&0xfffff0       	0x2ee000	\b, 192 kHz
5575>>17	belong&0xfffff0       	0x3e8000	\b, 256 kHz
5576>>17	belong&0xfffff0       	0x562200	\b, 352.8 kHz
5577>>17	belong&0xfffff0       	0x5dc000	\b, 384 kHz
5578>>21	byte&0xf		>0		\b, >4G samples
5579>>21	byte&0xf		0		\b
5580>>>22	belong			>0		\b, %u samples
5581>>>22	belong			0		\b, length unknown
5582
5583# (ISDN) VBOX voice message file (Wolfram Kleff)
55840       string          VBOX            VBOX voice message data
5585
5586# ReBorn Song Files (.rbs)
5587# David J. Singer <doc@deadvirgins.org.uk>
55888       string          RB40             RBS Song file
5589>29     string          ReBorn           created by ReBorn
5590>37     string          Propellerhead    created by ReBirth
5591
5592# Synthesizer Generator and Kimwitu share their file format
55930	string		A#S#C#S#S#L#V#3	    Synthesizer Generator or Kimwitu data
5594# Kimwitu++ uses a slightly different magic
55950	string		A#S#C#S#S#L#HUB	    Kimwitu++ data
5596
5597# From "Simon Hosie
55980       string  TFMX-SONG       TFMX module sound data
5599
5600# Monkey's Audio compressed audio format (.ape)
5601# From danny.milo@gmx.net (Danny Milosavljevic)
5602# New version from Abel Cheung <abel (@) oaka.org>
56030		string		MAC\040		Monkey's Audio compressed format
5604!:mime audio/x-ape
5605>4		uleshort	>0x0F8B		version %d
5606>>(0x08.l)	uleshort	=1000		with fast compression
5607>>(0x08.l)	uleshort	=2000		with normal compression
5608>>(0x08.l)	uleshort	=3000		with high compression
5609>>(0x08.l)	uleshort	=4000		with extra high compression
5610>>(0x08.l)	uleshort	=5000		with insane compression
5611>>(0x08.l+18)	uleshort	=1		\b, mono
5612>>(0x08.l+18)	uleshort	=2		\b, stereo
5613>>(0x08.l+20)	ulelong		x		\b, sample rate %d
5614>4		uleshort	<0x0F8C		version %d
5615>>6		uleshort	=1000		with fast compression
5616>>6		uleshort	=2000		with normal compression
5617>>6		uleshort	=3000		with high compression
5618>>6		uleshort	=4000		with extra high compression
5619>>6		uleshort	=5000		with insane compression
5620>>10		uleshort	=1		\b, mono
5621>>10		uleshort	=2		\b, stereo
5622>>12		ulelong		x		\b, sample rate %d
5623
5624# adlib sound files
5625# From: Alex Myczko <alex@aiei.ch>
5626
5627# https://github.com/rerrahkr/BambooTracker
56280	string	BambooTracker	BambooTracker
5629>13	string	Mod		Module
5630>13	string	Ist		Instrument
5631>13	string	Bnk		Bank
5632>22	byte	x		\b, version %u
5633>21	byte	x		\b.%u
5634>20	byte	x		\b.%u
5635
56360	string		CC2x		CheeseCutter 2 song
5637
56380    	string		RAWADATA	RdosPlay RAW
5639
56401068	string		RoR		AMUSIC Adlib Tracker
5641
56420	string		JCH		EdLib
5643
56440	string		mpu401tr	MPU-401 Trakker
5645
56460	string		SAdT		Surprise! Adlib Tracker
5647>4	byte		x		Version %d
5648
56490	string		XAD!		eXotic ADlib
5650
56510	string		ofTAZ!		eXtra Simple Music
5652
56530	string		FMK!		FM Kingtracker Song
5654
56550	string		DFM		DFM Song
5656
56570	string		\<CUD-FM-File\>	CFF Song
5658
56590	string		_A2module	A2M Song
5660
5661# Spectrum 128 tunes (.ay files).
5662# From: Emanuel Haupt <ehaupt@critical.ch>
56630	string		ZXAYEMUL	Spectrum 128 tune
5664
56650	string		\0BONK		BONK,
5666#>5	byte		x		version %d
5667>14	byte		x		%d channel(s),
5668>15	byte		=1		lossless,
5669>15	byte		=0		lossy,
5670>16	byte		x		mid-side
5671
5672384	string		LockStream	LockStream Embedded file (mostly MP3 on old Nokia phones)
5673
5674# format VQF (proprietary codec for sound)
5675# some infos on the header file available at :
5676# http://www.twinvq.org/english/technology_format.html
56770	string		TWIN97012000	VQF data
5678>27	short		0		\b, Mono
5679>27	short		1		\b, Stereo
5680>31	short 		>0		\b, %d kbit/s
5681>35	short 		>0		\b, %d kHz
5682
5683# Nelson A. de Oliveira (naoliv@gmail.com)
5684# .eqf
56850	string	Winamp\ EQ\ library\ file	%s
5686# it will match only versions like v<digit>.<digit>
5687# Since I saw only eqf files with version v1.1 I think that it's OK
5688>23	string	x	\b%.4s
5689# .preset
56900	string	[Equalizer\ preset]	XMMS equalizer preset
5691# .m3u
56920	search/1	#EXTM3U 	M3U playlist text
5693# .pls
56940	search/1	[playlist]	PLS playlist text
5695# licq.conf
56961	string	[licq]			LICQ configuration file
5697
5698# Atari ST audio files by Dirk Jagdmann <doj@cubic.org>
5699# NOTE: Most SNDH music is packed using ICE, which has
5700# magic numbers "ICE!" and "Ice!". Some SNDH music is
5701# not packed, so we check for both packed and unpacked.
570212	string			SNDH	SNDH Atari ST music
57030	belong&0xFFDFDFFF	0x49434521
5704>14	search/40		NDH	SNDH Atari ST music
5705>14	search/40		TITL	SNDH Atari ST music
57060	string		SC68\ Music-file\ /\ (c)\ (BeN)jami	sc68 Atari ST music
5707
5708# musepak support From: "Jiri Pejchal" <jiri.pejchal@gmail.com>
57090       string          MP+     Musepack audio (MP+)
5710!:mime	audio/x-musepack
5711>3      byte            255     \b, SV pre8
5712>3      byte&0xF        0x6     \b, SV 6
5713>3      byte&0xF        0x8     \b, SV 8
5714>3      byte&0xF        0x7     \b, SV 7
5715>>3     byte&0xF0       0x0     \b.0
5716>>3     byte&0xF0       0x10    \b.1
5717>>3     byte&0xF0       240     \b.15
5718>>10    byte&0xF0       0x0     \b, no profile
5719>>10    byte&0xF0       0x10    \b, profile 'Unstable/Experimental'
5720>>10    byte&0xF0       0x50    \b, quality 0
5721>>10    byte&0xF0       0x60    \b, quality 1
5722>>10    byte&0xF0       0x70    \b, quality 2 (Telephone)
5723>>10    byte&0xF0       0x80    \b, quality 3 (Thumb)
5724>>10    byte&0xF0       0x90    \b, quality 4 (Radio)
5725>>10    byte&0xF0       0xA0    \b, quality 5 (Standard)
5726>>10    byte&0xF0       0xB0    \b, quality 6 (Xtreme)
5727>>10    byte&0xF0       0xC0    \b, quality 7 (Insane)
5728>>10    byte&0xF0       0xD0    \b, quality 8 (BrainDead)
5729>>10    byte&0xF0       0xE0    \b, quality 9
5730>>10    byte&0xF0       0xF0    \b, quality 10
5731>>27    byte            0x0     \b, Buschmann 1.7.0-9, Klemm 0.90-1.05
5732>>27    byte            102     \b, Beta 1.02
5733>>27    byte            104     \b, Beta 1.04
5734>>27    byte            105     \b, Alpha 1.05
5735>>27    byte            106     \b, Beta 1.06
5736>>27    byte            110     \b, Release 1.1
5737>>27    byte            111     \b, Alpha 1.11
5738>>27    byte            112     \b, Beta 1.12
5739>>27    byte            113     \b, Alpha 1.13
5740>>27    byte            114     \b, Beta 1.14
5741>>27    byte            115     \b, Alpha 1.15
5742
57430       string          MPCK    Musepack audio (MPCK)
5744!:mime	audio/x-musepack
5745
5746# IMY
5747# from http://filext.com/detaillist.php?extdetail=IMY
5748# https://cellphones.about.com/od/cellularfaqs/f/rf_imelody.htm
5749# http://download.ncl.ie/doc/api/ie/ncl/media/music/IMelody.html
5750# http://www.wx800.com/msg/download/irda/iMelody.pdf
57510	string	BEGIN:IMELODY	iMelody Ringtone Format
5752
5753# From: "Mateus Caruccio" <mateus@caruccio.com>
5754# guitar pro v3,4,5 from http://filext.com/file-extension/gp3
57550	string	\030FICHIER\ GUITAR\ PRO\ v3.	Guitar Pro Ver. 3 Tablature
5756
5757# From: "Leslie P. Polzer" <leslie.polzer@gmx.net>
575860	string	SONG		SoundFX Module sound file
5759
5760# Type: Adaptive Multi-Rate Codec
5761# URL:  http://filext.com/detaillist.php?extdetail=AMR
5762# From: Russell Coker <russell@coker.com.au>
57630	string	#!AMR		Adaptive Multi-Rate Codec (GSM telephony)
5764!:mime	audio/amr
5765!:ext  amr
5766
5767# Type: SuperCollider 3 Synth Definition File Format
5768# From: Mario Lang <mlang@debian.org>
57690	string	SCgf	SuperCollider3 Synth Definition file,
5770>4	belong	x	version %d
5771
5772# Type: True Audio Lossless Audio
5773# URL:  https://wiki.multimedia.cx/index.php?title=True_Audio
5774# From: Mike Melanson <mike@multimedia.cx>
57750	string	TTA1	True Audio Lossless Audio
5776
5777# Type: WavPack Lossless Audio
5778# URL:  https://wiki.multimedia.cx/index.php?title=WavPack
5779# From: Mike Melanson <mike@multimedia.cx>
57800	string	wvpk	WavPack Lossless Audio
5781
5782# From Fabio R. Schmidlin <frs@pop.com.br>
5783# VGM music file
57840	string		Vgm\040
5785>9	ubyte		>0	VGM Video Game Music dump v
5786!:mime	audio/x-vgm
5787!:ext	vgm
5788>>9	ubyte/16	>0	\b%d
5789>>9	ubyte&0x0F	x	\b%d
5790>>8	ubyte/16	x	\b.%d
5791>>8	ubyte&0x0F	>0	\b%d
5792#Get soundchips
5793>>8	ubyte		x	\b, soundchip(s)=
5794>>0x0C	ulelong		>0	SN76489 (PSG),
5795>>0x10	ulelong		>0	YM2413 (OPLL),
5796>>0x2C	ulelong		>0	YM2612 (OPN2),
5797>>0x30	ulelong		>0	YM2151 (OPM),
5798>>0x38	ulelong		>0	Sega PCM,
5799>>0x34	ulelong		>0xC
5800>>>0x40	ulelong		>0	RF5C68 (PCM),
5801>>0x34	ulelong		>0x10
5802>>>0x44	ulelong		>0	YM2203 (OPN),
5803>>0x34	ulelong		>0x14
5804>>>0x48	ulelong		>0	YM2608 (OPNA),
5805>>0x34	ulelong		>0x18
5806>>>0x4C	lelong		>0	YM2610 (OPNB),
5807>>>0x4C	lelong		<0	YM2610B (OPNB+2FM),
5808>>0x34	ulelong		>0x1C
5809>>>0x50	ulelong		>0	YM3812 (OPL2),
5810>>0x34	ulelong		>0x20
5811>>>0x54	ulelong		>0	YM3526 (OPL),
5812>>0x34	ulelong		>0x24
5813>>>0x58	ulelong		>0	Y8950 (MSX-Audio),
5814>>0x34	ulelong		>0x28
5815>>>0x5C	ulelong		>0	YMF262 (OPL3),
5816>>0x34	ulelong		>0x2C
5817>>>0x60	ulelong		>0	YMF278B (OPL4),
5818>>0x34	ulelong		>0x30
5819>>>0x64	ulelong		>0	YMF271 (OPX),
5820>>0x34	ulelong		>0x34
5821>>>0x68	ulelong		>0	YMZ280B (PCMD8),
5822>>0x34	ulelong		>0x38
5823>>>0x6C	ulelong		>0	RF5C164 (PCM),
5824>>0x34	ulelong		>0x3C
5825>>>0x70	ulelong		>0	PWM,
5826>>0x34	ulelong		>0x40
5827>>>0x74	ulelong		>0
5828>>>>0x78 ubyte		0x00	AY-3-8910,
5829>>>>0x78 ubyte		0x01	AY-3-8912,
5830>>>>0x78 ubyte		0x02	AY-3-8913,
5831>>>>0x78 ubyte		0x03	AY-3-8930,
5832>>>>0x78 ubyte		0x10	YM2149,
5833>>>>0x78 ubyte		0x11	YM3439,
5834>>>>0x78 ubyte		0x12	YMZ284,
5835>>>>0x78 ubyte		0x13	YMZ294,
5836# VGM 1.61
5837>>0x34	ulelong		>0x4C
5838>>>0x80	ulelong		>0	DMG,
5839>>0x34	ulelong		>0x50
5840>>>0x84	lelong		>0	NES APU,
5841>>>0x84	lelong		<0	NES APU with FDS,
5842>>0x34	ulelong		>0x54
5843>>>0x88	ulelong		>0	MultiPCM,
5844>>0x34	ulelong		>0x58
5845>>>0x8C	ulelong		>0	uPD7759 (ADPCM Speech),
5846>>0x34	ulelong		>0x5C
5847>>>0x90	ulelong		>0	OKIM6258 (ADPCM Speech),
5848>>0x34	ulelong		>0x64
5849>>>0x98	ulelong		>0	OKIM6295 (ADPCM),
5850>>0x34	ulelong		>0x68
5851>>>0x9C	ulelong		>0	K051649,
5852>>0x34	ulelong		>0x6C
5853>>>0xA0	ulelong		>0	K054539,
5854>>0x34	ulelong		>0x70
5855>>>0xA4	ulelong		>0	HuC6280,
5856>>0x34	ulelong		>0x74
5857>>>0xA8	ulelong		>0	C140,
5858>>0x34	ulelong		>0x78
5859>>>0xAC	ulelong		>0	K053260,
5860>>0x34	ulelong		>0x7C
5861>>>0xB0	ulelong		>0	Pokey,
5862>>0x34	ulelong		>0x80
5863>>>0xB4	ulelong		>0	QSound,
5864# VGM 1.71
5865>>0x34	ulelong		>0x84
5866>>>0xB8	ulelong		>0	SCSP,
5867>>0x34	ulelong		>0x8C
5868>>>0xC0	ulelong		>0	WonderSwan,
5869>>0x34	ulelong		>0x90
5870>>>0xC4	ulelong		>0	VSU,
5871>>0x34	ulelong		>0x94
5872>>>0xC8	ulelong		>0	SAA1099,
5873>>0x34	ulelong		>0x98
5874>>>0xCC	ulelong		>0	ES5503 (DOC),
5875>>0x34	ulelong		>0x9C
5876>>>0xD0	lelong		>0	ES5505 (OTIS),
5877>>>0xD0	lelong		<0	ES5506 (OTTO),
5878>>0x34	ulelong		>0xA4
5879>>>0xD8	ulelong		>0	X1-010,
5880>>0x34	ulelong		>0xA8
5881>>>0xDC	ulelong		>0	C352,
5882>>0x34	ulelong		>0xAC
5883>>>0xE0	ulelong		>0	GA20,
5884
5885# GVOX Encore file format
5886# Since this is a proprietary file format and there is no publicly available
5887# format specification, this is just based on induction
5888#
58890	string	SCOW
5890>4	byte	0xc4	GVOX Encore music, version 5.0 or above
5891>4	byte	0xc2	GVOX Encore music, version < 5.0
5892
58930	string	ZBOT
5894>4	byte	0xc5	GVOX Encore music, version < 5.0
5895
5896# Summary:	Garmin Voice Processing Module (WAVE audios)
5897# From:		Joerg Jenderek
5898# URL:		https://www.garmin.com/
5899# Reference:	http://www.poi-factory.com/node/19580
5900# NOTE:		there exist 2 other Garmin VPM formats
59010		string	AUDIMG
5902# skip text files starting with string "AUDIMG"
5903>13		ubyte		<13	Garmin Voice Processing Module
5904!:mime	audio/x-vpm-wav-garmin
5905!:ext	vpm
5906# 3 bytes indicating the voice version (200,220)
5907>>6		string		x	\b, version %3.3s
5908# day of release (01-31)
5909>>12		ubyte		x	\b, %.2d
5910# month of release (01-12)
5911>>13		ubyte		x	\b.%.2d
5912# year of release (like 2006, 2007, 2008)
5913>>14		uleshort	x	\b.%.4d
5914# hour of release (0-23)
5915>>11		ubyte		x	%.2d
5916# minute of release (0-59)
5917>>10		ubyte		x	\b:%.2d
5918# second of release (0-59)
5919>>9		ubyte		x	\b:%.2d
5920# if you select a language like german on your garmin device
5921# you can only select voice modules with corresponding language byte ID like 1
5922>>18		ubyte		x	\b, language ID %d
5923# structure for phrases/sentences?
5924# number of voice sample in the 1st phrase?
5925#>>19		uleshort		x	\b, %#x samples
5926#>>>21		uleshort		>0	\b, at %#4.4x
5927#>>>(21.s)	ubequad			x	%#llx
5928# 2nd phrase?
5929#>>23		uleshort		x	\b, %#x samples
5930#>>>25		uleshort		>0	\b, at %#4.4x
5931#>>>(25.s)	ubequad			x	%#llx
5932# pointer to 1st audio WAV sample
5933>>16		uleshort	>0
5934>>>(16.s)	ulelong		>0	\b, at %#x
5935# WAV length
5936# 1 space char after "bytes" to get phrase "bytes RIFF"
5937>>>>(16.s+4)	ulelong		>0	%u bytes
5938# look for magic
5939>>>>>(&-8.l)	string		RIFF
5940# determine type by ./riff
5941>>>>>>&-4	indirect	x
5942# 2 - ~ 131 WAV samples following same way
5943#
5944# Summary:	encrypted Garmin Voice Processing Module
5945# From:		Joerg Jenderek
5946# URL:		https://www.garmin.com/us/products/ontheroad/voicestudio
5947# NOTE:		Encrypted variant used in voices like DrNightmare, Elfred, Yeti.
5948#		There exist 2 other Garmin VPM formats
59490	ubequad		0xa141190fecc8ced6	Garmin Voice Processing Module (encrypted)
5950!:mime	audio/x-vpm-garmin
5951!:ext	vpm
5952
5953# From Martin Mueller Skarbiniks Pedersen
59540		string		GDM
5955>0x3		byte		0xFE	General Digital Music.
5956>0x4		string		>\0	title: "%s"
5957>0x24		string		>\0	musician: "%s"
5958>>0x44		beshort		0x0D0A
5959>>>0x46		byte		0x1A
5960>>>>0x47	string		GMFS	Version
5961>>>>0x4B	byte		x	%d.
5962>>>>0x4C	byte		x	\b%02d
5963>>>>0x4D	beshort		0x000	(2GDM v
5964>>>>0x4F	byte		x	\b%d.
5965>>>>>0x50	byte		x	\b%d)
5966
59670		string		MTM	Multitracker
5968>0x3		byte/16		x	Version %d.
5969>0x3		byte&0x0F	x	\b%02d
5970>>0x4		string		>\0	title: "%s"
5971
59720		string		MO3
5973>3		ubyte		<6	MOdule with MP3
5974>>3		byte		0	Version	0	(With MP3 and lossless)
5975>>3		byte		1	Version	1	(With ogg and lossless)
5976>>3		byte		3	Version 2.2
5977>>3		byte		4	(With no LAME header)
5978>>3		byte		5	Version 2.4
5979
59800		string		ADRVPACK	AProSys	module
5981
5982# ftp://ftp.modland.com/pub/documents/format_documentation/\
5983# Art%20Of%20Noise%20(.aon).txt
59840		string		AON
5985>4		string		"ArtOfNoise by Bastian Spiegel(twice/lego)"
5986>0x2e		string		NAME	Art of Noise Tracker Song
5987>3		string		<9
5988>3		string		4	(4 voices)
5989>3		string		8	(8 voices)
5990>>0x36		string		>\0	Title: "%s"
5991
59920		string		FAR
5993>0x2c		byte		0x0d
5994>0x2d		byte		0x0a
5995>0x2e		byte		0x1a
5996>>0x3		byte		0xFE	Farandole Tracker Song
5997>>>0x31		byte/16		x	Version %d.
5998>>>0x31		byte&0x0F	x	\b%02d
5999>>>>0x4		string		>\0	\b, title: "%s"
6000
6001# magic for Klystrack, https://kometbomb.github.io/klystrack/
6002# from Alex Myczko <alex@aiei.ch>
60030	string	cyd!song	Klystrack song
6004>8	byte	>0		\b, version %u
6005>8	byte	>26
6006#>>9	byte	x		\b, channels %u
6007#>>10	leshort	x		\b, time signature %u
6008#>>12	leshort	x		\b, sequence step %u
6009#>>14	byte	x		\b, instruments %u
6010#>>15	leshort	x		\b, patterns %u
6011#>>17	leshort	x		\b, sequences %u
6012#>>19	leshort	x		\b, length %u
6013#>>21	leshort	x		\b, loop point %u
6014#>>23	byte	x		\b, master volume %u
6015#>>24	byte	x		\b, song speed %u
6016#>>25	byte	x		\b, song speed2 %u
6017#>>26	byte	x		\b, song rate %u
6018#>>27	belong	x		\b, flags %#x
6019#>>31	byte	x		\b, multiplex period %u
6020#>>32	byte	x		\b, pitch inaccuracy %u
6021>>149	pstring	x		\b, title %s
6022
60230	string	cyd!inst	Klystrack instrument
6024
6025# magic for WOPL instrument files, https://github.com/Wohlstand/OPL3BankEditor
6026# see Specifications/WOPL-and-OPLI-Specification.txt
6027
60280	string	WOPL3-INST\0	WOPL instrument
6029>11	leshort	x	\b, version %u
60300	string	WOPL3-BANK\0	WOPL instrument bank
6031>11	leshort	x	\b, version %u
6032
6033# AdLib/OPL instrument files. Format specifications on
6034#  http://www.shikadi.net/moddingwiki
60350	string	Junglevision\ Patch\ File	Junglevision instrument data
60360	string	#OPL_II#	DMX OP2 instrument data
60370	string	IBK\x1a		IBK instrument data
60380	string	2OP\x1a		IBK instrument data, 2 operators
60390	string	4OP\x1a		IBK instrument data, 4 operators
60402	string	ADLIB-		AdLib instrument data
6041>0	byte	x		\b, version %u
6042>1	byte	x		\b.%u
6043
6044# CRI ADX ADPCM audio
6045# Used by various Sega games.
6046# https://en.wikipedia.org/wiki/ADX_(file_format)
6047# https://wiki.multimedia.cx/index.php/CRI_ADX_file
6048# Added by David Korth <gerbilsoft@gerbilsoft.com>
60490x00		beshort		0x8000
6050>(2.S-2)	string		(c)CRI		CRI ADX ADPCM audio
6051!:ext adx
6052!:mime audio/x-adx
6053!:strength +50
6054>>0x12		byte		x		v%u
6055>>0x04		byte		0x02		\b, pre-set prediction coefficients
6056>>0x04		byte		0x03		\b, standard ADX
6057>>0x04		byte		0x04		\b, exponential scale
6058>>0x04		byte		0x10		\b, AHX (Dreamcast)
6059>>0x04		byte		0x11		\b, AHX
6060>>0x08		belong		x		\b, %u Hz
6061>>0x12		byte		0x03
6062>>>0x02		beshort		>0x2B
6063>>>>0x18	belong		!0		\b, looping
6064>>0x12		byte		0x04
6065>>>0x02		beshort		>0x37
6066>>>>0x24	belong		!0		\b, looping
6067>>0x13		byte&0x08	0x08		\b, encrypted
6068
6069# Lossless audio (.la) (http://www.lossless-audio.com/)
60700	string	LA
6071>2	string	03	Lossless audio version 0.3
6072>2	string	04	Lossless audio version 0.4
6073
6074# Sony PlayStation Audio (.xa)
60750	leshort 0x4158	Sony PlayStation Audio
6076
6077# Portable Sound Format
6078# Used for audio rips for various consoles.
6079# http://fileformats.archiveteam.org/wiki/Portable_Sound_Format
6080# Added by David Korth <gerbilsoft@gerbilsoft.com>
60810	string	PSF
6082>3	byte	0x01
6083>3	byte	0x02
6084>3	byte	0x11
6085>3	byte	0x12
6086>3	byte	0x13
6087>3	byte	0x21
6088>3	byte	0x22
6089>3	byte	0x23
6090>3	byte	0x41
6091>>0	string	PSF	Portable Sound Format
6092!:mime	audio/x-psf
6093>>>3	byte	0x01	(Sony PlayStation)
6094>>>3	byte	0x02	(Sony PlayStation 2)
6095>>>3	byte	0x11	(Sega Saturn)
6096>>>3	byte	0x12	(Sega Dreamcast)
6097>>>3	byte	0x13	(Sega Mega Drive)
6098>>>3	byte	0x21	(Nintendo 64)
6099>>>3	byte	0x22	(Game Boy Advance)
6100>>>3	byte	0x23	(Super NES)
6101>>>3	byte	0x41	(Capcom QSound)
6102
6103# Atari 8-bit SAP audio format
6104# http://asap.sourceforge.net/sap-format.html
6105# Added by David Korth <gerbilsoft@gerbilsoft.com>
61060	string		SAP\r\n	Atari 8-bit SAP audio file
6107!:mime	audio/x-sap
6108!:ext	sap
6109>5	search/1024	NAME
6110>>&1	string		x	\b: %s
6111>>5	search/1024	AUTHOR
6112>>>&1	string		x	by %s
6113
6114# Nintendo Wii BRSTM audio format (fields)
6115# NOTE: Assuming HEAD starts at 0x40.
6116# FIXME: Replace 0x48 with HEAD offset plus 8.
61170	name	nintendo-wii-brstm-fields
6118>(0x10.L)	string	HEAD	\b:
6119>>(0x10.L+0x0C)	belong	x
6120>>>(&-4.L+0x48)	belong	x
6121>>>>&-4		byte	0	PCM, signed 8-bit,
6122>>>>&-4		byte	1	PCM, signed 16-bit,
6123>>>>&-4		byte	2	THP ADPCM,
6124>>>>&-3		byte	!0	looping,
6125>>>>&-2		byte	1	mono
6126>>>>&-2		byte	2	stereo
6127>>>>&-2		byte	3	3 channels
6128>>>>&-2		byte	4	quad
6129>>>>&-2		byte	>4	%u channels
6130>>>>&0		beshort	!0	%u Hz
6131
6132# Nintendo Wii BRSTM audio format
6133# https://wiibrew.org/wiki/BRSTM_file
6134# Added by David Korth <gerbilsoft@gerbilsoft.com>
61350	string		RSTM	Nintendo Wii BRSTM audio file
6136!:mime	audio/x-brstm
6137!:ext	brstm
6138# Wii is big-endian, so default to BE.
6139>4	beshort		0xFEFF
6140>>0	use		nintendo-wii-brstm-fields
6141>4	leshort		0xFEFF
6142>>0	use		\^nintendo-wii-brstm-fields
6143
6144# Nintendo 3DS BCSTM audio format (fields)
61450	name	nintendo-3ds-bcstm-fields
6146>(0x18.l)	string	INFO	\b:
6147# INFO block: Stream information starts at 0x20 (minus 4 for the 'INFO' magic)
6148>>&0x1C		byte	0	PCM, signed 8-bit,
6149>>&0x1C		byte	1	PCM, signed 16-bit,
6150>>&0x1C		byte	2	DSP ADPCM,
6151>>&0x1C		byte	3	IMA ADPCM,
6152>>&0x1D		byte	!0	looping,
6153>>&0x1E		byte	1	mono
6154>>&0x1E		byte	2	stereo
6155>>&0x1E		byte	3	3 channels
6156>>&0x1E		byte	4	quad
6157>>&0x1E		byte	>4	%u channels
6158>>&0x20		lelong	!0	%u Hz
6159
6160# Nintendo 3DS BCSTM audio format
6161# https://www.3dbrew.org/wiki/BCSTM
6162# Added by David Korth <gerbilsoft@gerbilsoft.com>
61630	string		CSTM	Nintendo 3DS BCSTM audio file
6164!:mime	audio/x-bcstm
6165!:ext	bcstm
6166# 3DS is little-endian, so default to LE.
6167>4	leshort		0xFEFF
6168>>0	use		nintendo-3ds-bcstm-fields
6169>4	beshort		0xFEFF
6170>>0	use		\^nintendo-3ds-bcstm-fields
6171
6172# Nintendo Wii U BFSTM audio format
6173# http://mk8.tockdom.com/wiki/BFSTM_(File_Format)
6174# NOTE: This format is very similar to BCSTM.
6175# Added by David Korth <gerbilsoft@gerbilsoft.com>
61760	string		FSTM	Nintendo Wii U BFSTM audio file
6177!:mime	audio/x-bfstm
6178!:ext	bfstm
6179# BFSTM is used on both Wii U (BE) and Switch (LE),
6180# so default to LE.
6181>4	leshort		0xFEFF
6182>>0	use		nintendo-3ds-bcstm-fields
6183>4	beshort		0xFEFF
6184>>0	use		\^nintendo-3ds-bcstm-fields
6185
6186# Nintendo 3DS BCSTM audio format (fields)
61870	name	nintendo-3ds-bcwav-fields
6188>(0x18.l)	string	INFO	\b:
6189# INFO block (minus 4 for INFO magic)
6190>>&0x4		byte	0	PCM, signed 8-bit,
6191>>&0x4		byte	1	PCM, signed 16-bit,
6192>>&0x4		byte	2	DSP ADPCM,
6193>>&0x4		byte	3	IMA ADPCM,
6194>>&0x5		byte	!0	looping,
6195>>&0x8		lelong	x	stereo
6196>>&0x8		lelong	!0	%u Hz
6197
6198# Nintendo 3DS BCWAV audio format
6199# https://www.3dbrew.org/wiki/BCWAV
6200# Added by David Korth <gerbilsoft@gerbilsoft.com>
62010	string		CWAV	Nintendo 3DS BCWAV audio file
6202!:mime	audio/x-bcwav
6203!:ext	bcwav
6204# 3DS is little-endian, so default to LE.
6205>4	leshort		0xFEFF
6206>>0	use		nintendo-3ds-bcwav-fields
6207>4	beshort		0xFEFF
6208>>0	use		\^nintendo-3ds-bcwav-fields
6209
6210# Philips DSDIFF audio format (Direct Stream Digital Interchange File Format)
6211# Used for DSD audio recordings and Super Audio CD (SACD) mastering annotations
6212# https://dsd-guide.com/sites/default/files/white-papers/DSDIFF_1.5_Spec.pdf
6213# From: Toni Ruottu <toni.ruottu@iki.fi>
62140		string		FRM8
621512		string		DSD\x20		DSDIFF audio bitstream data
6216!:mime		audio/x-dff
6217!:ext		dff
6218
6219# format version chunk
6220>&0		string		FVER
6221# version 1
6222>>&8		byte		1
6223
6224# v1 / sampling resolution ( 1 bit PDM only )
6225>>>&0		string		x		\b, 1 bit
6226
6227# v1 / sound property chunk
6228>>>&0		search/0xff	PROP
6229>>>>&8		string		SND
6230
6231# v1 / sound property chunk / channel configuration chunk
6232>>>>>&0		search/0xff	CHNL
6233>>>>>>&8	ubeshort	1							\b, mono
6234>>>>>>&8	ubeshort	2
6235>>>>>>>&0	string		SLFTSRGT						\b, stereo
6236>>>>>>>&0	default		x							\b, 2 channels
6237>>>>>>&8	ubeshort	3
6238>>>>>>>&0	string		SLFTSRGTLFE\x20						\b, 2.1 stereo
6239>>>>>>>&0	string		SLFTSRGTC\x20\x20\x20					\b, 3.0 stereo
6240>>>>>>>&0	default		x							\b, 3 channels
6241>>>>>>&8	ubeshort	4
6242>>>>>>>&0	string		MLFTMRGTLS\x20\x20RS\x20\x20				\b, 4.0 surround
6243>>>>>>>&0	string		SLFTSRGTC\x20\x20\x20LFE\x20				\b, 3.1 stereo
6244>>>>>>>&0	default		x							\b, 4 channels
6245>>>>>>&8	ubeshort	5
6246>>>>>>>&0	string		MLFTMRGTC\x20\x20\x20LS\x20\x20RS\x20\x20		\b, 5.0 surround
6247>>>>>>>&0	string		MLFTMRGTLFE\x20LS\x20\x20RS\x20\x20			\b, 4.1 surround
6248>>>>>>>&0	default		x							\b, 5 channels
6249>>>>>>&8	ubeshort	6
6250>>>>>>>&0	string		MLFTMRGTC\x20\x20\x20LFE\x20LS\x20\x20RS\x20\x20	\b, 5.1 surround
6251>>>>>>>&0	default		x							\b, 6 channels
6252>>>>>>&8	ubeshort	>6							\b, %u channels
6253
6254# v1 / sound property chunk / sample rate chunk
6255>>>>>&0		search/0xff	FS\x20\x20
6256>>>>>>&0	string		x		\b,
6257>>>>>>&8	ubelong%44100	0
6258>>>>>>>&-4	ubelong/44100	x		"DSD %u"
6259>>>>>>>&-4	ubelong		x		%u Hz
6260
6261# v1 / sound property chunk / compression type chunk
6262>>>>>&0		search/0xff	CMPR
6263>>>>>>&8	string		DSD\x20		\b, no compression
6264>>>>>>&8	string		DST\x20		\b, DST compression
6265>>>>>>&8	default		x		\b, unknown compression
6266
6267# v1 / quest for metadata
6268>>>&0		string		x
6269
6270# v1 / quest for metadata / edited master information chunk
6271>>>>&0		search		DIIN
6272>>>>>&0		ubequad		>0		\b, "edited master" metadata
6273
6274# v1 / quest for metadata / ID3 chunk ( defacto standard )
6275>>>>&0		search		ID3\x20
6276>>>>>&8		string		ID3		\b, ID3 version 2
6277>>>>>&0		byte		x		\b.%u
6278>>>>>&1		byte		x		\b.%u
6279
6280# v1 / quest for metadata / failure ( possibly due to -P bytes=... being too low )
6281>>>>&0		default		x		\b, ID3 missing (or unreachable)
6282
6283# version > 1 or 0
6284>>&0		default		x		\b, unknown version
6285
6286# Sony DSF audio format (Direct Stream Digital Stream File)
6287# Used for lossless digital storage of songs produced as DSD audio
6288# Portable analog of a track stored on a Super Audio CD (SACD)
6289# https://dsd-guide.com/sites/default/files/white-papers/DSFFileFormatSpec_E.pdf
6290# From: Toni Ruottu <toni.ruottu@iki.fi>
62910		string		DSD\x20		DSF audio bitstream data
6292!:mime		audio/x-dsf
6293!:ext		dsf
6294
6295# format chunk
6296>28		string		fmt\x20
6297# version 1
6298>>&8		ulelong		1
6299
6300# v1 / sampling resolution ( 1 bit PDM only )
6301# NOTE: the spec incorrectly uses "bits per sample" instead of "bits per byte"
6302>>>&0		string		x		\b, 1 bit
6303
6304# v1 / channel configuration
6305>>>>&4		ulelong		1		\b, mono
6306>>>>&4		ulelong		2		\b, stereo
6307>>>>&4		ulelong		3		\b, 3.0 stereo
6308>>>>&4		ulelong		4		\b, 4.0 surround
6309>>>>&4		ulelong		5		\b, 3.1 stereo
6310>>>>&4		ulelong		6		\b, 5.0 surround
6311>>>>&4		ulelong		7		\b, 5.1 surround
6312>>>>&0		default		x
6313>>>>>&4		ulelong		x		\b, %u channels
6314
6315# v1 / sample rate chunk
6316>>>>&0		string		x		\b,
6317>>>>&12		ulelong%44100	0
6318>>>>>&-4	ulelong/44100	x		"DSD %u"
6319>>>>&12		ulelong		x		%u Hz
6320
6321# v1 / compression
6322>>>>&0		string		x
6323>>>>>&0		ulelong		0		\b, no compression
6324>>>>>&0		default		x		\b, unknown compression
6325
6326# v1 / embedded ID3v2 metadata
6327>>>0		string		x 		\b, ID3
6328>>>>20		ulequad		!0
6329>>>>>(20.q)	string		ID3		version 2
6330>>>>>>&0	byte		x		\b.%u
6331>>>>>>&1	byte		x		\b.%u
6332# unable to verify ID3 ( possibly due to -P bytes=... being too low )
6333>>>>>&0		default		x		unreachable
6334>>>>&0		default		x		missing
6335
6336# version > 1 or 0
6337>>&0		default		x		\b, unknown version
6338
6339#------------------------------------------------------------------------------
6340# $File: avm,v 1.1 2020/08/28 20:37:58 christos Exp $
6341# avm:  file(1) magic for avm files; this is not use
6342
6343# Summary:	FRITZ!Box router configuration backup
6344# From:		Joerg Jenderek
6345# URL:		https://en.wikipedia.org/wiki/Fritz!Box
6346# Reference:	http://www.mengelke.de/Projekte/FritzBoxTools2
6347# Note:		only tested with models 4040 and 6490 Cable (lgi)
63480	string		****\ FRITZ!Box\ 	FRITZ!Box configuration backup
6349#!:mime	text/plain
6350!:mime	application/x-avm-export
6351!:ext	export
6352# router model name like "4040" , "6490 Cable (lgi)" followed by " CONFIGURATION EXPORT"
6353>15	string		x			of %-.4s
6354# on 2nd line hashed password
6355#>41	search/54	Password=		\b, password
6356# on 3rd line firmware version like: 141.06.24 141.06.50 141.07.10 ... 155.06.83
6357>41	search/172	FirmwareVersion=	\b, firmware version
6358>>&0	string		x			%s
6359# on 5th line oem like: avme lgi
6360>41	search/285	OEM=			\b, oem
6361>>&0	string		x			%s
6362# on 7th line language like: de en
6363>41	search/305	Language=		\b, language
6364>>&0	string		x			%s
6365# on 10th line cfg file name like: /var/tmp.cfg
6366>41	search/349	tmp.cfg
6367# on 11th line date inside c-comment like: Thu Jun  4 22:25:19 2015
6368>>&4	string		x			\b, %s
6369#
6370
6371
6372#----------------------------------------------------------------
6373# $File: basis,v 1.5 2019/04/19 00:42:27 christos Exp $
6374# basis: file(1) magic for BBx/Pro5-files
6375#      Oliver Dammer <dammer@olida.de>	 2005/11/07
6376# https://www.basis.com business-basic-files.
6377#
63780	string		\074\074bbx\076\076	BBx
6379>7	string		\000			indexed file
6380>7	string		\001			serial file
6381>7	string		\002			keyed file
6382>>13	short		0			(sort)
6383>7	string		\004			program
6384>>18	byte		x			(LEVEL %d)
6385>>>23	string		>\000			psaved
6386>7	string		\006			mkeyed file
6387>>13	short		0			(sort)
6388>>8	string		\000			(mkey)
6389#------------------------------------------------------------------------------
6390# $File: beetle,v 1.2 2018/02/05 23:42:17 rrt Exp $
6391# beetle:  file(1) magic for Beetle VM object files
6392# https://github.com/rrthomas/beetle/
6393
6394# Beetle object module
63950	string		BEETLE\000	Beetle VM object file
6396
6397#------------------------------------------------------------------------------
6398# $File: ber,v 1.2 2019/04/19 00:42:27 christos Exp $
6399# ber:  file(1) magic for several BER formats used in the mobile
6400# telecommunications industry (Georg Sauthoff)
6401
6402# The file formats are standardized by the GSMA (GSM association).
6403# They are specified via ASN.1 schemas and some prose. Basic encoding
6404# rules (BER) is the used encoding. The formats are used for exchanging
6405# call data records (CDRs) between mobile operators and associated
6406# parties for roaming clearing purposes and fraud detection.
6407
6408# The magic file covers:
6409
6410# - TAP files (TD.57) - CDR batches and notifications
6411# - RAP files (TD.32) - return batches and acknowledgements
6412# - NRT files (TD.35) - CDR batches for 'near real time' processing
6413
6414#
6415# TAP 3 Files
6416# TAP -> Transferred Account Procedure
6417# cf. https://www.gsma.com/newsroom/wp-content/uploads/TD.57-v32.31.pdf
6418# TransferBatch short tag
64190	byte	0x61
6420# BatchControlInfo short tag
6421>&1	search/b5	\x64
6422# Sender long tag #TAP 3.x (BER encoded)
6423>>&1	search/b8	\x5f\x81\x44
6424# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block
6425>>>&64	search/b64	\x5f\x81\x49\x01\x03\x5f\x81\x3d\x01
6426>>>>&0	byte	x	TAP 3.%d Batch (TD.57, Transferred Account)
6427
6428# Notification short tag
64290	byte	0x62
6430# Sender long tag
6431>2	search/b8	\x5f\x81\x44
6432# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block
6433>>&64	search/b64	\x5f\x81\x49\x01\x03\x5f\x81\x3d\x01
6434>>>&0	byte	x	TAP 3.%d Notification (TD.57, Transferred Account)
6435
6436
6437# NRT Files
6438# NRT a.k.a. NRTRDE
64390	byte	0x61
6440# <SpecificationVersionNumber>2</><ReleaseVersionNumber> block
6441>&1	search/b8 \x5f\x29\x01\x02\x5f\x25\x01
6442>>&0	byte	x	NRT 2.%d (TD.35, Near Real Time Roaming Data Exchange)
6443
6444# RAP Files
6445# cf. https://www.gsma.com/newsroom/wp-content/uploads/TD.32-v6.11.pdf
6446# Long ReturnBatch tag
64470	string	\x7f\x84\x16
6448# Long RapBatchControlInfo tag
6449>&1	search/b8	\x7f\x84\x19
6450# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block
6451>>&64	search/b64	\x5f\x81\x49\x01\x03\x5f\x81\x3d\x01
6452# <RapSpecificationVersionNumber>1</><RapReleaseVersionNumber> block
6453>>>&1	string/b	\x5f\x84\x20\x01\x01\x5f\x84\x1f\x01
6454>>>>&0	byte	x	RAP 1.%d Batch (TD.32, Returned Account Procedure),
6455>>>&0	byte	x	TAP 3.%d
6456
6457# Long Acknowledgement tag
64580	string \x7f\x84\x17
6459# Long Sender tag
6460>&1	search/b5	\x5f\x81\x44	RAP Acknowledgement (TD.32, Returned Account Procedure)
6461
6462#------------------------------------------------------------------------------
6463# $File: bflt,v 1.5 2014/04/30 21:41:02 christos Exp $
6464# bFLT: file(1) magic for BFLT uclinux binary files
6465#
6466# From Philippe De Muyter <phdm@macqel.be>
6467#
64680	string		bFLT		BFLT executable
6469>4	belong		x		- version %d
6470>4	belong		4
6471>>36	belong&0x1	0x1		ram
6472>>36	belong&0x2	0x2		gotpic
6473>>36	belong&0x4	0x4		gzip
6474>>36	belong&0x8	0x8		gzdata
6475
6476#------------------------------------------------------------------------------
6477# $File: bhl,v 1.1 2017/06/11 22:20:02 christos Exp $
6478# BlockHashLoc
6479# ext: bhl
6480# Marco Pontello marcopon@gmail.com
6481# reference: https://github.com/MarcoPon/BlockHashLoc
64820	string	BlockHashLoc\x1a	BlockHashLoc recovery info,
6483>13	byte	x			version %d
6484!:ext   bhl
6485
6486#------------------------------------------------------------------------------
6487# $File: bioinformatics,v 1.5 2019/04/19 00:42:27 christos Exp $
6488# bioinfomatics:  file(1) magic for Bioinfomatics file formats
6489
6490###############################################################################
6491# BGZF (Blocked GNU Zip Format) - gzip compatible, but also indexable
6492# used by SAMtools bgzip/tabix (http://samtools.sourceforge.net/tabix.shtml)
6493###############################################################################
64940	string		\037\213
6495>3	byte		&0x04
6496>>12	string		BC
6497>>>14	leshort		&0x02	Blocked GNU Zip Format (BGZF; gzip compatible)
6498>>>>16	leshort		x	\b, block length %d
6499!:mime	application/x-gzip
6500
6501
6502###############################################################################
6503# Tabix index file
6504# used by SAMtools bgzip/tabix (http://samtools.sourceforge.net/tabix.shtml)
6505###############################################################################
65060	string	TBI\1		SAMtools TBI (Tabix index format)
6507>0x04	lelong	=1		\b, with %d reference sequence
6508>0x04	lelong	>1		\b, with %d reference sequences
6509>0x08	lelong	&0x10000	\b, using half-closed-half-open coordinates (BED style)
6510>0x08	lelong	^0x10000
6511>>0x08	lelong	=0		\b, using closed and one based coordinates (GFF style)
6512>>0x08	lelong	=1		\b, using SAM format
6513>>0x08	lelong	=2		\b, using VCF format
6514>0x0c	lelong	x		\b, sequence name column: %d
6515>0x10	lelong	x		\b, region start column: %d
6516>0x08	lelong	=0
6517>>0x14	lelong	x		\b, region end column: %d
6518>0x18	byte	x		\b, comment character: %c
6519>0x1c	lelong	x		\b, skip line count: %d
6520
6521
6522###############################################################################
6523# BAM (Binary Sequence Alignment/Map format)
6524# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf)
6525# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
6526###############################################################################
65270	string	BAM\1	SAMtools BAM (Binary Sequence Alignment/Map)
6528>0x04	lelong	>0
6529>>&0x00 regex	=^[@]HD\t.*VN:		\b, with SAM header
6530>>>&0	regex	=[0-9.]+		\b version %s
6531>>&(0x04)	lelong	>0	\b, with %d reference sequences
6532
6533
6534###############################################################################
6535# BAI (BAM indexing format)
6536# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf)
6537###############################################################################
65380		string	BAI\1	SAMtools BAI (BAM indexing format)
6539>0x04		lelong	>0	\b, with %d reference sequences
6540
6541
6542###############################################################################
6543# CRAM (Binary Sequence Alignment/Map format)
6544###############################################################################
65450	string	CRAM	CRAM
6546>0x04	byte	>-1	version %d.
6547>0x05	byte	>-1	\b%d
6548>0x06	string	>\0	(identified as %s)
6549
6550
6551###############################################################################
6552# BCF (Binary Call Format), version 1
6553# used by SAMtools & VCFtools (http://vcftools.sourceforge.net/bcf.pdf)
6554# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
6555###############################################################################
65560		string	   BCF\4
6557# length of seqnm data in bytes is positive
6558>&0x00		lelong	  >0
6559# length of smpl data in bytes is positive
6560>>&(&-0x04)	lelong	  >0			SAMtools BCF (Binary Call Format)
6561# length of meta in bytes
6562>>>&(&-0x04)	lelong	  >0
6563# have meta text string
6564>>>>&0x00	search	  ##samtoolsVersion=
6565>>>>>&0x00	string	  x			\b, generated by SAMtools version %s
6566
6567
6568###############################################################################
6569# BCF (Binary Call Format), version 2.1
6570# used by SAMtools (https://samtools.github.io/hts-specs/BCFv2_qref.pdf)
6571# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
6572###############################################################################
65730		string	   BCF\2\1    Binary Call Format (BCF) version 2.1
6574# length of header text
6575>&0x00		lelong	  >0
6576# have header string
6577>>&0x00 search	  ##samtoolsVersion=
6578>>>&0x00	string	  x			\b, generated by SAMtools version %s
6579
6580
6581###############################################################################
6582# BCF (Binary Call Format), version 2.2
6583# used by SAMtools (https://samtools.github.io/hts-specs/BCFv2_qref.pdf)
6584# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
6585###############################################################################
65860		string	   BCF\2\2    Binary Call Format (BCF) version 2.2
6587# length of header text
6588>&0x00		lelong	  >0
6589# have header string
6590>>&0x00 search	  ##samtoolsVersion=
6591>>>&0x00	string	  x			\b, generated by SAMtools version %s
6592
6593###############################################################################
6594# VCF (Variant Call Format)
6595# used by VCFtools (http://vcftools.sourceforge.net/)
6596###############################################################################
65970      search	   ##fileformat=VCFv	Variant Call Format (VCF)
6598>&0    string	   x			\b version %s
6599
6600###############################################################################
6601# FASTQ
6602# used by MAQ (http://maq.sourceforge.net/fastq.shtml)
6603###############################################################################
6604# XXX Broken?
6605# @<seqname>
6606#0	regex	=^@[A-Za-z0-9_.:-]+\?\n
6607# <seq>
6608#>&1	regex	=^[A-Za-z\n.~]++
6609# +[<seqname>]
6610#>>&1	regex	=^[A-Za-z0-9_.:-]*\?\n
6611# <qual>
6612#>>>&1	regex	=^[!-~\n]+\n		FASTQ
6613
6614###############################################################################
6615# FASTA
6616# used by FASTA (https://fasta.bioch.virginia.edu/fasta_www2/fasta_guide.pdf)
6617###############################################################################
6618#0	byte	0x3e
6619# q>0	regex	=^[>][!-~\t\ ]+$
6620# Amino Acid codes: [A-IK-Z*-]+
6621#>>1	regex	!=[!-'Jj;:=?@^`|~\\]		FASTA
6622# IUPAC codes/gaps: [ACGTURYKMSWBDHVNX-]+
6623# not in IUPAC codes/gaps: [EFIJLOPQZ]
6624#>>>1	regex	!=[EFIJLOPQZefijlopqz]		\b, with IUPAC nucleotide codes
6625#>>>1	regex	=^[EFIJLOPQZefijlopqz]+$	\b, with Amino Acid codes
6626
6627###############################################################################
6628# SAM (Sequence Alignment/Map format)
6629# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf)
6630###############################################################################
6631# Short-cut version to recognise SAM files with (optional) header at beginning
6632###############################################################################
66330      string	   @HD\t
6634>4     search	   VN:		Sequence Alignment/Map (SAM), with header
6635>>&0   regex	   [0-9.]+	\b version %s
6636###############################################################################
6637# Longer version to recognise SAM alignment lines using (many) regexes
6638###############################################################################
6639# SAM Alignment QNAME
66400		regex	=^[!-?A-~]{1,255}(\t[^\t]+){11}
6641# SAM Alignment FLAG
6642>0		regex	=^([^\t]+\t){1}[0-9]{1,5}\t
6643# SAM Alignment RNAME
6644>>0		regex	=^([^\t]+\t){2}\\*|[^*=]*\t
6645# SAM Alignment POS
6646>>>0		regex	=^([^\t]+\t){3}[0-9]{1,9}\t
6647# SAM Alignment MAPQ
6648>>>>0		regex	=^([^\t]+\t){4}[0-9]{1,3}\t
6649# SAM Alignment CIGAR
6650>>>>>0		regex	=\t(\\*|([0-9]+[MIDNSHPX=])+)\t
6651# SAM Alignment RNEXT
6652>>>>>>0		regex	=\t(\\*|=|[!-()+->?-~][!-~]*)\t
6653# SAM Alignment PNEXT
6654>>>>>>>0	regex	=^([^\t]+\t){7}[0-9]{1,9}\t
6655# SAM Alignment TLEN
6656>>>>>>>>0	regex	=\t[+-]{0,1}[0-9]{1,9}\t.*\t
6657# SAM Alignment SEQ
6658>>>>>>>>>0	regex	=^([^\t]+\t){9}(\\*|[A-Za-z=.]+)\t
6659# SAM Alignment QUAL
6660>>>>>>>>>>0	regex	=^([^\t]+\t){10}[!-~]+	Sequence Alignment/Map (SAM)
6661>>>>>>>>>>>0	regex	=^[@]HD\t.*VN:		\b, with header
6662>>>>>>>>>>>>&0	regex	=[0-9.]+		\b version %s
6663
6664##############################################################################
6665#
6666#    Magic ids for biomedical signal file formats
6667#    Copyright (C) 2018 Alois Schloegl <alois.schloegl@gmail.com>
6668#
6669#    The list has been derived from biosig projects
6670#      http://biosig.sourceforge.net
6671#      https://pub.ist.ac.at/~schloegl/matlab/eeg/
6672#      https://pub.ist.ac.at/~schloegl/biosig/TESTED
6673#
6674##############################################################################
6675#
66760	string  ABF\x20					Biosig/Axon Binary format
6677!:mime biosig/abf2
66780	string  ABF2\0\0				Biosig/Axon Binary format
6679!:mime biosig/abf2
6680#
66810	string  ATES\x20MEDICA\x20SOFT.\x20EEG\x20for\x20Windows	Biosig/ATES MEDICA SOFT. EEG for Windows
6682!:mime biosig/ates
6683#
66840	string  ATF\x09					Biosig/Axon Text format
6685!:mime biosig/atf
6686#
66870	string  ADU1					Biosig/Axona file format
6688!:mime biosig/axona
66890	string  ADU2					Biosig/Axona file format
6690!:mime biosig/axona
6691#
66920	string  ALPHA-TRACE-MEDICAL			Biosig/alpha trace
6693!:mime biosig/alpha
6694#
66950       string  AxGr					Biosig/AXG
66960       string  axgx					Biosig/AXG
6697!:mime biosig/axg
6698#
66990	string  HeaderLen=				Biosig/BCI2000
67000	string  BCI2000V				Biosig/BCI2000
6701!:mime biosig/bci2000
6702#
6703### Specification: https://www.biosemi.com/faq/file_format.htm
67040	string  \xffBIOSEMI				Biosig/Biosemi data format
6705!:mime biosig/bdf
6706#
67070	string  Brain\x20Vision\x20Data\x20Exchange\x20Header\x20File			Biosig/Brainvision data file
67080	string  Brain\x20Vision\x20V-Amp\x20Data\x20Header\x20File\x20Version		Biosig/Brainvision V-Amp file
67090	string  Brain\x20Vision\x20Data\x20Exchange\x20Marker\x20File,\x20Version	Biosig/Brainvision Marker file
6710!:mime biosig/brainvision
6711#
67120	string  CEDFILE					Biosig/CFS: Cambridge Electronic devices File format
6713!:mime biosig/ced
6714#
6715### Specification: https://www.edfplus.info/specs/index.html
67160	string	0\x20\x20\x20\x20\x20\x20\x20		Biosig/EDF: European Data format
6717!:mime biosig/edf
6718#
6719### Specifications: https://arxiv.org/abs/cs/0608052
67200	string  GDF					Biosig/GDF: General data format for biosignals
6721!:mime biosig/gdf
6722#
67230	string  DATA\0\0\0\0				Biosig/Heka Patchmaster
67240	string  DAT1\0\0\0\0				Biosig/Heka Patchmaster
67250	string  DAT2\0\0\0\0				Biosig/Heka Patchmaster
6726!:mime biosig/heka
6727#
67280	string  (C)\x20CED\x2087			Biosig/CED SMR
6729!:mime biosig/ced-smr
6730#
67310	string  CFWB\1\0\0\0				Biosig/CFWB
6732!:mime biosig/cfwb
6733#
67340	string  DEMG					Biosig/DEMG
6735!:mime biosig/demg
6736#
67370	string  EBS\x94\x0a\x13\x1a\x0d			Biosig/EBS
6738!:mime biosig/ebs
6739#
67400	string  Embla\x20data\x20file			Biosig/Embla
6741!:mime biosig/embla
6742#
67430	string  Header\r\nFile Version			Biosig/ETG4000
6744!:mime biosig/etg4000
6745#
67460	string  GALILEO\x20EEG\x20TRACE\x20FILE		Biosig/Galileo
6747!:mime biosig/galileo
6748#
67490	string  IGOR					Biosig/IgorPro ITX file
6750!:mime biosig/igorpro
6751#
6752#	Specification: http://www.ampsmedical.com/uploads/2017-12-7/The_ISHNE_Format.pdf
67530	string  ISHNE1.0				Biosig/ISHNE
6754!:mime biosig/ishne
6755#
6756# 	CEN/ISO 11073/22077 series, http://www.mfer.org/en/document.htm
67570	string  @\x20\x20MFER\x20			Biosig/MFER
67580	string  @\x20MFR\x20				Biosig/MFER
6759!:mime biosig/mfer
6760#
67610	string  NEURALEV				Biosig/NEV
67620	string  N.EV.\0					Biosig/NEV
6763!:mime biosig/nev
6764#
67650	string  NEX1					Biosig/NEX
6766!:mime biosig/nex1
6767#
67680	string  PLEX 					Biosig/Plexon v1.0
676910	string  PLEXON 					Biosig/Plexon v2.0
6770!:mime biosig/plexon
6771#
67720	string  \x02\x27\x91\xC6			Biosig/RHD2000: Intan RHD2000 format
6773#
6774#	Specification: CEN 1064:2005/ISO 11073:91064
677516	string  SCPECG\0\0 				Biosig/SCP-ECG format CEN 1064:2005/ISO 11073:91064
6776!:mime biosig/scpecg
6777#
67780	string  IAvSFo									Biosig/SIGIF
6779!:mime biosig/sigif
6780#
67810	string  POLY\x20SAMPLE\x20FILEversion\x20					Biosig/TMS32
6782!:mime biosig/tms32
6783#
67840	string  FileId=TMSi\x20PortiLab\x20sample\x20log\x20file\x0a\x0dVersion=	Biosig/TMSiLOG
6785!:mime biosig/tmsilog
6786#
67874	string	Synergy\0\48\49\50\46\48\48\51\46\48\48\48\46\48\48\48\0\28\0\0\0\2\0\0\0
6788>63	string	CRawDataElement
6789>>85	string	CRawDataBuffer								Biosig/SYNERGY
6790!:mime biosig/synergy
6791#
67924	string	\40\0\4\1\44\1\102\2\146\3\44\0\190\3					Biosig/UNIPRO
6793!:mime biosig/unipro
6794#
67950	string	VER=9\r\nCTIME=								Biosig/WCP
6796!:mime biosig/wcp
6797#
67980	string	\xAF\xFE\xDA\xDA							Biosig/Walter Graphtek
67990	string	\xDA\xDA\xFE\xAF							Biosig/Walter Graphtek
68000	string	\x55\x55\xFE\xAF							Biosig/Walter Graphtek
6801!:mime biosig/walter-graphtek
6802#
68030	string  V3.0\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20
6804>32	string  [PatInfo]								Biosig/Sigma
6805!:mime biosig/sigma
6806#
68070	string  \067\069\078\013\010\0x1a\04\0x84					Biosig/File exchange format (FEF)
6808!:mime biosig/fef
68090	string  \67\69\78\0x13\0x10\0x1a\4\0x84						Biosig/File exchange format (FEF)
6810!:mime biosig/fef
6811#
68120	string  \0\0\0\x64\0\0\0\x1f\0\0\0\x14\0\0\0\0\0\1
6813>36  	string  \0\0\0\x65\0\0\0\3\0\0\0\4\0\0
6814>>56	string  \0\0\0\x6a\0\0\0\3\0\0\0\4\0\0\0\0\xff\xff\xff\xff\0\0			Biosig/FIFF
6815!:mime biosig/fiff
6816#
6817
6818#------------------------------------------------------------------------------
6819# $File: blackberry,v 1.2 2017/03/17 21:35:28 christos Exp $
6820# blackberry:  file(1) magic for BlackBerry file formats
6821#
68225	belong	0
6823>8	belong  010010010	BlackBerry RIM ETP file
6824>>22	string	x		\b for %s
6825# Berkeley Lab Checkpoint Restart (BLCR) checkpoint context files
6826# https://ftg.lbl.gov/checkpoint
68270	string	C\0\0\0R\0\0\0	BLCR
6828>16	lelong	1	x86
6829>16	lelong	3	alpha
6830>16	lelong	5	x86-64
6831>16	lelong	7	ARM
6832>8	lelong	x	context data (little endian, version %d)
6833# Uncomment the following only of your "file" program supports "search"
6834#>0	search/1024	VMA\06	for kernel
6835#>>&1	byte	x	%d.
6836#>>&2	byte	x	%d.
6837#>>&3	byte	x	%d
68380	string	\0\0\0C\0\0\0R	BLCR
6839>16	belong	2	SPARC
6840>16	belong	4	ppc
6841>16	belong	6	ppc64
6842>16	belong	7	ARMEB
6843>16	belong	8	SPARC64
6844>8	belong	x	context data (big endian, version %d)
6845# Uncomment the following only of your "file" program supports "search"
6846#>0	search/1024	VMA\06	for kernel
6847#>>&1	byte	x	%d.
6848#>>&2	byte	x	\b%d.
6849#>>&3	byte	x	\b%d
6850
6851#------------------------------------------------------------------------------
6852# $File: blender,v 1.8 2019/04/19 00:42:27 christos Exp $
6853# blender: file(1) magic for Blender 3D related files
6854#
6855# Native format rule v1.2. For questions use the developers list
6856# https://lists.blender.org/mailman/listinfo/bf-committers
6857# GLOB chunk was moved near start and provides subversion info since 2.42
6858
68590		string	=BLENDER	Blender3D,
6860>7		string	=_		saved as 32-bits
6861>>8		string	=v		little endian
6862>>>9		byte	x		with version %c.
6863>>>10		byte	x		\b%c
6864>>>11		byte	x		\b%c
6865>>>0x40		string	=GLOB		\b.
6866>>>>0x58	leshort	x		\b%.4d
6867>>8		string	=V		big endian
6868>>>9		byte	x		with version %c.
6869>>>10		byte	x		\b%c
6870>>>11		byte	x		\b%c
6871>>>0x40		string	=GLOB		\b.
6872>>>>0x58	beshort	x		\b%.4d
6873>7		string	=-		saved as 64-bits
6874>>8		string	=v		little endian
6875>>9		byte	x		with version %c.
6876>>10		byte	x		\b%c
6877>>11		byte	x		\b%c
6878>>0x44		string	=GLOB		\b.
6879>>>0x60		leshort	x		\b%.4d
6880>>8		string	=V		big endian
6881>>>9		byte	x		with version %c.
6882>>>10		byte	x		\b%c
6883>>>11		byte	x		\b%c
6884>>>0x44		string	=GLOB		\b.
6885>>>>0x60	beshort	x		\b%.4d
6886
6887# Scripts that run in the embedded Python interpreter
68880		string	#!BPY		Blender3D BPython script
6889
6890#------------------------------------------------------------------------------
6891# $File: blit,v 1.9 2021/07/03 14:01:46 christos Exp $
6892# blit:  file(1) magic for 68K Blit stuff as seen from 680x0 machine
6893#
6894# Note that this 0407 conflicts with several other a.out formats...
6895#
6896# XXX - should this be redone with "be" and "le", so that it works on
6897# little-endian machines as well?  If so, what's the deal with
6898# "VAX-order" and "VAX-order2"?
6899#
6900#0	long		0407		68K Blit (standalone) executable
6901#0	short		0407		VAX-order2 68K Blit (standalone) executable
69020	short		03401		VAX-order 68K Blit (standalone) executable
69030	long		0406		68k Blit mpx/mux executable
69040	short		0406		VAX-order2 68k Blit mpx/mux executable
6905# GRR: line below is too general as it matches also TTComp archive, ASCII, 4K handled by ./archive
69060	short		03001		VAX-order 68k Blit mpx/mux executable
6907# TODO:
6908# skip TTComp archive, ASCII, 4K by looking for executable keyword like main
6909#>0	search/5536	main\0		VAX-order 68k Blit mpx/mux executable
6910# Need more values for WE32 DMD executables.
6911# Note that 0520 is the same as COFF
6912#0	short		0520		tty630 layers executable
6913
6914#------------------------------------------------------------------------------
6915# $File: bm,v 1.2 2021/03/14 16:56:51 christos Exp $
6916# bm:  file(1) magic for "Birtual Machine", cf. https://github.com/tsoding/bm
6917
69180	string	bm\001\244	Birtual Machine
6919>4	leshort	x		\b, version %d
6920>6	lelong	x		\b, program size %u
6921>14	lelong	x		\b, memory size %u
6922>22	lelong	x		\b, memory capacity %u
6923
6924#------------------------------------------------------------------------------
6925# $File: bout,v 1.5 2009/09/19 16:28:08 christos Exp $
6926# i80960 b.out objects and archives
6927#
69280	long		0x10d		i960 b.out relocatable object
6929>16	long		>0		not stripped
6930#
6931# b.out archive (hp-rt on i960)
69320	string		=!<bout>	b.out archive
6933>8	string		__.SYMDEF	random library
6934
6935#------------------------------------------------------------------------------
6936# $File: bsdi,v 1.7 2014/03/29 15:40:34 christos Exp $
6937# bsdi:  file(1) magic for BSD/OS (from BSDI) objects
6938# Some object/executable formats use the same magic numbers as are used
6939# in other OSes; those are handled by entries in aout.
6940#
6941
69420	lelong		0314		386 compact demand paged pure executable
6943>16	lelong		>0		not stripped
6944>32	byte		0x6a		(uses shared libs)
6945
6946# same as in SunOS 4.x, except for static shared libraries
69470	belong&077777777	0600413		SPARC demand paged
6948>0	byte		&0x80
6949>>20	belong		<4096		shared library
6950>>20	belong		=4096		dynamically linked executable
6951>>20	belong		>4096		dynamically linked executable
6952>0	byte		^0x80		executable
6953>16	belong		>0		not stripped
6954>36	belong		0xb4100001	(uses shared libs)
6955
69560	belong&077777777	0600410		SPARC pure
6957>0	byte		&0x80		dynamically linked executable
6958>0	byte		^0x80		executable
6959>16	belong		>0		not stripped
6960>36	belong		0xb4100001	(uses shared libs)
6961
69620	belong&077777777	0600407		SPARC
6963>0	byte		&0x80		dynamically linked executable
6964>0	byte		^0x80		executable
6965>16	belong		>0		not stripped
6966>36	belong		0xb4100001	(uses shared libs)
6967# Chiasmus is an encryption standard developed by the German Federal
6968# Office for Information Security (Bundesamt fuer Sicherheit in der
6969# Informationstechnik).
6970
6971# https://www.bsi.bund.de/EN/Topics/OtherTopics/Chiasmus/Chiasmus_node.html
69720	string		XIA1\r		Chiasmus Encrypted data
6973!:ext xia
6974
69750	string	XIS	Chiasmus key
6976!:ext xis
6977
6978#------------------------------------------------------------------------------
6979# $File: btsnoop,v 1.5 2009/09/19 16:28:08 christos Exp $
6980# BTSnoop:  file(1) magic for BTSnoop files
6981#
6982# From <marcel@holtmann.org>
69830	string		btsnoop\0		BTSnoop
6984>8	belong		x			version %d,
6985>12	belong		1001			Unencapsulated HCI
6986>12	belong		1002			HCI UART (H4)
6987>12	belong		1003			HCI BCSP
6988>12	belong		1004			HCI Serial (H5)
6989>>12	belong		x			type %d
6990
6991#------------------------------------------------------------
6992# $File: burp,v 1.1 2022/07/04 17:15:09 christos Exp $
6993# Burp file, I don't know the version
6994#------------------------------------------------------------
6995# From wof (wof@stachelkaktus.net)
69960	bequad	0x6685828000000001	Burp project save file
6997
6998#------------------------------------------------------------
6999# $File: bytecode,v 1.3 2022/03/24 15:48:58 christos Exp $
7000# magic for various bytecodes
7001
7002# From: Mikhail Gusarov <dottedmag@dottedmag.net>
7003# NekoVM (https://nekovm.org/) bytecode
70040	string		NEKO	NekoVM bytecode
7005>4	lelong		x	(%d global symbols,
7006>8	lelong		x	%d global fields,
7007>12	lelong		x	%d bytecode ops)
7008!:mime	application/x-nekovm-bytecode
7009
7010# https://www.iana.org/assignments/media-types/application/vnd.resilient.logic
7011# From: Benedikt Muessig <benedikt@resilient-group.de>
70120	belong		0x07524c4d	Resilient Logic bytecode
7013!:mime	application/vnd.resilient.logic
7014>4	byte/16		x	\b, version %d
7015>4	byte&0x0f	x	\b.%d
7016
7017# Guile file magic from <dalepsmith@gmail.com>
7018# https://www.gnu.org/s/guile/
7019# https://git.savannah.gnu.org/gitweb/?p=guile.git;f=libguile/_scm.h;hb=HEAD#l250
7020
70210	string	GOOF----	Guile Object
7022>8	string	LE		\b, little endian
7023>8	string	BE		\b, big endian
7024>11	string	4		\b, 32bit
7025>11	string	8		\b, 64bit
7026>13	regex	.\\..		\b, bytecode v%s
7027
7028#------------------------------------------------------------------------------
7029# $File: c64,v 1.12 2022/05/14 20:03:39 christos Exp $
7030# c64:  file(1) magic for various commodore 64 related files
7031#
7032# From: Dirk Jagdmann <doj@cubic.org>
7033
70340x16500	belong		0x12014100	D64 Image
70350x16500	belong		0x12014180	D71 Image
70360x61800 belong		0x28034400	D81 Image
70370	belong		0x43154164	X64 Image
7038
7039# C64 (and other CBM) cartridges
7040# Extended by David Korth <gerbilsoft@gerbilsoft.com>
7041# Reference: https://vice-emu.sourceforge.io/vice_17.html#SEC391
7042
70430	string		C64\40CARTRIDGE	Commodore 64 cartridge
7044>0x20	ubyte	0	\b,
7045>0x20	ubyte	!0
7046>>0x20	string/T	x	\b: "%.32s",
7047>0x16	beshort	0
7048>>0x18	beshort	0x0000	16 KB game
7049>>0x18	beshort	0x0001	8 KB game
7050>>0x18	beshort	0x0100	UltiMax mode
7051>>0x18	beshort	0x0101	RAM/disabled
7052>0x16	beshort	1	Action Replay
7053>0x16	beshort	2	KCS Power Cartridge
7054>0x16	beshort	3	Final Cartridge III
7055>0x16	beshort	4	Simons' BASIC
7056>0x16	beshort	5	Ocean type 1
7057>0x16	beshort	6	Expert Cartridge
7058>0x16	beshort	7	Fun Play, Power Play
7059>0x16	beshort	8	Super Games
7060>0x16	beshort	9	Atomic Power
7061>0x16	beshort	10	Epyx Fastload
7062>0x16	beshort	11	Westermann Learning
7063>0x16	beshort	12	Rex Utility
7064>0x16	beshort	13	Final Cartridge I
7065>0x16	beshort	14	Magic Formel
7066>0x16	beshort	15	C64 Game System, System 3
7067>0x16	beshort	16	Warp Speed
7068>0x16	beshort	17	Dinamic
7069>0x16	beshort	18	Zaxxon / Super Zaxxon (Sega)
7070>0x16	beshort	19	Magic Desk, Domark, HES Australia
7071>0x16	beshort	20	Super Snapshot V5
7072>0x16	beshort	21	Comal-80
7073>0x16	beshort	22	Structured BASIC
7074>0x16	beshort	23	Ross
7075>0x16	beshort	24	Dela EP64
7076>0x16	beshort	25	Dela EP7x8
7077>0x16	beshort	26	Dela EP256
7078>0x16	beshort	27	Rex EP256
7079>0x16	beshort	28	Mikro Assembler
7080>0x16	beshort	29	Final Cartridge Plus
7081>0x16	beshort	30	Action Replay 4
7082>0x16	beshort	31	Stardos
7083>0x16	beshort	32	EasyFlash
7084>0x16	beshort	33	EasyFlash Xbank
7085>0x16	beshort	34	Capture
7086>0x16	beshort	35	Action Replay 3
7087>0x16	beshort	36
7088>>0x1A	ubyte	1	Nordic Replay
7089>>0x1A	ubyte	!1	Retro Replay
7090>0x16	beshort	37	MMC64
7091>0x16	beshort	38	MMC Replay
7092>0x16	beshort	39	IDE64
7093>0x16	beshort	40	Super Snapshot V4
7094>0x16	beshort	41	IEEE-488
7095>0x16	beshort	42	Game Killer
7096>0x16	beshort	43	Prophet64
7097>0x16	beshort	44	EXOS
7098>0x16	beshort	45	Freeze Frame
7099>0x16	beshort	46	Freeze Machine
7100>0x16	beshort	47	Snapshot64
7101>0x16	beshort	48	Super Explode V5.0
7102>0x16	beshort	49	Magic Voice
7103>0x16	beshort	50	Action Replay 2
7104>0x16	beshort	51	MACH 5
7105>0x16	beshort	52	Diashow-Maker
7106>0x16	beshort	53	Pagefox
7107>0x16	beshort	54	Kingsoft
7108>0x16	beshort	55	Silverrock 128K Cartridge
7109>0x16	beshort	56	Formel 64
7110>0x16	beshort	57
7111>>0x1A	ubyte	1	Hucky
7112>>0x1A	ubyte	!1	RGCD
7113>0x16	beshort	58	RR-Net MK3
7114>0x16	beshort	59	EasyCalc
7115>0x16	beshort	60	GMod2
7116>0x16	beshort	61	MAX Basic
7117>0x16	beshort	62	GMod3
7118>0x16	beshort	63	ZIPP-CODE 48
7119>0x16	beshort	64	Blackbox V8
7120>0x16	beshort	65	Blackbox V3
7121>0x16	beshort	66	Blackbox V4
7122>0x16	beshort	67	REX RAM-Floppy
7123>0x16	beshort	68	BIS-Plus
7124>0x16	beshort	69	SD-BOX
7125>0x16	beshort	70	MultiMAX
7126>0x16	beshort	71	Blackbox V9
7127>0x16	beshort	72	Lt. Kernal Host Adaptor
7128>0x16	beshort	73	RAMLink
7129>0x16	beshort	74	H.E.R.O.
7130>0x16	beshort	75	IEEE Flash! 64
7131>0x16	beshort	76	Turtle Graphics II
7132>0x16	beshort	77	Freeze Frame MK2
7133
71340	string		C128\40CARTRIDGE	Commodore 128 cartridge
7135>0x20	ubyte	0	\b,
7136>0x20	ubyte	!0
7137>>0x20	string/T	x	\b: "%.32s",
7138>0x16	beshort	0	generic cartridge
7139>0x16	beshort	1	Warpspeed128
7140>>0x1A	ubyte	1	\b, REU support
7141>>0x1A	ubyte	2	\b, REU support, with I/O and ROM banking
7142
71430	string		CBM2\40CARTRIDGE	Commodore CBM-II cartridge
7144>0x20	ubyte	!0
7145>>0x20	string/T	x	\b: "%.32s"
7146
71470	string		VIC20\40CARTRIDGE	Commodore VIC-20 cartridge
7148>0x20	ubyte	0	\b,
7149>0x20	ubyte	!0
7150>>0x20	string/T	x	\b: "%.32s",
7151>0x16	beshort	0	generic cartridge
7152>0x16	beshort	1	Mega-Cart
7153>0x16	beshort	2	Behr Bonz
7154>0x16	beshort	3	Vic Flash Plugin
7155>0x16	beshort	4	UltiMem
7156>0x16	beshort	5	Final Expansion
7157
71580	string		PLUS4\40CARTRIDGE	Commodore 16/Plus4 cartridge
7159>0x20	ubyte	!0
7160>>0x20	string/T	x	\b: "%.32s"
7161
7162
7163# DreamLoad archives see:
7164# https://www.lemon64.com/forum/viewtopic.php?t=37415\
7165# &sid=494dc2ca91289e05dadf80a7f8a968fe (at the bottom).
7166# https://www.c64-wiki.com/wiki/DreamLoad.
7167# Example HVSC Commodore 64 music collection:
7168# https://kohina.duckdns.org/HVSC/C64Music/10_Years_HVSC.dfi
7169
71700	byte	0
7171>1	string	DREAMLOAD\40FILE\40ARCHIVE
7172>>0x17	byte	0	DFI Image
7173>>>0x1a	leshort	x	version: %d.
7174>>>0x18	leshort	x	\b%d
7175>>>0x1c	lelong	x	tracks: %d
7176
71770	string		GCR-1541	GCR Image
7178>8	byte		x		version: %i
7179>9	byte		x		tracks: %i
7180
71819	string		PSUR		ARC archive (c64)
71822	string		-LH1-		LHA archive (c64)
7183
71840	string		C64File		PC64 Emulator file
7185>8	string		>\0		"%s"
71860	string		C64Image	PC64 Freezer Image
7187
71880	beshort		0x38CD		C64 PCLink Image
71890	string		CBM\144\0\0	Power 64 C64 Emulator Snapshot
7190
71910	belong		0xFF424CFF	WRAptor packer (c64)
7192
71930	string		C64S\x20tape\x20file	T64 tape Image
7194>32	leshort		x		Version:%#x
7195>36	leshort		!0		Entries:%i
7196>40	string		x		Name:%.24s
7197
71980	string		C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0	T64 tape Image
7199>32	leshort		x		Version:%#x
7200>36	leshort		!0		Entries:%i
7201>40	string		x		Name:%.24s
7202
72030	string		C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0	T64 tape Image
7204>32	leshort		x		Version:%#x
7205>36	leshort		!0		Entries:%i
7206>40	string		x		Name:%.24s
7207
7208# Raw tape file format (.tap files)
7209# Esa Hyyti <esa@netlab.tkk.fi>
72100	string		C64-TAPE-RAW	C64 Raw Tape File (.tap),
7211>0x0c	byte		x		Version:%u,
7212>0x10	lelong		x		Length:%u cycles
7213
7214# magic for Goattracker2, http://covertbitops.c64.org/
7215# from Alex Myczko <alex@aiei.ch>
72160	string		GTS5		GoatTracker 2 song
7217>4	string		>\0		\b, "%s"
7218>36	string		>\0		\b by %s
7219>68	string		>\0		\b (C) %s
7220>100	byte		>0		\b, %u subsong(s)
7221
7222# CBM BASIC (cc65 compiled)
72230	leshort		0x0801
7224>2	leshort		0x080b
7225>6	string		\x9e		CBM BASIC
7226>7	string		>\0		\b, SYS %s
7227
7228#------------------------------------------------------------------------------
7229# $File: cad,v 1.29 2021/12/06 19:33:27 christos Exp $
7230# autocad:  file(1) magic for cad files
7231#
7232
7233# Microstation DGN/CIT Files (www.bentley.com)
7234# Last updated July 29, 2005 by Lester Hightower
7235# DGN is the default file extension of Microstation/Intergraph CAD files.
7236# CIT is the proprietary raster format (similar to TIFF) used to attach
7237# raster underlays to Microstation DGN (vector) drawings.
7238#
7239# http://www.wotsit.org/search.asp
7240# https://filext.com/detaillist.php?extdetail=DGN
7241# https://filext.com/detaillist.php?extdetail=CIT
7242#
7243# https://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2
7244# 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928
7245# https://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682
7246# 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F
7247#
7248# URL:		https://en.wikipedia.org/wiki/MicroStation
7249# reference:	http://dgnlib.maptools.org/dgn.html
7250#		http://dgnlib.maptools.org/dl/ref18.pdf
7251# Update:	Joerg Jenderek
7252# Note: verfied by command like `dgndump seed2d_b.dgn`
7253# test for level 8 and type 5 or 9
72540	beshort&0x3F73	0x0801
7255# level of element like 8
7256#>0	ubyte&0x3F	x			\b, level %u
7257#>0	ubyte		&0x80			\b, complex
7258#>0	ubyte		&0x40			\b, reserved
7259# type of element 9~TCB 8~Digitizer setup 5~Group Data Elements
7260#>1	ubyte&0x7F	x			\b, type %u
7261# words to follow in element: 17H~CEL library 2FEh~DGN 9FEh,DFEh~CIT
7262#>2	uleshort	x			\b, words %#4.4x to follow
7263# test for 3 reserved 0 bytes in CIT or "conversion" in ViewInfo structure (DGN CEL)
7264#>508	ubelong		x			\b, RESERVED %8.8x
7265>508	ubelong&0xFFffFF00	=0
7266# test for level 8 and type 9 for INGR raster image
7267>>0	beshort		0x0809
7268# test for length of 1st element is multiple of blocks a 512 bytes
7269>>>2	ubyte		0xfe
7270>>>>0 	use		ingr-image
7271# test for DGN or CEL by jump words (uleshort) forward to next element
7272>(2.s*2)	ulong		x
7273# 2nd element type: 8~Digitizer~DesiGNfile 1~library cell header other~CIT
7274#>>&1		ubyte&0x7F	x		\b, 2nd type %u
7275# DGN
7276>>&1		ubyte&0x7F	8
7277>>>2		uleshort	=0x02FE		Bentley/Intergraph Microstation CAD drawing
7278!:mime		application/x-bentley-dgn
7279!:ext		dgn
7280# The 0x40 bit of this byte is 1 if the file is 3D, otherwise 0
7281>>>>1214	ubyte  		&0x40		3D
7282>>>>1214	ubyte  		^0x40		2D
7283# 2 chars for name of subunits like ft FT in IN mu m mm '\0 '\040
7284>>>>1120	string		x		\b, units %-.2s
7285# 2 chars for name of master unit like IN in ML SU tn th TH HU mm "\0 "\040 \0\0
7286>>>>1122	string		>\0		%-.2s
7287#>>>>1120	ubelong		x		\b, units %#8.8x
7288# element range low,high x y z like xlow=0 08010000h 01080000h
7289#>>>>4		ubelong	  	!0		\b, xlow %8.8x
7290#>>>>8		ubelong	  	!0		\b, ylow %8.8x
7291#>>>>12		ubelong	  	!0		\b, zlow %8.8x
7292#>>>>16		ubelong	  	!0		\b, xhigh %8.8x
7293#>>>>20		ubelong	  	!0		\b, yhigh %8.8x
7294#>>>>24		ubelong	  	!0		\b, zhigh %8.8x
7295# graphic group number; all other elements in that group have same non-0 number
7296#>>>>28		leshort		x		\b, grphgrp %#4.4x
7297# words to optional attribute linkage
7298#>>>>30		ubyte		x		\b, attindx \%o
7299#>>>>31		ubyte		x		\b\%o
7300# >>30	string	\026\105			DGNFile
7301# >>30	string	\034\105			DGNFile
7302# >>30	string	\073\107			DGNFile
7303# >>30	string	\073\110			DGNFile
7304# >>30	string	\106\107			DGNFile
7305# >>30	string	\110\103			DGNFile
7306# >>30	string	\120\104			DGNFile
7307# >>30	string	\172\104			DGNFile
7308# >>30	string	\172\105			DGNFile
7309# >>30	string	\172\106			DGNFile
7310# >>30	string	\234\106			DGNFile
7311# >>30	string	\273\105			DGNFile
7312# >>30	string	\306\106			DGNFile
7313# >>30	string	\310\104			DGNFile
7314# >>30	string	\341\104			DGNFile
7315# >>30	string	\372\103			DGNFile
7316# >>30	string	\372\104			DGNFile
7317# >>30	string	\372\106			DGNFile
7318# >>30	string	\376\103			DGNFile
7319# elements properties indicator
7320#>>>>32		uleshort	!0		\b, properties %#4.4x
7321# class 0~Primary
7322#>>>>>32		uleshort&0x000F	!0		\b, class %#4.4x
7323# Symbology
7324#>>>>>34		uleshort	x		\b, Symbology %#4.4x
7325# test for 2nd element type 1~library cell header
7326>>&1		ubyte&0x7F	1
7327# test for 1st element with level 8 and type 5 for cell library
7328>>>0		beshort		0x0805		Bentley/Intergraph Microstation CAD cell library
7329!:mime		application/x-bentley-cel
7330!:ext		cel
7331#
7332# URL:		http://fileformats.archiveteam.org/wiki/Intergraph_Raster
7333# reference:	https://web.archive.org/web/20140903185431/
7334#		http://oreilly.com/www/centers/gff/formats/ingr/index.htm
7335# note:		verfied by command like `nconvert -fullinfo LONGLAT.CIT`
7336# display information for intergraph raster bitmap
73370	name	ingr-image
7338# in 5.37 "Microstation CITFile" "Bentley/Intergraph MicroStation CIT raster CAD"
7339# DataTypeCode indicates format, depth of the pixel data and used compression
7340>4	uleshort	x			Intergraph raster image
7341>>4	uleshort	0x0009			\b, Run-Length Encoded 1-bit
7342!:mime	image/x-intergraph-rle
7343!:ext	rel
7344>>4	uleshort	0x0018			\b, CCITT Group 4 1-bit
7345!:mime	image/x-intergraph-cit
7346!:ext	cit
7347>>4	uleshort	27			\b, Adaptive RLE RGB
7348!:mime	image/x-intergraph-rgb
7349!:ext	rgb
7350>>4	default		x
7351>>>4	uleshort	x			\b, Type %u
7352!:mime	image/x-intergraph
7353# TODO:
7354#>4	uleshort	0			\b, no data
7355# ...
7356#>4	uleshort	0x0045			\b, Continuous Tone CMKY (Uncompressed)
7357# ApplicationType: 0~generic raster image 3~drawing, scanning
7358# 8~I/IMAGE and MicroStation Imager 9~ModelView
7359>6	uleshort	!0			\b, ApplicationType %u
7360#>6	uleshort	x			\b, ApplicationType %u
7361# XViewOrigin; Raster grid data X origin
7362#>8	ulequad		!0			\b, XViewOrigin %llx
7363# PixelsPerLine is the number of pixels in a scan line of bitmapp
7364>184	ulelong		x			\b, %u x
7365# NumberOfLines is height of the raster data in scanlines
7366>188	ulelong		x			%u
7367# DeviceResolution; resolution of scanning device
7368# positive indicates number of micros between lines; negative indicates DPI
7369#>192	leshort		x			\b, DeviceResolution %d
7370# ScanlineOrient indicates the origin and the orientation of the scan lines
7371#>194	ubyte		x			\b, ScanlineOrient %x
7372>194	ubyte		x			\b, orientation
7373>194	ubyte		&0x01			right
7374>194	ubyte		^0x01			left
7375>194	ubyte		&0x02			down
7376>194	ubyte		^0x02			top
7377>194	ubyte		&0x04			horizontal
7378>194	ubyte		^0x04			vertical
7379# ScannableFlag; Scanline indexing method used
7380#>195	ubyte		!0			\b, ScannableFlag %#x
7381# RotationAngle; Rotation angle of raster data
7382#>196	ubequad		!0			\b, RotationAngle %#llx
7383# SkewAngle; Skew angle of raster data
7384#>204	ubequad		!0			\b, SkewAngle %llx
7385# DataTypeModifier; Additional raster data format info
7386#>212	uleshort	!0			\b, DataTypeModifier %#4.4x
7387# DesignFile[66]; Name of the design file
7388>214	string		>\0			\b, DesignFile %-.66s
7389# DatabaseFile[66]; Name of the database file
7390>280	string		>\0			\b, DatabaseFile %-.66s
7391# ParentGridFile[66]; Name of parent grid file
7392>346	string		>\0			\b, ParentGridFile %-.66s
7393# FileDescription[80]; Text description of file and contents
7394>412	string		>\0			\b, FileDescription %-.80s
7395# MinValue
7396#>492	ubequad		!0			\b, MinValue %#llx
7397# MaxValue
7398#>500	ubequad		!0			\b, MaxValue %#llx
7399# Reserved[3]; Unused (always 0)
7400#>508	ubelong&0xFFffFF00	x		\b, RESERVED %8.8x
7401# GridFileVersion; Grid File Version like 2 3
7402#>511	ubyte		x			\b, GridFileVersion %x
7403
7404# AutoCAD
7405# Merge of the different contributions and updates from https://en.wikipedia.org/wiki/Dwg
7406# and https://www.iana.org/assignments/media-types/image/vnd.dwg
74070	string	MC0.0	DWG AutoDesk AutoCAD Release 1.0
7408!:mime image/vnd.dwg
74090	string	AC1.2	DWG AutoDesk AutoCAD Release 1.2
7410!:mime image/vnd.dwg
74110	string	AC1.3	DWG AutoDesk AutoCAD Release 1.3
7412!:mime image/vnd.dwg
74130	string	AC1.40	DWG AutoDesk AutoCAD Release 1.40
7414!:mime image/vnd.dwg
74150	string	AC1.50	DWG AutoDesk AutoCAD Release 2.05
7416!:mime image/vnd.dwg
74170	string	AC2.10	DWG AutoDesk AutoCAD Release 2.10
7418!:mime image/vnd.dwg
74190	string	AC2.21	DWG AutoDesk AutoCAD Release 2.21
7420!:mime image/vnd.dwg
74210	string	AC2.22	DWG AutoDesk AutoCAD Release 2.22
7422!:mime image/vnd.dwg
74230	string	AC1001	DWG AutoDesk AutoCAD Release 2.22
7424!:mime image/vnd.dwg
74250	string	AC1002	DWG AutoDesk AutoCAD Release 2.50
7426!:mime image/vnd.dwg
74270	string	AC1003	DWG AutoDesk AutoCAD Release 2.60
7428!:mime image/vnd.dwg
74290	string	AC1004	DWG AutoDesk AutoCAD Release 9
7430!:mime image/vnd.dwg
74310	string	AC1006	DWG AutoDesk AutoCAD Release 10
7432!:mime image/vnd.dwg
74330	string	AC1009	DWG AutoDesk AutoCAD Release 11/12
7434!:mime image/vnd.dwg
7435# AutoCAD DWG versions R13/R14 (www.autodesk.com)
7436# Written December 01, 2003 by Lester Hightower
7437# Based on the DWG File Format Specifications at http://www.opendwg.org/
7438# AutoCad, from Nahuel Greco
7439# AutoCAD DWG versions R12/R13/R14 (www.autodesk.com)
74400	string	AC1012	DWG AutoDesk AutoCAD Release 13
7441!:mime image/vnd.dwg
74420	string	AC1013	DWG AutoDesk AutoCAD Release 13c3
7443!:mime image/vnd.dwg
74440	string	AC1014	DWG AutoDesk AutoCAD Release 14
7445!:mime image/vnd.dwg
74460	string	AC1015	DWG AutoDesk AutoCAD 2000
7447!:mime image/vnd.dwg
7448
7449# A new version of AutoCAD DWG
7450# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru,
7451# ICQ 358572321)
7452# From various sources like:
7453# https://autodesk.blogs.com/between_the_lines/autocad-release-history.html
74540	string	AC1018	DWG AutoDesk AutoCAD 2004/2005/2006
7455!:mime image/vnd.dwg
74560	string	AC1021	DWG AutoDesk AutoCAD 2007/2008/2009
7457!:mime image/vnd.dwg
74580	string	AC1024	DWG AutoDesk AutoCAD 2010/2011/2012
7459!:mime image/vnd.dwg
74600	string	AC1027	DWG AutoDesk AutoCAD 2013-2017
7461!:mime image/vnd.dwg
7462
7463# From GNU LibreDWG
74640	string	AC1032	DWG AutoDesk AutoCAD 2018/2019/2020
7465!:mime image/vnd.dwg
74660	string	AC1035	DWG AutoDesk AutoCAD 2021
7467!:mime image/vnd.dwg
7468
7469# KOMPAS 2D drawing from ASCON
7470# This is KOMPAS 2D drawing or fragment of drawing but is not detailed nor
7471# gathered nor specification
7472# ASCON https://ascon.net/main/ in English,
7473#	https://ascon.ru/ main site in Russian
7474# Extension is CDW for drawing and FRW for fragment of drawing
7475# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru,
7476# ICQ 358572321, https://vkontakte.ru/id16076543)
7477# From:
7478# https://sd.ascon.ru/otrs/customer.pl?Action=CustomerFAQ&CategoryID=4&ItemID=292
7479# (in russian) and my experiments
74800	string	KF
7481>2	belong	0x4E00000C	Kompas drawing 12.0 SP1
7482>2	belong	0x4D00000C	Kompas drawing 12.0
7483>2	belong	0x3200000B	Kompas drawing 11.0 SP1
7484>2	belong	0x3100000B	Kompas drawing 11.0
7485>2	belong	0x2310000A	Kompas drawing 10.0 SP1
7486>2	belong	0x2110000A	Kompas drawing 10.0
7487>2	belong	0x08000009	Kompas drawing 9.0 SP1
7488>2	belong	0x05000009	Kompas drawing 9.0
7489>2	belong	0x33010008	Kompas drawing 8+
7490>2	belong	0x1A000008	Kompas drawing 8.0
7491>2	belong	0x2C010107	Kompas drawing 7+
7492>2	belong	0x05000007	Kompas drawing 7.0
7493>2	belong	0x32000006	Kompas drawing 6+
7494>2	belong	0x09000006	Kompas drawing 6.0
7495>2	belong	0x5C009005	Kompas drawing 5.11R03
7496>2	belong	0x54009005	Kompas drawing 5.11R02
7497>2	belong	0x51009005	Kompas drawing 5.11R01
7498>2	belong	0x22009005	Kompas drawing 5.10R03
7499>2	belong	0x22009005	Kompas drawing 5.10R02 mar
7500>2	belong	0x21009005	Kompas drawing 5.10R02 febr
7501>2	belong	0x19009005	Kompas drawing 5.10R01
7502>2	belong	0xF4008005	Kompas drawing 5.9R01.003
7503>2	belong	0x1C008005	Kompas drawing 5.9R01.002
7504>2	belong	0x11008005	Kompas drawing 5.8R01.003
7505
7506# CAD: file(1) magic for computer aided design files
7507# Phillip Griffith <phillip dot griffith at gmail dot com>
7508# AutoCAD magic taken from the Open Design Alliance's OpenDWG specifications.
7509#
7510
7511# 3DS (3d Studio files)
75120	leshort		0x4d4d
7513>6	leshort		0x2
7514>>8	lelong		0xa
7515>>>16	leshort		0x3d3d	3D Studio model
7516# Beat sgi MMV
7517!:strength +20
7518!:mime	image/x-3ds
7519!:ext 3ds
7520
7521# MegaCAD 2D/3D drawing (.prt)
7522# https://megacad.de/
7523# From: Markus Heidelberg <markus.heidelberg@web.de>
75240	string	MegaCad23\0	MegaCAD 2D/3D drawing
7525
7526# Hoops CAD files
7527# https://docs.techsoft3d.com/visualize/3df/latest/build/general/hsf/\
7528# HSF_architecture.html
7529# Stephane Charette <stephane.charette@gmail.com>
75300	string	;;\020HSF\020V		OpenHSF (Hoops Stream Format)
7531>7	regex/9 V[.0-9]{4,5}\020	%s
7532!:ext hsf
7533
7534# AutoCAD Drawing Exchange Format
75350	regex		\^[\ \t]*0\r?\000$
7536>1	regex		\^[\ \t]*SECTION\r?$
7537>>2	regex		\^[\ \t]*2\r?$
7538>>>3	regex		\^[\ \t]*HEADER\r?$	AutoCAD Drawing Exchange Format
7539!:mime	application/x-dxf
7540!:ext	dxf
7541>>>>&1	search/8192	AC1006			\b, R10
7542>>>>&1	search/8192	AC1009			\b, R11/R12
7543>>>>&1	search/8192	AC1012			\b, R13
7544>>>>&1	search/8192	AC1013			\b, R13c3
7545>>>>&1	search/8192	AC1014			\b, R14
7546>>>>&1	search/8192	AC1015			\b, version 2000
7547>>>>&1	search/8192	AC1018			\b, version 2004
7548>>>>&1	search/8192	AC1021			\b, version 2007
7549>>>>&1	search/8192	AC1024			\b, version 2010
7550>>>>&1	search/8192	AC1027			\b, version 2013
7551>>>>&1	search/8192	AC1032			\b, version 2018
7552>>>>&1	search/8192	AC1035			\b, version 2021
7553
7554# The Sketchup 3D model format https://www.sketchup.com/
75550	string	\xff\xfe\xff\x0e\x53\x00\x6b\x00\x65\x00\x74\x00\x63\x00\x68\x00\x55\x00\x70\x00\x20\x00\x4d\x00\x6f\x00\x64\x00\x65\x00\x6c\x00	SketchUp Model
7556!:mime application/vnd.sketchup.skp
7557!:ext skp
7558
75594	regex/b	P[0-9][0-9]\\.[0-9][0-9][0-9][0-9]\\.[0-9][0-9][0-9][0-9]\\.[0-9]	NAXOS CAD System file from version %s
7560!:strength +40
7561
7562# glTF (GL Transmission Format) - by the Khronos Group
7563# Reference: https://github.com/KhronosGroup/glTF/tree/master/specification/2.0#glb-file-format-specification
75640	string		glTF		glTF binary model
7565>4	ulelong		x		\b, version %d
7566>8	ulelong		x		\b, length %d bytes
7567!:mime	model/gltf-binary
7568!:ext	glb
7569
7570# FBX (FilmBoX) - by Kaydara/Autodesk
7571# Reference: https://code.blender.org/2013/08/fbx-binary-file-format-specification
75720	string	Kaydara\ FBX\ Binary\ \ \0	Kaydara FBX model,
7573>&2	ulelong	x	version %d
7574!:ext	fbx
7575
7576# PLY (Polygon File Format/Stanford Triangle Format) - by Greg Turk
7577# Reference: https://web.archive.org/web/20161204152348/http://www.dcs.ed.ac.uk/teaching/cs4/www/graphics/Web/ply.html
75780	string	ply\n          	PLY model,
7579!:ext	ply
7580>4	string	format\ ascii\ 	ASCII,
7581>>&0	regex/6	[0-9.]+        	version %s
7582>4	string	format\ binary  	binary,
7583>>&0	string	_little_endian\ 	little endian,
7584>>>&0	regex/6	[0-9.]+         	version %s
7585>>&0	string	_big_endian\ 	big endian,
7586>>>&0	regex/6	[0-9.]+      	version %s
7587
7588# VRML (Virtual Reality Modeling Language) - by the Web3D Consortium
7589# From:      Michel Briand <michelbriand@free.fr>
7590# Reference: https://www.web3d.org/standards
75910	string/w	#VRML\ V1.0\ ascii	VRML 1 file
7592!:mime	model/vrml
7593!:ext	wrl
75940	string/w	#VRML\ V2.0\ utf8	ISO/IEC 14772 VRML 97 file
7595!:mime	model/vrml
7596!:ext	wrl
7597# X3D, VRML encoded
75980	string	#X3D	X3D (Extensible 3D) model, VRML format
7599>4	string	V
7600>>5	regex/6	[0-9.]+	\b, version %s
7601!:mime	model/x3d+vrml
7602!:ext	x3dv
7603
7604## XML-based 3D CAD Formats
7605# From: Michel Briand <michelbriand@free.fr>, Oliver Galvin <odg@riseup.net>
76060	string/w        \<?xml\ version=
7607!:strength + 5
7608# X3D (Extensible 3D)
7609# Schema:    https://www.web3d.org/specifications/x3d-3.2.dtd
7610# MIME Type: https://www.iana.org/assignments/media-types/model/x3d+xml
7611# Example:   https://www.web3d.org/x3d/content/examples/Basic/course/CreateX3DFromStringRandomSpheres.x3d
7612>20	search/1000/w   \<!DOCTYPE\ X3D         X3D (Extensible 3D) model, XML document
7613!:mime	model/x3d+xml
7614!:ext	x3d
7615# COLLADA (COLLAborative Design Activity) - by the Khronos Group
7616# Schema:    http://www.collada.org/2005/11/COLLADASchema
7617# Reference: https://www.khronos.org/collada
7618>20	search/1000/w	\<COLLADA	COLLADA model, XML document
7619!:mime	model/vnd.collada+xml
7620!:ext	dae
7621# 3MF (3D Manufacturing Format) - by the 3MF Consortium
7622# Schema:    http://schemas.microsoft.com/3dmanufacturing/core/2015/02
7623# Reference: https://3mf.io/specification
7624>20	search/1000/w	xmlns="http://schemas.microsoft.com/3dmanufacturing	3MF (3D Manufacturing Format) model, XML document
7625!:mime	model/3mf
7626!:ext	3mf
7627# AMF (Additive Manufacturing File)
7628# Reference: https://www.astm.org/Standards/ISOASTM52915.htm
7629>20	search/1000/w	\<amf	AMF (Additive Manufacturing Format) model, XML document
7630!:mime	application/x-amf
7631!:ext	amf
7632
7633#------------------------------------------------------------------------------
7634# $File: cafebabe,v 1.28 2022/07/01 23:24:47 christos Exp $
7635# Cafe Babes unite!
7636#
7637# Since Java bytecode and Mach-O universal binaries have the same magic number,
7638# the test must be performed in the same "magic" sequence to get both right.
7639# The long at offset 4 in a Mach-O universal binary tells the number of
7640# architectures; the short at offset 4 in a Java bytecode file is the JVM minor
7641# version and the short at offset 6 is the JVM major version.  Since there are only
7642# only 18 labeled Mach-O architectures at current, and the first released
7643# Java class format was version 43.0, we can safely choose any number
7644# between 18 and 39 to test the number of architectures against
7645# (and use as a hack). Let's not use 18, because the Mach-O people
7646# might add another one or two as time goes by...
7647#
7648### JAVA START ###
7649# Reference:	http://en.wikipedia.org/wiki/Java_class_file
7650# Update:	Joerg Jenderek
76510	belong		0xcafebabe
7652>4	ubelong		>30		compiled Java class data,
7653!:mime	application/x-java-applet
7654#!:mime	application/java-byte-code
7655!:ext	class
7656>>6	ubeshort	x	        version %d.
7657>>4	ubeshort	x       	\b%d
7658# for debugging purpose version as hexadecimal to compare with Mach-O universal binary
7659#>>4	ubelong		x       	(%#8.8x)
7660# Which is which?
7661# https://docs.oracle.com/javase/specs/jvms/se6/html/ClassFile.doc.html
7662#>>4	belong		0x002b		(Java 0.?)
7663#>>4	belong		0x032d		(Java 1.0)
7664#>>4	belong		0x032d		(Java 1.1)
7665>>4	belong		0x002e		(Java 1.2)
7666>>4	belong		0x002f		(Java 1.3)
7667>>4	belong		0x0030		(Java 1.4)
7668>>4	belong		0x0031		(Java 1.5)
7669>>4	belong		0x0032		(Java 1.6)
7670>>4	belong		0x0033		(Java 1.7)
7671>>4	belong		0x0034		(Java 1.8)
7672>>4	belong		0x0035		(Java SE 9)
7673>>4	belong		0x0036		(Java SE 10)
7674>>4	belong		0x0037		(Java SE 11)
7675>>4	belong		0x0038		(Java SE 12)
7676>>4	belong		0x0039		(Java SE 13)
7677>>4	belong		0x003A		(Java SE 14)
7678>>4	belong		0x003B		(Java SE 15)
7679>>4	belong		0x003C		(Java SE 16)
7680>>4	belong		0x003D		(Java SE 17)
7681>>4	belong		0x003E		(Java SE 18)
7682>>4	belong		0x003F		(Java SE 19)
7683>>4	belong		0x0040		(Java SE 20)
7684# pool count unequal zero
7685#>>8	beshort		x	        \b, pool count %#x
7686# pool table
7687#>>10	ubequad		x	        \b, pool %#16.16llx...
7688
76890	belong		0xcafed00d	JAR compressed with pack200,
7690>5	byte		x		version %d.
7691>4	byte		x		\b%d
7692!:mime	application/x-java-pack200
7693
7694
76950	belong		0xcafed00d	JAR compressed with pack200,
7696>5	byte		x		version %d.
7697>4	byte		x		\b%d
7698!:mime	application/x-java-pack200
7699
7700### JAVA END ###
7701### MACH-O START ###
7702# URL:		https://en.wikipedia.org/wiki/Mach-O
7703
77040	name		mach-o		\b [
7705# for debugging purpose CPU type as hexadecimal
7706#>0	ubequad		x		CPU=%16.16llx
7707# display CPU type as string like: i386 x86_64 ... armv7 armv7k ...
7708>0	use		mach-o-cpu	\b
7709# for debugging purpose print offset to 1st mach_header like:
7710# 1000h 4000h seldom 2d000h 88000h 5b000h 10e000 h
7711#>8	ubelong		x		at %#x offset
7712>(8.L)	indirect	x		\b:
7713>0	belong		x		\b]
7714
7715# Reference:	https://opensource.apple.com/source/cctools/cctools-949.0.1/
7716#		include/mach-o/fat.h
7717#		include/mach/machine.h
77180	belong		0xcafebabe
7719>4	belong		1		Mach-O universal binary with 1 architecture:
7720!:mime application/x-mach-binary
7721>>8	use		mach-o		\b
7722# nfat_arch; number of CPU architectures; highest is 18 for CPU_TYPE_POWERPC in 2020
7723>4	ubelong		>1
7724>>4	ubelong		<20		Mach-O universal binary with %d architectures:
7725!:mime application/x-mach-binary
7726>>>8	use		mach-o		\b
7727>>>4	ubelong		>1
7728>>>>28	use		mach-o		\b
7729>>>4	ubelong		>2
7730>>>>48	use		mach-o		\b
7731>>>4	ubelong		>3
7732>>>>68	use		mach-o		\b
7733>>>4	ubelong		>4
7734>>>>88	use		mach-o		\b
7735>>>4	ubelong		>5
7736>>>>108	use		mach-o		\b
7737
7738### MACH-O END ###
7739
7740#------------------------------------------------------------------------------
7741# $File: cbor,v 1.1 2015/01/28 01:05:21 christos Exp $
7742# cbor:  file(1) magic for CBOR files as defined in RFC 7049
7743
77440	string	\xd9\xd9\xf7 Concise Binary Object Representation (CBOR) container
7745!:mime	application/cbor
7746>3	ubyte	<0x20	(positive integer)
7747>3	ubyte	<0x40
7748>>3	ubyte	>0x1f	(negative integer)
7749>3	ubyte	<0x60
7750>>3	ubyte	>0x3f	(byte string)
7751>3	ubyte	<0x80
7752>>3	ubyte	>0x5f	(text string)
7753>3	ubyte	<0xa0
7754>3	ubyte	>0x7f	(array)
7755>3	ubyte	<0xc0
7756>>3	ubyte	>0x9f	(map)
7757>3	ubyte	<0xe0
7758>>3	ubyte	>0xbf	(tagged)
7759>3	ubyte	>0xdf	(other)
7760
7761#------------------------------------------------------------------------------
7762# $File: ccf,v 1.1 2022/02/15 12:57:45 christos Exp $
7763# file(1) magic(5) data for Phillips remote controls
7764
7765# Exchange format for Philips Pronto universal infrared remote controls
7766# A CCF file describes a learned/customized remote control,
7767# i.e. it contains button UI and infrared pulse code definitions
7768# (Georg Sauthoff)
7769# http://files.remotecentral.com/download/45/pan-air-csakr.zip.html
7770# https://github.com/gsauthof/pronto-ccf/blob/
7771
77728	string	@\xa5Z@_CCF
7773>32	string	CCF\x00		Philips Pronto IR remote control CCF
7774
7775#------------------------------------------------------------------------------
7776# $File: cddb,v 1.4 2009/09/19 16:28:08 christos Exp $
7777# CDDB: file(1) magic for CDDB(tm) format CD text data files
7778#
7779# From <steve@gracenote.com>
7780#
7781# This is the /etc/magic entry to decode datafiles as used by
7782# CDDB-enabled CD player applications.
7783#
7784
77850	search/1/w	#\040xmcd	CDDB(tm) format CD text data
7786
7787#------------------------------------------------------------------------------
7788# $File: chord,v 1.5 2010/09/20 19:19:16 rrt Exp $
7789# chord: file(1) magic for Chord music sheet typesetting utility input files
7790#
7791# From Philippe De Muyter <phdm@macqel.be>
7792# File format is actually free, but many distributed files begin with `{title'
7793#
77940	string		{title		Chord text file
7795
7796# Type:	PowerTab file format
7797# URL:	http://www.power-tab.net/
7798# From:	Jelmer Vernooij <jelmer@samba.org>
77990	string		ptab\003\000	Power-Tab v3 Tablature File
78000	string		ptab\004\000	Power-Tab v4 Tablature File
7801
7802#------------------------------------------------------------------------------
7803# $File: cisco,v 1.4 2009/09/19 16:28:08 christos Exp $
7804# cisco:  file(1) magic for cisco Systems routers
7805#
7806# Most cisco file-formats are covered by the generic elf code
7807#
7808# Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha.
78090	belong&0xffffff00	0x85011400  cisco IOS microcode
7810>7	string		>\0		    for '%s'
78110	belong&0xffffff00	0x8501cb00  cisco IOS experimental microcode
7812>7	string		>\0		    for '%s'
7813
7814#------------------------------------------------------------------------------
7815# $File: citrus,v 1.5 2021/01/04 19:48:31 christos Exp $
7816# citrus locale declaration
7817#
7818
78190	string		RuneCT		Citrus locale declaration for LC_CTYPE
78200	string		CtrsME		Citrus locale declaration for LC_MESSAGES
78210	string		CtrsMO		Citrus locale declaration for LC_MONETARY
78220	string		CtrsNU		Citrus locale declaration for LC_NUMERIC
78230	string		CtrsTI		Citrus locale declaration for LC_TIME
7824
7825#------------------------------------------------------------------------------
7826# $File: c-lang,v 1.30 2021/08/16 10:17:05 christos Exp $
7827# c-lang:  file(1) magic for C and related languages programs
7828#
7829# The strength is to beat standard HTML
7830
7831# BCPL
78320	search/8192	"libhdr"	BCPL source text
7833!:mime	text/x-bcpl
78340	search/8192	"LIBHDR"	BCPL source text
7835!:mime	text/x-bcpl
7836
7837# C
7838# Check for class if include is found, otherwise class is beaten by include because of lowered strength
78390	search/8192	#include
7840>0	regex	\^#include			C
7841>>0	regex	\^class[[:space:]]+
7842>>>&0	regex 	\\{[\.\*]\\}(;)?$			\b++
7843>>&0	clear	x				source text
7844!:strength + 13
7845!:mime	text/x-c
78460	search/8192	pragma
7847>0	regex	\^#[[:space:]]*pragma	C source text
7848!:mime	text/x-c
78490	search/8192	endif
7850>0	regex	\^#[[:space:]]*(if\|ifn)def
7851>>&0	regex	\^#[[:space:]]*endif$	C source text
7852!:mime	text/x-c
78530	search/8192	define
7854>0	regex	\^#[[:space:]]*(if\|ifn)def
7855>>&0	regex	\^#[[:space:]]*define	C source text
7856!:mime	text/x-c
78570	search/8192	char
7858>0	regex	\^[[:space:]]*char(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$			C source text
7859!:mime	text/x-c
78600	search/8192	double
7861>0	regex	\^[[:space:]]*double(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$			C source text
7862!:mime	text/x-c
78630	search/8192	extern
7864>0	regex	\^[[:space:]]*extern[[:space:]]+		C source text
7865!:mime	text/x-c
78660	search/8192	float
7867>0	regex	\^[[:space:]]*float(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$			C source text
7868!:mime	text/x-c
78690	search/8192	struct
7870>0	regex	\^struct[[:space:]]+		C source text
7871!:mime	text/x-c
78720	search/8192	union
7873>0	regex	\^union[[:space:]]+		C source text
7874!:mime	text/x-c
78750	search/8192	main(
7876>&0	search/64	String			Java source text
7877!:mime	text/x-java
7878>&0	default		x
7879>>&0 regex	\\)[[:space:]]*\\{		C source text
7880!:mime	text/x-c
7881
7882# C++
7883# The strength of these rules is increased so they beat the C rules above
78840	search/8192	namespace
7885>0	regex	\^namespace[[:space:]]+[_[:alpha:]]{1,30}[[:space:]]*\\{	C++ source text
7886!:strength + 30
7887!:mime	text/x-c++
7888# using namespace [namespace] or using std::[lib]
78890	search/8192	using
7890>0	regex	\^using[[:space:]]+(namespace\ )?std(::)?[[:alpha:]]*[[:space:]]*;		C++ source text
7891!:strength + 30
7892!:mime	text/x-c++
78930	search/8192	template
7894>0	regex	\^[[:space:]]*template[[:space:]]*<.*>[[:space:]]*$	C++ source text
7895!:strength + 30
7896!:mime	text/x-c++
78970	search/8192	virtual
7898>0	regex	\^[[:space:]]*virtual[[:space:]]+.*[};][[:space:]]*$		C++ source text
7899!:strength + 30
7900!:mime	text/x-c++
7901# But class alone is reduced to avoid beating php (Jens Schleusener)
79020	search/8192	class
7903>0	regex	\^[[:space:]]*class[[:space:]]+[[:digit:][:alpha:]:_]+[[:space:]]*\\{(.*[\n]*)*\\}(;)?$		C++ source text
7904!:strength + 13
7905!:mime	text/x-c++
79060	search/8192	public
7907>0	regex	\^[[:space:]]*public:		C++ source text
7908!:strength + 30
7909!:mime	text/x-c++
79100	search/8192	private
7911>0	regex	\^[[:space:]]*private:		C++ source text
7912!:strength + 30
7913!:mime	text/x-c++
79140	search/8192	protected
7915>0	regex	\^[[:space:]]*protected:		C++ source text
7916!:strength + 30
7917!:mime	text/x-c++
7918
7919# Objective-C
79200	search/8192	#import
7921>0	regex	\^#import			Objective-C source text
7922!:strength + 25
7923!:mime	text/x-objective-c
7924
7925# From: Mikhail Teterin <mi@aldan.algebra.com>
79260	string		cscope		cscope reference data
7927>7	string		x		version %.2s
7928# We skip the path here, because it is often long (so file will
7929# truncate it) and mostly redundant.
7930# The inverted index functionality was added some time between
7931# versions 11 and 15, so look for -q if version is above 14:
7932>7	string		>14
7933>>10	search/100	\ -q\ 		with inverted index
7934>10	search/100	\ -c\ 		text (non-compressed)
7935
7936#------------------------------------------------------------------------------
7937# $File: clarion,v 1.5 2014/04/30 21:41:02 christos Exp $
7938# clarion:  file(1) magic for # Clarion Personal/Professional Developer
7939# (v2 and above)
7940# From: Julien Blache <jb@jblache.org>
7941
7942# Database files
7943# signature
79440	leshort	0x3343	Clarion Developer (v2 and above) data file
7945# attributes
7946>2	leshort	&0x0001	\b, locked
7947>2	leshort	&0x0004	\b, encrypted
7948>2	leshort	&0x0008	\b, memo file exists
7949>2	leshort	&0x0010	\b, compressed
7950>2	leshort	&0x0040	\b, read only
7951# number of records
7952>5	lelong	x	\b, %d records
7953
7954# Memo files
79550	leshort	0x334d	Clarion Developer (v2 and above) memo data
7956
7957# Key/Index files
7958# No magic? :(
7959
7960# Help files
79610	leshort	0x49e0	Clarion Developer (v2 and above) help data
7962
7963#------------------------------------------------------------------------------
7964# $File: claris,v 1.8 2016/07/18 19:23:38 christos Exp $
7965# claris:  file(1) magic for claris
7966# "H. Nanosecond" <aldomel@ix.netcom.com>
7967# Claris Works a word processor, etc.
7968# Version 3.0
7969
7970# .pct claris works clip art files
7971#0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
7972#*
7973#0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000
7974#null to byte 1000 octal
7975514	string	\377\377\377\377\000
7976>0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0	Claris clip art
7977514	string	\377\377\377\377\001
7978>0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0	Claris clip art
7979
7980# Claris works files
7981# .cwk
7982# Moved to Apple AppleWorks document
7983#0	string	\002\000\210\003\102\117\102\117\000\001\206 Claris works document
7984# .plt
79850	string	\020\341\000\000\010\010	Claris Works palette files .plt
7986
7987# .msp a dictionary file I am not sure about this I have only one .msp file
79880	string	\002\271\262\000\040\002\000\164	Claris works dictionary
7989
7990# .usp are user dictionary bits
7991# I am not sure about a magic header:
7992#0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151
7993#        soh   S   p   f   8   U   D  sp   ^   S  cr  nl   p   o   d   i
7994#0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043
7995#          a   t   r   i   s   t  sp   ^   S  cr  nl   d   i   v  sp   #
7996
7997# .mth Thesaurus
7998# starts with \0 but no magic header
7999
8000# .chy Hyphenation file
8001# I am not sure: 000 210 034 000 000
8002
8003# other claris files
8004#./windows/claris/useng.ndx: data
8005#./windows/claris/xtndtran.l32: data
8006#./windows/claris/xtndtran.lst: data
8007#./windows/claris/clworks.lbl: data
8008#./windows/claris/clworks.prf: data
8009#./windows/claris/userd.spl: data
8010
8011#------------------------------------------------------------------------------
8012# $File: clipper,v 1.9 2020/12/15 23:57:27 christos Exp $
8013# clipper:  file(1) magic for Intergraph (formerly Fairchild) Clipper.
8014#
8015# XXX - what byte order does the Clipper use?
8016#
8017# XXX - what's the "!" stuff:
8018#
8019# >18	short		!074000,000000	C1 R1
8020# >18	short		!074000,004000	C2 R1
8021# >18	short		!074000,010000	C3 R1
8022# >18	short		!074000,074000	TEST
8023#
8024# I shall assume it's ANDing the field with the first value and
8025# comparing it with the second, and rewrite it as:
8026#
8027# >18	short&074000	000000		C1 R1
8028# >18	short&074000	004000		C2 R1
8029# >18	short&074000	010000		C3 R1
8030# >18	short&074000	074000		TEST
8031#
8032# as SVR3.1's "file" doesn't support anything of the "!074000,000000"
8033# sort, nor does SunOS 4.x, so either it's something Intergraph added
8034# in CLIX, or something AT&T added in SVR3.2 or later, or something
8035# somebody else thought was a good idea; it's not documented in the
8036# man page for this version of "magic", nor does it appear to be
8037# implemented (at least not after I blew off the bogus code to turn
8038# old-style "&"s into new-style "&"s, which just didn't work at all).
8039#
80400	short		0575		CLIPPER COFF executable (VAX #)
8041>20	short		0407		(impure)
8042>20	short		0410		(5.2 compatible)
8043>20	short		0411		(pure)
8044>20	short		0413		(demand paged)
8045>20	short		0443		(target shared library)
8046>12	long		>0		not stripped
8047>22	short		>0		- version %d
80480	short		0577		CLIPPER COFF executable
8049>18	short&074000	000000		C1 R1
8050>18	short&074000	004000		C2 R1
8051>18	short&074000	010000		C3 R1
8052>18	short&074000	074000		TEST
8053>20	short		0407		(impure)
8054>20	short		0410		(pure)
8055>20	short		0411		(separate I&D)
8056>20	short		0413		(paged)
8057>20	short		0443		(target shared library)
8058>12	long		>0		not stripped
8059>22	short		>0		- version %d
8060>48	long&01		01		alignment trap enabled
8061>52	byte		1		-Ctnc
8062>52	byte		2		-Ctsw
8063>52	byte		3		-Ctpw
8064>52	byte		4		-Ctcb
8065>53	byte		1		-Cdnc
8066>53	byte		2		-Cdsw
8067>53	byte		3		-Cdpw
8068>53	byte		4		-Cdcb
8069>54	byte		1		-Csnc
8070>54	byte		2		-Cssw
8071>54	byte		3		-Cspw
8072>54	byte		4		-Cscb
8073#4	string		pipe		CLIPPER instruction trace
8074#4	string		prof		CLIPPER instruction profile
8075#------------------------------------------------------------------------------
8076# file:  file(1) magic for Clojure
8077# URL:  https://clojure.org/
8078# From: Jason Felice <jason.m.felice@gmail.com>
8079
80800	string/w	#!\ /usr/bin/clj	Clojure script text executable
8081!:mime	text/x-clojure
80820	string/w	#!\ /usr/local/bin/clj	Clojure script text executable
8083!:mime	text/x-clojure
80840	string/w	#!\ /usr/bin/clojure	Clojure script text executable
8085!:mime	text/x-clojure
80860	string/w	#!\ /usr/local/bin/clojure	Clojure script text executable
8087!:mime	text/x-clojure
80880	string/W	#!/usr/bin/env\ clj	Clojure script text executable
8089!:mime	text/x-clojure
80900	string/W	#!/usr/bin/env\ clojure	Clojure script text executable
8091!:mime	text/x-clojure
80920	string/W	#!\ /usr/bin/env\ clj	Clojure script text executable
8093!:mime	text/x-clojure
80940	string/W	#!\ /usr/bin/env\ clojure	Clojure script text executable
8095!:mime	text/x-clojure
8096
80970	regex	\^\\\(ns[[:space:]]+[a-z]	Clojure module source text
8098!:mime	text/x-clojure
8099
81000	regex	\^\\\(ns[[:space:]]+\\\^\\{:	Clojure module source text
8101!:mime	text/x-clojure
8102
81030	regex	\^\\\(defn-?[[:space:]]	Clojure module source text
8104!:mime	text/x-clojure
8105
8106#------------------------------------------------------------------------------
8107# $File: coff,v 1.6 2021/04/26 15:56:00 christos Exp $
8108# coff: file(1) magic for Common Object Files not specific to known cpu types or manufactures
8109#
8110# COFF
8111#
8112# by Joerg Jenderek at Oct 2015, Feb 2021
8113# https://en.wikipedia.org/wiki/COFF
8114# https://de.wikipedia.org/wiki/Common_Object_File_Format
8115# http://www.delorie.com/djgpp/doc/coff/filhdr.html
8116
8117# display name+variables+flags of Common Object Files Format (32bit)
8118# Maybe used also in adi,att3b,clipper,hitachi-sh,hp,ibm6000,intel,
8119# mips,motorola,msdos,osf1,sharc,varied.out,vax
81200	name				display-coff
8121# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags
8122>18	uleshort&0x8E80	0
8123# skip DOCTOR.DAILY READER.NDA REDBOX.ROOT by looking for positive number of sections
8124>>2	uleshort	>0
8125# skip ega80woa.fnt svgafix.fnt HP3FNTS1.DAT HP3FNTS2.DAT INTRO.ACT LEARN.PIF by looking for low number of sections
8126>>>2	uleshort	<4207
8127>>>>0	clear		x
8128# f_magic - magic number
8129# DJGPP, 80386 COFF executable, MS Windows COFF Intel 80386 object file (./intel)
8130>>>>0	uleshort	0x014C		Intel 80386
8131# Hitachi SH big-endian COFF (./hitachi-sh)
8132>>>>0	uleshort	0x0500		Hitachi SH big-endian
8133# Hitachi SH little-endian COFF (./hitachi-sh)
8134>>>>0	uleshort	0x0550		Hitachi SH little-endian
8135# executable (RISC System/6000 V3.1) or obj module (./ibm6000)
8136#>>>>0	uleshort	0x01DF
8137# MS Windows COFF Intel Itanium, AMD64
8138# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680313(v=vs.85).aspx
8139>>>>0	uleshort	0x0200		Intel ia64
8140>>>>0	uleshort	0x8664		Intel amd64
8141# ARM COFF (./arm)
8142>>>>0	uleshort	0xaa64		Aarch64
8143>>>>0	uleshort	0x01c0		ARM
8144>>>>0	uleshort	0x01c2		ARM Thumb
8145>>>>0	uleshort	0x01c4		ARMv7 Thumb
8146# TODO for other COFFs
8147#>>>>0	uleshort	0xABCD		COFF_TEMPLATE
8148>>>>0	default		x
8149>>>>>0	uleshort	x		type %#04x
8150>>>>0	uleshort	x		COFF
8151# F_EXEC flag bit
8152>>>>18	leshort		^0x0002		object file
8153!:mime	application/x-coff
8154!:ext	o/obj/lib
8155# no cof sample found
8156#!:ext	cof/o/obj/lib
8157>>>>18	leshort		&0x0002		executable
8158#!:mime	application/x-coffexec
8159# F_RELFLG flag bit,static object
8160>>>>18	leshort		&0x0001		\b, no relocation info
8161# F_LNNO flag bit
8162>>>>18	leshort		&0x0004		\b, no line number info
8163# F_LSYMS flag bit
8164>>>>18	leshort		&0x0008		\b, stripped
8165>>>>18	leshort		^0x0008		\b, not stripped
8166# flags in other COFF versions
8167#0x0010    F_FDPR_PROF
8168#0x0020    F_FDPR_OPTI
8169#0x0040    F_DSA
8170# F_AR32WR flag bit
8171#>>>>18	leshort		&0x0100		\b, 32 bit little endian
8172#0x1000    F_DYNLOAD
8173#0x2000    F_SHROBJ
8174#0x4000    F_LOADONLY
8175# f_nscns - number of sections like: 1 2 3 4 5 7 8 9 11 12 15 16 19 20 21 22 26 30 36 40 42 56 80 89 96 124
8176>>>>2	uleshort	<2		\b, %u section
8177>>>>2	uleshort	>1		\b, %u sections
8178# f_symptr - symbol table pointer, only for not stripped
8179# like: 0 0x7c 0xf4 0x104 0x182 0x1c2 0x1c6 0x468 0x948 0x416e 0x149a6 0x1c9d8 0x23a68 0x35120 0x7afa0
8180>>>>8	ulelong		>0		\b, symbol offset=%#x
8181# f_nsyms - number of symbols, only for not stripped
8182# like: 0 2 7 9 10 11 20 35 41 63 71 80 105 146 153 158 170 208 294 572 831 1546
8183>>>>12	ulelong		>0		\b, %d symbols
8184# f_opthdr - optional header size. An object file should have a value of 0
8185>>>>16	uleshort	>0		\b, optional header size %u
8186# f_timdat - file time & date stamp only for little endian
8187>>>>4	ledate		>0		\b, created %s
8188# at offset 20 can be optional header, extra bytes FILHSZ-20 because
8189# do not rely on sizeof(FILHDR) to give the correct size for header.
8190# or first section header
8191# additional variables for other COFF files
8192>>>>16	uleshort	=0
8193# first section name s_name[8] like: .text .data .debug$S .drectve .testseg
8194>>>>>20	string		x		\b, 1st section name "%.8s"
8195# >20	beshort		0407		(impure)
8196# >20	beshort		0410		(pure)
8197# >20	beshort		0413		(demand paged)
8198# >20	beshort		0421		(standalone)
8199# >22	leshort		>0		- version %d
8200# >168	string		.lowmem		Apple toolbox
8201
8202
8203#------------------------------------------------------------------------------
8204# $File: commands,v 1.69 2022/04/20 21:14:23 christos Exp $
8205# commands:  file(1) magic for various shells and interpreters
8206#
8207#0	string/w	:			shell archive or script for antique kernel text
82080	string/fwt	#!\ /bin/sh		POSIX shell script text executable
8209!:mime	text/x-shellscript
82100	string/fwb	#!\ /bin/sh		POSIX shell script executable (binary data)
8211!:mime	text/x-shellscript
8212
82130	string/fwt	#!\ /bin/csh		C shell script text executable
8214!:mime	text/x-shellscript
8215
8216# korn shell magic, sent by George Wu, gwu@clyde.att.com
82170	string/fwt	#!\ /bin/ksh		Korn shell script text executable
8218!:mime	text/x-shellscript
82190	string/fwb	#!\ /bin/ksh		Korn shell script executable (binary data)
8220!:mime	text/x-shellscript
8221
82220	string/fwt 	#!\ /bin/tcsh		Tenex C shell script text executable
8223!:mime	text/x-shellscript
82240	string/fwt	#!\ /usr/bin/tcsh	Tenex C shell script text executable
8225!:mime	text/x-shellscript
82260	string/fwt 	#!\ /usr/local/tcsh	Tenex C shell script text executable
8227!:mime	text/x-shellscript
82280	string/fwt	#!\ /usr/local/bin/tcsh	Tenex C shell script text executable
8229!:mime	text/x-shellscript
8230
8231#
8232# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson)
82330	string/fwt	#!\ /bin/zsh		Paul Falstad's zsh script text executable
8234!:mime	text/x-shellscript
82350	string/fwt	#!\ /usr/bin/zsh	Paul Falstad's zsh script text executable
8236!:mime	text/x-shellscript
82370	string/fwt	#!\ /usr/local/bin/zsh	Paul Falstad's zsh script text executable
8238!:mime	text/x-shellscript
82390	string/fwt	#!\ /usr/bin/env\ zsh	Paul Falstad's zsh script text executable
8240!:mime	text/x-shellscript
8241
82420	string/fwt	#!\ /bin/ash		Neil Brown's ash script text executable
8243!:mime	text/x-shellscript
82440	string/fwt	#!\ /usr/bin/ash	Neil Brown's ash script text executable
8245!:mime	text/x-shellscript
82460	string/fwt	#!\ /usr/local/bin/ash	Neil Brown's ash script text executable
8247!:mime	text/x-shellscript
82480	string/fwt	#!\ /usr/local/bin/ae	Neil Brown's ae script text executable
8249!:mime	text/x-shellscript
82500	string/fwt	#!\ /bin/nawk		new awk script text executable
8251!:mime	text/x-nawk
82520	string/fwt	#!\ /usr/bin/nawk	new awk script text executable
8253!:mime	text/x-nawk
82540	string/fwt	#!\ /usr/local/bin/nawk	new awk script text executable
8255!:mime	text/x-nawk
82560	string/fwt	#!\ /bin/gawk		GNU awk script text executable
8257!:mime	text/x-gawk
82580	string/wt	#!\ /usr/bin/gawk	GNU awk script text executable
8259!:mime	text/x-gawk
82600	string/fwt	#!\ /usr/local/bin/gawk	GNU awk script text executable
8261!:mime	text/x-gawk
8262#
82630	string/fwt	#!\ /bin/awk		awk script text executable
8264!:mime	text/x-awk
82650	string/fwt	#!\ /usr/bin/awk	awk script text executable
8266!:mime	text/x-awk
82670	regex/4096	=^[\040\t\f\r\n]{0,100}BEGIN[\040\t\f\r\n]{0,100}[{]	awk or perl script text
8268
8269# AT&T Bell Labs' Plan 9 shell
82700	string/fwt	#!\ /bin/rc	Plan 9 rc shell script text executable
8271
8272# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)
82730	string/fwt	#!\ /bin/bash	Bourne-Again shell script text executable
8274!:mime	text/x-shellscript
82750	string/fwb	#!\ /bin/bash	Bourne-Again shell script executable (binary data)
8276!:mime	text/x-shellscript
82770	string/fwt	#!\ /usr/bin/bash	Bourne-Again shell script text executable
8278!:mime	text/x-shellscript
82790	string/fwb	#!\ /usr/bin/bash	Bourne-Again shell script executable (binary data)
8280!:mime	text/x-shellscript
82810	string/fwt	#!\ /usr/local/bash	Bourne-Again shell script text executable
8282!:mime	text/x-shellscript
82830	string/fwb	#!\ /usr/local/bash	Bourne-Again shell script executable (binary data)
8284!:mime	text/x-shellscript
82850	string/fwt	#!\ /usr/local/bin/bash	Bourne-Again shell script text executable
8286!:mime	text/x-shellscript
82870	string/fwb	#!\ /usr/local/bin/bash	Bourne-Again shell script executable (binary data)
8288!:mime	text/x-shellscript
82890	string/fwt	#!\ /usr/bin/env\ bash	Bourne-Again shell script text executable
8290!:mime	text/x-shellscript
8291
8292# Fish shell magic
8293# From: Benjamin Lowry <ben@ben.gmbh>
82940	string/fwt	#!\ /usr/local/bin/fish		fish shell script text executable
8295!:mime	text/x-shellscript
82960	string/fwt	#!\ /usr/bin/fish		fish shell script text executable
8297!:mime	text/x-shellscript
82980	string/fwt	#!\ /usr/bin/env\ fish		fish shell script text executable
8299!:mime	text/x-shellscript
8300
83010	string/wt	#!\ 	a
8302>&-1	string/T	x	%s script text executable
8303
83040	search/1/fwt	#!\ /usr/bin/tclsh	Tcl/Tk script text executable
8305!:mime  text/x-tcl
8306
83070	search/1/fwt	#!\ /usr/bin/texlua	LuaTex script text executable
8308!:mime	text/x-luatex
8309
83100	search/1/fwt	#!\ /usr/bin/luatex	LuaTex script text executable
8311!:mime	text/x-luatex
8312
83130	search/1/fwt	#!\ /usr/bin/stap	Systemtap script text executable
8314!:mime  text/x-systemtap
8315
8316# From: Kylie McClain <kylie@somas.is>
8317# Type: execline scripts
8318# URL:  https://skarnet.org/software/execline/
83190	string/fwt	#!\ /command/execlineb		execline script text executable
8320!:mime	text/x-execline
83210	string/fwt	#!\ /bin/execlineb		execline script text executable
8322!:mime	text/x-execline
83230	string/fwt	#!\ /usr/bin/execlineb		execline script text executable
8324!:mime	text/x-execline
83250	string/fwt	#!\ /usr/bin/env\ execlineb		execline script text executable
8326!:mime	text/x-execline
8327
83280	string	#!
8329>0	regex	\^#!.*/bin/execlineb([[:space:]].*)*$	execline script text executable
8330!:mime	text/x-execline
8331
8332# PHP scripts
8333# Ulf Harnhammar <ulfh@update.uu.se>
83340	search/1/c	=<?php			PHP script text
8335!:strength + 30
8336!:mime	text/x-php
83370	search/1	=<?\n			PHP script text
8338!:mime	text/x-php
83390	search/1	=<?\r			PHP script text
8340!:mime	text/x-php
83410	search/1/w	#!\ /usr/local/bin/php	PHP script text executable
8342!:strength + 10
8343!:mime	text/x-php
83440	search/1/w	#!\ /usr/bin/php	PHP script text executable
8345!:strength + 10
8346!:mime	text/x-php
8347# Smarty compiled template, https://www.smarty.net/
8348# Elan Ruusamae <glen@delfi.ee>
83490	string	=<?php
8350>5	regex	[\ \n]
8351>>6	string	/*\ Smarty\ version		Smarty compiled template
8352>>>24	regex	[0-9.]+				\b, version %s
8353!:mime	text/x-php
8354
83550	string		Zend\x00		PHP script Zend Optimizer data
8356
8357# From: Anatol Belski <ab@php.net>
83580	string		OPCACHE
8359>7	ubyte		0			PHP opcache filecache data
8360
83610	search/64	--TEST--
8362>16	search/64	--FILE--
8363>24	search/8192	--EXPECT		PHP core test
8364!:ext	phpt
8365
8366# https://www.php.net/manual/en/phar.fileformat.signature.php
8367-4	string		GBMB			PHP phar archive
8368>-8	ubyte		0x1			with MD5 signature
8369!:ext	phar
8370>-8	ubyte		0x2			with SHA1 signature
8371!:ext	phar
8372>-8	ubyte		0x3			with SHA256 signature
8373!:ext	phar
8374>-8	ubyte		0x4			with SHA512 signature
8375!:ext	phar
8376>-8	ubyte		0x10			with OpenSSL signature
8377!:ext	phar
8378>-8	ubyte		0x11			with OpenSSL SHA256 signature
8379!:ext	phar
8380>-8	ubyte		0x12			with OpenSSL SHA512 signature
8381!:ext	phar
8382
83830	string/t	$!			DCL command file
8384
8385# Type: Pdmenu
8386# URL:  https://packages.debian.org/pdmenu
8387# From: Edward Betts <edward@debian.org>
83880	string		#!/usr/bin/pdmenu	Pdmenu configuration file text
8389
8390# From Danny Weldon
83910	string	\x0b\x13\x08\x00
8392>0x04   uleshort	<4      ksh byte-code version %d
8393
8394#----------------------------------------------------------------------------
8395# $File: communications,v 1.5 2009/09/19 16:28:08 christos Exp $
8396# communication
8397
8398# TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3.
8399# It is used for conformance testing of communication protocols.
8400# Added by W. Borgert <debacle@debian.org>.
84010	string		$Suite			TTCN Abstract Test Suite
8402>&1	string		$SuiteId
8403>>&1	string		>\n			%s
8404>&2	string		$SuiteId
8405>>&1	string		>\n			%s
8406>&3	string		$SuiteId
8407>>&1	string		>\n			%s
8408
8409# MSC (message sequence charts) are a formal description technique,
8410# described in ITU-T Z.120, mainly used for communication protocols.
8411# Added by W. Borgert <debacle@debian.org>.
84120	string		mscdocument	Message Sequence Chart (document)
84130	string		msc		Message Sequence Chart (chart)
84140	string		submsc		Message Sequence Chart (subchart)
8415#------------------------------------------------------------------------------
8416# $File: compress,v 1.83 2022/08/16 11:16:39 christos Exp $
8417# compress:  file(1) magic for pure-compression formats (no archives)
8418#
8419# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
8420#
8421# Formats for various forms of compressed data
8422# Formats for "compress" proper have been moved into "compress.c",
8423# because it tries to uncompress it to figure out what's inside.
8424
8425# standard unix compress
84260	string		\037\235	compress'd data
8427!:mime	application/x-compress
8428!:apple	LZIVZIVU
8429>2	byte&0x80	>0		block compressed
8430>2	byte&0x1f	x		%d bits
8431
8432# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver)
8433# URL: https://en.wikipedia.org/wiki/Gzip
8434# Reference: https://tools.ietf.org/html/rfc1952
8435# Update: Joerg Jenderek, Apr 2019
8436#   Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
8437#	* Original filename is only at offset 10 if "extra field" absent
8438#	* Produce shorter output - notably, only report compression methods
8439#         other than 8 ("deflate", the only method defined in RFC 1952).
8440# Note: find defs -iname '*.trid.xml' -exec grep -q '<Bytes>1F8B08' {} \; -ls
8441# TODO:
8442# FBR	Blueberry FlashBack screen Record	https://www.flashbackrecorder.com/
8443# KPR	KOffice/Calligra KPresenter		application/x-kpresenter
8444# KPT	KOffice/Calligra KPresenter template?	application/x-kpresenter
8445# SAV	Diggles Saved Game File			http://www.innonics.com
8446# SAV	FarCry (demo) saved game		http://www.farcry-thegame.com
8447# DAT	ZOAGZIP game data format		http://en.wikipedia.org/wiki/SD_Gundam_Capsule_Fighter
84480       string          \037\213
8449# to display gzip compressed (strength=100=2*50) before other (strength=50)?
8450#!:strength * 2
8451# no FNAME and FCOMMENT bit implies no file name/comment. That means only binary
8452>3	byte&0x18	=0
8453# For binary gzipped no ASCII text should occur
8454#	mcd-monu-cad.trid.xml
8455>>10	string		MCD			Monu-Cad Drawing, Component or Font
8456#>>36	string		Created\ with\ MONU-CAD
8457#!:mime	application/octet-stream
8458# http://fileformats.archiveteam.org/wiki/Monu-CAD
8459#	http://www.monucad.com/downloads/FullDemo-2005.EXE
8460#	/HANDS96.MCC	Component
8461#	/DEMO_DD01.MCD	Drawing
8462#	/MCALF020.FNT	Font
8463!:ext	mcc/mcd/fnt
8464# http://www.generalcadd.com
8465>>10	string		GXD			General CADD, Drawing or Component
8466#!:mime	application/octet-stream
8467#	/gxc/BUILDINGEDGE.gxc			Component
8468#	/gxd/HOCKETT-STPAUL-WRHSE.gxd		Drawing
8469#	/gxd/POWERLAND-MILL-ADD-11.gxd		Drawing		v9.1.06
8470!:ext	gxc/gxd
8471#>>>13	ubyte		0			\b, version 0
8472>>>13	string		09			\b, version 9
8473# other gzipped binary like gzipped tar, VirtualBox extension package,...
8474>>10	default		x		gzip compressed data
8475!:mime	application/gzip
8476>>>0	use	gzip-info
8477# size of the original (uncompressed) input data modulo 2^32
8478>>-0	offset		>48
8479>>>-4	ulelong		x		\b, original size modulo 2^32 %u
8480>>-0	offset		<48		\b, truncated
8481# gzipped TAR or VirtualBox extension package
8482#!:mime	application/x-compressed-tar
8483#!:mime	application/x-virtualbox-vbox-extpack
8484# https://www.w3.org/TR/SVG/mimereg.html
8485#!:mime	image/image/svg+xml-compressed
8486#	zlib.3.gz
8487#	microcode-20180312.tgz
8488#	tpz same as tgz
8489#	lua-md5_1.2-1_i386_i486.ipk	https://en.wikipedia.org/wiki/Opkg
8490#	Oracle_VM_VirtualBox_Extension_Pack-5.0.12-104815.vbox-extpack
8491!:ext	gz/tgz/tpz/ipk/vbox-extpack/svgz
8492# FNAME/FCOMMENT bit implies file name/comment as iso-8859-1 text
8493>3	byte&0x18	>0		gzip compressed data
8494!:mime	application/gzip
8495# gzipped tar, gzipped Abiword document
8496#!:mime	application/x-compressed-tar
8497#!:mime	application/x-abiword-compressed
8498#!:mime	image/image/svg+xml-compressed
8499#	kleopatra_splashscreen.svgz	gzipped .svg
8500!:ext	gz/tgz/tpz/zabw/svgz
8501>>0	use	gzip-info
8502# size of the original (uncompressed) input data modulo 2^32
8503>>-0	offset		>48
8504>>>-4	ulelong		x		\b, original size modulo 2^32 %u
8505>>-0	offset		<48		\b, truncated
8506#	display information of gzip compressed files
85070	name				gzip-info
8508#>2	byte		x		THIS iS GZIP
8509>2	byte		<8		\b, reserved method
8510>2	byte		>8		\b, unknown method
8511>3	byte		&0x01		\b, ASCII
8512>3	byte		&0x02		\b, has CRC
8513>3	byte		&0x04		\b, extra field
8514>3	byte&0xC	=0x08
8515>>10	string		x		\b, was "%s"
8516>3	byte		&0x10		\b, has comment
8517>3	byte		&0x20		\b, encrypted
8518>4	ledate		>0		\b, last modified: %s
8519>8	byte		2		\b, max compression
8520>8	byte		4		\b, max speed
8521>9	byte		=0x00		\b, from FAT filesystem (MS-DOS, OS/2, NT)
8522>9	byte		=0x01		\b, from Amiga
8523>9	byte		=0x02		\b, from VMS
8524>9	byte		=0x03		\b, from Unix
8525>9	byte		=0x04		\b, from VM/CMS
8526>9	byte		=0x05		\b, from Atari
8527>9	byte		=0x06		\b, from HPFS filesystem (OS/2, NT)
8528>9	byte		=0x07		\b, from MacOS
8529>9	byte		=0x08		\b, from Z-System
8530>9	byte		=0x09		\b, from CP/M
8531>9	byte		=0x0A		\b, from TOPS/20
8532>9	byte		=0x0B		\b, from NTFS filesystem (NT)
8533>9	byte		=0x0C		\b, from QDOS
8534>9	byte		=0x0D		\b, from Acorn RISCOS
8535# size of the original (uncompressed) input data modulo 2^32
8536#>-4	ulelong		x		\b, original size modulo 2^32 %u
8537#ERROR: line 114: non zero offset 1048572 at level 1
8538
8539# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis
85400	string		\037\036	packed data
8541!:mime	application/octet-stream
8542>2	belong		>1		\b, %d characters originally
8543>2	belong		=1		\b, %d character originally
8544#
8545# This magic number is byte-order-independent.
85460	short		0x1f1f		old packed data
8547!:mime	application/octet-stream
8548
8549# XXX - why *two* entries for "compacted data", one of which is
8550# byte-order independent, and one of which is byte-order dependent?
8551#
85520	short		0x1fff		compacted data
8553!:mime	application/octet-stream
8554# This string is valid for SunOS (BE) and a matching "short" is listed
8555# in the Ultrix (LE) magic file.
85560	string		\377\037	compacted data
8557!:mime	application/octet-stream
85580	short		0145405		huf output
8559!:mime	application/octet-stream
8560
8561# bzip2
85620	string		BZh		bzip2 compressed data
8563!:mime	application/x-bzip2
8564!:ext	bz2
8565>3	byte		>47		\b, block size = %c00k
8566
8567# bzip	a block-sorting file compressor
8568#	by Julian Seward <sewardj@cs.man.ac.uk> and others
85690	string		BZ0		bzip compressed data
8570!:mime	application/x-bzip
8571>3	byte		>47		\b, block size = %c00k
8572
8573# lzip
85740	string		LZIP		lzip compressed data
8575!:mime application/x-lzip
8576>4	byte		x		\b, version: %d
8577
8578# squeeze and crunch
8579# Michael Haardt <michael@cantor.informatik.rwth-aachen.de>
85800	beshort		0x76FF		squeezed data,
8581>4	string		x		original name %s
85820	beshort		0x76FE		crunched data,
8583>2	string		x		original name %s
85840	beshort		0x76FD		LZH compressed data,
8585>2	string		x		original name %s
8586
8587# Freeze
85880	string		\037\237	frozen file 2.1
85890	string		\037\236	frozen file 1.0 (or gzip 0.5)
8590
8591# SCO compress -H (LZH)
85920	string		\037\240	SCO compress -H (LZH) data
8593
8594# European GSM 06.10 is a provisional standard for full-rate speech
8595# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse
8596# excitation/long term prediction) coding at 13 kbit/s.
8597#
8598# There's only a magic nibble (4 bits); that nibble repeats every 33
8599# bytes.  This isn't suited for use, but maybe we can use it someday.
8600#
8601# This will cause very short GSM files to be declared as data and
8602# mismatches to be declared as data too!
8603#0	byte&0xF0	0xd0		data
8604#>33	byte&0xF0	0xd0
8605#>66	byte&0xF0	0xd0
8606#>99	byte&0xF0	0xd0
8607#>132	byte&0xF0	0xd0		GSM 06.10 compressed audio
8608
8609# lzop from <markus.oberhumer@jk.uni-linz.ac.at>
86100	string		\x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a	lzop compressed data
8611>9	beshort		<0x0940
8612>>9	byte&0xf0	=0x00		- version 0.
8613>>9	beshort&0x0fff	x		\b%03x,
8614>>13	byte		1		LZO1X-1,
8615>>13	byte		2		LZO1X-1(15),
8616>>13	byte		3		LZO1X-999,
8617## >>22	bedate		>0		last modified: %s,
8618>>14	byte		=0x00		os: MS-DOS
8619>>14	byte		=0x01		os: Amiga
8620>>14	byte		=0x02		os: VMS
8621>>14	byte		=0x03		os: Unix
8622>>14	byte		=0x05		os: Atari
8623>>14	byte		=0x06		os: OS/2
8624>>14	byte		=0x07		os: MacOS
8625>>14	byte		=0x0A		os: Tops/20
8626>>14	byte		=0x0B		os: WinNT
8627>>14	byte		=0x0E		os: Win32
8628>9	beshort		>0x0939
8629>>9	byte&0xf0	=0x00		- version 0.
8630>>9	byte&0xf0	=0x10		- version 1.
8631>>9	byte&0xf0	=0x20		- version 2.
8632>>9	beshort&0x0fff	x		\b%03x,
8633>>15	byte		1		LZO1X-1,
8634>>15	byte		2		LZO1X-1(15),
8635>>15	byte		3		LZO1X-999,
8636## >>25	bedate		>0		last modified: %s,
8637>>17	byte		=0x00		os: MS-DOS
8638>>17	byte		=0x01		os: Amiga
8639>>17	byte		=0x02		os: VMS
8640>>17	byte		=0x03		os: Unix
8641>>17	byte		=0x05		os: Atari
8642>>17	byte		=0x06		os: OS/2
8643>>17	byte		=0x07		os: MacOS
8644>>17	byte		=0x0A		os: Tops/20
8645>>17	byte		=0x0B		os: WinNT
8646>>17	byte		=0x0E		os: Win32
8647
8648# 4.3BSD-Quasijarus Strong Compression
8649# https://minnie.tuhs.org/Quasijarus/compress.html
86500	string		\037\241	Quasijarus strong compressed data
8651
8652# From: Cory Dikkers <cdikkers@swbell.net>
86530	string		XPKF		Amiga xpkf.library compressed data
86540	string		PP11		Power Packer 1.1 compressed data
86550	string		PP20		Power Packer 2.0 compressed data,
8656>4	belong		0x09090909	fast compression
8657>4	belong		0x090A0A0A	mediocre compression
8658>4	belong		0x090A0B0B	good compression
8659>4	belong		0x090A0C0C	very good compression
8660>4	belong		0x090A0C0D	best compression
8661
8662# 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at)
8663# https://www.7-zip.org or DOC/7zFormat.txt
8664#
86650	string		7z\274\257\047\034	7-zip archive data,
8666>6	byte		x			version %d
8667>7	byte		x			\b.%d
8668!:mime	application/x-7z-compressed
8669!:ext 7z/cb7
8670
8671# Type: LZMA
86720	lelong&0xffffff	=0x5d
8673>12	leshort		0xff			LZMA compressed data,
8674!:mime	application/x-lzma
8675>>5	lequad		=0xffffffffffffffff	streamed
8676>>5	lequad		!0xffffffffffffffff	non-streamed, size %lld
8677>12	leshort		0			LZMA compressed data,
8678>>5	lequad		=0xffffffffffffffff	streamed
8679>>5	lequad		!0xffffffffffffffff	non-streamed, size %lld
8680
8681# http://tukaani.org/xz/xz-file-format.txt
86820	ustring		\xFD7zXZ\x00		XZ compressed data, checksum
8683!:strength * 2
8684!:mime	application/x-xz
8685>7	byte&0xf	0x0			NONE
8686>7	byte&0xf	0x1			CRC32
8687>7	byte&0xf	0x4			CRC64
8688>7	byte&0xf	0xa			SHA-256
8689
8690# https://github.com/ckolivas/lrzip/blob/master/doc/magic.header.txt
86910	string		LRZI			LRZIP compressed data
8692>4	byte		x			- version %d
8693>5	byte		x			\b.%d
8694>22	byte		1			\b, encrypted
8695!:mime	application/x-lrzip
8696
8697# https://fastcompression.blogspot.fi/2013/04/lz4-streaming-format-final.html
86980	lelong		0x184d2204	LZ4 compressed data (v1.4+)
8699!:mime	application/x-lz4
8700# Added by osm0sis@xda-developers.com
87010 	lelong		0x184c2103	LZ4 compressed data (v1.0-v1.3)
8702!:mime	application/x-lz4
87030	lelong		0x184c2102	LZ4 compressed data (v0.1-v0.9)
8704!:mime	application/x-lz4
8705
8706# Zstandard/LZ4 skippable frames
8707# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md
87080         lelong&0xFFFFFFF0  0x184D2A50
8709>(4.l+8)  indirect	x
8710
8711# Zstandard Dictionary ID subroutine
87120     name        zstd-dictionary-id
8713# Single Segment = True
8714>0    byte        &0x20   \b, Dictionary ID:
8715>>0   byte&0x03   0       None
8716>>0   byte&0x03   1
8717>>>1  byte        x       %u
8718>>0   byte&0x03   2
8719>>>1  leshort     x       %u
8720>>0   byte&0x03   3
8721>>>1  lelong      x       %u
8722# Single Segment = False
8723>0    byte        ^0x20   \b, Dictionary ID:
8724>>0   byte&0x03   0       None
8725>>0   byte&0x03   1
8726>>>2  byte        x       %u
8727>>0   byte&0x03   2
8728>>>2  leshort     x       %u
8729>>0   byte&0x03   3
8730>>>2  lelong      x       %u
8731
8732# Zstandard compressed data
8733# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md
87340     lelong       0xFD2FB522  Zstandard compressed data (v0.2)
8735!:mime  application/zstd
87360     lelong       0xFD2FB523  Zstandard compressed data (v0.3)
8737!:mime  application/zstd
87380     lelong       0xFD2FB524  Zstandard compressed data (v0.4)
8739!:mime  application/zstd
87400     lelong       0xFD2FB525  Zstandard compressed data (v0.5)
8741!:mime  application/zstd
87420     lelong       0xFD2FB526  Zstandard compressed data (v0.6)
8743!:mime  application/zstd
87440     lelong       0xFD2FB527  Zstandard compressed data (v0.7)
8745!:mime  application/zstd
8746>4    use          zstd-dictionary-id
87470     lelong       0xFD2FB528  Zstandard compressed data (v0.8+)
8748!:mime  application/zstd
8749>4    use          zstd-dictionary-id
8750
8751# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md
87520  lelong    0xEC30A437  Zstandard dictionary
8753!:mime  application/x-std-dictionary
8754>4 lelong    x           (ID %u)
8755
8756# AFX compressed files (Wolfram Kleff)
87572	string		-afx-		AFX compressed file data
8758
8759# Supplementary magic data for the file(1) command to support
8760# rzip(1).  The format is described in magic(5).
8761#
8762# Copyright (C) 2003 by Andrew Tridgell.  You may do whatever you want with
8763# this file.
8764#
87650	string		RZIP		rzip compressed data
8766>4	byte		x		- version %d
8767>5	byte		x		\b.%d
8768>6	belong		x		(%d bytes)
8769
87700	string		ArC\x01		FreeArc archive <http://freearc.org>
8771
8772# Type:	DACT compressed files
87730	long	0x444354C3	DACT compressed data
8774>4	byte	>-1		(version %i.
8775>5	byte	>-1		%i.
8776>6	byte	>-1		%i)
8777>7	long	>0		, original size: %i bytes
8778>15	long	>30		, block size: %i bytes
8779
8780# Valve Pack (VPK) files
87810	lelong	0x55aa1234	Valve Pak file
8782>0x4	lelong	x		\b, version %u
8783>0x8	lelong	x		\b, %u entries
8784
8785# Snappy framing format
8786# https://code.google.com/p/snappy/source/browse/trunk/framing_format.txt
87870	string	\377\006\0\0sNaPpY	snappy framed data
8788!:mime	application/x-snappy-framed
8789
8790# qpress, https://www.quicklz.com/
87910	string	qpress10	qpress compressed data
8792!:mime	application/x-qpress
8793
8794# Zlib https://www.ietf.org/rfc/rfc6713.txt
87950	string/b	x
8796>0	beshort%31	=0
8797>>0	byte&0xf	=8
8798>>>0	byte&0x80 	=0	zlib compressed data
8799!:mime	application/zlib
8800
8801# BWC compression
88020	string		BWC
8803>3	byte		0	BWC compressed data
8804
8805# UCL compression
88060	bequad		0x00e955434cff011a	UCL compressed data
8807
8808# Softlib archive
88090	string		SLIB	Softlib archive
8810>4	leshort		x	\b, version %d
8811>6	leshort		x	(contains %d files)
8812
8813# URL:  https://github.com/lzfse/lzfse/blob/master/src/lzfse_internal.h#L276
8814# From: Eric Hall <eric.hall@darkart.com>
88150	string	bvx-	lzfse encoded, no compression
88160	string	bvx1	lzfse compressed, uncompressed tables
88170	string	bvx2	lzfse compressed, compressed tables
88180	string	bvxn	lzfse encoded, lzvn compressed
8819
8820# pcxLib.exe compression program
8821# http://www.shikadi.net/moddingwiki/PCX_Library
88220	string/b	pcxLib
8823>0x0A	string/b	Copyright\020(c)\020Genus\020Microprogramming,\020Inc.	pcxLib compressed
8824
8825#------------------------------------------------------------------------------
8826# $File: console,v 1.68 2022/05/14 20:04:43 christos Exp $
8827# Console game magic
8828# Toby Deshane <hac@shoelace.digivill.net>
8829
8830# ines: file(1) magic for Marat's iNES Nintendo Entertainment System ROM dump format
8831# Updated by David Korth <gerbilsoft@gerbilsoft.com>
8832# References:
8833# - https://wiki.nesdev.com/w/index.php/INES
8834# - https://wiki.nesdev.com/w/index.php/NES_2.0
8835
8836# Common header for iNES, NES 2.0, and Wii U iNES.
88370	name		nes-rom-image-ines
8838>7	byte&0x0C	=0x8		(NES 2.0)
8839>4	byte		x		\b: %ux16k PRG
8840>5	byte		x		\b, %ux8k CHR
8841>6	byte&0x08	=0x8		[4-Scr]
8842>6	byte&0x09	=0x0		[H-mirror]
8843>6	byte&0x09	=0x1		[V-mirror]
8844>6	byte&0x02	=0x2		[SRAM]
8845>6	byte&0x04	=0x4		[Trainer]
8846>7	byte&0x03	=0x2		[PC10]
8847>7	byte&0x03	=0x1		[VS]
8848>>7	byte&0x0C	=0x8
8849# NES 2.0: VS PPU
8850>>>13	byte&0x0F	=0x0		\b, RP2C03B
8851>>>13	byte&0x0F	=0x1		\b, RP2C03G
8852>>>13	byte&0x0F	=0x2		\b, RP2C04-0001
8853>>>13	byte&0x0F	=0x3		\b, RP2C04-0002
8854>>>13	byte&0x0F	=0x4		\b, RP2C04-0003
8855>>>13	byte&0x0F	=0x5		\b, RP2C04-0004
8856>>>13	byte&0x0F	=0x6		\b, RP2C03B
8857>>>13	byte&0x0F	=0x7		\b, RP2C03C
8858>>>13	byte&0x0F	=0x8		\b, RP2C05-01
8859>>>13	byte&0x0F	=0x9		\b, RP2C05-02
8860>>>13	byte&0x0F	=0xA		\b, RP2C05-03
8861>>>13	byte&0x0F	=0xB		\b, RP2C05-04
8862>>>13	byte&0x0F	=0xC		\b, RP2C05-05
8863# TODO: VS protection hardware?
8864>>7	byte		x		\b]
8865# NES 2.0-specific flags.
8866>7	byte&0x0C	=0x8
8867>>12	byte&0x03	=0x0		[NTSC]
8868>>12	byte&0x03	=0x1		[PAL]
8869>>12	byte&0x02	=0x2		[NTSC+PAL]
8870
8871# Standard iNES ROM header.
88720	string		NES\x1A		NES ROM image (iNES)
8873!:mime	application/x-nes-rom
8874>0	use		nes-rom-image-ines
8875
8876# Wii U Virtual Console iNES ROM header.
88770	belong		0x4E455300	NES ROM image (Wii U Virtual Console)
8878!:mime	application/x-nes-rom
8879>0	use		nes-rom-image-ines
8880
8881#------------------------------------------------------------------------------
8882# unif: file(1) magic for UNIF-format Nintendo Entertainment System ROM images
8883# Reference: https://wiki.nesdev.com/w/index.php/UNIF
8884# From: David Korth <gerbilsoft@gerbilsoft.com>
8885#
8886# NOTE: The UNIF format uses chunks instead of a fixed header,
8887# so most of the data isn't easily parseable.
8888#
88890	string	UNIF
8890>4	lelong	<16	NES ROM image (UNIF v%d format)
8891!:mime	application/x-nes-rom
8892
8893#------------------------------------------------------------------------------
8894# fds: file(1) magic for Famciom Disk System disk images
8895# Reference: https://wiki.nesdev.com/w/index.php/Family_Computer_Disk_System#.FDS_format
8896# From: David Korth <gerbilsoft@gerbilsoft.com>
8897# TODO: Check "Disk info block" and get info from that in addition to the optional header.
8898
8899# Disk info block. (block 1)
89000	name	nintendo-fds-disk-info-block
8901>23	byte	!1		FMC-
8902>23	byte	1		FSC-
8903>16	string	x		\b%.3s
8904>15	ubyte	x		\b, mfr %02X
8905>20	ubyte	x		(Rev.%02u)
8906
8907# Headered version.
89080	string	FDS\x1A
8909>0x11	string	*NINTENDO-HVC*	Famicom Disk System disk image:
8910!:mime	application/x-fds-disk
8911>>0x10	use	nintendo-fds-disk-info-block
8912>4	byte	1	(%u side)
8913>4	byte	!1	(%u sides)
8914
8915# Unheadered version.
89161	string	*NINTENDO-HVC*	Famicom Disk System disk image:
8917!:mime	application/x-fds-disk
8918>0	use	nintendo-fds-disk-info-block
8919
8920#------------------------------------------------------------------------------
8921# tnes: file(1) magic for TNES-format Nintendo Entertainment System ROM images
8922# Used by Nintendo 3DS NES Virtual Console games.
8923# From: David Korth <gerbilsoft@gerbilsoft.com>
8924#
89250		string	TNES	NES ROM image (Nintendo 3DS Virtual Console)
8926!:mime		application/x-nes-rom
8927>4		byte	100	\b: FDS,
8928>>0x2010	use	nintendo-fds-disk-info-block
8929>4		byte	!100	\b: TNES mapper %u
8930>>5	byte		x		\b, %ux8k PRG
8931>>6	byte		x		\b, %ux8k CHR
8932>>7	byte&0x08	=1		[WRAM]
8933>>8	byte&0x09	=1		[H-mirror]
8934>>8	byte&0x09	=2		[V-mirror]
8935>>8	byte&0x02	=3		[VRAM]
8936
8937#------------------------------------------------------------------------------
8938# gameboy: file(1) magic for the Nintendo (Color) Gameboy raw ROM format
8939# Reference: http://gbdev.gg8.se/wiki/articles/The_Cartridge_Header
8940#
89410x104		bequad		0xCEED6666CC0D000B	Game Boy ROM image
8942# TODO: application/x-gameboy-color-rom for GBC.
8943!:mime		application/x-gameboy-rom
8944>0x143		byte&0x80	0x80
8945>>0x134		string		>\0			\b: "%.15s"
8946>0x143		byte&0x80	!0x80
8947>>0x134		string		>\0			\b: "%.16s"
8948>0x14c		byte		x			(Rev.%02u)
8949
8950# Machine type. (SGB, CGB, SGB+CGB)
8951# Old licensee code 0x33 is required for SGB, but not CGB.
8952>0x14b		byte		0x33
8953>>0x146		byte		0x03
8954>>>0x143	byte&0x80	0x80	[SGB+CGB]
8955>>>0x143	byte&0x80	!0x80	[SGB]
8956>>0x146		byte		!0x03
8957>>>0x143	byte&0xC0	0x80	[CGB]
8958>>>0x143	byte&0xC0	0xC0	[CGB ONLY]
8959>0x14b		byte		!0x33
8960>>0x143		byte&0xC0	0x80	[CGB]
8961>>0x143		byte&0xC0	0xC0	[CGB ONLY]
8962
8963# Mapper.
8964>0x147 byte 0x00  [ROM ONLY]
8965>0x147 byte 0x01  [MBC1]
8966>0x147 byte 0x02  [MBC1+RAM]
8967>0x147 byte 0x03  [MBC1+RAM+BATT]
8968>0x147 byte 0x05  [MBC2]
8969>0x147 byte 0x06  [MBC2+BATTERY]
8970>0x147 byte 0x08  [ROM+RAM]
8971>0x147 byte 0x09  [ROM+RAM+BATTERY]
8972>0x147 byte 0x0B  [MMM01]
8973>0x147 byte 0x0C  [MMM01+SRAM]
8974>0x147 byte 0x0D  [MMM01+SRAM+BATT]
8975>0x147 byte 0x0F  [MBC3+TIMER+BATT]
8976>0x147 byte 0x10  [MBC3+TIMER+RAM+BATT]
8977>0x147 byte 0x11  [MBC3]
8978>0x147 byte 0x12  [MBC3+RAM]
8979>0x147 byte 0x13  [MBC3+RAM+BATT]
8980>0x147 byte 0x19  [MBC5]
8981>0x147 byte 0x1A  [MBC5+RAM]
8982>0x147 byte 0x1B  [MBC5+RAM+BATT]
8983>0x147 byte 0x1C  [MBC5+RUMBLE]
8984>0x147 byte 0x1D  [MBC5+RUMBLE+SRAM]
8985>0x147 byte 0x1E  [MBC5+RUMBLE+SRAM+BATT]
8986>0x147 byte 0xFC  [Pocket Camera]
8987>0x147 byte 0xFD  [Bandai TAMA5]
8988>0x147 byte 0xFE  [Hudson HuC-3]
8989>0x147 byte 0xFF  [Hudson HuC-1]
8990
8991# ROM size.
8992>0x148 byte 0     \b, ROM: 256Kbit
8993>0x148 byte 1     \b, ROM: 512Kbit
8994>0x148 byte 2     \b, ROM: 1Mbit
8995>0x148 byte 3     \b, ROM: 2Mbit
8996>0x148 byte 4     \b, ROM: 4Mbit
8997>0x148 byte 5     \b, ROM: 8Mbit
8998>0x148 byte 6     \b, ROM: 16Mbit
8999>0x148 byte 7     \b, ROM: 32Mbit
9000>0x148 byte 0x52  \b, ROM: 9Mbit
9001>0x148 byte 0x53  \b, ROM: 10Mbit
9002>0x148 byte 0x54  \b, ROM: 12Mbit
9003
9004# RAM size.
9005>0x149 byte 1     \b, RAM: 16Kbit
9006>0x149 byte 2     \b, RAM: 64Kbit
9007>0x149 byte 3     \b, RAM: 256Kbit
9008>0x149 byte 4     \b, RAM: 1Mbit
9009>0x149 byte 5     \b, RAM: 512Kbit
9010
9011#------------------------------------------------------------------------------
9012# genesis: file(1) magic for various Sega Mega Drive / Genesis ROM image and disc formats
9013# Updated by David Korth <gerbilsoft@gerbilsoft.com>
9014# References:
9015# - https://www.retrodev.com/segacd.html
9016# - http://devster.monkeeh.com/sega/32xguide1.txt
9017#
9018
9019# Common Sega Mega Drive header format.
9020# FIXME: Name fields are 48 bytes, but have spaces for padding instead of 00s.
90210		name	sega-mega-drive-header
9022# ROM title. (Use domestic if present; if not, use international.)
9023>0x120		byte	>0x20
9024>>0x120		string	>\0	\b: "%.16s"
9025>0x120		byte	<0x21
9026>>0x150		string	>\0	\b: "%.16s"
9027# Other information.
9028>0x180		string	>\0	(%.14s
9029>>0x110		string  >\0	\b, %.16s
9030>0x180		byte	0
9031>>0x110		string  >\0	(%.16s
9032>0		byte	x	\b)
9033
9034# TODO: Check for 32X CD?
9035# Sega Mega CD disc images: 2048-byte sectors.
90360	string	SEGADISCSYSTEM\ \ 	Sega Mega CD disc image
9037!:mime	application/x-sega-cd-rom
9038>0	use	sega-mega-drive-header
9039>0	byte	x			\b, 2048-byte sectors
90400	string	SEGABOOTDISC\ \ \ \ 	Sega Mega CD disc image
9041!:mime	application/x-sega-cd-rom
9042>0	use	sega-mega-drive-header
9043>0	byte	x			\b, 2048-byte sectors
9044# Sega Mega CD disc images: 2352-byte sectors.
90450x10	string	SEGADISCSYSTEM\ \ 	Sega Mega CD disc image
9046!:mime	application/x-sega-cd-rom
9047>0x10	use	sega-mega-drive-header
9048>0	byte	x			\b, 2352-byte sectors
90490x10	string	SEGABOOTDISC\ \ \ \ 	Sega Mega CD disc image
9050!:mime	application/x-sega-cd-rom
9051>0x10	use	sega-mega-drive-header
9052>0	byte	x			\b, 2352-byte sectors
9053
9054# Sega Mega Drive: Identify the system ID.
90550x100		string	SEGA
9056>0x3C0		string	MARS\ CHECK\ MODE	Sega 32X ROM image
9057!:mime		application/x-genesis-32x-rom
9058>>0		use	sega-mega-drive-header
9059>0x104		string	\ PICO			Sega Pico ROM image
9060!:mime		application/x-sega-pico-rom
9061>>0		use	sega-mega-drive-header
9062>0x104		string	TOYS\ PICO		Sega Pico ROM image
9063!:mime		application/x-sega-pico-rom
9064>>0		use	sega-mega-drive-header
9065>0x104		string	\ TOYS\ PICO		Sega Pico ROM image
9066!:mime		application/x-sega-pico-rom
9067>>0		use	sega-mega-drive-header
9068>0x104		string	\ IAC			Sega Pico ROM image
9069!:mime		application/x-sega-pico-rom
9070>>0		use	sega-mega-drive-header
9071>0x104		string	\ TERA68K		Sega Teradrive (68K) ROM image
9072!:mime		application/x-sega-teradrive-rom
9073>>0		use	sega-mega-drive-header
9074>0x104		string	\ TERA286		Sega Teradrive (286) ROM image
9075!:mime		application/x-sega-teradrive-rom
9076>>0		use	sega-mega-drive-header
9077>0x180		string	BR			Sega Mega CD Boot ROM image
9078!:mime		application/x-genesis-rom
9079>>0		use	sega-mega-drive-header
9080>0x104		default	x			Sega Mega Drive / Genesis ROM image
9081!:mime		application/x-genesis-rom
9082>>0		use	sega-mega-drive-header
9083
9084# Sega Mega Drive: Some ROMs have "SEGA" at 0x101, not 0x100.
90850x100		string	\ SEGA			Sega Mega Drive / Genesis ROM image
9086>0		use	sega-mega-drive-header
9087
9088# Sega Pico ROMs that don't start with "SEGA".
90890x100		string	SAMSUNG\ PICO		Samsung Pico ROM image
9090!:mime		application/x-sega-pico-rom
9091>0		use	sega-mega-drive-header
90920x100		string	IMA\ IKUNOUJYUKU	Samsung Pico ROM image
9093!:mime		application/x-sega-pico-rom
9094>0		use	sega-mega-drive-header
90950x100		string	IMA IKUNOJYUKU		Samsung Pico ROM image
9096!:mime		application/x-sega-pico-rom
9097>0		use	sega-mega-drive-header
9098
9099# Sega Picture Magic (modified 32X)
91000x100		string	Picture\ Magic
9101>0x3C0		string	PICTURE MAGIC-01	Sega 32X ROM image
9102!:mime		application/x-genesis-32x-rom
9103>>0		use	sega-mega-drive-header
9104
9105#------------------------------------------------------------------------------
9106# genesis: file(1) magic for the Super MegaDrive ROM dump format
9107#
9108
9109# NOTE: Due to interleaving, we can't display anything
9110# other than the copier header information.
91110      name    sega-genesis-smd-header
9112>0     byte    x       %dx16k blocks
9113>2     byte    0       \b, last in series or standalone
9114>2     byte    >0      \b, split ROM
9115
9116# "Sega Genesis" header.
91170x280	string EAGN
9118>8	beshort	0xAABB	Sega Mega Drive / Genesis ROM image (SMD format):
9119!:mime	application/x-genesis-rom
9120>>0	use     sega-genesis-smd-header
9121
9122# "Sega Mega Drive" header.
91230x280	string EAMG
9124>8	beshort	0xAABB	Sega Mega Drive / Genesis ROM image (SMD format):
9125!:mime	application/x-genesis-rom
9126>>0	use     sega-genesis-smd-header
9127
9128#------------------------------------------------------------------------------
9129# smsgg:  file(1) magic for Sega Master System and Game Gear ROM images
9130# Detects all Game Gear and export Sega Master System ROM images,
9131# and some Japanese Sega Master System ROM images.
9132# From: David Korth <gerbilsoft@gerbilsoft.com>
9133# Reference: https://www.smspower.org/Development/ROMHeader
9134#
9135
9136# General SMS header rule.
9137# The SMS boot ROM checks the header at three locations.
91380	name	sega-master-system-rom-header
9139# Machine type.
9140>0x0F	byte&0xF0	0x30	Sega Master System
9141!:mime	application/x-sms-rom
9142>0x0F	byte&0xF0	0x40	Sega Master System
9143!:mime	application/x-sms-rom
9144>0x0F	byte&0xF0	0x50	Sega Game Gear
9145!:mime	application/x-gamegear-rom
9146>0x0F	byte&0xF0	0x60	Sega Game Gear
9147!:mime	application/x-gamegear-rom
9148>0x0F	byte&0xF0	0x70	Sega Game Gear
9149!:mime	application/x-gamegear-rom
9150>0x0F	default		x	Sega Master System / Game Gear
9151!:mime	application/x-sms-rom
9152>0	byte		x	ROM image:
9153# Product code.
9154>0x0E	byte&0xF0	0x10	1
9155>0x0E	byte&0xF0	0x20	2
9156>0x0E	byte&0xF0	0x30	3
9157>0x0E	byte&0xF0	0x40	4
9158>0x0E	byte&0xF0	0x50	5
9159>0x0E	byte&0xF0	0x60	6
9160>0x0E	byte&0xF0	0x70	7
9161>0x0E	byte&0xF0	0x80	8
9162>0x0E	byte&0xF0	0x90	9
9163>0x0E	byte&0xF0	0xA0	10
9164>0x0E	byte&0xF0	0xB0	11
9165>0x0E	byte&0xF0	0xC0	12
9166>0x0E	byte&0xF0	0xD0	13
9167>0x0E	byte&0xF0	0xE0	14
9168>0x0E	byte&0xF0	0xF0	15
9169# If the product code is 5 digits, we'll need to backspace here.
9170>0x0E	byte&0xF0	!0
9171>>0x0C	leshort		x	\b%04x
9172>0x0E	byte&0xF0	0
9173>>0x0C	leshort		x	%04x
9174# Revision.
9175>0x0E	byte&0x0F	x	(Rev.%02d)
9176# ROM size. (Used for the boot ROM checksum routine.)
9177>0x0F	byte&0x0F	0x0A	(8 KB)
9178>0x0F	byte&0x0F	0x0B	(16 KB)
9179>0x0F	byte&0x0F	0x0C	(32 KB)
9180>0x0F	byte&0x0F	0x0D	(48 KB)
9181>0x0F	byte&0x0F	0x0E	(64 KB)
9182>0x0F	byte&0x0F	0x0F	(128 KB)
9183>0x0F	byte&0x0F	0x00	(256 KB)
9184>0x0F	byte&0x0F	0x01	(512 KB)
9185>0x0F	byte&0x0F	0x02	(1 MB)
9186
9187# SMS/GG header locations.
91880x7FF0	string	TMR\ SEGA
9189>0x7FF0	use	sega-master-system-rom-header
91900x3FF0	string	TMR\ SEGA
9191>0x3FF0	use	sega-master-system-rom-header
91920x1FF0	string	TMR\ SEGA
9193>0x1FF0	use	sega-master-system-rom-header
9194
9195#------------------------------------------------------------------------------
9196# saturn: file(1) magic for the Sega Saturn disc image format.
9197# From: David Korth <gerbilsoft@gerbilsoft.com>
9198#
9199
9200# Common Sega Saturn disc header format.
9201# NOTE: Title is 112 bytes, but we're only showing 32 due to space padding.
9202# TODO: Release date, device information, region code, others?
92030	name	sega-saturn-disc-header
9204>0x60	string	>\0	\b: "%.32s"
9205>0x20	string	>\0	(%.10s
9206>>0x2A	string	>\0	\b, %.6s)
9207>>0x2A	byte	0	\b)
9208
9209# 2048-byte sector version.
92100	string	SEGA\ SEGASATURN\ 	Sega Saturn disc image
9211!:mime	application/x-saturn-rom
9212>0	use	sega-saturn-disc-header
9213>0	byte	x			(2048-byte sectors)
9214# 2352-byte sector version.
92150x10	string	SEGA\ SEGASATURN\ 	Sega Saturn disc image
9216!:mime	application/x-saturn-rom
9217>0x10	use	sega-saturn-disc-header
9218>0	byte	x			(2352-byte sectors)
9219
9220#------------------------------------------------------------------------------
9221# dreamcast: file(1) magic for the Sega Dreamcast disc image format.
9222# From: David Korth <gerbilsoft@gerbilsoft.com>
9223# Reference: https://mc.pp.se/dc/ip0000.bin.html
9224#
9225
9226# Common Sega Dreamcast disc header format.
9227# NOTE: Title is 128 bytes, but we're only showing 32 due to space padding.
9228# TODO: Release date, device information, region code, others?
92290	name	sega-dreamcast-disc-header
9230>0x80	string	>\0	\b: "%.32s"
9231>0x40	string	>\0	(%.10s
9232>>0x4A	string	>\0	\b, %.6s)
9233>>0x4A	byte	0	\b)
9234
9235# 2048-byte sector version.
92360	string	SEGA\ SEGAKATANA\ 	Sega Dreamcast disc image
9237!:mime	application/x-dc-rom
9238>0	use	sega-dreamcast-disc-header
9239>0	byte	x			(2048-byte sectors)
9240# 2352-byte sector version.
92410x10	string	SEGA\ SEGAKATANA\ 	Sega Dreamcast disc image
9242!:mime	application/x-dc-rom
9243>0x10	use	sega-dreamcast-disc-header
9244>0	byte	x			(2352-byte sectors)
9245
9246#------------------------------------------------------------------------------
9247# dreamcast:  file(1) uncertain magic for the Sega Dreamcast VMU image format
9248#
92490 belong 0x21068028   Sega Dreamcast VMU game image
92500 string LCDi         Dream Animator file
9251
9252#------------------------------------------------------------------------------
9253# z64: file(1) magic for the Z64 format N64 ROM dumps
9254# Reference: http://forum.pj64-emu.com/showthread.php?t=2239
9255# From: David Korth <gerbilsoft@gerbilsoft.com>
9256#
92570	bequad	0x803712400000000F	Nintendo 64 ROM image
9258!:mime	application/x-n64-rom
9259>0x20	string	>\0	\b: "%.20s"
9260>0x3B	string	x	(%.4s
9261>0x3F	byte	x	\b, Rev.%02u)
9262
9263#------------------------------------------------------------------------------
9264# v64: file(1) magic for the V64 format N64 ROM dumps
9265# Same as z64 format, but with 16-bit byteswapping.
9266#
92670	bequad	0x3780401200000F00	Nintendo 64 ROM image (V64)
9268!:mime	application/x-n64-rom
9269
9270#------------------------------------------------------------------------------
9271# n64-swap2: file(1) magic for the swap2 format N64 ROM dumps
9272# Same as z64 format, but with swapped 16-bit words.
9273#
92740	bequad	0x12408037000F0000	Nintendo 64 ROM image (wordswapped)
9275!:mime	application/x-n64-rom
9276
9277#------------------------------------------------------------------------------
9278# n64-le32: file(1) magic for the 32-bit byteswapped format N64 ROM dumps
9279# Same as z64 format, but with 32-bit byteswapping.
9280#
92810	bequad	0x401237800F000000	Nintendo 64 ROM image (32-bit byteswapped)
9282!:mime	application/x-n64-rom
9283
9284#------------------------------------------------------------------------------
9285# gba: file(1) magic for the Nintendo Game Boy Advance raw ROM format
9286# Reference: https://problemkaputt.de/gbatek.htm#gbacartridgeheader
9287#
9288# Original version from: "Nelson A. de Oliveira" <naoliv@gmail.com>
9289# Updated version from: David Korth <gerbilsoft@gerbilsoft.com>
9290#
92914	bequad	0x24FFAE51699AA221	Game Boy Advance ROM image
9292!:mime	application/x-gba-rom
9293>0xA0	string	>\0	\b: "%.12s"
9294>0xAC	string	x	(%.6s
9295>0xBC	byte	x	\b, Rev.%02u)
9296
9297#------------------------------------------------------------------------------
9298# nds: file(1) magic for the Nintendo DS(i) raw ROM format
9299# Reference: https://problemkaputt.de/gbatek.htm#dscartridgeheader
9300#
9301# Original version from: "Nelson A. de Oliveira" <naoliv@gmail.com>
9302# Updated version from: David Korth <gerbilsoft@gerbilsoft.com>
9303#
93040xC0	bequad	0x24FFAE51699AA221	Nintendo DS ROM image
9305!:mime	application/x-nintendo-ds-rom
9306>0x00	string	>\0		\b: "%.12s"
9307>0x0C	string	x		(%.6s
9308>0x1E	byte	x		\b, Rev.%02u)
9309>0x12	byte	2		(DSi enhanced)
9310>0x12	byte	3		(DSi only)
9311# Secure Area check.
9312>0x20		lelong	<0x4000		(homebrew)
9313>0x20		lelong	>0x3FFF
9314>>0x4000	lequad	0x0000000000000000	(multiboot)
9315>>0x4000	lequad	!0x0000000000000000
9316>>>0x4000	lequad	0xE7FFDEFFE7FFDEFF	(decrypted)
9317>>>0x4000	lequad	!0xE7FFDEFFE7FFDEFF
9318>>>>0x1000	lequad	0x0000000000000000	(encrypted)
9319>>>>0x1000	lequad	!0x0000000000000000	(mask ROM)
9320
9321#------------------------------------------------------------------------------
9322# nds_passme: file(1) magic for Nintendo DS ROM images for GBA cartridge boot.
9323# This is also used for loading .nds files using the MSET exploit on 3DS.
9324# Reference: https://github.com/devkitPro/ndstool/blob/master/source/ndscreate.cpp
93250xC0	bequad	0xC8604FE201708FE2	Nintendo DS Slot-2 ROM image (PassMe)
9326!:mime	application/x-nintendo-ds-rom
9327
9328#------------------------------------------------------------------------------
9329# ngp: file(1) magic for the Neo Geo Pocket (Color) raw ROM format.
9330# From: David Korth <gerbilsoft@gerbilsoft.com>
9331# References:
9332# - https://neogpc.googlecode.com/svn-history/r10/trunk/src/core/neogpc.cpp
9333# - https://www.devrs.com/ngp/files/ngpctech.txt
9334#
93350x0A	string		BY\ SNK\ CORPORATION	Neo Geo Pocket
9336!:mime	application/x-neo-geo-pocket-rom
9337>0x23	byte		0x10			Color
9338>0	byte		x			ROM image
9339>0x24	string		>\0			\b: "%.12s"
9340>0x21	uleshort	x			\b, NEOP%04X
9341>0x1F	ubyte		0xFF			(debug mode enabled)
9342
9343#------------------------------------------------------------------------------
9344# msx: file(1) magic for MSX game cartridge dumps
9345# Too simple - MPi
9346#0 beshort 0x4142 MSX game cartridge dump
9347
9348#------------------------------------------------------------------------------
9349# Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) :
93500	string	PS-X\ EXE	Sony Playstation executable
9351>16	lelong	x		PC=%#08x,
9352>20	lelong	!0		GP=%#08x,
9353>24	lelong	!0		.text=[%#08x,
9354>>28	lelong	x		\b%#x],
9355>32	lelong	!0		.data=[%#08x,
9356>>36	lelong	x		\b%#x],
9357>40	lelong	!0		.bss=[%#08x,
9358>>44	lelong	x		\b%#x],
9359>48	lelong	!0		Stack=%#08x,
9360>48	lelong	=0		No Stack!,
9361>52	lelong	!0		StackSize=%#x,
9362#>76	string	>\0		(%s)
9363#  Area:
9364>113	string	x		(%s)
9365
9366# CPE executables
93670	string	CPE		CPE executable
9368>3	byte	x		(version %d)
9369
9370#------------------------------------------------------------------------------
9371# Microsoft Xbox executables .xbe (Esa Hyytia <ehyytia@cc.hut.fi>)
93720	string	XBEH	Microsoft Xbox executable
9373!:mime	audio/x-xbox-executable
9374!:ext	xbe
9375# expect base address of 0x10000
9376>0x0104                 ulelong =0x10000
9377>>(0x0118.l-0x0FFF4)    lestring16 x       \b: "%.40s"
9378>>(0x0118.l-0x0FFF5)    byte     x         (%c
9379>>(0x0118.l-0x0FFF6)    byte     x         \b%c-
9380>>(0x0118.l-0x0FFF8)    uleshort x         \b%03u)
9381>>(0x0118.l-0x0FF60)    ulelong&0x80000007  0x80000007 \b, all regions
9382>>(0x0118.l-0x0FF60)    ulelong&0x80000007  !0x80000007
9383>>>(0x0118.l-0x0FF60)   ulelong >0           (regions:
9384>>>>(0x0118.l-0x0FF60)  ulelong &0x00000001  NA
9385>>>>(0x0118.l-0x0FF60)  ulelong &0x00000002  Japan
9386>>>>(0x0118.l-0x0FF60)  ulelong &0x00000004  Rest_of_World
9387>>>>(0x0118.l-0x0FF60)  ulelong &0x80000000  Manufacturer
9388>>>(0x0118.l-0x0FF60)   ulelong >0           \b)
9389# probabilistic checks whether signed or not
9390>0x0004 ulelong =0x0
9391>>&2    ulelong =0x0
9392>>>&2   ulelong =0x0  \b, not signed
9393>0x0004 ulelong >0
9394>>&2    ulelong >0
9395>>>&2   ulelong >0    \b, signed
9396
9397# --------------------------------
9398# Microsoft Xbox data file formats
93990       string          XIP0            XIP, Microsoft Xbox data
94000       string          XTF0            XTF, Microsoft Xbox data
9401
9402#------------------------------------------------------------------------------
9403# Microsoft Xbox 360 executables (.xex)
9404# From: David Korth <gerbilsoft@gerbilsoft.com>
9405# References:
9406# - https://free60project.github.io/wiki/XEX.html
9407# - https://github.com/xenia-project/xenia/blob/HEAD/src/xenia/kernel/util/xex2_info.h
9408
9409# Title ID (part of Execution ID section)
94100		name	xbox-360-xex-execution-id
9411>(0.L+0xC)	byte	x	(%c
9412>(0.L+0xD)	byte	x	\b%c
9413>(0.L+0xE)	beshort	x	\b-%04u, media ID:
9414>(0.L)		belong	x	%08X)
9415
9416# Region code (part of Security Info)
94170	name	xbox-360-xex-region-code
9418>0	ubelong	0xFFFFFFFF	\b, all regions
9419>0	ubelong	!0xFFFFFFFF
9420>>0	ubelong	>0		(regions:
9421>>0	ubelong&0x000000FF	0x000000FF	USA
9422>>0	ubelong&0x00000100	0x00000100	Japan
9423>>0	ubelong&0x00000200	0x00000200	China
9424>>0	ubelong&0x0000FC00	0x0000FC00	Asia
9425>>0	ubelong&0x00FF0000	0x00FF0000	PAL
9426>>0	ubelong&0x00FF0000	0x00FE0000	PAL [except AU/NZ]
9427>>0	ubelong&0x00FF0000	0x00010000	AU/NZ
9428>>0	ubelong&0xFF000000	0xFF000000	Other
9429>>0	ubelong	>0		\b)
9430
94310	string	XEX2	Microsoft Xbox 360 executable
9432!:mime	audio/x-xbox360-executable
9433!:ext	xex
9434>0x18	search/0x100	\x00\x04\x00\x06
9435>>&0	use	xbox-360-xex-execution-id
9436>(0x010.L+0x178)	use	xbox-360-xex-region-code
9437
94380	string	XEX1	Microsoft Xbox 360 executable (XEX1)
9439!:mime	audio/x-xbox360-executable
9440!:ext	xex
9441>0x18	search/0x100	\x00\x04\x00\x06
9442>>&0	use	xbox-360-xex-execution-id
9443>(0x010.L+0x154)	use	xbox-360-xex-region-code
9444
9445#------------------------------------------------------------------------------
9446# Microsoft Xbox 360 packages
9447# From: David Korth <gerbilsoft@gerbilsoft.com>
9448# References:
9449# - https://free60project.github.io/wiki/STFS.html
9450# - https://github.com/xenia-project/xenia/blob/HEAD/src/xenia/kernel/util/xex2_info.h
9451
9452# TODO: More information for console-signed packages.
9453
94540	name	xbox-360-package
9455>0x360	byte	x	(%c
9456>0x361	byte	x	\b%c
9457>0x362	beshort	x	\b-%04u, media ID:
9458>0x354	belong	x	%08X)
9459>0x344	belong	x	\b, content type:
9460>>0x344	belong	0x1		Saved Game
9461>>0x344	belong	0x2		Marketplace Content
9462>>0x344	belong	0x3		Publisher
9463>>0x344	belong	0x1000		Xbox 360 Title
9464>>0x344	belong	0x2000		IPTV Pause Buffer
9465>>0x344	belong	0x4000		Installed Game
9466>>0x344	belong	0x5000		Original Xbox Game
9467>>0x344	belong	0x9000		Avatar Item
9468>>0x344	belong	0x10000		Profile
9469>>0x344	belong	0x20000		Gamer Picture
9470>>0x344	belong	0x30000		Theme
9471>>0x344	belong	0x40000		Cache File
9472>>0x344	belong	0x50000		Storage Download
9473>>0x344	belong	0x60000		Xbox Saved Game
9474>>0x344	belong	0x70000		Xbox Download
9475>>0x344	belong	0x80000		Game Demo
9476>>0x344	belong	0x90000		Video
9477>>0x344	belong	0xA0000		Game
9478>>0x344	belong	0xB0000		Installer
9479>>0x344	belong	0xC0000		Game Trailer
9480>>0x344	belong	0xD0000		Arcade Title
9481>>0x344	belong	0xE0000		XNA
9482>>0x344	belong	0xF0000		License Store
9483>>0x344	belong	0x100000	Movie
9484>>0x344	belong	0x200000	TV
9485>>0x344	belong	0x300000	Music Video
9486>>0x344	belong	0x400000	Game Video
9487>>0x344	belong	0x500000	Podcast Video
9488>>0x344	belong	0x600000	Viral Video
9489>>0x344	belong	0x2000000	Community Game
9490
94910	string	CON\x20	Microsoft Xbox 360 package (console-signed)
9492>0	use	xbox-360-package
94930	string	PIRS
9494>0	belong	0	Microsoft Xbox 360 package (non-Xbox Live)
9495>>0	use	xbox-360-package
94960	string	LIVE
9497>0x104	belong	0	Microsoft Xbox 360 package (Xbox Live)
9498>>0	use	xbox-360-package
9499
9500# Atari Lynx cartridge dump (EXE/BLL header)
9501# From: "Stefan A. Haubenthal" <polluks@sdf.lonestar.org>
9502# Reference:
9503# https://raw.githubusercontent.com/cc65/cc65/master/libsrc/lynx/exehdr.s
9504# Double-check that the image type matches too, 0x8008 conflicts with
9505# 8 character OMF-86 object file headers.
95060	beshort		0x8008
9507>6	string		BS93		Lynx homebrew cartridge
9508!:mime	application/x-atari-lynx-rom
9509>>2	beshort		x		\b, RAM start $%04x
95100	string		LYNX		Lynx cartridge
9511!:mime	application/x-atari-lynx-rom
9512>4	leshort/4	>0		\b, bank 0 %dk
9513>6	leshort/4	>0		\b, bank 1 %dk
9514>10	string		>\0		\b, "%.32s"
9515>42	string		>\0		\b, "%.16s"
9516
9517# Opera file system that is used on the 3DO console
9518# From: Serge van den Boom <svdb@stack.nl>
95190	string		\x01ZZZZZ\x01	3DO "Opera" file system
9520
9521# From: Alex Myczko <alex@aiei.ch>
9522# From: David Pflug <david@pflug.email>
9523# is the offset 12 or the offset 16 correct?
9524# GBS (Game Boy Sound) magic
9525# ftp://ftp.modland.com/pub/documents/format_documentation/\
9526# Gameboy%20Sound%20System%20(.gbs).txt
95270	string		GBS		Nintendo Gameboy Music/Audio Data
9528#12	string		GameBoy\ Music\ Module	Nintendo Gameboy Music Module
9529>16	string		>\0	("%.32s" by
9530>48	string		>\0	%.32s, copyright
9531>80	string		>\0	%.32s),
9532>3	byte		x	version %u,
9533>4	byte		x	%u tracks
9534
9535# IPS Patch Files from: From: Thomas Klausner <tk@giga.or.at>
9536# see https://zerosoft.zophar.net/ips.php
95370	string	PATCH			IPS patch file
9538!:ext	ips
9539
9540# BPS Patch Files - from: David Korth <gerbilsoft@gerbilsoft.com>
9541# Reference: https://www.romhacking.net/documents/746/
95420	string	BPS1			BPS patch file
9543!:ext	bps
9544
9545# APS Patch Files - from: David Korth <gerbilsoft@gerbilsoft.com>
9546# Reference: https://github.com/btimofeev/UniPatcher/wiki/APS-(N64)
95470	string	APS10			APS patch file
9548!:ext	aps
9549>5	byte	0			\b, simple patch
9550>5	byte	1			\b, N64-specific patch for
9551>>58	byte	x			N%c
9552>>59	byte	x			\b%c
9553>>60	byte	x			\b%c
9554>7	byte	!0x20
9555# FIXME: /T specifier isn't working with a fixed-length string.
9556>>7	string	x			\b: "%.50s"
9557
9558# UPS Patch Files - from: David Korth <gerbilsoft@gerbilsoft.com>
9559# Reference: http://fileformats.archiveteam.org/wiki/UPS_(binary_patch_format)
95600	string	UPS1			UPS patch file
9561!:ext	ups
9562
9563# Playstations Patch Files from: From: Thomas Klausner <tk@giga.or.at>
95640	string	PPF30			Playstation Patch File version 3.0
9565>5	byte	0			\b, PPF 1.0 patch
9566>5	byte	1			\b, PPF 2.0 patch
9567>5	byte	2			\b, PPF 3.0 patch
9568>>56	byte	0			\b, Imagetype BIN (any)
9569>>56	byte	1			\b, Imagetype GI (PrimoDVD)
9570>>57	byte	0			\b, Blockcheck disabled
9571>>57	byte	1			\b, Blockcheck enabled
9572>>58	byte	0			\b, Undo data not available
9573>>58	byte	1			\b, Undo data available
9574>6	string	x			\b, description: %s
9575
95760	string	PPF20			Playstation Patch File version 2.0
9577>5	byte	0			\b, PPF 1.0 patch
9578>5	byte	1			\b, PPF 2.0 patch
9579>>56	lelong	>0			\b, size of file to patch %d
9580>6	string	x			\b, description: %s
9581
95820	string	PPF10			Playstation Patch File version 1.0
9583>5	byte	0			\b, Simple Encoding
9584>6	string	x			\b, description: %s
9585
9586# From: Daniel Dawson <ddawson@icehouse.net>
9587# SNES9x .smv "movie" file format.
95880		string		SMV\x1A	SNES9x input recording
9589>0x4		lelong		x	\b, version %d
9590# version 4 is latest so far
9591>0x4		lelong		<5
9592>>0x8		ledate		x	\b, recorded at %s
9593>>0xc		lelong		>0	\b, rerecorded %d times
9594>>0x10		lelong		x	\b, %d frames long
9595>>0x14		byte		>0	\b, data for controller(s):
9596>>>0x14		byte		&0x1	#1
9597>>>0x14		byte		&0x2	#2
9598>>>0x14		byte		&0x4	#3
9599>>>0x14		byte		&0x8	#4
9600>>>0x14		byte		&0x10	#5
9601>>0x15		byte		^0x1	\b, begins from snapshot
9602>>0x15		byte		&0x1	\b, begins from reset
9603>>0x15		byte		^0x2	\b, NTSC standard
9604>>0x15		byte		&0x2	\b, PAL standard
9605>>0x17		byte		&0x1    \b, settings:
9606# WIP1Timing not used as of version 4
9607>>>0x4		lelong		<4
9608>>>>0x17	byte		&0x2	WIP1Timing
9609>>>0x17		byte		&0x4	Left+Right
9610>>>0x17		byte		&0x8	VolumeEnvX
9611>>>0x17		byte		&0x10	FakeMute
9612>>>0x17		byte		&0x20	SyncSound
9613# New flag as of version 4
9614>>>0x4		lelong		>3
9615>>>>0x17	byte		&0x80	NoCPUShutdown
9616>>0x4		lelong		<4
9617>>>0x18		lelong		>0x23
9618>>>>0x20	leshort		!0
9619>>>>>0x20	lestring16	x	\b, metadata: "%s"
9620>>0x4		lelong		>3
9621>>>0x24		byte		>0	\b, port 1:
9622>>>>0x24	byte		1	joypad
9623>>>>0x24	byte		2	mouse
9624>>>>0x24	byte		3	SuperScope
9625>>>>0x24	byte		4	Justifier
9626>>>>0x24	byte		5	multitap
9627>>>0x24		byte		>0	\b, port 2:
9628>>>>0x25	byte		1	joypad
9629>>>>0x25	byte		2	mouse
9630>>>>0x25	byte		3	SuperScope
9631>>>>0x25	byte		4	Justifier
9632>>>>0x25	byte		5	multitap
9633>>>0x18		lelong		>0x43
9634>>>>0x40	leshort		!0
9635>>>>>0x40	lestring16	x	\b, metadata: "%s"
9636>>0x17		byte		&0x40   \b, ROM:
9637>>>(0x18.l-26)	lelong		x	CRC32 %#08x
9638>>>(0x18.l-23)	string		x	"%s"
9639
9640# Type: scummVM savegame files
9641# From: Sven Hartge <debian@ds9.argh.org>
96420	string	SCVM	ScummVM savegame
9643>12	string	>\0	"%s"
9644
9645#------------------------------------------------------------------------------
9646# Nintendo GameCube / Wii file formats.
9647#
9648
9649# Type: Nintendo GameCube/Wii common disc header data.
9650# From: David Korth <gerbilsoft@gerbilsoft.com>
9651# Reference: https://wiibrew.org/wiki/Wii_Disc
96520	name	nintendo-gcn-disc-common
9653>0x20	string	x	"%.64s"
9654>0x00	string	x	(%.6s
9655>0x06	byte	>0
9656>>0x06	byte	1	\b, Disc 2
9657>>0x06	byte	2	\b, Disc 3
9658>>0x06	byte	3	\b, Disc 4
9659>0x07	byte	x	\b, Rev.%02u)
9660>0x18	belong	0x5D1C9EA3
9661>>0x60	beshort	0x0101	\b (Unencrypted)
9662>0x200	string	NKIT	\b (NKit compressed)
9663
9664
9665# Type: Nintendo GameCube disc image
9666# From: David Korth <gerbilsoft@gerbilsoft.com>
9667# Reference: https://wiibrew.org/wiki/Wii_Disc
96680x1C	belong	0xC2339F3D	Nintendo GameCube disc image:
9669!:mime	application/x-gamecube-rom
9670>0	use	nintendo-gcn-disc-common
9671
9672# Type: Nintendo GameCube embedded disc image
9673# Commonly found on demo discs.
9674# From: David Korth <gerbilsoft@gerbilsoft.com>
9675# Reference: http://hitmen.c02.at/files/yagcd/yagcd/index.html#idx14.8
96760		belong	0xAE0F38A2
9677>0x0C		belong	0x00100000
9678>>(8.L+0x1C)	belong	0xC2339F3D	Nintendo GameCube embedded disc image:
9679!:mime	application/x-gamecube-rom
9680>>>(8.L)	use	nintendo-gcn-disc-common
9681
9682# Type: Nintendo Wii disc image
9683# From: David Korth <gerbilsoft@gerbilsoft.com>
9684# Reference: https://wiibrew.org/wiki/Wii_Disc
96850x18	belong	0x5D1C9EA3	Nintendo Wii disc image:
9686>0	use	nintendo-gcn-disc-common
9687
9688# Type: Nintendo Wii disc image (WBFS format)
9689# From: David Korth <gerbilsoft@gerbilsoft.com>
9690# Reference: https://wiibrew.org/wiki/Wii_Disc
96910	string	WBFS
9692>0x218	belong	0x5D1C9EA3	Nintendo Wii disc image (WBFS format):
9693!:mime	application/x-wii-rom
9694>>0x200	use	nintendo-gcn-disc-common
9695
9696# Type: Nintendo GameCube/Wii disc image (CISO format)
9697# NOTE: This is NOT the same as Compact ISO or PSP CISO,
9698# though it has the same magic number.
96990		string	CISO
9700# Other fields are used to determine what type of CISO this is:
9701# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size)
9702# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size)
9703# - None of the above: Compact ISO.
9704>4		lelong	0x200000
9705>>8		byte	1
9706>>>0x801C	belong	0xC2339F3D	Nintendo GameCube disc image (CISO format):
9707!:mime	application/x-wii-rom
9708>>>>0x8000	use	nintendo-gcn-disc-common
9709>>>0x8018	belong	0x5D1C9EA3	Nintendo Wii disc image (CISO format):
9710!:mime	application/x-wii-rom
9711>>>>0x8000	use	nintendo-gcn-disc-common
9712
9713# Type: Nintendo GameCube/Wii disc image (GCZ format)
9714# Due to zlib compression, we can't get the actual disc information.
97150	lelong	0xB10BC001
9716>4	lelong	0		Nintendo GameCube disc image (GCZ format)
9717!:mime	application/x-gamecube-rom
9718>4	lelong	1		Nintendo Wii disc image (GCZ format)
9719!:mime	application/x-wii-rom
9720>4	default	x		Nintendo GameCube/Wii disc image (GCZ format)
9721
9722# Type: Nintendo GameCube/Wii disc image (WDF format)
97230		string	WII\001DISC
9724>8		belong	1
9725# WDFv1
9726>>0x54		belong	0xC2339F3D	Nintendo GameCube disc image (WDFv1 format):
9727!:mime	application/x-gamecube-rom
9728>>>0x38		use	nintendo-gcn-disc-common
9729>>0x58		belong	0x5D1C9EA3	Nintendo Wii disc image (WDFv1 format):
9730!:mime	application/x-wii-rom
9731>>>0x38		use	nintendo-gcn-disc-common
9732>8		belong	2
9733# WDFv2
9734>>(12.L+0x1C)	belong	0xC2339F3D	Nintendo GameCube disc image (WDFv2 format):
9735!:mime	application/x-gamecube-rom
9736>>>(12.L)	use	nintendo-gcn-disc-common
9737>>(12.L+0x18)	belong	0x5D1C9EA3	Nintendo Wii disc image (WDFv2 format):
9738!:mime	application/x-wii-rom
9739>>>(12.L)	use	nintendo-gcn-disc-common
9740
9741# Type: Nintendo GameCube/Wii disc image (WIA format)
97420	string	WIA\001	Nintendo
9743>0x48	belong	1	GameCube
9744!:mime	application/x-gamecube-rom
9745>0x48	belong	2	Wii
9746!:mime	application/x-wii-rom
9747>0x48	default	x	GameCube/Wii
9748>0x48	belong	x	disc image (WIA format):
9749>>0x58	use	nintendo-gcn-disc-common
9750
9751# Type: Nintendo GameCube/Wii disc image (with SDK header)
9752# From: David Korth <gerbilsoft@gerbilsoft.com>
9753# Reference: https://wiibrew.org/wiki/Wii_Disc
97540		belong	0xFFFF0000
9755>0x18		belong	0x00000000
9756>>0x1C		belong	0x00000000
9757>>>0x8018	belong	0x5D1C9EA3	Nintendo Wii SDK disc image:
9758!:mime	application/x-wii-rom
9759>>>>0x8000	use	nintendo-gcn-disc-common
9760>>>0x801C	belong	0xC2339F3D	Nintendo GameCube SDK disc image:
9761!:mime	application/x-gamecube-rom
9762>>>>0x8000	use	nintendo-gcn-disc-common
9763
9764# Type: Nintendo GameCube/Wii disc image (RVZ format)
97650	string		RVZ\001	Nintendo
9766>0x48	belong		1	GameCube
9767!:mime	application/x-gamecube-rom
9768>0x48	belong		2	Wii
9769!:mime	application/x-wii-rom
9770>0x48	default		x	GameCube/Wii
9771>0x48	belong		x	disc image (RVZ format):
9772>>0x58	use		nintendo-gcn-disc-common
9773
9774#------------------------------------------------------------------------------
9775# Nintendo 3DS file formats.
9776#
9777
9778# Type: Nintendo 3DS "NCSD" image. (game cards and eMMC)
9779# From: David Korth <gerbilsoft@gerbilsoft.com>
9780# Reference: https://www.3dbrew.org/wiki/NCSD
97810x100		string		NCSD
9782>0x118		lequad		0		Nintendo 3DS Game Card image
9783# NCCH header for partition 0. (game data)
9784>>0x1150	string		>\0	\b: "%.16s"
9785>>0x312		byte		x	(Rev.%02u)
9786>>0x118C	byte		2	(New3DS only)
9787>>0x18D		byte		0		(inner device)
9788>>0x18D		byte		1		(Card1)
9789>>0x18D		byte		2		(Card2)
9790>>0x18D		byte		3		(extended device)
9791>0x118		bequad		0x0102020202000000	Nintendo 3DS eMMC dump (Old3DS)
9792>0x118		bequad		0x0102020203000000	Nintendo 3DS eMMC dump (New3DS)
9793
9794# Nintendo 3DS version code.
9795# Reference: https://www.3dbrew.org/wiki/Titles
9796# Format: leshort containing three fields:
9797# - 6-bit: Major
9798# - 6-bit: Minor
9799# - 4-bit: Revision
9800# NOTE: Only supporting major/minor versions from 0-15 right now.
9801# NOTE: Should be prefixed with "v".
98020	name	nintendo-3ds-version-code
9803# Raw version.
9804>0	leshort	x	\b%u,
9805# Major version.
9806>0	leshort&0xFC00	0x0000	0
9807>0	leshort&0xFC00	0x0400	1
9808>0	leshort&0xFC00	0x0800	2
9809>0	leshort&0xFC00	0x0C00	3
9810>0	leshort&0xFC00	0x1000	4
9811>0	leshort&0xFC00	0x1400	5
9812>0	leshort&0xFC00	0x1800	6
9813>0	leshort&0xFC00	0x1C00	7
9814>0	leshort&0xFC00	0x2000	8
9815>0	leshort&0xFC00	0x2400	9
9816>0	leshort&0xFC00	0x2800	10
9817>0	leshort&0xFC00	0x2C00	11
9818>0	leshort&0xFC00	0x3000	12
9819>0	leshort&0xFC00	0x3400	13
9820>0	leshort&0xFC00	0x3800	14
9821>0	leshort&0xFC00	0x3C00	15
9822# Minor version.
9823>0	leshort&0x03F0	0x0000	\b.0
9824>0	leshort&0x03F0	0x0010	\b.1
9825>0	leshort&0x03F0	0x0020	\b.2
9826>0	leshort&0x03F0	0x0030	\b.3
9827>0	leshort&0x03F0	0x0040	\b.4
9828>0	leshort&0x03F0	0x0050	\b.5
9829>0	leshort&0x03F0	0x0060	\b.6
9830>0	leshort&0x03F0	0x0070	\b.7
9831>0	leshort&0x03F0	0x0080	\b.8
9832>0	leshort&0x03F0	0x0090	\b.9
9833>0	leshort&0x03F0	0x00A0	\b.10
9834>0	leshort&0x03F0	0x00B0	\b.11
9835>0	leshort&0x03F0	0x00C0	\b.12
9836>0	leshort&0x03F0	0x00D0	\b.13
9837>0	leshort&0x03F0	0x00E0	\b.14
9838>0	leshort&0x03F0	0x00F0	\b.15
9839# Revision.
9840>0	leshort&0x000F	x	\b.%u
9841
9842# Type: Nintendo 3DS "NCCH" container.
9843# https://www.3dbrew.org/wiki/NCCH
98440x100		string	NCCH	Nintendo 3DS
9845>0x18D		byte&2	0	File Archive (CFA)
9846>0x18D		byte&2	2	Executable Image (CXI)
9847>0x150		string	>\0	\b: "%.16s"
9848>0x18D		byte	0x05
9849>>0x10E		leshort	x	(Old3DS System Update v
9850>>0x10E		use	nintendo-3ds-version-code
9851>>0x10E		leshort	x	\b)
9852>0x18D		byte	0x15
9853>>0x10E		leshort	x	(New3DS System Update v
9854>>0x10E		use	nintendo-3ds-version-code
9855>>0x10E		leshort	x	\b)
9856>0x18D		byte	!0x05
9857>>0x18D		byte	!0x15
9858>>>0x112	byte	x	(v
9859>>>0x112	use	nintendo-3ds-version-code
9860>>>0x112	byte	x	\b)
9861>0x18C		byte	2	(New3DS only)
9862
9863# Type: Nintendo 3DS "SMDH" file. (application description)
9864# From: David Korth <gerbilsoft@gerbilsoft.com>
9865# Reference: https://3dbrew.org/wiki/SMDH
98660		string		SMDH		Nintendo 3DS SMDH file
9867>0x208		leshort		!0
9868>>0x208		lestring16	x		\b: "%.128s"
9869>>0x388		leshort		!0
9870>>>0x388	lestring16	x		by %.128s
9871>0x208		leshort		0
9872>>0x008		leshort		!0
9873>>>0x008	lestring16	x		\b: "%.128s"
9874>>>0x188	leshort		!0
9875>>>>0x188	lestring16	x		by %.128s
9876
9877# Type: Nintendo 3DS Homebrew Application.
9878# From: David Korth <gerbilsoft@gerbilsoft.com>
9879# Reference: https://3dbrew.org/wiki/3DSX_Format
98800	string	3DSX	Nintendo 3DS Homebrew Application (3DSX)
9881
9882# Type: Nintendo 3DS Banner Model Data.
9883# From: David Korth <gerbilsoft@gerbilsoft.com>
9884# Reference: https://3dbrew.org/wiki/CBMD
98850	string	CBMD\0\0\0\0	Nintendo 3DS Banner Model Data
9886
9887#------------------------------------------------------------------------------
9888# a7800: file(1) magic for the Atari 7800 raw ROM format.
9889# From: David Korth <gerbilsoft@gerbilsoft.com>
9890# Reference: https://sites.google.com/site/atari7800wiki/a78-header
9891
98920	byte	>0
9893>0	byte	<3
9894>>1	string	ATARI7800	Atari 7800 ROM image
9895!:mime	application/x-atari-7800-rom
9896>>>0x11	string	>\0	\b: "%.32s"
9897# Display type.
9898>>>0x39	byte	0	(NTSC)
9899>>>0x39	byte	1	(PAL)
9900>>>0x36	byte&1	1	(POKEY)
9901
9902#------------------------------------------------------------------------------
9903# vectrex: file(1) magic for the GCE Vectrex raw ROM format.
9904# From: David Korth <gerbilsoft@gerbilsoft.com>
9905# Reference: http://www.playvectrex.com/designit/chrissalo/hello1.htm
9906#
9907# NOTE: Title is terminated with 0x80, not 0.
9908# The header is terminated with a 0, so that will
9909# terminate the title as well.
9910#
99110	string	g\ GCE	Vectrex ROM image
9912>0x11	string	>\0	\b: "%.16s"
9913
9914#------------------------------------------------------------------------------
9915# amiibo: file(1) magic for Nintendo amiibo NFC dumps.
9916# From: David Korth <gerbilsoft@gerbilsoft.com>
9917# Reference: https://www.3dbrew.org/wiki/Amiibo
99180x00		byte	0x04
9919>0x0A		beshort	0x0FE0
9920>>0x0C		belong	0xF110FFEE
9921>>>0x208	beshort	0x0100
9922>>>>0x020A	byte	0x0F
9923>>>>>0x020C	bequad	0x000000045F000000
9924>>>>>>0x5B	byte	0x02
9925>>>>>>>0x54	belong	x	Nintendo amiibo NFC dump - amiibo ID: %08X-
9926>>>>>>>0x58	belong	x	\b%08X
9927
9928#------------------------------------------------------------------------------
9929# Type: Nintendo Switch XCI (Game Cartridge Image)
9930# From: Benjamin Lowry <ben@ben.gmbh>
9931# Reference: https://switchbrew.org/wiki/Gamecard_Format
99320x100		string	HEAD
9933>0x10D		byte	0xFA	Nintendo Switch cartridge image (XCI), 1GB
9934>0x10D		byte	0xF8	Nintendo Switch cartridge image (XCI), 2GB
9935>0x10D		byte	0xF0	Nintendo Switch cartridge image (XCI), 4GB
9936>0x10D		byte	0xE0	Nintendo Switch cartridge image (XCI), 8GB
9937>0x10D		byte	0xE1	Nintendo Switch cartridge image (XCI), 16GB
9938>0x10D		byte	0xE2	Nintendo Switch cartridge image (XCI), 32GB
9939
9940#------------------------------------------------------------------------------
9941# Type: Nintendo Switch Executable
9942# From: Benjamin Lowry <ben@ben.gmbh>
9943# Reference: https://switchbrew.org/wiki/NSO
99440x00		string	NSO0	Nintendo Switch executable (NSO)
9945
9946#------------------------------------------------------------------------------
9947# Type: Nintendo Switch PFS0
9948# From: Benjamin Lowry <ben@ben.gmbh>
9949# Reference: https://switchbrew.org/wiki/NCA_Format#PFS0
99500x00		string	PFS0	Nintendo Switch partition filesystem (PFS0)
9951>0x04		ulelong	x	\b, %d files
9952
9953#------------------------------------------------------------------------------
9954# amiibo: file(1) magic for Nintendo Badge Arcade files.
9955# From: David Korth <gerbilsoft@gerbilsoft.com>
9956# References:
9957# - https://github.com/GerbilSoft/rom-properties/issues/92
9958# - https://github.com/CaitSith2/BadgeArcadeTool
9959# - https://github.com/TheMachinumps/Advanced-badge-editor
9960
9961# PRBS: Individual badge and/or mega badge.
99620		string	PRBS
9963>0x44		byte	>0x20	Nintendo Badge Arcade
9964>>0xB8		ulelong	<2
9965>>>0xBC		ulelong	<2	badge:
9966>>>0xBC		ulelong	>1	Mega Badge
9967>>>>0xB8	ulelong	x	(%ux
9968>>>>0xBC	ulelong	x	\b%u):
9969>>0xB8		ulelong	>1	Mega Badge
9970>>>0xB8		ulelong	x	(%ux
9971>>>0xBC		ulelong	x	\b%u):
9972>0x44		string	x	"%s"
9973>0x3C		ulelong	x	\b, badge ID: %u
9974>0x74		byte	>0x20
9975>>0x74		string	x	\b, set: "%s"
9976>0xA8		ulelong	!0xFFFFFFFF
9977>>0xA8		ulelong	x	\b, launch title ID: %08X
9978>>0xA4		ulelong	x	\b-%08X
9979
9980# CABS: Badge set.
99810	string	CABS
9982>0x2C	byte	>0x20	Nintendo Badge Arcade badge set:
9983>>0x2C	string	x	"%.48s"
9984>>0x24	ulelong	x	\b, set ID: %u
9985
9986#------------------------------------------------------------------------------
9987# sufami: file(1) magic for Sufami Turbo ROM images.
9988# From: David Korth <gerbilsoft@gerbilsoft.com>
9989# References:
9990# - https://problemkaputt.de/fullsnes.htm#snescartsufamiturbominicartridgeadaptor
99910	string		BANDAI\ SFC-ADX
9992>0x10	string		!SFC-ADX\ BACKUP	Sufami Turbo ROM image:
9993>>0x10	string/T	x	"%.14s"
9994>>0x30	byte		x	\b, ID %02X
9995>>0x31	byte		x	\b%02X
9996>>0x32	byte		x	\b%02X
9997>>0x33	ubyte		>0	\b, series index %u
9998>>0x34	ubyte		0	[SlowROM]
9999>>0x34	ubyte		1	[FastROM]
10000>>0x35	ubyte		1	[SRAM]
10001>>0x35	ubyte		3	[Special]
10002
10003#------------------------------------------------------------------------------
10004# $File: convex,v 1.8 2012/10/03 23:44:43 christos Exp $
10005# convex:  file(1) magic for Convex boxes
10006#
10007# Convexes are big-endian.
10008#
10009# /*\
10010#  * Below are the magic numbers and tests added for Convex.
10011#  * Added at beginning, because they are expected to be used most.
10012# \*/
100130	belong	0507	Convex old-style object
10014>16	belong	>0	not stripped
100150	belong	0513	Convex old-style demand paged executable
10016>16	belong	>0	not stripped
100170	belong	0515	Convex old-style pre-paged executable
10018>16	belong	>0	not stripped
100190	belong	0517	Convex old-style pre-paged, non-swapped executable
10020>16	belong	>0	not stripped
100210	belong	0x011257	Core file
10022#
10023# The following are a series of dump format magic numbers.  Each one
10024# corresponds to a drastically different dump format.  The first on is
10025# the original dump format on a 4.1 BSD or earlier file system.  The
10026# second marks the change between the 4.1 file system and the 4.2 file
10027# system.  The Third marks the changing of the block size from 1K
10028# to 2K to be compatible with an IDC file system.  The fourth indicates
10029# a dump that is dependent on Convex Storage Manager, because data in
10030# secondary storage is not physically contained within the dump.
10031# The restore program uses these number to determine how the data is
10032# to be extracted.
10033#
1003424	belong	=60013	dump format, 4.2 or 4.3 BSD (IDC compatible)
1003524	belong	=60014	dump format, Convex Storage Manager by-reference dump
10036#
10037# what follows is a bunch of bit-mask checks on the flags field of the opthdr.
10038# If there is no `=' sign, assume just checking for whether the bit is set?
10039#
100400	belong	0601		Convex SOFF
10041>88	belong&0x000f0000	=0x00000000	c1
10042>88	belong			&0x00010000	c2
10043>88	belong			&0x00020000	c2mp
10044>88	belong			&0x00040000	parallel
10045>88	belong			&0x00080000	intrinsic
10046>88	belong			&0x00000001	demand paged
10047>88	belong			&0x00000002	pre-paged
10048>88	belong			&0x00000004	non-swapped
10049>88	belong			&0x00000008	POSIX
10050#
10051>84	belong			&0x80000000	executable
10052>84	belong			&0x40000000	object
10053>84	belong&0x20000000	=0		not stripped
10054>84	belong&0x18000000	=0x00000000	native fpmode
10055>84	belong&0x18000000	=0x10000000	ieee fpmode
10056>84	belong&0x18000000	=0x18000000	undefined fpmode
10057#
100580	belong			0605		Convex SOFF core
10059#
100600	belong			0607		Convex SOFF checkpoint
10061>88	belong&0x000f0000	=0x00000000	c1
10062>88	belong			&0x00010000	c2
10063>88	belong			&0x00020000	c2mp
10064>88	belong			&0x00040000	parallel
10065>88	belong			&0x00080000	intrinsic
10066>88	belong			&0x00000008	POSIX
10067#
10068>84	belong&0x18000000	=0x00000000	native fpmode
10069>84	belong&0x18000000	=0x10000000	ieee fpmode
10070>84	belong&0x18000000	=0x18000000	undefined fpmode
10071
10072#------------------------------------------------------------------------------
10073# $File: coverage,v 1.3 2021/02/23 00:51:10 christos Exp $
10074# xoverage:  file(1) magic for test coverage data
10075
10076# File formats used to store test coverage data
10077# 2016-05-21, Georg Sauthoff <mail@georg.so>
10078
10079
10080# - GCC gcno - written by GCC at compile time when compiling with
10081# 	gcc -ftest-coverage
10082# - GCC gcda - written by a program that was compiled with
10083#	gcc -fprofile-arcs
10084# - LLVM raw profiles - generated by a program compiled with
10085#	clang -fprofile-instr-generate -fcoverage-mapping ...
10086# - LLVM indexed profiles - generated by
10087#	llvm-profdata
10088# - GCOV reports, i.e. the annotated source code
10089# - LCOV trace files, i.e. aggregated GCC profiles
10090#
10091# GCC coverage tracefiles
10092# .gcno file are created during compile time,
10093# while data collected during runtime is stored in .gcda files
10094# cf. gcov-io.h
10095# https://gcc.gnu.org/onlinedocs/gcc-5.3.0/gcc/Gcov-Data-Files.html
10096# Examples:
10097# Fedora 23/x86-64/gcc-5.3.1: 6f 6e 63 67 52 33 30 35
10098# Debian 8 PPC64/gcc-4.9.2  : 67 63 6e 6f 34 30 39 2a
100990	lelong	0x67636e6f	GCC gcno coverage (-ftest-coverage),
10100>&3	byte	x	version %c.
10101>&1	byte	x	\b%c
10102
10103# big endian
101040	belong	0x67636e6f	GCC gcno coverage (-ftest-coverage),
10105>&0	byte	x	version %c.
10106>&2	byte	x	\b%c (big-endian)
10107
10108# Examples:
10109# Fedora 23/x86-64/gcc-5.3.1: 61 64 63 67 52 33 30 35
10110# Debian 8 PPC64/gcc-4.9.2  : 67 63 64 61 34 30 39 2a
101110	lelong	0x67636461	GCC gcda coverage (-fprofile-arcs),
10112>&3	byte	x	version %c.
10113>&1	byte	x	\b%c
10114
10115# big endian
101160	belong	0x67636461	GCC gcda coverage (-fprofile-arcs),
10117>&0	byte	x	version %c.
10118>&2	byte	x	\b%c (big-endian)
10119
10120
10121# LCOV tracefiles
10122# cf. http://ltp.sourceforge.net/coverage/lcov/geninfo.1.php
101230	string	TN:
10124>&0	search/64	\nSF:/	LCOV coverage tracefile
10125
10126
10127# Coverage reports generated by gcov
10128# i.e. source code annotated with coverage information
101290	string	\x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Source:
10130>&0	search/128	\x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Graph:
10131>>&0	search/128	\x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Data:	GCOV coverage report
10132
10133
10134# LLVM coverage files
10135
10136# raw data after running a program compiled with:
10137# `clang -fprofile-instr-generate -fcoverage-mapping ...`
10138# default name: default.profraw
10139# magic is: \xFF lprofr \x81
10140# cf. https://llvm.org/docs/doxygen/html/InstrProfData_8inc_source.html
101410	lequad	0xff6c70726f667281	LLVM raw profile data,
10142>&0	byte	x	version %d
10143
10144# big endian
101450	bequad	0xff6c70726f667281	LLVM raw profile data,
10146>&7	byte	x	version %d (big-endian)
10147
10148
10149# LLVM indexed instruction profile (as generated by llvm-profdata)
10150# magic is: reverse(\xFF lprofi \x81)
10151# cf. https://llvm.org/docs/CoverageMappingFormat.html
10152# https://llvm.org/docs/doxygen/html/namespacellvm_1_1IndexedInstrProf.html
10153# https://llvm.org/docs/CommandGuide/llvm-cov.html
10154# https://llvm.org/docs/CommandGuide/llvm-profdata.html
101550	lequad	0x8169666f72706cff	LLVM indexed profile data,
10156>&0	byte	x	version %d
10157
10158# big endian
101590	bequad	0x8169666f72706cff	LLVM indexed profile data,
10160>&7	byte	x	version %d (big-endian)
10161
10162
10163#------------------------------------------------------------------------------
10164# $File: cracklib,v 1.7 2009/09/19 16:28:08 christos Exp $
10165# cracklib:  file (1) magic for cracklib v2.7
10166
101670	lelong	0x70775631	Cracklib password index, little endian
10168>4	long	>0		(%i words)
10169>4	long	0		("64-bit")
10170>>8	long	>-1		(%i words)
101710	belong	0x70775631	Cracklib password index, big endian
10172>4	belong	>-1		(%i words)
10173# really bellong 0x0000000070775631
101740	search/1	\0\0\0\0pwV1	Cracklib password index, big endian ("64-bit")
10175>12	belong	>0		(%i words)
10176
10177#------------------------------------------------------------------------------
10178# $File: crypto,v 1.2 2021/03/27 20:15:53 christos Exp $
10179# crypto:  file(1) magic for crypto formats
10180#
10181
10182# ----------------------------------------------------------------------------
10183# $File: ctags,v 1.6 2009/09/19 16:28:08 christos Exp $
10184# ctags:  file (1) magic for Exuberant Ctags files
10185# From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de>
101860	search/1	=!_TAG	Exuberant Ctags tag file text
10187
10188#--------------------------------------------------------------
10189# ctf:  file(1) magic for CTF (Common Trace Format) trace files
10190#
10191# Specs. available here: <https://www.efficios.com/ctf>
10192#--------------------------------------------------------------
10193
10194# CTF trace data
101950	lelong	0xc1fc1fc1	Common Trace Format (CTF) trace data (LE)
101960	belong	0xc1fc1fc1	Common Trace Format (CTF) trace data (BE)
10197
10198# CTF metadata (packetized)
101990	lelong	0x75d11d57	Common Trace Format (CTF) packetized metadata (LE)
10200>35	byte	x		\b, v%d
10201>36	byte	x		\b.%d
102020	belong	0x75d11d57	Common Trace Format (CTF) packetized metadata (BE)
10203>35	byte	x		\b, v%d
10204>36	byte	x		\b.%d
10205
10206# CTF metadata (plain text)
102070	string	/*\x20CTF\x20   Common Trace Format (CTF) plain text metadata
10208!:strength + 5			# this is to make sure we beat C
10209>&0	regex	[0-9]+\\.[0-9]+	\b, v%s
10210
10211#------------------------------------------------------------------------------
10212# $File: cubemap,v 1.1 2012/06/06 13:03:20 christos Exp $
10213# file(1) magic(5) data for cubemaps  Martin Erik Werner <martinerikwerner@gmail.com>
10214#
102150	string	ACMP	Map file for the AssaultCube FPS game
102160	string	CUBE	Map file for cube and cube2 engine games
102170	string	MAPZ)	Map file for the Blood Frontier/Red Eclipse FPS games
10218
10219#------------------------------------------------------------------------------
10220# $File: cups,v 1.6 2019/04/19 00:42:27 christos Exp $
10221# Cups: file(1) magic for the cups raster file format
10222# From: Laurent Martelli <martellilaurent@gmail.com>
10223# https://www.cups.org/documentation.php/spec-raster.html
10224#
10225
102260	name		cups-le
10227>280	lelong		x		\b, %d
10228>284	lelong		x		\bx%d dpi
10229>376	lelong		x		\b, %dx
10230>380	lelong		x		\b%d pixels
10231>388	lelong		x		%d bits/color
10232>392	lelong		x		%d bits/pixel
10233>400	lelong		0		ColorOrder=Chunky
10234>400	lelong		1		ColorOrder=Banded
10235>400	lelong		2		ColorOrder=Planar
10236>404	lelong		0		ColorSpace=gray
10237>404	lelong		1		ColorSpace=RGB
10238>404	lelong		2		ColorSpace=RGBA
10239>404	lelong		3		ColorSpace=black
10240>404	lelong		4		ColorSpace=CMY
10241>404	lelong		5		ColorSpace=YMC
10242>404	lelong		6		ColorSpace=CMYK
10243>404	lelong		7		ColorSpace=YMCK
10244>404	lelong		8		ColorSpace=KCMY
10245>404	lelong		9		ColorSpace=KCMYcm
10246>404	lelong		10		ColorSpace=GMCK
10247>404	lelong		11		ColorSpace=GMCS
10248>404	lelong		12		ColorSpace=WHITE
10249>404	lelong		13		ColorSpace=GOLD
10250>404	lelong		14		ColorSpace=SILVER
10251>404	lelong		15		ColorSpace=CIE XYZ
10252>404	lelong		16		ColorSpace=CIE Lab
10253>404	lelong		17		ColorSpace=RGBW
10254>404	lelong		18		ColorSpace=sGray
10255>404	lelong		19		ColorSpace=sRGB
10256>404	lelong		20		ColorSpace=AdobeRGB
10257
10258# Cups Raster image format, Big Endian
102590	string		RaS
10260>3	string		t		Cups Raster version 1, Big Endian
10261>3	string		2		Cups Raster version 2, Big Endian
10262>3	string		3		Cups Raster version 3, Big Endian
10263!:mime	application/vnd.cups-raster
10264>0	use		\^cups-le
10265
10266
10267# Cups Raster image format, Little Endian
102681	string		SaR
10269>0	string		t		Cups Raster version 1, Little Endian
10270>0	string		2		Cups Raster version 2, Little Endian
10271>0	string		3		Cups Raster version 3, Little Endian
10272!:mime	application/vnd.cups-raster
10273>0	use		cups-le
10274
10275#------------------------------------------------------------------------------
10276# $File: dact,v 1.4 2009/09/19 16:28:08 christos Exp $
10277# dact:  file(1) magic for DACT compressed files
10278#
102790	long		0x444354C3	DACT compressed data
10280>4	byte		>-1		(version %i.
10281>5	byte		>-1		$BS%i.
10282>6	byte		>-1		$BS%i)
10283>7	long		>0		$BS, original size: %i bytes
10284>15	long		>30		$BS, block size: %i bytes
10285
10286#------------------------------------------------------------------------------
10287# $File: database,v 1.67 2022/07/12 18:57:42 christos Exp $
10288# database:  file(1) magic for various databases
10289#
10290# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
10291#
10292#
10293# GDBM magic numbers
10294#  Will be maintained as part of the GDBM distribution in the future.
10295#  <downsj@teeny.org>
102960	belong	0x13579acd	GNU dbm 1.x or ndbm database, big endian, 32-bit
10297!:mime	application/x-gdbm
102980	belong	0x13579ace	GNU dbm 1.x or ndbm database, big endian, old
10299!:mime	application/x-gdbm
103000	belong	0x13579acf	GNU dbm 1.x or ndbm database, big endian, 64-bit
10301!:mime	application/x-gdbm
103020	lelong	0x13579acd	GNU dbm 1.x or ndbm database, little endian, 32-bit
10303!:mime	application/x-gdbm
103040	lelong	0x13579ace	GNU dbm 1.x or ndbm database, little endian, old
10305!:mime	application/x-gdbm
103060	lelong	0x13579acf	GNU dbm 1.x or ndbm database, little endian, 64-bit
10307!:mime	application/x-gdbm
103080	string	GDBM		GNU dbm 2.x database
10309!:mime	application/x-gdbm
10310#
10311# Berkeley DB
10312#
10313# Ian Darwin's file /etc/magic files: big/little-endian version.
10314#
10315# Hash 1.85/1.86 databases store metadata in network byte order.
10316# Btree 1.85/1.86 databases store the metadata in host byte order.
10317# Hash and Btree 2.X and later databases store the metadata in host byte order.
10318
103190	long	0x00061561	Berkeley DB
10320!:mime	application/x-dbm
10321>8	belong	4321
10322>>4	belong	>2		1.86
10323>>4	belong	<3		1.85
10324>>4	belong	>0		(Hash, version %d, native byte-order)
10325>8	belong	1234
10326>>4	belong	>2		1.86
10327>>4	belong	<3		1.85
10328>>4	belong	>0		(Hash, version %d, little-endian)
10329
103300	belong	0x00061561	Berkeley DB
10331>8	belong	4321
10332>>4	belong	>2		1.86
10333>>4	belong	<3		1.85
10334>>4	belong	>0		(Hash, version %d, big-endian)
10335>8	belong	1234
10336>>4	belong	>2		1.86
10337>>4	belong	<3		1.85
10338>>4	belong	>0		(Hash, version %d, native byte-order)
10339
103400	long	0x00053162	Berkeley DB 1.85/1.86
10341>4	long	>0		(Btree, version %d, native byte-order)
103420	belong	0x00053162	Berkeley DB 1.85/1.86
10343>4	belong	>0		(Btree, version %d, big-endian)
103440	lelong	0x00053162	Berkeley DB 1.85/1.86
10345>4	lelong	>0		(Btree, version %d, little-endian)
10346
1034712	long	0x00061561	Berkeley DB
10348>16	long	>0		(Hash, version %d, native byte-order)
1034912	belong	0x00061561	Berkeley DB
10350>16	belong	>0		(Hash, version %d, big-endian)
1035112	lelong	0x00061561	Berkeley DB
10352>16	lelong	>0		(Hash, version %d, little-endian)
10353
1035412	long	0x00053162	Berkeley DB
10355>16	long	>0		(Btree, version %d, native byte-order)
1035612	belong	0x00053162	Berkeley DB
10357>16	belong	>0		(Btree, version %d, big-endian)
1035812	lelong	0x00053162	Berkeley DB
10359>16	lelong	>0		(Btree, version %d, little-endian)
10360
1036112	long	0x00042253	Berkeley DB
10362>16	long	>0		(Queue, version %d, native byte-order)
1036312	belong	0x00042253	Berkeley DB
10364>16	belong	>0		(Queue, version %d, big-endian)
1036512	lelong	0x00042253	Berkeley DB
10366>16	lelong	>0		(Queue, version %d, little-endian)
10367
10368# From Max Bowsher.
1036912	long	0x00040988	Berkeley DB
10370>16	long	>0		(Log, version %d, native byte-order)
1037112	belong	0x00040988	Berkeley DB
10372>16	belong	>0		(Log, version %d, big-endian)
1037312	lelong	0x00040988	Berkeley DB
10374>16	lelong	>0		(Log, version %d, little-endian)
10375
10376#
10377#
10378# Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch>
103790	string/b	RRD\0		RRDTool DB
10380>4	string/b	x		version %s
10381
10382>>10	short		!0		16bit aligned
10383>>>10	bedouble	8.642135e+130	big-endian
10384>>>>18	short		x		32bit long (m68k)
10385
10386>>10	short		0
10387>>>12	long		!0		32bit aligned
10388>>>>12	bedouble	8.642135e+130	big-endian
10389>>>>>20 long		0		64bit long
10390>>>>>20 long		!0		32bit long
10391>>>>12	ledouble	8.642135e+130	little-endian
10392>>>>>24 long		0		64bit long
10393>>>>>24 long		!0		32bit long (i386)
10394>>>>12	string		\x43\x2b\x1f\x5b\x2f\x25\xc0\xc7	middle-endian
10395>>>>>24 short		!0		32bit long (arm)
10396
10397>>8	quad		0		64bit aligned
10398>>>16	bedouble	8.642135e+130	big-endian
10399>>>>24	long		0		64bit long (s390x)
10400>>>>24	long		!0		32bit long (hppa/mips/ppc/s390/SPARC)
10401>>>16	ledouble	8.642135e+130	little-endian
10402>>>>28	long		0		64bit long (alpha/amd64/ia64)
10403>>>>28	long		!0		32bit long (armel/mipsel)
10404
10405#----------------------------------------------------------------------
10406# ROOT: file(1) magic for ROOT databases
10407#
104080       string  root\0  ROOT file
10409>4      belong  x       Version %d
10410>33     belong  x       (Compression: %d)
10411
10412# XXX: Weak magic.
10413# Alex Ott <ott@jet.msk.su>
10414## Paradox file formats
10415#2	  leshort	0x0800	Paradox
10416#>0x39	  byte		3	v. 3.0
10417#>0x39	  byte		4	v. 3.5
10418#>0x39	  byte		9	v. 4.x
10419#>0x39	  byte		10	v. 5.x
10420#>0x39	  byte		11	v. 5.x
10421#>0x39	  byte		12	v. 7.x
10422#>>0x04	  byte		0	indexed .DB data file
10423#>>0x04	  byte		1	primary index .PX file
10424#>>0x04	  byte		2	non-indexed .DB data file
10425#>>0x04	  byte		3	non-incrementing secondary index .Xnn file
10426#>>0x04	  byte		4	secondary index .Ynn file
10427#>>0x04	  byte		5	incrementing secondary index .Xnn file
10428#>>0x04	  byte		6	non-incrementing secondary index .XGn file
10429#>>0x04	  byte		7	secondary index .YGn file
10430#>>>0x04	  byte		8	incrementing secondary index .XGn file
10431
10432## XBase database files
10433# updated by Joerg Jenderek at Feb 2013
10434# https://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm
10435# https://www.clicketyclick.dk/databases/xbase/format/dbf.html
10436# inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
104370	ubelong&0x0000FFFF		<0x00000C20
10438!:strength +10
10439# skip Infocom game Z-machine
10440>2		ubyte			>0
10441# skip Androids *.xml
10442>>3		ubyte			>0
10443>>>3		ubyte			<32
10444# 1 < version VV
10445>>>>0		ubyte			>1
10446# skip HELP.CA3 by test for reserved byte ( NULL )
10447>>>>>27		ubyte			0
10448# reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF)
10449#>>>>>30		ubeshort     		x		30NULL?%x
10450# possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
10451>>>>>>24	ubelong&0xffFFFFff	>0x01302000
10452# .DBF or .MDX
10453>>>>>>24	ubelong&0xffFFFFff	<0x01302001
10454# for Xbase Database file (*.DBF) reserved (NULL) for multi-user
10455>>>>>>>24	ubelong&0xffFFFFff	=0
10456# test for 2 reserved NULL bytes,transaction and encryption byte flag
10457>>>>>>>>12	ubelong&0xFFFFfEfE	0
10458# test for MDX flag
10459>>>>>>>>>28	ubyte			x
10460>>>>>>>>>28	ubyte&0xf8		0
10461# header size >= 32
10462>>>>>>>>>>8	uleshort		>31
10463# skip PIC15736.PCX by test for language driver name or field name
10464>>>>>>>>>>>32	ubyte			>0
10465#!:mime	application/x-dbf; charset=unknown-8bit ??
10466#!:mime	application/x-dbase
10467>>>>>>>>>>>>0	use			xbase-type
10468# database file
10469>>>>>>>>>>>>28	ubyte&0x04		=0		\b DBF
10470!:ext	dbf
10471>>>>>>>>>>>>28	ubyte&0x04		=4		\b DataBaseContainer
10472!:ext	dbc
10473>>>>>>>>>>>>4	lelong			0		\b, no records
10474>>>>>>>>>>>>4	lelong			>0		\b, %d record
10475# plural s appended
10476>>>>>>>>>>>>>4	lelong			>1		\bs
10477# https://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF
10478# 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000)
10479>>>>>>>>>>>>10	uleshort		x		* %d
10480# file size = records * record size + header size
10481>>>>>>>>>>>>1	ubyte			x		\b, update-date
10482>>>>>>>>>>>>1	use			xbase-date
10483# https://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx
10484#>>>>>>>>>>>>29	ubyte			=0		\b, codepage ID=%#x
10485# 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ?
10486>>>>>>>>>>>>29	ubyte			>0		\b, codepage ID=%#x
10487#>>>>>>>>>>>>28	ubyte&0x01		0		\b, no index file
10488# MDX or CDX index
10489>>>>>>>>>>>>28	ubyte&0x01		1		\b, with index file .MDX
10490>>>>>>>>>>>>28	ubyte&0x02		2		\b, with memo .FPT
10491#>>>>>>>>>>>>28	ubyte&0x04		4		\b, DataBaseContainer
10492# 1st record offset + 1 = header size
10493>>>>>>>>>>>>8	uleshort		>0
10494>>>>>>>>>>>>(8.s+1)	ubyte		>0
10495>>>>>>>>>>>>>8		uleshort	>0		\b, at offset %d
10496>>>>>>>>>>>>>(8.s+1)	ubyte		>0
10497>>>>>>>>>>>>>>&-1	string		>\0		1st record "%s"
10498# for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
10499>>>>>>>24	ubelong&0x0133f7ff	>0
10500# test for reserved NULL byte
10501>>>>>>>>47	ubyte			0
10502# test for valid TAG key format (0x10 or 0)
10503>>>>>>>>>559	ubyte&0xeF		0
10504# test MM <= 12
10505>>>>>>>>>>45	ubeshort		<0x0C20
10506>>>>>>>>>>>45	ubyte			>0
10507>>>>>>>>>>>>46	ubyte			<32
10508>>>>>>>>>>>>>46	ubyte			>0
10509#!:mime	application/x-mdx
10510>>>>>>>>>>>>>>0		use		xbase-type
10511>>>>>>>>>>>>>>0		ubyte		x		\b MDX
10512>>>>>>>>>>>>>>1		ubyte		x		\b, creation-date
10513>>>>>>>>>>>>>>1		use		xbase-date
10514>>>>>>>>>>>>>>44	ubyte		x		\b, update-date
10515>>>>>>>>>>>>>>44	use		xbase-date
10516# No.of tags in use (1,2,5,12)
10517>>>>>>>>>>>>>>28	uleshort	x		\b, %d
10518# No. of entries in tag (0x30)
10519>>>>>>>>>>>>>>25	ubyte		x		\b/%d tags
10520#  Length of tag
10521>>>>>>>>>>>>>>26	ubyte		x		* %d
10522# 1st tag name_
10523>>>>>>>>>>>>>548	string		x		\b, 1st tag "%.11s"
10524# 2nd tag name
10525#>>>>>>>>>>>>(26.b+548)	string		x		\b, 2nd tag "%.11s"
10526#
10527#		Print the xBase names of different version variants
105280	name				xbase-type
10529>0	ubyte		<2
10530# 1 < version
10531>0	ubyte		>1
10532>>0	ubyte		0x02		FoxBase
10533!:mime	application/x-dbf
10534# like: ACCESS.DBF USER.DBF dbase3date.dbf mitarbei.dbf produkte.dbf umlaut-test-v2.dbf
10535# FoxBase+/dBaseIII+, no memo
10536>>0	ubyte		0x03		FoxBase+/dBase III
10537!:mime	application/x-dbf
10538# like: 92DATA.DBF MSCATLOG.DBF SYLLABI2.DBF SYLLABUS.DBF T4.DBF Teleadr.dbf us_city.dbf
10539# dBASE IV no memo file
10540>>0	ubyte		0x04		dBase IV
10541!:mime	application/x-dbf
10542# like: Quattro-test11.dbf umlaut-test-v4.dbf
10543# dBASE V no memo file
10544>>0	ubyte		0x05		dBase V
10545!:mime	application/x-dbf
10546# like: dbase4double.dbf Quattro-test2.dbf umlaut-test7.dbf
10547!:ext	dbf
10548# probably Apollo Database Server 9.7? xBase (0x6)
10549>>0	ubyte		0x06		Apollo
10550!:mime	application/x-dbf
10551# like: ALIAS.DBF CRYPT.DBF PROCS.DBF USERS.DBF
10552# https://docs.microsoft.com/en-us/previous-versions/visualstudio/foxpro/st4a0s68(v=vs.80)
10553>>0	ubyte		0x2F		FoxBase+/Dbase III plus, no memo
10554!:mime	application/x-dbf
10555# no example
10556>>0	ubyte		0x30		Visual FoxPro
10557!:mime	application/x-dbf
10558# like: 26FRX.DBF 30DBC.DBF 30DBCPRO.DBF BEHINDSC.DBF USER_LEV.DBF
10559# Microsoft Visual FoxPro Database Container File like: FOXPRO-DB-TEST.DBC TESTDATA.DBC TASTRADE.DBC
10560>>0	ubyte		0x31		Visual FoxPro, autoincrement
10561!:mime	application/x-dbf
10562# like: AI_Table.DBF dbase_31.dbf w_cityFoxpro.dbf
10563# Visual FoxPro, with field type Varchar or Varbinary
10564>>0	ubyte		0x32		Visual FoxPro, with field type Varchar
10565!:mime	application/x-dbf
10566# like: dbase_32.dbf
10567# dBASE IV SQL, no memo;dbv memo var size (Flagship)
10568>>0	ubyte		0x43		dBase IV, with SQL table
10569!:mime	application/x-dbf
10570# like: ASSEMBLY.DBF INVENTRY.DBF STAFF.DBF
10571# https://docs.microsoft.com/en-us/previous-versions/visualstudio/foxpro/st4a0s68(v=vs.80)
10572>>0	ubyte		0x62		dBase IV, with SQL table
10573#!:mime	application/x-dbf
10574# no example
10575# dBASE IV, with memo!!
10576>>0	ubyte		0x7b		dBase IV, with memo
10577!:mime	application/x-dbf
10578# like: test3memo.DBF dbase5.DBF
10579# https://docs.microsoft.com/en-us/previous-versions/visualstudio/foxpro/st4a0s68(v=vs.80)
10580>>0	ubyte		0x82		dBase IV, with SQL system
10581#!:mime	application/x-dbf
10582# no example
10583# FoxBase+/dBaseIII+ with memo .DBT!
10584>>0	ubyte		0x83		FoxBase+/dBase III, with memo .DBT
10585!:mime	application/x-dbf
10586# like: T2.DBF t3.DBF biblio.dbf dbase_83.dbf dbase3dbt0_4.dbf fsadress.dbf stop.dbf
10587# VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file
10588>>0	ubyte		0x87		VISUAL OBJECTS, with memo file
10589!:mime	application/x-dbf
10590# like: ACCESS.DBF dbase3date.dbf dbase3float.dbf holdings.dbf mitarbei.dbf
10591# https://docs.microsoft.com/en-us/previous-versions/visualstudio/foxpro/st4a0s68(v=vs.80)
10592>>0	ubyte		0x8A		FoxBase+/dBase III, with memo .DBT
10593#!:mime	application/x-dbf
10594# no example
10595# dBASE IV with memo!
10596>>0	ubyte		0x8B		dBase IV, with memo .DBT
10597!:mime	application/x-dbf
10598# like: animals.dbf archive.dbf callin.dbf dbase_8b.dbf phnebook.dbf t6.dbf
10599# dBase IV with SQL Table,no memo?
10600>>0	ubyte		0x8E		dBase IV, with SQL table
10601!:mime	application/x-dbf
10602# like: dbase5.DBF test3memo.DBF test-memo.DBF
10603# .dbv and .dbt memo (Flagship)?
10604>>0	ubyte		0xB3		Flagship
10605!:mime	application/x-dbf
10606# no example
10607# https://docs.microsoft.com/en-us/previous-versions/visualstudio/foxpro/st4a0s68(v=vs.80)
10608>>0	ubyte		0xCA		dBase IV with memo .DBT
10609#!:mime	application/x-dbf
10610# no example
10611# dBASE IV with SQL table, with memo .DBT
10612>>0	ubyte		0xCB		dBase IV with SQL table, with memo .DBT
10613!:mime	application/x-dbf
10614# like: dbase5.DBF test3memo.DBF test-memo.DBF
10615# HiPer-Six format;Clipper SIX, with SMT memo file
10616>>0	ubyte		0xE5		Clipper SIX with memo
10617!:mime	application/x-dbf
10618# like: dbase5.DBF test3memo.DBF test-memo.DBF testClipper.dbf DATA.DBF
10619# https://docs.microsoft.com/en-us/previous-versions/visualstudio/foxpro/st4a0s68(v=vs.80)
10620>>0	ubyte		0xF4		dBase IV, with SQL table, with memo
10621#!:mime	application/x-dbf
10622# no example
10623>>0	ubyte		0xF5		FoxPro with memo
10624!:mime	application/x-dbf
10625# like: CUSTOMER.DBF FOXUSER1.DBF Invoice.DBF NG.DBF OBJSAMP.DBF dbase_f5.dbf kunde.dbf
10626# probably Apollo Database Server 9.7 with SQL and memo mask? xBase (0xF6)
10627>>0	ubyte		0xF6		Apollo, with SQL table with memo
10628!:mime	application/x-dbf
10629# like: SCRIPTS.DBF
10630# https://docs.microsoft.com/en-us/previous-versions/visualstudio/foxpro/st4a0s68(v=vs.80)
10631#>>0	ubyte		0xFA		FoxPro 2.x, with memo
10632#!:mime	application/x-dbf
10633# no example
10634# unknown version (should not happen)
10635>>0	default		x		xBase
10636!:mime	application/x-dbf
10637>>>0	ubyte		x		(%#x)
10638# flags in version byte
10639# DBT flag (with dBASE III memo .DBT)!!
10640# >>0	ubyte&0x80	>0		DBT_FLAG=%x
10641# memo flag ??
10642# >>0	ubyte&0x08	>0		MEMO_FLAG=%x
10643# SQL flag ??
10644# >>0	ubyte&0x70	>0		SQL_FLAG=%x
10645#		test and print the date of xBase .DBF .MDX
106460	name				xbase-date
10647# inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
10648>0	ubelong		x
10649>1	ubyte		<13
10650>>1	ubyte		>0
10651>>>2	ubyte		>0
10652>>>>2	ubyte		<32
10653>>>>>0	ubyte		x
10654# YY is interpreted as 20YY or 19YY
10655>>>>>>0	ubyte		<100		\b %.2d
10656# YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY
10657>>>>>>0	ubyte		>99		\b %d
10658>>>>>1	ubyte		x		\b-%d
10659>>>>>2	ubyte		x		\b-%d
10660
10661#	dBase memo files .DBT or .FPT
10662# https://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx
1066316		ubyte		<4
10664>16		ubyte		!2
10665>>16		ubyte		!1
10666# next free block index is positive
10667>>>0		ulelong		>0
10668# skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size
10669>>>>17		ubelong&0xFFfdFEff	0x00000000
10670# skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h
10671>>>>>20		ubelong&0xFF01209B	0x00000000
10672# dBASE III
10673>>>>>>16	ubyte		3
10674# dBASE III DBT
10675>>>>>>>0	use		dbase3-memo-print
10676# dBASE III DBT without version, dBASE IV DBT , FoxPro FPT , or many ZIP , DBF garbage
10677>>>>>>16	ubyte		0
10678# unusual dBASE III DBT like angest.dbt, dBASE IV DBT with block size 0 , FoxPro FPT ,  or garbage PCX DBF
10679>>>>>>>20	uleshort	0
10680# FoxPro FPT , unusual dBASE III DBT like biblio.dbt or garbage
10681>>>>>>>>8	ulong		=0
10682>>>>>>>>>6	ubeshort	>0
10683# skip emacs.PIF
10684>>>>>>>>>>4	ushort		0
10685# check for valid FoxPro field type
10686>>>>>>>>>>>512	ubelong		<3
10687# skip LXMDCLN4.OUT LXMDCLN6.OUT LXMDALG6.OUT with invalid blocksize 170=AAh
10688>>>>>>>>>>>>6	ubeshort&0x002f	0
10689>>>>>>>>>>>>>0	use		foxpro-memo-print
10690# dBASE III DBT , garbage
10691# skip WORD1XW.DOC with improbably high free block index
10692>>>>>>>>>0	ulelong		<0x400000
10693# skip WinStore.App.exe by looking for printable 2nd character of 1st memo item
10694>>>>>>>>>>513	ubyte		>037
10695# skip DOS executables CPQ0TD.DRV E30ODI.COM IBM0MONO.DRV by looking for printable 1st character of 1st memo item
10696>>>>>>>>>>>512	ubyte		>037
10697# unusual dBASE III DBT like adressen.dbt
10698>>>>>>>>>>>>0	use		dbase3-memo-print
10699# dBASE III DBT like angest.dbt, or garbage PCX DBF
10700>>>>>>>>8	ubelong		!0
10701# skip PCX and some DBF by test for for reserved NULL bytes
10702>>>>>>>>>510	ubeshort	0
10703# skip bad symples with improbably high free block index above 2 GiB file limit
10704>>>>>>>>>>0	ulelong		<0x400000
10705# skip AI070GEP.EPS by printable 1st character of 1st memo item
10706>>>>>>>>>>>512	ubyte		>037
10707# skip some Microsoft Visual C, OMF library like: BZ2.LIB WATTCPWL.LIB ZLIB.LIB
10708>>>>>>>>>>>>512	ubyte		<0200
10709# skip gluon-ffhat-1.0-tp-link-tl-wr1043n-nd-v2-sysupgrade.bin by printable 2nd character
10710>>>>>>>>>>>>>513 ubyte		>037
10711>>>>>>>>>>>>>>0	use		dbase3-memo-print
10712# dBASE IV DBT with positive block size
10713>>>>>>>20	uleshort	>0
10714# dBASE IV DBT with valid block length like 512, 1024
10715# multiple of 2 in between 16 and 16 K ,implies upper and lower bits are zero
10716# skip also 3600h 3E00h size
10717>>>>>>>>20	uleshort&0xE00f	0
10718>>>>>>>>>0	use		dbase4-memo-print
10719
10720#		Print the information of dBase III DBT memo file
107210	name				dbase3-memo-print
10722>0	ubyte			x		dBase III DBT
10723!:mime	application/x-dbt
10724!:ext	dbt
10725# instead 3 as version number 0 for unusual examples like biblio.dbt
10726>16	ubyte			!3		\b, version number %u
10727# Number of next available block for appending data
10728#>0	lelong			=0		\b, next free block index %u
10729>0	lelong			!0		\b, next free block index %u
10730# no positive block length
10731#>20	uleshort		=0		\b, block length %u
10732>20	uleshort		!0		\b, block length %u
10733# dBase III memo field terminated by \032\032
10734# like: "WHAT IS XBASE" test.dbt "Borges, Malte" biblio.dbt "First memo\032\032" T2.DBT
10735>512	string			>\0		\b, 1st item "%s"
10736# For DEBUGGING
10737#>512	ubelong			x		\b, 1ST item %#8.8x
10738# https://www.clicketyclick.dk/databases/xbase/format/dbt.html
10739#		Print the information of dBase IV DBT memo file
107400	name				dbase4-memo-print
10741>0		lelong		x		dBase IV DBT
10742!:mime	application/x-dbt
10743!:ext dbt
10744# 8 character shorted main name of corresponding dBASE IV DBF file
10745>8		ubelong		>0x20000000
10746# skip unusual like for angest.dbt
10747>>20		uleshort	>0
10748>>>8		string		>\0		\b of %-.8s.DBF
10749# value 0 implies 512 as size
10750#>4		ulelong		=0		\b, blocks size %u
10751# size of blocks not reliable like 0x2020204C in angest.dbt
10752>4		ulelong		!0
10753>>4		ulelong&0x0000003f	0	\b, blocks size %u
10754# dBase IV DBT with positive block length (found 512 , 1024)
10755>20		uleshort	>0		\b, block length %u
10756# next available block
10757#>0		lelong		=0		\b, next free block index %u
10758>0		lelong		!0		\b, next free block index %u
10759>20		uleshort	>0
10760>>(20.s)	ubelong		x
10761>>>&-4		use		dbase4-memofield-print
10762# unusual dBase IV DBT without block length (implies 512 as length)
10763>20		uleshort	=0
10764>>512		ubelong		x
10765>>>&-4		use				dbase4-memofield-print
10766#		Print the information of dBase IV memo field
107670	name			dbase4-memofield-print
10768# free dBase IV memo field
10769>0		ubelong		!0xFFFF0800
10770>>0		lelong		x		\b, next free block %u
10771>>4		lelong		x		\b, next used block %u
10772# used dBase IV memo field
10773>0		ubelong		=0xFFFF0800
10774# length of memo field
10775>>4		lelong		x		\b, field length %d
10776>>>8		string		>\0		\b, 1st used item "%s"
10777# http://www.dbfree.org/webdocs/1-documentation/0018-developers_stuff_(advanced)/os_related_stuff/xbase_file_format.htm
10778#		Print the information of FoxPro FPT memo file
107790	name				foxpro-memo-print
10780>0		belong		x		FoxPro FPT
10781!:mime	application/x-fpt
10782!:ext	fpt
10783# Size of blocks for FoxPro ( 64,256 ); probably a multiple of two
10784>6		ubeshort	x		\b, blocks size %u
10785# next available block
10786#>0		belong		=0		\b, next free block index %u
10787>0		belong		!0		\b, next free block index %u
10788# field type ( 0~picture, 1~memo, 2~object )
10789>512		ubelong		<3		\b, field type %u
10790# length of memo field
10791>512		ubelong		1
10792>>516		belong		>0		\b, field length %d
10793>>>520		string		>\0		\b, 1st item "%s"
10794
10795# Summary:	DBASE Compound Index file *.CDX and FoxPro index *.IDX
10796# From:		Joerg Jenderek
10797# URL:		https://www.clicketyclick.dk/databases/xbase/format/cdx.html
10798#		https://www.clicketyclick.dk/databases/xbase/format/idx.html
10799#		https://www.clicketyclick.dk/databases/xbase/format/idx_comp.html
10800# Reference:	https://mark0.net/download/triddefs_xml.7z/defs/s/sybase-ianywhere-cdx.trid.xml
10801#		https://mark0.net/download/triddefs_xml.7z/defs/c/cdx-vfp7.trid.xml
10802# like: kunde.cdx
108030	ulelong		0x1C00
10804>0	use			xbase-index
10805# like: SYLLABI2.CDX SYLLABUS.CDX
108060	ulelong		0x0800
10807>0	use			xbase-index
10808# often in xBase index pointer to root node 400h
108090	ulelong		0x0400
10810# skip most Maple help database *.hdb with version tag handled by ./maple
10811>1028	string		!version
10812# skip Maple help database hsum.hdb checking for valid reserved area
10813>>492	quad		=0
10814# skip remaining Maple help database *.hdb by checking key length
10815#>>>12	uleshort	!0x000F			KEY_LENGTHVALID
10816>>>0	use			xbase-index
10817#	display information about dBase/FoxPro index
108180	name			xbase-index
10819>0	ulelong		x			xBase
10820!:mime	application/x-dbase-index
10821>14	ubyte		&0x40			compound index
10822# DCX for FoxPro database index like: TESTDATA.DCX
10823!:ext	cdx/dcx
10824>14	ubyte		^0x40			index
10825# only 1 example like: TEST.IDX
10826!:ext	idx
10827# pointer to root node like: 1C00h 800h often 400h
10828>0	ulelong		!0x400			\b, root pointer %#x
10829# Pointer to free node list: often 0 but -1 if not present
10830>4	ulelong		!0			\b, free node pointer %#x
10831# MAYBE number of pages in file (Foxbase, FoxPro 1.x) or
10832# http://www.foxpert.com/foxpro/knowlbits/files/knowlbits_200708_1.HTM
10833# Whenever Visual FoxPro updates the index file it increments this reserved field
10834# Reserved for internal use like: 02000000h 03000000h 460c0000h 780f0000h 89000000h 9fdc0100h often 0
10835>8	ulelong		!0			\b, reserved counter %#x
10836# length of key like: mostly 000Ah 0028h (TEST.IDX)
10837>12	uleshort	!0x000A			\b, key length %#x
10838# index options like: 24h E0h E8h
10839# 1~a unique index 8~index has FOR clause 32~compact index format 64~compound index header
10840# 16~Bit vector (SoftC) 128~Structure index (FoxPro)
10841>14	ubyte		x			\b, index options (%#x
10842>14	ubyte		&0x01			\b, unique
10843>14	ubyte		&0x08			\b, has FOR clause
10844>14	ubyte		&0x10			\b, bit vector (SoftC)
10845>14	ubyte		&0x20			\b, compact format
10846#>14	ubyte		&0x40			\b, compound header
10847>14	ubyte		&0x80			\b, structure
10848>14	ubyte		x			\b)
10849# WHAT EXACTLY IS THAT? index signature like: 0 (sybase-ianywhere-cdx.trid.xml) 1 (cdx-vfp7.trid.xml)
10850>15	ubyte		!0			\b, index signature %u
10851# reserved area (0-bytes) til about 500, but not for uncompressed Index files *.idx
10852>16	quad		!0			\b, at 16 reserved %#llx
10853>492	quad		!0			\b, at 492 reserved %#llx
10854# for IDX variant
10855#>14	ubyte		^0x40			IDX
10856# for CDX variant
10857>14	ubyte		&0x40
10858# Ascending or descending: 0~ascending 1~descending
10859>>502	uleshort	x			\b, sort order %u
10860# Total expression length (FoxPro 2) like: 0 1
10861>>504	uleshort	!0			\b, expression length %u
10862# FOR expression pool length like: 1
10863>>506	uleshort	!1			\b, FOR expression pool length %#x
10864# reserved for internal use like: 0
10865>>508	uleshort	!0			\b, at 0x508 reserved %#x
10866# Key expression pool length like: 1
10867>>510	uleshort	!1			\b, key expression pool length %#x
10868# 512 - 1023 Key & FOR expression pool (uncompiled)
10869>>512	quad		!0			\b, key expression pool %#llx
10870#>>520	quad		!0			\b, key expression pool %#llx
10871
10872# Summary:	dBASE IV Printer Form *.PRF
10873# From:		Joerg Jenderek
10874# URL:		https://en.wikipedia.org/wiki/.dbf#Other_file_types_found_in_dBASE
10875# Reference:	https://mark0.net/download/triddefs_xml.7z/defs/p/prf-dbase.trid.xml
108760	ubeshort	0x0400
10877# skip some Xbase Index files *.ndx and Infocom (Z-machine 4) *.z4 handled by ./adventure
10878# by looking for valid printer driver name extension
10879>0x58	search/8	.PR2
10880>>0	use			xbase-prf
10881#	display information of dbase print form like printer driver *.PR2
108820	name			xbase-prf	dBase Printer Form
10883!:mime	application/x-dbase-prf
10884!:ext	prf
10885# MAYBE version? like: 4~DBASE IV
10886#>0	ubyte		x			\b, version %u
10887# MAYBE flag like: 1~with output file name 0~not
10888#>2	ubyte		!0			\b, flag %u
10889# optional printer text output file name like E:\DBASE\IV\T6.txt
10890>3	string		>\0			\b, output file %s
10891# probably padding with nils til 0x53
10892#>0x48	 uquad		!0			\b, at 0x48 padding %#llx
10893# dBASE IV printer driver name like: Generic.PR2 ASCII.PR2
10894>0x56	string		>\0			\b, using printer driver %s
10895# 2 is probably last character of previous dBASE printer driver name
10896#>0x60	ubyte		!0x32			\b, at 0x60 %#x
10897# probably padding with nils til 0xa8
10898#>0x61	uquad		!0			\b, at 0x61 padding %#llx
10899# unknown 0x03020300 0x03020100 at 0xa8
10900>0xa8	ubelong 	x			\b, at 0xa8 unknown %#8.8x
10901# probably padding with nils til 0x2aa
10902#>0x2a0	uquad		!0			\b, at 0x2a0 padding %#llx
10903# unknown 0x100ff7f01000001 at 0x2AB
10904>0x2ab	ubequad		!0x100ff7f01000001	\b, at 0x2ab unknown %#llx
10905# unknown 0x0042 at 0x2b3
10906>0x2b3	ubeshort 	!0x0042			\b, at 0x2b3 unknown %#4.4x
10907# unknown last 4 bytes at 0x2b6 like: 0 0x23
10908>0x2b6	ubelong		!0			\b, at 0x2b6 unknown %#8.8x
10909
10910# TODO:
10911# DBASE index file *.NDX
10912# dBASE compiled Format *.FMO
10913# FoxPro Database memo file *.DCT
10914# FoxPro Forms Memo *.SCT
10915# FoxPro Generated Menu Program *.MPR
10916# FoxPro Report *.FRX
10917# FoxPro Report Memo *.FRT
10918# Foxpro Generated Screen Program *.SPR
10919# Foxpro memo *.PJT
10920## End of XBase database stuff
10921
10922# MS Access database
109234	string	Standard\ Jet\ DB	Microsoft Access Database
10924!:mime	application/x-msaccess
109254	string	Standard\ ACE\ DB	Microsoft Access Database
10926!:mime	application/x-msaccess
10927
10928# From: Joerg Jenderek
10929# URL: http://fileformats.archiveteam.org/wiki/Extensible_Storage_Engine
10930# Reference: https://github.com/libyal/libesedb/archive/master.zip
10931#	libesedb-master/documentation/
10932#	Extensible Storage Engine (ESE) Database File (EDB) format.asciidoc
10933# Note: also known as "JET Blue". Used by numerous Windows components such as
10934# Windows Search, Mail, Exchange and Active Directory.
109354	ubelong		0xefcdab89
10936# unknown1
10937>132	ubelong		0		Extensible storage engine
10938!:mime	application/x-ms-ese
10939# file_type 0~database 1~stream
10940>>12	ulelong		0		DataBase
10941# Security DataBase (sdb)
10942!:ext	edb/sdb
10943>>12	ulelong		1		STreaMing
10944!:ext	stm
10945# format_version 620h
10946>>8	uleshort	x		\b, version %#x
10947>>10	uleshort	>0		revision %#4.4x
10948>>0	ubelong		x	 	\b, checksum %#8.8x
10949# Page size 4096 8192 32768
10950>>236	ulequad		x		\b, page size %lld
10951# database_state
10952>>52	ulelong		1		\b, JustCreated
10953>>52	ulelong		2		\b, DirtyShutdown
10954#>>52	ulelong		3		\b, CleanShutdown
10955>>52	ulelong		4		\b, BeingConverted
10956>>52	ulelong		5		\b, ForceDetach
10957# Windows NT major version when the databases indexes were updated.
10958>>216	ulelong		x		\b, Windows version %d
10959# Windows NT minor version
10960>>220	ulelong		x		\b.%d
10961
10962# From: Joerg Jenderek
10963# URL: https://forensicswiki.org/wiki/Windows_Application_Compatibility
10964# Note: files contain application compatibility fixes, application compatibility modes and application help messages.
109658	string		sdbf
10966>7	ubyte		0
10967# TAG_TYPE_LIST+TAG_INDEXES
10968>>12	uleshort	0x7802		Windows application compatibility Shim DataBase
10969# version? 2 3
10970#>>>0	ulelong		x		\b, version %d
10971!:mime	application/x-ms-sdb
10972!:ext	sdb
10973
10974# TDB database from Samba et al - Martin Pool <mbp@samba.org>
109750	string	TDB\ file		TDB database
10976>32	lelong	0x2601196D		version 6, little-endian
10977>>36	lelong	x			hash size %d bytes
10978
10979# SE Linux policy database
109800       lelong  0xf97cff8c      SE Linux policy
10981>16     lelong  x               v%d
10982>20     lelong  1      MLS
10983>24     lelong  x       %d symbols
10984>28     lelong  x       %d ocons
10985
10986# ICE authority file data (Wolfram Kleff)
109872	string		ICE		ICE authority data
10988
10989# X11 Xauthority file (Wolfram Kleff)
1099010	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
1099111	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
1099212	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
1099313	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
1099414	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
1099515	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
1099616	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
1099717	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
1099818	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
10999
11000# From: Maxime Henrion <mux@FreeBSD.org>
11001# PostgreSQL's custom dump format, Maxime Henrion <mux@FreeBSD.org>
110020	string		PGDMP		PostgreSQL custom database dump
11003>5	byte		x		- v%d
11004>6	byte		x		\b.%d
11005>5	beshort		<0x101		\b-0
11006>5	beshort		>0x100
11007>>7	byte		x		\b-%d
11008
11009# Type: Advanced Data Format (ADF) database
11010# URL:  https://www.grc.nasa.gov/WWW/cgns/adf/
11011# From: Nicolas Chauvat <nicolas.chauvat@logilab.fr>
110120	string	@(#)ADF\ Database	CGNS Advanced Data Format
11013
11014# Tokyo Cabinet magic data
11015# http://tokyocabinet.sourceforge.net/index.html
110160	string		ToKyO\ CaBiNeT\n	Tokyo Cabinet
11017>14	string		x			\b (%s)
11018>32	byte		0			\b, Hash
11019!:mime	application/x-tokyocabinet-hash
11020>32	byte		1			\b, B+ tree
11021!:mime	application/x-tokyocabinet-btree
11022>32	byte		2			\b, Fixed-length
11023!:mime	application/x-tokyocabinet-fixed
11024>32	byte		3			\b, Table
11025!:mime	application/x-tokyocabinet-table
11026>33	byte		&1			\b, [open]
11027>33	byte		&2			\b, [fatal]
11028>34	byte		x			\b, apow=%d
11029>35	byte		x			\b, fpow=%d
11030>36	byte		&0x01			\b, [large]
11031>36	byte		&0x02			\b, [deflate]
11032>36	byte		&0x04			\b, [bzip]
11033>36	byte		&0x08			\b, [tcbs]
11034>36	byte		&0x10			\b, [excodec]
11035>40	lequad		x			\b, bnum=%lld
11036>48	lequad		x			\b, rnum=%lld
11037>56	lequad		x			\b, fsiz=%lld
11038
11039# Type:	QDBM Quick Database Manager
11040# From:	Benoit Sibaud <bsibaud@april.org>
110410	string		\\[depot\\]\n\f		Quick Database Manager, little endian
110420	string		\\[DEPOT\\]\n\f		Quick Database Manager, big endian
11043
11044# Type:	TokyoCabinet database
11045# URL:	http://tokyocabinet.sourceforge.net/
11046# From:	Benoit Sibaud <bsibaud@april.org>
110470	string		ToKyO\ CaBiNeT\n	TokyoCabinet database
11048>14	string		x			(version %s)
11049
11050# From:  Stephane Blondon https://www.yaal.fr
11051# Database file for Zope (done by FileStorage)
110520	string	FS21	Zope Object Database File Storage v3 (data)
110530	string	FS30	Zope Object Database File Storage v4 (data)
11054
11055# Cache file for the database of Zope (done by ClientStorage)
110560	string		ZEC3	Zope Object Database Client Cache File (data)
11057
11058# IDA (Interactive Disassembler) database
110590	string		IDA1	IDA (Interactive Disassembler) database
11060
11061# Hopper (reverse engineering tool) https://www.hopperapp.com/
110620	string		hopperdb	Hopper database
11063
11064# URL: https://en.wikipedia.org/wiki/Panorama_(database_engine)
11065# Reference: http://www.provue.com/Panorama/
11066# From: Joerg Jenderek
11067# NOTE: test only versions 4 and 6.0 with Windows
11068# length of Panorama database name
110695	ubyte				>0
11070# look after database name for "some" null bits
11071>(5.B+7)	ubelong&0xF3ffF000	0
11072# look for first keyword
11073>>&1		search/2		DESIGN		Panorama database
11074#!:mime	application/x-panorama-database
11075!:apple	KASXZEPD
11076!:ext	pan
11077# database name
11078>>>5	pstring				x		\b, "%s"
11079
11080#
11081#
11082# askSam Database by Stefan A. Haubenthal <polluks@web.de>
110830	string	askw40\0	askSam DB
11084
11085#
11086#
11087# MUIbase Database Tool by Stefan A. Haubenthal <polluks@web.de>
110880	string	MBSTV\040	MUIbase DB
11089>6	string	x		version %s
11090
11091#
11092# CDB database
110930	string	NBCDB\012	NetBSD Constant Database
11094>7	byte	x		\b, version %d
11095>8	string	x		\b, for '%s'
11096>24	lelong	x		\b, datasize %d
11097>28	lelong	x		\b, entries %d
11098>32	lelong	x		\b, index %d
11099>36	lelong	x		\b, seed %#x
11100
11101#
11102# Redis RDB - https://redis.io/topics/persistence
111030	string	REDIS			Redis RDB file,
11104>5	regex	[0-9][0-9][0-9][0-9]	version %s
11105
11106# Mork database.
11107# Used by older versions of Mozilla Suite and Firefox,
11108# and current versions of Thunderbird.
11109# From: David Korth <gerbilsoft@gerbilsoft.com>
111100	string	//\ <!--\ <mdb:mork:z\ v="	Mozilla Mork database
11111>23	string	x		\b, version %.3s
11112
11113# URL:		https://en.wikipedia.org/wiki/Management_Information_Format
11114# Reference:	https://www.dmtf.org/sites/default/files/standards/documents/DSP0005.pdf
11115# From:		Joerg Jenderek
11116# Note:		only tested with monitor asset reports of Dell Display Manager
11117#		skip start like Language=fr|CA|iso8859-1
111180	search/27/C	Start\040Component	DMI Management Information Format
11119#!:mime	text/plain
11120!:mime	text/x-dmtf-mif
11121!:ext	mif
11122
11123
11124#------------------------------------------------------------------------------
11125# $File: dataone,v 1.3 2022/04/18 21:38:10 christos Exp $
11126#
11127# DataONE- files from Dave Vieglais <dave.vieglais@gmail.com> &
11128#                     Pratik Shrivastava <pratikshrivastava23@gmail.com>
11129#
11130# file formats:   https://cn.dataone.org/cn/v2/formats
11131#------------------------------------------------------------------------------
11132
11133# EML (Ecological Metadata Language Format)
111340	string	\<?xml\ version=
11135>&0	regex/1024	eml-[0-9]\\.[0-9]\\.[0-9]+	eml://ecoinformatics.org/%s
11136
11137# onedcx (DataONE Dublin Core Extended v1.0)
11138>&0	regex/1024	onedcx/v[0-9]\\.[0-9]+		https://ns.dataone.org/metadata/schema/onedcx/v1.0
11139
11140# FGDC-STD-001-1998 (Content Standard for Digital Geospatial Metadata,
11141# version 001-1998)
11142>&0	search/1024	fgdc				FGDC-STD-001-1998
11143
11144# Mercury (Oak Ridge National Lab Mercury Metadata version 1.0)
11145>&0	regex/1024	mercury/terms/v[0-9]\\.[0-9]	https://purl.org/ornl/schema/mercury/terms/v1.0
11146
11147# ISOTC211 (Geographic MetaData (GMD) Extensible Markup Language)
11148>&0	search/1024	isotc211
11149>>&0	search/1024	eng;USA				https://www.isotc211.org/2005/gmd
11150
11151# ISOTC211 (NOAA Variant Geographic MetaData (GMD) Extensible Markup Language)
11152>>&0	regex/1024	gov\\.noaa\\.nodc:[0-9]+		https://www.isotc211.org/2005/gmd-noaa
11153
11154# ISOTC211 PANGAEA Variant Geographic MetaData (GMD) Extensible Markup Language
11155>>&0	regex/1024	pangaea\\.dataset[0-9][0-9][0-9][0-9][0-9][0-9]+	https://www.isotc211.org/2005/gmd-pangaea
11156!:mime	text/xml
11157
11158
11159# Object Reuse and Exchange Vocabulary
111600	string	\<?xml\ version=
11161>&0	search/1024	rdf
11162>>&0	search/1024	openarchives	https://www.openarchives.org/ore/terms
11163!:mime application/rdf+xml
11164
11165
11166# Dryad Metadata Application Profile Version 3.1
111670	string	<DryadData
11168>&0	regex/1024	dryad-bibo/v[0-9]\\.[0-9]	https://datadryad.org/profile/v3.1
11169!:mime	text/xml
11170
11171#------------------------------------------------------------------------------
11172# $File: dbpf,v 1.3 2019/04/19 00:42:27 christos Exp $
11173# dppf:	Maxis Database Packed Files, the stored data file format used by all
11174#	Maxis games after the Sims: http://wiki.niotso.org/DBPF
11175# 	https://www.wiki.sc4devotion.com/index.php?title=DBPF
11176#	13 Oct 2017, Kip Warner <kip at thevertigo dot com>
111770	string	DBPF	Maxis Database Packed File
11178>4	ulelong	x	\b, version: %u.
11179>>8	ulelong	x	\b%u
11180>>>36	ulelong	x       \b, files: %u
11181>>24	ledate	!0	\b, created: %s
11182>>28	ledate	!0	\b, modified: %s
11183!:ext	dbpf/package/dat/sc4
11184!:mime	application/x-maxis-dbpf
11185#------------------------------------------------------------------------------
11186# $File: der,v 1.5 2022/07/30 18:07:34 christos Exp $
11187# der: file(1) magic for DER encoded files
11188#
11189
11190# Certificate information piece
111910	name	certinfo
11192>0	der	seq
11193>>&0	der	set
11194>>>&0	der	seq
11195>>>>&0	der	obj_id3=550406
11196>>>>&0	der	prt_str=x	\b, countryName=%s
11197>>&0	der	set
11198>>>&0	der	seq
11199>>>>&0	der	obj_id3=550408
11200>>>>&0	der	utf8_str=x	\b, stateOrProvinceName=%s
11201>>&0	der	set
11202>>>&0	der	seq
11203>>>>&0	der	obj_id3=55040a
11204>>>>&0	der	utf8_str=x	\b, organizationName=%s
11205>>&0	der	set
11206>>>&0	der	seq
11207>>>>&0	der	obj_id3=550403
11208>>>>&0	der	utf8_str=x	\b, commonName=%s
11209>>&0	der	seq
11210
11211# Certificate requests
112120	der	seq
11213>&0	der	seq
11214>>&0	der	int1=00		DER Encoded Certificate request
11215>>&0	use	certinfo
11216
11217# Key Pairs
112180	der	seq
11219>&0	der	int1=00
11220>&0	der	int65=x
11221>&0	der	int3=010001	DER Encoded Key Pair, 512 bits
11222
112230	der	seq
11224>&0	der	int1=00
11225>&0	der	int129=x
11226>&0	der	int3=010001	DER Encoded Key Pair, 1024 bits
11227
112280	der	seq
11229>&0	der	int1=00
11230>&0	der	int257=x
11231>&0	der	int3=010001	DER Encoded Key Pair, 2048 bits
11232
112330	der	seq
11234>&0	der	int1=00
11235>&0	der	int513=x
11236>&0	der	int3=010001	DER Encoded Key Pair, 4096 bits
11237
112380	der	seq
11239>&0	der	int1=00
11240>&0	der	int1025=x
11241>&0	der	int3=010001	DER Encoded Key Pair, 8192 bits
11242
112430	der	seq
11244>&0	der	int1=00
11245>&0	der	int2049=x
11246>&0	der	int3=010001	DER Encoded Key Pair, 16k bits
11247
112480	der	seq
11249>&0	der	int1=00
11250>&0	der	int4097=x
11251>&0	der	int3=010001	DER Encoded Key Pair, 32k bits
11252
11253# Certificates
112540	der	seq
11255>&0	der	seq
11256>>&0	der	int2=0dfa	DER Encoded Certificate, 512 bits
11257>>&0	der	int2=0dfb	DER Encoded Certificate, 1024 bits
11258>>&0	der	int2=0dfc	DER Encoded Certificate, 2048 bits
11259>>&0	der	int2=0dfd	DER Encoded Certificate, 4096 bits
11260>>&0	der	int2=0dfe	DER Encoded Certificate, 8192 bits
11261>>&0	der	int2=0dff	DER Encoded Certificate, 16k bits
11262>>&0	der	int2=0e04	DER Encoded Certificate, 32k bits
11263>>&0	der	int2=x		DER Encoded Certificate, ? bits (%s)
11264>>&0	der	seq
11265>>>&0	der	obj_id9=2a864886f70d010105	\b, sha1WithRSAEncryption
11266>>>&0	der	obj_id9=x			\b, ? Encryption (%s)
11267>>>&0	der	null
11268>>&0	der	seq
11269>>>&0	der	set
11270>>>>&0	der	seq
11271>>>>>&0	der	obj_id3=550406
11272>>>>>&0	der	prt_str=x	\b, countryName=%s
11273>>>&0	der	set
11274>>>>&0	der	seq
11275>>>>>&0	der	obj_id3=550408
11276>>>>>&0	der	prt_str=x	\b, stateOrProvinceName=%s
11277>>>&0	der	set
11278>>>>&0	der	seq
11279>>>>>&0	der	obj_id3=550407
11280>>>>>&0	der	prt_str=x	\b, localityName=%s
11281>>>&0	der	set
11282>>>>&0	der	seq
11283>>>>>&0	der	obj_id3=55040a
11284>>>>>&0	der	prt_str=x	\b, organizationName=%s
11285>>>&0	der	set
11286>>>>&0	der	seq
11287>>>>>&0	der	obj_id3=55040b
11288>>>>>&0	der	prt_str=x	\b, organizationUnitName=%s
11289>>>&0	der	set
11290>>>>&0	der	seq
11291>>>>>&0	der	obj_id3=550403
11292>>>>>&0	der	prt_str=x	\b, commonName=%s
11293>>>&0	der	set
11294>>>>&0	der	seq
11295>>>>>&0	der	obj_id9=2a864886f70d010901
11296>>>>>&0	der	ia5_str=x	\b, emailAddress=%s
11297#>>&0	der	seq
11298#>>>&0	der	utc_time=x	\b, utcTime=%s
11299#>>>&0	der	utc_time=x	\b, utcTime=%s
11300>>&0	use	certinfo
11301
113020	der	seq
11303>&0	der	seq
11304>>&0	der	eoc
11305>>>&0	der	int1=02		Certificate, Version=3
11306>>>&0	der	int1=x		Certificate, Version=%s
11307>>&0	der	int9=x		\b, Serial=%s
11308>>&0	der	seq
11309>>>&0	der     obj_id9=2a864886f70d01010b
11310>>>&0	der	null
11311>>&0	der	seq
11312>>>&0	der	set
11313>>>>&0	der	seq
11314>>>>>&0	der     obj_id3=550403
11315>>>>>&0	der     utf8_str=x      \b, Issuer=%s
11316#>>&0	der	seq
11317#>>>&0	der	utc_time=x	\b, not-valid-before=%s
11318#>>>&0	der	utc_time=x	\b, not-valid-after=%s
11319>>&0	der	seq
11320>>>&0	der	set
11321>>>>&0	der	seq
11322>>>>>&0	der     obj_id3=550403
11323>>>>>&0	der     utf8_str=x      \b, Subject=%s
11324
11325#------------------------------------------------------------------------------
11326# $File: diamond,v 1.7 2009/09/19 16:28:08 christos Exp $
11327# diamond:  file(1) magic for Diamond system
11328#
11329# ... diamond is a multi-media mail and electronic conferencing system....
11330#
11331# XXX - I think it was either renamed Slate, or replaced by Slate....
11332#
11333#	The full deal is too long...
11334#0	string	<list>\n<protocol\ bbn-multimedia-format>	Diamond Multimedia Document
113350	string	=<list>\n<protocol\ bbn-m	Diamond Multimedia Document
11336
11337#------------------------------------------------------------------------------
11338# $File: dif,v 1.1 2020/04/09 19:14:01 christos Exp $
11339# dif:  file(1) magic for DIF text files
11340
11341#------------------------------------------------------------------------------
11342# From:	Joerg Jenderek
11343# URL:	http://en.wikipedia.org/wiki/Data_Interchange_Format
11344#	http://fileformats.archiveteam.org/wiki/Data_Interchange_Format
11345# Note:	called by TrID "Data Interchange Format",
11346#	by DROID x-fmt/368 "VisiCalc Database"
113470	string		TABLE
11348# skip text starting with TABLE by looking for numeric version on 2nd line
11349>6	search/2	0,
11350# skip DROID x-fmt-41-signature-id-380.dif by looking for key word TUPLES at the beginning
11351>>27	search/128	TUPLES		Data Interchange Format
11352# https://www.pcmatic.com/company/libraries/fileextension/detail.asp?ext=dif.html
11353#!:mime	application/x-dif-spreadsheet	Gnumeric
11354# https://github.com/LibreOffice/online/blob/master/discovery.xml
11355#!:mime	application/x-dif-document	LibreOffice
11356# https://www.wikidata.org/wiki/Wikidata:WikiProject_Informatics/File_formats/Lists/File_formats
11357!:mime	application/x-dif
11358# https://extension.nirsoft.net/dif
11359#!:mime	application/vnd.ms-excel
11360#!:mime	text/plain
11361!:ext	dif
11362# look for double quote 0x22 on 3rd line
11363>>>10	search/3	"
11364# skip if next character also double quote
11365>>>>&0	ubyte		!0x22		\b, generator or table name
11366# comment like EXCEL, pwm enclosed in double quotes
11367>>>>>&-2	string	x		%s
11368
11369
11370#------------------------------------------------------------------------------
11371# $File: diff,v 1.17 2020/08/22 18:16:58 christos Exp $
11372# diff:  file(1) magic for diff(1) output
11373#
113740	search/1	diff\040	diff output text
11375!:mime	text/x-diff
113760	search/1	***\040
11377>&0	search/1024	\n---\040	context diff output text
11378!:mime	text/x-diff
113790	search/1	Only\040in\040 	diff output text
11380!:mime	text/x-diff
113810	search/1	Common\040subdirectories:\040 	diff output text
11382!:mime	text/x-diff
11383
113840	search/1	Index:		RCS/CVS diff output text
11385!:mime	text/x-diff
11386
11387# bsdiff:  file(1) magic for bsdiff(1) output
113880	string/b	BSDIFF40	bsdiff(1) patch file
11389
11390
11391# unified diff
113920	search/4096	---\040
11393>&0	search/1024 	\n
11394>>&0	search/1 	+++\040
11395>>>&0	search/1024 	\n
11396>>>>&0	search/1	@@		unified diff output text
11397!:mime	text/x-diff
11398!:strength + 90
11399
11400# librsync -- the library for network deltas
11401#
11402# Copyright (C) 2001 by Martin Pool.  You may do whatever you want with
11403# this file.
11404#
114050	belong		0x72730236	rdiff network-delta data
11406
114070	belong		0x72730136	rdiff network-delta signature data
11408>4	belong		x		(block length=%d,
11409>8	belong		x		signature strength=%d)
11410
11411#------------------------------------------------------------------------------
11412# $File: digital,v 1.12 2021/07/03 14:01:46 christos Exp $
11413#  Digital UNIX - Info
11414#
114150	string	=!<arch>\n________64E	Alpha archive
11416>22	string	X			-- out of date
11417#
11418
114190	leshort		0603
11420>24	leshort		0410		COFF format alpha pure
11421>24	leshort		0413		COFF format alpha demand paged
11422>>22	leshort&030000	!020000		executable
11423>>22	leshort&020000	!0		dynamically linked
11424>>16	lelong		!0		not stripped
11425>>16	lelong		0		stripped
11426>>27	byte		x		- version %d
11427>>26	byte		x		\b.%d
11428>>28	byte		x		\b-%d
11429>24	leshort		0407		COFF format alpha object
11430>>22	leshort&030000	020000		shared library
11431>>27	byte		x		- version %d
11432>>26	byte		x		\b.%d
11433>>28	byte		x		\b-%d
11434
11435# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk>
11436#
11437# The actual magic number is just "Core", followed by a 2-byte version
11438# number; however, treating any file that begins with "Core" as a Digital
11439# UNIX core dump file may produce too many false hits, so we include one
11440# byte of the version number as well; DU 5.0 appears only to be up to
11441# version 2.
11442#
114430	string		Core\001	Alpha COFF format core dump (Digital UNIX)
11444>24	string		>\0		\b, from '%s'
114450	string		Core\002	Alpha COFF format core dump (Digital UNIX)
11446>24	string		>\0		\b, from '%s'
11447#
11448# The next is incomplete, we could tell more about this format,
11449# but its not worth it.
114500	leshort		0x188	Alpha compressed COFF
114510	leshort		0x18f	Alpha u-code object
11452#
11453#
11454# Some other interesting Digital formats,
114550	string	\377\377\177		ddis/ddif
114560	string	\377\377\174		ddis/dots archive
114570	string	\377\377\176		ddis/dtif table data
114580	string	\033c\033		LN03 output
114590	long	04553207		X image
11460#
114610	string	=!<PDF>!\n		profiling data file
11462#
11463# Locale data tables (MIPS and Alpha).
11464#
11465# GRR: line below is too general as it matches also TTComp archive, ASCII, 2K  handled by ./archive
114660	short		0x0501		locale data table
11467>6	short		0x24		for MIPS
11468>6	short		0x40		for Alpha
11469
11470#------------------------------------------------------------------------------
11471# $File: dolby,v 1.9 2019/04/19 00:42:27 christos Exp $
11472# ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at>
11473# from https://www.atsc.org/standards/a_52a.pdf
11474# corrections, additions, etc. are always welcome!
11475#
11476# syncword
114770	beshort		0x0b77	ATSC A/52 aka AC-3 aka Dolby Digital stream,
11478# Proposed audio/ac3 RFC/4184
11479!:mime	audio/vnd.dolby.dd-raw
11480# fscod
11481>4	byte&0xc0 = 0x00	48 kHz,
11482>4	byte&0xc0 = 0x40	44.1 kHz,
11483>4	byte&0xc0 = 0x80	32 kHz,
11484# is this one used for 96 kHz?
11485>4	byte&0xc0 = 0xc0	reserved frequency,
11486#
11487>5	byte&0x07 = 0x00	\b, complete main (CM)
11488>5	byte&0x07 = 0x01	\b, music and effects (ME)
11489>5	byte&0x07 = 0x02	\b, visually impaired (VI)
11490>5	byte&0x07 = 0x03	\b, hearing impaired (HI)
11491>5	byte&0x07 = 0x04	\b, dialogue (D)
11492>5	byte&0x07 = 0x05	\b, commentary (C)
11493>5	byte&0x07 = 0x06	\b, emergency (E)
11494>5	beshort&0x07e0  0x0720	\b, voiceover (VO)
11495>5	beshort&0x07e0 >0x0720	\b, karaoke
11496# acmod
11497>6	byte&0xe0 = 0x00	1+1 front,
11498>>6	byte&0x10 = 0x10	LFE on,
11499>6	byte&0xe0 = 0x20	1 front/0 rear,
11500>>6	byte&0x10 = 0x10	LFE on,
11501>6	byte&0xe0 = 0x40	2 front/0 rear,
11502# dsurmod (for stereo only)
11503>>6	byte&0x18 = 0x00	Dolby Surround not indicated
11504>>6	byte&0x18 = 0x08	not Dolby Surround encoded
11505>>6	byte&0x18 = 0x10	Dolby Surround encoded
11506>>6	byte&0x18 = 0x18	reserved Dolby Surround mode
11507>>6	byte&0x04 = 0x04	LFE on,
11508>6	byte&0xe0 = 0x60	3 front/0 rear,
11509>>6	byte&0x04 = 0x04	LFE on,
11510>6	byte&0xe0 = 0x80	2 front/1 rear,
11511>>6	byte&0x04 = 0x04	LFE on,
11512>6	byte&0xe0 = 0xa0	3 front/1 rear,
11513>>6	byte&0x01 = 0x01	LFE on,
11514>6	byte&0xe0 = 0xc0	2 front/2 rear,
11515>>6	byte&0x04 = 0x04	LFE on,
11516>6	byte&0xe0 = 0xe0	3 front/2 rear,
11517>>6	byte&0x01 = 0x01	LFE on,
11518#
11519>4	byte&0x3e = 0x00	\b, 32 kbit/s
11520>4	byte&0x3e = 0x02	\b, 40 kbit/s
11521>4	byte&0x3e = 0x04	\b, 48 kbit/s
11522>4	byte&0x3e = 0x06	\b, 56 kbit/s
11523>4	byte&0x3e = 0x08	\b, 64 kbit/s
11524>4	byte&0x3e = 0x0a	\b, 80 kbit/s
11525>4	byte&0x3e = 0x0c	\b, 96 kbit/s
11526>4	byte&0x3e = 0x0e	\b, 112 kbit/s
11527>4	byte&0x3e = 0x10	\b, 128 kbit/s
11528>4	byte&0x3e = 0x12	\b, 160 kbit/s
11529>4	byte&0x3e = 0x14	\b, 192 kbit/s
11530>4	byte&0x3e = 0x16	\b, 224 kbit/s
11531>4	byte&0x3e = 0x18	\b, 256 kbit/s
11532>4	byte&0x3e = 0x1a	\b, 320 kbit/s
11533>4	byte&0x3e = 0x1c	\b, 384 kbit/s
11534>4	byte&0x3e = 0x1e	\b, 448 kbit/s
11535>4	byte&0x3e = 0x20	\b, 512 kbit/s
11536>4	byte&0x3e = 0x22	\b, 576 kbit/s
11537>4	byte&0x3e = 0x24	\b, 640 kbit/s
11538
11539#------------------------------------------------------------
11540# $File: dsf,v 1.1 2022/01/08 16:29:18 christos Exp $
11541# dsf:  file(1) magic for DSD Stream File
11542# URL:          https://en.wikipedia.org/wiki/Direct_Stream_Digital
11543# Reference:    https://dsd-guide.com/sites/default/files/white-papers/DSFFileFormatSpec_E.pdf
115440	string	DSD\x20		DSD Stream File,
11545>0x30	leshort	1		mono,
11546>0x30	leshort	2		stereo,
11547>0x30	leshort	3		three-channel,
11548>0x30	leshort	4		quad-channel,
11549>0x30	leshort	5		3.1 4-channel,
11550>0x30	leshort	6		five-channel,
11551>0x30	leshort	7		5.1 surround,
11552>0x30	default	x
11553>>0x30	leshort	x		unknown channel format (%d),
11554>0x38	lelong	2822400		simple-rate,
11555>0x38	lelong	5644800		double-rate,
11556>0x38	default	x
11557>>0x38	lelong	x		%d Hz,
11558>0x3c	leshort	1		1 bit,
11559>0x3c	leshort	8		8 bit,
11560>0x3c	default	x
11561>>0x3c	leshort	x		%d bit,
11562>0x40	lelong	x		%d samples
11563
11564#------------------------------------------------------------------------------
11565# $File: dump,v 1.17 2018/06/26 01:07:17 christos Exp $
11566# dump:  file(1) magic for dump file format--for new and old dump filesystems
11567#
11568# We specify both byte orders in order to recognize byte-swapped dumps.
11569#
115700	name	new-dump-be
11571>4	bedate	x		This dump %s,
11572>8	bedate	x		Previous dump %s,
11573>12	belong	>0		Volume %d,
11574>692	belong	0		Level zero, type:
11575>692	belong	>0		Level %d, type:
11576>0	belong	1		tape header,
11577>0	belong	2		beginning of file record,
11578>0	belong	3		map of inodes on tape,
11579>0	belong	4		continuation of file record,
11580>0	belong	5		end of volume,
11581>0	belong	6		map of inodes deleted,
11582>0	belong	7		end of medium (for floppy),
11583>676	string	>\0		Label %s,
11584>696	string	>\0		Filesystem %s,
11585>760	string	>\0		Device %s,
11586>824	string	>\0		Host %s,
11587>888	belong	>0		Flags %x
11588
115890	name	old-dump-be
11590#>4	bedate	x		This dump %s,
11591#>8	bedate	x		Previous dump %s,
11592>12	belong	>0		Volume %d,
11593>692	belong	0		Level zero, type:
11594>692	belong	>0		Level %d, type:
11595>0	belong	1		tape header,
11596>0	belong	2		beginning of file record,
11597>0	belong	3		map of inodes on tape,
11598>0	belong	4		continuation of file record,
11599>0	belong	5		end of volume,
11600>0	belong	6		map of inodes deleted,
11601>0	belong	7		end of medium (for floppy),
11602>676	string	>\0		Label %s,
11603>696	string	>\0		Filesystem %s,
11604>760	string	>\0		Device %s,
11605>824	string	>\0		Host %s,
11606>888	belong	>0		Flags %x
11607
116080	name	ufs2-dump-be
11609>896	beqdate	x		This dump %s,
11610>904	beqdate	x		Previous dump %s,
11611>12	belong	>0		Volume %d,
11612>692	belong	0		Level zero, type:
11613>692	belong	>0		Level %d, type:
11614>0	belong	1		tape header,
11615>0	belong	2		beginning of file record,
11616>0	belong	3		map of inodes on tape,
11617>0	belong	4		continuation of file record,
11618>0	belong	5		end of volume,
11619>0	belong	6		map of inodes deleted,
11620>0	belong	7		end of medium (for floppy),
11621>676	string	>\0		Label %s,
11622>696	string	>\0		Filesystem %s,
11623>760	string	>\0		Device %s,
11624>824	string	>\0		Host %s,
11625>888	belong	>0		Flags %x
11626
1162724	belong	60012		new-fs dump file (big endian),
11628>0	use	new-dump-be
11629
1163024	belong	60011		old-fs dump file (big endian),
11631>0	use	old-dump-be
11632
1163324	lelong	60012		new-fs dump file (little endian),
11634# to correctly recognize '*.mo' GNU message catalog (little endian)
11635!:strength - 15
11636>0	use	\^new-dump-be
11637
1163824	lelong	60011		old-fs dump file (little endian),
11639>0	use	\^old-dump-be
11640
11641
1164224	belong	0x19540119	new-fs dump file (ufs2, big endian),
11643>0	use	ufs2-dump-be
11644
1164524	lelong	0x19540119	new-fs dump file (ufs2, little endian),
11646>0	use	\^ufs2-dump-be
11647
1164818	leshort	60011		old-fs dump file (16-bit, assuming PDP-11 endianness),
11649>2	medate	x		Previous dump %s,
11650>6	medate	x		This dump %s,
11651>10	leshort	>0		Volume %d,
11652>0	leshort	1		tape header.
11653>0	leshort	2		beginning of file record.
11654>0	leshort	3		map of inodes on tape.
11655>0	leshort	4		continuation of file record.
11656>0	leshort	5		end of volume.
11657>0	leshort	6		map of inodes deleted.
11658>0	leshort	7		end of medium (for floppy).
11659
11660#------------------------------------------------------------------------------
11661# $File: dyadic,v 1.9 2019/04/19 00:42:27 christos Exp $
11662# Dyadic: file(1) magic for Dyalog APL.
11663#
11664# updated by Joerg Jenderek at Oct 2013
11665# https://en.wikipedia.org/wiki/Dyalog_APL
11666# https://www.dyalog.com/
11667# .DXV Dyalog APL External Variable
11668# .DIN Dyalog APL Input Table
11669# .DOT Dyalog APL Output Table
11670# .DFT Dyalog APL Format File
116710	ubeshort&0xFF60	0xaa00
11672# skip biblio.dbt
11673>1	byte		!4
11674# real Dyalog APL have non zero version numbers like 7.3 or 13.4
11675>>2	ubeshort	>0x0000		Dyalog APL
11676>>>1	byte		0x00		aplcore
11677#>>>1	byte		0x00		incomplete workspace
11678# *.DCF Dyalog APL Component File
11679>>>1	byte		0x01		component file 32-bit non-journaled non-checksummed
11680#>>>1	byte		0x01		component file
11681>>>1	byte		0x02		external variable exclusive
11682#>>>1	byte		0x02		external variable
11683# *.DWS Dyalog APL Workspace
11684>>>1	byte		0x03		workspace
11685>>>>7	byte&0x28	0x00		32-bit
11686>>>>7	byte&0x28	0x20		64-bit
11687>>>>7	byte&0x0c	0x00		classic
11688>>>>7	byte&0x0c	0x04		unicode
11689>>>>7	byte&0x88	0x00		big-endian
11690>>>>7	byte&0x88	0x80		little-endian
11691>>>1	byte		0x06		external variable shared
11692# *.DSE Dyalog APL Session , *.DLF Dyalog APL Session Log File
11693>>>1	byte		0x07		session
11694>>>1	byte		0x08		mapped file 32-bit
11695>>>1	byte		0x09		component file 64-bit non-journaled non-checksummed
11696>>>1	byte		0x0a		mapped file 64-bit
11697>>>1	byte		0x0b		component file 32-bit level 1 journaled non-checksummed
11698>>>1	byte		0x0c		component file 64-bit level 1 journaled non-checksummed
11699>>>1	byte		0x0d		component file 32-bit level 1 journaled checksummed
11700>>>1	byte		0x0e		component file 64-bit level 1 journaled checksummed
11701>>>1	byte		0x0f		component file 32-bit level 2 journaled checksummed
11702>>>1	byte		0x10		component file 64-bit level 2 journaled checksummed
11703>>>1	byte		0x11		component file 32-bit level 3 journaled checksummed
11704>>>1	byte		0x12		component file 64-bit level 3 journaled checksummed
11705>>>1	byte		0x13		component file 32-bit non-journaled checksummed
11706>>>1	byte		0x14		component file 64-bit non-journaled checksummed
11707>>>1	byte		0x15		component file under construction
11708>>>1	byte		0x16		DFS component file 64-bit level 1 journaled checksummed
11709>>>1	byte		0x17		DFS component file 64-bit level 2 journaled checksummed
11710>>>1	byte		0x18		DFS component file 64-bit level 3 journaled checksummed
11711>>>1	byte		0x19		external workspace
11712>>>1	byte		0x80		DDB
11713>>>2	byte		x		version %d
11714>>>3	byte		x		\b.%d
11715#>>>2	byte		x		type %d
11716#>>>3	byte		x		subtype %d
11717
11718# *.DXF Dyalog APL Transfer File
117190	short		0x6060		Dyalog APL transfer
11720
11721#------------------------------------------------------------------------------
11722# $File: ebml,v 1.2 2019/04/19 00:42:27 christos Exp $
11723# ebml:  file(1) magic for various Extensible Binary Meta Language
11724# https://www.matroska.org/technical/specs/index.html#track
117250	belong	0x1a45dfa3	EBML file
11726>4	search/b/100	\102\202
11727>>&1	string	x		\b, creator %.8s
11728
11729#------------------------------------------------------------------------------
11730# $File: edid,v 1.1 2019/03/28 12:36:01 christos Exp $
11731# edid:  file(1) magic for EDID dump files
11732
117330	quad	0x00ffffffffffff00	Extended display identification data dump
11734!:mime application/x-edid-dump
11735>18	byte	0x01			Version 1
11736>>19	byte	<0x04			\b.%d
11737>18	byte	0x02			Version 2
11738>>19	byte	0x00			\b.0
11739
11740#------------------------------------------------------------------------------
11741# $File: editors,v 1.12 2020/10/11 20:28:07 christos Exp $
11742# T602 editor documents
11743# by David Necas <yeti@physics.muni.cz>
117440	string	@CT\ 	T602 document data,
11745>4	string	0	Kamenicky
11746>4	string	1	CP 852
11747>4	string	2	KOI8-CS
11748>4	string	>2	unknown encoding
11749
11750# Vi IMproved Encrypted file
11751# by David Necas <yeti@physics.muni.cz>
11752# updated by Osman Surkatty
117530	string	VimCrypt~	Vim encrypted file data
11754>9	string	01!		with zip cryptmethod
11755>9	string	02!		with blowfish cryptmethod
11756>9	string	03!		with blowfish2 cryptmethod
11757
117580	name	vimnanoswap
11759>67	byte	0
11760>>107	byte	0
11761#>>>2	string	x	%s swap file
11762>>>24	ulelong	x	\b, pid %d
11763>>>28	string	>\0	\b, user %s
11764>>>68	string	>\0	\b, host %s
11765>>>108	string	>\0	\b, file %s
11766>>>1007	byte	0x55	\b, modified
11767
11768# Vi IMproved Swap file
11769# by Sven Wegener <swegener@gentoo.org>
117700	string  b0VIM\ 		Vim swap file
11771>&0	string  >\0		\b, version %s
11772>0	use	vimnanoswap
11773
11774
11775# Lock/swap file for several editors, at least
11776# Vi IMproved and nano
117770	string	b0nano		Nano swap file
11778>0	use	vimnanoswap
11779
11780# kate (K Advanced Text Editor)
117810	string	\x00\x00\x00\x12Kate\ Swap\ File\ 2.0\x00	Kate swap file
11782
11783#------------------------------------------------------------------------------
11784# $File: efi,v 1.5 2014/04/30 21:41:02 christos Exp $
11785# efi:  file(1) magic for Universal EFI binaries
11786
117870	lelong	0x0ef1fab9
11788>4	lelong	1		Universal EFI binary with 1 architecture
11789>>&0	lelong	7		\b, i386
11790>>&0	lelong	0x01000007	\b, x86_64
11791>4	lelong	2		Universal EFI binary with 2 architectures
11792>>&0	lelong	7		\b, i386
11793>>&0	lelong	0x01000007	\b, x86_64
11794>>&20	lelong	7		\b, i386
11795>>&20	lelong	0x01000007	\b, x86_64
11796>4	lelong	>2		Universal EFI binary with %d architectures
11797
11798#------------------------------------------------------------------------------
11799# $File: elf,v 1.87 2021/05/25 15:19:51 christos Exp $
11800# elf:  file(1) magic for ELF executables
11801#
11802# We have to check the byte order flag to see what byte order all the
11803# other stuff in the header is in.
11804#
11805# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
11806#
11807# Created by: unknown
11808# Modified by (1): Daniel Quinlan <quinlan@yggdrasil.com>
11809# Modified by (2): Peter Tobias <tobias@server.et-inf.fho-emden.de> (core support)
11810# Modified by (3): Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> (fix of core support)
11811# Modified by (4): <gerardo.cacciari@gmail.com> (VMS Itanium)
11812# Modified by (5): Matthias Urlichs <smurf@debian.org> (Listing of many architectures)
11813
118140	name		elf-mips
11815>0	lelong&0xf0000000	0x00000000	MIPS-I
11816>0	lelong&0xf0000000	0x10000000	MIPS-II
11817>0	lelong&0xf0000000	0x20000000	MIPS-III
11818>0	lelong&0xf0000000	0x30000000	MIPS-IV
11819>0	lelong&0xf0000000	0x40000000	MIPS-V
11820>0	lelong&0xf0000000	0x50000000	MIPS32
11821>0	lelong&0xf0000000	0x60000000	MIPS64
11822>0	lelong&0xf0000000	0x70000000	MIPS32 rel2
11823>0	lelong&0xf0000000	0x80000000	MIPS64 rel2
11824>0	lelong&0xf0000000	0x90000000	MIPS32 rel6
11825>0	lelong&0xf0000000	0xa0000000	MIPS64 rel6
11826
118270	name		elf-sparc
11828>0	lelong&0x00ffff00	0x00000100	V8+ Required,
11829>0	lelong&0x00ffff00	0x00000200	Sun UltraSPARC1 Extensions Required,
11830>0	lelong&0x00ffff00	0x00000400	HaL R1 Extensions Required,
11831>0	lelong&0x00ffff00	0x00000800	Sun UltraSPARC3 Extensions Required,
11832>0	lelong&0x3		0		total store ordering,
11833>0	lelong&0x3		1		partial store ordering,
11834>0	lelong&0x3		2		relaxed memory ordering,
11835
118360	name		elf-pa-risc
11837>2	leshort		0x020b		1.0
11838>2	leshort		0x0210		1.1
11839>2	leshort		0x0214		2.0
11840>0	leshort		&0x0008		(LP64)
11841
118420	name		elf-riscv
11843>0	lelong&0x00000001	0x00000001	RVC,
11844>0	lelong&0x00000008	0x00000008	RVE,
11845>0	lelong&0x00000006	0x00000000	soft-float ABI,
11846>0	lelong&0x00000006	0x00000002	single-float ABI,
11847>0	lelong&0x00000006	0x00000004	double-float ABI,
11848>0	lelong&0x00000006	0x00000006	quad-float ABI,
11849
118500	name		elf-le
11851>16	leshort		0		no file type,
11852!:mime	application/octet-stream
11853>16	leshort		1		relocatable,
11854!:mime	application/x-object
11855>16	leshort		2		executable,
11856!:mime	application/x-executable
11857>16	leshort		3		${x?pie executable:shared object},
11858
11859!:mime	application/x-${x?pie-executable:sharedlib}
11860>16	leshort		4		core file,
11861!:mime	application/x-coredump
11862# OS-specific
11863>7	byte		202
11864>>16	leshort		0xFE01		executable,
11865!:mime	application/x-executable
11866# Core file detection is not reliable.
11867#>>>(0x38+0xcc) string	>\0		of '%s'
11868#>>>(0x38+0x10) lelong	>0		(signal %d),
11869>16	leshort		&0xff00
11870>>18	leshort		!8		processor-specific,
11871>>18	leshort		8
11872>>>16	leshort		0xFF80		PlayStation 2 IOP module,
11873!:mime	application/x-sharedlib
11874>>>16	leshort		!0xFF80		processor-specific,
11875>18	clear		x
11876>18	leshort		0		no machine,
11877>18	leshort		1		AT&T WE32100,
11878>18	leshort		2		SPARC,
11879>18	leshort		3		Intel 80386,
11880>18	leshort		4		Motorola m68k,
11881>>4	byte		1
11882>>>36	lelong		&0x01000000	68000,
11883>>>36	lelong		&0x00810000	CPU32,
11884>>>36	lelong		0		68020,
11885>18	leshort		5		Motorola m88k,
11886>18	leshort		6		Intel 80486,
11887>18	leshort		7		Intel 80860,
11888# The official e_machine number for MIPS is now #8, regardless of endianness.
11889# The second number (#10) will be deprecated later. For now, we still
11890# say something if #10 is encountered, but only gory details for #8.
11891>18	leshort		8		MIPS,
11892>>4	byte		1
11893>>>36	lelong		&0x20		N32
11894>18	leshort		10		MIPS,
11895>>4	byte		1
11896>>>36	lelong		&0x20		N32
11897>18	leshort		8
11898# only for 32-bit
11899>>4	byte		1
11900>>>36	use		elf-mips
11901# only for 64-bit
11902>>4	byte		2
11903>>>48	use		elf-mips
11904>18	leshort		9		Amdahl,
11905>18	leshort		10		MIPS (deprecated),
11906>18	leshort		11		RS6000,
11907>18	leshort		15		PA-RISC,
11908# only for 32-bit
11909>>4	byte		1
11910>>>36	use		elf-pa-risc
11911# only for 64-bit
11912>>4	byte		2
11913>>>48	use		elf-pa-risc
11914>18	leshort		16		nCUBE,
11915>18	leshort		17		Fujitsu VPP500,
11916>18	leshort		18		SPARC32PLUS,
11917# only for 32-bit
11918>>4	byte		1
11919>>>36	use		elf-sparc
11920>18	leshort		19		Intel 80960,
11921>18	leshort		20		PowerPC or cisco 4500,
11922>18	leshort		21		64-bit PowerPC or cisco 7500,
11923>>48	lelong		0		Unspecified or Power ELF V1 ABI,
11924>>48	lelong		1		Power ELF V1 ABI,
11925>>48	lelong		2		OpenPOWER ELF V2 ABI,
11926>18	leshort		22		IBM S/390,
11927>18	leshort		23		Cell SPU,
11928>18	leshort		24		cisco SVIP,
11929>18	leshort		25		cisco 7200,
11930>18	leshort		36		NEC V800 or cisco 12000,
11931>18	leshort		37		Fujitsu FR20,
11932>18	leshort		38		TRW RH-32,
11933>18	leshort		39		Motorola RCE,
11934>18	leshort		40		ARM,
11935>>4	byte		1
11936>>>36	lelong&0xff000000	0x04000000	EABI4
11937>>>36	lelong&0xff000000	0x05000000	EABI5
11938>>>36	lelong		&0x00800000	BE8
11939>>>36	lelong		&0x00400000	LE8
11940>18	leshort		41		Alpha,
11941>18	leshort		42		Renesas SH,
11942>18	leshort		43		SPARC V9,
11943>>4	byte		2
11944>>>48	use		elf-sparc
11945>18	leshort		44		Siemens Tricore Embedded Processor,
11946>18	leshort		45		Argonaut RISC Core, Argonaut Technologies Inc.,
11947>18	leshort		46		Renesas H8/300,
11948>18	leshort		47		Renesas H8/300H,
11949>18	leshort		48		Renesas H8S,
11950>18	leshort		49		Renesas H8/500,
11951>18	leshort		50		IA-64,
11952>18	leshort		51		Stanford MIPS-X,
11953>18	leshort		52		Motorola Coldfire,
11954>18	leshort		53		Motorola M68HC12,
11955>18	leshort		54		Fujitsu MMA,
11956>18	leshort		55		Siemens PCP,
11957>18	leshort		56		Sony nCPU,
11958>18	leshort		57		Denso NDR1,
11959>18	leshort		58		Start*Core,
11960>18	leshort		59		Toyota ME16,
11961>18	leshort		60		ST100,
11962>18	leshort		61		Tinyj emb.,
11963>18	leshort		62		x86-64,
11964>18	leshort		63		Sony DSP,
11965>18	leshort		64		DEC PDP-10,
11966>18	leshort		65		DEC PDP-11,
11967>18	leshort		66		FX66,
11968>18	leshort		67		ST9+ 8/16 bit,
11969>18	leshort		68		ST7 8 bit,
11970>18	leshort		69		MC68HC16,
11971>18	leshort		70		MC68HC11,
11972>18	leshort		71		MC68HC08,
11973>18	leshort		72		MC68HC05,
11974>18	leshort		73		SGI SVx or Cray NV1,
11975>18	leshort		74		ST19 8 bit,
11976>18	leshort		75		Digital VAX,
11977>18	leshort		76		Axis cris,
11978>18	leshort		77		Infineon 32-bit embedded,
11979>18	leshort		78		Element 14 64-bit DSP,
11980>18	leshort		79		LSI Logic 16-bit DSP,
11981>18	leshort		80		MMIX,
11982>18	leshort		81		Harvard machine-independent,
11983>18	leshort		82		SiTera Prism,
11984>18	leshort		83		Atmel AVR 8-bit,
11985>18	leshort		84		Fujitsu FR30,
11986>18	leshort		85		Mitsubishi D10V,
11987>18	leshort		86		Mitsubishi D30V,
11988>18	leshort		87		NEC v850,
11989>18	leshort		88		Renesas M32R,
11990>18	leshort		89		Matsushita MN10300,
11991>18	leshort		90		Matsushita MN10200,
11992>18	leshort		91		picoJava,
11993>18	leshort		92		OpenRISC,
11994>18	leshort		93		Synopsys ARCompact ARC700 cores,
11995>18	leshort		94		Tensilica Xtensa,
11996>18	leshort		95		Alphamosaic VideoCore,
11997>18	leshort		96		Thompson Multimedia,
11998>18	leshort		97		NatSemi 32k,
11999>18	leshort		98		Tenor Network TPC,
12000>18	leshort		99		Trebia SNP 1000,
12001>18	leshort		100		STMicroelectronics ST200,
12002>18	leshort		101		Ubicom IP2022,
12003>18	leshort		102		MAX Processor,
12004>18	leshort		103		NatSemi CompactRISC,
12005>18	leshort		104		Fujitsu F2MC16,
12006>18	leshort		105		TI msp430,
12007>18	leshort		106		Analog Devices Blackfin,
12008>18	leshort		107		S1C33 Family of Seiko Epson,
12009>18	leshort		108		Sharp embedded,
12010>18	leshort		109		Arca RISC,
12011>18	leshort		110		PKU-Unity Ltd.,
12012>18	leshort		111		eXcess: 16/32/64-bit,
12013>18	leshort		112		Icera Deep Execution Processor,
12014>18	leshort		113		Altera Nios II,
12015>18	leshort		114		NatSemi CRX,
12016>18	leshort		115		Motorola XGATE,
12017>18	leshort		116		Infineon C16x/XC16x,
12018>18	leshort		117		Renesas M16C series,
12019>18	leshort		118		Microchip dsPIC30F,
12020>18	leshort		119		Freescale RISC core,
12021>18	leshort		120		Renesas M32C series,
12022>18	leshort		131		Altium TSK3000 core,
12023>18	leshort		132		Freescale RS08,
12024>18	leshort		134		Cyan Technology eCOG2,
12025>18	leshort		135		Sunplus S+core7 RISC,
12026>18	leshort		136		New Japan Radio (NJR) 24-bit DSP,
12027>18	leshort		137		Broadcom VideoCore III,
12028>18	leshort		138		LatticeMico32,
12029>18	leshort		139		Seiko Epson C17 family,
12030>18	leshort		140		TI TMS320C6000 DSP family,
12031>18	leshort		141		TI TMS320C2000 DSP family,
12032>18	leshort		142		TI TMS320C55x DSP family,
12033>18	leshort		144		TI Programmable Realtime Unit
12034>18	leshort		160		STMicroelectronics 64bit VLIW DSP,
12035>18	leshort		161		Cypress M8C,
12036>18	leshort		162		Renesas R32C series,
12037>18	leshort		163		NXP TriMedia family,
12038>18	leshort		164		QUALCOMM DSP6,
12039>18	leshort		165		Intel 8051 and variants,
12040>18	leshort		166		STMicroelectronics STxP7x family,
12041>18	leshort		167		Andes embedded RISC,
12042>18	leshort		168		Cyan eCOG1X family,
12043>18	leshort		169		Dallas MAXQ30,
12044>18	leshort		170		New Japan Radio (NJR) 16-bit DSP,
12045>18	leshort		171		M2000 Reconfigurable RISC,
12046>18	leshort		172		Cray NV2 vector architecture,
12047>18	leshort		173		Renesas RX family,
12048>18	leshort		174		META,
12049>18	leshort		175		MCST Elbrus,
12050>18	leshort		176		Cyan Technology eCOG16 family,
12051>18	leshort		177		NatSemi CompactRISC,
12052>18	leshort		178		Freescale Extended Time Processing Unit,
12053>18	leshort		179		Infineon SLE9X,
12054>18	leshort		180		Intel L1OM,
12055>18	leshort		181		Intel K1OM,
12056>18	leshort		183		ARM aarch64,
12057>18	leshort		185		Atmel 32-bit family,
12058>18	leshort		186		STMicroeletronics STM8 8-bit,
12059>18	leshort		187		Tilera TILE64,
12060>18	leshort		188		Tilera TILEPro,
12061>18	leshort		189		Xilinx MicroBlaze 32-bit RISC,
12062>18	leshort		190		NVIDIA CUDA architecture,
12063>18	leshort		191		Tilera TILE-Gx,
12064>18	leshort		195		Synopsys ARCv2/HS3x/HS4x cores,
12065>18	leshort		197		Renesas RL78 family,
12066>18	leshort		199		Renesas 78K0R,
12067>18	leshort		200		Freescale 56800EX,
12068>18	leshort		201		Beyond BA1,
12069>18	leshort		202		Beyond BA2,
12070>18	leshort		203		XMOS xCORE,
12071>18	leshort		204		Microchip 8-bit PIC(r),
12072>18	leshort		210		KM211 KM32,
12073>18	leshort		211		KM211 KMX32,
12074>18	leshort		212		KM211 KMX16,
12075>18	leshort		213		KM211 KMX8,
12076>18	leshort		214		KM211 KVARC,
12077>18	leshort		215		Paneve CDP,
12078>18	leshort		216		Cognitive Smart Memory,
12079>18	leshort		217		iCelero CoolEngine,
12080>18	leshort		218		Nanoradio Optimized RISC,
12081>18	leshort		243		UCB RISC-V,
12082# only for 32-bit
12083>>4	byte		1
12084>>>36	use		elf-riscv
12085# only for 64-bit
12086>>4	byte		2
12087>>>48	use		elf-riscv
12088>18	leshort		244		Lanai 32-bit processor,
12089>18	leshort		245		CEVA Processor Architecture Family,
12090>18	leshort		246		CEVA X2 Processor Family,
12091>18	leshort		247		eBPF,
12092>18	leshort		248		Graphcore Intelligent Processing Unit,
12093>18	leshort		249		Imagination Technologies,
12094>18	leshort		250		Netronome Flow Processor,
12095>18	leshort		251             NEC Vector Engine,
12096>18	leshort		252		C-SKY processor family,
12097>18	leshort		253		Synopsys ARCv3 64-bit ISA/HS6x cores,
12098>18	leshort		254		MOS Technology MCS 6502 processor,
12099>18	leshort		255		Synopsys ARCv3 32-bit,
12100>18	leshort		256		Kalray VLIW core of the MPPA family,
12101>18	leshort		257		WDC 65816/65C816,
12102>18	leshort		258		LoongArch,
12103>18	leshort		259		ChipON KungFu32,
12104>18	leshort		0x1057		AVR (unofficial),
12105>18	leshort		0x1059		MSP430 (unofficial),
12106>18	leshort		0x1223		Adapteva Epiphany (unofficial),
12107>18	leshort		0x2530		Morpho MT (unofficial),
12108>18	leshort		0x3330		FR30 (unofficial),
12109>18	leshort		0x3426		OpenRISC (obsolete),
12110>18	leshort		0x4688		Infineon C166 (unofficial),
12111>18	leshort		0x5441		Cygnus FRV (unofficial),
12112>18	leshort		0x5aa5		DLX (unofficial),
12113>18	leshort		0x7650		Cygnus D10V (unofficial),
12114>18	leshort		0x7676		Cygnus D30V (unofficial),
12115>18	leshort		0x8217		Ubicom IP2xxx (unofficial),
12116>18	leshort		0x8472		OpenRISC (obsolete),
12117>18	leshort		0x9025		Cygnus PowerPC (unofficial),
12118>18	leshort		0x9026		Alpha (unofficial),
12119>18	leshort		0x9041		Cygnus M32R (unofficial),
12120>18	leshort		0x9080		Cygnus V850 (unofficial),
12121>18	leshort		0xa390		IBM S/390 (obsolete),
12122>18	leshort		0xabc7		Old Xtensa (unofficial),
12123>18	leshort		0xad45		xstormy16 (unofficial),
12124>18	leshort		0xbaab		Old MicroBlaze (unofficial),,
12125>18	leshort		0xbeef		Cygnus MN10300 (unofficial),
12126>18	leshort		0xdead		Cygnus MN10200 (unofficial),
12127>18	leshort		0xf00d		Toshiba MeP (unofficial),
12128>18	leshort		0xfeb0		Renesas M32C (unofficial),
12129>18	leshort		0xfeba		Vitesse IQ2000 (unofficial),
12130>18	leshort		0xfebb		NIOS (unofficial),
12131>18	leshort		0xfeed		Moxie (unofficial),
12132>18	default		x
12133>>18	leshort		x		*unknown arch %#x*
12134>20	lelong		0		invalid version
12135>20	lelong		1		version 1
12136
121370	string		\177ELF		ELF
12138!:strength *2
12139>4	byte		0		invalid class
12140>4	byte		1		32-bit
12141>4	byte		2		64-bit
12142>5	byte		0		invalid byte order
12143>5	byte		1		LSB
12144>>0	use		elf-le
12145>5	byte		2		MSB
12146>>0	use		\^elf-le
12147>7	byte		0		(SYSV)
12148>7	byte		1		(HP-UX)
12149>7	byte		2		(NetBSD)
12150>7	byte		3		(GNU/Linux)
12151>7	byte		4		(GNU/Hurd)
12152>7	byte		5		(86Open)
12153>7	byte		6		(Solaris)
12154>7	byte		7		(Monterey)
12155>7	byte		8		(IRIX)
12156>7	byte		9		(FreeBSD)
12157>7	byte		10		(Tru64)
12158>7	byte		11		(Novell Modesto)
12159>7	byte		12		(OpenBSD)
12160>7	byte		13		(OpenVMS)
12161>7	byte		14		(HP NonStop Kernel)
12162>7	byte		15		(AROS Research Operating System)
12163>7	byte		16		(FenixOS)
12164>7	byte		17		(Nuxi CloudABI)
12165>7	byte		97		(ARM)
12166>7	byte		202		(Cafe OS)
12167>7	byte		255		(embedded)
12168
12169#------------------------------------------------------------------------------
12170# $File: encore,v 1.7 2014/04/30 21:41:02 christos Exp $
12171# encore:  file(1) magic for Encore machines
12172#
12173# XXX - needs to have the byte order specified (NS32K was little-endian,
12174# dunno whether they run the 88K in little-endian mode or not).
12175#
121760	short		0x154		Encore
12177>20	short		0x107		executable
12178>20	short		0x108		pure executable
12179>20	short		0x10b		demand-paged executable
12180>20	short		0x10f		unsupported executable
12181>12	long		>0		not stripped
12182>22	short		>0		- version %d
12183>22	short		0		-
12184#>4	date		x		stamp %s
121850	short		0x155		Encore unsupported executable
12186>12	long		>0		not stripped
12187>22	short		>0		- version %d
12188>22	short		0		-
12189#>4	date		x		stamp %s
12190
12191#------------------------------------------------------------------------------
12192# $File: epoc,v 1.9 2013/12/21 14:28:15 christos Exp $
12193# EPOC : file(1) magic for EPOC documents [Psion Series 5/Osaris/Geofox 1]
12194# Stefan Praszalowicz <hpicollo@worldnet.fr> and Peter Breitenlohner <peb@mppmu.mpg.de>
12195# Useful information for improving this file can be found at:
12196# http://software.frodo.looijaard.name/psiconv/formats/Index.html
12197#------------------------------------------------------------------------------
121980	lelong		0x10000037	Psion Series 5
12199>4	lelong		0x10000039	font file
12200>4	lelong		0x1000003A	printer driver
12201>4	lelong		0x1000003B	clipboard
12202>4	lelong		0x10000042	multi-bitmap image
12203!:mime image/x-epoc-mbm
12204>4	lelong		0x1000006A	application information file
12205>4	lelong		0x1000006D
12206>>8	lelong		0x1000007D	Sketch image
12207!:mime image/x-epoc-sketch
12208>>8	lelong		0x1000007E	voice note
12209>>8	lelong		0x1000007F	Word file
12210!:mime application/x-epoc-word
12211>>8	lelong		0x10000085	OPL program (TextEd)
12212!:mime application/x-epoc-opl
12213>>8	lelong		0x10000087	Comms settings
12214>>8	lelong		0x10000088	Sheet file
12215!:mime application/x-epoc-sheet
12216>>8	lelong		0x100001C4	EasyFax initialisation file
12217>4	lelong		0x10000073	OPO module
12218!:mime application/x-epoc-opo
12219>4	lelong		0x10000074	OPL application
12220!:mime application/x-epoc-app
12221>4	lelong		0x1000008A	exported multi-bitmap image
12222>4	lelong		0x1000016D
12223>>8	lelong		0x10000087	Comms names
12224
122250	lelong		0x10000041	Psion Series 5 ROM multi-bitmap image
12226
122270	lelong		0x10000050	Psion Series 5
12228>4	lelong		0x1000006D	database
12229>>8	lelong		0x10000084	Agenda file
12230!:mime application/x-epoc-agenda
12231>>8	lelong		0x10000086	Data file
12232!:mime application/x-epoc-data
12233>>8	lelong		0x10000CEA	Jotter file
12234!:mime application/x-epoc-jotter
12235>4	lelong		0x100000E4	ini file
12236
122370	lelong		0x10000079	Psion Series 5 binary:
12238>4	lelong		0x00000000	DLL
12239>4	lelong		0x10000049	comms hardware library
12240>4	lelong		0x1000004A	comms protocol library
12241>4	lelong		0x1000005D	OPX
12242>4	lelong		0x1000006C	application
12243>4	lelong		0x1000008D	DLL
12244>4	lelong		0x100000AC	logical device driver
12245>4	lelong		0x100000AD	physical device driver
12246>4	lelong		0x100000E5	file transfer protocol
12247>4	lelong		0x100000E5	file transfer protocol
12248>4	lelong		0x10000140	printer definition
12249>4	lelong		0x10000141	printer definition
12250
122510	lelong		0x1000007A	Psion Series 5 executable
12252
12253#------------------------------------------------------------------------------
12254# $File: erlang,v 1.7 2019/04/19 00:42:27 christos Exp $
12255# erlang:  file(1) magic for Erlang JAM and BEAM files
12256# URL:  https://www.erlang.org/faq/x779.html#AEN812
12257
12258# OTP R3-R4
122590	string	\0177BEAM!	Old Erlang BEAM file
12260>6	short	>0		- version %d
12261
12262# OTP R5 and onwards
122630	string	FOR1
12264>8	string	BEAM		Erlang BEAM file
12265
12266# 4.2 version may have a copyright notice!
122674	string	Tue\ Jan\ 22\ 14:32:44\ MET\ 1991	Erlang JAM file - version 4.2
1226879	string	Tue\ Jan\ 22\ 14:32:44\ MET\ 1991	Erlang JAM file - version 4.2
12269
122704	string	1.0\ Fri\ Feb\ 3\ 09:55:56\ MET\ 1995	Erlang JAM file - version 4.3
12271
122720	bequad	0x0000000000ABCDEF	Erlang DETS file
12273
12274# $File: espressif,v 1.3 2021/04/26 15:56:00 christos Exp $
12275# configuration dump of Tasmota firmware for ESP8266 based devices by Espressif
12276# URL: https://github.com/arendst/Sonoff-Tasmota/
12277# Reference: https://codeload.github.com/arendst/Sonoff-Tasmota/zip/release-6.2/
12278# Sonoff-Tasmota-release-6.2.zip/Sonoff-Tasmota-release-6.2/sonoff/settings.h
12279# From: Joerg Jenderek
12280#
12281# cfg_holder=4617=0x1209
122820		uleshort	4617
12283# remaining settings normally 0x5A+offset XORed; free_1D5[20] empty since 5.12.0e
12284>0x1D5		ubequad		0x2f30313233343536	configuration of Tasmota firmware (ESP8266)
12285!:mime	application/x-tasmota-dmp
12286!:ext	dmp
12287# version like 6.2.1.0 ~ 0x06020100 XORed to 0x63666262
12288>>11		ubyte^0x65	x			\b, version %u
12289>>10		ubyte^0x64	x			\b.%u
12290>>9		ubyte^0x63	x			\b.%u
12291>>8		ubyte^0x62	x			\b.%u
12292#>8		ubelong		x			(%#x)
12293# hostname[33] XORed
12294>>0x165		ubyte^0x1BF	x			\b, hostname %c
12295>>0x166		ubyte^0x1C0	>037			\b%c
12296>>0x167		ubyte^0x1C1	>037			\b%c
12297>>0x168		ubyte^0x1C2	>037			\b%c
12298>>0x169		ubyte^0x1C3	>037			\b%c
12299>>0x16A		ubyte^0x1C4	>037			\b%c
12300>>0x16B		ubyte^0x1C5	>037			\b%c
12301>>0x16C		ubyte^0x1C6	>037			\b%c
12302>>0x16D		ubyte^0x1C7	>037			\b%c
12303>>0x16E		ubyte^0x1C8	>037			\b%c
12304>>0x16F		ubyte^0x1C9	>037			\b%c
12305>>0x170		ubyte^0x1CA	>037			\b%c
12306>>0x171		ubyte^0x1CB	>037			\b%c
12307>>0x172		ubyte^0x1CC 	>037			\b%c
12308>>0x173		ubyte^0x1CD	>037			\b%c
12309>>0x174		ubyte^0x1CE	>037			\b%c
12310>>0x175		ubyte^0x1CF	>037			\b%c
12311>>0x176		ubyte^0x1D0	>037			\b%c
12312>>0x177		ubyte^0x1D1	>037			\b%c
12313>>0x178		ubyte^0x1D2	>037			\b%c
12314>>0x179		ubyte^0x1D3	>037			\b%c
12315>>0x17A		ubyte^0x1D4	>037			\b%c
12316>>0x17B		ubyte^0x1D5	>037			\b%c
12317>>0x17C		ubyte^0x1D6	>037			\b%c
12318>>0x17D		ubyte^0x1D7	>037			\b%c
12319>>0x17E		ubyte^0x1D8	>037			\b%c
12320>>0x17F		ubyte^0x1D9	>037			\b%c
12321>>0x180		ubyte^0x1DA	>037			\b%c
12322>>0x181		ubyte^0x1DB	>037			\b%c
12323>>0x182		ubyte^0x1DC	>037			\b%c
12324>>0x183		ubyte^0x1DD	>037			\b%c
12325>>0x184		ubyte^0x1DE	>037			\b%c
12326>>0x185		ubyte^0x1DF	>037			\b%c
12327#>>0x165		string		x			(%.33s)
12328
12329
12330
12331#------------------------------------------------------------------------------
12332# $File: esri,v 1.5 2019/04/19 00:42:27 christos Exp $
12333# ESRI Shapefile format (.shp .shx .dbf=DBaseIII)
12334# Based on info from
12335# <URL:https://www.esri.com/library/whitepapers/pdfs/shapefile.pdf>
123360	belong	9994	ESRI Shapefile
12337>4	belong	=0
12338>8	belong	=0
12339>12	belong	=0
12340>16	belong	=0
12341>20	belong	=0
12342>28	lelong	x	version %d
12343>24	belong	x	length %d
12344>32	lelong	=0	type Null Shape
12345>32	lelong	=1	type Point
12346>32	lelong	=3	type PolyLine
12347>32	lelong	=5	type Polygon
12348>32	lelong	=8	type MultiPoint
12349>32	lelong	=11	type PointZ
12350>32	lelong	=13	type PolyLineZ
12351>32	lelong	=15	type PolygonZ
12352>32	lelong	=18	type MultiPointZ
12353>32	lelong	=21	type PointM
12354>32	lelong	=23	type PolyLineM
12355>32	lelong	=25	type PolygonM
12356>32	lelong	=28	type MultiPointM
12357>32	lelong	=31	type MultiPatch
12358
12359#------------------------------------------------------------------------------
12360# $File: fcs,v 1.4 2009/09/19 16:28:09 christos Exp $
12361# fcs: file(1) magic for FCS (Flow Cytometry Standard) data files
12362# From Roger Leigh <roger@whinlatter.uklinux.net>
123630       string          FCS1.0          Flow Cytometry Standard (FCS) data, version 1.0
123640       string          FCS2.0          Flow Cytometry Standard (FCS) data, version 2.0
123650       string          FCS3.0          Flow Cytometry Standard (FCS) data, version 3.0
12366
12367#------------------------------------------------------------------------------
12368# $File: filesystems,v 1.150 2022/07/04 16:40:33 christos Exp $
12369# filesystems:  file(1) magic for different filesystems
12370#
123710	name	partid
12372>0	ubyte	0x00	Unused
12373>0	ubyte	0x01	12-bit FAT
12374>0	ubyte	0x02	XENIX /
12375>0	ubyte	0x03	XENIX /usr
12376>0	ubyte	0x04	16-bit FAT, less than 32M
12377>0	ubyte	0x05	extended partition
12378>0	ubyte	0x06	16-bit FAT, more than 32M
12379>0	ubyte	0x07	OS/2 HPFS, NTFS, QNX2, Adv. UNIX
12380>0	ubyte	0x08	AIX or os, or etc.
12381>0	ubyte	0x09	AIX boot partition or Coherent
12382>0	ubyte	0x0a	O/2 boot manager or Coherent swap
12383>0	ubyte	0x0b	32-bit FAT
12384>0	ubyte	0x0c	32-bit FAT, LBA-mapped
12385>0	ubyte	0x0d	7XXX, LBA-mapped
12386>0	ubyte	0x0e	16-bit FAT, LBA-mapped
12387>0	ubyte	0x0f	extended partition, LBA-mapped
12388>0	ubyte	0x10	OPUS
12389>0	ubyte	0x11 	OS/2 DOS 12-bit FAT
12390>0	ubyte	0x12 	Compaq diagnostics
12391>0	ubyte	0x14 	OS/2 DOS 16-bit FAT <32M
12392>0	ubyte	0x16 	OS/2 DOS 16-bit FAT >=32M
12393>0	ubyte	0x17 	OS/2 hidden IFS
12394>0	ubyte	0x18 	AST Windows swapfile
12395>0	ubyte	0x19 	Willowtech Photon coS
12396>0	ubyte	0x1b 	hidden win95 fat 32
12397>0	ubyte	0x1c 	hidden win95 fat 32 lba
12398>0	ubyte	0x1d	hidden win95 fat 16 lba
12399>0	ubyte	0x20 	Willowsoft OFS1
12400>0	ubyte	0x21 	reserved
12401>0	ubyte	0x23 	reserved
12402>0	ubyte	0x24	NEC DOS
12403>0	ubyte	0x26 	reserved
12404>0	ubyte	0x31 	reserved
12405>0	ubyte	0x32	Alien Internet Services NOS
12406>0	ubyte	0x33 	reserved
12407>0	ubyte	0x34 	reserved
12408>0	ubyte	0x35 	JFS on OS2
12409>0	ubyte	0x36 	reserved
12410>0	ubyte	0x38 	Theos
12411>0	ubyte	0x39 	Plan 9, or Theos spanned
12412>0	ubyte	0x3a 	Theos ver 4 4gb partition
12413>0	ubyte	0x3b 	Theos ve 4 extended partition
12414>0	ubyte	0x3c 	PartitionMagic recovery
12415>0	ubyte	0x3d 	Hidden Netware
12416>0	ubyte	0x40 	VENIX 286 or LynxOS
12417>0	ubyte	0x41	PReP
12418>0	ubyte	0x42	linux swap sharing DRDOS disk
12419>0	ubyte	0x43	linux sharing DRDOS disk
12420>0	ubyte	0x44	GoBack change utility
12421>0	ubyte	0x45	Boot US Boot manager
12422>0	ubyte	0x46	EUMEL/Elan or Ergos 3
12423>0	ubyte	0x47	EUMEL/Elan or Ergos 3
12424>0	ubyte	0x48	EUMEL/Elan or Ergos 3
12425>0	ubyte	0x4a	ALFX/THIN filesystem for DOS
12426>0	ubyte	0x4c	Oberon partition
12427>0	ubyte	0x4d 	QNX4.x
12428>0	ubyte	0x4e 	QNX4.x 2nd part
12429>0	ubyte	0x4f 	QNX4.x 3rd part
12430>0	ubyte	0x50 	DM (disk manager)
12431>0	ubyte	0x51 	DM6 Aux1 (or Novell)
12432>0	ubyte	0x52 	CP/M or Microport SysV/AT
12433>0	ubyte	0x53 	DM6 Aux3
12434>0	ubyte	0x54	DM6 DDO
12435>0	ubyte	0x55	EZ-Drive (disk manager)
12436>0	ubyte	0x56	Golden Bow (disk manager)
12437>0	ubyte	0x57	Drive PRO
12438>0	ubyte	0x5c	Priam Edisk (disk manager)
12439>0	ubyte	0x61	SpeedStor
12440>0	ubyte	0x63	GNU HURD or Mach or Sys V/386
12441>0	ubyte	0x64	Novell Netware 2.xx or Speedstore
12442>0	ubyte	0x65	Novell Netware 3.xx
12443>0	ubyte	0x66	Novell 386 Netware
12444>0	ubyte	0x67	Novell
12445>0	ubyte	0x68	Novell
12446>0	ubyte	0x69	Novell
12447>0	ubyte	0x70	DiskSecure Multi-Boot
12448>0	ubyte	0x71	reserved
12449>0	ubyte	0x73	reserved
12450>0	ubyte	0x74	reserved
12451>0	ubyte	0x75	PC/IX
12452>0	ubyte	0x76	reserved
12453>0	ubyte	0x77	M2FS/M2CS partition
12454>0	ubyte	0x78	XOSL boot loader filesystem
12455>0	ubyte	0x80	MINIX until 1.4a
12456>0	ubyte	0x81	MINIX since 1.4b
12457>0	ubyte	0x82	Linux swap or Solaris
12458>0	ubyte	0x83	Linux native
12459>0	ubyte	0x84	OS/2 hidden C: drive
12460>0	ubyte	0x85	Linux extended partition
12461>0	ubyte	0x86	NT FAT volume set
12462>0	ubyte	0x87	NTFS volume set or HPFS mirrored
12463>0	ubyte	0x8a	Linux Kernel AiR-BOOT partition
12464>0	ubyte	0x8b	Legacy Fault tolerant FAT32
12465>0	ubyte	0x8c	Legacy Fault tolerant FAT32 ext
12466>0	ubyte	0x8d	Hidden free FDISK FAT12
12467>0	ubyte	0x8e	Linux Logical Volume Manager
12468>0	ubyte	0x90	Hidden free FDISK FAT16
12469>0	ubyte	0x91	Hidden free FDISK DOS EXT
12470>0	ubyte	0x92	Hidden free FDISK FAT16 Big
12471>0	ubyte	0x93	Amoeba filesystem
12472>0	ubyte	0x94	Amoeba bad block table
12473>0	ubyte	0x95	MIT EXOPC native partitions
12474>0	ubyte	0x97	Hidden free FDISK FAT32
12475>0	ubyte	0x98	Datalight ROM-DOS Super-Boot
12476>0	ubyte	0x99	Mylex EISA SCSI
12477>0	ubyte	0x9a	Hidden free FDISK FAT16 LBA
12478>0	ubyte	0x9b	Hidden free FDISK EXT LBA
12479>0	ubyte	0x9f	BSDI?
12480>0	ubyte	0xa0	IBM Thinkpad hibernation
12481>0	ubyte	0xa1	HP Volume expansion (SpeedStor)
12482>0	ubyte	0xa3	HP Volume expansion (SpeedStor)
12483>0	ubyte	0xa4	HP Volume expansion (SpeedStor)
12484>0	ubyte	0xa5	386BSD partition type
12485>0	ubyte	0xa6	OpenBSD partition type
12486>0	ubyte	0xa7	NeXTSTEP 486
12487>0	ubyte	0xa8	Apple UFS
12488>0	ubyte	0xa9	NetBSD partition type
12489>0	ubyte	0xaa	Olivetty Fat12 1.44MB Service part
12490>0	ubyte	0xab	Apple Boot
12491>0	ubyte	0xae	SHAG OS filesystem
12492>0	ubyte	0xaf	Apple HFS
12493>0	ubyte	0xb0	BootStar Dummy
12494>0	ubyte	0xb1	reserved
12495>0	ubyte	0xb3	reserved
12496>0	ubyte	0xb4	reserved
12497>0	ubyte	0xb6	reserved
12498>0	ubyte	0xb7	BSDI BSD/386 filesystem
12499>0	ubyte	0xb8	BSDI BSD/386 swap
12500>0	ubyte	0xbb	Boot Wizard Hidden
12501>0	ubyte	0xbe	Solaris 8 partition type
12502>0	ubyte	0xbf	Solaris partition type
12503>0	ubyte	0xc0 	CTOS
12504>0	ubyte	0xc1 	DRDOS/sec (FAT-12)
12505>0	ubyte	0xc2 	Hidden Linux
12506>0	ubyte	0xc3 	Hidden Linux swap
12507>0	ubyte	0xc4 	DRDOS/sec (FAT-16, < 32M)
12508>0	ubyte	0xc5 	DRDOS/sec (EXT)
12509>0	ubyte	0xc6 	DRDOS/sec (FAT-16, >= 32M)
12510>0	ubyte	0xc7 	Syrinx (Cyrnix?) or HPFS disabled
12511>0	ubyte	0xc8 	Reserved for DR-DOS 8.0+
12512>0	ubyte	0xc9 	Reserved for DR-DOS 8.0+
12513>0	ubyte	0xca 	Reserved for DR-DOS 8.0+
12514>0	ubyte	0xcb 	DR-DOS 7.04+ Secured FAT32 CHS
12515>0	ubyte	0xcc 	DR-DOS 7.04+ Secured FAT32 LBA
12516>0	ubyte	0xcd	CTOS Memdump
12517>0	ubyte	0xce 	DR-DOS 7.04+ FAT16X LBA
12518>0	ubyte	0xcf 	DR-DOS 7.04+ EXT LBA
12519>0	ubyte	0xd0 	REAL/32 secure big partition
12520>0	ubyte	0xd1 	Old Multiuser DOS FAT12
12521>0	ubyte	0xd4 	Old Multiuser DOS FAT16 Small
12522>0	ubyte	0xd5 	Old Multiuser DOS Extended
12523>0	ubyte	0xd6 	Old Multiuser DOS FAT16 Big
12524>0	ubyte	0xd8 	CP/M 86
12525>0	ubyte	0xdb 	CP/M or Concurrent CP/M
12526>0	ubyte	0xdd 	Hidden CTOS Memdump
12527>0	ubyte	0xde 	Dell PowerEdge Server utilities
12528>0	ubyte	0xdf 	DG/UX virtual disk manager
12529>0	ubyte	0xe0 	STMicroelectronics ST AVFS
12530>0	ubyte	0xe1 	DOS access or SpeedStor 12-bit
12531>0	ubyte	0xe3 	DOS R/O or Storage Dimensions
12532>0	ubyte	0xe4 	SpeedStor 16-bit FAT < 1024 cyl.
12533>0	ubyte	0xe5	reserved
12534>0	ubyte	0xe6	reserved
12535>0	ubyte	0xeb 	BeOS
12536>0	ubyte	0xee	GPT Protective MBR
12537>0	ubyte	0xef	EFI system partition
12538>0	ubyte	0xf0 	Linux PA-RISC boot loader
12539>0	ubyte	0xf1 	SpeedStor or Storage Dimensions
12540>0	ubyte	0xf2 	DOS 3.3+ Secondary
12541>0	ubyte	0xf3	reserved
12542>0	ubyte	0xf4	SpeedStor large partition
12543>0	ubyte	0xf5	Prologue multi-volumen partition
12544>0	ubyte	0xf6 	reserved
12545>0	ubyte	0xf9 	pCache: ext2/ext3 persistent cache
12546>0	ubyte	0xfa 	Bochs x86 emulator
12547>0	ubyte	0xfb 	VMware File System
12548>0	ubyte	0xfc 	VMware Swap
12549>0	ubyte	0xfd 	Linux RAID partition persistent sb
12550>0	ubyte	0xfe	LANstep or IBM PS/2 IML
12551>0	ubyte	0xff 	Xenix Bad Block Table
12552
125530	string	\366\366\366\366	PC formatted floppy with no filesystem
12554# Sun disk labels
12555# From /usr/include/sun/dklabel.h:
125560774	beshort		0xdabe
12557# modified by Joerg Jenderek, because original test
12558# succeeds for Cabinet archive dao360.dl_ with negative blocks
12559>0770	long		>0		Sun disk label
12560>>0	string		x		'%s
12561>>>31	string		>\0		\b%s
12562>>>>63	string		>\0		\b%s
12563>>>>>95	string		>\0		\b%s
12564>>0	string		x		\b'
12565>>0734	short		>0		%d rpm,
12566>>0736	short		>0		%d phys cys,
12567>>0740	short		>0		%d alts/cyl,
12568>>0746	short		>0		%d interleave,
12569>>0750	short		>0		%d data cyls,
12570>>0752	short		>0		%d alt cyls,
12571>>0754	short		>0		%d heads/partition,
12572>>0756	short		>0		%d sectors/track,
12573>>0764	long		>0		start cyl %d,
12574>>0770	long		x		%d blocks
12575# Is there a boot block written 1 sector in?
12576>512    belong&077777777	0600407	\b, boot block present
12577
12578# Joerg Jenderek: Smart Boot Manager backup file is 25 (MSDOS) or 41 (LINUX) byte header + first sectors of disk
12579# (http://btmgr.sourceforge.net/docs/user-guide-3.html)
125800		string	SBMBAKUP_	Smart Boot Manager backup file
12581>9		string	x		\b, version %-5.5s
12582>>14		string	=_
12583>>>15		string	x		%-.1s
12584>>>>16		string	=_		\b.
12585>>>>>17		string	x		\b%-.1s
12586>>>>>>18	string	=_		\b.
12587>>>>>>>19	string	x		\b%-.1s
12588>>>22		ubyte	0
12589>>>>21		ubyte	x		\b, from drive %#x
12590>>>22		ubyte	>0
12591>>>>21		string	x		\b, from drive %s
12592>>>535		search/17	\x55\xAA
12593>>>>&-512	indirect	x	\b; contains
12594
12595# updated by Joerg Jenderek at Nov 2012
12596# DOS Emulator image is 128 byte, null right padded header + harddisc image
125970	string	DOSEMU\0
12598>0x27E	leshort	0xAA55
12599#offset is 128
12600>>19	ubyte	128
12601>>>(19.b-1)	ubyte	0x0	DOS Emulator image
12602>>>>7	ulelong	>0		\b, %u heads
12603>>>>11	ulelong	>0		\b, %d sectors/track
12604>>>>15	ulelong	>0		\b, %d cylinders
12605>>>>128	indirect	x	\b; contains
12606
12607# added by Joerg Jenderek at Nov 2012
12608# http://www.thenakedpc.com/articles/v04/08/0408-05.html
12609# Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data
126100	string	PNCIHISK\0		Norton Utilities disc image data
12611# real x86 boot sector with jump instruction
12612>509	search/1026	\x55\xAA\xeb
12613>>&-1	indirect	x		\b; contains
12614# http://file-extension.net/seeker/file_extension_dat
126150	string	PNCIUNDO		Norton Disk Doctor UnDo file
12616#
12617
12618# DOS/MBR boot sector updated by Joerg Jenderek at Sep 2007,May 2011,2013
12619# for any allowed sector sizes
1262030		search/481	\x55\xAA
12621# to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111)
12622# DOS BPB information (70) and after DOS floppy (120) like in previous file version
12623!:strength +65
12624# for sector sizes < 512 Bytes
12625>11		uleshort	<512
12626>>(11.s-2)	uleshort	0xAA55		DOS/MBR boot sector
12627# for sector sizes with 512 or more Bytes
12628>0x1FE		leshort		0xAA55		DOS/MBR boot sector
12629
12630# ExFAT
126313		string/w	=EXFAT
12632>0x1FE		leshort		0xAA55
12633>>0x6E		ubyte		1
12634>>>0x6F		ubyte		0x80
12635>>>0		ubyte		0xEB	DOS/MBR boot sector,
12636>>>0x69		ubyte		x	ExFAT Filesystem version %d.
12637>>>0x68		ubyte		x	\b%d
12638>>>0x6d		ubyte		x	\b, (1<<%d) sectors per cluster
12639>>>0x48		ulequad		x	\b, sectors %lld
12640>>>0x64		ulelong		x	\b, serial number %#x
12641
12642# keep old DOS/MBR boot sector as dummy for mbr and bootloader displaying
12643# only for sector sizes with 512 or more Bytes
126440x1FE          leshort         0xAA55         	DOS/MBR boot sector
12645#
12646# to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version
12647!:strength +65
12648>2		string		OSBS		OS/BS MBR
12649# added by Joerg Jenderek at Feb 2013 according to https://thestarman.pcministry.com/asm/mbr/
12650# and https://en.wikipedia.org/wiki/Master_Boot_Record
12651# test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by
12652# characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00
12653>0	search/2	\x33\xc0\x8e\xd0\xbc\x00\x7c	MS-MBR
12654# Microsoft Windows 95A and early ( https://thestarman.pcministry.com/asm/mbr/STDMBR.htm )
12655# assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld
12656>>8	ubequad		0x8bf45007501ffbfc
12657# https://thestarman.pcministry.com/asm/mbr/200MBR.htm
12658>>>0x16	ubyte		0xF3				\b,DOS 2
12659>>>>219	regex		Author\ -\ 			Author:
12660# found "David Litton" , "A Pehrsson  "
12661>>>>>&0	string		x				"%s"
12662>>>0x16	ubyte		0xF2
12663# NEC MS-DOS 3.30 Rev. 3 . See https://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm
12664# assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz
12665>>>>0x22	ubequad	0xbf7c07813d5aa575		\b,NEC 3.3
12666# version MS-DOS 3.30 til MS-Windows 95A (WinVer=4.00.1111)
12667>>>>0x22	default	x				\b,D0S version 3.3-7.0
12668# error messages are printed by assembler instructions: mov si,06nn;...;int 10 (0xBEnn06;...)
12669# where nn is string offset varying for different languages
12670# "Invalid partition table"				nn=0x8b for english version
12671>>>>>(0x49.b)	string		Invalid\ partition\ table		english
12672>>>>>(0x49.b)	string		Ung\201ltige\ Partitionstabelle		german
12673>>>>>(0x49.b)	string		Table\ de\ partition\ invalide		french
12674>>>>>(0x49.b)	string		Tabela\ de\ parti\207ao\ inv\240lida	portuguese
12675>>>>>(0x49.b)	string		Tabla\ de\ partici\242n\ no\ v\240lida	spanish
12676>>>>>(0x49.b)	string		Tavola\ delle\ partizioni\ non\ valida	italian
12677>>>>>0x49	ubyte		>0			at offset %#x
12678>>>>>>(0x49.b)	string		>\0			"%s"
12679# "Error loading operating system"			nn=0xa3 for english version
12680# "Fehler beim Laden des Betriebssystems"		nn=0xa7 for german version
12681# "Erreur en chargeant syst\212me d'exploitation"	nn=0xa7 for french version
12682# "Erro na inicializa\207ao do sistema operacional"	nn=0xa7 for portuguese Brazilian version
12683# "Error al cargar sistema operativo"			nn=0xa8 for spanish version
12684# "Errore durante il caricamento del sistema operativo"	nn=0xae for italian version
12685>>>>>0x74	ubyte		>0			at offset %#x
12686>>>>>>(0x74.b)	string		>\0			"%s"
12687# "Missing operating system"				nn=0xc2 for english version
12688# "Betriebssystem fehlt"				nn=0xcd for german version
12689# "Syst\212me d'exploitation absent"			nn=0xd2 for french version
12690# "Sistema operacional nao encontrado"			nn=0xd4 for portuguese Brazilian version
12691# "Falta sistema operativo"				nn=0xca for spanish version
12692# "Sistema operativo mancante"				nn=0xe2 for italian version
12693>>>>>0x79	ubyte		>0			at offset %#x
12694>>>>>>(0x79.b)	string		>\0			"%s"
12695# Microsoft Windows 95B to XP (https://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm)
12696# assembler instructions: push ax;pop es;push  ax;pop ds;cld;mov si,7c1b
12697>>8	ubequad		0x5007501ffcbe1b7c
12698# assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04
12699>>>24		ubequad	0xf3a4cbbebe07b104		9M
12700# "Invalid partition table"				nn=0x10F for english version
12701# "Ung\201ltige Partitionstabelle"				nn=0x10F for german version
12702# "Table de partition erron\202e"				nn=0x10F for french version
12703# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240"	nn=0x10F for russian version
12704>>>>(0x3C.b+0x0FF)	string	Invalid\ partition\ table		english
12705>>>>(0x3C.b+0x0FF)	string	Ung\201ltige\ Partitionstabelle		german
12706>>>>(0x3C.b+0x0FF)	string	Table\ de\ partition\ erron\202e	french
12707>>>>(0x3C.b+0x0FF)	string	\215\245\257\340\240\242\250\253\354\255\240\357\ \342\240\241\253\250\346\240	russian
12708>>>>0x3C		ubyte	x			at offset %#x+0xFF
12709>>>>(0x3C.b+0x0FF)	string	>\0			"%s"
12710# "Error loading operating system"			nn=0x127 for english version
12711# "Fehler beim Laden des Betriebssystems"		nn=0x12b for german version
12712# "Erreur lors du chargement du syst\212me d'exploitation"	nn=0x12a for french version
12713# "\216\350\250\241\252\240 \257\340\250 \247\240\243\340\343\247\252\245 \256\257\245\340\240\346\250\256\255\255\256\251 \341\250\341\342\245\254\353"	nn=0x12d for russian version
12714>>>>0xBD		ubyte	x			at offset 0x1%x
12715>>>>(0xBD.b+0x100)	string	>\0			"%s"
12716# "Missing operating system"				nn=0x146 for english version
12717# "Betriebssystem fehlt"				nn=0x151 for german version
12718# "Syst\212me d'exploitation manquant"			nn=0x15e for french version
12719# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240"	nn=0x156 for russian version
12720>>>>0xA9		ubyte	x			at offset 0x1%x
12721>>>>(0xA9.b+0x100)	string	>\0			"%s"
12722# https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm
12723# assembler instructions: rep;movsb;retf;mov BP,07be;mov cl,04
12724>>>24		ubequad	0xf3a4cbbdbe07b104		XP
12725# where xxyyzz are lower bits from offsets of error messages varying for different languages
12726>>>>0x1B4	ubelong&0x00FFFFFF	0x002c4463	english
12727>>>>0x1B4	ubelong&0x00FFFFFF	0x002c486e	german
12728# "Invalid partition table"				xx=0x12C for english version
12729# "Ung\201ltige Partitionstabelle"				xx=0x12C for german version
12730>>>>0x1b5	ubyte		>0			at offset 0x1%x
12731>>>>(0x1b5.b+0x100)	string	>\0			"%s"
12732# "Error loading operating system"			yy=0x144 for english version
12733# "Fehler beim Laden des Betriebssystems"		yy=0x148 for german version
12734>>>>0x1b6	ubyte		>0			at offset 0x1%x
12735>>>>(0x1b6.b+0x100)	string	>\0			"%s"
12736# "Missing operating system"				zz=0x163 for english version
12737# "Betriebssystem nicht vorhanden"			zz=0x16e for german version
12738>>>>0x1b7	ubyte		>0			at offset 0x1%x
12739>>>>(0x1b7.b+0x100)	string	>\0			"%s"
12740# Microsoft Windows Vista or 7
12741# assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00
12742>>8	ubequad		0xc08ed8be007cbf00
12743# Microsoft Windows Vista (https://thestarman.pcministry.com/asm/mbr/VistaMBR.htm)
12744# assembler instructions: jnz 0729;cmp ebx,"TCPA"
12745>>>0xEC		ubequad	0x753b6681fb544350		Vista
12746# where xxyyzz are lower bits from offsets of error messages varying for different languages
12747>>>>0x1B4	ubelong&0x00FFFFFF	0x00627a99	english
12748#>>>>0x1B4	ubelong&0x00FFFFFF	?		german
12749# "Invalid partition table"				xx=0x162 for english version
12750# "Ung\201ltige Partitionstabelle"				xx=0x1?? for german version
12751>>>>0x1b5	ubyte		>0			at offset 0x1%x
12752>>>>(0x1b5.b+0x100)	string	>\0			"%s"
12753# "Error loading operating system"			yy=0x17a for english version
12754# "Fehler beim Laden des Betriebssystems"		yy= 0x1?? for german version
12755>>>>0x1b6	ubyte		>0			at offset 0x1%x
12756>>>>(0x1b6.b+0x100)	string	>\0			"%s"
12757# "Missing operating system"				zz=0x199 for english version
12758# "Betriebssystem nicht vorhanden"			zz=0x1?? for german version
12759>>>>0x1b7	ubyte		>0			at offset 0x1%x
12760>>>>(0x1b7.b+0x100)	string	>\0			"%s"
12761# Microsoft Windows 7 (https://thestarman.pcministry.com/asm/mbr/W7MBR.htm)
12762# assembler instructions: cmp ebx,"TCPA";cmp
12763>>>0xEC		ubequad	0x6681fb5443504175		Windows 7
12764# where xxyyzz are lower bits from offsets of error messages varying for different languages
12765>>>>0x1B4	ubelong&0x00FFFFFF	0x00637b9a	english
12766#>>>>0x1B4	ubelong&0x00FFFFFF	?		german
12767# "Invalid partition table"				xx=0x163 for english version
12768# "Ung\201ltige Partitionstabelle"				xx=0x1?? for german version
12769>>>>0x1b5	ubyte		>0			at offset 0x1%x
12770>>>>(0x1b5.b+0x100)	string	>\0			"%s"
12771# "Error loading operating system"			yy=0x17b for english version
12772# "Fehler beim Laden des Betriebssystems"		yy=0x1?? for german version
12773>>>>0x1b6	ubyte		>0			at offset 0x1%x
12774>>>>(0x1b6.b+0x100)	string	>\0			"%s"
12775# "Missing operating system"				zz=0x19a for english version
12776# "Betriebssystem nicht vorhanden"			zz=0x1?? for german version
12777>>>>0x1b7	ubyte		>0			at offset 0x1%x
12778>>>>(0x1b7.b+0x100)	string	>\0			"%s"
12779# https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs
12780# https://en.wikipedia.org/wiki/MBR_disk_signature#ID
12781>>0x1b8	ulelong		>0				\b, disk signature %#-.4x
12782# driveID/timestamp for Win 95B,98,98SE and ME. See https://thestarman.pcministry.com/asm/mbr/mystery.htm
12783>>0xDA	uleshort		0
12784>>>0xDC 	ulelong		>0			\b, created
12785# physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive
12786>>>>0xDC	ubyte		x			with driveID %#x
12787# hours, minutes and seconds
12788>>>>0xDf	ubyte		x			at %x
12789>>>>0xDe	ubyte		x			\b:%x
12790>>>>0xDd	ubyte		x			\b:%x
12791# special case for Microsoft MS-DOS 3.21 spanish
12792# assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov
12793>0	ubequad		0xfab830008ed0bc00
12794# assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov
12795>>8	ubequad		0x1fbfcb800008ed8		MS-MBR,D0S version 3.21 spanish
12796# Microsoft MBR IPL end
12797
12798# dr-dos with some upper-, lowercase variants
12799>0x9D	string	Invalid\ partition\ table$
12800>>181	string	No\ Operating\ System$
12801>>>201	string	Operating\ System\ load\ error$	\b, DR-DOS MBR, Version 7.01 to 7.03
12802>0x9D	string	Invalid\ partition\ table$
12803>>181	string	No\ operating\ system$
12804>>>201	string	Operating\ system\ load\ error$	\b, DR-DOS MBR, Version 7.01 to 7.03
12805>342	string	Invalid\ partition\ table$
12806>>366	string	No\ operating\ system$
12807>>>386	string	Operating\ system\ load\ error$	\b, DR-DOS MBR, version 7.01 to 7.03
12808>295	string	NEWLDR\0
12809>>302	string	Bad\ PT\ $
12810>>>310	string	No\ OS\ $
12811>>>>317	string	OS\ load\ err$
12812>>>>>329	string	Moved\ or\ missing\ IBMBIO.LDR\n\r
12813>>>>>>358	string	Press\ any\ key\ to\ continue.\n\r$
12814>>>>>>>387	string	Copyright\ (c)\ 1984,1998
12815>>>>>>>>411	string	Caldera\ Inc.\0		\b, DR-DOS MBR (IBMBIO.LDR)
12816#
12817# tests for different MS-DOS Master Boot Records (MBR) moved and merged
12818#
12819#>0x145	string	Default:\ F				\b, FREE-DOS MBR
12820#>0x14B	string	Default:\ F				\b, FREE-DOS 1.0 MBR
12821>0x145	search/7	Default:\ F			\b, FREE-DOS MBR
12822#>>313		string	F0\ .\ .\ .
12823#>>>322		string	disk\ 1
12824#>>>>382	string	FAT3
12825>64	string	no\ active\ partition\ found
12826>>96	string	read\ error\ while\ reading\ drive	\b, FREE-DOS Beta 0.9 MBR
12827# Ranish Partition Manager http://www.ranish.com/part/
12828>387	search/4	\0\ Error!\r
12829>>378	search/7	Virus!
12830>>>397	search/4	Booting\040
12831>>>>408	search/4	HD1/\0	 			\b, Ranish MBR (
12832>>>>>416	string	Writing\ changes...		\b2.37
12833>>>>>>438	ubyte		x			\b,%#x dots
12834>>>>>>440	ubyte		>0			\b,virus check
12835>>>>>>441	ubyte		>0			\b,partition %c
12836#2.38,2.42,2.44
12837>>>>>416	string	!Writing\ changes...		\b
12838>>>>>>418	ubyte	1				\bvirus check,
12839>>>>>>419	ubyte	x				\b%#x seconds
12840>>>>>>420	ubyte&0x0F	>0			\b,partition
12841>>>>>>>420	ubyte&0x0F	<5			\b %x
12842>>>>>>>420	ubyte&0x0F	0Xf			\b ask
12843>>>>>420	ubyte		x			\b)
12844#
12845# SYSLINUX MBR moved
12846# https://www.acronis.de/
12847>362	string	MBR\ Error\ \0\r
12848>>376	string	ress\ any\ key\ to\040
12849>>>392	string	boot\ from\ floppy...\0			\b, Acronis MBR
12850# added by Joerg Jenderek
12851# https://www.visopsys.org/
12852# https://partitionlogic.org.uk/
12853>309	string	No\ bootable\ partition\ found\r
12854>>339	string	I/O\ Error\ reading\ boot\ sector\r	\b, Visopsys MBR
12855>349	string	No\ bootable\ partition\ found\r
12856>>379	string	I/O\ Error\ reading\ boot\ sector\r	\b, simple Visopsys MBR
12857# bootloader, bootmanager
12858>0x40	string	SBML
12859# label with 11 characters of FAT 12 bit filesystem
12860>>43	string	SMART\ BTMGR
12861>>>430	string	SBMK\ Bad!\r			\b, Smart Boot Manager
12862# OEM-ID not always "SBM"
12863#>>>>3	strings	SBM
12864>>>>6	string	>\0                             \b, version %s
12865>382	string	XOSLLOADXCF			\b, eXtended Operating System Loader
12866>6	string	LILO				\b, LInux i386 boot LOader
12867>>120	string	LILO				\b, version 22.3.4 SuSe
12868>>172	string	LILO				\b, version 22.5.8 Debian
12869# updated by Joerg Jenderek at Oct 2008
12870# variables according to grub-0.97/stage1/stage1.S or
12871# https://www.gnu.org/software/grub/manual/grub.html#Embedded-data
12872# usual values are marked with comments to get only information of strange GRUB loaders
12873>342		search/60	\0Geom\0
12874#>0		ulelong		x		%x=0x009048EB ,	0x2a9048EB  0
12875>>0x41		ubyte		<2
12876>>>0x3E		ubyte		>2		\b; GRand Unified Bootloader
12877# 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90
12878>>>>0x3E	ubyte		x		\b, stage1 version %#x
12879#If it is 0xFF, use a drive passed by BIOS
12880>>>>0x40	ubyte		<0xFF		\b, boot drive %#x
12881# in most case 0,1,0x2e for GRUB 0.5.95
12882>>>>0x41	ubyte		>0		\b, LBA flag %#x
12883>>>>0x42	uleshort	<0x8000		\b, stage2 address %#x
12884#>>>>0x42	uleshort	=0x8000		\b, stage2 address %#x (usual)
12885>>>>0x42	uleshort	>0x8000		\b, stage2 address %#x
12886#>>>>0x44	ulelong		=1		\b, 1st sector stage2 %#x (default)
12887>>>>0x44	ulelong		>1		\b, 1st sector stage2 %#x
12888>>>>0x48	uleshort	<0x800		\b, stage2 segment %#x
12889#>>>>0x48	uleshort	=0x800		\b, stage2 segment %#x (usual)
12890>>>>0x48	uleshort	>0x800		\b, stage2 segment %#x
12891>>>>402		string	Geom\0Hard\ Disk\0Read\0\ Error\0
12892>>>>>394	string	stage1			\b, GRUB version 0.5.95
12893>>>>382		string	Geom\0Hard\ Disk\0Read\0\ Error\0
12894>>>>>376	string	GRUB\ \0		\b, GRUB version 0.93 or 1.94
12895>>>>383		string	Geom\0Hard\ Disk\0Read\0\ Error\0
12896>>>>>377	string	GRUB\ \0		\b, GRUB version 0.94
12897>>>>385		string	Geom\0Hard\ Disk\0Read\0\ Error\0
12898>>>>>379	string	GRUB\ \0		\b, GRUB version 0.95 or 0.96
12899>>>>391		string	Geom\0Hard\ Disk\0Read\0\ Error\0
12900>>>>>385	string	GRUB\ \0		\b, GRUB version 0.97
12901# unknown version
12902>>>343		string	Geom\0Read\0\ Error\0
12903>>>>321		string	Loading\ stage1.5	\b, GRUB version x.y
12904>>>380		string	Geom\0Hard\ Disk\0Read\0\ Error\0
12905>>>>374		string	GRUB\ \0		\b, GRUB version n.m
12906# SYSLINUX bootloader moved
12907>395	string	chksum\0\ ERROR!\0		\b, Gujin bootloader
12908# http://www.bcdwb.de/bcdw/index_e.htm
12909>3	string	BCDL
12910>>498	string	BCDL\ \ \ \ BIN			\b, Bootable CD Loader (1.50Z)
12911# mbr partition table entries updated by Joerg Jenderek at Sep 2013
12912# skip Norton Utilities disc image data
12913>3		string		!IHISK
12914# skip Linux style boot sector starting with assembler instructions mov 0x7c0,ax;
12915>>0		belong		!0xb8c0078e
12916# not Linux kernel
12917>>>514		string		!HdrS
12918# not BeOS
12919>>>>422		string		!Be\ Boot\ Loader
12920# jump over BPB instruction implies DOS bootsector or AdvanceMAME mbr
12921>>>>>0		ubelong&0xFD000000	=0xE9000000
12922# AdvanceMAME mbr
12923>>>>>>(1.b+2)	ubequad		0xfa31c08ed88ec08e
12924>>>>>>>446	use		partition-table
12925# mbr, Norton Utilities disc image data, or 2nd,etc. sector of x86 bootloader
12926>>>>>0		ubelong&0xFD000000	!0xE9000000
12927# skip FSInfosector
12928>>>>>>0		string		!RRaA
12929# skip 3rd sector of MS x86 bootloader with assembler instructions cli;MOVZX EAX,BYTE PTR [BP+10];MOV ECX,
12930# https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm
12931>>>>>>>0	ubequad		!0xfa660fb64610668b
12932# skip 13rd sector of MS x86 bootloader
12933>>>>>>>>0	ubequad		!0x660fb64610668b4e
12934# skip sector starting with DOS new line
12935>>>>>>>>>0	string		!\r\n
12936# allowed active flag 0,80h-FFh
12937>>>>>>>>>>446	ubyte		0
12938>>>>>>>>>>>446	use		partition-table
12939>>>>>>>>>>446	ubyte		>0x7F
12940>>>>>>>>>>>446	use		partition-table
12941# TODO: test for extended bootrecord (ebr) moved and merged with mbr partition table entries
12942# mbr partition table entries end
12943# https://www.acronis.de/
12944#FAT label=ACRONIS\ SZ
12945#OEM-ID=BOOTWIZ0
12946>442	string	Non-system\ disk,\040
12947>>459	string	press\ any\ key...\x7\0		\b, Acronis Startup Recovery Loader
12948# updated by Joerg Jenderek at Nov 2012, Sep 2013
12949# DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes
12950# display 1 space
12951>>>447	ubyte	x		\b
12952>>>477	use	DOS-filename
12953#
12954>185	string	FDBOOT\ Version\040
12955>>204	string	\rNo\ Systemdisk.\040
12956>>>220	string	Booting\ from\ harddisk.\n\r
12957>>>245	string	Cannot\ load\ from\ harddisk.\n\r
12958>>>>273 string	Insert\ Systemdisk\040
12959>>>>>291 string and\ press\ any\ key.\n\r		\b, FDBOOT harddisk Bootloader
12960>>>>>>200 string	>\0                             \b, version %-3s
12961>242	string	Bootsector\ from\ C.H.\ Hochst\204
12962# http://freecode.com/projects/dosfstools	dosfstools-n.m/src/mkdosfs.c
12963# updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string
12964# skip name "C.H. Hochstaetter" partly because it is sometimes written without umlaut
12965>242	search/127	Bootsector\ from\ C.H.\ Hochst
12966>>278	search/127	No\ Systemdisk.\ Booting\ from\ harddisk
12967# followed by variants with point,CR-NL or NL-CR
12968>>>208	search/261	Cannot\ load\ from\ harddisk.
12969# followed by variants CR-NL or NL-CR
12970>>>>236	search/235	Insert\ Systemdisk\ and\ press\ any\ key.
12971# followed by variants with point,CR-NL or NL-CR
12972>>>>>180	search/96	Disk\ formatted\ with\ WinImage\ 	\b, WinImage harddisk Bootloader
12973# followed by string like "6.50 (c) 1993-2004 Gilles Vollant"
12974>>>>>>&0	string		x 					\b, version %-4.4s
12975>(1.b+2)	ubyte		0xe
12976>>(1.b+3)	ubyte		0x1f
12977>>>(1.b+4)	ubyte		0xbe
12978# message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others
12979>>>>(1.b+5)	ubyte&0xd3	0x53
12980>>>>>(1.b+6)	ubyte		0x7c
12981# assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah,
12982>>>>>>(1.b+7)	ubyte		0xac
12983>>>>>>>(1.b+8)	ubyte		0x22
12984>>>>>>>>(1.b+9)	ubyte		0xc0
12985>>>>>>>>>(1.b+10)	ubyte	0x74
12986>>>>>>>>>>(1.b+11)	ubyte	0x0b
12987>>>>>>>>>>>(1.b+12)	ubyte	0x56
12988>>>>>>>>>>>>(1.b+13)	ubyte	0xb4			\b, mkdosfs boot message display
12989# FAT1X version
12990>>>>>>>>>>>>>(1.b+5)	ubyte	0x5b
12991>>>>>>>>>>>>>>0x5b	string	>\0			"%-s"
12992# FAT32 version
12993>>>>>>>>>>>>>(1.b+5)	ubyte	0x77
12994>>>>>>>>>>>>>>0x77	string	>\0			"%-s"
12995>214	string	Please\ try\ to\ install\ FreeDOS\ 	\b, DOS Emulator boot message display
12996#>>244	string	from\ dosemu-freedos-*-bin.tgz\r
12997#>>>170	string	Sorry,\ could\ not\ load\ an\040
12998#>>>>195	string	operating\ system.\r\n
12999#
13000>103	string	This\ is\ not\ a\ bootable\ disk.\040
13001>>132	string	Please\ insert\ a\ bootable\040
13002>>>157	string	floppy\ and\r\n
13003>>>>169	string	press\ any\ key\ to\ try\ again...\r	\b, FREE-DOS message display
13004#
13005>66	string	Solaris\ Boot\ Sector
13006>>99	string	Incomplete\ MDBoot\ load.
13007>>>89	string	Version 				\b, Sun Solaris Bootloader
13008>>>>97	byte	x					version %c
13009#
13010>408	string	OS/2\ !!\ SYS01475\r\0
13011>>429	string	OS/2\ !!\ SYS02025\r\0
13012>>>450	string	OS/2\ !!\ SYS02027\r\0
13013>>>469	string	OS2BOOT\ \ \ \ 				\b, IBM OS/2 Warp bootloader
13014#
13015>409	string	OS/2\ !!\ SYS01475\r\0
13016>>430	string	OS/2\ !!\ SYS02025\r\0
13017>>>451	string	OS/2\ !!\ SYS02027\r\0
13018>>>470	string	OS2BOOT\ \ \ \ 				\b, IBM OS/2 Warp Bootloader
13019>112		string	This\ disk\ is\ not\ bootable\r
13020>>142		string	If\ you\ wish\ to\ make\ it\ bootable
13021>>>176		string	run\ the\ DOS\ program\ SYS\040
13022>>>200		string	after\ the\r
13023>>>>216		string	system\ has\ been\ loaded\r\n
13024>>>>>242	string	Please\ insert\ a\ DOS\ diskette\040
13025>>>>>271	string	into\r\n\ the\ drive\ and\040
13026>>>>>>292	string	strike\ any\ key...\0		\b, IBM OS/2 Warp message display
13027# XP
13028>430	string	NTLDR\ is\ missing\xFF\r\n
13029>>449	string	Disk\ error\xFF\r\n
13030>>>462	string	Press\ any\ key\ to\ restart\r		\b, Microsoft Windows XP Bootloader
13031# DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes
13032>>>>417		ubyte&0xDF	>0
13033>>>>>417	string		x			%-.5s
13034>>>>>>422	ubyte&0xDF	>0
13035>>>>>>>422	string		x 			\b%-.3s
13036>>>>>425	ubyte&0xDF	>0
13037>>>>>>425	string		>\ 			\b.%-.3s
13038#
13039>>>>371		ubyte		>0x20
13040>>>>>368	ubyte&0xDF	>0
13041>>>>>>368	string		x 			%-.5s
13042>>>>>>>373	ubyte&0xDF	>0
13043>>>>>>>>373	string		x 			\b%-.3s
13044>>>>>>376	ubyte&0xDF	>0
13045>>>>>>>376	string		x 			\b.%-.3s
13046#
13047>430	string	NTLDR\ nicht\ gefunden\xFF\r\n
13048>>453	string	Datentr\204gerfehler\xFF\r\n
13049>>>473	string	Neustart\ mit\ beliebiger\ Taste\r	\b, Microsoft Windows XP Bootloader (german)
13050>>>>417		ubyte&0xDF	>0
13051>>>>>417	string		x			%-.5s
13052>>>>>>422	ubyte&0xDF	>0
13053>>>>>>>422	string		x 			\b%-.3s
13054>>>>>425	ubyte&0xDF	>0
13055>>>>>>425	string		>\ 			\b.%-.3s
13056# offset variant
13057>>>>379	string	\0
13058>>>>>368	ubyte&0xDF	>0
13059>>>>>>368	string		x 			%-.5s
13060>>>>>>>373	ubyte&0xDF	>0
13061>>>>>>>>373	string		x 			\b%-.3s
13062#
13063>430	string	NTLDR\ fehlt\xFF\r\n
13064>>444	string	Datentr\204gerfehler\xFF\r\n
13065>>>464	string	Neustart\ mit\ beliebiger\ Taste\r	\b, Microsoft Windows XP Bootloader (2.german)
13066>>>>417		ubyte&0xDF	>0
13067>>>>>417	string		x			%-.5s
13068>>>>>>422	ubyte&0xDF	>0
13069>>>>>>>422	string		x 			\b%-.3s
13070>>>>>425	ubyte&0xDF	>0
13071>>>>>>425	string		>\ 			\b.%-.3s
13072# variant
13073>>>>371		ubyte		>0x20
13074>>>>>368	ubyte&0xDF	>0
13075>>>>>>368	string		x 			%-.5s
13076>>>>>>>373	ubyte&0xDF	>0
13077>>>>>>>>373	string		x 			\b%-.3s
13078>>>>>>376	ubyte&0xDF	>0
13079>>>>>>>376	string		x 			\b.%-.3s
13080#
13081>430	string	NTLDR\ fehlt\xFF\r\n
13082>>444	string	Medienfehler\xFF\r\n
13083>>>459	string	Neustart:\ Taste\ dr\201cken\r		\b, Microsoft Windows XP Bootloader (3.german)
13084>>>>371		ubyte		>0x20
13085>>>>>368	ubyte&0xDF	>0
13086>>>>>>368	string		x 			%-.5s
13087>>>>>>>373	ubyte&0xDF	>0
13088>>>>>>>>373	string		x 			\b%-.3s
13089>>>>>>376	ubyte&0xDF	>0
13090>>>>>>>376	string		x 			\b.%-.3s
13091# variant
13092>>>>417		ubyte&0xDF	>0
13093>>>>>417	string		x			%-.5s
13094>>>>>>422	ubyte&0xDF	>0
13095>>>>>>>422	string		x 			\b%-.3s
13096>>>>>425	ubyte&0xDF	>0
13097>>>>>>425	string		>\ 			\b.%-.3s
13098#
13099>430	string	Datentr\204ger\ entfernen\xFF\r\n
13100>>454	string	Medienfehler\xFF\r\n
13101>>>469	string	Neustart:\ Taste\ dr\201cken\r		\b, Microsoft Windows XP Bootloader (4.german)
13102>>>>379		string		\0
13103>>>>>368	ubyte&0xDF	>0
13104>>>>>>368	string		x 			%-.5s
13105>>>>>>>373	ubyte&0xDF	>0
13106>>>>>>>>373	string		x 			\b%-.3s
13107>>>>>>376	ubyte&0xDF	>0
13108>>>>>>>376	string		x 			\b.%-.3s
13109# variant
13110>>>>417		ubyte&0xDF	>0
13111>>>>>417	string		x			%-.5s
13112>>>>>>422	ubyte&0xDF	>0
13113>>>>>>>422	string		x 			\b%-.3s
13114>>>>>425	ubyte&0xDF	>0
13115>>>>>>425	string		>\ 			\b.%-.3s
13116#
13117
13118#>3	string	NTFS\ \ \ \040
13119>389	string	Fehler\ beim\ Lesen\040
13120>>407	string	des\ Datentr\204gers
13121>>>426	string	NTLDR\ fehlt
13122>>>>440	string	NTLDR\ ist\ komprimiert
13123>>>>>464 string	Neustart\ mit\ Strg+Alt+Entf\r		\b, Microsoft Windows XP Bootloader NTFS (german)
13124#>3	string	NTFS\ \ \ \040
13125>313	string	A\ disk\ read\ error\ occurred.\r
13126>>345	string	A\ kernel\ file\ is\ missing\040
13127>>>370	string	from\ the\ disk.\r
13128>>>>484	string	NTLDR\ is\ compressed
13129>>>>>429 string	Insert\ a\ system\ diskette\040
13130>>>>>>454 string and\ restart\r\nthe\ system.\r		\b, Microsoft Windows XP Bootloader NTFS
13131# DOS loader variants different languages,offsets
13132>472	ubyte&0xDF	>0
13133>>389	string	Invalid\ system\ disk\xFF\r\n
13134>>>411	string	Disk\ I/O\ error
13135>>>>428	string	Replace\ the\ disk,\ and\040
13136>>>>>455 string	press\ any\ key				\b, Microsoft Windows 98 Bootloader
13137#IO.SYS
13138>>>>>>472	ubyte&0xDF	>0
13139>>>>>>>472	string		x 			\b %-.2s
13140>>>>>>>>474	ubyte&0xDF	>0
13141>>>>>>>>>474	string		x 			\b%-.5s
13142>>>>>>>>>>479	ubyte&0xDF	>0
13143>>>>>>>>>>>479 string		x 			\b%-.1s
13144>>>>>>>480	ubyte&0xDF	>0
13145>>>>>>>>480	string		x 			\b.%-.3s
13146#MSDOS.SYS
13147>>>>>>>483	ubyte&0xDF	>0			\b+
13148>>>>>>>>483	string		x 			\b%-.5s
13149>>>>>>>>>488	ubyte&0xDF	>0
13150>>>>>>>>>>488	string		x 			\b%-.3s
13151>>>>>>>>491	ubyte&0xDF	>0
13152>>>>>>>>>491	string		x 			\b.%-.3s
13153#
13154>>390	string	Invalid\ system\ disk\xFF\r\n
13155>>>412	string	Disk\ I/O\ error\xFF\r\n
13156>>>>429	string	Replace\ the\ disk,\ and\040
13157>>>>>451 string	then\ press\ any\ key\r			\b, Microsoft Windows 98 Bootloader
13158>>388	string	Ungueltiges\ System\ \xFF\r\n
13159>>>410	string	E/A-Fehler\ \ \ \ \xFF\r\n
13160>>>>427	string	Datentraeger\ wechseln\ und\040
13161>>>>>453 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (german)
13162#WINBOOT.SYS only not spaces (0xDF)
13163>>>>>>497	ubyte&0xDF	>0
13164>>>>>>>497	string		x 			%-.5s
13165>>>>>>>>502	ubyte&0xDF	>0
13166>>>>>>>>>502	string		x 			\b%-.1s
13167>>>>>>>>>>503	ubyte&0xDF	>0
13168>>>>>>>>>>>503	string		x 			\b%-.1s
13169>>>>>>>>>>>>504	ubyte&0xDF	>0
13170>>>>>>>>>>>>>504 string		x 			\b%-.1s
13171>>>>>>505	ubyte&0xDF	>0
13172>>>>>>>505	string		x 			\b.%-.3s
13173#IO.SYS
13174>>>>>>472	ubyte&0xDF	>0			or
13175>>>>>>>472	string		x 			\b %-.2s
13176>>>>>>>>474	ubyte&0xDF	>0
13177>>>>>>>>>474	string		x 			\b%-.5s
13178>>>>>>>>>>479	ubyte&0xDF	>0
13179>>>>>>>>>>>479 string		x 			\b%-.1s
13180>>>>>>>480	ubyte&0xDF	>0
13181>>>>>>>>480	string		x 			\b.%-.3s
13182#MSDOS.SYS
13183>>>>>>>483	ubyte&0xDF	>0			\b+
13184>>>>>>>>483	string		x 			\b%-.5s
13185>>>>>>>>>488	ubyte&0xDF	>0
13186>>>>>>>>>>488	string		x 			\b%-.3s
13187>>>>>>>>491	ubyte&0xDF	>0
13188>>>>>>>>>491	string		x 			\b.%-.3s
13189#
13190>>390	string	Ungueltiges\ System\ \xFF\r\n
13191>>>412	string	E/A-Fehler\ \ \ \ \xFF\r\n
13192>>>>429	string	Datentraeger\ wechseln\ und\040
13193>>>>>455 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (German)
13194#WINBOOT.SYS only not spaces (0xDF)
13195>>>>>>497	ubyte&0xDF	>0
13196>>>>>>>497	string		x 			%-.7s
13197>>>>>>>>504	ubyte&0xDF	>0
13198>>>>>>>>>504	string		x 			\b%-.1s
13199>>>>>>505	ubyte&0xDF	>0
13200>>>>>>>505	string		x 			\b.%-.3s
13201#IO.SYS
13202>>>>>>472	ubyte&0xDF	>0			or
13203>>>>>>>472	string		x 			\b %-.2s
13204>>>>>>>>474	ubyte&0xDF	>0
13205>>>>>>>>>474	string		x 			\b%-.6s
13206>>>>>>>480	ubyte&0xDF	>0
13207>>>>>>>>480	string		x 			\b.%-.3s
13208#MSDOS.SYS
13209>>>>>>>483	ubyte&0xDF	>0			\b+
13210>>>>>>>>483	string		x 			\b%-.5s
13211>>>>>>>>>488	ubyte&0xDF	>0
13212>>>>>>>>>>488	string		x 			\b%-.3s
13213>>>>>>>>491	ubyte&0xDF	>0
13214>>>>>>>>>491	string		x 			\b.%-.3s
13215#
13216>>389	string	Ungueltiges\ System\ \xFF\r\n
13217>>>411	string	E/A-Fehler\ \ \ \ \xFF\r\n
13218>>>>428	string	Datentraeger\ wechseln\ und\040
13219>>>>>454 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (GERMAN)
13220# DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes
13221>>>>>>472	string		x 			%-.2s
13222>>>>>>>474	ubyte&0xDF	>0
13223>>>>>>>>474	string		x 			\b%-.5s
13224>>>>>>>>479	ubyte&0xDF	>0
13225>>>>>>>>>479	string		x 			\b%-.1s
13226>>>>>>480	ubyte&0xDF	>0
13227>>>>>>>480	string		x 			\b.%-.3s
13228>>>>>>483	ubyte&0xDF	>0			\b+
13229>>>>>>>483	string		x 			\b%-.5s
13230>>>>>>>488	ubyte&0xDF	>0
13231>>>>>>>>488	string		x 			\b%-.2s
13232>>>>>>>>490	ubyte&0xDF	>0
13233>>>>>>>>>490	string		x 			\b%-.1s
13234>>>>>>>491	ubyte&0xDF	>0
13235>>>>>>>>491	string		x 			\b.%-.3s
13236>479	ubyte&0xDF	>0
13237>>416	string	Kein\ System\ oder\040
13238>>>433	string	Laufwerksfehler
13239>>>>450	string	Wechseln\ und\ Taste\ dr\201cken	\b, Microsoft DOS Bootloader (german)
13240#IO.SYS
13241>>>>>479	string		x 			\b %-.2s
13242>>>>>>481	ubyte&0xDF	>0
13243>>>>>>>481	string		x 			\b%-.6s
13244>>>>>487	ubyte&0xDF	>0
13245>>>>>>487	string		x 			\b.%-.3s
13246#MSDOS.SYS
13247>>>>>>490	ubyte&0xDF	>0			\b+
13248>>>>>>>490	string		x 			\b%-.5s
13249>>>>>>>>495	ubyte&0xDF	>0
13250>>>>>>>>>495	string		x 			\b%-.3s
13251>>>>>>>498	ubyte&0xDF	>0
13252>>>>>>>>498	string		x 			\b.%-.3s
13253#
13254>376	search/41	Non-System\ disk\ or\040
13255>>395	search/41	disk\ error\r
13256>>>407	search/41	Replace\ and\040
13257>>>>419	search/41	press\ 				\b,
13258>>>>419	search/41	strike\ 			\b, old
13259>>>>426	search/41	any\ key\ when\ ready\r		MS or PC-DOS bootloader
13260#449			Disk\ Boot\ failure\r		MS 3.21
13261#466			Boot\ Failure\r			MS 3.30
13262>>>>>468 search/18	\0
13263#IO.SYS,IBMBIO.COM
13264>>>>>>&0	string		x 			\b %-.2s
13265>>>>>>>&-20	ubyte&0xDF	>0
13266>>>>>>>>&-1	string		x 			\b%-.4s
13267>>>>>>>>>&-16	ubyte&0xDF	>0
13268>>>>>>>>>>&-1	string		x 			\b%-.2s
13269>>>>>>&8	ubyte&0xDF	>0			\b.
13270>>>>>>>&-1	string		x 			\b%-.3s
13271#MSDOS.SYS,IBMDOS.COM
13272>>>>>>&11	ubyte&0xDF	>0			\b+
13273>>>>>>>&-1	string		x 			\b%-.5s
13274>>>>>>>>&-6	ubyte&0xDF	>0
13275>>>>>>>>>&-1	string		x 			\b%-.1s
13276>>>>>>>>>>&-5	ubyte&0xDF	>0
13277>>>>>>>>>>>&-1	string		x 			\b%-.2s
13278>>>>>>>&7	ubyte&0xDF	>0			\b.
13279>>>>>>>>&-1	string		x 			\b%-.3s
13280>441	string	Cannot\ load\ from\ harddisk.\n\r
13281>>469	string	Insert\ Systemdisk\040
13282>>>487	string	and\ press\ any\ key.\n\r		\b, MS (2.11) DOS bootloader
13283#>43	string	\224R-LOADER\ \ SYS			=label
13284>54	string	SYS
13285>>324	string	VASKK
13286>>>495	string	NEWLDR\0				\b, DR-DOS Bootloader (LOADER.SYS)
13287#
13288>98	string	Press\ a\ key\ to\ retry\0\r
13289>>120	string	Cannot\ find\ file\ \0\r
13290>>>139	string	Disk\ read\ error\0\r
13291>>>>156	string	Loading\ ...\0				\b, DR-DOS (3.41) Bootloader
13292#DRBIOS.SYS
13293>>>>>44		ubyte&0xDF	>0
13294>>>>>>44	string		x			\b %-.6s
13295>>>>>>>50	ubyte&0xDF	>0
13296>>>>>>>>50	string		x 			\b%-.2s
13297>>>>>>52	ubyte&0xDF	>0
13298>>>>>>>52	string		x 			\b.%-.3s
13299#
13300>70	string	IBMBIO\ \ COM
13301>>472	string	Cannot\ load\ DOS!\040
13302>>>489	string	Any\ key\ to\ retry			\b, DR-DOS Bootloader
13303>>471	string	Cannot\ load\ DOS\040
13304>>487	string	press\ key\ to\ retry			\b, Open-DOS Bootloader
13305#??
13306>444	string	KERNEL\ \ SYS
13307>>314	string	BOOT\ error!				\b, FREE-DOS Bootloader
13308>499	string	KERNEL\ \ SYS
13309>>305	string	BOOT\ err!\0				\b, Free-DOS Bootloader
13310>449	string	KERNEL\ \ SYS
13311>>319	string	BOOT\ error!				\b, FREE-DOS 0.5 Bootloader
13312#
13313>449	string	Loading\ FreeDOS
13314>>0x1AF		ulelong		>0			\b, FREE-DOS 0.95,1.0 Bootloader
13315>>>497		ubyte&0xDF	>0
13316>>>>497		string		x 			\b %-.6s
13317>>>>>503	ubyte&0xDF	>0
13318>>>>>>503	string		x 			\b%-.1s
13319>>>>>>>504	ubyte&0xDF	>0
13320>>>>>>>>504	string		x 			\b%-.1s
13321>>>>505		ubyte&0xDF	>0
13322>>>>>505	string		x 			\b.%-.3s
13323#
13324>331	string	Error!.0				\b, FREE-DOS 1.0 bootloader
13325#
13326>125	string	Loading\ FreeDOS...\r
13327>>311	string	BOOT\ error!\r				\b, FREE-DOS bootloader
13328>>>441		ubyte&0xDF	>0
13329>>>>441		string		x 			\b %-.6s
13330>>>>>447	ubyte&0xDF	>0
13331>>>>>>447	string		x 			\b%-.1s
13332>>>>>>>448	ubyte&0xDF	>0
13333>>>>>>>>448	string		x 			\b%-.1s
13334>>>>449		ubyte&0xDF	>0
13335>>>>>449	string		x 			\b.%-.3s
13336>124	string	FreeDOS\0
13337>>331	string	\ err\0					\b, FREE-DOS BETa 0.9 Bootloader
13338# DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes
13339>>>497		ubyte&0xDF	>0
13340>>>>497		string		x 			\b %-.6s
13341>>>>>503	ubyte&0xDF	>0
13342>>>>>>503	string		x 			\b%-.1s
13343>>>>>>>504	ubyte&0xDF	>0
13344>>>>>>>>504	string		x 			\b%-.1s
13345>>>>505		ubyte&0xDF	>0
13346>>>>>505	string		x 			\b.%-.3s
13347>>333	string	\ err\0					\b, FREE-DOS BEta 0.9 Bootloader
13348>>>497		ubyte&0xDF	>0
13349>>>>497		string		x 			\b %-.6s
13350>>>>>503	ubyte&0xDF	>0
13351>>>>>>503	string		x 			\b%-.1s
13352>>>>>>>504	ubyte&0xDF	>0
13353>>>>>>>>504	string		x 			\b%-.1s
13354>>>>505		ubyte&0xDF	>0
13355>>>>>505	string		x 			\b.%-.3s
13356>>334	string	\ err\0					\b, FREE-DOS Beta 0.9 Bootloader
13357>>>497		ubyte&0xDF	>0
13358>>>>497		string		x 			\b %-.6s
13359>>>>>503	ubyte&0xDF	>0
13360>>>>>>503	string		x 			\b%-.1s
13361>>>>>>>504	ubyte&0xDF	>0
13362>>>>>>>>504	string		x 			\b%-.1s
13363>>>>505		ubyte&0xDF	>0
13364>>>>>505	string		x 			\b.%-.3s
13365>336	string	Error!\040
13366>>343	string	Hit\ a\ key\ to\ reboot.		\b, FREE-DOS Beta 0.9sr1 Bootloader
13367>>>497		ubyte&0xDF	>0
13368>>>>497		string		x 			\b %-.6s
13369>>>>>503	ubyte&0xDF	>0
13370>>>>>>503	string		x 			\b%-.1s
13371>>>>>>>504	ubyte&0xDF	>0
13372>>>>>>>>504	string		x 			\b%-.1s
13373>>>>505		ubyte&0xDF	>0
13374>>>>>505	string		x 			\b.%-.3s
13375# added by Joerg Jenderek
13376# https://www.visopsys.org/
13377# https://partitionlogic.org.uk/
13378# OEM-ID=Visopsys
13379>478		ulelong	0
13380>>(1.b+326)	string	I/O\ Error\ reading\040
13381>>>(1.b+344)	string	Visopsys\ loader\r
13382>>>>(1.b+361)	string	Press\ any\ key\ to\ continue.\r	\b, Visopsys loader
13383# http://alexfru.chat.ru/epm.html#bootprog
13384>494	ubyte	>0x4D
13385>>495	string	>E
13386>>>495	string	<S
13387#OEM-ID is not reliable
13388>>>>3	string	BootProg
13389# It just looks for a program file name at the root directory
13390# and loads corresponding file with following execution.
13391# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
13392>>>>499			ubyte&0xDF	>0		\b, COM/EXE Bootloader
13393>>>>>499		use		DOS-filename
13394#If the boot sector fails to read any other sector,
13395#it prints a very short message ("RE") to the screen and hangs the computer.
13396#If the boot sector fails to find needed program in the root directory,
13397#it also hangs with another message ("NF").
13398>>>>>492		string		RENF		\b, FAT (12 bit)
13399>>>>>495		string		RENF		\b, FAT (16 bit)
13400#If the boot sector fails to read any other sector,
13401#it prints a very short message ("RE") to the screen and hangs the computer.
13402# x86 bootloader end
13403
13404# added by Joerg Jenderek at Feb 2013 according to https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
13405# and https://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector
13406>0		string		RRaA
13407>>0x1E4		string		rrAa		\b, FSInfosector
13408#>>0x1FC	uleshort	=0		SHOULD BE ZERO
13409>>>0x1E8	ulelong		<0xffffffff	\b, %u free clusters
13410>>>0x1EC	ulelong		<0xffffffff	\b, last allocated cluster %u
13411
13412# updated by Joerg Jenderek at Sep 2007
13413>3	ubyte	0
13414#no active flag
13415>>446	ubyte	0
13416# partition 1 not empty
13417>>>450	ubyte	>0
13418# partitions 3,4 empty
13419>>>>482		ubyte	0
13420>>>>>498	ubyte	0
13421# partition 2 ID=0,5,15
13422>>>>>>466	ubyte	<0x10
13423>>>>>>>466	ubyte	0x05			\b, extended partition table
13424>>>>>>>466	ubyte	0x0F			\b, extended partition table (LBA)
13425>>>>>>>466	ubyte	0x0			\b, extended partition table (last)
13426
13427# DOS x86 sector separated and moved from "DOS/MBR boot sector" by Joerg Jenderek at May 2011
13428
13429>0x200	lelong	0x82564557		\b, BSD disklabel
13430
13431# by Joerg Jenderek at Apr 2013
13432#	Print the DOS filenames from directory entry form with 8 right space padded bytes + 3 bytes for extension
13433#	like IO.SYS. MSDOS.SYS , KERNEL.SYS , DRBIO.SYS
134340	name			DOS-filename
13435# space=0x20 (00100000b) means empty
13436>0			ubyte&0xDF	>0
13437>>0			ubyte		x 		\b%c
13438>>>1			ubyte&0xDF	>0
13439>>>>1			ubyte		x 		\b%c
13440>>>>>2			ubyte&0xDF	>0
13441>>>>>>2			ubyte		x 		\b%c
13442>>>>>>>3		ubyte&0xDF	>0
13443>>>>>>>>3		ubyte		x 		\b%c
13444>>>>>>>>>4		ubyte&0xDF	>0
13445>>>>>>>>>>4		ubyte		x 		\b%c
13446>>>>>>>>>>>5		ubyte&0xDF	>0
13447>>>>>>>>>>>>5		ubyte		x 		\b%c
13448>>>>>>>>>>>>>6		ubyte&0xDF	>0
13449>>>>>>>>>>>>>>6		ubyte		x 		\b%c
13450>>>>>>>>>>>>>>>7	ubyte&0xDF	>0
13451>>>>>>>>>>>>>>>>7	ubyte		x 		\b%c
13452# DOS filename extension
13453>>8			ubyte&0xDF	>0		\b.
13454>>>8			ubyte		x 		\b%c
13455>>>>9			ubyte&0xDF	>0
13456>>>>>9			ubyte		x 		\b%c
13457>>>>>>10		ubyte&0xDF	>0
13458>>>>>>>10		ubyte		x 		\b%c
13459#	Print 2 following DOS filenames from directory entry form
13460#	like IO.SYS+MSDOS.SYS or ibmbio.com+ibmdos.com
134610	name			2xDOS-filename
13462# display 1 space
13463>0			ubyte		x		\b
13464>0			use		DOS-filename
13465>11			ubyte		x		\b+
13466>11			use		DOS-filename
13467
13468# https://en.wikipedia.org/wiki/Master_boot_record#PTE
13469# display standard partition table
134700	name				partition-table
13471#>0		ubyte		x	PARTITION-TABLE
13472# test and display 1st til 4th partition table entry
13473>0		use			partition-entry-test
13474>16		use			partition-entry-test
13475>32		use			partition-entry-test
13476>48		use			partition-entry-test
13477#		test for entry of partition table
134780	name				partition-entry-test
13479# partition type ID > 0
13480>4		ubyte		>0
13481# active flag 0
13482>>0		ubyte		0
13483>>>0		use		partition-entry
13484# active flag 0x80, 0x81, ...
13485>>0		ubyte		>0x7F
13486>>>0		use		partition-entry
13487#		Print entry of partition table
134880	name				partition-entry
13489# partition type ID > 0
13490>4		ubyte		>0	\b; partition
13491>>64		leshort		0xAA55	1
13492>>48		leshort		0xAA55	2
13493>>32		leshort		0xAA55	3
13494>>16		leshort		0xAA55	4
13495>>4		ubyte		x	: ID=%#x
13496>>0		ubyte&0x80	0x80	\b, active
13497>>0		ubyte		>0x80	%#x
13498>>1		ubyte		x	\b, start-CHS (
13499>>1		use		partition-chs
13500>>5		ubyte		x	\b), end-CHS (
13501>>5		use		partition-chs
13502>>8		ulelong		x	\b), startsector %u
13503>>12		ulelong		x	\b, %u sectors
13504#		Print cylinder,head,sector (CHS) of partition entry
135050	name				partition-chs
13506# cylinder
13507>1		ubyte		x	\b0x
13508>1		ubyte&0xC0	0x40	\b1
13509>1		ubyte&0xC0	0x80	\b2
13510>1		ubyte&0xC0	0xC0	\b3
13511>2		ubyte		x	\b%x
13512# head
13513>0		ubyte		x	\b,%u
13514# sector
13515>1		ubyte&0x3F	x	\b,%u
13516
13517# FATX
135180		string		FATX		FATX filesystem data
13519
13520# romfs filesystems - Juan Cespedes <cespedes@debian.org>
135210	string		-rom1fs-	romfs filesystem, version 1
13522>8	belong	x			%d bytes,
13523>16	string	x			named %s.
13524
13525# netboot image - Juan Cespedes <cespedes@debian.org>
135260	lelong		0x1b031336L	Netboot image,
13527>4	lelong&0xFFFFFF00	0
13528>>4	lelong&0x100	0x000		mode 2
13529>>4	lelong&0x100	0x100		mode 3
13530>4	lelong&0xFFFFFF00	!0	unknown mode
13531
135320x18b	string	OS/2	OS/2 Boot Manager
13533
13534# updated by Joerg Jenderek at Oct 2008 and Sep 2012
13535# https://syslinux.zytor.com/iso.php
13536# tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05
13537# assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop
135380	ulequad&0x909000007cc0eafa	0x909000007c40eafa
13539>631	search/689	ISOLINUX\ 	isolinux Loader
13540>>&0	string		x		(version %-4.4s)
13541# https://syslinux.zytor.com/pxe.php
13542# assembler instructions: jmp 7C05
135430	ulelong	0x007c05ea		pxelinux loader (version 2.13 or older)
13544# assembler instructions: pushfd;pushad
135450	ulelong	0x60669c66		pxelinux loader
13546# assembler instructions: jmp 05
135470	ulelong	0xc00005ea		pxelinux loader (version 3.70 or newer)
13548# https://syslinux.zytor.com/wiki/index.php/SYSLINUX
135490	string	LDLINUX\ SYS\ 		SYSLINUX loader
13550>12	string	x			(older version %-4.4s)
135510	string	\r\nSYSLINUX\ 		SYSLINUX loader
13552>11	string	x			(version %-4.4s)
13553# syslinux updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012
13554# assembler instructions: jmp yy (yy=0x3c,0x58);nop;"SYSLINUX"
135550	ulelong&0x80909bEB	0x009018EB
13556# OEM-ID not always "SYSLINUX"
13557>434	search/47	Boot\ failed
13558# followed by \r\n\0 or :\
13559>>482	search/132	\0LDLINUX\ SYS		Syslinux bootloader (version 2.13 or older)
13560>>1	ubyte		0x58			Syslinux bootloader (version 3.0-3.9)
13561>459	search/30	Boot\ error\r\n\0
13562>>1	ubyte		0x58			Syslinux bootloader (version 3.10 or newer)
13563# SYSLINUX MBR updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012
13564# assembler instructions: mov di,0600h;mov cx,0100h
1356516	search/4	\xbf\x00\x06\xb9\x00\x01
13566# to display SYSLINUX MBR (36) before old DOS/MBR boot sector one with partition table (strength=50+21)
13567!:strength +36
13568>94	search/249	Missing\ operating\ system
13569# followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other
13570# skip Ranish MBR
13571>>408	search/4	HD1/\0
13572>>408	default		x
13573>>>250	search/118	\0Operating\ system\ load		SYSLINUX MBR
13574# followed by "ing " or space
13575>>>>292	search/98	error
13576>>>>>&0	string		\r		    			(version 3.35 or older)
13577>>>>>&0	string		.\r					(version 3.52 or newer)
13578>>>>>&0	default		x					(version 3.36-3.51 )
13579>368	search/106	\0Disk\ error\ on\ boot\r\n		SYSLINUX GPT-MBR
13580>>156	search/10	\0Boot\ partition\ not\ found\r\n
13581>>>270	search/10	\0OS\ not\ bootable\r\n			(version 3.86 or older)
13582>>174	search/10	\0Missing\ OS\r\n
13583>>>189	search/10	\0Multiple\ active\ partitions\r\n	(version 4.00 or newer)
13584# SYSLINUX END
13585
13586# NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012
13587# assembler instructions: xor ax,ax;mov	ax,ss;mov sp,0x7c00;mov	ax,
135880	ubequad		0x31c08ed0bc007c8e
13589# mbr_bootsel magic before partition table not reliable with small ipl fragments
13590#>444	uleshort	0xb5e1
13591>0004	uleshort	x
13592# ERRorTeXT
13593>>181	search/166		Error\ \0\r\n				NetBSD mbr
13594# NT Drive Serial Number https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS
13595>>>0x1B8	ubelong		>0					\b,Serial %#-.8x
13596# BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx
13597>>>0xbb		search/71	\xcd\x13\x5a\x52\x52			\b,bootselector
13598# BOOT_EXTENDED definitions contains assembler instructions:
13599# xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13
13600>>>0x96	search/1	\x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13	\b,boot extended
13601# COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al
13602>>>0x130	search/55	\xee\x80\xc2\x05\xec\xa8\x40		\b,serial IO
13603# not TERSE_ERROR
13604>>>196		search/106	No\ active\ partition\0
13605>>>>&0		string		Disk\ read\ error\0
13606>>>>>&0		string		No\ operating\ system\0			\b,verbose
13607# not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13
13608>>>0x7d		search/7	\x5a\x52\xb4\x08\xcd\x13		\b,CHS
13609# not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop	dx;push	dx;int 0x13
13610>>>0xa4		search/84	\xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13	\b,LBA-check
13611# assembler instructions: movw nametab,bx
13612>>>0x26	    search/21	\xBB\x94\x07
13613# not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf
13614>>>>&-9	ubequad&0xBE00f0E800febb94	0xBE0000E80000bb94
13615>>>>>181	search/166		Error\ \0
13616# "a: disk" , "Fn: diskn" or "NetBSD MBR boot"
13617>>>>>>&3	string			x				\b,"%s"
13618>>>446	use		partition-table
13619# Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html
13620# added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4
13621# assembler instructions: jmp short 0x58;nop;ASCII
136220	ubequad&0xeb58908000000000	0xeb58900000000000
13623# assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss,
13624>(1.b+2)	ubequad			0xfa31c08ed88ec08e
13625# Error messages at end of code
13626>>376		string	No\ operating\ system\r\n\0
13627>>>398		string	Disk\ error\r\n\0FDD\0HDD\0
13628>>>>419		string	\ EBIOS\r\n\0				AdvanceMAME mbr
13629
13630# Neil Turton mbr loader variant of https://www.chiark.greenend.org.uk/~neilt/mbr/
13631# added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11
13632# for 1st version assembler instructions:	cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI,
13633# or  	  	  	    			cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS,
136340	ulequad&0xcE1b40D48EC031FC	0x8E0000D08EC031FC
13635# pointer to the data starting with Neil Turton signature string
13636>(0x1BC.s)		string		NDTmbr
13637>>&-14			string		1234F\0			Turton mbr (
13638# parameters also viewed by install-mbr --list
13639>>>(0x1BC.s+7)		ubyte		x			\b%u<=
13640>>>(0x1BC.s+9)		ubyte		x			\bVersion<=%u
13641#>>>(0x1BC.s+8)		ubyte		x			asm_flag_%x
13642>>>(0x1BC.s+8)		ubyte&1		1			\b,Y2K-Fix
13643# variant used by testdisk of https://www.cgsecurity.org/wiki/Menu_MBRCode
13644>>>(0x1BC.s+8)		ubyte&2		2			\b,TestDisk
13645#0x1~1,..,0x8~4,0x10~F,0x80~A enabled
13646#>>>(0x1BC.s+10)		ubyte		x			\b,flags %#x
13647#0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot
13648#>>>(0x1BC.s+11)		ubyte		x			\b,cfg_def %#x
13649# for older versions
13650>>>(0x1BC.s+9)		ubyte		<2
13651#>>>>(0x1BC.s+12)	ubyte		18			\b,%hhu/18 seconds
13652>>>>(0x1BC.s+12)	ubyte		!18			\b,%u/18 seconds
13653# floppy A: or B:
13654>>>>(0x1BC.s+13)	ubyte		<2			\b,floppy %#x
13655>>>>(0x1BC.s+13)	ubyte		>1
13656# 1st hard disc
13657#>>>>>(0x1BC.s+13)	ubyte		0x80			\b,drive %#x
13658# not 1st hard disc
13659>>>>>(0x1BC.s+13)	ubyte		!0x80			\b,drive %#x
13660# for version >= 2 maximal timeout can be 65534
13661>>>(0x1BC.s+9)		ubyte		>1
13662#>>>>(0x1BC.s+12)	uleshort	18			\b,%u/18 seconds
13663>>>>(0x1BC.s+12)	uleshort	!18			\b,%u/18 seconds
13664# floppy A: or B:
13665>>>>(0x1BC.s+14)	ubyte		<2			\b,floppy %#x
13666>>>>(0x1BC.s+14)	ubyte		>1
13667# 1st hard disc
13668#>>>>>(0x1BC.s+14)	ubyte		0x80			\b,drive %#x
13669# not 1st hard disc
13670>>>>>(0x1BC.s+14)	ubyte		!0x80			\b,drive %#x
13671>>>0	ubyte		x					\b)
13672
13673# added by Joerg Jenderek
13674# In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or
13675# grub-1.94/kern/i386/pc/startup.S
13676# https://www.gnu.org/software/grub/manual/grub.html#Embedded-data
13677# usual values are marked with comments to get only information of strange GRUB loaders
136780x200	uleshort		0x70EA
13679# found only version 3.{1,2}
13680>0x206		ubeshort	>0x0300
13681# GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00"
13682>>0x212 	ubyte		>0x29
13683>>>0x213 	ubyte		>0x29
13684# not iso9660_stage1_5
13685#>>>0	ulelong&0x00BE5652	0x00BE5652
13686>>>>0x213 	ubyte		>0x29		GRand Unified Bootloader
13687# config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2"
13688>>>>0x217 	ubyte		0xFF		stage1_5
13689>>>>0x217 	ubyte		<0xFF		stage2
13690>>>>0x206	ubyte		x		\b version %u
13691>>>>0x207	ubyte		x		\b.%u
13692# module_size for 1.94
13693>>>>0x208	ulelong		<0xffffff	\b, installed partition %u
13694#>>>>0x208	ulelong		=0xffffff	\b, %lu (default)
13695>>>>0x208	ulelong		>0xffffff	\b, installed partition %u
13696# GRUB 0.5.95 unofficial
13697>>>>0x20C	ulelong&0x2E300000 0x2E300000
13698# 0=stage2	1=ffs	2=e2fs	3=fat	4=minix	5=reiserfs
13699>>>>>0x20C	ubyte		x		\b, identifier %#x
13700#>>>>>0x20D	ubyte		=0		\b, LBA flag %#x (default)
13701>>>>>0x20D	ubyte		>0		\b, LBA flag %#x
13702# GRUB version as string
13703>>>>>0x20E 	string		>\0		\b, GRUB version %-s
13704# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
13705>>>>>>0x215 	ulong		0xffffffff
13706>>>>>>>0x219 	string		>\0		\b, configuration file %-s
13707>>>>>>0x215 	ulong		!0xffffffff
13708>>>>>>>0x215 	string		>\0		\b, configuration file %-s
13709# newer GRUB versions
13710>>>>0x20C	ulelong&0x2E300000 !0x2E300000
13711##>>>>>0x20C	ulelong		=0		\b, saved entry %d (usual)
13712>>>>>0x20C	ulelong		>0		\b, saved entry %d
13713# for 1.94 contains kernel image size
13714# for 0.93,0.94,0.96,0.97
13715# 0=stage2	1=ffs	2=e2fs	3=fat	4=minix	5=reiserfs	6=vstafs	7=jfs	8=xfs	9=iso9660	a=ufs2
13716>>>>>0x210	ubyte		x		\b, identifier %#x
13717# The flag for LBA forcing is in most cases 0
13718#>>>>>0x211	ubyte		=0		\b, LBA flag %#x (default)
13719>>>>>0x211	ubyte		>0		\b, LBA flag %#x
13720# GRUB version as string
13721>>>>>0x212 	string		>\0		\b, GRUB version %-s
13722# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
13723>>>>>0x217 	ulong		0xffffffff
13724>>>>>>0x21b 	string		>\0		\b, configuration file %-s
13725>>>>>0x217 	ulong		!0xffffffff
13726>>>>>>0x217 	string		>\0		\b, configuration file %-s
13727
13728# DOS x86 sector updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at May 2011
13729# JuMP short     bootcodeoffset NOP assembler instructions will usually be EB xx 90
13730# over BIOS parameter block (BPB)
13731# https://thestarman.pcministry.com/asm/2bytejumps.htm#FWD
13732# older drives may use Near JuMP instruction E9 xx xx
13733# minimal short forward jump found 0x29 for bootloaders or 0x0
13734# maximal short forward jump is 0x7f
13735# OEM-ID is empty or contain readable bytes
137360		ulelong&0x804000E9	0x000000E9
13737!:strength	+60
13738# mtools-3.9.8/msdos.h
13739# usual values are marked with comments to get only information of strange FAT systems
13740# valid sectorsize must be a power of 2 from 32 to 32768
13741>11		uleshort&0x001f	0
13742>>11		uleshort	<32769
13743>>>11		uleshort	>31
13744>>>>21		ubyte&0xf0	0xF0
13745>>>>>0		ubyte		0xEB		DOS/MBR boot sector
13746>>>>>>1		ubyte		x		\b, code offset %#x+2
13747>>>>>0		ubyte		0xE9
13748>>>>>>1		uleshort	x		\b, code offset %#x+3
13749>>>>>3		string		>\0		\b, OEM-ID "%-.8s"
13750#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC
13751>>>>>>8		string		IHC		\b cached by Windows 9M
13752>>>>>11		uleshort	>512		\b, Bytes/sector %u
13753#>>>>>11	uleshort	=512		\b, Bytes/sector %u=512 (usual)
13754>>>>>11		uleshort	<512		\b, Bytes/sector %u
13755>>>>>13		ubyte		>1		\b, sectors/cluster %u
13756#>>>>>13	ubyte		=1		\b, sectors/cluster %u (usual on Floppies)
13757# for lazy FAT32 implementation like Transcend digital photo frame PF830
13758>>>>>82		string/c	fat32
13759>>>>>>14	uleshort	!32		\b, reserved sectors %u
13760#>>>>>>14	uleshort	=32		\b, reserved sectors %u (usual Fat32)
13761>>>>>82		string/c	!fat32
13762>>>>>>14	uleshort	>1		\b, reserved sectors %u
13763#>>>>>>14	uleshort	=1		\b, reserved sectors %u (usual FAT12,FAT16)
13764#>>>>>>14	uleshort	0		\b, reserved sectors %u (usual NTFS)
13765>>>>>16		ubyte		>2		\b, FATs %u
13766#>>>>>16	ubyte		=2		\b, FATs %u (usual)
13767>>>>>16		ubyte		=1		\b, FAT  %u
13768>>>>>16		ubyte		>0
13769>>>>>17		uleshort	>0		\b, root entries %u
13770#>>>>>17	uleshort	=0		\b, root entries %hu=0 (usual Fat32)
13771>>>>>19		uleshort	>0		\b, sectors %u (volumes <=32 MB)
13772#>>>>>19	uleshort	=0		\b, sectors %hu=0 (usual Fat32)
13773>>>>>21		ubyte		>0xF0		\b, Media descriptor %#x
13774#>>>>>21	ubyte		=0xF0		\b, Media descriptor %#x (usual floppy)
13775>>>>>21		ubyte		<0xF0		\b, Media descriptor %#x
13776>>>>>22		uleshort	>0		\b, sectors/FAT %u
13777#>>>>>22	uleshort	=0		\b, sectors/FAT %hu=0 (usual Fat32)
13778>>>>>24		uleshort	x		\b, sectors/track %u
13779>>>>>26		ubyte		>2		\b, heads %u
13780#>>>>>26	ubyte		=2		\b, heads %u (usual floppy)
13781>>>>>26		ubyte		=1		\b, heads %u
13782# valid only for sector sizes with more then 32 Bytes
13783>>>>>11		uleshort	>32
13784# https://en.wikipedia.org/wiki/Design_of_the_FAT_file_system#Extended_BIOS_Parameter_Block
13785# skip for values 2,2Ah,70h,73h,DFh
13786# and continue for extended boot signature values 0,28h,29h,80h
13787>>>>>>38	ubyte&0x56	=0
13788>>>>>>>28	ulelong		>0		\b, hidden sectors %u
13789#>>>>>>>28	ulelong		=0		\b, hidden sectors %u (usual floppy)
13790>>>>>>>32	ulelong		>0		\b, sectors %u (volumes > 32 MB)
13791#>>>>>>>32	ulelong		=0		\b, sectors %u (volumes > 32 MB)
13792# FAT<32 bit specific
13793>>>>>>>82	string/c	!fat32
13794#>>>>>>>>36	ubyte		0x80		\b, physical drive %#x=0x80 (usual harddisk)
13795#>>>>>>>>36	ubyte		0		\b, physical drive %#x=0 (usual floppy)
13796>>>>>>>>36	ubyte		!0x80
13797>>>>>>>>>36	ubyte		!0		\b, physical drive %#x
13798# VGA-copy CRC or
13799# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
13800>>>>>>>>37	ubyte		>0		\b, reserved %#x
13801#>>>>>>>>37	ubyte		=0		\b, reserved %#x
13802# extended boot signature value is 0x80 for NTFS, 0x28 or 0x29 for others
13803>>>>>>>>38	ubyte		!0x29		\b, dos < 4.0 BootSector (%#x)
13804>>>>>>>>38	ubyte&0xFE	=0x28
13805>>>>>>>>>39	ulelong		x		\b, serial number %#x
13806>>>>>>>>38	ubyte		=0x29
13807>>>>>>>>>43	string		<NO\ NAME	\b, label: "%11.11s"
13808>>>>>>>>>43	string		>NO\ NAME	\b, label: "%11.11s"
13809>>>>>>>>>43	string		=NO\ NAME	\b, unlabeled
13810# there exist some old floppies without word FAT at offset 54
13811# a word like "FATnm   " is only a hint for a FAT size on nm-bits
13812# Normally the number of clusters is calculated by the values of BPP.
13813# if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit,
13814# otherwise FAT is 16 bit.
13815# http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html
13816>>>>>82		string/c	!fat32
13817>>>>>>54	string		FAT12		\b, FAT (12 bit)
13818>>>>>>54	string		FAT16		\b, FAT (16 bit)
13819>>>>>>54	default		x
13820# determinate FAT bit size by media descriptor
13821# small floppies implies FAT12
13822>>>>>>>21	ubyte		<0xF0		\b, FAT (12 bit by descriptor)
13823# with media descriptor F0h floppy or maybe superfloppy with FAT16
13824>>>>>>>21	ubyte		=0xF0
13825# superfloppy (many sectors) implies FAT16
13826>>>>>>>>32	ulelong		>0xFFFF		\b, FAT (16 bit by descriptor+sectors)
13827# no superfloppy with media descriptor F0h implies FAT12
13828>>>>>>>>32	default		x		\b, FAT (12 bit by descriptor+sectors)
13829# with media descriptor F8h floppy or hard disc with FAT12 or FAT16
13830>>>>>>>21	ubyte		=0xF8
13831# 360 KiB with media descriptor F8h, 9 sectors per track ,single sided floppy implies FAT12
13832>>>>>>>>19	ubequad	0xd002f80300090001	\b, FAT (12 bit by descriptor+geometry)
13833# hard disc with FAT12 or FAT16
13834>>>>>>>>19	default		x		\b, FAT (1Y bit by descriptor)
13835# with media descriptor FAh floppy, RAM disc with FAT12 or FAT16 or Tandy hard disc
13836>>>>>>>21	ubyte		=0xFA
13837# 320 KiB with media descriptor FAh, 8 sectors per track ,single sided floppy implies FAT12
13838>>>>>>>>19	ubequad	0x8002fa0200080001	\b, FAT (12 bit by descriptor+geometry)
13839# RAM disc with FAT12 or FAT16 or Tandy hard disc
13840>>>>>>>>19	default		x		\b, FAT (1Y bit by descriptor)
13841# others are floppy
13842>>>>>>>21	default		x		\b, FAT (12 bit by descriptor)
13843# FAT32 bit specific
13844>>>>>82		string/c	fat32		\b, FAT (32 bit)
13845>>>>>>36	ulelong		x		\b, sectors/FAT %u
13846# https://technet.microsoft.com/en-us/library/cc977221.aspx
13847>>>>>>40	uleshort	>0		\b, extension flags %#x
13848#>>>>>>40	uleshort	=0		\b, extension flags %hu
13849>>>>>>42	uleshort	>0		\b, fsVersion %u
13850#>>>>>>42	uleshort	=0		\b, fsVersion %u (usual)
13851>>>>>>44	ulelong		>2		\b, rootdir cluster %u
13852#>>>>>>44	ulelong		=2		\b, rootdir cluster %u
13853#>>>>>>44	ulelong		=1		\b, rootdir cluster %u
13854>>>>>>48	uleshort	>1		\b, infoSector %u
13855#>>>>>>48	uleshort	=1		\b, infoSector %u (usual)
13856>>>>>>48	uleshort	<1		\b, infoSector %u
13857# 0 or 0xFFFF instead of usual 6 means no backup sector
13858>>>>>>50	uleshort	=0xFFFF		\b, no Backup boot sector
13859>>>>>>50	uleshort	=0		\b, no Backup boot sector
13860#>>>>>>50	uleshort	=6		\b, Backup boot sector %u (usual)
13861>>>>>>50	default		x
13862>>>>>>>50	uleshort	x		\b, Backup boot sector %u
13863# corrected by Joerg Jenderek at Feb 2011 according to https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
13864>>>>>>52	ulelong		>0		\b, reserved1 %#x
13865>>>>>>56	ulelong		>0		\b, reserved2 %#x
13866>>>>>>60	ulelong		>0		\b, reserved3 %#x
13867# same structure as FAT1X
13868#>>>>>>64	ubyte		=0x80		\b, physical drive %#x=80 (usual harddisk)
13869#>>>>>>64	ubyte		=0		\b, physical drive %#x=0 (usual floppy)
13870>>>>>>64	ubyte		!0x80
13871>>>>>>>64	ubyte		>0		\b, physical drive %#x
13872# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
13873>>>>>>65	ubyte		>0		\b, reserved %#x
13874>>>>>>66	ubyte		!0x29		\b, dos < 4.0 BootSector (%#x)
13875>>>>>>66	ubyte		=0x29
13876>>>>>>>67	ulelong		x		\b, serial number %#x
13877>>>>>>>71	string		<NO\ NAME	\b, label: "%11.11s"
13878>>>>>>>71	string		>NO\ NAME	\b, label: "%11.11s"
13879>>>>>>>71	string		=NO\ NAME	\b, unlabeled
13880# additional tests for floppy image added by Joerg Jenderek
13881# no fixed disk
13882>>>>>21		ubyte		!0xF8
13883# floppy media with 12 bit FAT
13884>>>>>>54	string		!FAT16
13885# test for FAT after bootsector
13886>>>>>>>(11.s)	ulelong&0x00ffffF0	0x00ffffF0	\b, followed by FAT
13887# floppy image
13888!:mime application/x-ima
13889# NTFS specific added by Joerg Jenderek at Mar 2011 according to https://thestarman.pcministry.com/asm/mbr/NTFSBR.htm
13890# and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html
13891# 0 FATs
13892>>>>>16	ubyte		=0
13893# 0 root entries
13894>>>>>>17	uleshort	=0
13895# 0 DOS sectors
13896>>>>>>>19	uleshort	=0
13897# 0 sectors/FAT
13898# dos < 4.0 BootSector value found is 0x80
13899#38	ubyte		=0x80			\b, dos < 4.0 BootSector (%#x)
13900>>>>>>>>22	uleshort	=0		\b; NTFS
13901>>>>>>>>>24	uleshort	>0		\b, sectors/track %u
13902>>>>>>>>>36	ulelong		!0x800080	\b, physical drive %#x
13903>>>>>>>>>40	ulequad		>0		\b, sectors %lld
13904>>>>>>>>>48	ulequad		>0		\b, $MFT start cluster %lld
13905>>>>>>>>>56	ulequad		>0		\b, $MFTMirror start cluster %lld
13906# Values 0 to 127 represent MFT record sizes of 0 to 127 clusters.
13907# Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes.
13908>>>>>>>>>64	lelong		<256
13909>>>>>>>>>>64	lelong		<128		\b, clusters/RecordSegment %d
13910>>>>>>>>>>64	ubyte		>127		\b, bytes/RecordSegment 2^(-1*%i)
13911# Values 0 to 127 represent index block sizes of 0 to 127 clusters.
13912# Values 128 to 255 represent index block sizes of 2^(256-N) byte
13913>>>>>>>>>68	ulelong		<256
13914>>>>>>>>>>68	ulelong		<128		\b, clusters/index block %d
13915#>>>>>>>>>>68	ulelong		>127		\b, bytes/index block 2^(256-%d)
13916>>>>>>>>>>68	ubyte		>127		\b, bytes/index block 2^(-1*%i)
13917>>>>>>>>>72	ulequad		x		\b, serial number 0%llx
13918>>>>>>>>>80	ulelong		>0		\b, checksum %#x
13919#>>>>>>>>>80	ulelong		=0		\b, checksum %#x=0 (usual)
13920# unicode loadername size jump
13921>>>>>>>>>(0x200.s*2)	ubyte				x
13922# in next sector loadername terminated by unicode CTRL-D and $
13923>>>>>>>>>>&0x1FF	ulequad&0x0000FFffFFffFF00	0x0000002400040000 \b; contains
13924# if 2nd NTFS sectors is found then assume whole filesystem
13925#!:mime		application/x-raw-disk-image
13926!:ext		img/bin/ntfs
13927>>>>>>>>>>>0x200	use				ntfs-sector2
13928
13929# For 2nd NTFS sector added by Joerg Jenderek at Jan 2013, Mar 2019
13930# https://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm
13931# unused assembler instructions short JMP y2;NOP;NOP
139320x056		ulelong&0xFFFF0FFF	0x909002EB	NTFS
13933#!:mime		application/octet-stream
13934!:ext		bin
13935>0		use		ntfs-sector2
13936# https://memory.dataram.com/products-and-services/software/ramdisk
13937# assembler instructions JMP C000;NOP
139380x056		ulelong			0x9000c0e9	NTFS
13939#!:mime		application/octet-stream
13940!:ext		bin
13941>0		use		ntfs-sector2
13942# check for characteristics of second NTFS sector and then display loader name
139430		name		ntfs-sector2
13944# number of utf16 characters of loadername
13945>0		uleshort	<8
13946# unused assembler instructions JMP y2;NOP;NOP or JMP C000;NOP
13947>>0x056		ulelong&0xFF0000FD	0x900000E9
13948# loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR
13949>>>0x002		lestring16	x	bootstrap %-5.5s
13950# check for 7 character length of loader name like BOOTMGR
13951>>>0		uleshort	7
13952>>>>0x0c	lestring16	x	\b%-2.2s
13953### DOS,NTFS boot sectors end
13954
13955# ntfsclone-image is a special save format for NTFS volumes,
13956# created and restored by the ntfsclone program
139570	string	\0ntfsclone-image	ntfsclone image,
13958>0x10	byte	x			version %d.
13959>0x11	byte	x			\b%d,
13960>0x12	lelong	x			cluster size %d,
13961>0x16	lequad	x			device size %lld,
13962>0x1e	lequad	x			%lld total clusters,
13963>0x26	lequad	x			%lld clusters in use
13964
139659564	lelong		0x00011954	Unix Fast File system [v1] (little-endian),
13966>8404	string		x		last mounted on %s,
13967#>9504	ledate		x		last checked at %s,
13968>8224	ledate		x		last written at %s,
13969>8401	byte		x		clean flag %d,
13970>8228	lelong		x		number of blocks %d,
13971>8232	lelong		x		number of data blocks %d,
13972>8236	lelong		x		number of cylinder groups %d,
13973>8240	lelong		x		block size %d,
13974>8244	lelong		x		fragment size %d,
13975>8252	lelong		x		minimum percentage of free blocks %d,
13976>8256	lelong		x		rotational delay %dms,
13977>8260	lelong		x		disk rotational speed %drps,
13978>8320	lelong		0		TIME optimization
13979>8320	lelong		1		SPACE optimization
13980
1398142332	lelong		0x19540119	Unix Fast File system [v2] (little-endian)
13982>&-1164	string		x		last mounted on %s,
13983>&-696	string		>\0		volume name %s,
13984>&-304	leqldate	x		last written at %s,
13985>&-1167	byte		x		clean flag %d,
13986>&-1168	byte		x		readonly flag %d,
13987>&-296	lequad		x		number of blocks %lld,
13988>&-288	lequad		x		number of data blocks %lld,
13989>&-1332	lelong		x		number of cylinder groups %d,
13990>&-1328	lelong		x		block size %d,
13991>&-1324	lelong		x		fragment size %d,
13992>&-180	lelong		x		average file size %d,
13993>&-176	lelong		x		average number of files in dir %d,
13994>&-272	lequad		x		pending blocks to free %lld,
13995>&-264	lelong		x		pending inodes to free %d,
13996>&-664	lequad		x		system-wide uuid %0llx,
13997>&-1316	lelong		x		minimum percentage of free blocks %d,
13998>&-1248	lelong		0		TIME optimization
13999>&-1248	lelong		1		SPACE optimization
14000
1400166908	lelong		0x19540119	Unix Fast File system [v2] (little-endian)
14002>&-1164	string		x		last mounted on %s,
14003>&-696	string		>\0		volume name %s,
14004>&-304	leqldate	x		last written at %s,
14005>&-1167	byte		x		clean flag %d,
14006>&-1168	byte		x		readonly flag %d,
14007>&-296	lequad		x		number of blocks %lld,
14008>&-288	lequad		x		number of data blocks %lld,
14009>&-1332	lelong		x		number of cylinder groups %d,
14010>&-1328	lelong		x		block size %d,
14011>&-1324	lelong		x		fragment size %d,
14012>&-180	lelong		x		average file size %d,
14013>&-176	lelong		x		average number of files in dir %d,
14014>&-272	lequad		x		pending blocks to free %lld,
14015>&-264	lelong		x		pending inodes to free %d,
14016>&-664	lequad		x		system-wide uuid %0llx,
14017>&-1316	lelong		x		minimum percentage of free blocks %d,
14018>&-1248	lelong		0		TIME optimization
14019>&-1248	lelong		1		SPACE optimization
14020
140219564	belong		0x00011954	Unix Fast File system [v1] (big-endian),
14022>7168   belong		0x4c41424c	Apple UFS Volume
14023>>7186  string		x		named %s,
14024>>7176  belong		x		volume label version %d,
14025>>7180  bedate		x		created on %s,
14026>8404	string		x		last mounted on %s,
14027#>9504	bedate		x		last checked at %s,
14028>8224	bedate		x		last written at %s,
14029>8401	byte		x		clean flag %d,
14030>8228	belong		x		number of blocks %d,
14031>8232	belong		x		number of data blocks %d,
14032>8236	belong		x		number of cylinder groups %d,
14033>8240	belong		x		block size %d,
14034>8244	belong		x		fragment size %d,
14035>8252	belong		x		minimum percentage of free blocks %d,
14036>8256	belong		x		rotational delay %dms,
14037>8260	belong		x		disk rotational speed %drps,
14038>8320	belong		0		TIME optimization
14039>8320	belong		1		SPACE optimization
14040
1404142332	belong		0x19540119	Unix Fast File system [v2] (big-endian)
14042>&-1164	string		x		last mounted on %s,
14043>&-696	string		>\0		volume name %s,
14044>&-304	beqldate	x		last written at %s,
14045>&-1167	byte		x		clean flag %d,
14046>&-1168	byte		x		readonly flag %d,
14047>&-296	bequad		x		number of blocks %lld,
14048>&-288	bequad		x		number of data blocks %lld,
14049>&-1332	belong		x		number of cylinder groups %d,
14050>&-1328	belong		x		block size %d,
14051>&-1324	belong		x		fragment size %d,
14052>&-180	belong		x		average file size %d,
14053>&-176	belong		x		average number of files in dir %d,
14054>&-272	bequad		x		pending blocks to free %lld,
14055>&-264	belong		x		pending inodes to free %d,
14056>&-664	bequad		x		system-wide uuid %0llx,
14057>&-1316	belong		x		minimum percentage of free blocks %d,
14058>&-1248	belong		0		TIME optimization
14059>&-1248	belong		1		SPACE optimization
14060
1406166908	belong		0x19540119	Unix Fast File system [v2] (big-endian)
14062>&-1164	string		x		last mounted on %s,
14063>&-696	string		>\0		volume name %s,
14064>&-304	beqldate	x		last written at %s,
14065>&-1167	byte		x		clean flag %d,
14066>&-1168	byte		x		readonly flag %d,
14067>&-296	bequad		x		number of blocks %lld,
14068>&-288	bequad		x		number of data blocks %lld,
14069>&-1332	belong		x		number of cylinder groups %d,
14070>&-1328	belong		x		block size %d,
14071>&-1324	belong		x		fragment size %d,
14072>&-180	belong		x		average file size %d,
14073>&-176	belong		x		average number of files in dir %d,
14074>&-272	bequad		x		pending blocks to free %lld,
14075>&-264	belong		x		pending inodes to free %d,
14076>&-664	bequad		x		system-wide uuid %0llx,
14077>&-1316	belong		x		minimum percentage of free blocks %d,
14078>&-1248	belong		0		TIME optimization
14079>&-1248	belong		1		SPACE optimization
14080
140810	ulequad		0xc8414d4dc5523031	HAMMER filesystem (little-endian),
14082>0x90	lelong+1	x			volume %d
14083>0x94	lelong		x			(of %d),
14084>0x50	string		x			name %s,
14085>0x98	ulelong		x			version %u,
14086>0xa0	ulelong		x			flags %#x
14087
140880	ulequad		0x48414d3205172011	HAMMER2 filesystem (little-endian),
14089>0x3b	byte		x			volume %d,
14090>0x28	ulequad/1073741824 x			size %lluGB,
14091>0x30	ulelong		x			version %u,
14092>0x34	ulelong		x			flags %#x
14093
14094# ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca>
14095# ext4 filesystem - Eric Sandeen <sandeen@sandeen.net>
14096# volume label and UUID Russell Coker
14097# https://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
140980x438   leshort         0xEF53          Linux
14099>0x44c  lelong          x               rev %d
14100>0x43e  leshort         x               \b.%d
14101# No journal?  ext2
14102>0x45c  lelong          ^0x0000004      ext2 filesystem data
14103>>0x43a leshort         ^0x0000001      (mounted or unclean)
14104# Has a journal?  ext3 or ext4
14105>0x45c  lelong          &0x0000004
14106#  and small INCOMPAT?
14107>>0x460 lelong          <0x0000040
14108#   and small RO_COMPAT?
14109>>>0x464 lelong         <0x0000008      ext3 filesystem data
14110#   else large RO_COMPAT?
14111>>>0x464 lelong         >0x0000007      ext4 filesystem data
14112#  else large INCOMPAT?
14113>>0x460	lelong          >0x000003f      ext4 filesystem data
14114>0x468	ubelong		x		\b, UUID=%08x
14115>0x46c	ubeshort	x		\b-%04x
14116>0x46e	ubeshort	x		\b-%04x
14117>0x470	ubeshort	x		\b-%04x
14118>0x472	ubelong		x		\b-%08x
14119>0x476	ubeshort	x		\b%04x
14120>0x478	string		>0		\b, volume name "%s"
14121# General flags for any ext* fs
14122>0x460	lelong          &0x0000004      (needs journal recovery)
14123>0x43a	leshort         &0x0000002      (errors)
14124# INCOMPAT flags
14125>0x460	lelong          &0x0000001      (compressed)
14126#>0x460	lelong          &0x0000002      (filetype)
14127#>0x460	lelong          &0x0000010      (meta bg)
14128>0x460	lelong          &0x0000040      (extents)
14129>0x460	lelong          &0x0000080      (64bit)
14130#>0x460	lelong          &0x0000100      (mmp)
14131#>0x460	lelong          &0x0000200      (flex bg)
14132# RO_INCOMPAT flags
14133#>0x464	lelong          &0x0000001      (sparse super)
14134>0x464	lelong          &0x0000002      (large files)
14135>0x464	lelong          &0x0000008      (huge files)
14136#>0x464	lelong          &0x0000010      (gdt checksum)
14137#>0x464	lelong          &0x0000020      (many subdirs)
14138#>0x463	lelong          &0x0000040      (extra isize)
14139
14140# f2fs filesystem - Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi>
141410x400	lelong		0xF2F52010	F2FS filesystem
14142>0x46c	ubelong		x		\b, UUID=%08x
14143>0x470	ubeshort	x		\b-%04x
14144>0x472	ubeshort	x		\b-%04x
14145>0x474	ubeshort	x		\b-%04x
14146>0x476	ubelong		x		\b-%08x
14147>0x47a	ubeshort	x		\b%04x
14148>0x147c	lestring16	x		\b, volume name "%s"
14149
14150# Minix filesystems - Juan Cespedes <cespedes@debian.org>
141510x410	leshort		0x137f
14152!:strength / 2
14153>0x402	beshort		< 100
14154>0x402	beshort		> -1		Minix filesystem, V1, 14 char names, %d zones
14155>0x1e	string		minix		\b, bootable
141560x410	beshort		0x137f
14157!:strength / 2
14158>0x402	beshort		< 100
14159>0x402	beshort		> -1		Minix filesystem, V1 (big endian), %d zones
14160>0x1e	string		minix		\b, bootable
141610x410	leshort		0x138f
14162!:strength / 2
14163>0x402	beshort		< 100
14164>0x402	beshort		> -1		Minix filesystem, V1, 30 char names, %d zones
14165>0x1e	string		minix		\b, bootable
141660x410	beshort		0x138f
14167!:strength / 2
14168>0x402	beshort		< 100
14169>0x402	beshort		> -1		Minix filesystem, V1, 30 char names (big endian), %d zones
14170>0x1e	string		minix		\b, bootable
14171# Weak Magic: this is $x
14172#0x410	leshort		0x2468
14173#>0x402	beshort		< 100
14174#>>0x402	beshort		> -1		Minix filesystem, V2, 14 char names
14175#>0x1e	string		minix		\b, bootable
14176#0x410	beshort		0x2468
14177#>0x402	beshort		< 100
14178#>0x402	beshort		> -1		Minix filesystem, V2 (big endian)
14179#>0x1e	string		minix		\b, bootable
14180#0x410	leshort		0x2478
14181#>0x402	beshort		< 100
14182#>0x402	beshort		> -1		Minix filesystem, V2, 30 char names
14183#>0x1e	string		minix		\b, bootable
14184#0x410	leshort		0x2478
14185#>0x402	beshort		< 100
14186#>0x402	beshort		> -1		Minix filesystem, V2, 30 char names
14187#>0x1e	string		minix		\b, bootable
14188#0x410	beshort		0x2478
14189#>0x402	beshort		!0		Minix filesystem, V2, 30 char names (big endian)
14190#>0x1e	string		minix		\b, bootable
14191# Weak Magic! this is MD
14192#0x418	leshort		0x4d5a
14193#>0x402	beshort		<100
14194#>>0x402	beshort		> -1		Minix filesystem, V3, 60 char names
14195
14196# SGI disk labels - Nathan Scott <nathans@debian.org>
141970	belong		0x0BE5A941	SGI disk label (volume header)
14198
14199# SGI XFS filesystem - Nathan Scott <nathans@debian.org>
142000	belong		0x58465342	SGI XFS filesystem data
14201>0x4	belong		x		(blksz %d,
14202>0x68	beshort		x		inosz %d,
14203>0x64	beshort		^0x2004		v1 dirs)
14204>0x64	beshort		&0x2004		v2 dirs)
14205
14206############################################################################
14207# Minix-ST kernel floppy
142080x800	belong		0x46fc2700	Atari-ST Minix kernel image
14209# https://en.wikipedia.org/wiki/BIOS_parameter_block
14210# floppies with valid BPB and any instruction at beginning
14211>19	string		\240\005\371\005\0\011\0\2\0	\b, 720k floppy
14212>19	string		\320\002\370\005\0\011\0\1\0	\b, 360k floppy
14213
14214############################################################################
14215# Hmmm, is this a better way of detecting _standard_ floppy images ?
1421619	string		\320\002\360\003\0\011\0\1\0	DOS floppy 360k
14217>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
1421819	string		\240\005\371\003\0\011\0\2\0	DOS floppy 720k
14219>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
1422019	string		\100\013\360\011\0\022\0\2\0	DOS floppy 1440k
14221>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
14222
1422319	string		\240\005\371\005\0\011\0\2\0	DOS floppy 720k, IBM
14224>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
1422519	string		\100\013\371\005\0\011\0\2\0	DOS floppy 1440k, mkdosfs
14226>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
14227
1422819	string		\320\002\370\005\0\011\0\1\0	Atari-ST floppy 360k
1422919	string		\240\005\371\005\0\011\0\2\0	Atari-ST floppy 720k
14230#			|       |   |     |     |
14231#			|       |   |     |     heads
14232#			|       |   |     sectors/track
14233#			|       |   sectors/FAT
14234#			|       media descriptor
14235#		BPB:	sectors
14236
14237#  Valid media descriptor bytes for MS-DOS:
14238#
14239#     Byte   Capacity   Media Size and Type
14240#     -------------------------------------------------
14241#
14242#     F0     2.88 MB    3.5-inch, 2-sided, 36-sector
14243#     F0     1.44 MB    3.5-inch, 2-sided, 18-sector
14244#     F9     720K       3.5-inch, 2-sided, 9-sector
14245#     F9     1.2 MB     5.25-inch, 2-sided, 15-sector
14246#     FD     360K       5.25-inch, 2-sided, 9-sector
14247#     FF     320K       5.25-inch, 2-sided, 8-sector
14248#     FC     180K       5.25-inch, 1-sided, 9-sector
14249#     FE     160K       5.25-inch, 1-sided, 8-sector
14250#     FE     250K       8-inch, 1-sided, single-density
14251#     FD     500K       8-inch, 2-sided, single-density
14252#     FE     1.2 MB     8-inch, 2-sided, double-density
14253#     F8     -----      Fixed disk
14254#
14255#     FC     xxxK       Apricot 70x1x9 boot disk.
14256#
14257# Originally a bitmap:
14258#  xxxxxxx0	Not two sided
14259#  xxxxxxx1	Double sided
14260#  xxxxxx0x	Not 8 SPT
14261#  xxxxxx1x	8 SPT
14262#  xxxxx0xx	Not Removable drive
14263#  xxxxx1xx	Removable drive
14264#  11111xxx	Must be one.
14265#
14266# But now it's rather random:
14267#  111111xx	Low density disk
14268#        00	SS, Not 8 SPT
14269#        01	DS, Not 8 SPT
14270#        10	SS, 8 SPT
14271#        11	DS, 8 SPT
14272#
14273#  11111001	Double density 3 1/2 floppy disk, high density 5 1/4
14274#  11110000	High density 3 1/2 floppy disk
14275#  11111000	Hard disk any format
14276#
14277
14278# all FAT12 (strength=70) floppies with sectorsize 512 added by Joerg Jenderek at Jun 2013
14279# https://en.wikipedia.org/wiki/File_Allocation_Table#Exceptions
14280# Too Weak.
14281#512		ubelong&0xE0ffff00	0xE0ffff00
14282# without valid Media descriptor in place of BPB, cases with are done at other places
14283#>21		ubyte			<0xE5			floppy with old FAT filesystem
14284# but valid Media descriptor at begin of FAT
14285#>>512		ubyte			=0xed			720k
14286#>>512		ubyte			=0xf0			1440k
14287#>>512		ubyte			=0xf8			720k
14288#>>512		ubyte			=0xf9			1220k
14289#>>512		ubyte			=0xfa			320k
14290#>>512		ubyte			=0xfb			640k
14291#>>512		ubyte			=0xfc			180k
14292# look like an old DOS directory entry
14293#>>>0xA0E	ubequad			0
14294#>>>>0xA00	ubequad			!0
14295#!:mime application/x-ima
14296#>>512		ubyte			=0xfd
14297# look for 2nd FAT at different location to distinguish between 360k and 500k
14298#>>>0x600	ubelong&0xE0ffff00	0xE0ffff00		360k
14299#>>>0x500	ubelong&0xE0ffff00	0xE0ffff00		500k
14300#>>>0xA0E	ubequad			0
14301#!:mime application/x-ima
14302#>>512		ubyte			=0xfe
14303#>>>0x400	ubelong&0xE0ffff00	0xE0ffff00		160k
14304#>>>>0x60E	ubequad			0
14305#>>>>>0x600	ubequad			!0
14306#!:mime application/x-ima
14307#>>>0xC00	ubelong&0xE0ffff00	0xE0ffff00		1200k
14308#>>512		ubyte			=0xff			320k
14309#>>>0x60E	ubequad			0
14310#>>>>0x600	ubequad			!0
14311#!:mime application/x-ima
14312#>>512		ubyte			x			\b, Media descriptor %#x
14313# without x86 jump instruction
14314#>>0		ulelong&0x804000E9	!0x000000E9
14315# assembler instructions: CLI;MOV SP,1E7;MOV AX;07c0;MOV
14316#>>>0	ubequad				0xfabce701b8c0078e	\b, MS-DOS 1.12 bootloader
14317# IOSYS.COM+MSDOS.COM
14318#>>>>0xc4	use			2xDOS-filename
14319#>>0		ulelong&0x804000E9	=0x000000E9
14320# only x86 short jump instruction found
14321#>>>0		ubyte			=0xEB
14322#>>>>1		ubyte			x			\b, code offset %#x+2
14323# https://thestarman.pcministry.com/DOS/ibm100/Boot.htm
14324# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;MOV DX,0
14325#>>>>(1.b+2)	ubequad			0xfa8cc88ed8ba0000	\b, PC-DOS 1.0 bootloader
14326# ibmbio.com+ibmdos.com
14327#>>>>>0x176	use			DOS-filename
14328#>>>>>0x181	ubyte			x			\b+
14329#>>>>>0x182	use			DOS-filename
14330# https://thestarman.pcministry.com/DOS/ibm110/Boot.htm
14331# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;XOR DX,DX;MOV
14332#>>>>(1.b+2)	ubequad			0xfa8cc88ed833d28e	\b, PC-DOS 1.1 bootloader
14333# ibmbio.com+ibmdos.com
14334#>>>>>0x18b	use			DOS-filename
14335#>>>>>0x196	ubyte			x			\b+
14336#>>>>>0x197	use			DOS-filename
14337# https://en.wikipedia.org/wiki/Zenith_Data_Systems
14338# assembler instructions: MOV BX,07c0;MOV SS,BX;MOV SP,01c6
14339#>>>>(1.b+2)	ubequad			0xbbc0078ed3bcc601	\b, Zenith Data Systems MS-DOS 1.25 bootloader
14340# IO.SYS+MSDOS.SYS
14341#>>>>>0x20	use			2xDOS-filename
14342# https://en.wikipedia.org/wiki/Corona_Data_Systems
14343# assembler instructions: MOV AX,CS;MOV DS,AX;CLI;MOV SS,AX;
14344#>>>>(1.b+2)	ubequad			0x8cc88ed8fa8ed0bc	\b, MS-DOS 1.25 bootloader
14345# IO.SYS+MSDOS.SYS
14346#>>>>>0x69	use			2xDOS-filename
14347# assembler instructions: CLI;PUSH CS;POP SS;MOV SP,7c00;
14348#>>>>(1.b+2)	ubequad			0xfa0e17bc007cb860	\b, MS-DOS 2.11 bootloader
14349# defect IO.SYS+MSDOS.SYS ?
14350#>>>>>0x162	use			2xDOS-filename
14351
143520	name				cdrom
14353>38913	string   !NSR0      ISO 9660 CD-ROM filesystem data
14354!:mime	application/x-iso9660-image
14355!:ext	iso/iso9660
14356>38913	string    NSR0      UDF filesystem data
14357!:mime	application/x-iso9660-image
14358!:ext	iso/udf
14359>>38917	string    1         (version 1.0)
14360>>38917	string    2         (version 1.5)
14361>>38917	string    3         (version 2.0)
14362>>38917	byte     >0x33      (unknown version, ID %#X)
14363>>38917	byte     <0x31      (unknown version, ID %#X)
14364# The next line is not necessary because the MBR staff is done looking for boot signature
14365>0x1FE	leshort  0xAA55     (DOS/MBR boot sector)
14366# "application id" which appears to be used as a volume label
14367>32808	string/T  >\0       '%.32s'
14368>34816	string    \000CD001\001EL\ TORITO\ SPECIFICATION    (bootable)
1436937633	string    CD001     ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
14370!:mime	application/x-iso9660-image
1437132777	string    CDROM     High Sierra CD-ROM filesystem data
14372# "application id" which appears to be used as a volume label
14373>32816	string/T  >\0       '%.32s'
14374
14375
14376# CDROM Filesystems
14377# https://en.wikipedia.org/wiki/ISO_9660
14378# Modified for UDF by gerardo.cacciari@gmail.com
1437932769	string    CD001
14380# mime line at that position does not work
14381# to display CD-ROM (70=81-11) after MBR (113=40+72+1), partition-table (71=50+21) and before Apple Driver Map (51)
14382#!:strength -11
14383# to display CD-ROM (114=81+33) before MBR (113=40+72+1), partition-table (71=50+21) and Apple Driver Map (51)
14384!:strength +35
14385>0	use	cdrom
14386
14387# URL: https://en.wikipedia.org/wiki/NRG_(file_format)
14388# Reference: https://dl.opendesktop.org/api/files/download/id/1460731811/
14389#	11577-mount-iso-0.9.5.tar.bz2/mount-iso-0.9.5/install.sh
14390# From: Joerg Jenderek
14391# Note:	Only for nero disc with once (DAO) type after 300 KB header
14392339969	string    CD001	Nero CD image at 0x4B000
14393!:mime	application/x-nrg
14394!:ext	nrg
14395>307200	use cdrom
14396
14397# .cso files
14398# Reference: https://pismotec.com/ciso/ciso.h
14399# NOTE: There are two other formats with the same magic but
14400# completely incompatible specifications:
14401# - GameCube/Wii CISO: https://github.com/dolphin-emu/dolphin/blob/master/Source/Core/DiscIO/CISOBlob.h
14402# - PSP CISO: https://github.com/jamie/ciso/blob/master/ciso.h
144030    string    CISO
14404# Other fields are used to determine what type of CISO this is:
14405# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size)
14406# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size)
14407# - 0x10 == 0x00004000: For >2GB files using maxcso...
14408# 			https://github.com/unknownbrackets/maxcso/issues/26
14409# - None of the above: Compact ISO.
14410>4	lelong	!0
14411>>4	lelong	!0x200000
14412>>>16	lelong	!0x800
14413>>>>16	lelong	!0x4000		Compressed ISO CD image
14414
14415# cramfs filesystem - russell@coker.com.au
144160       lelong    0x28cd3d45      Linux Compressed ROM File System data, little endian
14417>4      lelong  x size %u
14418>8      lelong  &1 version #2
14419>8      lelong  &2 sorted_dirs
14420>8      lelong  &4 hole_support
14421>32     lelong  x CRC %#x,
14422>36     lelong  x edition %u,
14423>40     lelong  x %u blocks,
14424>44     lelong  x %u files
14425
144260       belong    0x28cd3d45      Linux Compressed ROM File System data, big endian
14427>4      belong  x size %u
14428>8      belong  &1 version #2
14429>8      belong  &2 sorted_dirs
14430>8      belong  &4 hole_support
14431>32     belong  x CRC %#x,
14432>36     belong  x edition %u,
14433>40     belong  x %u blocks,
14434>44     belong  x %u files
14435
14436# reiserfs - russell@coker.com.au
144370x10034		string	ReIsErFs	ReiserFS V3.5
144380x10034		string	ReIsEr2Fs	ReiserFS V3.6
144390x10034		string	ReIsEr3Fs	ReiserFS V3.6.19
14440>0x1002c 	leshort	x		block size %d
14441>0x10032	leshort	&2		(mounted or unclean)
14442>0x10000	lelong	x		num blocks %d
14443>0x10040	lelong	1		tea hash
14444>0x10040	lelong	2		yura hash
14445>0x10040	lelong	3		r5 hash
14446
14447# EST flat binary format (which isn't, but anyway)
14448# From: Mark Brown <broonie@sirena.org.uk>
144490	string	ESTFBINR	EST flat binary
14450
14451# Aculab VoIP firmware
14452# From: Mark Brown <broonie@sirena.org.uk>
144530	string	VoIP\ Startup\ and	Aculab VoIP firmware
14454>35	string	x	format %s
14455
14456# From: Mark Brown <broonie@sirena.org.uk> [old]
14457# From: Behan Webster <behanw@websterwood.com>
144580	belong	0x27051956	u-boot legacy uImage,
14459>32	string	x		%s,
14460>28	byte	0		Invalid os/
14461>28	byte	1		OpenBSD/
14462>28	byte	2		NetBSD/
14463>28	byte	3		FreeBSD/
14464>28	byte	4		4.4BSD/
14465>28	byte	5		Linux/
14466>28	byte	6		SVR4/
14467>28	byte	7		Esix/
14468>28	byte	8		Solaris/
14469>28	byte	9		Irix/
14470>28	byte	10		SCO/
14471>28	byte	11		Dell/
14472>28	byte	12		NCR/
14473>28	byte	13		LynxOS/
14474>28	byte	14		VxWorks/
14475>28	byte	15		pSOS/
14476>28	byte	16		QNX/
14477>28	byte	17		Firmware/
14478>28	byte	18		RTEMS/
14479>28	byte	19		ARTOS/
14480>28	byte	20		Unity OS/
14481>28	byte	21		INTEGRITY/
14482>29	byte	0		\bInvalid CPU,
14483>29	byte	1		\bAlpha,
14484>29	byte	2		\bARM,
14485>29	byte	3		\bIntel x86,
14486>29	byte	4		\bIA64,
14487>29	byte	5		\bMIPS,
14488>29	byte	6		\bMIPS 64-bit,
14489>29	byte	7		\bPowerPC,
14490>29	byte	8		\bIBM S390,
14491>29	byte	9		\bSuperH,
14492>29	byte	10		\bSparc,
14493>29	byte	11		\bSparc 64-bit,
14494>29	byte	12		\bM68K,
14495>29	byte	13		\bNios-32,
14496>29	byte	14		\bMicroBlaze,
14497>29	byte	15		\bNios-II,
14498>29	byte	16		\bBlackfin,
14499>29	byte	17		\bAVR32,
14500>29	byte	18		\bSTMicroelectronics ST200,
14501>29	byte	19		\bSandbox architecture,
14502>29	byte	20		\bANDES Technology NDS32,
14503>29	byte	21		\bOpenRISC 1000,
14504>29	byte	22		\bARM 64-bit,
14505>29	byte	23		\bDesignWare ARC,
14506>29	byte	24		\bx86_64,
14507>29	byte	25		\bXtensa,
14508>29	byte	26		\bRISC-V,
14509>30	byte	0		Invalid Image
14510>30	byte	1		Standalone Program
14511>30	byte	2		OS Kernel Image
14512>30	byte	3		RAMDisk Image
14513>30	byte	4		Multi-File Image
14514>30	byte	5		Firmware Image
14515>30	byte	6		Script File
14516>30	byte	7		Filesystem Image (any type)
14517>30	byte	8		Binary Flat Device Tree BLOB
14518>31	byte	0		(Not compressed),
14519>31	byte	1		(gzip),
14520>31	byte	2		(bzip2),
14521>31	byte	3		(lzma),
14522>12	belong	x		%d bytes,
14523>8	bedate	x		%s,
14524>16	belong	x		Load Address: %#08X,
14525>20	belong	x		Entry Point: %#08X,
14526>4	belong	x		Header CRC: %#08X,
14527>24	belong	x		Data CRC: %#08X
14528
14529# JFFS2 file system
145300	leshort	0x1984		Linux old jffs2 filesystem data little endian
145310	beshort	0x1984		Linux old jffs2 filesystem data big endian
145320	leshort	0x1985		Linux jffs2 filesystem data little endian
145330	beshort	0x1985		Linux jffs2 filesystem data big endian
14534
14535# Squashfs
145360	name	squashfs
14537>28	beshort	x	version %d.
14538>30	beshort	x	\b%d,
14539>20	beshort 0	uncompressed,
14540>20	beshort 1	zlib
14541>20	beshort 2	lzma
14542>20	beshort 3	lzo
14543>20	beshort 4	xz
14544>20	beshort 5	lz4
14545>20	beshort 6	zstd
14546>20	beshort >0	compressed,
14547>28	beshort <3
14548>>8	belong	x	%d bytes,
14549>28	beshort >2
14550>>28	beshort <4
14551>>>63	bequad x	%lld bytes,
14552>>28	beshort >3
14553>>>40	bequad x	%lld bytes,
14554#>>67	belong	x	%d bytes,
14555>4	belong	x	%d inodes,
14556>28	beshort <2
14557>>32	beshort	x	blocksize: %d bytes,
14558>28	beshort >1
14559>>28	beshort <4
14560>>>51	belong	x	blocksize: %d bytes,
14561>>28	beshort >3
14562>>>12	belong	x	blocksize: %d bytes,
14563>28	beshort <4
14564>>39	bedate	x	created: %s
14565>28	beshort >3
14566>>8	bedate	x	created: %s
14567
145680	string	sqsh	Squashfs filesystem, big endian,
14569>0	use	squashfs
14570
145710	string	hsqs	Squashfs filesystem, little endian,
14572>0	use	\^squashfs
14573
14574# AFS Dump Magic
14575# From: Ty Sarna <tsarna@sarna.org>
145760       string                  \x01\xb3\xa1\x13\x22    AFS Dump
14577>&0     belong                  x                       (v%d)
14578>>&0    byte                    0x76
14579>>>&0   belong                  x                       Vol %d,
14580>>>>&0  byte                    0x6e
14581>>>>>&0 string                  x                       %s
14582>>>>>>&1        byte            0x74
14583>>>>>>>&0       beshort         2
14584>>>>>>>>&4      bedate          x                       on: %s
14585>>>>>>>>&0      bedate          =0                      full dump
14586>>>>>>>>&0      bedate          !0                      incremental since: %s
14587
14588#----------------------------------------------------------
14589#delta ISO    Daniel Novotny (dnovotny@redhat.com)
145900	string  DISO	Delta ISO data
14591!:strength +50
14592>4	belong  x	version %d
14593
14594# VMS backup savesets - gerardo.cacciari@gmail.com
14595#
145964            string  \x01\x00\x01\x00\x01\x00
14597>(0.s+16)    string  \x01\x01
14598>>&(&0.b+8)  byte    0x42       OpenVMS backup saveset data
14599>>>40        lelong  x          (block size %d,
14600>>>49        string  >\0        original name '%s',
14601>>>2         short   1024       VAX generated)
14602>>>2         short   2048       AXP generated)
14603>>>2         short   4096       I64 generated)
14604
14605# Summary: Oracle Clustered Filesystem
14606# Created by: Aaron Botsis <redhat@digitalmafia.org>
146078	string		OracleCFS	Oracle Clustered Filesystem,
14608>4	long		x		rev %d
14609>0	long		x		\b.%d,
14610>560	string		x		label: %.64s,
14611>136	string		x		mountpoint: %.128s
14612
14613# Summary: Oracle ASM tagged volume
14614# Created by: Aaron Botsis <redhat@digitalmafia.org>
1461532	string		ORCLDISK	Oracle ASM Volume,
14616>40	string		x		Disk Name: %0.12s
1461732	string		ORCLCLRD	Oracle ASM Volume (cleared),
14618>40	string		x		Disk Name: %0.12s
14619
14620# Oracle Clustered Filesystem - Aaron Botsis <redhat@digitalmafia.org>
146218	string		OracleCFS	Oracle Clustered Filesystem,
14622>4	long		x		rev %d
14623>0	long		x		\b.%d,
14624>560	string		x		label: %.64s,
14625>136	string		x		mountpoint: %.128s
14626
14627# Oracle ASM tagged volume - Aaron Botsis <redhat@digitalmafia.org>
1462832	string		ORCLDISK	Oracle ASM Volume,
14629>40	string		x		Disk Name: %0.12s
1463032	string		ORCLCLRD	Oracle ASM Volume (cleared),
14631>40	string		x		Disk Name: %0.12s
14632
14633# Compaq/HP RILOE floppy image
14634# From: Dirk Jagdmann <doj@cubic.org>
146350	string	CPQRFBLO	Compaq/HP RILOE floppy image
14636
14637#------------------------------------------------------------------------------
14638# Files-11 On-Disk Structure (File system for various RSX-11 and VMS flavours).
14639# These bits come from LBN 1 (home block) of ODS-1, ODS-2 and ODS-5 volumes,
14640# which is mapped to VBN 2 of [000000]INDEXF.SYS;1 - gerardo.cacciari@gmail.com
14641#
146421008    string          DECFILE11       Files-11 On-Disk Structure
14643>525    byte            x               (ODS-%d);
14644>1017   string          A               RSX-11, VAX/VMS or OpenVMS VAX file system;
14645>1017   string          B
14646>>525   byte            2               VAX/VMS or OpenVMS file system;
14647>>525   byte            5               OpenVMS Alpha or Itanium file system;
14648>984    string          x               volume label is '%-12.12s'
14649
14650# From: Thomas Klausner <wiz@NetBSD.org>
14651# https://filext.com/file-extension/DAA
14652# describes the daa file format. The magic would be:
146530	string		DAA\x0\x0\x0\x0\x0	PowerISO Direct-Access-Archive
14654
14655# From Albert Cahalan <acahalan@gmail.com>
14656# really le32 operation,destination,payloadsize (but quite predictable)
14657# 01 00 00 00 00 00 00 c0 00 02 00 00
146580	string		\1\0\0\0\0\0\0\300\0\2\0\0	Marvell Libertas firmware
14659
14660# From Eric Sandeen
14661# GFS2
146620x10000         belong          0x01161970
14663>0x10018        belong          0x0000051d      GFS1 Filesystem
14664>>0x10024        belong          x               (blocksize %d,
14665>>0x10060        string          >\0             lockproto %s)
14666>0x10018        belong          0x00000709      GFS2 Filesystem
14667>>0x10024        belong          x               (blocksize %d,
14668>>0x10060        string          >\0             lockproto %s)
14669
14670# Russell Coker <russell@coker.com.au>
146710x10040		string		_BHRfS_M	BTRFS Filesystem
14672>0x1012b	string		>\0		label "%s",
14673>0x10090	lelong		x		sectorsize %d,
14674>0x10094	lelong		x		nodesize %d,
14675>0x10098	lelong		x		leafsize %d,
14676>0x10020	ubelong		x		UUID=%08x-
14677>0x10024	ubeshort	x		\b%04x-
14678>0x10026	ubeshort	x		\b%04x-
14679>0x10028	ubeshort	x		\b%04x-
14680>0x1002a	ubeshort	x		\b%04x
14681>0x1002c	ubelong		x		\b%08x,
14682>0x10078	lequad		x		%lld/
14683>0x10070	lequad		x		\b%lld bytes used,
14684>0x10088	lequad		x		%lld devices
14685
146860		string		btrfs-stream	BTRFS stream file
14687
14688# dvdisaster's .ecc
14689# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
146900	string	*dvdisaster*	dvdisaster error correction file
14691
14692# xfs metadump image
14693# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
14694# but can we do the << ?  For now it's always 512 (0x200) anyway.
146950	string XFSM
14696>0x200	string XFSB	XFS filesystem metadump image
14697
14698# Type:	CROM filesystem
14699# From:	Werner Fink <werner@suse.de>
147000	string	CROMFS	CROMFS
14701>6	string	>\0	\b version %2.2s,
14702>8	ulequad	>0	\b block data at %lld,
14703>16	ulequad	>0	\b fblock table at %lld,
14704>24	ulequad	>0	\b inode table at %lld,
14705>32	ulequad	>0	\b root at %lld,
14706>40	ulelong	>0	\b fblock size = %d,
14707>44	ulelong	>0	\b block size = %d,
14708>48	ulequad	>0	\b bytes = %lld
14709
14710# Type:	xfs metadump image
14711# From:	Daniel Novotny <dnovotny@redhat.com>
14712# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
14713# but can we do the << ? For now it's always 512 (0x200) anyway.
147140	string	XFSM
14715>0x200	string	XFSB	XFS filesystem metadump image
14716
14717# Type:	delta ISO
14718# From:	Daniel Novotny <dnovotny@redhat.com>
147190	string	DISO	Delta ISO data,
14720>4	belong	x	version %d
14721
14722# JFS2 (Journaling File System) image. (Old JFS1 has superblock at 0x1000.)
14723# See linux/fs/jfs/jfs_superblock.h for layout; see jfs_filsys.h for flags.
14724# From: Adam Buchbinder <adam.buchbinder@gmail.com>
147250x8000	string	JFS1
14726# Because it's text-only magic, check a binary value (version) to be sure.
14727# Should always be 2, but mkfs.jfs writes it as 1. Needs to be 2 or 1 to be
14728# mountable.
14729>&0	lelong	<3	JFS2 filesystem image
14730# Label is followed by a UUID; we have to limit string length to avoid
14731# appending the UUID in the case of a 16-byte label.
14732>>&144	regex	[\x20-\x7E]{1,16}	(label "%s")
14733>>&0	lequad	x	\b, %lld blocks
14734>>&8	lelong	x	\b, blocksize %d
14735>>&32	lelong&0x00000006	>0	(dirty)
14736>>&36	lelong	>0	(compressed)
14737
14738# LFS
147390	lelong	0x070162	LFS filesystem image
14740>4	lelong	1		version 1,
14741>>8	lelong	x		\b blocks %u,
14742>>12	lelong	x		\b blocks per segment %u,
14743>4	lelong	2		version 2,
14744>>8	lelong	x		\b fragments %u,
14745>>12	lelong	x		\b bytes per segment %u,
14746>16	lelong	x		\b disk blocks %u,
14747>20	lelong	x		\b block size %u,
14748>24	lelong	x		\b fragment size %u,
14749>28	lelong	x		\b fragments per block %u,
14750>32	lelong	x		\b start for free list %u,
14751>36	lelong	x		\b number of free blocks %d,
14752>40	lelong	x		\b number of files %u,
14753>44	lelong	x		\b blocks available for writing %d,
14754>48	lelong	x		\b inodes in cache %d,
14755>52	lelong	x		\b inode file disk address %#x,
14756>56	lelong	x		\b inode file inode number %u,
14757>60	lelong	x		\b address of last segment written %#x,
14758>64	lelong	x		\b address of next segment to write %#x,
14759>68	lelong	x		\b address of current segment written %#x
14760
147610	string	td\000		floppy image data (TeleDisk, compressed)
147620	string	TD\000		floppy image data (TeleDisk)
14763
147640	string	CQ\024		floppy image data (CopyQM,
14765>16	leshort	x		%d sectors,
14766>18	leshort	x		%d heads.)
14767
147680	string	ACT\020Apricot\020disk\020image\032\004	floppy image data (ApriDisk)
14769
14770# URL:		http://fileformats.archiveteam.org/wiki/LoadDskF/SaveDskF
14771# Update:	Joerg Jenderek
14772# Note:		called "IBM SKF disk image" by TrID
14773#		verfied by 7-Zip `7z l -tFAT -slt *.dsk` and
14774#		`deark -l -m loaddskf  06200D19.DSK`
14775# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/d/dsk-skf-old.trid.xml
147760	beshort	0xAA58
14777>0	use		SaveDskF
14778# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/d/dsk-skf.trid.xml
147790	beshort	0xAA59
14780>0	use		SaveDskF
14781# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/d/dsk-skf-comp.trid.xml
147820	beshort	0xAA5A
14783# skip foo by additional check for unused upper byte of media type in SaveDskF header
14784#>3	ubyte		=0
14785# skip bar by additional check for valid "low" number of heads in SaveDskF header
14786#>>26	uleshort	<3
14787# skip foo by additional check for unused double word field in SaveDskF header
14788#>>>30	long		=0
14789#>>>>0	use		SaveDskF
14790>0	use		SaveDskF
14791# display information about IBM SaveDskF floppy disk images
147920	name			SaveDskF
14793# SaveDskF magic
14794>0	beshort	x		floppy image data (IBM SaveDskF
14795#!:mime	application/octet-stream
14796!:mime	application/x-ibm-dsk
14797!:ext	dsk
14798# also suffix with digit (1dk .2dk ...); NO example FOUND!
14799#!:ext	dsk/1dk/2dk
14800>1	ubyte		=0x58	\b, old)
14801>1	ubyte		=0x59	\b)
14802>1	ubyte		=0x5A	\b, compressed)
14803# media type; the first byte of the FAT like: 0xF0 (usual floppy) 0xF9 0xFE
14804# https://en.wikipedia.org/wiki/Design_of_the_FAT_file_system
14805>2	ubyte		!0xF0	\b, Media descriptor %#x
14806# upper byte of media type is not used; so this seems to be nil
14807>3	ubyte		!0	\b, upper byte of media type %#x
14808# sector size in bytes as in the BIOS parameter block like: 512 ; SAVEDSKF.EXE with other sizes produce garbage images
14809>4	uleshort	!512	\b, Bytes/sector %u
14810# cluster mask; number of sectors per cluster, minus 1
14811>6	uleshort+1	>1	\b, sectors/cluster %u
14812#>6	uleshort+1	x	\b, sectors/cluster %u
14813# cluster shift; log2(cluster size / sector size) like: 0~1=ClusterSize/SectorSize
14814>7	ubyte		>0	\b, cluster shift %u
14815#>7	ubyte		x	\b, cluster shift %u
14816# reserved sectors; as in the BIOS parameter block like: 1 256 (2M256R-K.DSK)
14817>8	uleshort	>1	\b, reserved sectors %u
14818#>8	uleshort	x	\b, reserved sectors %u
14819# FAT copies; as in the BIOS parameter block like: 2 (usual) 1 (2-NK.DSK)
14820>10	ubyte		!2	\b, FAT
14821# plural s
14822>>10	ubyte		>1	\bs
14823>>10	ubyte		x	%u
14824# root directory entries; as in the BIOS parameter block like: 224 (usual) 64 (H1-NK.DSK) 4096 (2-NK.DSK)
14825>11	uleshort	!224	\b, root entries %u
14826# sector number of first cluster (count sectors used by boot sector, FATs and root directory) like: 7 10 29 33 288
14827>13	uleshort	!33	\b, 1st cluster at sector %u
14828# number of clusters in image; empty clusters at the end are not saved and counted like: 2372 2848
14829>15	uleshort	x	\b, %u clusters
14830# sectors/FAT; as in the BIOS parameter block like: 1 (H1-NK.DSK) 7 9
14831>17	ubyte		!9	\b, sectors/FAT %u
14832# sector number of root directory (ie, count of sectors used by boot sector and FATs) like: 3 (H1-NK.DSK) 9 10 15 19 274 (2M256R-K.DSK)
14833>18	uleshort	!19	\b, root directory at sector %u
14834# checksum; sum of all bytes in the file
14835>20	ulelong		x	\b, checksum %#8.8x
14836# cylinders; number of cylinders like: 40 80
14837>24 	uleshort	!80	\b, %u cylinders
14838#>24 	uleshort	x	\b, %u cylinders
14839# heads; number of heads as in the BIOS parameter block like: 1 (H1-NK.DSK) 2
14840>26	uleshort	!2	\b, heads %u
14841#>26	uleshort	x	\b, heads %u
14842# sectors/track; number of sectors per track as in the BIOS parameter block like: 8 15 18 36
14843>28	uleshort	!18	\b, sectors/track %u
14844#>28	uleshort	x	\b, sectors/track %u
14845# unused double word field seems to be always like: 0
14846>30	ulelong		!0	\b, at 0x1E %#x
14847# number of sectors in images like: 1017 2786 2880
14848>34 	uleshort	x	\b, sectors %u
14849# if string is "printable" it can be a real comment
14850>(36.s)	ubyte		!0x00
14851# if 1st sector is far enough away (> 0x29) then there is space for comment part
14852>>38	uleshort	>41
14853# offset to comment string like: 28h=40
14854>>>36	uleshort	x	\b, at %#x
14855# comment string terminated with \r\n\0
14856>>>(36.s)	string	x	"%s"
14857# offset to the first sector like: 0 (If this is 0, assume it is 0x200) 29h=41 (DISPLAY3.DSK) 31h 43h 45h 46h 48h 50h 200h=512
14858>38	uleshort	!0	\b, 1st sector at %#x
14859# FOR DEBUGGING!
14860#>(38.s)	ubelong		x	SECTOR CONTENT %x
14861# not compressed floppy image implies readable DOS boot sector inside image
14862>>1		ubyte	!0x5A
14863# when not compressed it is readable as DOS boot sector via ./filesystems
14864#>>>(38.s)	indirect x	\b; contains
14865>38	uleshort	=0	\b, 1st sector at 0x200 (0)
14866# maybe standard DOS boot sector; NO example FOUND HERE!
14867#>>0x200	indirect	x	\b; contains
14868
148690	string	\074CPM_Disk\076	disk image data (YAZE)
14870
14871# From: 	Joerg Jenderek
14872# URL:		https://en.wikipedia.org/wiki/Central_Point_Software#cite_note-6
14873# Reference:	https://www.robcraig.com/download/transcopy-5-x-file-format
14874#		https://www.robcraig.com/download/transcopy-file-format-by-gene-thompson
14875#		http://mark0.net/download/triddefs_xml.7z/defs/t/tc-transcopy.trid.xml
14876# TransCopy signature
148770		beshort		0x5AA5
14878# skip Intel serial flash ROM with invalid 0 disk sides handled by ./intel
14879>0x103		ubyte		!0
14880# skip Intel serial flash ROM with unlikely "high" start cylinder 100 handled by ./intel
14881#>>0x101		ubyte		<100		VALID_START_CYLINDER
14882# skip Intel serial flash ROM with unlikely description handled by ./intel
14883#>>>2		beshort		!0xF00f		VALID_DESCRIPTION
14884# skip Intel serial flash ROM with invalid disk types 89h 88h handled by ./intel
14885#>>>>0x100	byte		!0x89		VALID_DISK_TYPE
14886>>0	use	tc-floppy
14887#	display information of Central Point Software (CPS) Option Board TransCopy floppy image
148880	name		tc-floppy
14889>0		beshort		x		TransCopy disk image
14890#!:mime	application/octet-stream
14891!:mime	application/x-floppy-image-tc
14892# like: disk04.tc VOCALC2.TC WIZ5_A.tc WIZ2_720.IMG
14893!:ext	tc/img
14894# 1st description (optional 0-terminated maximal 32) like:
14895# "Project Workbench 2.20" "Visi On Calc" "Wizardry V Disk 1 of 3"
14896>2		string		>\0		%.32s
14897# 2nd desc. (optional 0-terminated maximal 32) like:
14898# "(1988)." "Advanced - Utility" 'Program Disk 2"
14899>0x22		string		>\0		"%.32s"
14900# Looks like ascii (like MESSAGES) formatted with attribute bytes (190)?
14901# not needed for disk copy
14902#>>0x42		string		x		'%.190s'
14903#>>0x88		lestring16	x		"%.8s"
14904# disktype: 2~MFM High Density 3~MFM Double Density 4~Apple II GCR 5~FM Single Density
14905# 6~Commodore GCR 7~MFM Double Density 8~Commodore Amiga Ch~Atari FM FFh~Unknown
14906>0x100		ubyte		!0xFF		\b, disk type %u
14907# StartingCylinder like: 0
14908>0x101		ubyte		x		\b, cylinder
14909>0x101		ubyte		!0		start=%u
14910# EndingCylinder like: 40 (often) 41 79
14911>0x102		ubyte		x		end=%u
14912# NumberOfSides like: 2
14913>0x103		ubyte		!2		\b, %u sides
14914# TrackIncrement like: 1
14915>0x104		ubyte		!1		\b, track increment %u
14916# TrackPosTbl Track skew
14917#>0x105		ubequad		x		\b, Track skew %#16.16llx
14918# TrackOffsTbl
14919#>0x305		ubequad		x		\b, TrackOffsTbl %#16.16llx
14920# TrackLngthTbl
14921#>0x505		ubequad		x		\b, TrackLngthTbl %#16.16llx
14922# TrackTypeTable
14923#>0x705		ubequad		x		\b, TrackTypeTable %#16.16llx
14924# Address mark timing
14925#>0x905		ubequad		x		\b, Address mark timing %#16.16llx
14926# Track fragment
14927#>0x2905 ubequad			!0		\b, Track fragment %#16.16llx
14928# Track data
14929#>0x4000		ubequad		!0		\b, Track data %#16.16llx
14930
14931# ReFS
14932# Richard W.M. Jones <rjones@redhat.com>
149330	string	\0\0\0ReFS\0	ReFS filesystem image
14934
14935# EFW encase image file format:
14936# Gregoire Passault
14937# http://www.forensicswiki.org/wiki/Encase_image_file_format
149380	string	EVF\x09\x0d\x0a\xff\x00	EWF/Expert Witness/EnCase image file format
14939
14940# UBIfs
14941# Linux kernel sources: fs/ubifs/ubifs-media.h
149420	lelong	0x06101831
14943>0x16	leshort	0		UBIfs image
14944>0x08	lequad	x		\b, sequence number %llu
14945>0x10	leshort x		\b, length %u
14946>0x04	lelong	x		\b, CRC %#08x
14947
149480	lelong	0x23494255
14949>0x04	leshort	<2
14950>0x05	string	\0\0\0
14951>0x1c	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
14952>0x04	leshort	x		UBI image, version %u
14953
14954# NEC PC-88 2D disk image
14955# From Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
149560x20		ulelong&0xFFFFFEFF	0x2A0
14957>0x10		string			\0\0\0\0\0\0\0\0\0\0
14958>>0x280		string			\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
14959>>>0x1A		ubyte&0xEF		0
14960>>>>0x1B	ubyte&0x8F		0
14961>>>>>0x1B	ubyte&70		<0x40
14962>>>>>>0x1C	ulelong			>0x21
14963>>>>>>>0	regex	[[:print:]]*	NEC PC-88 disk image, name=%s
14964>>>>>>>>0x1B	ubyte	0		\b, media=2D
14965>>>>>>>>0x1B	ubyte	0x10		\b, media=2DD
14966>>>>>>>>0x1B	ubyte	0x20		\b, media=2HD
14967>>>>>>>>0x1B	ubyte	0x30		\b, media=1D
14968>>>>>>>>0x1B	ubyte	0x40		\b, media=1DD
14969>>>>>>>>0x1A	ubyte	0x10		\b, write-protected
14970
14971# HDD Raw Copy Tool disk image, file extension: .imgc
14972# From Benjamin Vanheuverzwijn <bvanheu@gmail.com>
149730	pstring	HDD\ Raw\ Copy\ Tool	%s
14974>0x100	pstring	x			%s
14975>0x200	pstring	x			- HD model: %s
14976#>0x300	pstring	x			unknown %s
14977>0x400	pstring	x			serial: %s
14978#>0x500	pstring	x			unknown: %s
14979!:ext	imgc
14980
14981# http://martin.hinner.info/fs/bfs/bfs-structure.html
149820	lelong	0x1BADFACE		SCO UnixWare BFS filesystem
14983
14984# https://arstechnica.com/information-technology/2018/07/the-beos-filesystem/
1498532	lelong	0x42465331		BE/OS BFS1 filesystem
14986>36	lelong	x			\b, byte order %d
14987>40	lelong	x			\b, block size %d
14988>44	lelong	x			\b, block shift %d
14989>48	lequad	x			\b, total blocks %lld
14990>56	lequad	x			\b, used blocks %lld
14991
14992
149930	name next
14994>0	lelong	x			\b, size %d
14995>4	string	x			\b, label %s
14996
14997# https://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-44.3\
14998# /IONeXTPartitionScheme.h
149990	string	NeXT			NeXT version 1 disklabel
15000>12	use next
150010	string	dlV1			NeXT version 2 disklabel
15002>12	use next
150030	string	dlV2			NeXT version 3 disklabel
15004>12	use next
15005
15006# bcachefs
15007# From: Thomas Wei�schuh <thomas@t-8ch.de>
15008
150090	name	bcachefs-uuid
15010>0	ubelong		x	\b%08x
15011>4	ubeshort	x	\b-%04x
15012>6	ubeshort	x	\b-%04x
15013>8	ubeshort	x	\b-%04x
15014>10	ubelong		x	\b-%08x
15015>14	ubeshort	x	\b%04x
15016
150170x1018		string		\xc6\x85\x73\xf6\x4e\x1a\x45\xca\x82\x65\xf5\x7f\x48\xba\x6d\x81	bcachefs
15018>0x1068		lequad		8	\b, UUID=
15019>>0x1038	use		bcachefs-uuid
15020>>0x1048	string		>0	\b, label "%.32s"
15021>>0x1010	uleshort	x	\b, version %u
15022>>0x1012	uleshort	x	\b, min version %u
15023>>0x107a	byte		x	\b, device %d
15024# assumes the first field is the members field
15025>>0x12f4	ulelong		0x01	\b/UUID=
15026>>>0x12f0	default		x
15027>>>&(0x107a.b*56)	use	bcachefs-uuid
15028>>0x107b	byte		x	\b, %d devices
15029>>0x1090	byte		^0x02	\b (unclean)
15030
15031# EROFS
15032# https://kernel.googlesource.com/pub/scm/linux/kernel/git/xiang/erofs-utils/\
15033# +/refs/heads/experimental/include/erofs_fs.h#12
150341024		lelong		0xE0F5E1E2	EROFS filesystem
15035#>1028		lelong		x		\b, checksum=%#x
15036>1032		lelong		>0		\b, compat:
15037>>1032		lelong		&1		SB_CHKSUM
15038>>1032		lelong		&2		MTIME
15039>1036		byte		x		\b, blocksize=%u
15040>1037		byte		x		\b, exslots=%u
15041#>1038		leshort		x		\b, root_nid=%d
15042#>1040		lequad		x		\b, inodes=%ld
15043#>1048		leldate		x		\b, build_time=%s
15044#>1056		lelong		x		\b.%d
15045#>1060		lelong		x		\b, blocks=%d
15046#>1064		lelong		x		\b, metadata@%#x
15047#>1068		lelong		x		\b, xattr@%#x
15048>1072		guid		x		\b, uuid=%s
15049>1088		string		>0		\b, name=%s
15050>1104		lelong		>0		\b, incompat:
15051>>1104		lelong		&1		LZ4_0PADDING
15052>>1104		lelong		&2		BIG_PCLUSTER
15053>>1104		lelong		&4		CHUNKED_FILE
15054>>1104		lelong		&8		DEVICE_TABLE
15055>>1104		lelong		&16		ZTAILPACKING
15056
15057#------------------------------------------------------------------------------
15058# $File: finger,v 1.3 2019/04/19 00:42:27 christos Exp $
15059# fingerprint:  file(1) magic for fingerprint data
15060# XPM bitmaps)
15061#
15062
15063# https://cgit.freedesktop.org/libfprint/libfprint/tree/libfprint/data.c
15064
150650	string	FP1		libfprint fingerprint data V1
15066>3	beshort	x		\b, driver_id %x
15067>5	belong	x		\b, devtype %x
15068
150690	string	FP2		libfprint fingerprint data V2
15070>3	beshort	x		\b, driver_id %x
15071>5	belong	x		\b, devtype %x
15072
15073#------------------------------------------------------------------------------
15074# $File: flash,v 1.15 2019/04/19 00:42:27 christos Exp $
15075# flash:	file(1) magic for Macromedia Flash file format
15076#
15077# See
15078#
15079#	https://www.macromedia.com/software/flash/open/
15080#	https://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/\
15081#	en/devnet/swf/pdf/swf-file-format-spec.pdf page 27
15082#
15083
150840   name	swf-details
15085
15086>0	string		F
15087>>8	byte&0xfd	0x08		Macromedia Flash data
15088!:mime	application/x-shockwave-flash
15089>>>3	byte		x		\b, version %d
15090>>8	byte&0xfe	0x10		Macromedia Flash data
15091!:mime	application/x-shockwave-flash
15092>>>3	byte		x		\b, version %d
15093>>8	byte		0x18		Macromedia Flash data
15094!:mime	application/x-shockwave-flash
15095>>>3	byte		x		\b, version %d
15096>>8	beshort&0xff87	0x2000		Macromedia Flash data
15097!:mime	application/x-shockwave-flash
15098>>>3	byte		x		\b, version %d
15099>>8	beshort&0xffe0	0x3000		Macromedia Flash data
15100!:mime	application/x-shockwave-flash
15101>>>3	byte		x		\b, version %d
15102>>8	byte&0x7	0
15103>>>8	ubyte		>0x2f
15104>>>>9	ubyte		<0x20		Macromedia Flash data
15105!:mime	application/x-shockwave-flash
15106>>>>>3	byte		x		\b, version %d
15107
15108>0	string		C
15109>>8	byte		0x78		Macromedia Flash data (compressed)
15110!:mime	application/x-shockwave-flash
15111>>>3	byte		x		\b, version %d
15112
15113>0	string		Z
15114>>8	byte		0x5d		Macromedia Flash data (lzma compressed)
15115!:mime	application/x-shockwave-flash
15116>>>3	byte		x		\b, version %d
15117
15118
151191	string		WS
15120>4	ulelong		>14
15121>>3	ubyte		!0
15122>>>0	use		swf-details
15123
15124# From: Cal Peake <cp@absolutedigital.net>
151250	string		FLV\x01		Macromedia Flash Video
15126!:mime	video/x-flv
15127
15128#
15129# Yosu Gomez
151300	string	AGD2\xbe\xb8\xbb\xcd\x00	Macromedia Freehand 7 Document
151310	string	AGD3\xbe\xb8\xbb\xcc\x00	Macromedia Freehand 8 Document
15132# From Dave Wilson
151330	string	AGD4\xbe\xb8\xbb\xcb\x00	Macromedia Freehand 9 Document
15134
15135#------------------------------------------------------------------------------
15136#	$File: flif,v 1.1 2015/11/23 22:04:36 christos Exp $
15137#	flif:	Magic	data	for	file(1)	command.
15138#	FLIF	(Free	Lossless	Image	Format)
15139
151400	string	FLIF	FLIF
15141>4	string	<H	image data
15142>>6	beshort	x	\b, %u
15143>>8	beshort	x	\bx%u
15144>>5	string	1	\b, 8-bit/color,
15145>>5	string	2	\b, 16-bit/color,
15146>>4	string	1	\b, grayscale, non-interlaced
15147>>4	string	3	\b, RGB, non-interlaced
15148>>4	string	4	\b, RGBA, non-interlaced
15149>>4	string	A	\b, grayscale
15150>>4	string	C	\b, RGB, interlaced
15151>>4	string	D	\b, RGBA, interlaced
15152>4	string	>H	\b, animation data
15153>>5	ubyte	<255	\b, %i frames
15154>>>7	beshort	x	\b, %u
15155>>>9	beshort	x	\bx%u
15156>>>6	string	=1	\b, 8-bit/color
15157>>>6	string	=2	\b, 16-bit/color
15158>>5	ubyte	0xFF
15159>>>6	beshort	x	\b, %i frames,
15160>>>9	beshort	x	\b, %u
15161>>>11	beshort	x	\bx%u
15162>>>8	string	=1	\b, 8-bit/color
15163>>>8	string	=2	\b, 16-bit/color
15164>>4	string	=Q	\b, grayscale, non-interlaced
15165>>4	string	=S	\b, RGB, non-interlaced
15166>>4	string	=T	\b, RGBA, non-interlaced
15167>>4	string	=a	\b, grayscale
15168>>4	string	=c	\b, RGB, interlaced
15169>>4	string	=d	\b, RGBA, interlaced
15170
15171#------------------------------------------------------------------------------
15172# $File: fonts,v 1.51 2022/08/16 11:16:39 christos Exp $
15173# fonts:  file(1) magic for font data
15174#
151750	search/1	FONT		ASCII vfont text
151760	short		0436		Berkeley vfont data
151770	short		017001		byte-swapped Berkeley vfont data
15178
15179# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com
15180# Modified by:	Joerg Jenderek
15181# URL:		https://en.wikipedia.org/wiki/PostScript_fonts
15182#		http://fileformats.archiveteam.org/wiki/Adobe_Type_1
15183# Reference:	http://mark0.net/download/triddefs_xml.7z
15184#		defs/p/pfb.trid.xml
15185# Note:		PFB stands for Printer Font Binary
151860	string		%!PS-AdobeFont-1.	PostScript Type 1 font text
15187#!:mime	font/x-postscript-pfb
15188#!:ext	pfb
15189>20	string		>\0			(%s)
15190# http://www.nationalarchives.gov.uk/pronom/fmt/525
151916	string		%!PS-AdobeFont-1.
15192# skip DROID fmt-525-signature-id-816.pfb by checking for content after header
15193>24	ubyte		x			PostScript Type 1 font program data
15194#!:mime	application/octet-stream
15195!:mime	font/x-postscript-pfb
15196!:ext	pfb
15197# often followed by colon (3Ah) and space (20h) and font name like: DarkGardenMK LetterGothic
15198>>24	ubyte		=0x3A
15199>>>26	string		>\0			(%s)
15200# some times instead of colon %%CreationDate: and "font name" later
15201>>24	ubyte		!0x3A
15202# font name directive followed by def like: c0633bt_.pfb
15203>>>25	search/1247	/FontName\040/
15204# show font name in parentheses like: Frankfurt Lithos CharterBT-BoldItalic Courier10PitchBT-Bold
15205>>>>&0	regex		[A-Za-z0-9-]+		(%s)
15206# http://cd.textfiles.com/maxfonts/ATM/M/MIRROR__.PFB
152076	string		%PS-AdobeFont-1.	PostScript Type 1 font program data
15208!:mime	font/x-postscript-pfb
15209!:ext	pfb
15210# font name like:  Times-Mirror
15211>25	string		>\0			(%s)
152120	string		%!FontType1	PostScript Type 1 font program data
15213#!:mime	font/x-postscript-pfb
15214#!:ext	pfb
152156	string		%!FontType1	PostScript Type 1 font program data
15216#!:mime	application/octet-stream
15217!:mime	font/x-postscript-pfb
15218!:ext	pfb
15219# font name like: CaslonOpenFace FetteFraktur Kaufmann Linotext MesozoicGothic Old-Town
15220>23	string		>\0			(%s)
15221# http://cd.textfiles.com/maxfonts/ATM/P/PLAYBI.PFB
15222230	string		%!FontType1	PostScript Type 1 font program data
15223!:mime	font/x-postscript-pfb
15224!:ext	pfb
15225# font name like: Playbill
15226>247	string		>\0			(%s)
152270	string		%!PS-Adobe-3.0\ Resource-Font	PostScript Type 1 font text
15228#!:mime	font/x-postscript-pfb
15229#!:ext	pfb
15230
15231# Summary:	PostScript Type 1 Printer Font Metrics
15232# URL:		https://en.wikipedia.org/wiki/PostScript_fonts
15233# Reference:	https://partners.adobe.com/public/developer/en/font/5178.PFM.pdf
15234# Modified by:	Joerg Jenderek
15235# Note:		moved from ./msdos magic
15236# dfVersion 256=0100h
152370		uleshort	0x0100
15238# GRR: line above is too general as it catches also TrueType font,
15239# raw G3 data FAX, WhatsApp encrypted and Panorama database
15240# dfType 129=0081h
15241>66		uleshort	0x0081
15242# dfVertRes 300=012Ch not needed as additional test
15243#>>70		uleshort	0x012c
15244# dfHorizRes 300=012Ch
15245#>>>72		uleshort	0x012c
15246# dfDriverInfo points to postscript information section
15247>>(101.l)	string/c	Postscript	Printer Font Metrics
15248# above labeled "PFM data" by ./msdos (version 5.28) or "Adobe Printer Font Metrics" by TrID
15249!:mime	application/x-font-pfm
15250# AppleShare Print Server
15251#!:apple	ASPS????
15252!:ext	pfm
15253# dfCopyright 60 byte null padded Copyright string. uncomment it to get old looking
15254#>>>6		string		>\060		- %-.60s
15255# dfDriverInfo
15256>>>139		ulelong		>0
15257# often abbreviated and same as filename
15258>>>>(139.l)	string		x		%s
15259# dfSize
15260>>>2		ulelong		x		\b, %d bytes
15261# dfFace 210=D2h 9Eh
15262>>>105		ulelong		>0
15263# Windows font name
15264>>>>(105.l)	string		x		\b, %s
15265# dfItalic
15266>>>80		ubyte		1		italic
15267# dfUnderline
15268>>>81		ubyte		1		underline
15269# dfStrikeOut
15270>>>82		ubyte		1		strikeout
15271# dfWeight 400=0x0190 300=0x012c 500=0x01f4 600=0x0258 700=0x02bc
15272>>>83		uleshort	>699		bold
15273# dfPitchAndFamily 16 17 48 49 64 65
15274>>>90		ubyte		16		serif
15275>>>90		ubyte		17		serif proportional
15276#>>>90		ubyte		48		other
15277>>>90		ubyte		49		proportional
15278>>>90		ubyte		64		script
15279>>>90		ubyte		65		script proportional
15280
15281# X11 font files in SNF (Server Natural Format) format
15282# updated by Joerg Jenderek at Feb 2013 and Nov 2021
15283# http://computer-programming-forum.com/51-perl/8f22fb96d2e34bab.htm
15284# URL:		http://fileformats.archiveteam.org/wiki/SNF
15285# Reference:	https://cgit.freedesktop.org/xorg/lib/libXfont/tree/src/bitmap/snfstr.h
152860	belong		00000004
15287# version2 same as version1 in struct _snfFontInfo
15288>104	belong		00000004		X11 SNF font data, MSB first
15289# GRR: line above is too general as it catches also DEGAS low-res bitmap like:
15290# http://cd.textfiles.com/geminiatari/FILES/GRAPHICS/ANIMAT/SPID_PAT/BIGSPID.PI1
15291!:mime	application/x-font-sfn
15292!:ext	snf
15293# GRR: line below is too general as it catches also Xbase index file t3-CHAR.NDX
152940	lelong		00000004
15295>104	lelong		00000004		X11 SNF font data, LSB first
15296!:mime	application/x-font-sfn
15297# Reference:    http://mark0.net/download/triddefs_xml.7z/defs/s/snf-x11-lsb.trid.xml
15298!:ext	snf
15299
15300# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com)
153010	search/1	STARTFONT\ 		X11 BDF font text
15302
15303# From: Joerg Jenderek
15304# URL: https://grub.gibibit.com/New_font_format
15305# Reference: util/grub-mkfont.c
15306#		include/grub/fontformat.h
15307# FONT_FORMAT_SECTION_NAMES_FILE
153080			string		FILE
15309# FONT_FORMAT_PFF2_MAGIC
15310>8			string		PFF2
15311# leng 4 only at the moment
15312>>4			ubelong		4
15313# FONT_FORMAT_SECTION_NAMES_FONT_NAME
15314>>>12			string		NAME		GRUB2 font
15315!:mime			application/x-font-pf2
15316!:ext			pf2
15317# length of font_name
15318>>>>16			ubelong		>0
15319# font_name
15320>>>>>20			string		>\0		"%-s"
15321
15322# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com)
15323# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides)
153240	string		\001fcp			X11 Portable Compiled Font data,
15325>12	lelong		^0x08			bit: LSB,
15326>12	lelong		&0x08			bit: MSB,
15327>12	lelong		^0x04			byte: LSB first
15328>12	lelong		&0x04			byte: MSB first
153290	string		D1.0\015		X11 Speedo font data
15330
15331#------------------------------------------------------------------------------
15332# FIGlet fonts and controlfiles
15333# From figmagic supplied with Figlet version 2.2
15334# "David E. O'Brien" <obrien@FreeBSD.ORG>
153350	string		flf		FIGlet font
15336>3	string		>2a		version %-2.2s
153370	string		flc		FIGlet controlfile
15338>3	string		>2a		version %-2.2s
15339
15340# libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu)
15341# Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++
153420	belong		0x14025919	libGrx font data,
15343>8	leshort		x		%dx
15344>10	leshort		x		\b%d
15345>40	string		x		%s
15346# Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu)
15347# Update:	Joerg Jenderek
15348# URL:		http://fileformats.archiveteam.org/wiki/CPI
15349# Reference:	http://www.delorie.com/djgpp/doc/rbinter/it/58/17.html
153500	belong		0xff464f4e	DOS code page font data collection
15351!:mime	font/x-dos-cpi
15352!:ext	cpi
153530	string		\x7fDRFONT	DR-DOS code page font data collection
15354!:mime	font/x-drdos-cpi
15355!:ext	cpi
153567	belong		0x00454741	DOS code page font data
153577	belong		0x00564944	DOS code page font data (from Linux?)
153584098	string		DOSFONT		DOSFONT2 encrypted font data
15359
15360# From: Joerg Jenderek
15361# URL: http://fileformats.archiveteam.org/wiki/GEM_bitmap_font
15362# Reference: http://cd.textfiles.com/ataricompendium/BOOK/HTML/APPENDC.HTM#cnt
15363#
15364# usual case with lightening mask and skewing mask 5555h~UU
15365#62	ulelong		0x55555555
15366# skip cl8m8ocofedso.testfile by looking for face size lower/equal 72
15367#>2	uleshort	<73
15368#>>0	use		gdos-font
15369# BOX18.GFT COWBOY30.GFT ROYALK30.GFT
15370#62	ulelong		0
15371# skip ISO 9660 CD-ROM ./filesystem by looking for low positive face size
15372#>2	uleshort	>2
15373# skip DOS 2.0 backup id file ./msdos by looking for face size lower/equal 72
15374#>>2	uleshort	<73
15375# skip MS oem.hlp, some Windows ICO ./msdos by looking for valid long name like WYE
15376#>>>4	ulelong		>0x001F1f1F
15377# skip Microsoft WinWord 2.0 ./msdos by looking for positive offset to font data
15378#>>>>76	ulelong		>83
15379#>>>>>0	use		gdos-font
153800	name		gdos-font
15381>0	uleshort	x		GEM GDOS font
15382!:mime	application/x-font-gdos
15383# also .eps found like AA070GEP.EPS AI360GEP.EPS
15384!:ext	fnt/gtf
15385# font name like Big&Tall, Celtic #s, Courier, University Bold, WYE
15386>4	string		x		%.32s
15387# face size in points 3-72 SLSS03CG.FNT H1CELT72.FNT
15388>2	uleshort	x		%u
15389# face ID (must be unique)
15390>0	uleshort	x		\b, ID %#4.4x
15391# lowest character index in face (4 but usually 32 for disk-loaded fonts)
15392#>36	uleshort	!32		\b, unusual character index %u
15393# width of the widest character like 0 8 10 12 16 24 32
15394#>50	uleshort	x		\b, %u char width
15395# width of the widest character cell like 8 11 12 14 15 16 33 67
15396#>52	uleshort	x		\b, %u cell width
15397# thickening size in pixel like 0 1 2 3 4 5 6 7 8
15398#>58	uleshort	x		\b, %u thick
15399# lightening mask to eliminate pixels, usually 5555h
15400>62	uleshort	!0x5555		\b, lightening mask %#x
15401# skewing mask to determine when to perform additional rotation when skewing, usually 5555h
15402>64	uleshort	!0x5555		\b, skewing mask %#x
15403# offset to optional horizontal offset table 0 58h~88 5eh 252h
15404#>68	ulelong		x		\b, %#x horizontal table offset
15405# offset of character offset table 54h for many *.GFT 55h 58h 5Eh 120h 1D4h 202h 220h
15406#>72	ulelong		x		\b, %#x coffset
15407# offset to font data like 116h 118h 158 20Ah 20Eh
15408>76	ulelong		x		\b, %#x foffset
15409# form width in bytes like 58 67 156 190 227 317 345
15410#>80	uleshort	x		\b, %u fwidth
15411# form height in bytes like 4 8 11 17 26 56 70 90 120 146 150
15412#>82	uleshort	x		\b, %u fheight
15413# pointer to the next font like 0 10000h 20000h 30000h 40000h 60000h 80000h E0000h D0000h
15414#>84	ulelong		x		\b, %#x noffset
15415
15416# downloadable fonts for browser (prints type) anthon@mnt.org
15417# https://tools.ietf.org/html/rfc3073
154180	string		PFR1		Portable Font Resource font data (new)
15419>102	string		>0		\b: %s
154200	string		PFR0		Portable Font Resource font data (old)
15421>4	beshort		>0		version %d
15422
15423# True Type fonts
15424# Modified by: Joerg Jenderek
15425# URL: https://en.wikipedia.org/wiki/TrueType
15426# Reference: https://developer.apple.com/fonts/TrueType-Reference-Manual/
15427#
15428# sfnt version "typ1" used by some Apple, but no example found
154290	string	typ1
15430>0	use		sfnt-font
15431>0	use		sfnt-names
15432# sfnt version "true" used by some Apple
154330	string	true
15434>0	use		sfnt-font
15435>0	use		sfnt-names
15436# GRR: below test is too general
15437# sfnt version often 0x00010000
154380	string	\000\001\000\000
15439>0	use		sfnt-font
15440>0	use		sfnt-names
15441#	validate and display sfnt font data like number of tables
154420	name		sfnt-font
15443# file 5.30 version assumes 00FFh as maximal number of tables
15444#>4	ubeshort	<0x0100
15445# maximal 27 tables found like in Skia.ttf
15446# 46 different table names mentioned on Apple specification
15447# skip 1st sequence of DOS 2 backup with path separator (\~92 or /~47) misinterpreted as table number
15448>4	ubeshort	<47
15449# skip bad examples with garbage table names like in a5.show HYPERC MAC
15450# tag names consist of up to four characters padded with spaces at end like
15451# BASE DSIG OS/2 Zapf acnt glyf cvt vmtx xref ...
15452>>12	regex/4l	\^[A-Za-z][A-Za-z][A-Za-z/][A-Za-z2\ ]
15453#>>>0	ubelong	x	\b, sfnt version %#x
15454>>>0	ubelong	!0x4f54544f	TrueType
15455!:mime	font/sfnt
15456!:apple	????tfil
15457# .ttf for TrueType font
15458# EUDC.tte created by privat character editor %WINDIR%\system32\eudcedit.exe
15459!:ext	ttf/tte
15460# sfnt version 4F54544Fh~OTTO
15461>>>0	ubelong	=0x4f54544f	OpenType
15462!:mime	font/otf
15463!:apple	????OTTO
15464!:ext	otf
15465>>>0	ubelong	x		Font data
15466# DSIG=44454947h table name implies a digitally signed font
15467# search range = number of tables * 16 =< maximal number of tables * 16 = 27 * 16 = 432
15468>>>12	search/432	DSIG		\b, digitally signed
15469>>>4	ubeshort	x		\b, %d tables
15470# minimal 9 tables found like in NISC18030.ttf
15471#>>>4	ubeshort	<10		TMIN
15472#>>>4	ubeshort	>24		TBIG
15473# table directory entries
15474>>>12	string		x		\b, 1st "%4.4s"
15475
15476#	search and display 1st name in sfnt font which is often copyright text
15477#	does not work inside font collections
154780	name		sfnt-names
15479# search for naming table
15480>12	search/432/s	name
15481# biggest offset 0x0100bd28 like Windows10 Fonts\simsunb.ttf
15482#>>>>&8	ubelong		>0x0100bd27	BIGGEST OFFSET
15483>>&8	ubelong		>0x00100000
15484# offset of name table
15485>>>&-4	ubelong		x		\b, name offset %#x
15486# GRR: pointer to name table only works if offset ~< FILE_BYTES_MAX = 100000h defined in src\file.h
15487>>&8	ubelong		<0x00100000
15488>>>&-16	ubelong		x
15489# name table
15490>>>>(&8.L)	ubequad	x
15491# invalid format selector
15492#>>>>>&-8	ubeshort	!0	\b, invalid selector %x
15493# minimal 3 name records found like in c:\Program Files (x86)\Tesseract-OCR\tessdata\pdf.ttf
15494# maximal 1227 name records found like in Apple Chancery.ttf
15495#>>>>>&-6	ubeshort	<0x4	mincount
15496#>>>>>&-6	ubeshort	>130	maxcount
15497>>>>>&-6	ubeshort	x	\b, %d names
15498# offset to start of string storage from start of table
15499#>>>>>&-4	ubeshort	x	\b, record offset %d
15500# 1st name record
15501# string offset from start of storage area
15502#>>>>>&8		ubeshort	x	\b, string offset %d
15503# string length
15504#>>>>>&6		ubeshort	x	\b, string length %d
15505# minimal name string 7 like in c:\Program Files (x86)\Kodi\addons\webinterface.default\lib\video-js\font\VideoJS.ttf
15506# also found 0 like in SWZCONLN.TTF
15507#>>>>>&6		ubeshort	<8	MIN STRING
15508# maximal name string 806 like in c:\Windows\Fonts\palabi.ttf
15509#>>>>>&6		ubeshort	>805	MAX STRING
15510# platform identifier: 0~Apple Unicode, 1~Macintosh, 3~Microsoft
15511#>>>>>&-2	ubeshort	>3	BAD PLATFORM
15512>>>>>&-2	ubeshort	0	\b, Unicode
15513>>>>>&-2	ubeshort	1	\b, Macintosh
15514>>>>>&-2	ubeshort	3	\b, Microsoft
15515# languageID (0~english Macintosh, 0409h~english Microsoft, ...)
15516>>>>>&2		ubeshort	>0	\b, language %#x
15517# name identifiers
15518# often 0~copyright, 1~font, 2~font subfamily, 5~version, 13~license, 19~sample, ...
15519>>>>>&4		ubeshort	>0	\b, type %d string
15520# platform specific encoding:
15521# 0~undefined character set, 1~UGL set with Unicode, 3~Unicode 2.0 BMP only, 4~Unicode 2.0
15522#>>>>>&0		ubeshort	x	\b, %d encoding
15523>>>>>&0		ubeshort	0
15524# handle only name string offset 0 because do not know how to add 2 relative offsets
15525>>>>>>&6		ubeshort	0
15526>>>>>>>&(&-14.S-18)	ubyte		!0
15527# GRR: instead 806 only first MAXstring = 96 characters are displayed as defined in src\file.h
15528# often copyright string that starts like \251 2006 The Monotype Corporation
15529>>>>>>>>&-1		string		x	\b, %-11.96s
15530# test for unicode string
15531>>>>>>>&(&-14.S-18)	ubyte		0
15532>>>>>>>>&0		lestring16	x	\b, %-11.96s
15533# unicode encoding
15534>>>>>&0		ubeshort	>0
15535>>>>>>&6		ubeshort	0
15536>>>>>>>&(&-14.S-17)	lestring16	x	\b, %-11.96s
15537
155380	string		\007\001\001\000Copyright\ (c)\ 199	Adobe Multiple Master font
155390	string		\012\001\001\000Copyright\ (c)\ 199	Adobe Multiple Master font
15540
15541# TrueType/OpenType font collections (.ttc)
15542# URL: https://en.wikipedia.org/wiki/OpenType
15543# https://www.microsoft.com/typography/otspec/otff.htm
15544# Modified by: Joerg Jenderek
15545# Note:	container for TrueType, OpenType font
155460	string		ttcf
15547# skip ASCII text
15548>4	ubyte		0
15549# sfnt version often 0x00010000 of 1st table is TrueType
15550>>(12.L)	ubelong	!0x4f54544f	TrueType
15551!:mime	font/ttf
15552!:apple	????tfil
15553!:ext	ttc
15554# sfnt version 4F54544Fh~OTTO of 1st table is OpenType font
15555>>(12.L)	ubelong	=0x4f54544f	OpenType
15556!:mime	font/otf
15557!:apple	????OTTO
15558# no example found for otc
15559!:ext	ttc/otc
15560>>4	ubyte		x		font collection data
15561#!:mime	font/collection
15562# TCC version
15563>>4	belong		0x00010000	\b, 1.0
15564>>4	belong		0x00020000	\b, 2.0
15565>>8	ubelong		>0		\b, %d fonts
15566# array offset size = fonts * offsetsize = fonts * 4
15567>>(8.L*4) ubequad	x
15568# 0x44454947 = 'DSIG'
15569>>>&4	belong		0x44534947	\b, digitally signed
15570# offset to 1st font
15571>>12	ubelong		x		\b, at %#x
15572# point to 1st font that starts with sfnt version
15573>>(12.L) use		sfnt-font
15574
15575# Opentype font data from Avi Bercovich
155760	string		OTTO		OpenType font data
15577!:mime application/vnd.ms-opentype
15578
15579# From: Alex Myczko <alex@aiei.ch>
155800	string		SplineFontDB:	Spline Font Database
15581!:mime application/vnd.font-fontforge-sfd
15582>14	string		x		version %s
15583
15584# EOT
155850x40	string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
15586>0x22	string		LP		Embedded OpenType (EOT)
15587# workaround until there's lepstring16
15588# >>0x52	lepstring16/h	>\0		\b, %s family
15589>>0x52	short	!0
15590>>>0x54	lestring16	x		\b, %s family
15591!:mime application/vnd.ms-fontobject
15592
15593# Web Open Font Format (.woff)
155940	name		woff
15595>4	belong		0x00010000	\b, TrueType
15596>4	belong		0x4F54544F	\b, CFF
15597>4	belong		0x74727565	\b, TrueType
15598>4	default		x
15599>>4	belong		x		\b, flavor %d
15600>8	belong		x		\b, length %d
15601#>12	beshort		x		\b, numTables %d
15602#>14	beshort		x		\b, reserved %d
15603#>16	belong		x		\b, totalSfntSize %d
15604
15605# https://www.w3.org/TR/WOFF/
156060	string		wOFF	Web Open Font Format
15607!:mime font/woff
15608>0	use		woff
15609>20	beshort		x	\b, version %d
15610>22	beshort		x	\b.%d
15611# https://www.w3.org/TR/WOFF2/
156120	string		wOF2	Web Open Font Format (Version 2)
15613!:mime font/woff2
15614!:ext	woff2
15615>0	use		woff
15616#>20	belong		x	\b, totalCompressedSize %d
15617>24	beshort		x	\b, version %d
15618>26	beshort		x	\b.%d
15619
15620#------------------------------------------------------------------------------
15621# $File: forth,v 1.4 2021/04/26 15:56:00 christos Exp $
15622# forth:  file(1) magic for various Forth environments
15623# From: Lubomir Rintel <lkundrak@v3.sk>
15624#
15625
15626# Has a FORTH stack diagram and something that looks very much like a FORTH
15627# multi-line word definition. Probably a FORTH source.
156280       regex   \[[:space:]]\\(([[:space:]].*)?\ --\ (.*[[:space:]])?\\)
15629>0      regex   \^:\[[:space:]]
15630>>0     regex   \^;$				FORTH program
15631!:mime  text/x-forth
15632
15633# Inline word definition complete with a stack diagram
156340       regex   \^:[[:space:]].*[[:space:]]\\(([[:space:]].*)?\ --\ (.*[[:space:]])?\\)[[:space:]].*[[:space:]];$	FORTH program
15635!:mime  text/x-forth
15636
15637# Various dictionary images used by OpenFirware FORTH environment
15638
156390	lelong	0xe1a00000
15640>8	lelong	0xe1a00000
15641# skip raspberry pi kernel image kernel7.img by checking for positive text length
15642>>24	lelong	>0		ARM OpenFirmware FORTH Dictionary,
15643>>>24	lelong	x		Text length: %d bytes,
15644>>>28	lelong	x		Data length: %d bytes,
15645>>>32	lelong	x		Text Relocation Table length: %d bytes,
15646>>>36	lelong	x		Data Relocation Table length: %d bytes,
15647>>>40	lelong	x		Entry Point: %#08X,
15648>>>44	lelong	x		BSS length: %d bytes
15649
156500	string	MP
15651>28	lelong	1		x86 OpenFirmware FORTH Dictionary,
15652>>4	leshort	x		%d blocks
15653>>2	leshort	x		+ %d bytes,
15654>>6	leshort	x		%d relocations,
15655>>8	leshort	x		Header length: %d paragraphs,
15656>>10	leshort	x		Data Size: %d
15657>>12	leshort	x		- %d 4K pages,
15658>>14	lelong	x		Initial Stack Pointer: %#08X,
15659>>20	lelong	x		Entry Point: %#08X,
15660>>24	lelong	x		First Relocation Item: %d,
15661>>26	lelong	x		Overlay Number: %d,
15662>>18	leshort	x		Checksum: %#08X
15663
156640	belong	0x48000020	PowerPC OpenFirmware FORTH Dictionary,
15665>4	belong	x		Text length: %d bytes,
15666>8	belong	x		Data length: %d bytes,
15667>12	belong	x		BSS length: %d bytes,
15668>16	belong	x		Symbol Table length: %d bytes,
15669>20	belong	x		Entry Point: %#08X,
15670>24	belong	x		Text Relocation Table length: %d bytes,
15671>28	belong	x		Data Relocation Table length: %d bytes
15672
156730	lelong	0x10000007	MIPS OpenFirmware FORTH Dictionary,
15674>4	lelong	x		Text length: %d bytes,
15675>8	lelong	x		Data length: %d bytes,
15676>12	lelong	x		BSS length: %d bytes,
15677>16	lelong	x		Symbol Table length: %d bytes,
15678>20	lelong	x		Entry Point: %#08X,
15679>24	lelong	x		Text Relocation Table length: %d bytes,
15680>28	lelong	x		Data Relocation Table length: %d bytes
15681
15682# Dictionary images used by minimal C FORTH environments, any platform,
15683# using native byte order.
15684
15685# Weak.
15686#0	short	0x5820		cForth 16-bit Dictionary,
15687#>2	short	x		Serial: %#08X,
15688#>4	short	x		Dictionary Start: %#08X,
15689#>6	short	x		Dictionary Size: %d bytes,
15690#>8	short	x		User Area Start: %#08X,
15691#>10	short	x		User Area Size: %d bytes,
15692#>12	short	x		Entry Point: %#08X
15693
156940	long	0x581120	cForth 32-bit Dictionary,
15695>4	long	x		Serial: %#08X,
15696>8	long	x		Dictionary Start: %#08X,
15697>12	long	x		Dictionary Size: %d bytes,
15698>16	long	x		User Area Start: %#08X,
15699>20	long	x		User Area Size: %d bytes,
15700>24	long	x		Entry Point: %#08X
15701
15702#------------------------------------------------------------------------------
15703# $File: fortran,v 1.10 2015/11/05 18:47:16 christos Exp $
15704# FORTRAN source
15705# Check that the first 100 lines start with C or whitespace first.
157060       regex/100l      !\^[^Cc\ \t].*$
15707>0	regex/100l	\^[Cc][\ \t]	FORTRAN program text
15708!:mime	text/x-fortran
15709!:strength - 5
15710
15711#------------------------------------------------------------------------------
15712# $File: frame,v 1.14 2019/11/25 00:31:30 christos Exp $
15713# frame:  file(1) magic for FrameMaker files
15714#
15715# This stuff came on a FrameMaker demo tape, most of which is
15716# copyright, but this file is "published" as witness the following:
15717#
15718# Note that this is the Framemaker Maker Interchange Format, not the
15719# Normal format which would be application/vnd.framemaker.
15720#
157210	string		\<MakerFile	FrameMaker document
15722!:mime	application/x-mif
15723>11	string		5.5		 (5.5
15724>11	string		5.0		 (5.0
15725>11	string		4.0		 (4.0
15726>11	string		3.0		 (3.0
15727>11	string		2.0		 (2.0
15728>11	string		1.0		 (1.0
15729>14	byte		x		  %c)
15730# URL:		http://fileformats.archiveteam.org/wiki/Maker_Interchange_Format
15731# Reference:	https://help.adobe.com/en_US/framemaker/mifreference/mifref.pdf
15732# Update:	Joerg Jenderek 2019 Nov
157330	string		\<MIFFile	FrameMaker MIF (ASCII) file
15734# https://www.iana.org/assignments/media-types/application/vnd.mif
15735!:mime	application/vnd.mif
15736# mif most but also find bookTOC.framemif
15737!:ext	mif/framemif
15738# followed by space~20h
15739#>8	ubyte		0x20		\b, space before version
15740# 3 characters of version number of the MIF language like 1.0, 2.0 ... 2015 ...
15741>9	string		x		(%.3s
15742# if not greater sign then display 4th character of version
15743>12	ubyte		=0x3e		\b)
15744>12	ubyte		!0x3e		\b%c)
15745# comment starting with # shows the name+version number of generating program
15746>13	search/3	#
15747>>&0	string		x		"%s"
157480	search/1	\<MakerDictionary	FrameMaker Dictionary text
15749!:mime	application/x-mif
15750>17	string		3.0		 (3.0)
15751>17	string		2.0		 (2.0)
15752>17	string		1.0		 (1.x)
157530	string		\<MakerScreenFont	FrameMaker Font file
15754!:mime	application/x-mif
15755>17	string		1.01		 (%s)
157560	string		\<MML		FrameMaker MML file
15757!:mime	application/x-mif
157580	string		\<BookFile	FrameMaker Book file
15759!:mime	application/x-mif
15760>10	string		3.0		 (3.0
15761>10	string		2.0		 (2.0
15762>10	string		1.0		 (1.0
15763>13	byte		x		  %c)
15764# XXX - this book entry should be verified, if you find one, uncomment this
15765#0	string		\<Book\040 	FrameMaker Book (ASCII) file
15766#!:mime	application/x-mif
15767#>6	string		3.0		 (3.0)
15768#>6	string		2.0		 (2.0)
15769#>6	string		1.0		 (1.0)
157700	string		\<Maker\040Intermediate\040Print\040File	FrameMaker IPL file
15771!:mime	application/x-mif
15772
15773#------------------------------------------------------------------------------
15774# $File: freebsd,v 1.9 2022/01/19 12:44:13 christos Exp $
15775# freebsd:  file(1) magic for FreeBSD objects
15776#
15777# All new-style FreeBSD magic numbers are in host byte order (i.e.,
15778# little-endian on x86).
15779#
15780# XXX - this comes from the file "freebsd" in a recent FreeBSD version of
15781# "file"; it, and the NetBSD stuff in "netbsd", appear to use different
15782# schemes for distinguishing between executable images, shared libraries,
15783# and object files.
15784#
15785# FreeBSD says:
15786#
15787#    Regardless of whether it's pure, demand-paged, or none of the
15788#    above:
15789#
15790#	if the entry point is < 4096, then it's a shared library if
15791#	the "has run-time loader information" bit is set, and is
15792#	position-independent if the "is position-independent" bit
15793#	is set;
15794#
15795#	if the entry point is >= 4096 (or >4095, same thing), then it's
15796#	an executable, and is dynamically-linked if the "has run-time
15797#	loader information" bit is set.
15798#
15799# On x86, NetBSD says:
15800#
15801#    If it's neither pure nor demand-paged:
15802#
15803#	if it has the "has run-time loader information" bit set, it's
15804#	a dynamically-linked executable;
15805#
15806#	if it doesn't have that bit set, then:
15807#
15808#	    if it has the "is position-independent" bit set, it's
15809#	    position-independent;
15810#
15811#	    if the entry point is non-zero, it's an executable, otherwise
15812#	    it's an object file.
15813#
15814#    If it's pure:
15815#
15816#	if it has the "has run-time loader information" bit set, it's
15817#	a dynamically-linked executable, otherwise it's just an
15818#	executable.
15819#
15820#    If it's demand-paged:
15821#
15822#	if it has the "has run-time loader information" bit set,
15823#	then:
15824#
15825#	    if the entry point is < 4096, it's a shared library;
15826#
15827#	    if the entry point is = 4096 or > 4096 (i.e., >= 4096),
15828#	    it's a dynamically-linked executable);
15829#
15830#	if it doesn't have the "has run-time loader information" bit
15831#	set, then it's just an executable.
15832#
15833# (On non-x86, NetBSD does much the same thing, except that it uses
15834# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K
15835# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's
15836# had 8K pages; dunno about MIPS.)
15837#
15838# I suspect the two will differ only in perverse and uninteresting cases
15839# ("shared" libraries that aren't demand-paged and whose pages probably
15840# won't actually be shared, executables with entry points <4096).
15841#
15842# I leave it to those more familiar with FreeBSD and NetBSD to figure out
15843# what the right answer is (although using ">4095", FreeBSD-style, is
15844# probably better than separately checking for "=4096" and ">4096",
15845# NetBSD-style).  (The old "netbsd" file analyzed FreeBSD demand paged
15846# executables using the NetBSD technique.)
15847#
158480	lelong&0377777777	041400407	FreeBSD/i386
15849>20	lelong			<4096
15850>>3	byte&0xC0		&0x80		shared library
15851>>3	byte&0xC0		0x40		PIC object
15852>>3	byte&0xC0		0x00		object
15853>20	lelong			>4095
15854>>3	byte&0x80		0x80		dynamically linked executable
15855>>3	byte&0x80		0x00		executable
15856>16	lelong			>0		not stripped
15857
158580	lelong&0377777777	041400410	FreeBSD/i386 pure
15859>20	lelong			<4096
15860>>3	byte&0xC0		&0x80		shared library
15861>>3	byte&0xC0		0x40		PIC object
15862>>3	byte&0xC0		0x00		object
15863>20	lelong			>4095
15864>>3	byte&0x80		0x80		dynamically linked executable
15865>>3	byte&0x80		0x00		executable
15866>16	lelong			>0		not stripped
15867
158680	lelong&0377777777	041400413	FreeBSD/i386 demand paged
15869>20	lelong			<4096
15870>>3	byte&0xC0		&0x80		shared library
15871>>3	byte&0xC0		0x40		PIC object
15872>>3	byte&0xC0		0x00		object
15873>20	lelong			>4095
15874>>3	byte&0x80		0x80		dynamically linked executable
15875>>3	byte&0x80		0x00		executable
15876>16	lelong			>0		not stripped
15877
158780	lelong&0377777777	041400314	FreeBSD/i386 compact demand paged
15879>20	lelong			<4096
15880>>3	byte&0xC0		&0x80		shared library
15881>>3	byte&0xC0		0x40		PIC object
15882>>3	byte&0xC0		0x00		object
15883>20	lelong			>4095
15884>>3	byte&0x80		0x80		dynamically linked executable
15885>>3	byte&0x80		0x00		executable
15886>16	lelong			>0		not stripped
15887
15888# XXX gross hack to identify core files
15889# cores start with a struct tss; we take advantage of the following:
15890# byte 7:     highest byte of the kernel stack pointer, always 0xfe
15891#      8/9:   kernel (ring 0) ss value, always 0x0010
15892#      10 - 27: ring 1 and 2 ss/esp, unused, thus always 0
15893#      28:    low order byte of the current PTD entry, always 0 since the
15894#             PTD is page-aligned
15895#
158967	string	\357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	FreeBSD/i386 a.out core file
15897>1039	string	>\0	from '%s'
15898
15899# /var/run/ld.so.hints
15900# What are you laughing about?
159010	lelong			011421044151	ld.so hints file (Little Endian
15902>4	lelong			>0		\b, version %d)
15903>4	belong			<1		\b)
159040	belong			011421044151	ld.so hints file (Big Endian
15905>4	belong			>0		\b, version %d)
15906>4	belong			<1		\b)
15907
15908#
15909# Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities
15910#
159110	string	SCRSHOT_	scrshot(1) screenshot,
15912>8	byte	x		version %d,
15913>9	byte	2		%d bytes in header,
15914>>10	byte	x		%d chars wide by
15915>>11	byte	x		%d chars high
15916
15917#
15918# FreeBSD kernel minidumps
15919#
159200	string	minidump\040FreeBSD/	FreeBSD kernel minidump
15921# powerpc uses 32-byte magic, followed by 32-byte mmu kind, then version
15922>17	string	powerpc
15923>>17	string	>\0			for %s,
15924>>>32	string	>\0			%s,
15925>>>>64	byte	0			big endian,
15926>>>>>64	belong	x			version %d
15927>>>>64	default	x			little endian,
15928>>>>>64	lelong	x			version %d
15929# all other architectures use 24-byte magic, followed by version
15930>17	default	x
15931>>17	string	>\0			for %s,
15932>>>24	byte	0			big endian,
15933>>>>24	belong	x			version %d
15934>>>24	default	x			little endian,
15935>>>>24	lelong	x			version %d
15936
15937#------------------------------------------------------------------------------
15938# $File: fsav,v 1.22 2021/04/26 15:56:00 christos Exp $
15939# fsav:  file(1) magic for datafellows fsav virus definition files
15940# Anthon van der Neut (anthon@mnt.org)
15941
15942# ftp://ftp.f-prot.com/pub/{macrdef2.zip,nomacro.def}
159430	beshort		0x1575		fsav macro virus signatures
15944>8	leshort		>0		(%d-
15945>11	byte		>0		\b%02d-
15946>10	byte		>0		\b%02d)
15947# ftp://ftp.f-prot.com/pub/sign.zip
15948#10	ubyte		<12
15949#>9	ubyte		<32
15950#>>8	ubyte		0x0a
15951#>>>12	ubyte		0x07
15952#>>>>11	uleshort	>0		fsav DOS/Windows virus signatures (%d-
15953#>>>>10	byte		0		\b01-
15954#>>>>10	byte		1		\b02-
15955#>>>>10	byte		2		\b03-
15956#>>>>10	byte		3		\b04-
15957#>>>>10	byte		4		\b05-
15958#>>>>10	byte		5		\b06-
15959#>>>>10	byte		6		\b07-
15960#>>>>10	byte		7		\b08-
15961#>>>>10	byte		8		\b09-
15962#>>>>10	byte		9		\b10-
15963#>>>>10	byte		10		\b11-
15964#>>>>10	byte		11		\b12-
15965#>>>>9	ubyte		>0		\b%02d)
15966# ftp://ftp.f-prot.com/pub/sign2.zip
15967#0	ubyte		0x62
15968#>1	ubyte		0xF5
15969#>>2	ubyte		0x1
15970#>>>3	ubyte		0x1
15971#>>>>4	ubyte		0x0e
15972#>>>>>13		ubyte	>0		fsav virus signatures
15973#>>>>>>11	ubyte	x		size %#02x
15974#>>>>>>12	ubyte	x		\b%02x
15975#>>>>>>13	ubyte	x		\b%02x bytes
15976
15977# Joerg Jenderek: joerg dot jenderek at web dot de
15978# clamav-0.100.2\docs\html\node60.html
15979# https://github.com/vrtadmin/clamav-faq/raw/master/manual/clamdoc.pdf
15980# ClamAV virus database files start with a 512 bytes colon separated header
15981# ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime
15982# + gzipped (optional) tarball files
15983# output can often be verified by `sigtool --info=FILE`
159840	string		ClamAV-VDB:	Clam AntiVirus
15985# padding spaces implies database
15986>511	ubyte		=0x20		database
15987!:mime	application/x-clamav-database
15988# empty build time
15989>>10	string		=::		(unsigned)
15990# sigtool(1) man page
15991!:ext	cud
15992# display some text to avoid error like:
15993# Magdir/fsav, 78: Warning: Current entry does not yet have a description for adding a EXTENSION type
15994# file: could not find any valid magic files! (No error)
15995>>10	default		x		(with buildtime)
15996#>>10	default		x
15997# clamtmp is used for temporarily database like update process
15998# for pure tar database only cld extension found
15999!:ext	cld/cvd/clamtmp/cud
16000>511	default		x		file
16001!:mime	application/x-clamav
16002!:ext	info
16003>11	string		>\0
16004# buildDate empty or like "22 Mar 2017 12-57 -0400"; verified by `sigtool -i FILE`
16005>>11	regex		\^[^:]{0,23}	\b, %s
16006# version like 25170
16007>>>&1	regex		\^[^:]{1,6}	\b, version %s
16008# signaturesNumbers like 4566249
16009>>>>&1	regex		\^[^:]{1,10}	\b, %s signatures
16010# functionalityLevelRequired like 60
16011>>>>>&1	regex		\^[^:]{1,4}	\b, level %s
16012# X for nothing or MD5
16013#>>>>>>&1	regex	\^[^:]{1,32}	\b, MD5 "%s"
16014>>>>>>&1	regex	\^[^:]{1,32}
16015# X for nothing or digital signature starting like AIzk/LYbX
16016#>>>>>>>&1	regex	\^[^:]{1,255}	\b, signature "%s"
16017>>>>>>>&1	regex	\^[^:]{1,255}
16018# builder like neo
16019>>>>>>>>&1	regex	\^[^:]{1,32}	\b, builder %s
16020# buildTime like 1506611558
16021#>>>>>>>>>&1	regex	\^[^:]{1,10}	\b, %s
16022>>>>>>>>>&1	regex	\^[^:]{1,10}
16023# padding with spaces
16024#>>>>>>>>>>&1	ubequad	x		\b, padding %#16.16llx
16025>510	ubyte		=0x20
16026# inspect real database content
16027#>>512	ubeshort	x		\b, database MAGIC %#x
16028# ./archive handle pure tar archives
16029>>1012	quad		=0		\b, with
16030>>>512	use		tar-file
16031# not pure tar
16032>>1012	quad		!0
16033# one space at the end of text and then handles gzipped archives by ./compress
16034>>>512	string		\037\213	\b, with
16035>>>>512	indirect	x
16036
16037# Type: Grisoft AVG AntiVirus
16038# From: David Newgas <david@newgas.net>
160390	string	AVG7_ANTIVIRUS_VAULT_FILE	AVG 7 Antivirus vault file data
16040
160410	string	X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR
16042>33	string	-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*	EICAR virus test files
16043
16044# From: Joerg Jenderek
16045# URL: https://www.avira.com/
16046# Note: found in directory %ProgramData%\Avira\Antivirus\INFECTED (Windows)
16047# tested with version 15.0.43.23 at November 2019
160480	string		AntiVir\ Qua	Avira AntiVir quarantined
16049!:mime	application/x-avira-qua
16050#!:mime	application/octet-stream
16051!:ext	qua
16052>156	string		SUSPICIOUS_FILE
16053# file path of suspicious file
16054>>220	lestring16	x		%s
16055>156	string		!SUSPICIOUS_FILE
16056# file path of virus file
16057>>228	lestring16	x		%s
16058# quarantined date
16059>60	ldate		x		at %s
16060# virus/danger name
16061>156	string		!SUSPICIOUS_FILE
16062>>156	string		x		\b, category "%s"
16063
16064
16065#------------------------------------------------------------------------------
16066# $File: fusecompress,v 1.2 2011/08/08 09:05:55 christos Exp $
16067# fusecompress:   file(1) magic for fusecompress
160680	string	\037\135\211	FuseCompress(ed) data
16069>3	byte	0x00	(none format)
16070>3	byte	0x01	(bz2 format)
16071>3	byte	0x02	(gz format)
16072>3	byte	0x03	(lzo format)
16073>3	byte	0x04	(xor format)
16074>3	byte	>0x04	(unknown format)
16075>4	long	x	uncompressed size: %d
16076
16077#------------------------------------------------------------------------------
16078# $File: games,v 1.25 2022/05/31 18:40:20 christos Exp $
16079# games:  file(1) for games
16080
16081# Fabio Bonelli <fabiobonelli@libero.it>
16082# Quake II - III data files
160830       string  IDP2        	Quake II 3D Model file,
16084>20     long    x               %u skin(s),
16085>8      long    x               (%u x
16086>12     long    x 		%u),
16087>40     long    x               %u frame(s),
16088>16     long    x               Frame size %u bytes,
16089>24     long  	x               %u vertices/frame,
16090>28     long    x            	%u texture coordinates,
16091>32     long    x               %u triangles/frame
16092
160930       string  IBSP            Quake
16094>4      long    0x26            II Map file (BSP)
16095>4      long    0x2E      	III Map file (BSP)
16096
160970       string  IDS2            Quake II SP2 sprite file
16098
16099#---------------------------------------------------------------------------
16100# Doom and Quake
16101# submitted by Nicolas Patrois
16102
161030       string  \xcb\x1dBoom\xe6\xff\x03\x01    Boom or linuxdoom demo
16104# some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01
16105
1610624      string  LxD\ 203        Linuxdoom save
16107>0      string  x       , name=%s
16108>44     string  x       , world=%s
16109
16110# Quake
16111
16112# Update: Joerg Jenderek
16113# URL: http://fileformats.archiveteam.org/wiki/PAK
16114# reference: https://quakewiki.org/wiki/.pak
16115# GRR: line below is too general as it matches also Acorn PackDir compressed Archive
16116# and Git pack ./revision
161170       string  PACK
16118# real Quake examples like pak0.pak have only some hundreds like 150 files
16119# So test for few files
16120>8	ulelong <0x01000000
16121# in file version 5.32 test for null terminator is only true for
16122# offset ~< FILE_BYTES_MAX = 1 MB defined in ../../src/file.h
16123# look for null terminator of 1st entry name
16124>>(4.l+55)	ubyte	0	Quake I or II world or extension
16125!:mime	application/x-dzip
16126!:ext	pak
16127#>>>8	ulelong	x	\b, table size %u
16128# dividing this by entry size (64) gives number of files
16129>>>8	ulelong/64 x	\b, %u files
16130# offset to the beginning of the file table
16131>>>4	ulelong	x	\b, offset %#x
16132# 1st file entry
16133>>>(4.l)	use	pak-entry
16134# 2nd file entry
16135#>>>4	ulelong+64	x	\b, offset %#x
16136#>>>(4.l+64)	use	pak-entry
16137#
16138#	display file table entry of Quake PAK archive
161390	name		pak-entry
16140# normally entry start after header which implies offset 12 or higher
16141>56	ulelong	>11
16142# the offset from the beginning of pak to beginning of this entry file contents
16143>>56	ulelong	x	at %#x
16144# the size of file for this entry
16145>>60	ulelong	x	%u bytes
16146# 56 byte null-terminated entry name string includes path like maps/e1m1.bsp
16147>>0	string	x	'%-.56s'
16148# inspect entry content by jumping to entry offset
16149>>(56)	indirect x	\b:
16150
16151#0       string  -1\x0a  Quake I demo
16152#>30     string  x        version %.4s
16153#>61     string  x        level %s
16154
16155#0       string  5\x0a   Quake I save
16156
16157# The levels
16158
16159# Quake 1
16160
161610	string	5\x0aIntroduction             Quake I save: start Introduction
161620	string	5\x0athe_Slipgate_Complex     Quake I save: e1m1 The slipgate complex
161630	string	5\x0aCastle_of_the_Damned     Quake I save: e1m2 Castle of the damned
161640	string	5\x0athe_Necropolis           Quake I save: e1m3 The necropolis
161650	string	5\x0athe_Grisly_Grotto        Quake I save: e1m4 The grisly grotto
161660	string	5\x0aZiggurat_Vertigo         Quake I save: e1m8 Ziggurat vertigo (secret)
161670	string	5\x0aGloom_Keep               Quake I save: e1m5 Gloom keep
161680	string	5\x0aThe_Door_To_Chthon       Quake I save: e1m6 The door to Chthon
161690	string	5\x0aThe_House_of_Chthon      Quake I save: e1m7 The house of Chthon
161700	string	5\x0athe_Installation         Quake I save: e2m1 The installation
161710	string	5\x0athe_Ogre_Citadel         Quake I save: e2m2 The ogre citadel
161720	string	5\x0athe_Crypt_of_Decay       Quake I save: e2m3 The crypt of decay (dopefish lives!)
161730	string	5\x0aUnderearth               Quake I save: e2m7 Underearth (secret)
161740	string	5\x0athe_Ebon_Fortress        Quake I save: e2m4 The ebon fortress
161750	string	5\x0athe_Wizard's_Manse       Quake I save: e2m5 The wizard's manse
161760	string	5\x0athe_Dismal_Oubliette     Quake I save: e2m6 The dismal oubliette
161770	string	5\x0aTermination_Central      Quake I save: e3m1 Termination central
161780	string	5\x0aVaults_of_Zin            Quake I save: e3m2 Vaults of Zin
161790	string	5\x0athe_Tomb_of_Terror       Quake I save: e3m3 The tomb of terror
161800	string	5\x0aSatan's_Dark_Delight     Quake I save: e3m4 Satan's dark delight
161810	string	5\x0athe_Haunted_Halls        Quake I save: e3m7 The haunted halls (secret)
161820	string	5\x0aWind_Tunnels             Quake I save: e3m5 Wind tunnels
161830	string	5\x0aChambers_of_Torment      Quake I save: e3m6 Chambers of torment
161840	string	5\x0athe_Sewage_System        Quake I save: e4m1 The sewage system
161850	string	5\x0aThe_Tower_of_Despair     Quake I save: e4m2 The tower of despair
161860	string	5\x0aThe_Elder_God_Shrine     Quake I save: e4m3 The elder god shrine
161870	string	5\x0athe_Palace_of_Hate       Quake I save: e4m4 The palace of hate
161880	string	5\x0aHell's_Atrium            Quake I save: e4m5 Hell's atrium
161890	string	5\x0athe_Nameless_City        Quake I save: e4m8 The nameless city (secret)
161900	string	5\x0aThe_Pain_Maze            Quake I save: e4m6 The pain maze
161910	string	5\x0aAzure_Agony              Quake I save: e4m7 Azure agony
161920	string	5\x0aShub-Niggurath's_Pit     Quake I save: end Shub-Niggurath's pit
16193
16194# Quake DeathMatch levels
16195
161960	string	5\x0aPlace_of_Two_Deaths	 Quake I save: dm1 Place of two deaths
161970	string	5\x0aClaustrophobopolis		 Quake I save: dm2 Claustrophobopolis
161980	string	5\x0aThe_Abandoned_Base		 Quake I save: dm3 The abandoned base
161990	string	5\x0aThe_Bad_Place		 Quake I save: dm4 The bad place
162000	string	5\x0aThe_Cistern		 Quake I save: dm5 The cistern
162010	string	5\x0aThe_Dark_Zone		 Quake I save: dm6 The dark zone
16202
16203# Scourge of Armagon
16204
162050	string	5\x0aCommand_HQ               Quake I save: start Command HQ
162060	string	5\x0aThe_Pumping_Station      Quake I save: hip1m1 The pumping station
162070	string	5\x0aStorage_Facility         Quake I save: hip1m2 Storage facility
162080	string	5\x0aMilitary_Complex         Quake I save: hip1m5 Military complex (secret)
162090	string	5\x0athe_Lost_Mine            Quake I save: hip1m3 The lost mine
162100	string	5\x0aResearch_Facility        Quake I save: hip1m4 Research facility
162110	string	5\x0aAncient_Realms           Quake I save: hip2m1 Ancient realms
162120	string	5\x0aThe_Gremlin's_Domain     Quake I save: hip2m6 The gremlin's domain (secret)
162130	string	5\x0aThe_Black_Cathedral      Quake I save: hip2m2 The black cathedral
162140	string	5\x0aThe_Catacombs            Quake I save: hip2m3 The catacombs
162150	string	5\x0athe_Crypt__              Quake I save: hip2m4 The crypt
162160	string	5\x0aMortum's_Keep            Quake I save: hip2m5 Mortum's keep
162170	string	5\x0aTur_Torment              Quake I save: hip3m1 Tur torment
162180	string	5\x0aPandemonium              Quake I save: hip3m2 Pandemonium
162190	string	5\x0aLimbo                    Quake I save: hip3m3 Limbo
162200	string	5\x0athe_Edge_of_Oblivion     Quake I save: hipdm1 The edge of oblivion (secret)
162210	string	5\x0aThe_Gauntlet             Quake I save: hip3m4 The gauntlet
162220	string	5\x0aArmagon's_Lair           Quake I save: hipend Armagon's lair
16223
16224# Malice
16225
162260	string	5\x0aThe_Academy      Quake I save: start The academy
162270	string	5\x0aThe_Lab          Quake I save: d1 The lab
162280	string	5\x0aArea_33          Quake I save: d1b Area 33
162290	string	5\x0aSECRET_MISSIONS  Quake I save: d3b Secret missions
162300	string	5\x0aThe_Hospital     Quake I save: d10 The hospital (secret)
162310	string	5\x0aThe_Genetics_Lab Quake I save: d11 The genetics lab (secret)
162320	string	5\x0aBACK_2_MALICE    Quake I save: d4b Back to Malice
162330	string	5\x0aArea44           Quake I save: d1c Area 44
162340	string	5\x0aTakahiro_Towers  Quake I save: d2 Takahiro towers
162350	string	5\x0aA_Rat's_Life     Quake I save: d3 A rat's life
162360	string	5\x0aInto_The_Flood   Quake I save: d4 Into the flood
162370	string	5\x0aThe_Flood        Quake I save: d5 The flood
162380	string	5\x0aNuclear_Plant    Quake I save: d6 Nuclear plant
162390	string	5\x0aThe_Incinerator_Plant    Quake I save: d7 The incinerator plant
162400	string	5\x0aThe_Foundry              Quake I save: d7b The foundry
162410	string	5\x0aThe_Underwater_Base      Quake I save: d8 The underwater base
162420	string	5\x0aTakahiro_Base            Quake I save: d9 Takahiro base
162430	string	5\x0aTakahiro_Laboratories    Quake I save: d12 Takahiro laboratories
162440	string	5\x0aStayin'_Alive    Quake I save: d13 Stayin' alive
162450	string	5\x0aB.O.S.S._HQ      Quake I save: d14 B.O.S.S. HQ
162460	string	5\x0aSHOWDOWN!        Quake I save: d15 Showdown!
16247
16248# Malice DeathMatch levels
16249
162500	string	5\x0aThe_Seventh_Precinct	 Quake I save: ddm1 The seventh precinct
162510	string	5\x0aSub_Station		 Quake I save: ddm2 Sub station
162520	string	5\x0aCrazy_Eights!		 Quake I save: ddm3 Crazy eights!
162530	string	5\x0aEast_Side_Invertationa	 Quake I save: ddm4 East side invertationa
162540	string	5\x0aSlaughterhouse		 Quake I save: ddm5 Slaughterhouse
162550	string	5\x0aDOMINO			 Quake I save: ddm6 Domino
162560	string	5\x0aSANDRA'S_LADDER		 Quake I save: ddm7 Sandra's ladder
16257
16258
162590	string	MComprHD	MAME CHD compressed hard disk image,
16260>12	belong	x		version %u
16261
16262# doom - submitted by Jon Dowland
16263
162640	string	=IWAD		doom main IWAD data
16265>4	lelong	x		containing %d lumps
162660	string	=PWAD		doom patch PWAD data
16267>4	lelong	x		containing %d lumps
16268
16269# Build engine group files (Duke Nukem, Shadow Warrior, ...)
16270# Extension: .grp
16271# Created by: "Ganael Laplanche" <ganael.laplanche@martymac.org>
162720	string	KenSilverman	Build engine group file
16273>12	lelong	x		containing %d files
16274
16275# Summary: Warcraft 3 save
16276# Extension: .w3g
16277# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com>
162780	string		Warcraft\ III\ recorded\ game	%s
16279
16280
16281# Summary: Warcraft 3 map
16282# Extension: .w3m
16283# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com>
162840	string		HM3W		Warcraft III map file
16285
16286
16287# Summary: SGF Smart Game Format
16288# Extension: .sgf
16289# Reference: https://www.red-bean.com/sgf/
16290# Created by: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar>
16291# Modified by (1): Abel Cheung (regex, more game format)
16292# FIXME: Some games don't have GM (game type)
162930	regex		\\(;.*GM\\[[0-9]{1,2}\\]	Smart Game Format
16294>2	search/0x200/b	GM[
16295>>&0	string		1]	(Go)
16296>>&0	string		2]	(Othello)
16297>>&0	string		3]	(chess)
16298>>&0	string		4]	(Gomoku+Renju)
16299>>&0	string		5]	(Nine Men's Morris)
16300>>&0	string		6]	(Backgammon)
16301>>&0	string		7]	(Chinese chess)
16302>>&0	string		8]	(Shogi)
16303>>&0	string		9]	(Lines of Action)
16304>>&0	string		10]	(Ataxx)
16305>>&0	string		11]	(Hex)
16306>>&0	string		12]	(Jungle)
16307>>&0	string		13]	(Neutron)
16308>>&0	string		14]	(Philosopher's Football)
16309>>&0	string		15]	(Quadrature)
16310>>&0	string		16]	(Trax)
16311>>&0	string		17]	(Tantrix)
16312>>&0	string		18]	(Amazons)
16313>>&0	string		19]	(Octi)
16314>>&0	string		20]	(Gess)
16315>>&0	string		21]	(Twixt)
16316>>&0	string		22]	(Zertz)
16317>>&0	string		23]	(Plateau)
16318>>&0	string		24]	(Yinsh)
16319>>&0	string		25]	(Punct)
16320>>&0	string		26]	(Gobblet)
16321>>&0	string		27]	(hive)
16322>>&0	string		28]	(Exxit)
16323>>&0	string		29]	(Hnefatal)
16324>>&0	string		30]	(Kuba)
16325>>&0	string		31]	(Tripples)
16326>>&0	string		32]	(Chase)
16327>>&0	string		33]	(Tumbling Down)
16328>>&0	string		34]	(Sahara)
16329>>&0	string		35]	(Byte)
16330>>&0	string		36]	(Focus)
16331>>&0	string		37]	(Dvonn)
16332>>&0	string		38]	(Tamsk)
16333>>&0	string		39]	(Gipf)
16334>>&0	string		40]	(Kropki)
16335
16336##############################################
16337# NetImmerse/Gamebryo game engine entries
16338
16339# Summary: Gamebryo game engine file
16340# Extension: .nif, .kf
16341# Created by: Abel Cheung <abelcheung@gmail.com>
163420		string		Gamebryo\ File\ Format,\ Version\ 	Gamebryo game engine file
16343>&0		regex		[0-9a-z.]+				\b, version %s
16344
16345# Summary: Gamebryo game engine file
16346# Extension: .kfm
16347# Created by: Abel Cheung <abelcheung@gmail.com>
163480		string		;Gamebryo\ KFM\ File\ Version\ 		Gamebryo game engine animation File
16349>&0		regex		[0-9a-z.]+				\b, version %s
16350
16351# Summary: NetImmerse game engine file
16352# Extension .nif
16353# Created by: Abel Cheung <abelcheung@gmail.com>
163540		string		NetImmerse\ File\ Format,\ Version
16355>&0		string		n\ 					NetImmerse game engine file
16356>>&0		regex		[0-9a-z.]+				\b, version %s
16357
16358# Type:	SGF Smart Game Format
16359# URL:	https://www.red-bean.com/sgf/
16360# From:	Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar>
163612	regex/c	\\(;.*GM\\[[0-9]{1,2}\\]	Smart Game Format
16362>2	regex/c	GM\\[1\\]			- Go Game
16363>2	regex/c	GM\\[6\\]			- BackGammon Game
16364>2	regex/c	GM\\[11\\]			- Hex Game
16365>2	regex/c	GM\\[18\\]			- Amazons Game
16366>2	regex/c	GM\\[19\\]			- Octi Game
16367>2	regex/c	GM\\[20\\]			- Gess Game
16368>2	regex/c	GM\\[21\\]			- twix Game
16369
16370# Epic Games/Unreal Engine Package
16371#
163720	lelong		0x9E2A83C1	Unreal Engine Package,
16373>4	leshort		x		version: %i
16374>12	lelong		!0		\b, names: %i
16375>28	lelong		!0		\b, imports: %i
16376>20	lelong		!0		\b, exports: %i
16377
163780	string		ESVG
16379>4	lelong		0x00160000
16380>10	string		TOC\020		Empire Deluxe for DOS saved game
16381
16382# Sid Meier's Civilization V/VI
16383# From: Benjamin Lowry <ben@ben.gmbh>
163840	string	CIV5
16385>4	byte	0x08		Sid Meier's Civilization V saved game,
16386>>12	regex	[0-9a-z.]+	saved by game version %s
16387>4	byte	0x01		Sid Meier's Civilization V replay data,
16388>>12	regex	[0-9a-z.]+	saved by game version %s
16389
163900	string	CIV6		Sid Meier's Civilization VI saved game
16391
16392# https://syzygy-tables.info/
16393# From Michel Van den Bergh
163940	string	\327f\f\245	Syzygy DTZ tablebase
16395!:mime	application/syzygy
163960	string	q\350#]		Syzygy WDL tablebase
16397!:mime	application/syzygy
16398
16399##############################################################################
16400# Grand Theft Auto (GTA) file formats.
16401#
16402# Summary:
16403# Includes GTA-specific formats used in all games from 1997 to present. Games
16404# and formats were created by Rockstar North, formerly DMA Design. Magic tests
16405# were written based on a combination of official and community documentation.
16406#
16407# Created by: Oliver Galvin <odg@riseup.net>
16408#
16409# References:
16410# * Classic GTA documentation and research:
16411#    <https://gitlab.com/classic-gta/gta-data>
16412# * Official RenderWare documentation available from EA:
16413#    <https://github.com/electronicarts/RenderWare3Docs>
16414# * Lots of community research in the GTAMods wiki:
16415#    <https://gtamods.com/wiki>
16416
16417# GTA 2D-Era data - 'Classic' top down games (1/L/2)
16418
16419## GTA text
16420
164210	string	\xbf\xf8\xbd\x49\x62\xbe	GTA1 in-game text (FXT),
164220	string	GBL	GTA2 in-game text (GXT),
16423>3	string  	E	English,
16424>>4	uleshort	x	version %d
16425>3	string  	F	French,
16426>>4	uleshort	x	version %d
16427>3	string  	G	German,
16428>>4	uleshort	x	version %d
16429>3	string  	I	Italian,
16430>>4	uleshort	x	version %d
16431>3	string  	S	Spanish,
16432>>4	uleshort	x	version %d
16433>3	string  	J	Japanese,
16434>>4	uleshort	x	version %d
16435
16436## GTA maps
16437
164380	ulelong 	331	GTA1 map layout (CMP),
16439>4	byte    	1	Level 1
16440>4	byte    	2	Level 2
16441>4	byte    	3	Level 3
164420	string  	GBMP	GTA2/GBH map layout (GMP),
16443>4	uleshort	x	version %d
164440	string/t	[MapFiles]	GTA2 multiplayer map metadata (MMP)
164450	string/t	MainOrBonus\ =\ MAIN	GTA2 single player map listing (test1.seq)
16446
16447## GTA 2D sprites and textures
16448
164490	ulelong 	290	GTA1 style data (GRX), 8 bit editor graphics
164500	ulelong 	325	GTA1 style data (GRY), 8 bit in-game graphics
164510	ulelong 	336	GTA1 style data (G24), 24 bit in-game graphics
164520	string  	GBST	GTA2/GBH style data (STY), in-game graphics,
16453>4	uleshort	x	version %d
16454
16455## GTA audio index
16456
164570	ulelong	0
16458>4	ulelong	<0x40000
16459>>8	ulelong	>4500
16460>>>8	ulelong	<45000	GTA audio index data (SDT)
16461
16462## GTA scripts
16463
164640	ulelong 	0x00080000
16465>4	uleshort	0x0024    	GTA2 binary main script (SCR)
16466
164670	uleshort	0x063c    	GTA2 binary mission script (SCR), Residential area (ste)
164680	uleshort	0x055b    	GTA2 binary mission script (SCR), Downtown area (wil)
164690	uleshort	0x0469    	GTA2 binary mission script (SCR), Industrial area (bil)
16470
164710	string   	v9.6\0\0 	GTA2 replay file (REP),
16472>8	regex/30c	[a-z0-9:\ ]+\0\0	created on %s
16473
16474# GTA 3D-Era (III/VC/SA/LCS/VCS) - used by the RenderWare engine by Criterion Games
16475
16476## GTA 3D models and textures - RenderWare binary streams
16477
164788	ulelong	0x00000310	RenderWare data, v3.1.0.0, used in GTA III on PS2,
16479>0	ulelong	0x00000016	texture archive (TXD)
16480>0	ulelong 0x00000010	3D models (DFF)
164818	ulelong	0x0401ffff	RenderWare data, v3.1.0.1, used in GTA III on PC/PS2,
16482>0	ulelong	0x00000016	texture archive (TXD)
16483>0	ulelong 0x00000010	3D models (DFF)
164848	ulelong	0x0800ffff	RenderWare data, v3.2.0.0, used in GTA III on PC,
16485>0	ulelong	0x00000016	texture archive (TXD)
16486>0	ulelong 0x00000010	3D models (DFF)
164878	ulelong	0x0c00ffff	RenderWare data, v3.3.0.0,
16488>0	ulelong	0x00000016	texture archive (TXD)
16489>0	ulelong 0x00000010	3D models (DFF)
164908	ulelong	0x0c02ffff	RenderWare data, v3.3.0.2, used in GTA III PC and GTA VC PS2,
16491>0	ulelong	0x00000016	texture archive (TXD)
16492>0	ulelong 0x00000010	3D models (DFF)
164938	ulelong	0x1000ffff	RenderWare data, v3.4.0.0,
16494>0	ulelong	0x00000016	texture archive (TXD)
16495>0	ulelong 0x00000010	3D models (DFF)
164968	ulelong	0x1003ffff	RenderWare data, v3.4.0.3, used in GTA VC PC,
16497>0	ulelong	0x00000016	texture archive (TXD)
16498>0	ulelong 0x00000010	3D models (DFF)
164998	ulelong	0x1005ffff	RenderWare data, v3.4.0.5, used in GTA III/VC on Android,
16500>0	ulelong	0x00000016	texture archive (TXD)
16501>0	ulelong 0x00000010	3D models (DFF)
165028	ulelong	0x1400ffff	RenderWare data, v3.5.0.0, used in GTA III/VC on Xbox,
16503>0	ulelong	0x00000016	texture archive (TXD)
16504>0	ulelong 0x00000010	3D models (DFF)
165058	ulelong	0x1803ffff	RenderWare data, v3.6.0.3, used in GTA SA,
16506>0	ulelong	0x00000016	texture archive (TXD)
16507>0	ulelong 0x00000010	3D models (DFF)
16508
165090	string	COL	RenderWare collision data (COL),
16510>3	string	L	version 1, used in GTA III/VC/SA
16511>3	string	2	version 2, used in GTA SA
16512>3	string	3	version 3, used in GTA SA
16513>3	string	4	version 4, used in GTA SA
16514
16515## GTA items and animations
16516
165170	string/c	#\ ipl\ generated\ from\ max\ file	GTA Item Placement data (IPL), used in GTA III/VC
165180	string/b	bnry	GTA Item Placement data (IPL), used in GTA SA/IV,
16519>4	ulelong 	x	%d items
16520
165210	string	ANP	GTA animation data (IFP),
16522>3	string	K	version 1, used in GTA III/VC
16523>3	string	3	version 2, used in GTA SA
16524
165250	string	GtaSA29	GTA Replay data (REP), used in GTA SA
16526
16527## GTA text
16528
165290	string	TKEY	GTA in-game text (GXT), version 2, used in GTA III
165300	string	TABL	GTA in-game text (GXT), version 3, used in GTA VC/LS/VCS
16531
16532## GTA scripts
16533
165340	string	\x02\x00\x01	GTA script (SCM), used in GTA III/VC/SA
16535
16536## GTA archives
16537
165380	string	VER2	GTA archive (IMG), version 2, used in GTA SA,
16539>4	ulelong	x	%d items
16540
16541# GTA HD-Era (IV/V) - used by the Rockstar Advanced Game Engine (RAGE)
16542
16543## GTA models and textures - RAGE resources
16544# Note: GTA IV formats not yet documented - WAD, WBD, WBN, WHM, WPL
16545
165460	ulelong	0x00695254	GTA Drawable data (WDR), model and weapon data, used in GTA IV
165470	ulelong	0x00695238	GTA Windows Frag Type (WFT), vehicle models, used in GTA IV
165480	ulelong	0x006953A4	GTA Ped and LOD models (WDD), used in GTA IV
165490	ulelong	0x00695384	GTA Windows Texture Dictionary (WTD), used in GTA IV
16550
16551## GTA text
16552
165534	string  	TABL	GTA in-game text (GXT),
16554>0	uleshort	x	version %d, used in GTA SA/IV
165550	string  	2GXT	GTA in-game text (GXT2), used in GTA V
16556
16557## GTA scripts
16558
165590	ulelong	0x0d524353	GTA script (SCO), unencrypted, used in GTA IV,
16560>4	ulelong	x         	%d code bytes,
16561>>8	ulelong	x         	%d static variables,
16562>>>12	ulelong	x         	%d global variables
165630	ulelong	0x0e726373	GTA script (SCO), encrypted, used in GTA IV
16564>4	ulelong	x         	%d code bytes,
16565>>8	ulelong	x         	%d static variables,
16566>>>12	ulelong	x         	%d global variables
16567
16568## GTA archives
16569
165700	ulelong	0xa94e2a52	GTA archive (IMG),
16571>4	ulelong	x        	version %d, used in GTA IV,
16572>>8	ulelong	x        	%d items
16573
16574# RPF[0-8]
165750	ulelong&0xfffffff0 =0x52504630
16576>0	ulelong&0xf	<9	RAGE Package Format (RPF), version %d, used in
16577>>0	ulelong&0xf	=0	Rockstar Table Tennis,
16578>>0	ulelong&0xf	=1	*unknown*
16579>>0	ulelong&0xf	=2	GTA IV,
16580>>0	ulelong&0xf	=3	GTA IV Audio & Midnight Club: LA,
16581>>0	ulelong&0xf	=4	Max Payne 3,
16582>>0	ulelong&0xf	=5	*unknown*
16583>>0	ulelong&0xf	=6	RDR,
16584>>0	ulelong&0xf	=7	GTA V,
16585>>0	ulelong&0xf	=8	RDR 2,
16586>>4	ulelong 	x	%d bytes,
16587>>>8	ulelong 	x	%d entries
16588
16589#------------------------------------------------------------------------------
16590# $File: gcc,v 1.5 2016/07/01 23:31:13 christos Exp $
16591# gcc:  file(1) magic for GCC special files
16592#
165930	string		gpch		GCC precompiled header
16594
16595# The version field is annoying.  It's 3 characters, not zero-terminated.
16596>5	byte		x			(version %c
16597>6	byte		x			\b%c
16598>7	byte		x			\b%c)
16599
16600# 67 = 'C', 111 = 'o', 43 = '+', 79 = 'O'
16601>4	byte		67			for C
16602>4	byte		111			for Objective-C
16603>4	byte		43			for C++
16604>4	byte		79			for Objective-C++
16605
16606#------------------------------------------------------------------------------
16607# $File: gconv
16608# gconv: file(1) magic for iconv/gconv module configuration cache
16609#
16610# Magic number defined in glibc/iconv/iconvconfig.h as GCONVCACHE_MAGIC
16611#
16612# From: Marek Cermak <macermak@redhat.com>
16613#
166140		lelong		0x20010324 	gconv module configuration cache data
16615#------------------------------------------------------------------------------
16616# $File: gentoo,v 1.2 2022/09/12 13:13:28 christos Exp $
16617# gentoo:  file(1) magic for gentoo specific formats
16618#
16619# Summary: Gentoo ebuild Manifest files (GLEP 74)
16620# Reference: https://www.gentoo.org/glep/glep-0074.html
16621# Submitted by: Michal Gorny <mgorny@gentoo.org>
16622# Start by doing a fast check for the most common tags.
166230	string	AUX
16624>0	use	gentoo-manifest
166250	string	DATA
16626>0	use	gentoo-manifest
166270	string	DIST
16628>0	use	gentoo-manifest
166290	string	EBUILD
16630>0	use	gentoo-manifest
166310	string	MANIFEST
16632>0	use	gentoo-manifest
16633
16634# Manifest can be PGP-signed.
166350	string	-----BEGIN\040PGP\040SIGNED\040MESSAGE-----
16636>34	search/32	\n\n
16637>>&0	string	AUX
16638>>>&0	use	gentoo-manifest
16639>>&0	string	DATA
16640>>>&0	use	gentoo-manifest
16641>>&0	string	DIST
16642>>>&0	use	gentoo-manifest
16643>>&0	string	EBUILD
16644>>>&0	use	gentoo-manifest
16645>>&0	string	MANIFEST
16646>>>&0	use	gentoo-manifest
16647
16648# Use a more detailed regex to verify that we were correct.
16649# <tag> <filename> <size> <hash-name> <hash-value>...
16650# (<tag>'s already been matched prior to calling)
166510	name	gentoo-manifest
16652>&0	regex	[[:space:]]+[[:print:]]+[[:space:]]+[[:digit:]]+[[:space:]]+[[:alnum:]]+[[:space:]]+[[:xdigit:]]{32}	Gentoo Manifest (GLEP 74)
16653
16654# Summary: Gentoo ebuild and eclass files
16655# Reference: https://projects.gentoo.org/pms/8/pms.html
16656# Submitted by: Michal Gorny <mgorny@gentoo.org>
166570	search/512	EAPI=
16658>0	regex		.*\n[\040\t]*EAPI=["']?	Gentoo ebuild
16659>>&0	regex		[[:alnum:]+_.-]+	\b, EAPI %s
16660
166610	search/512	@ECLASS:\040		Gentoo eclass
16662>&0	string		x			%s
16663
16664# Summary: Gentoo supplementary package and category metadata files
16665# Reference: https://www.gentoo.org/glep/glep-0068.html
16666# Submitted by: Michal Gorny <mgorny@gentoo.org>
166670	string		\<?xml
16668>0	search/512	\<catmetadata		Gentoo category metadata file
16669>0	search/512	\<pkgmetadata		Gentoo package metadata file
16670
16671# Summary: Gentoo GLEP 78 binary package
16672# Reference: https://www.gentoo.org/glep/glep-0078.html
16673# Note: assumes the strict format
16674# Submitted by: Michal Gorny <mgorny@gentoo.org>
16675
16676# GPKG uses ustar (or ustar-compatible GNU format) that starts with
16677# a <directory>/gpkg-1 file
16678257	string		ustar
16679>0	search/100	/gpkg-1\0
16680>>0	regex		[^/]+		Gentoo GLEP 78 (GPKG) binary package for "%s"
16681!:mime	application/x-tar
16682!:ext	tar
16683# the logic below requires the gpkg-1 file to be empty
16684>>>124	string	00000000000\0
16685# determine the compression used by looking at the second member name
16686>>>>512	search/100	.tar.
16687>>>>>&0	string		gz\0		using gzip compression
16688>>>>>&0	string		bz2\0		using bzip2 compression
16689>>>>>&0	string		lz\0		using lzip compression
16690>>>>>&0	string		lz4\0		using lz4 compression
16691>>>>>&0	string		lzo\0		using lzo compression
16692>>>>>&0	string		xz\0		using xz compression
16693>>>>>&0	string		zst\0		using zstd compression
16694>>>>(636.o+1024)	search/611	.sig\0	\b, signed
16695
16696#------------------------------------------------------------------------------
16697# $File: geo,v 1.8 2022/03/24 15:48:58 christos Exp $
16698# Geo- files from Kurt Schwehr <schwehr@ccom.unh.edu>
16699
16700######################################################################
16701#
16702# Acoustic Doppler Current Profilers (ADCP)
16703#
16704######################################################################
16705
167060	beshort	0x7f7f	RDI Acoustic Doppler Current Profiler (ADCP)
16707
16708######################################################################
16709#
16710# Metadata
16711#
16712######################################################################
16713
167140	string	Identification_Information	FGDC ASCII metadata
16715
16716######################################################################
16717#
16718# Seimsic / Subbottom
16719#
16720######################################################################
16721
16722# Knudsen subbottom chirp profiler - Binary File Format: B9
16723# KEB D409-03167 V1.75 Huffman
167240	string	KEB\ 	Knudsen seismic KEL binary (KEB) -
16725>4	regex	[-A-Z0-9]+	Software: %s
16726>>&1	regex	V[0-9]+\\.[0-9]+	version %s
16727
16728######################################################################
16729#
16730# LIDAR - Laser altimetry or bathy
16731#
16732######################################################################
16733
16734
16735# Caris LIDAR format for LADS comes as two parts... ascii location file and binary waveform data
167360	string	HCA	LADS Caris Ascii Format (CAF) bathymetric lidar
16737>4	regex [0-9]+\\.[0-9]+	version %s
16738
167390	string	HCB	LADS Caris Binary Format (CBF) bathymetric lidar waveform data
16740>3      byte    x	version %d .
16741>4	byte	x	%d
16742
16743
16744######################################################################
16745#
16746# MULTIBEAM SONARS https://www.ldeo.columbia.edu/res/pi/MB-System/formatdoc/
16747#
16748######################################################################
16749
16750# GeoAcoustics - GeoSwath Plus
167514	beshort	0x2002	GeoSwath RDF
167520	string	Start:-	GeoSwatch auf text file
16753
16754# Seabeam 2100
16755# mbsystem code mb41
167560	string SB2100	SeaBeam 2100 multibeam sonar
167570	string SB2100DR	SeaBeam 2100 DR multibeam sonar
167580	string SB2100PR SeaBeam 2100 PR multibeam sonar
16759
16760# This corresponds to MB-System format 94, L-3/ELAC/SeaBeam XSE vendor
16761# format. It is the format of our upgraded SeaBeam 2112 on R/V KNORR.
167620    string $HSF    XSE multibeam
16763
16764# mb121 https://www.saic.com/maritime/gsf/
167658	string	GSF-v	SAIC generic sensor format (GSF) sonar data,
16766>&0	regex [0-9]+\\.[0-9]+	version %s
16767
16768# MGD77 - https://www.ngdc.noaa.gov/mgg/dat/geodas/docs/mgd77.htm
16769# mb161
167709	string MGD77	MGD77 Header, Marine Geophysical Data Exchange Format
16771
16772# MBSystem processing caches the mbinfo output
167731	string	Swath\ Data\ File:	mbsystem info cache
16774
16775# Caris John Hughes Clark format
167760	string	HDCS	Caris multibeam sonar related data
167771	string	Start/Stop\ parameter\ header:	Caris ASCII project summary
16778
16779######################################################################
16780#
16781# Visualization and 3D modeling
16782#
16783######################################################################
16784
16785# IVS - IVS3d.com Tagged Data Represetation
167860	string	%%\ TDR\ 2.0	IVS Fledermaus TDR file
16787
16788# http://www.ecma-international.org/publications/standards/Ecma-363.htm
16789# 3D in PDFs
167900	string	U3D	ECMA-363, Universal 3D
16791
16792######################################################################
16793#
16794# Support files
16795#
16796######################################################################
16797
16798# https://midas.psi.ch/elog/
167990	string	$@MID@$	elog journal entry
16800
16801# Geospatial Designs https://www.geospatialdesigns.com/surfer6_format.htm
168020	string		DSBB	Surfer 6 binary grid file
16803>4	leshort		x	\b, %d
16804>6	leshort		x	\bx%d
16805>8	ledouble	x	\b, minx=%g
16806>16	ledouble	x	\b, maxx=%g
16807>24	ledouble	x	\b, miny=%g
16808>32	ledouble	x	\b, maxy=%g
16809>40	ledouble	x	\b, minz=%g
16810>48	ledouble	x	\b, maxz=%g
16811
16812# magic for LAS format files
16813# alex myczko <alex@aiei.ch>
16814# https://www.asprs.org/wp-content/uploads/2010/12/LAS_1_3_r11.pdf
168150	string		LASF	LIDAR point data records
16816>24	byte		>0	\b, version %u
16817>25	byte		>0	\b.%u
16818>26	string		>\0	\b, SYSID %s
16819>58	string		>\0	\b, Generating Software %s
16820
16821# magic for PCD format files
16822# alex myczko <alex@aiei.ch>
16823# http://pointclouds.org/documentation/tutorials/pcd_file_format.php
168240	string		#\ .PCD	Point Cloud Data
16825
16826#------------------------------------------------------------------------------
16827# $File: geos,v 1.4 2009/09/19 16:28:09 christos Exp $
16828# GEOS files (Vidar Madsen, vidar@gimp.org)
16829# semi-commonly used in embedded and handheld systems.
168300	belong	0xc745c153	GEOS
16831>40	byte	1	executable
16832>40	byte	2	VMFile
16833>40	byte	3	binary
16834>40	byte	4	directory label
16835>40	byte	<1	unknown
16836>40	byte	>4	unknown
16837>4	string	>\0	\b, name "%s"
16838#>44	short	x	\b, version %d
16839#>46	short	x	\b.%d
16840#>48	short	x	\b, rev %d
16841#>50	short	x	\b.%d
16842#>52	short	x	\b, proto %d
16843#>54	short	x	\br%d
16844#>168	string	>\0	\b, copyright "%s"
16845
16846#------------------------------------------------------------------------------
16847# $File: gimp,v 1.10 2019/10/15 18:19:40 christos Exp $
16848# GIMP Gradient: file(1) magic for the GIMP's gradient data files (.ggr)
16849# by Federico Mena <federico@nuclecu.unam.mx>
16850
168510       string/t        GIMP\ Gradient  GIMP gradient data
16852#!:mime	text/plain
16853!:mime	text/x-gimp-ggr
16854!:ext	ggr
16855
16856# GIMP palette (.gpl)
16857# From: Markus Heidelberg <markus.heidelberg@web.de>
168580       string/t        GIMP\ Palette   GIMP palette data
16859# URL:		https://docs.gimp.org/en/gimp-concepts-palettes.html
16860# Reference:	http://fileformats.archiveteam.org/wiki/GIMP_Palette
16861#!:mime	text/plain
16862!:mime	text/x-gimp-gpl
16863!:ext	gpl
16864
16865#------------------------------------------------------------------------------
16866# XCF:  file(1) magic for the XCF image format used in the GIMP (.xcf) developed
16867#       by Spencer Kimball and Peter Mattis
16868#       ('Bucky' LaDieu, nega@vt.edu)
16869
16870# URL:		https://en.wikipedia.org/wiki/XCF_(file_format)
16871# Reference:	https://gitlab.gnome.org/GNOME/gimp/blob/master/devel-docs/xcf.txt
168720	string		gimp\ xcf	GIMP XCF image data,
16873!:mime	image/x-xcf
16874!:ext	xcf
16875>9	string		file		version 0,
16876>9	string		v		version
16877>>10	string		>\0		%s,
16878>14	belong		x		%u x
16879>18	belong		x		%u,
16880>22     belong          0               RGB Color
16881>22     belong          1               Greyscale
16882>22     belong          2               Indexed Color
16883>22	belong		>2		Unknown Image Type.
16884
16885#------------------------------------------------------------------------------
16886# XCF:  file(1) magic for the patterns used in the GIMP (.pat), developed
16887#       by Spencer Kimball and Peter Mattis
16888#       ('Bucky' LaDieu, nega@vt.edu)
16889
16890# Reference:	http://fileformats.archiveteam.org/wiki/GIMP_Pattern
1689120      string          GPAT            GIMP pattern data,
16892>24     string          x               %s
16893!:mime	image/x-gimp-pat
16894!:ext	pat
16895
16896#------------------------------------------------------------------------------
16897# XCF:  file(1) magic for the brushes used in the GIMP (.gbr), developed
16898#       by Spencer Kimball and Peter Mattis
16899#       ('Bucky' LaDieu, nega@vt.edu)
16900
1690120      string          GIMP            GIMP brush data
16902# Reference:	http://fileformats.archiveteam.org/wiki/GIMP_Brush
16903!:mime	image/x-gimp-gbr
16904# some sources also list gpb
16905!:ext	gbr
16906
16907# From:		Joerg Jenderek
16908# URL:		https://docs.gimp.org/en/gimp-using-animated-brushes.html
16909# Reference:	http://fileformats.archiveteam.org/wiki/GIMP_Animated_Brush
16910# share\gimp\2.0\brushes\Legacy\confetti.gih
169110	search/21/b	\040ncells:		GIMP animated brush data
16912!:mime	image/x-gimp-gih
16913!:ext	gih
16914
16915# GIMP Curves File
16916# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
169170	string	#\040GIMP\040Curves\040File	GIMP curve file
16918#!:mime	text/plain
16919!:mime	text/x-gimp-curve
16920!:ext	/txt
16921
16922
16923#------------------------------------------------------------------------------
16924# $File: git,v 1.2 2020/08/09 16:57:15 christos Exp $
16925# git:  file(1) magic for Git objects
16926
169270	string	blob\040
16928>5	regex	[0-9a-f]+		Git blob %s
16929
169300	string	tree\040
16931>5	regex	[0-9a-f]+		Git tree %s
16932
169330	string	commit\040
16934>7	regex	[0-9a-f]+		Git commit %s
16935
16936#------------------------------------------------------------------------------
16937# $File: glibc,v 1.1 2018/10/11 15:35:43 christos Exp $
16938# glibc locale files
16939#
16940# https://sourceware.org/git/?p=glibc.git;f=locale/localeinfo.h;h=68822a63#l32
16941
169420	belong	0x20070920	glibc locale file LC_CTYPE
169430	belong	0x14110320	glibc locale file LC_NUMERIC
169440	belong	0x17110320	glibc locale file LC_TIME
169450	belong	0x17100520	glibc locale file LC_COLLATE
169460	belong	0x11110320	glibc locale file LC_MONETARY
169470	belong	0x10110320	glibc locale file LC_MESSAGES
169480	belong	0x13110320	glibc locale file LC_ALL
169490	belong	0x12110320	glibc locale file LC_PAPER
169500	belong	0x1d110320	glibc locale file LC_NAME
169510	belong	0x1c110320	glibc locale file LC_ADDRESS
169520	belong	0x1f110320	glibc locale file LC_TELEPHONE
169530	belong	0x1e110320	glibc locale file LC_MEASUREMENT
169540	belong	0x19110320	glibc locale file LC_IDENTIFICATION
16955
16956
16957#------------------------------------------------------------------------------
16958# $File: gnome,v 1.7 2020/06/23 16:17:08 christos Exp $
16959# GNOME related files
16960
16961# Contributed by Josh Triplett
16962# FIXME: Could be simplified if pstring supported two-byte counts
169630         string   GnomeKeyring\n\r\0\n GNOME keyring
16964>&0       ubyte    0                    \b, major version 0
16965>>&0      ubyte    0                    \b, minor version 0
16966>>>&0     ubyte    0                    \b, crypto type 0 (AES)
16967>>>&0     ubyte    >0                   \b, crypto type %u (unknown)
16968>>>&1     ubyte    0                    \b, hash type 0 (MD5)
16969>>>&1     ubyte    >0                   \b, hash type %u (unknown)
16970>>>&2     ubelong  0xFFFFFFFF           \b, name NULL
16971>>>&2     ubelong  !0xFFFFFFFF
16972>>>>&-4   ubelong  >255                 \b, name too long for file's pstring type
16973>>>>&-4   ubelong  <256
16974>>>>>&-1  pstring  x                    \b, name "%s"
16975>>>>>>&0  ubeqdate x                    \b, last modified %s
16976>>>>>>&8  ubeqdate x                    \b, created %s
16977>>>>>>&16 ubelong  &1
16978>>>>>>>&0 ubelong  x                    \b, locked if idle for %u seconds
16979>>>>>>&16 ubelong  ^1                   \b, not locked if idle
16980>>>>>>&24 ubelong  x                    \b, hash iterations %u
16981>>>>>>&28 ubequad  x                    \b, salt %llu
16982>>>>>>&52 ubelong  x                    \b, %u item(s)
16983
16984# From: Alex Beregszaszi <alex@fsn.hu>
169854	string	gtktalog		GNOME Catalogue (gtktalog)
16986>13	string	>\0			version %s
16987
16988# Summary: GStreamer binary registry
16989# Extension: .bin
16990# Submitted by: Josh Triplett <josh@joshtriplett.org>
169910	belong	0xc0def00d		GStreamer binary registry
16992>4	string	x			\b, version %s
16993
16994# GVariant Database file
16995# By Elan Ruusamae <glen@delfi.ee>
16996# https://github.com/GNOME/gvdb/blob/master/gvdb-format.h
16997# It's always "GVariant", it's byte swapped on incompatible archs
16998# See https://github.com/GNOME/gvdb/blob/master/gvdb-builder.c
16999# file_builder_serialise()
17000# https://developer.gnome.org/glib/2.34/glib-GVariant.html#GVariant
170010	string	GVariant	GVariant Database file,
17002# version is never filled. probably future extension
17003>8	lelong	x		version %d
17004# not sure are these usable, so commented out
17005#>>16	lelong	x		start %d,
17006#>>>20	lelong	x		end %d
17007
17008# G-IR database made by gobject-introspect toolset,
17009# https://live.gnome.org/GObjectIntrospection
170100	string		GOBJ\nMETADATA\r\n\032	G-IR binary database
17011>16	byte		x			\b, v%d
17012>17	byte		x			\b.%d
17013>20	short		x			\b, %d entries
17014>22	short		x			\b/%d local
17015
17016#------------------------------------------------------------------------------
17017# $File: gnu,v 1.24 2021/04/26 15:56:00 christos Exp $
17018# gnu:  file(1) magic for various GNU tools
17019#
17020# GNU nlsutils message catalog file format
17021#
17022# GNU message catalog (.mo and .gmo files)
17023
17024# Update: Joerg Jenderek
17025# URL: https://www.gnu.org/software/gettext/manual/html_node/MO-Files.html
17026# Reference: ftp://ftp.gnu.org/pub/gnu/gettext/gettext-0.19.8.tar.gz/
17027#	gettext-0.19.8.1/gettext-runtime/intl/gmo.h
17028# Note: maybe call it like "GNU translation gettext machine object"
170290	string		\336\22\4\225	GNU message catalog (little endian),
17030#0	ulelong	0x950412DE		GNU-format message catalog data
17031# TODO: write lines in such a way that code can also be called for big endian variant
17032#>0	use		gettext-object
17033#0	name		gettext-object
17034>4	ulelong		x		revision
17035!:mime	application/x-gettext-translation
17036# mo extension is also used for Easeus Partition Master PE32 executable module
17037# like ConvertFatToNTFS.mo
17038!:ext	gmo/mo
17039# only found three revision combinations 0.0 0.1 1.1 as unsigned 32-bit
17040# major revision
17041>4	ulelong/0xFFff	x		%u.
17042# minor revision
17043>4	ulelong&0x0000FFff	x	\b%u
17044>>8	ulelong		x		\b, %u message
17045# plural s
17046>>8	ulelong		>1		\bs
17047# size of hashing table
17048#>20	ulelong		x		\b, %u hash
17049#>20	ulelong		>1		\bes
17050#>24	ulelong		x		at %#x
17051# for revision x.0 offset of table with originals is 1Ch if directly after header
17052>4	ulelong&0x0000FFff	=0
17053>>12	ulelong		!0x1C		\b, at %#x string table
17054# but for x.1 table offset i found is 30h. That means directly after bigger header
17055>4	ulelong&0x0000FFff	>0
17056>>12	ulelong		!0x30		\b, at %#x string table
17057# The following variables are only used in .mo files with minor revision >= 1
17058# number of system dependent segments
17059#>>28	ulelong		x		\b, %u segment
17060#>>28	ulelong		>1		\bs
17061# offset of table describing system dependent segments
17062#>>32	ulelong		x		at %#x
17063# number of system dependent strings pairs
17064>>36	ulelong		x		\b, %u sysdep message
17065>>36	ulelong		>1		\bs
17066# offset of table with start offsets of original sysdep strings
17067#>>40	ulelong		x		\b, at %#x sysdep strings
17068# offset of table with start offsets of translated sysdep strings
17069#>>44	ulelong		x		\b, at %#x sysdep translations
17070# >>(44.l)	ulelong	x		%#x chars
17071# >>>&0		ulelong	x		at %#x
17072# >>>>(&-4)	string	x		"%s"
17073# string table after big header
17074#>>48	ubequad		x		\b, string table %#llx
17075#
17076# 0th string length seems to be always 0
17077#>(12.l)	ulelong	x		\b, %u chars
17078#>>&0		ulelong	x		at %#x
17079# if 1st string length positive inspect offset and string
17080#>(12.l+8)	ulelong	>0		\b, %u chars
17081#>>&0		ulelong	x		at %#x
17082# if 2nd string length positive inspect offset and string
17083# >(12.l+16)	ulelong	>0		\b, %u chars
17084# >>&0		ulelong	x		at %#x
17085# skip newline byte
17086#>>>(&-4)	ubyte	=0x0A
17087#>>>>&0		string	x		"%s"
17088#>>>(&-4)	ubyte	!0x0A
17089#>>>>&-1		string	x		'%s'
17090# offset of table with translation strings
17091#>16	ulelong		x		\b, at %#x translation table
17092# check translation 0 length and offset
17093>(16.l)		ulelong	>0
17094>>&0		ulelong	x
17095# translation 0 seems to be often Project-Id with name and version
17096>>>(&-4)	string	x		\b, %s
17097# trans. 1 with bytes >= 1 unlike icoutils-0.31.0\po\en@boldquot.gmo with 1 NL
17098>(16.l+8)	ulelong	>1
17099>>&0		ulelong	x
17100>>>(&-4)	ubyte	!0x0A
17101>>>>&-1		string	x		'%s'
17102# 1 New Line like in tar-1.29\po\de.gmo
17103>>>(&-4)	ubyte	=0x0A
17104>>>>&0		ubyte	!0x0A
17105>>>>>&-1	string	x		'%s'
17106# 2nd New Line like in parted-3.1\po\de.gmo
17107>>>>&0		ubyte	=0x0A
17108>>>>>&0		string	x		'%s'
17109
171100	string		\225\4\22\336	GNU message catalog (big endian),
17111#0	ubelong	0x950412DE		GNU-format message catalog data
17112!:mime	application/x-gettext-translation
17113!:ext	gmo/mo
17114# TODO: for big endian use same code as for little endian
17115#>0	use		\^gettext-object
17116# DEBUG code
17117#>16	ubelong		x		\b, at %#x translation table
17118#>(16.L)		ubelong	x		%#x chars
17119#>>&0		ubelong	x		at %#x
17120# unexpected value HERE!
17121#>>>(&-4)	ubequad	x		%#llx
17122#
17123>4	beshort		x		revision %d.
17124>6	beshort		>0		\b%d,
17125>>8	belong		x		%d messages,
17126>>36	belong		x		%d sysdep messages
17127>6	beshort		=0		\b%d,
17128>>8	belong		x		%d messages
17129
17130
17131# GnuPG
17132# The format is very similar to pgp
171330	string          \001gpg                 GPG key trust database
17134>4	byte            x                       version %d
17135# Note: magic.mime had 0x8501 for the next line instead of 0x8502
171360	beshort		0x8502			GPG encrypted data
17137!:mime	text/PGP # encoding: data
17138
17139# Update: Joerg Jenderek
17140# Note:	PGP and GPG use same data structure.
17141#	So recognition is now done by ./pgp with start test for byte 0x99
17142# This magic is not particularly good, as the keyrings don't have true
17143# magic. Nevertheless, it covers many keyrings.
17144# 0	ubeshort-0x9901	<2
17145# >3	byte		4
17146# >>4	bedate		x		GPG key public ring, created %s
17147# !:mime application/x-gnupg-keyring
17148
17149# Symmetric encryption
171500	leshort		0x0d8c
17151>4	leshort		0x0203
17152>>2	leshort		0x0204		GPG symmetrically encrypted data (3DES cipher)
17153>>2	leshort		0x0304		GPG symmetrically encrypted data (CAST5 cipher)
17154>>2	leshort		0x0404		GPG symmetrically encrypted data (BLOWFISH cipher)
17155>>2	leshort		0x0704		GPG symmetrically encrypted data (AES cipher)
17156>>2	leshort		0x0804		GPG symmetrically encrypted data (AES192 cipher)
17157>>2	leshort		0x0904		GPG symmetrically encrypted data (AES256 cipher)
17158>>2	leshort		0x0a04		GPG symmetrically encrypted data (TWOFISH cipher)
17159>>2	leshort		0x0b04		GPG symmetrically encrypted data (CAMELLIA128 cipher)
17160>>2	leshort		0x0c04		GPG symmetrically encrypted data (CAMELLIA192 cipher)
17161>>2	leshort		0x0d04		GPG symmetrically encrypted data (CAMELLIA256 cipher)
17162
17163
17164# GnuPG Keybox file
17165# <https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=kbx/keybox-blob.c;hb=HEAD>
17166# From: Philipp Hahn <hahn@univention.de>
171670	belong	32
17168>4	byte	1
17169>>8	string	KBXf	GPG keybox database
17170>>>5	byte	1	version %d
17171>>>16	bedate	x	\b, created-at %s
17172>>>20	bedate	x	\b, last-maintained %s
17173
17174
17175# From: James Youngman <jay@gnu.org>
17176# gnu find magic
171770	string	\0LOCATE	GNU findutils locate database data
17178>7	string	>\0		\b, format %s
17179>7	string	02		\b (frcode)
17180
17181# Files produced by GNU gettext
17182
17183# gettext message catalogue
171840	search/1024	\nmsgid
17185>&0	search/1024	\nmsgstr	GNU gettext message catalogue text
17186!:strength +100
17187!:mime text/x-po
17188
17189#------------------------------------------------------------------------------
17190# $File: gnumeric,v 1.4 2009/09/19 16:28:09 christos Exp $
17191# gnumeric:  file(1) magic for Gnumeric spreadsheet
17192# This entry is only semi-helpful, as Gnumeric compresses its files, so
17193# they will ordinarily reported as "compressed", but at least -z helps
1719439	string	=<gmr:Workbook	Gnumeric spreadsheet
17195!:mime	application/x-gnumeric
17196
17197#------------------------------------------------------------------------------
17198# $File: gpt,v 1.5 2020/12/12 20:01:47 christos Exp $
17199#
17200# GPT Partition table patterns.
17201# Author: Rogier Goossens (goossens.rogier@gmail.com)
17202# Note that a GPT-formatted disk must contain an MBR as well.
17203#
17204
17205# The initial segment (up to >>>>>>>>422) was copied from the X86
17206# partition table code (aka MBR).
17207# This is kept separate, so that MBR partitions are not reported as well.
17208# (use -k if you do want them as well)
17209
17210# First, detect the MBR partition table
17211# If more than one GPT protective MBR partition exists, don't print anything
17212# (the other MBR detection code will then just print the MBR partition table)
172130x1FE			leshort		0xAA55
17214>3			string		!MS
17215>>3			string		!SYSLINUX
17216>>>3			string		!MTOOL
17217>>>>3			string		!NEWLDR
17218>>>>>5			string		!DOS
17219# not FAT (32 bit)
17220>>>>>>82		string		!FAT32
17221#not Linux kernel
17222>>>>>>>514		string		!HdrS
17223#not BeOS
17224>>>>>>>>422		string		!Be\ Boot\ Loader
17225# GPT with protective MBR entry in partition 1 (only)
17226>>>>>>>>>450		ubyte		0xee
17227>>>>>>>>>>466		ubyte		!0xee
17228>>>>>>>>>>>482		ubyte		!0xee
17229>>>>>>>>>>>>498		ubyte		!0xee
17230#>>>>>>>>>>>>>446	use		gpt-mbr-partition
17231>>>>>>>>>>>>>(454.l*8192)	string		EFI\ PART	GPT partition table
17232>>>>>>>>>>>>>>0			use		gpt-mbr-type
17233>>>>>>>>>>>>>>&-8		use		gpt-table
17234>>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes
17235>>>>>>>>>>>>>(454.l*8192)	string		!EFI\ PART
17236>>>>>>>>>>>>>>(454.l*4096)	string		EFI\ PART	GPT partition table
17237>>>>>>>>>>>>>>>0		use		gpt-mbr-type
17238>>>>>>>>>>>>>>>&-8		use		gpt-table
17239>>>>>>>>>>>>>>>0		ubyte		x		of 4096 bytes
17240>>>>>>>>>>>>>>(454.l*4096)	string		!EFI\ PART
17241>>>>>>>>>>>>>>>(454.l*2048)	string		EFI\ PART	GPT partition table
17242>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
17243>>>>>>>>>>>>>>>>&-8		use		gpt-table
17244>>>>>>>>>>>>>>>>0		ubyte		x		of 2048 bytes
17245>>>>>>>>>>>>>>>(454.l*2048)	string		!EFI\ PART
17246>>>>>>>>>>>>>>>>(454.l*1024)	string		EFI\ PART	GPT partition table
17247>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
17248>>>>>>>>>>>>>>>>>&-8		use		gpt-table
17249>>>>>>>>>>>>>>>>>0		ubyte		x		of 1024 bytes
17250>>>>>>>>>>>>>>>>(454.l*1024)	string		!EFI\ PART
17251>>>>>>>>>>>>>>>>>(454.l*512)	string		EFI\ PART	GPT partition table
17252>>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
17253>>>>>>>>>>>>>>>>>>&-8		use		gpt-table
17254>>>>>>>>>>>>>>>>>>0		ubyte		x		of 512 bytes
17255# GPT with protective MBR entry in partition 2 (only)
17256>>>>>>>>>450		ubyte		!0xee
17257>>>>>>>>>>466		ubyte		0xee
17258>>>>>>>>>>>482		ubyte		!0xee
17259>>>>>>>>>>>>498		ubyte		!0xee
17260#>>>>>>>>>>>>>462	use		gpt-mbr-partition
17261>>>>>>>>>>>>>(470.l*8192)	string		EFI\ PART	GPT partition table
17262>>>>>>>>>>>>>>0			use		gpt-mbr-type
17263>>>>>>>>>>>>>>&-8		use		gpt-table
17264>>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes
17265>>>>>>>>>>>>>(470.l*8192)	string		!EFI\ PART
17266>>>>>>>>>>>>>>(470.l*4096)	string		EFI\ PART	GPT partition table
17267>>>>>>>>>>>>>>>0		use		gpt-mbr-type
17268>>>>>>>>>>>>>>>&-8		use		gpt-table
17269>>>>>>>>>>>>>>>0		ubyte		x		of 4096 bytes
17270>>>>>>>>>>>>>>(470.l*4096)	string		!EFI\ PART
17271>>>>>>>>>>>>>>>(470.l*2048)	string		EFI\ PART	GPT partition table
17272>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
17273>>>>>>>>>>>>>>>>&-8		use		gpt-table
17274>>>>>>>>>>>>>>>>0		ubyte		x		of 2048 bytes
17275>>>>>>>>>>>>>>>(470.l*2048)	string		!EFI\ PART
17276>>>>>>>>>>>>>>>>(470.l*1024)	string		EFI\ PART	GPT partition table
17277>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
17278>>>>>>>>>>>>>>>>>&-8		use		gpt-table
17279>>>>>>>>>>>>>>>>>0		ubyte		x		of 1024 bytes
17280>>>>>>>>>>>>>>>>(470.l*1024)	string		!EFI\ PART
17281>>>>>>>>>>>>>>>>>(470.l*512)	string		EFI\ PART	GPT partition table
17282>>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
17283>>>>>>>>>>>>>>>>>>&-8		use		gpt-table
17284>>>>>>>>>>>>>>>>>>0		ubyte		x		of 512 bytes
17285# GPT with protective MBR entry in partition 3 (only)
17286>>>>>>>>>450		ubyte		!0xee
17287>>>>>>>>>>466		ubyte		!0xee
17288>>>>>>>>>>>482		ubyte		0xee
17289>>>>>>>>>>>>498		ubyte		!0xee
17290#>>>>>>>>>>>>>478	use		gpt-mbr-partition
17291>>>>>>>>>>>>>(486.l*8192)	string		EFI\ PART	GPT partition table
17292>>>>>>>>>>>>>>0			use		gpt-mbr-type
17293>>>>>>>>>>>>>>&-8		use		gpt-table
17294>>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes
17295>>>>>>>>>>>>>(486.l*8192)	string		!EFI\ PART
17296>>>>>>>>>>>>>>(486.l*4096)	string		EFI\ PART	GPT partition table
17297>>>>>>>>>>>>>>>0		use		gpt-mbr-type
17298>>>>>>>>>>>>>>>&-8		use		gpt-table
17299>>>>>>>>>>>>>>>0		ubyte		x		of 4096 bytes
17300>>>>>>>>>>>>>>(486.l*4096)	string		!EFI\ PART
17301>>>>>>>>>>>>>>>(486.l*2048)	string		EFI\ PART	GPT partition table
17302>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
17303>>>>>>>>>>>>>>>>&-8		use		gpt-table
17304>>>>>>>>>>>>>>>>0		ubyte		x		of 2048 bytes
17305>>>>>>>>>>>>>>>(486.l*2048)	string		!EFI\ PART
17306>>>>>>>>>>>>>>>>(486.l*1024)	string		EFI\ PART	GPT partition table
17307>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
17308>>>>>>>>>>>>>>>>>&-8		use		gpt-table
17309>>>>>>>>>>>>>>>>>0		ubyte		x		of 1024 bytes
17310>>>>>>>>>>>>>>>>(486.l*1024)	string		!EFI\ PART
17311>>>>>>>>>>>>>>>>>(486.l*512)	string		EFI\ PART	GPT partition table
17312>>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
17313>>>>>>>>>>>>>>>>>>&-8		use		gpt-table
17314>>>>>>>>>>>>>>>>>>0		ubyte		x		of 512 bytes
17315# GPT with protective MBR entry in partition 4 (only)
17316>>>>>>>>>450		ubyte		!0xee
17317>>>>>>>>>>466		ubyte		!0xee
17318>>>>>>>>>>>482		ubyte		!0xee
17319>>>>>>>>>>>>498		ubyte		0xee
17320#>>>>>>>>>>>>>494	use		gpt-mbr-partition
17321>>>>>>>>>>>>>(502.l*8192)	string		EFI\ PART	GPT partition table
17322>>>>>>>>>>>>>>0			use		gpt-mbr-type
17323>>>>>>>>>>>>>>&-8		use		gpt-table
17324>>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes
17325>>>>>>>>>>>>>(502.l*8192)	string		!EFI\ PART
17326>>>>>>>>>>>>>>(502.l*4096)	string		EFI\ PART	GPT partition table
17327>>>>>>>>>>>>>>>0		use		gpt-mbr-type
17328>>>>>>>>>>>>>>>&-8		use		gpt-table
17329>>>>>>>>>>>>>>>0		ubyte		x		of 4096 bytes
17330>>>>>>>>>>>>>>(502.l*4096)	string		!EFI\ PART
17331>>>>>>>>>>>>>>>(502.l*2048)	string		EFI\ PART	GPT partition table
17332>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
17333>>>>>>>>>>>>>>>>&-8		use		gpt-table
17334>>>>>>>>>>>>>>>>0		ubyte		x		of 2048 bytes
17335>>>>>>>>>>>>>>>(502.l*2048)	string		!EFI\ PART
17336>>>>>>>>>>>>>>>>(502.l*1024)	string		EFI\ PART	GPT partition table
17337>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
17338>>>>>>>>>>>>>>>>>&-8		use		gpt-table
17339>>>>>>>>>>>>>>>>>0		ubyte		x		of 1024 bytes
17340>>>>>>>>>>>>>>>>(502.l*1024)	string		!EFI\ PART
17341>>>>>>>>>>>>>>>>>(502.l*512)	string		EFI\ PART	GPT partition table
17342>>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
17343>>>>>>>>>>>>>>>>>>&-8		use		gpt-table
17344>>>>>>>>>>>>>>>>>>0		ubyte		x		of 512 bytes
17345
17346# The following code does GPT detection and processing, including
17347# sector size detection.
17348# It has to be duplicated above because the top-level pattern
17349# (i.e. not called using 'use') must print *something* for file
17350# to count it as a match. Text only printed in named patterns is
17351# not counted, and causes file to continue, and try and match
17352# other patterns.
17353#
17354# Unfortunately, when assuming sector sizes >=16k, if the sector size
17355# happens to be 512 instead, we may find confusing data after the GPT
17356# table...  If the GPT table has less than 128 entries, this may even
17357# happen for assumed sector sizes as small as 4k
17358# This could be solved by checking for the presence of the backup GPT
17359# header as well, but that makes the logic extremely complex
17360##0		name		gpt-mbr-partition
17361##>(8.l*8192)	string		EFI\ PART
17362##>>(8.l*8192)	use		gpt-mbr-type
17363##>>&-8		use		gpt-table
17364##>>0		ubyte		x		of 8192 bytes
17365##>(8.l*8192)	string		!EFI\ PART
17366##>>(8.l*4096)	string		EFI\ PART	GPT partition table
17367##>>>0		use		gpt-mbr-type
17368##>>>&-8		use		gpt-table
17369##>>>0		ubyte		x		of 4096 bytes
17370##>>(8.l*4096)	string		!EFI\ PART
17371##>>>(8.l*2048)	string		EFI\ PART	GPT partition table
17372##>>>>0		use		gpt-mbr-type
17373##>>>>&-8		use		gpt-table
17374##>>>>0		ubyte		x		of 2048 bytes
17375##>>>(8.l*2048)	string		!EFI\ PART
17376##>>>>(8.l*1024)	string		EFI\ PART	GPT partition table
17377##>>>>>0		use		gpt-mbr-type
17378##>>>>>&-8	use		gpt-table
17379##>>>>>0		ubyte		x		of 1024 bytes
17380##>>>>(8.l*1024)	string		!EFI\ PART
17381##>>>>>(8.l*512)	string		EFI\ PART	GPT partition table
17382##>>>>>>0		use		gpt-mbr-type
17383##>>>>>>&-8	use		gpt-table
17384##>>>>>>0		ubyte		x		of 512 bytes
17385
17386# Print details of MBR type for a GPT-disk
17387# Calling code ensures that there is only one 0xee partition.
173880		name		gpt-mbr-type
17389# GPT with protective MBR entry in partition 1
17390>450		ubyte		0xee
17391>>454		ulelong		1
17392>>>462		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	\b (with hybrid MBR)
17393>>454		ulelong		!1													\b (nonstandard: not at LBA 1)
17394# GPT with protective MBR entry in partition 2
17395>466		ubyte		0xee
17396>>470		ulelong		1
17397>>>478		string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
17398>>>>446		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0					\b (with hybrid MBR)
17399>>>478		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	\b (with hybrid MBR)
17400>>470		ulelong		!1									\b (nonstandard: not at LBA 1)
17401# GPT with protective MBR entry in partition 3
17402>482		ubyte		0xee
17403>>486		ulelong		1
17404>>>494		string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
17405>>>>446		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	\b (with hybrid MBR)
17406>>>494		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0					\b (with hybrid MBR)
17407>>486		ulelong		!1									\b (nonstandard: not at LBA 1)
17408# GPT with protective MBR entry in partition 4
17409>498		ubyte		0xee
17410>>502		ulelong		1
17411>>>446		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	\b (with hybrid MBR)
17412>>502		ulelong		!1													\b (nonstandard: not at LBA 1)
17413
17414# Print the information from a GPT partition table structure
174150		name		gpt-table
17416>10		uleshort	x		\b, version %u
17417>8		uleshort	x		\b.%u
17418>56		ulelong		x		\b, GUID: %08x
17419>60		uleshort	x		\b-%04x
17420>62		uleshort	x		\b-%04x
17421>64		ubeshort	x		\b-%04x
17422>66		ubeshort	x		\b-%04x
17423>68		ubelong		x		\b%08x
17424#>80		uleshort	x		\b, %d partition entries
17425>32		ulequad+1	x		\b, disk size: %lld sectors
17426
17427# In case a GPT data-structure is at LBA 0, report it as well
17428# This covers systems which are not GPT-aware, and which show
17429# and allow access to the protective partition. This code will
17430# detect the contents of such a partition.
174310		string		EFI\ PART	GPT data structure (nonstandard: at LBA 0)
17432>0		use		gpt-table
17433>0		ubyte		x		(sector size unknown)
17434
17435
17436
17437#------------------------------------------------------------------------------
17438# $File: gpu,v 1.3 2021/04/26 15:56:00 christos Exp $
17439# gpu: file(1) magic for GPU input files
17440
17441# Standard Portable Intermediate Representation (SPIR)
17442# Documentation: https://www.khronos.org/spir
17443# Typical file extension: .spv
17444
174450	belong	0x07230203	Khronos SPIR-V binary, big-endian
17446>4	belong	x		\b, version %#08x
17447>8	belong	x		\b, generator %#08x
17448
174490	lelong	0x07230203      Khronos SPIR-V binary, little-endian
17450>4	lelong	x		\b, version %#08x
17451>8	lelong	x		\b, generator %#08x
17452
17453# Vulkan Trace file
17454# Documentation:
17455# https://github.com/LunarG/VulkanTools/blob/master/vktrace/vktrace_common/\
17456# vktrace_trace_packet_identifiers.h
17457# Typical file extension: .vktrace
17458
174598	lequad  0xABADD068ADEAFD0C	Vulkan trace file, little-endian
17460>0	leshort	x			\b, version %d
17461
174628	bequad  0xABADD068ADEAFD0C	Vulkan trace file, big-endian
17463>0	beshort	x			\b, version %d
17464
17465#------------------------------------------------------------------------------
17466# $File: grace,v 1.4 2009/09/19 16:28:09 christos Exp $
17467# ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
17468#
17469# ACE/gr binary
174700	string	\000\000\0001\000\000\0000\000\000\0000\000\000\0002\000\000\0000\000\000\0000\000\000\0003		old ACE/gr binary file
17471>39	byte	>0			- version %c
17472# ACE/gr ascii
174730	string	#\ xvgr\ parameter\ file	ACE/gr ascii file
174740	string	#\ xmgr\ parameter\ file	ACE/gr ascii file
174750	string	#\ ACE/gr\ parameter\ file	ACE/gr ascii file
17476# Grace projects
174770	string	#\ Grace\ project\ file		Grace project file
17478>23	string	@version\  			(version
17479>>32	byte	>0 				%c
17480>>33	string	>\0 				\b.%.2s
17481>>35	string	>\0 				\b.%.2s)
17482# ACE/gr fit description files
174830	string	#\ ACE/gr\ fit\ description\ 	ACE/gr fit description file
17484# end of ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
17485
17486#------------------------------------------------------------------------------
17487# $File: graphviz,v 1.9 2019/04/30 04:01:40 christos Exp $
17488# graphviz:  file(1) magic for https://www.graphviz.org/
17489
17490# FIXME: These patterns match too generally. For example, the first
17491# line matches a LaTeX file containing the word "graph" (with a {
17492# following later) and the second line matches this file.
17493#0	regex/100l	[\r\n\t\ ]*graph[\r\n\t\ ]+.*\\{	graphviz graph text
17494#!:mime	text/vnd.graphviz
17495#0	regex/100l	[\r\n\t\ ]*digraph[\r\n\t\ ]+.*\\{	graphviz digraph text
17496#!:mime	text/vnd.graphviz
17497
17498#------------------------------------------------------------------------------
17499# $File: gringotts,v 1.6 2017/03/17 21:35:28 christos Exp $
17500# gringotts:  file(1) magic for Gringotts
17501# http://devel.pluto.linux.it/projects/Gringotts/
17502# author: Germano Rizzo <mano@pluto.linux.it>
17503#GRG3????Y
175040	string	GRG		Gringotts data file
17505#file format 1
17506>3	string		1		v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9
17507#file format 2
17508>3	string		2		v.2, MCRYPT S2K,
17509>>8	byte&0x70	0x00		RIJNDAEL-128 crypt,
17510>>8	byte&0x70	0x10		SERPENT crypt,
17511>>8	byte&0x70	0x20		TWOFISH crypt,
17512>>8	byte&0x70	0x30		CAST-256 crypt,
17513>>8	byte&0x70	0x40		SAFER+ crypt,
17514>>8	byte&0x70	0x50		LOKI97 crypt,
17515>>8	byte&0x70	0x60		3DES crypt,
17516>>8	byte&0x70	0x70		RIJNDAEL-256 crypt,
17517>>8	byte&0x08	0x00		SHA1 hash,
17518>>8	byte&0x08	0x08		RIPEMD-160 hash,
17519>>8	byte&0x04	0x00		ZLib
17520>>8	byte&0x04	0x04		BZip2
17521>>8	byte&0x03	0x00		lvl.0
17522>>8	byte&0x03	0x01		lvl.3
17523>>8	byte&0x03	0x02		lvl.6
17524>>8	byte&0x03	0x03		lvl.9
17525#file format 3
17526>3	string		3		v.3, OpenPGP S2K,
17527>>8	byte&0x70	0x00		RIJNDAEL-128 crypt,
17528>>8	byte&0x70	0x10		SERPENT crypt,
17529>>8	byte&0x70	0x20		TWOFISH crypt,
17530>>8	byte&0x70	0x30		CAST-256 crypt,
17531>>8	byte&0x70	0x40		SAFER+ crypt,
17532>>8	byte&0x70	0x50		LOKI97 crypt,
17533>>8	byte&0x70	0x60		3DES crypt,
17534>>8	byte&0x70	0x70		RIJNDAEL-256 crypt,
17535>>8	byte&0x08	0x00		SHA1 hash,
17536>>8	byte&0x08	0x08		RIPEMD-160 hash,
17537>>8	byte&0x04	0x00		ZLib
17538>>8	byte&0x04	0x04		BZip2
17539>>8	byte&0x03	0x00		lvl.0
17540>>8	byte&0x03	0x01		lvl.3
17541>>8	byte&0x03	0x02		lvl.6
17542>>8	byte&0x03	0x03		lvl.9
17543#file format >3
17544>3	string		>3		v.%.1s (unknown details)
17545
17546#------------------------------------------------------------------------------
17547# $File: hardware,v 1.1 2018/08/02 06:32:52 christos Exp $
17548# hardware magic
17549
17550# EDID
17551# https://en.wikipedia.org/wiki/Extended_Display_Identification_Data
175520	string		\x00\xFF\xFF\xFF\xFF\xFF\xFF\x00
17553>19	byte		x
17554>>18	byte		x	EDID data, version %u.
17555>>19	byte		x	\b%u
17556#>>17	ubyte+1990	<255	\b, manufactured %u
17557
17558#------------------------------------------------------------------------------
17559# $File: hitachi-sh,v 1.10 2020/12/12 20:01:47 christos Exp $
17560# hitach-sh: file(1) magic for Hitachi Super-H
17561#
17562# Super-H COFF
17563#
17564# updated by Joerg Jenderek at Oct 2015
17565# https://en.wikipedia.org/wiki/COFF
17566# https://de.wikipedia.org/wiki/Common_Object_File_Format
17567# http://www.delorie.com/djgpp/doc/coff/filhdr.html
17568# below test line conflicts with 2nd NTFS filesystem sector
17569# 2nd NTFS filesystem sector often starts with 0x05004e00 for unicode string 5 NTLDR
17570# and Portable Gaming Notation Compressed format (*.WID http://pgn.freeservers.com/)
175710	beshort		0x0500
17572# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags
17573>18	ubeshort&0x8E80	0
17574# use big endian variant of subroutine to display name+variables+flags
17575# for common object formatted files
17576>>0	use				\^display-coff
17577!:strength -10
17578
175790	leshort		0x0550
17580# test for unused flag bits in f_flags
17581>18	uleshort&0x8E80	0
17582# use little endian variant of subroutine to
17583# display name+variables+flags for common object formatted files
17584>>0	use				display-coff
17585!:strength -10
17586
17587
17588#------------------------------------------------------------------------------
17589# $File: hp,v 1.25 2019/01/13 00:32:38 christos Exp $
17590# hp:  file(1) magic for Hewlett Packard machines (see also "printer")
17591#
17592# XXX - somebody should figure out whether any byte order needs to be
17593# applied to the "TML" stuff; I'm assuming the Apollo stuff is
17594# big-endian as it was mostly 68K-based.
17595#
17596# I think the 500 series was the old stack-based machines, running a
17597# UNIX environment atop the "SUN kernel"; dunno whether it was
17598# big-endian or little-endian.
17599#
17600# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based;
17601# hp300 are 68020+68881 based; hp400 are also 68k.  The following basic
17602# HP magic is useful for reference, but using "long" magic is a better
17603# practice in order to avoid collisions.
17604#
17605# Guy Harris (guy@netapp.com): some additions to this list came from
17606# HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1,
17607# 1.2, and 2.0).  The 1.2 and 2.0 stuff isn't in the HP-UX 10.0
17608# "/etc/magic", though, except for the "archive file relocatable library"
17609# stuff, and the 68030 and 68040 stuff isn't there at all - are they not
17610# used in executables, or have they just not yet updated "/etc/magic"
17611# completely?
17612#
17613# 0	beshort		200		hp200 (68010) BSD binary
17614# 0	beshort		300		hp300 (68020+68881) BSD binary
17615# 0	beshort		0x20c		hp200/300 HP-UX binary
17616# 0	beshort		0x20d		hp400 (68030) HP-UX binary
17617# 0	beshort		0x20e		hp400 (68040?) HP-UX binary
17618# 0	beshort		0x20b		PA-RISC1.0 HP-UX binary
17619# 0	beshort		0x210		PA-RISC1.1 HP-UX binary
17620# 0	beshort		0x211		PA-RISC1.2 HP-UX binary
17621# 0	beshort		0x214		PA-RISC2.0 HP-UX binary
17622
17623#
17624# The "misc" stuff needs a byte order; the archives look suspiciously
17625# like the old 177545 archives (0xff65 = 0177545).
17626#
17627#### Old Apollo stuff
176280	beshort		0627		Apollo m68k COFF executable
17629>18	beshort		^040000		not stripped
17630>22	beshort		>0		- version %d
176310	beshort		0624		apollo a88k COFF executable
17632>18	beshort		^040000		not stripped
17633>22	beshort		>0		- version %d
176340       long            01203604016     TML 0123 byte-order format
176350       long            01702407010     TML 1032 byte-order format
176360       long            01003405017     TML 2301 byte-order format
176370       long            01602007412     TML 3210 byte-order format
17638#### PA-RISC 1.1
176390	belong 		0x02100106	PA-RISC1.1 relocatable object
176400	belong 		0x02100107	PA-RISC1.1 executable
17641>168	belong		&0x00000004	dynamically linked
17642>(144)	belong		0x054ef630	dynamically linked
17643>96	belong		>0		- not stripped
17644
176450	belong 		0x02100108	PA-RISC1.1 shared executable
17646>168	belong&0x4	0x4		dynamically linked
17647>(144)	belong		0x054ef630	dynamically linked
17648>96	belong		>0		- not stripped
17649
176500	belong 		0x0210010b	PA-RISC1.1 demand-load executable
17651>168	belong&0x4	0x4		dynamically linked
17652>(144)	belong		0x054ef630	dynamically linked
17653>96	belong		>0		- not stripped
17654
176550	belong 		0x0210010e	PA-RISC1.1 shared library
17656>96	belong		>0		- not stripped
17657
176580	belong 		0x0210010d	PA-RISC1.1 dynamic load library
17659>96	belong		>0		- not stripped
17660
17661#### PA-RISC 2.0
176620	belong		0x02140106	PA-RISC2.0 relocatable object
17663
176640       belong		0x02140107	PA-RISC2.0 executable
17665>168	belong		&0x00000004	dynamically linked
17666>(144)	belong		0x054ef630	dynamically linked
17667>96	belong		>0		- not stripped
17668
176690       belong		0x02140108	PA-RISC2.0 shared executable
17670>168	belong		&0x00000004	dynamically linked
17671>(144)	belong		0x054ef630	dynamically linked
17672>96	belong		>0		- not stripped
17673
176740       belong		0x0214010b	PA-RISC2.0 demand-load executable
17675>168	belong		&0x00000004	dynamically linked
17676>(144)	belong		0x054ef630	dynamically linked
17677>96	belong		>0		- not stripped
17678
176790       belong		0x0214010e	PA-RISC2.0 shared library
17680>96	belong		>0		- not stripped
17681
176820       belong		0x0214010d	PA-RISC2.0 dynamic load library
17683>96	belong		>0		- not stripped
17684
17685#### 800
176860	belong 		0x020b0106	PA-RISC1.0 relocatable object
17687
176880	belong 		0x020b0107	PA-RISC1.0 executable
17689>168	belong&0x4	0x4		dynamically linked
17690>(144)	belong		0x054ef630	dynamically linked
17691>96	belong		>0		- not stripped
17692
176930	belong 		0x020b0108	PA-RISC1.0 shared executable
17694>168	belong&0x4	0x4		dynamically linked
17695>(144)	belong		0x054ef630	dynamically linked
17696>96	belong		>0		- not stripped
17697
176980	belong 		0x020b010b	PA-RISC1.0 demand-load executable
17699>168	belong&0x4	0x4		dynamically linked
17700>(144)	belong		0x054ef630	dynamically linked
17701>96	belong		>0		- not stripped
17702
177030	belong 		0x020b010e	PA-RISC1.0 shared library
17704>96	belong		>0		- not stripped
17705
177060	belong 		0x020b010d	PA-RISC1.0 dynamic load library
17707>96	belong		>0		- not stripped
17708
17709#### 500
177100	long		0x02080106	HP s500 relocatable executable
17711>16	long		>0		- version %d
17712
177130	long		0x02080107	HP s500 executable
17714>16	long		>0		- version %d
17715
177160	long		0x02080108	HP s500 pure executable
17717>16	long		>0		- version %d
17718
17719#### 200
177200	belong 		0x020c0108	HP s200 pure executable
17721>4	beshort		>0		- version %d
17722>8	belong		&0x80000000	save fp regs
17723>8	belong		&0x40000000	dynamically linked
17724>8	belong		&0x20000000	debuggable
17725>36	belong		>0		not stripped
17726
177270	belong		0x020c0107	HP s200 executable
17728>4	beshort		>0		- version %d
17729>8	belong		&0x80000000	save fp regs
17730>8	belong		&0x40000000	dynamically linked
17731>8	belong		&0x20000000	debuggable
17732>36	belong		>0		not stripped
17733
177340	belong		0x020c010b	HP s200 demand-load executable
17735>4	beshort		>0		- version %d
17736>8	belong		&0x80000000	save fp regs
17737>8	belong		&0x40000000	dynamically linked
17738>8	belong		&0x20000000	debuggable
17739>36	belong		>0		not stripped
17740
177410	belong		0x020c0106	HP s200 relocatable executable
17742>4	beshort		>0		- version %d
17743>6	beshort		>0		- highwater %d
17744>8	belong		&0x80000000	save fp regs
17745>8	belong		&0x20000000	debuggable
17746>8	belong		&0x10000000	PIC
17747
177480	belong 		0x020a0108	HP s200 (2.x release) pure executable
17749>4	beshort		>0		- version %d
17750>36	belong		>0		not stripped
17751
177520	belong		0x020a0107	HP s200 (2.x release) executable
17753>4	beshort		>0		- version %d
17754>36	belong		>0		not stripped
17755
177560	belong		0x020c010e	HP s200 shared library
17757>4	beshort		>0		- version %d
17758>6	beshort		>0		- highwater %d
17759>36	belong		>0		not stripped
17760
177610	belong		0x020c010d	HP s200 dynamic load library
17762>4	beshort		>0		- version %d
17763>6	beshort		>0		- highwater %d
17764>36	belong		>0		not stripped
17765
17766#### MISC
177670	long		0x0000ff65	HP old archive
177680	long		0x020aff65	HP s200 old archive
177690	long		0x020cff65	HP s200 old archive
177700	long		0x0208ff65	HP s500 old archive
17771
177720	long		0x015821a6	HP core file
17773
177740	long		0x4da7eee8	HP-WINDOWS font
17775>8	byte		>0		- version %d
177760	string		Bitmapfile	HP Bitmapfile
17777
177780	string		IMGfile	CIS 	compimg HP Bitmapfile
17779# XXX - see "lif"
17780#0	short		0x8000		lif file
177810	long		0x020c010c	compiled Lisp
17782
177830	string		msgcat01	HP NLS message catalog,
17784>8	long		>0		%d messages
17785
17786# Summary: HP-48/49 calculator
17787# Created by: phk@data.fls.dk
17788# Modified by (1): AMAKAWA Shuhei <sa264@cam.ac.uk>
17789# Modified by (2): Samuel Thibault <samuel.thibault@ens-lyon.org> (HP49 support)
177900	string		HPHP		HP
17791>4	string		48		48 binary
17792>4	string		49		49 binary
17793>7	byte		>64		- Rev %c
17794>8	leshort		0x2911		(ADR)
17795>8	leshort		0x2933		(REAL)
17796>8	leshort		0x2955		(LREAL)
17797>8	leshort		0x2977		(COMPLX)
17798>8	leshort		0x299d		(LCOMPLX)
17799>8	leshort		0x29bf		(CHAR)
17800>8	leshort		0x29e8		(ARRAY)
17801>8	leshort		0x2a0a		(LNKARRAY)
17802>8	leshort		0x2a2c		(STRING)
17803>8	leshort		0x2a4e		(HXS)
17804>8	leshort		0x2a74		(LIST)
17805>8	leshort		0x2a96		(DIR)
17806>8	leshort		0x2ab8		(ALG)
17807>8	leshort		0x2ada		(UNIT)
17808>8	leshort		0x2afc		(TAGGED)
17809>8	leshort		0x2b1e		(GROB)
17810>8	leshort		0x2b40		(LIB)
17811>8	leshort		0x2b62		(BACKUP)
17812>8	leshort		0x2b88		(LIBDATA)
17813>8	leshort		0x2d9d		(PROG)
17814>8	leshort		0x2dcc		(CODE)
17815>8	leshort		0x2e48		(GNAME)
17816>8	leshort		0x2e6d		(LNAME)
17817>8	leshort		0x2e92		(XLIB)
17818
178190	string		%%HP:		HP text
17820>6	string		T(0)		- T(0)
17821>6	string		T(1)		- T(1)
17822>6	string		T(2)		- T(2)
17823>6	string		T(3)		- T(3)
17824>10	string		A(D)		A(D)
17825>10	string		A(R)		A(R)
17826>10	string		A(G)		A(G)
17827>14	string		F(.)		F(.);
17828>14	string		F(,)		F(,);
17829
17830
17831# Summary: HP-38/39 calculator
17832# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org>
178330	string		HP3
17834>3	string		8		HP 38
17835>3	string		9		HP 39
17836>4	string		Bin		binary
17837>4	string		Asc		ASCII
17838>7	string		A		(Directory List)
17839>7	string		B		(Zaplet)
17840>7	string		C		(Note)
17841>7	string		D		(Program)
17842>7	string		E		(Variable)
17843>7	string		F		(List)
17844>7	string		G		(Matrix)
17845>7	string		H		(Library)
17846>7	string		I		(Target List)
17847>7	string		J		(ASCII Vector specification)
17848>7	string		K		(wildcard)
17849
17850# Summary: HP-38/39 calculator
17851# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org>
178520	string		HP3
17853>3	string		8		HP 38
17854>3	string		9		HP 39
17855>4	string		Bin		binary
17856>4	string		Asc		ASCII
17857>7	string		A		(Directory List)
17858>7	string		B		(Zaplet)
17859>7	string		C		(Note)
17860>7	string		D		(Program)
17861>7	string		E		(Variable)
17862>7	string		F		(List)
17863>7	string		G		(Matrix)
17864>7	string		H		(Library)
17865>7	string		I		(Target List)
17866>7	string		J		(ASCII Vector specification)
17867>7	string		K		(wildcard)
17868
17869# hpBSD magic numbers
178700	beshort		200		hp200 (68010) BSD
17871>2	beshort		0407		impure binary
17872>2	beshort		0410		read-only binary
17873>2	beshort		0413		demand paged binary
178740	beshort		300		hp300 (68020+68881) BSD
17875>2	beshort		0407		impure binary
17876>2	beshort		0410		read-only binary
17877>2	beshort		0413		demand paged binary
17878#
17879# From David Gero <dgero@nortelnetworks.com>
17880# HP-UX 10.20 core file format from /usr/include/sys/core.h
17881# Unfortunately, HP-UX uses corehead blocks without specifying the order
17882# There are four we care about:
17883#     CORE_KERNEL, which starts with the string "HP-UX"
17884#     CORE_EXEC, which contains the name of the command
17885#     CORE_PROC, which contains the signal number that caused the core dump
17886#     CORE_FORMAT, which contains the version of the core file format (== 1)
17887# The only observed order in real core files is KERNEL, EXEC, FORMAT, PROC
17888# but we include all 6 variations of the order of the first 3, and
17889# assume that PROC will always be last
17890# Order 1: KERNEL, EXEC, FORMAT, PROC
178910x10		string	HP-UX
17892>0		belong	2
17893>>0xC		belong	0x3C
17894>>>0x4C		belong	0x100
17895>>>>0x58	belong	0x44
17896>>>>>0xA0	belong	1
17897>>>>>>0xAC	belong	4
17898>>>>>>>0xB0	belong	1
17899>>>>>>>>0xB4	belong	4		core file
17900>>>>>>>>>0x90	string	>\0		from '%s'
17901>>>>>>>>>0xC4	belong	3		- received SIGQUIT
17902>>>>>>>>>0xC4	belong	4		- received SIGILL
17903>>>>>>>>>0xC4	belong	5		- received SIGTRAP
17904>>>>>>>>>0xC4	belong	6		- received SIGABRT
17905>>>>>>>>>0xC4	belong	7		- received SIGEMT
17906>>>>>>>>>0xC4	belong	8		- received SIGFPE
17907>>>>>>>>>0xC4	belong	10		- received SIGBUS
17908>>>>>>>>>0xC4	belong	11		- received SIGSEGV
17909>>>>>>>>>0xC4	belong	12		- received SIGSYS
17910>>>>>>>>>0xC4	belong	33		- received SIGXCPU
17911>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
17912# Order 2: KERNEL, FORMAT, EXEC, PROC
17913>>>0x4C		belong	1
17914>>>>0x58	belong	4
17915>>>>>0x5C	belong	1
17916>>>>>>0x60	belong	0x100
17917>>>>>>>0x6C	belong	0x44
17918>>>>>>>>0xB4	belong	4		core file
17919>>>>>>>>>0xA4	string	>\0		from '%s'
17920>>>>>>>>>0xC4	belong	3		- received SIGQUIT
17921>>>>>>>>>0xC4	belong	4		- received SIGILL
17922>>>>>>>>>0xC4	belong	5		- received SIGTRAP
17923>>>>>>>>>0xC4	belong	6		- received SIGABRT
17924>>>>>>>>>0xC4	belong	7		- received SIGEMT
17925>>>>>>>>>0xC4	belong	8		- received SIGFPE
17926>>>>>>>>>0xC4	belong	10		- received SIGBUS
17927>>>>>>>>>0xC4	belong	11		- received SIGSEGV
17928>>>>>>>>>0xC4	belong	12		- received SIGSYS
17929>>>>>>>>>0xC4	belong	33		- received SIGXCPU
17930>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
17931# Order 3: FORMAT, KERNEL, EXEC, PROC
179320x24		string	HP-UX
17933>0		belong	1
17934>>0xC		belong	4
17935>>>0x10		belong	1
17936>>>>0x14	belong	2
17937>>>>>0x20	belong	0x3C
17938>>>>>>0x60	belong	0x100
17939>>>>>>>0x6C	belong	0x44
17940>>>>>>>>0xB4	belong	4		core file
17941>>>>>>>>>0xA4	string	>\0		from '%s'
17942>>>>>>>>>0xC4	belong	3		- received SIGQUIT
17943>>>>>>>>>0xC4	belong	4		- received SIGILL
17944>>>>>>>>>0xC4	belong	5		- received SIGTRAP
17945>>>>>>>>>0xC4	belong	6		- received SIGABRT
17946>>>>>>>>>0xC4	belong	7		- received SIGEMT
17947>>>>>>>>>0xC4	belong	8		- received SIGFPE
17948>>>>>>>>>0xC4	belong	10		- received SIGBUS
17949>>>>>>>>>0xC4	belong	11		- received SIGSEGV
17950>>>>>>>>>0xC4	belong	12		- received SIGSYS
17951>>>>>>>>>0xC4	belong	33		- received SIGXCPU
17952>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
17953# Order 4: EXEC, KERNEL, FORMAT, PROC
179540x64		string	HP-UX
17955>0		belong	0x100
17956>>0xC		belong	0x44
17957>>>0x54		belong	2
17958>>>>0x60	belong	0x3C
17959>>>>>0xA0	belong	1
17960>>>>>>0xAC	belong	4
17961>>>>>>>0xB0	belong	1
17962>>>>>>>>0xB4	belong	4		core file
17963>>>>>>>>>0x44	string	>\0		from '%s'
17964>>>>>>>>>0xC4	belong	3		- received SIGQUIT
17965>>>>>>>>>0xC4	belong	4		- received SIGILL
17966>>>>>>>>>0xC4	belong	5		- received SIGTRAP
17967>>>>>>>>>0xC4	belong	6		- received SIGABRT
17968>>>>>>>>>0xC4	belong	7		- received SIGEMT
17969>>>>>>>>>0xC4	belong	8		- received SIGFPE
17970>>>>>>>>>0xC4	belong	10		- received SIGBUS
17971>>>>>>>>>0xC4	belong	11		- received SIGSEGV
17972>>>>>>>>>0xC4	belong	12		- received SIGSYS
17973>>>>>>>>>0xC4	belong	33		- received SIGXCPU
17974>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
17975# Order 5: FORMAT, EXEC, KERNEL, PROC
179760x78		string	HP-UX
17977>0		belong	1
17978>>0xC		belong	4
17979>>>0x10		belong	1
17980>>>>0x14	belong	0x100
17981>>>>>0x20	belong	0x44
17982>>>>>>0x68	belong	2
17983>>>>>>>0x74	belong	0x3C
17984>>>>>>>>0xB4	belong	4		core file
17985>>>>>>>>>0x58	string	>\0		from '%s'
17986>>>>>>>>>0xC4	belong	3		- received SIGQUIT
17987>>>>>>>>>0xC4	belong	4		- received SIGILL
17988>>>>>>>>>0xC4	belong	5		- received SIGTRAP
17989>>>>>>>>>0xC4	belong	6		- received SIGABRT
17990>>>>>>>>>0xC4	belong	7		- received SIGEMT
17991>>>>>>>>>0xC4	belong	8		- received SIGFPE
17992>>>>>>>>>0xC4	belong	10		- received SIGBUS
17993>>>>>>>>>0xC4	belong	11		- received SIGSEGV
17994>>>>>>>>>0xC4	belong	12		- received SIGSYS
17995>>>>>>>>>0xC4	belong	33		- received SIGXCPU
17996>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
17997# Order 6: EXEC, FORMAT, KERNEL, PROC
17998>0		belong	0x100
17999>>0xC		belong	0x44
18000>>>0x54		belong	1
18001>>>>0x60	belong	4
18002>>>>>0x64	belong	1
18003>>>>>>0x68	belong	2
18004>>>>>>>0x74	belong	0x2C
18005>>>>>>>>0xB4	belong	4		core file
18006>>>>>>>>>0x44	string	>\0		from '%s'
18007>>>>>>>>>0xC4	belong	3		- received SIGQUIT
18008>>>>>>>>>0xC4	belong	4		- received SIGILL
18009>>>>>>>>>0xC4	belong	5		- received SIGTRAP
18010>>>>>>>>>0xC4	belong	6		- received SIGABRT
18011>>>>>>>>>0xC4	belong	7		- received SIGEMT
18012>>>>>>>>>0xC4	belong	8		- received SIGFPE
18013>>>>>>>>>0xC4	belong	10		- received SIGBUS
18014>>>>>>>>>0xC4	belong	11		- received SIGSEGV
18015>>>>>>>>>0xC4	belong	12		- received SIGSYS
18016>>>>>>>>>0xC4	belong	33		- received SIGXCPU
18017>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
18018
18019
18020
18021#------------------------------------------------------------------------------
18022# $File: human68k,v 1.6 2021/04/26 15:56:00 christos Exp $
18023# human68k:  file(1) magic for Human68k (X680x0 DOS) binary formats
18024# Magic too short!
18025#0		string	HU		Human68k
18026#>68		string	LZX		LZX compressed
18027#>>72		string	>\0		(version %s)
18028#>(8.L+74)	string	LZX		LZX compressed
18029#>>(8.L+78)	string	>\0		(version %s)
18030#>60		belong	>0		binded
18031#>(8.L+66)	string	#HUPAIR		hupair
18032#>0		string	HU		X executable
18033#>(8.L+74)	string	#LIBCV1		- linked PD LIBC ver 1
18034#>4		belong	>0		- base address %#x
18035#>28		belong	>0		not stripped
18036#>32		belong	>0		with debug information
18037#0		beshort	0x601a		Human68k Z executable
18038#0		beshort	0x6000		Human68k object file
18039#0		belong	0xd1000000	Human68k ar binary archive
18040#0		belong	0xd1010000	Human68k ar ascii archive
18041#0		beshort	0x0068		Human68k lib archive
18042#4		string	LZX		Human68k LZX compressed
18043#>8		string	>\0		(version %s)
18044#>4		string	LZX		R executable
18045#2		string	#HUPAIR		Human68k hupair R executable
18046
18047#------------------------------------------------------------------------------
18048# $File: ibm370,v 1.11 2021/03/14 16:51:45 christos Exp $
18049# ibm370:  file(1) magic for IBM 370 and compatibles.
18050#
18051# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
18052# What the heck *is* "USS/370"?
18053# AIX 4.1's "/etc/magic" has
18054#
18055#	0	short		0535		370 sysV executable
18056#	>12	long		>0		not stripped
18057#	>22	short		>0		- version %d
18058#	>30	long		>0		- 5.2 format
18059#	0	short		0530		370 sysV pure executable
18060#	>12	long		>0		not stripped
18061#	>22	short		>0		- version %d
18062#	>30	long		>0		- 5.2 format
18063#
18064# instead of the "USS/370" versions of the same magic numbers.
18065#
180660	beshort		0537		370 XA sysV executable
18067>12	belong		>0		not stripped
18068>22	beshort		>0		- version %d
18069>30	belong		>0		- 5.2 format
180700	beshort		0532		370 XA sysV pure executable
18071>12	belong		>0		not stripped
18072>22	beshort		>0		- version %d
18073>30	belong		>0		- 5.2 format
180740	beshort		054001		370 sysV pure executable
18075>12	belong		>0		not stripped
180760	beshort		055001		370 XA sysV pure executable
18077>12	belong		>0		not stripped
180780	beshort		056401		370 sysV executable
18079>12	belong		>0		not stripped
180800	beshort		057401		370 XA sysV executable
18081>12	belong		>0		not stripped
180820       beshort		0531		SVR2 executable (Amdahl-UTS)
18083>12	belong		>0		not stripped
18084>24     belong		>0		- version %d
180850	beshort		0534		SVR2 pure executable (Amdahl-UTS)
18086>12	belong		>0		not stripped
18087>24	belong		>0		- version %d
180880	beshort		0530		SVR2 pure executable (USS/370)
18089>12	belong		>0		not stripped
18090>24	belong		>0		- version %d
180910	beshort		0535		SVR2 executable (USS/370)
18092>12	belong		>0		not stripped
18093>24	belong		>0		- version %d
18094
18095# NETDATA (https://en.wikipedia.org/wiki/NETDATA)
18096#	-\INMR01 In EBCDIC
180970	string 		\x60\xe0\xc9\xd5\xd4\xd9\xf0\xf1	IBM NETDATA file
18098
18099#------------------------------------------------------------------------------
18100# $File: ibm6000,v 1.15 2021/07/03 14:01:46 christos Exp $
18101# ibm6000:  file(1) magic for RS/6000 and the RT PC.
18102#
181030	beshort		0x01df		executable (RISC System/6000 V3.1) or obj module
18104>12	belong		>0		not stripped
18105# Breaks sun4 statically linked execs.
18106#0      beshort		0x0103		executable (RT Version 2) or obj module
18107#>2	byte		0x50		pure
18108#>28	belong		>0		not stripped
18109#>6	beshort		>0		- version %ld
18110# GRR: line below is too general as it matches also TTComp archive, ASCII, 1K handled by ./archive
181110	beshort		0x0104		shared library
18112# GRR: line below is too general as it matches also TTComp archive, ASCII, 2K handled by ./archive
181130	beshort		0x0105		ctab data
181140	beshort		0xfe04		structured file
181150	string		0xabcdef	AIX message catalog
181160	belong		0x000001f9	AIX compiled message catalog
181170	string		\<aiaff>	archive
181180	string		\<bigaf>	archive (big format)
181190	belong		0x09006bea	AIX backup/restore format file
181200	belong		0x09006fea	AIX backup/restore format file
18121
181220	beshort		0x01f7		64-bit XCOFF executable or object module
18123>20	belong		0		not stripped
18124# GRR: this test is still too general as it catches also many FATs of DOS filesystems
181254	belong		&0x0feeddb0
18126# real core dump could not be 32-bit and 64-bit together
18127>7	byte&0x03	!3		AIX core file
18128>>1	byte		&0x01		fulldump
18129>>7	byte		&0x01		32-bit
18130>>>0x6e0	string	>\0		\b, %s
18131>>7	byte		&0x02		64-bit
18132>>>0x524	string	>\0		\b, %s
18133
18134#------------------------------------------------------------------------------
18135# $File: icc,v 1.7 2021/04/26 15:56:00 christos Exp $
18136# icc:  file(1) magic for International Color Consortium file formats
18137
18138#
18139# Color profiles as per the ICC's "Image technology colour management -
18140# Architecture, profile format, and data structure" specification.
18141# See
18142#
18143#	http://www.color.org/specification/ICC1v43_2010-12.pdf
18144#
18145# for Specification ICC.1:2010 (Profile version 4.3.0.0).
18146# URL: http://fileformats.archiveteam.org/wiki/ICC_profile
18147# Reference: http://www.color.org/iccmax/ICC.2-2016-7.pdf
18148# Update: Joerg Jenderek
18149#
18150# Bytes 36 to 39 contain a generic profile file signature of "acsp";
18151# bytes 40 to 43 "may be used to identify the primary platform/operating
18152# system framework for which the profile was created".
18153#
18154#	check and display ICC/ICM color profile
181550	name	color-profile
18156>36	string		acsp
18157# skip ASCII like Cognacspirit.txt by month <= 12
18158>>26	ubeshort	<13
18159# platform/operating system. Only 5 mentioned
18160
18161#
18162# This appears to be what's used for Apple ColorSync profiles.
18163# Instead of adding that, Apple just changed the generic "acsp" entry
18164# to be for "ColorSync ICC Color Profile" rather than "Kodak Color
18165# Management System, ICC Profile".
18166# Yes, it's "APPL", not "AAPL"; see the spec.
18167>>>40	string		APPL		ColorSync
18168
18169# Microsoft ICM color profile
18170>>>40	string		MSFT		Microsoft
18171
18172# Yes, that's a blank after "SGI".
18173>>>40	string		SGI\ 		SGI
18174
18175# XXX - is this what's used for the Sun KCMS or not?  The standard file
18176# uses just "acsp" for that, but Apple's file uses it for "ColorSync",
18177# and there *is* an identified "primary platform" value of SUNW.
18178>>>40	string		SUNW		Sun KCMS
18179
18180# 5th platform
18181>>>40	string		TGNT		Taligent
18182
18183# remaining "l" "e" of "color profile" printed later to avoid error
18184>>>40	string		x 		color profi
18185#>>>40	string		x		(%.4s)
18186!:mime	application/vnd.iccprofile
18187# for "ICM" extension only versions 2.x and for Kodak "CC" 2.0 is found
18188>>>8	ubyte		=2
18189# do not use empty message text to avoid error like
18190# icc, 82: Warning: Current entry does not yet have a description for adding a EXTENSION type
18191# file.exe: could not find any valid magic files!
18192>>>>9	ubyte		!0		\ble
18193!:ext	icc/icm
18194# minor version
18195>>>>9	ubyte		=0		\bl
18196# Kodak colour management system
18197>>>>>4	string		=KCMS		\be
18198!:ext	icc/icm/cc
18199>>>>>4	string		!KCMS		\be
18200!:ext	icc/icm
18201>>>8	ubyte		!2		\ble
18202!:ext	icc
18203# Profile version major.4bit-minor.sub1.sub2 like 4.3.0.0 (04300000h)
18204>>>8	ubyte		x		%u
18205>>>9	ubyte/16	x		\b.%u
18206# reserved and shall be null but 205.205 in umx1220u.icm
18207>>>10	ubyte		>0		\b.%u
18208>>>>11	ubyte		>0		\b.%u
18209# preferred colour management module like appl CCMS KCMS Lino UCCM "Win " "FF  "
18210# skip space like in brmsl08f.icm and null like in brmsl09f.icm, brmsl07f.icm
18211>>>4	string		>\ 		\b, type %.2s
18212>>>>6	string		>\  		\b%.1s
18213>>>>>7	string		>\  		\b%.1s
18214# colour space "XYZ " "Lab " "RGB " CMYK GRAY ...
18215>>>16	string		x		\b, %.3s
18216>>>19	string		>\  		\b%.1s
18217# Profile Connection Space (PCS) field usually "XYZ " or "Lab " but sometimes
18218# null or CMYK like in ISOcoated_v2_to_PSOcoated_v3_DeviceLink.icc
18219>>>20	string		>\0		\b/%.3s
18220>>>>23	string		>\ 		\b%.1s
18221# eleven device classes
18222>>>12	string		x		\b-%.4s device
18223# skip 00001964h in hpf69000.icc or 0h in XRDC50Q.ICM or " ROT" in brmsl05f.icm
18224>>>52	string		>\040
18225# skip "none" model like in "Trinitron Compatible 9300K G2.2.icm"
18226>>>>52	ubelong		!0x6e6f6e65
18227# device manufacturer field like "HP  " "IBM " EPSO
18228>>>>>48	string		x		\b, %.2s
18229>>>>>50	string		>\  		\b%.1s
18230>>>>>51	string		>\  		\b%.1s
18231# model like "ADI " "A265" and skip 20000404h in IS330.icm for RICOH RUSSIAN-SC
18232>>>>>52	string		>\ \  		\b/%.3s
18233>>>>>>55 string		>\  		\b%.1s
18234>>>>>52	string		x		model
18235# creator (often same as manufacture) like HP SONY XROX or null like in A925A.icm
18236>>>80	string		>\0		by %.2s
18237>>>>82	string		>\  		\b%.1s
18238>>>>>83	string		>\  		\b%.1s
18239# profile size
18240>>>0	ubelong		x		\b, %u bytes
18241# skip invalid date 0 like in linearSRGB.icc
18242>>>24	ubequad		!0
18243# datetime dd-mm-yyyy hh:mm:ss
18244>>>>28	ubeshort	x		\b, %u
18245# month <= 12
18246>>>>26	ubeshort	x		\b-%u
18247# year
18248>>>>24	ubeshort	x		\b-%u
18249# do not display midnight time like in CNHP8308.ICC
18250>>>>30	ubequad&0xFFffFFffFFff0000	!0
18251# hour <= 24
18252>>>>>30	ubeshort	x		%u
18253# minutes <= 59
18254>>>>>32	ubeshort	x		\b:%.2u
18255# seconds <= 59
18256>>>>>34	ubeshort	x		\b:%.2u
18257# vendor specific flags like 2 in HPCLJ5.ICM
18258>>>44	ubeshort	>0		\b, %#x vendor flags
18259# profile flags bits 0-2 of least 16 used by ICC
18260#>>>44	ubelong		>0		\b, %#x flags
18261# icEmbeddedProfileTrue
18262>>>44	ubelong		&1		\b, embedded
18263# icEmbeddedProfileFalse
18264#>>>44	ubelong		^1		\b, not embedded
18265# icUseWithEmbeddedDataOnly
18266>>>44	ubelong		&2		\b, dependently
18267# icUseAnywhere
18268#>>>44	ubelong		^2		\b, independently
18269>>>44	ubelong		&4		\b, MCS
18270#>>>44	ubelong		^4		\b, no MCS
18271# vendor specific device attributes 1~srgb.icc
18272# E000D00h~CNB7QEDA.ICM C000A00h~CNB5FCAA.ICM 01040401h~CNB25PE3.ICM
18273>>>56	ubelong		>0		\b, %#x vendor attribute
18274# ICC device attributes bits 0-7 used
18275#>>>60	ubelong		x		\b, %#x attribute
18276# http://www.color.org/icc34.h
18277>>>60	ubelong		&0x01		\b, transparent
18278#>>>60	ubelong		^0x01		\b, reflective
18279>>>60	ubelong		&0x02		\b, matte
18280#>>>60	ubelong		^0x02		\b, glossy
18281>>>60	ubelong		&0x04		\b, negative
18282#>>>60	ubelong		^0x04		\b, positive
18283>>>60	ubelong		&0x08		\b, black&white
18284#>>>60	ubelong		^0x08		\b, colour
18285>>>60	ubelong		&0x10		\b, non-paper
18286#>>>60	ubelong		^0x10		\b, paper
18287>>>60	ubelong		&0x20		\b, non-textured
18288#>>>60	ubelong		^0x20		\b, textured
18289>>>60	ubelong		&0x40		\b, non-isotropic
18290#>>>60	ubelong		^0x40		\b, isotropic
18291>>>60	ubelong		&0x80		\b, self-luminous
18292#>>>60	ubelong		^0x80		\b, non-self-luminous
18293# rendering intent 0-3 but 7AEA5027h in EE051__1.ICM 6CB1BCh in EE061__1.ICM
18294>>>64	ubelong		>3		\b, %#x rendering intent
18295#>>>64	ubelong		=0		\b, perceptual
18296>>>64	ubelong		=1		\b, relative colorimetric
18297>>>64	ubelong		=2		\b, saturation
18298>>>64	ubelong		=3		\b, absolute colorimetric
18299# PCS illuminant (3*s15Fixed16Numbers) often 0000f6d6 00010000 0000d32d
18300>>>71	ubequad		!0xd6000100000000d3	\b, PCS
18301# usually X~0.9642*65536=63189.8112~63190=F6D5h ; but also found
18302# often F6D6 in gt5000r.icm, F6B8 in kodakce.icm, F6CA in RSWOP.icm
18303>>>>68	ubelong			!0x0000f6d5	X=%#x
18304# usually Y=1.0~00010000h but Y=0 in brmsl07f.icm
18305>>>>72	ubelong			!0x00010000	Y=%#x
18306# usually Z~0.8249*65536=54060.6464~54061=D32Dh ; but also found
18307# D2F7 in hp1200c.icm, often D32C in A925A.icm, D309 in RSWOP.icm , D2F8 in kodak_dc.icm
18308>>>>76	ubelong			!0x0000d32d	Z=%#x
18309# Profile ID. MD5 fingerprinting method as defined in Internet RFC 1321.
18310>>>84	ubequad		>0		\b, %#llx MD5
18311# reserved in older versions should be zero but also found CDCDCDCDCDCDCDCD
18312#>>100	ubequad		x		\b %#llx reserved
18313# tag table
18314# 6 <= tags count <= 43
18315#>>>128	ubelong		>43		\b, %u tags
18316>>>128	ubelong		x
18317# shall contain the profileDescriptionTag "desc" , copyrightTag "cprt"
18318# search range = tags count * 12 -8=< maximal tag count * 12 -8= 43 * 12 -8= 508
18319>>>>132	search/508	cprt
18320# but no copyright tag in linearSRGB.icc
18321# beneath /System/Library/Frameworks/WebKit.framework/
18322# Versions/A/Frameworks/WebCore.framework/Versions/A/Resources
18323>>>>132	default		x		\b, no copyright tag
18324# 1st tag
18325#>>>132	string		x		\b, 1st tag %.4s
18326#>>>136	ubelong		x		%#x offset
18327#>>>140	ubelong		x		%#x len
18328# 2nd tag,...
18329# look also for profileDescriptionTag "desc"
18330>>>132	search/508	desc
18331# look further for TextDescriptionType "desc" signature
18332>>>>(&0.L)	string		=desc
18333>>>>>&4		pstring/l	x	"%s"
18334# look alternative for multiLocalizedUnicodeType "mluc" signature like in VideoPAL.icc
18335>>>>(&0.L)	string		=mluc
18336>>>>>&(&8.L)	ubequad		x
18337>>>>>>&4	bestring16	x	'%s'
18338
18339# Any other profile.
18340# XXX - should we use "acsp\0\0\0\0" for "no primary platform" profiles,
18341# and use "acsp" for everything else and dump the "primary platform"
18342# string in those cases?
1834336	string		acsp
18344>0	use		color-profile
18345
18346
18347
18348#------------------------------------------------------------------------------
18349# $File: iff,v 1.18 2022/03/21 19:57:18 christos Exp $
18350# iff:	file(1) magic for Interchange File Format (see also "audio" & "images")
18351#
18352# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic
18353# Arts for file interchange.  It has also been used by Apple, SGI, and
18354# especially Commodore-Amiga.
18355#
18356# IFF files begin with an 8 byte FORM header, followed by a 4 character
18357# FORM type, which is followed by the first chunk in the FORM.
18358
183590	string		FORM		IFF data
18360#>4	belong		x		\b, FORM is %d bytes long
18361# audio formats
18362>8	string		AIFF		\b, AIFF audio
18363!:mime	audio/x-aiff
18364>8	string		AIFC		\b, AIFF-C compressed audio
18365!:mime	audio/x-aiff
18366>8	string		8SVX		\b, 8SVX 8-bit sampled sound voice
18367!:mime	audio/x-aiff
18368>8	string		16SV		\b, 16SV 16-bit sampled sound voice
18369>8	string		SAMP		\b, SAMP sampled audio
18370>8	string		MAUD		\b, MAUD MacroSystem audio
18371>8	string		SMUS		\b, SMUS simple music
18372>8	string		CMUS		\b, CMUS complex music
18373# image formats
18374>8	string		ILBMBMHD	\b, ILBM interleaved image
18375>>20	beshort		x		\b, %d x
18376>>22	beshort		x		%d
18377>8	string		RGBN		\b, RGBN 12-bit RGB image
18378>8	string		RGB8		\b, RGB8 24-bit RGB image
18379>8	string		DEEP		\b, DEEP TVPaint/XiPaint image
18380>8	string		DR2D		\b, DR2D 2-D object
18381>8	string		TDDD		\b, TDDD 3-D rendering
18382>8	string		LWOB		\b, LWOB 3-D object
18383>8	string		LWO2		\b, LWO2 3-D object, v2
18384>8	string		LWLO		\b, LWLO 3-D layered object
18385>8	string		REAL		\b, REAL Real3D rendering
18386>8	string		MC4D		\b, MC4D MaxonCinema4D rendering
18387>8	string		ANIM		\b, ANIM animation
18388>8	string		YAFA		\b, YAFA animation
18389>8	string		SSA\ 		\b, SSA super smooth animation
18390>8	string		FANT		\b, Fantavision animation
18391>8	string		ACBM		\b, ACBM continuous image
18392>8	string		FAXX		\b, FAXX fax image
18393>8	string		STFX		\b, ST-Fax image
18394>8	string		IMAGIHDR	\b, CD-i image
18395# other formats
18396>8	string		FTXT		\b, FTXT formatted text
18397>8	string		CTLG		\b, CTLG message catalog
18398>8	string		PREF		\b, PREF preferences
18399>8	string		DTYP		\b, DTYP datatype description
18400>8	string		PTCH		\b, PTCH binary patch
18401>8	string		AMFF		\b, AMFF AmigaMetaFile format
18402>8	string		WZRD		\b, WZRD StormWIZARD resource
18403>8	string		DOC\040		\b, DOC desktop publishing document
18404>8	string		SWRT		\b, SWRT Final Copy/Writer document
18405>8	string		WORD		\b, ProWrite document
18406>8	string 		WTXT		\b, WTXT Wordworth document
18407>8	string 		WOWO		\b, WOWO Wordworth document
18408>8	string		WVQA 		\b, Westwood Studios VQA Multimedia,
18409>>24	leshort		x		%d video frames,
18410>>26	leshort		x		%d x
18411>>28	leshort		x		%d
18412>8	string		MOVE		\b, Wing Commander III Video
18413>>12	string		_PC_		\b, PC version
18414>>12	string		3DO_		\b, 3DO version
18415
18416# These go at the end of the iff rules
18417#
18418# David Griffith <dave@661.org>
18419# I don't see why these might collide with anything else.
18420#
18421# Interactive Fiction related formats
18422#
18423>8	string		IFRS		\b, Blorb Interactive Fiction
18424>>24	string		Exec		with executable chunk
18425>8	string          IFZS		\b, Z-machine or Glulx saved game file (Quetzal)
18426!:mime	application/x-blorb
18427
18428#------------------------------------------------------------------------------
18429# $File: images,v 1.227 2022/09/11 20:58:52 christos Exp $
18430# images:  file(1) magic for image formats (see also "iff", and "c-lang" for
18431# XPM bitmaps)
18432#
18433# originally from jef@helios.ee.lbl.gov (Jef Poskanzer),
18434# additions by janl@ifi.uio.no as well as others. Jan also suggested
18435# merging several one- and two-line files into here.
18436#
18437# little magic: PCX (first byte is 0x0a)
18438
18439# Targa - matches `povray', `ppmtotga' and `xv' outputs
18440# by Philippe De Muyter <phdm@macqel.be>
18441# URL: http://justsolve.archiveteam.org/wiki/TGA
18442# Reference: http://www.dca.fee.unicamp.br/~martino/disciplinas/ea978/tgaffs.pdf
18443# Update: Joerg Jenderek
18444# at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11
18445#	,32 or 33 (both not observed)
18446# at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise
18447#	or theoretically 2-128 reserved for use by Truevision or 128-255 may be used for developer applications
18448# at 3, leshort Index is 0 for povray, ppmtotga and xv outputs
18449# `xv' recognizes only a subset of the following (RGB with pixelsize = 24)
18450# `tgatoppm' recognizes a superset (Index may be anything)
18451#
18452# test of Color Map Type 0~no 1~color map
18453# and Image Type 1 2 3 9 10 11 32 33
18454# and Color Map Entry Size 0 15 16 24 32
184550	ubequad&0x00FeC400000000C0	0
18456# Conflict with MPEG sequences.
18457!:strength -40
18458# Prevent conflicts with CRI ADX.
18459#>(2.S-2) belong	!0x28632943
18460# above line does not work for rgb32_top_left_rle.tga
18461# skip some MPEG sequence *.vob and some CRI ADX audio with improbable interleave bits
18462>17	ubyte&0xC0		!0xC0
18463# skip more garbage like *.iso by looking for positive image type
18464>>2	ubyte			>0
18465# skip some compiled terminfo like xterm+tmux by looking for image type less equal 33
18466>>>2	ubyte			<34
18467# skip some MPEG sequence *.vob HV001T01.EVO winnicki.mpg with unacceptable alpha channel depth 11
18468>>>>17	ubyte&0x0F		!11
18469# skip arches.3200 , Finder.Root , Slp.1 by looking for low pixel depth 1 8 15 16 24 32
18470>>>>>16	ubyte			1
18471>>>>>>0		use		tga-image
18472>>>>>16	ubyte			8
18473>>>>>>0		use		tga-image
18474>>>>>16	ubyte			15
18475>>>>>>0		use		tga-image
18476>>>>>16	ubyte			16
18477>>>>>>0		use		tga-image
18478>>>>>16	ubyte			24
18479>>>>>>0		use		tga-image
18480>>>>>16	ubyte			32
18481>>>>>>0		use		tga-image
18482#	display tga bitmap image information
184830	name				tga-image
18484>2	ubyte		<34		Targa image data
18485!:mime	image/x-tga
18486!:apple	????TPIC
18487# normal extension .tga but some Truevision products used others:
18488# tpic (Apple),icb (Image Capture Board),vda (Video Display Adapter),vst (NuVista),win (UNSURE about that)
18489!:ext	tga/tpic/icb/vda/vst
18490# image type 1 2 3 9 10 11 32 33
18491>2	ubyte&0xF7	1		- Map
18492>2	ubyte&0xF7	2		- RGB
18493# alpha channel
18494>>17	ubyte&0x0F	>0		\bA
18495>2	ubyte&0xF7	3		- Mono
18496# type not found, but by http://www.fileformat.info/format/tga/corion.htm
18497# Compressed color-mapped data, using Huffman, Delta, and runlength encoding
18498>2	ubyte		32		- Color
18499# Compressed color-mapped data, using Huffman, Delta, and RLE. 4-pass quadtree- type process
18500>2	ubyte		33		- Color
18501# Color Map Type 0~no 1~color map
18502>1	ubyte		1		(
18503# first color map entry, 0 normal
18504>>3	uleshort	>0		\b%d-
18505# color map length 0 2 1dh 3bh d9h 100h
18506>>5	uleshort	x		\b%d)
18507# 8~run length encoding bit
18508>2	ubyte&0x08	8		- RLE
18509# gimp can create big pictures!
18510>12	uleshort	>0		%d x
18511>12	uleshort	=0		65536 x
18512# image height. 0 interpreted as 65536
18513>14	uleshort	>0		%d
18514>14	uleshort	=0		65536
18515# Image Pixel depth 1 8 15 16 24 32
18516>16	ubyte		x		x %d
18517# X origin of image. 0 normal
18518>8	uleshort	>0		+%d
18519# Y origin of image. 0 normal; positive for top
18520>10	uleshort	>0		+%d
18521# Image descriptor: bits 3-0 give the alpha channel depth, bits 5-4 give direction
18522# alpha depth like: 1 8
18523>17	ubyte&0x0F	>0		- %d-bit alpha
18524# bits 5-4 give direction. normal bottom left
18525>17	ubyte		&0x20		- top
18526#>17	ubyte		^0x20		- bottom
18527>17	ubyte		&0x10		- right
18528#>17	ubyte		^0x10		- left
18529# some info say other bits 6-7 should be zero
18530# but data storage interleave by http://www.fileformat.info/format/tga/corion.htm
18531# 00 - no interleave;01 - even/odd interleave; 10 - four way interleave; 11 - reserved
18532#>17	ubyte&0xC0	0x00		- no interleave
18533>17	ubyte&0xC0	0x40		- interleave
18534>17	ubyte&0xC0	0x80		- four way interleave
18535>17	ubyte&0xC0	0xC0		- reserved
18536# positive length implies identification field
18537>0	ubyte		>0
18538>>18	string		x		"%s"
18539# last 18 bytes of newer tga file footer signature
18540>18	search/4261301/s	TRUEVISION-XFILE.\0
18541# extension area offset if not 0
18542>>&-8		ulelong			>0
18543# length of the extension area. normal 495 for version 2.0
18544>>>(&-4.l)	uleshort		0x01EF
18545# AuthorName[41]
18546>>>>&0		string			>\0		- author "%-.40s"
18547# Comment[324]=4 * 80 null terminated
18548>>>>&41		string			>\0		- comment "%-.80s"
18549# date
18550>>>>&365	ubequad&0xffffFFFFffff0000	!0
18551# Day
18552>>>>>&-6	uleshort		x		%d
18553# Month
18554>>>>>&-8	uleshort		x		\b-%d
18555# Year
18556>>>>>&-4	uleshort		x		\b-%d
18557# time
18558>>>>&371	ubequad&0xffffFFFFffff0000	!0
18559# hour
18560>>>>>&-8	uleshort		x		%d
18561# minutes
18562>>>>>&-6	uleshort		x		\b:%.2d
18563# second
18564>>>>>&-4	uleshort		x		\b:%.2d
18565# JobName[41]
18566>>>>&377	string			>\0		- job "%-.40s"
18567# JobHour Jobminute Jobsecond
18568>>>>&418	ubequad&0xffffFFFFffff0000	!0
18569>>>>>&-8	uleshort		x		%d
18570>>>>>&-6	uleshort		x		\b:%.2d
18571>>>>>&-4	uleshort		x		\b:%.2d
18572# SoftwareId[41]
18573>>>>&424	string			>\0		- %-.40s
18574# SoftwareVersionNumber
18575>>>>&424	ubyte			>0
18576>>>>>&40	uleshort/100		x		%d
18577>>>>>&40	uleshort%100		x		\b.%d
18578# VersionLetter
18579>>>>>&42	ubyte			>0x20		\b%c
18580# KeyColor
18581>>>>&468	ulelong			>0		- keycolor %#8.8x
18582# Denominator of Pixel ratio. 0~no pixel aspect
18583>>>>&474	uleshort		>0
18584# Numerator
18585>>>>>&-4	uleshort		>0		- aspect %d
18586>>>>>&-2	uleshort		x		\b/%d
18587# Denominator of Gamma ratio. 0~no Gamma value
18588>>>>&478	uleshort		>0
18589# Numerator
18590>>>>>&-4	uleshort		>0		- gamma %d
18591>>>>>&-2	uleshort		x		\b/%d
18592# ColorOffset
18593#>>>>&480	ulelong			x		- col offset %#8.8x
18594# StampOffset
18595#>>>>&484	ulelong			x		- stamp offset %#8.8x
18596# ScanOffset
18597#>>>>&488	ulelong			x		- scan offset %#8.8x
18598# AttributesType
18599#>>>>&492	ubyte			x		- Attributes %#x
18600## EndOfTGA
18601
18602# PBMPLUS images
18603# URL: 		https://en.wikipedia.org/wiki/Netpbm
18604# The next byte following the magic is always whitespace.
18605# adding 65 to strength so that Netpbm images comes before "x86 boot sector" or
18606# "DOS/MBR boot sector" identified by ./filesystems
186070	name		netpbm
18608>3	regex/s		=[0-9]{1,50}[\040\t\f\r\n]+[0-9]{1,50}	Netpbm image data
18609>>&0	regex		=[0-9]{1,50} 			\b, size = %s x
18610>>>&0	regex		=[0-9]{1,50}			\b %s
18611
186120	search/1	P1
18613# test for whitespace after 2 byte magic
18614>2	regex/2		[\040\t\f\r\n]
18615# skip DROID x-fmt-164-signature-id-583.pbm with ten 0 digits
18616>>3	string		!000000000
18617>>>0	use		netpbm
18618>>>0	string		x	\b, bitmap
18619!:strength + 65
18620!:mime	image/x-portable-bitmap
18621!:ext	pbm
18622# check for character # starting a comment line
18623>>>3	ubyte		=0x23
18624>>>>4	string		x	%s
18625
186260	search/1	P2
18627>0	regex/4		P2[\040\t\f\r\n]
18628>>0	use		netpbm
18629>>0	string		x	\b, greymap
18630!:strength + 65
18631# american spelling gray
18632!:mime	image/x-portable-graymap
18633!:ext	pgm
18634
186350	search/1	P3
18636>0	regex/4		P3[\040\t\f\r\n]
18637>>0	use		netpbm
18638>>0	string		x	\b, pixmap
18639!:strength + 65
18640!:mime	image/x-portable-pixmap
18641!:ext	ppm
18642
186430	string		P4
18644>0	regex/4		P4[\040\t\f\r\n]
18645>>0	use		netpbm
18646>>0	string		x	\b, rawbits, bitmap
18647!:strength + 65
18648!:mime	image/x-portable-bitmap
18649!:ext	pbm
18650
186510	string		P5
18652>0	regex/4		P5[\040\t\f\r\n]
18653>>0	use		netpbm
18654>>0	string		x	\b, rawbits, greymap
18655!:strength + 65
18656!:mime	image/x-portable-greymap
18657!:ext	pgm
18658
186590	string		P6
18660>0	regex/4		P6[\040\t\f\r\n]
18661>>0	use		netpbm
18662>>0	string		x	\b, rawbits, pixmap
18663!:strength + 65
18664!:mime	image/x-portable-pixmap
18665!:ext	ppm/pnm
18666
18667# URL: 		https://en.wikipedia.org/wiki/Netpbm#PAM_graphics_format
18668# Reference:	http://fileformats.archiveteam.org/wiki/Portable_Arbitrary_Map
18669# Update:	Joerg Jenderek
186700	string		P7
18671# skip DROID fmt-405-signature-id-589.pam by looking for character like New Line
18672>2	ubyte		!0xAB
18673#>2	ubyte		=0x0A
18674>>3	search/256/b	WIDTH		Netpbm PAM image file, size =
18675!:mime	image/x-portable-arbitrarymap
18676!:ext	pam
18677!:strength + 65
18678>>>&1	string		x		%s
18679>>>3	search/256/b	HEIGHT		x
18680>>>>&1	string		x		%s
18681# at offset 2 a New Line character (0xA) should appear
18682>>>2	ubyte		!0x0A		\b, %#x at offset 2 instead new line
18683
18684# From: bryanh@giraffe-data.com (Bryan Henderson)
186850	string		\117\072	Solitaire Image Recorder format
18686>4	string		\013		MGI Type 11
18687>4	string		\021		MGI Type 17
186880	string		.MDA		MicroDesign data
18689>21	ubyte		48		version 2
18690>21	ubyte		51		version 3
186910	string		.MDP		MicroDesign page data
18692>21	ubyte		48		version 2
18693>21	ubyte		51		version 3
18694
18695# NIFF (Navy Interchange File Format, a modification of TIFF) images
18696# [GRR:  this *must* go before TIFF]
186970	string		IIN1		NIFF image data
18698!:mime	image/x-niff
18699
18700# Canon RAW version 1 (CRW) files are a type of Canon Image File Format
18701# (CIFF) file. These are apparently all little-endian.
18702# From: Adam Buchbinder <adam.buchbinder@gmail.com>
18703# URL: https://www.sno.phy.queensu.ca/~phil/exiftool/canon_raw.html
187040	string		II\x1a\0\0\0HEAPCCDR	Canon CIFF raw image data
18705!:mime	image/x-canon-crw
18706>16	uleshort	x	\b, version %d.
18707>14	uleshort	x	\b%d
18708
18709# Canon RAW version 2 (CR2) files are a kind of TIFF with an extra magic
18710# number. Put this above the TIFF test to make sure we detect them.
18711# These are apparently all little-endian.
18712# From: Adam Buchbinder <adam.buchbinder@gmail.com>
18713# URL: https://libopenraw.freedesktop.org/wiki/Canon_CR2
187140	string		II\x2a\0\x10\0\0\0CR	Canon CR2 raw image data
18715!:mime	image/x-canon-cr2
18716!:strength +80
18717>10	ubyte		x	\b, version %d.
18718>11	ubyte		x	\b%d
18719
18720# Fujifilm RAF RAW image files with embedded JPEG data and compressed
18721# or uncompressed CFA RAW data. Byte order: Big Endian.
18722# URL: https://libopenraw.freedesktop.org/formats/raf/
18723# Useful info from http://fileformats.archiveteam.org/wiki/Fujifilm_RAF.
18724# File extension: RAF
18725# Works for both the FinePix S2 Pro and the X-T3. Anybody have some more Fuji
18726# raw samples available?
18727# -- David Dyer-Bennet <dd-b@dd-b.net> 9-Sep-2021
187280	string		FUJIFILMCCD-RAW		Fujifilm RAF raw image data
18729!:mime  image/x-fuji-raf
18730!:ext	raf
18731>0x10	string		x			\b, format version %4.4s
18732>0x1C	string		x			\b, camera %s
18733
18734# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com)
18735# The second word of TIFF files is the TIFF version number, 42, which has
18736# never changed.  The TIFF specification recommends testing for it.
187370	string		MM\x00\x2a	TIFF image data, big-endian
18738!:strength +70
18739!:mime	image/tiff
18740!:ext	tif,tiff
18741>(4.L)	use		\^tiff_ifd
187420	string		II\x2a\x00	TIFF image data, little-endian
18743!:mime	image/tiff
18744!:strength +70
18745!:ext	tif,tiff
18746>(4.l)	use		tiff_ifd
18747
187480	name		tiff_ifd
18749>0	uleshort	x		\b, direntries=%d
18750>2	use		tiff_entry
18751
187520	name		tiff_entry
18753# NewSubFileType
18754>0	uleshort	0xfe
18755>>12	use		tiff_entry
18756>0	uleshort	0x100
18757>>4	ulelong		1
18758>>>12	use		tiff_entry
18759>>>8	uleshort	x		\b, width=%d
18760>0	uleshort	0x101
18761>>4	ulelong		1
18762>>>8	uleshort	x		\b, height=%d
18763>>>12	use		tiff_entry
18764>0	uleshort	0x102
18765>>8	uleshort	x		\b, bps=%d
18766>>12	use		tiff_entry
18767>0	uleshort	0x103
18768>>4	ulelong		1		\b, compression=
18769>>>8	uleshort	1		\bnone
18770>>>8	uleshort	2		\bhuffman
18771>>>8	uleshort	3		\bbi-level group 3
18772>>>8	uleshort	4		\bbi-level group 4
18773>>>8	uleshort	5		\bLZW
18774>>>8	uleshort	6		\bJPEG (old)
18775>>>8	uleshort	7		\bJPEG
18776>>>8	uleshort	8		\bdeflate
18777>>>8	uleshort	9		\bJBIG, ITU-T T.85
18778>>>8	uleshort	0xa		\bJBIG, ITU-T T.43
18779>>>8	uleshort	0x7ffe		\bNeXT RLE 2-bit
18780>>>8	uleshort	0x8005		\bPackBits (Macintosh RLE)
18781>>>8	uleshort	0x8029		\bThunderscan RLE
18782>>>8	uleshort	0x807f		\bRasterPadding (CT or MP)
18783>>>8	uleshort	0x8080		\bRLE (Line Work)
18784>>>8	uleshort	0x8081		\bRLE (High-Res Cont-Tone)
18785>>>8	uleshort	0x8082		\bRLE (Binary Line Work)
18786>>>8	uleshort	0x80b2		\bDeflate (PKZIP)
18787>>>8	uleshort	0x80b3		\bKodak DCS
18788>>>8	uleshort	0x8765		\bJBIG
18789>>>8	uleshort	0x8798		\bJPEG2000
18790>>>8	uleshort	0x8799		\bNikon NEF Compressed
18791>>>8	default		x
18792>>>>8	uleshort	x		\b(unknown %#x)
18793>>>12	use		tiff_entry
18794>0	uleshort	0x106		\b, PhotometricInterpretation=
18795>>8	clear		x
18796>>8	uleshort	0		\bWhiteIsZero
18797>>8	uleshort	1		\bBlackIsZero
18798>>8	uleshort	2		\bRGB
18799>>8	uleshort	3		\bRGB Palette
18800>>8	uleshort	4		\bTransparency Mask
18801>>8	uleshort	5		\bCMYK
18802>>8	uleshort	6		\bYCbCr
18803>>8	uleshort	8		\bCIELab
18804>>8	default		x
18805>>>8	uleshort	x		\b(unknown=%#x)
18806>>12	use		tiff_entry
18807# FillOrder
18808>0	uleshort	0x10a
18809>>4	ulelong		1
18810>>>12	use		tiff_entry
18811# DocumentName
18812>0	uleshort	0x10d
18813>>(8.l)	string		x		\b, name=%s
18814>>>12	use		tiff_entry
18815# ImageDescription
18816>0	uleshort	0x10e
18817>>(8.l)	string		x		\b, description=%s
18818>>>12	use		tiff_entry
18819# Make
18820>0	uleshort	0x10f
18821>>(8.l)	string		x		\b, manufacturer=%s
18822>>>12	use		tiff_entry
18823# Model
18824>0	uleshort	0x110
18825>>(8.l)	string		x		\b, model=%s
18826>>>12	use		tiff_entry
18827# StripOffsets
18828>0	uleshort	0x111
18829>>12	use		tiff_entry
18830# Orientation
18831>0	uleshort	0x112		\b, orientation=
18832>>8	uleshort	1		\bupper-left
18833>>8	uleshort	3		\blower-right
18834>>8	uleshort	6		\bupper-right
18835>>8	uleshort	8		\blower-left
18836>>8	uleshort	9		\bundefined
18837>>8	default		x
18838>>>8	uleshort	x		\b[*%d*]
18839>>12	use		tiff_entry
18840# XResolution
18841>0	uleshort	0x11a
18842>>8	ulelong		x		\b, xresolution=%d
18843>>12	use		tiff_entry
18844# YResolution
18845>0	uleshort	0x11b
18846>>8	ulelong		x		\b, yresolution=%d
18847>>12	use		tiff_entry
18848# ResolutionUnit
18849>0	uleshort	0x128
18850>>8	uleshort	x		\b, resolutionunit=%d
18851>>12	use		tiff_entry
18852# Software
18853>0	uleshort	0x131
18854>>(8.l)	string		x		\b, software=%s
18855>>12	use		tiff_entry
18856# Datetime
18857>0	uleshort	0x132
18858>>(8.l)	string		x		\b, datetime=%s
18859>>12	use		tiff_entry
18860# HostComputer
18861>0	uleshort	0x13c
18862>>(8.l)	string		x		\b, hostcomputer=%s
18863>>12	use		tiff_entry
18864# WhitePoint
18865>0	uleshort	0x13e
18866>>12	use		tiff_entry
18867# PrimaryChromaticities
18868>0	uleshort	0x13f
18869>>12	use		tiff_entry
18870# YCbCrCoefficients
18871>0	uleshort	0x211
18872>>12	use		tiff_entry
18873# YCbCrPositioning
18874>0	uleshort	0x213
18875>>12	use		tiff_entry
18876# ReferenceBlackWhite
18877>0	uleshort	0x214
18878>>12	use		tiff_entry
18879# Copyright
18880>0	uleshort	0x8298
18881>>(8.l)	string		x		\b, copyright=%s
18882>>12	use		tiff_entry
18883# ExifOffset
18884>0	uleshort	0x8769
18885>>12	use		tiff_entry
18886# GPS IFD
18887>0	uleshort	0x8825		\b, GPS-Data
18888>>12	use		tiff_entry
18889
18890#>0	uleshort	x		\b, unknown=%#x
18891#>>12	use		tiff_entry
18892
188930	string		MM\x00\x2b	Big TIFF image data, big-endian
18894!:mime	image/tiff
188950	string		II\x2b\x00	Big TIFF image data, little-endian
18896!:mime	image/tiff
18897
18898# PNG [Portable Network Graphics, or "PNG's Not GIF"] images
18899# (Greg Roelofs, newt@uchicago.edu)
18900# (Albert Cahalan, acahalan@cs.uml.edu)
18901#
18902# 137 P N G \r \n ^Z \n [4-byte length] I H D R [HEAD data] [HEAD crc] ...
18903#
18904
18905# IHDR parser
189060	name		png-ihdr
18907>0	ubelong		x		\b, %d x
18908>4	ubelong		x		%d,
18909>8	ubyte		x		%d-bit
18910>9	ubyte		0		grayscale,
18911>9	ubyte		2		\b/color RGB,
18912>9	ubyte		3		colormap,
18913>9	ubyte		4		gray+alpha,
18914>9	ubyte		6		\b/color RGBA,
18915#>10	ubyte		0		deflate/32K,
18916>12	ubyte		0		non-interlaced
18917>12	ubyte		1		interlaced
18918
18919# Standard PNG image.
189200	string		\x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x0DIHDR	PNG image data
18921!:mime	image/png
18922!:ext   png
18923!:strength +10
18924>16	use		png-ihdr
18925
18926# Apple CgBI PNG image.
189270	string		\x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x04CgBI
18928>24	string  	\x00\x00\x00\x0DIHDR	PNG image data (CgBI)
18929!:mime	image/png
18930!:ext   png
18931!:strength +10
18932>>32	use		png-ihdr
18933
18934# possible GIF replacements; none yet released!
18935# (Greg Roelofs, newt@uchicago.edu)
18936#
18937# GRR 950115:  this was mine ("Zip GIF"):
189380	string		GIF94z		ZIF image (GIF+deflate alpha)
18939!:mime	image/x-unknown
18940#
18941# GRR 950115:  this is Jeremy Wohl's Free Graphics Format (better):
18942#
189430	string		FGF95a		FGF image (GIF+deflate beta)
18944!:mime	image/x-unknown
18945#
18946# GRR 950115:  this is Thomas Boutell's Portable Bitmap Format proposal
18947# (best; not yet implemented):
18948#
189490	string		PBF		PBF image (deflate compression)
18950!:mime	image/x-unknown
18951
18952# GIF
18953# Strength set up to beat 0x55AA DOS/MBR signature word lookups (+65)
189540	string		GIF8		GIF image data
18955!:strength +80
18956!:mime	image/gif
18957!:apple	8BIMGIFf
18958!:ext	gif
18959>4	string		7a		\b, version 8%s,
18960>4	string		9a		\b, version 8%s,
18961>6	uleshort	>0		%d x
18962>8	uleshort	>0		%d
18963#>10	ubyte		&0x80		color mapped,
18964#>10	ubyte&0x07	=0x00		2 colors
18965#>10	ubyte&0x07	=0x01		4 colors
18966#>10	ubyte&0x07	=0x02		8 colors
18967#>10	ubyte&0x07	=0x03		16 colors
18968#>10	ubyte&0x07	=0x04		32 colors
18969#>10	ubyte&0x07	=0x05		64 colors
18970#>10	ubyte&0x07	=0x06		128 colors
18971#>10	ubyte&0x07	=0x07		256 colors
18972
18973# ITC (CMU WM) raster files.  It is essentially a byte-reversed Sun raster,
18974# 1 plane, no encoding.
189750	string		\361\0\100\273	CMU window manager raster image data
18976>4	ulelong		>0		%d x
18977>8	ulelong		>0		%d,
18978>12	ulelong		>0		%d-bit
18979
18980# Magick Image File Format
18981# URL:		https://imagemagick.org/script/miff.php
18982# Reference:	http://fileformats.archiveteam.org/wiki/MIFF
18983# Update:	Joerg Jenderek
18984# http://www.nationalarchives.gov.uk/pronom/fmt/930
189850	search/256/bc	id=imagemagick
18986# skip bad ASCII text by following new line~0x0A or space~0x20 character
18987#>&0	ubyte		x		\b, next character %#x
18988# called by TriD ImageMagick Machine independent File Format bitmap
18989>&0	ubyte&0xD5	0		MIFF image data
18990# https://reposcope.com/mimetype/image/miff
18991#!:mime	image/miff
18992!:mime	image/x-miff
18993!:ext	miff/mif
18994# examples with standard file(1) magic
18995#>>0	string		=id=ImageMagick	with standard magic
18996# examples with unusual file(1) magic like
18997>>0	string		!id=ImageMagick	starting with
18998# start with comment (brace) like http://samples.fileformat.info/.../AQUARIUM.MIF
18999>>>0	ubyte		=0x7b		comment
19000# skip second character which is often a newline and show comment
19001>>>>2	string		x		"%s"
19002# does not start with comment, probably letters with other case like Id=ImageMagick
19003# ImageMagick-7.0.9-2/Magick++/demo/smile_anim.miff
19004>>>0	ubyte		!0x7b
19005>>>>0	string		>\0		'%-.14s'
19006# URL:		https://imagemagick.org/
19007# Reference:	https://imagemagick.org/script/magick-vector-graphics.php
19008# From:		Joerg Jenderek
19009# Note:		all white-spaces between commands are ignored
190100	string		push
19011# skip some white spaces
19012>5	search/3	graphic-context	ImageMagick Vector Graphic
19013# TODO: look for dangerous commands like CVE-2016-3715
19014#!:mime	text/plain
19015!:mime	image/x-mvg
19016!:ext	mvg
19017
19018# Artisan
190190	long		1123028772	Artisan image data
19020>4	long		1		\b, rectangular 24-bit
19021>4	long		2		\b, rectangular 8-bit with colormap
19022>4	long		3		\b, rectangular 32-bit (24-bit with matte)
19023
19024# FIG (Facility for Interactive Generation of figures), an object-based format
19025# URL: 		http://fileformats.archiveteam.org/wiki/Fig
19026#		https://en.wikipedia.org/wiki/Xfig
19027# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/f/fig.trid.xml
19028# https://web.archive.org/web/20070920204655/http://epb.lbl.gov/xfig/fig-format.html
19029# Update:	Joerg Jenderek
19030# Note:		called "FIG vector drawing" by TrID,
19031#		4 byte magic is assumed to be always at offset 0 and
19032#		verified by `fig2mpdf -v bootloader.fig && file bootloader.pdf`
19033#0	search/1/tb	#FIG		FIG image text
19034# GRR: with --keep-going option the line above gives duplicate messages
190350	search/1/ts	#FIG
19036>&0	use		image-xfig
19037# binary data variant with non ASCII text characters like Control-A or �C in thermostat.fig
190380	search/1/bs	#FIG
19039>&0	use		image-xfig
19040#	display XFIG image describing text, mime type, file name extension and version
190410	name		image-xfig
19042>8	ubyte		x		FIG image text
19043#!:mime	text/plain
19044# https://reposcope.com/mimetype/image/x-xfig
19045!:mime	image/x-xfig
19046!:ext	fig
19047# version string like: 1.4 2.1 3.1 3.2
19048>5	string		x		\b, version %.3s
19049# some times after version text like: "Produced by xfig version 3.2.5-alpha5"
19050>8	ubyte		>0x0D
19051>>8	string		x		"%s"
19052# should be point character (2Eh) of version string according to TrID
19053#>6	ubyte		!0x2E		\b, at 6 %#x
19054# caret character (23h) at the beginning in most or probaly all exanples
19055#>0	ubyte		!0x23		\b, starting with character %#x
19056# URL: 		http://fileformats.archiveteam.org/wiki/DeskMate_Draw
19057#		http://en.wikipedia.org/wiki/Deskmate
19058# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/d/dm-fig.trid.xml
19059# From:		Joerg Jenderek
19060# Note:		called "DeskMate Draw drawing" by TrID
190610	string		\x14FIG		DeskMate Drawing
19062#!:mime	application/octet-stream
19063!:mime	image/x-deskmate-fig
19064!:ext	fig
19065# TODO:
19066#	"Cabri 3D Figure"	by TrID fig-cabri.trid.xml
19067#	"Playmation Figure"	by TrID fig-playmation.trid.xml
19068
19069# PHIGS
190700	string		ARF_BEGARF		PHIGS clear text archive
190710	string		@(#)SunPHIGS		SunPHIGS
19072# version number follows, in the form m.n
19073>40	string		SunBin			binary
19074>32	string		archive			archive
19075
19076# GKS (Graphics Kernel System)
190770	string		GKSM		GKS Metafile
19078>24	string		SunGKS		\b, SunGKS
19079
19080# CGM image files
190810	string		BEGMF		clear text Computer Graphics Metafile
19082
19083# MGR bitmaps  (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de)
190840	string	yz	MGR bitmap, modern format, 8-bit aligned
190850	string	zz	MGR bitmap, old format, 1-bit deep, 16-bit aligned
190860	string	xz	MGR bitmap, old format, 1-bit deep, 32-bit aligned
190870	string	yx	MGR bitmap, modern format, squeezed
19088
19089# Fuzzy Bitmap (FBM) images
190900	string		%bitmap\0	FBM image data
19091>30	long		0x31		\b, mono
19092>30	long		0x33		\b, color
19093
19094# facsimile data
190951	string		PC\ Research,\ Inc	group 3 fax data
19096>29	ubyte		0		\b, normal resolution (204x98 DPI)
19097>29	ubyte		1		\b, fine resolution (204x196 DPI)
19098# From: Herbert Rosmanith <herp@wildsau.idv.uni.linz.at>
190990	string		Sfff		structured fax file
19100
19101# From: Joerg Jenderek <joerg.jen.der.ek@gmx.net>
19102# URL:	http://fileformats.archiveteam.org/wiki/Award_BIOS_logo
19103# Note:	verified by XnView command `nconvert -fullinfo *.EPA`
191040	string		\x11\x06	Award BIOS Logo, 136 x 84
19105!:mime	image/x-award-bioslogo
19106!:ext	epa
191070	string		\x11\x09	Award BIOS Logo, 136 x 126
19108!:mime	image/x-award-bioslogo
19109!:ext	epa
19110# https://telparia.com/fileFormatSamples/image/epa/IO.EPA
19111# Note:	by bitmap-awbm-v1x1009.trid.xml called "Award BIOS logo bitmap (128x126) (v1)"
19112#	verified by RECOIL `recoil2png -o tmp.png IO.EPA; file tmp.png`
191130	string		\x10\x09	Award BIOS Logo, 128 x 126
19114!:mime	image/x-award-bioslogo
19115!:ext	epa
19116#0	string		\x07\x1f	BIOS Logo corrupted?
19117# http://www.blackfiveservices.co.uk/awbmtools.shtml
19118# http://biosgfx.narod.ru/v3/
19119# http://biosgfx.narod.ru/abr-2/
191200	string		AWBM
19121# Note:    by bitmap-awbm.trid.xml called "Award BIOS logo bitmap (v2)"
19122>4	uleshort	<1981		Award BIOS Logo, version 2
19123#>4	uleshort	<1981		Award BIOS bitmap
19124!:mime	image/x-award-bioslogo2
19125#!:mime	image/x-award-bmp
19126!:ext	epa/bmp
19127# image width is a multiple of 4
19128>>4	uleshort&0x0003	0
19129>>>4	uleshort	x		\b, %d
19130>>>6	uleshort	x		x %d
19131>>4	uleshort&0x0003	>0		\b,
19132>>>4	uleshort&0x0003	=1
19133>>>>4	uleshort	x		%d+3
19134>>>4	uleshort&0x0003	=2
19135>>>>4	uleshort	x		%d+2
19136>>>4	uleshort&0x0003	=3
19137>>>>4	uleshort	x		%d+1
19138>>>6	uleshort	x		x %d
19139# at offset 8 starts imagedata followed by "RGB " marker
19140
19141# PC bitmaps (OS/2, Windows BMP files)  (Greg Roelofs, newt@uchicago.edu)
19142# https://en.wikipedia.org/wiki/BMP_file_format#DIB_header_.\
19143# 28bitmap_information_header.29
19144# Note:	variant starting direct with DIB header see
19145#	http://fileformats.archiveteam.org/wiki/BMP
19146#	verified by ImageMagick version 6.8.9-8 command `identify *.dib`
191470	uleshort		40
19148# skip bad samples like GAME by looking for valid number of color planes
19149>12	uleshort	1		Device independent bitmap graphic
19150!:mime	image/x-ms-bmp
19151!:apple	????BMPp
19152!:ext	dib
19153>>4	ulelong		x		\b, %d x
19154>>8	ulelong		x		%d x
19155>>14	uleshort	x		%d
19156# number of color planes (must be 1)
19157#>>12	uleshort	>1		\b, %u color planes
19158# compression method: 0~no 1~RLE 8-bit/pixel 3~Huffman 1D
19159#>>16	ulelong		3		\b, Huffman 1D compression
19160>>16	ulelong		>0		\b, %u compression
19161# image size is the size of raw bitmap; a dummy 0 can be given for BI_RGB bitmaps
19162>>20	ulelong		x		\b, image size %u
19163# horizontal and vertical resolution of the image (pixel per metre, signed integer)
19164>>24	ulelong		>0		\b, resolution %d x
19165>>>28	ulelong		x		%d px/m
19166# number of colors in palette, or 0 to default to 2**n
19167#>>32	ulelong		>0		\b, %u colors
19168# number of important colors used, or 0 when every color is important
19169>>36	ulelong		>0		\b, %u important colors
19170# From:		Joerg Jenderek
19171# URL:		http://fileformats.archiveteam.org/wiki/VBM_(VDC_BitMap)
19172# Reference:	http://csbruce.com/cbm/postings/csc19950906-1.txt
19173#		http://mark0.net/download/triddefs_xml.7z
19174#		defs/b/bitmap-vbm.trid.xml
19175#		defs/b/bitmap-vbm-v3.trid.xml
19176# Note:		called "VDC BitMap" by TrID
19177#		verified by RECOIL `recoil2png -o tmp.png coke_can.vbm; file tmp.png`
19178# begin with a signature of 'B' 'M' 0xCB, followed by a version byte 2 or 3
19179# Similar to the unrelated Windows BMP format
19180#	check for VDC bitmap and then display image dimension and version
191810	name		bitmap-vbm
19182>2	ubyte		0xCB		VDC bitmap
19183!:mime	image/x-commodore-vbm
19184# http://recoil.sourceforge.net/formats.html
19185!:ext	bm/vbm
19186# the VBM format version number: 2 or 3
19187>>3	ubyte		x		\b, version %u
19188# width of the image in Hi/Lo format
19189>>4	ubeshort	x		\b, %u
19190# height of the image
19191>>6	ubeshort	x		x %u
19192# version 3 images have the following additional header information
19193>>3	ubyte		=3
19194# data-encoding type: 0~uncompressed 1~RLE-compressed
19195>>>8	ubyte		0		\b, uncompressed
19196>>>8	ubyte		1		\b, RLE-compressed
19197# byte code for general RLE repetitions
19198#>>>9	ubyte		x		\b, RLE repetition code 0x%x
19199# reserved := 0
19200#>>>14	short		>0		\b, reserved 0x%x
19201# length of comment text; 0~no comment text
19202#>>>16	ubeshort	>0		\b, comment length %u
19203>>>16	pstring/H	>0		\b, comment "%s"
19204#
192050	string		BM
19206# check for magic and version 2 of VDC bitmap or BMP with cbSize=715=CB02
19207>2	ubeshort		0xCB02
19208>>6	short		=0
19209>>>0	use     	bitmap-bmp
19210# VDC bitmap height or maybe a few OS/2 BMP with nonzero "hotspot coordinates"
19211>>6	short		!0
19212>>>0	use     	bitmap-vbm
19213# check for magic and version 3 of VDC bitmap or BMP with cbSize=971=CB03
19214>2	ubeshort		0xCB03
19215# check for reserved value (=0) of VDC bitmap
19216>>14	short		=0
19217>>>0	use     	bitmap-vbm
19218# BMP with cbSize=????03CBh and dib header size != 0
19219>>14	short		!0
19220>>>0	use     	bitmap-bmp
19221# cbSize is size of header or file size of Windows BMP bitmap
19222>2	default		x
19223>>0	use     	bitmap-bmp
192240	name		bitmap-bmp
19225>14	ulelong		12		PC bitmap, OS/2 1.x format
19226!:mime	image/bmp
19227!:ext	bmp
19228>>18	uleshort	x		\b, %d x
19229>>20	uleshort	x		%d
19230# number of color planes (must be 1)
19231#>>22	uleshort	!1		\b, %u color planes
19232# number of bits per pixel (color depth); found 4 8
19233>>24	uleshort	x		x %d
19234# x, y coordinates of the hotspot
19235>>6	uleshort	>0		\b, hotspot %ux
19236>>>8	uleshort	x		\b%u
19237# cbSize; size of file or header like 1Ah 228C8h
19238>>2	ulelong		x		\b, cbSize %u
19239#>>2	ulelong		x		\b, cbSize 0x%8.8x
19240# offBits; offset to bitmap data like:
19241>>10	ulelong		x	\b, bits offset %u
19242# http://fileformats.archiveteam.org/wiki/BMP#OS.2F2_BMP_2.0 no examples found
19243>14	ulelong		48		PC bitmap, OS/2 2.x format (DIB header size=48)
19244>14	ulelong		24		PC bitmap, OS/2 2.x format (DIB header size=24)
19245# http://entropymine.com/jason/bmpsuite/bmpsuite/q/pal8os2v2-16.bmp
19246# Note:    by bitmap-bmp-v2o.trid.xml called "Windows Bitmap (v2o)"
19247>14	ulelong		16		PC bitmap, OS/2 2.x format (DIB header size=16)
19248!:mime	image/bmp
19249!:apple	????BMPp
19250!:ext	bmp
19251# image width and height fields are unsigned integers for OS/2
19252>>18	ulelong		x		\b, %u x
19253>>22	ulelong		x		%u
19254# number of bits per pixel (color depth); found 8
19255>>28	uleshort	>1		x %u
19256# x, y coordinates of the hotspot
19257>>6	uleshort	>0		\b, hotspot %ux
19258>>>8	uleshort	x		\b%u
19259# number of color planes (must be 1)
19260#>>26	uleshort	>1		\b, %u color planes
19261# cbSize; size of file like: 241E
19262>>2	ulelong		x		\b, cbSize %u
19263#>>2	ulelong		x		\b, cbSize 0x%x
19264# offBits; offset to bitmap data like: 41E
19265>>10	ulelong		x	\b, bits offset %u
19266#>>10	ulelong		x	\b, bits offset 0x%x
19267>14	ulelong		64		PC bitmap, OS/2 2.x format
19268!:mime	image/bmp
19269!:apple	????BMPp
19270!:ext	bmp
19271# image width and height fields are unsigned integers for OS/2
19272>>18	ulelong		x		\b, %u x
19273>>22	ulelong		x		%u
19274# number of bits per pixel (color depth); found 1 4 8
19275>>28	uleshort	>1		x %u
19276# x, y coordinates of the hotspot
19277>>6	uleshort	>0		\b, hotspot %ux
19278>>>8	uleshort	x		\b%u
19279>>26	uleshort	>1		\b, %u color planes
19280# cbSize; size of file or headers
19281>>2	ulelong		x		\b, cbSize %u
19282# BMP with cbSize 000002CBh=715 or 000003CBh=971 maybe misinterpreted as VDC bitmap
19283#>>2	ulelong		x		\b, cbSize %#x
19284# offBits; offset to bitmap data like 56h 5Eh 8Eh 43Eh
19285>>10	ulelong		x	\b, bits offset %u
19286#>>10	ulelong		x	\b, bits offset %#x
19287#>>(10.l) ubequad	!0	\b, bits %#16.16llx
19288# BITMAPV2INFOHEADER	adds RGB bit masks
19289>14	ulelong		52		PC bitmap, Adobe Photoshop
19290!:mime	image/bmp
19291!:apple	????BMPp
19292!:ext	bmp
19293>>18	ulelong		x		\b, %d x
19294>>22	ulelong		x		%d x
19295# number of bits per pixel (color depth); found 16 32
19296>>28	uleshort	x		%d
19297# x, y coordinates of the hotspot; should be zero for Windows variant
19298>>6	uleshort	>0		\b, hotspot %ux
19299>>>8	uleshort	x		\b%u
19300# cbSize; size of file like: 14A 7F42
19301>>2	ulelong		x		\b, cbSize %u
19302#>>2	ulelong		x		\b, cbSize 0x%x
19303# offBits; offset to bitmap data like: 42h
19304>>10	ulelong		x	\b, bits offset %u
19305#>>10	ulelong		x	\b, bits offset 0x%x
19306# BITMAPV3INFOHEADER	adds alpha channel bit mask
19307>14	ulelong		56		PC bitmap, Adobe Photoshop with alpha channel mask
19308!:mime	image/bmp
19309!:apple	????BMPp
19310!:ext	bmp
19311>>18	ulelong		x		\b, %d x
19312>>22	ulelong		x		%d x
19313# number of bits per pixel (color depth); found 16 32
19314>>28	uleshort		x		%d
19315# x, y coordinates of the hotspot; should be zero for Windows variant
19316>>6	uleshort	>0		\b, hotspot %ux
19317>>>8	uleshort	x		\b%u
19318# cbSize; size of file like: 4E 7F46 131DE 14046h
19319>>2	ulelong		x		\b, cbSize %u
19320#>>2	ulelong		x		\b, cbSize 0x%x
19321# offBits; offset to bitmap data like: 46h
19322>>10	ulelong			x	\b, bits offset %u
19323#>>10	ulelong			x	\b, bits offset 0x%x
19324>14	ulelong		40
19325# jump 4 bytes before end of file/header to skip fmt-116-signature-id-118.dib
19326# broken for large bitmaps
19327#>>(2.l-4)	ulong	x		PC bitmap, Windows 3.x format
19328>>14	ulelong		40		PC bitmap, Windows 3.x format
19329!:mime	image/bmp
19330!:apple	????BMPp
19331>>>18	ulelong		x		\b, %d x
19332>>>22	ulelong		x		%d
19333# 320 x 400		https://en.wikipedia.org/wiki/LOGO.SYS
19334>>>18	ulequad		=0x0000019000000140	x
19335!:ext	bmp/sys
19336>>>18	ulequad		!0x0000019000000140
19337# compression method 2~RLE 4-bit/pixel implies also extension rle
19338>>>>30	ulelong		2		x
19339!:ext	bmp/rle
19340# not RLE compressed and not 320x400 dimension
19341>>>>30	default		x
19342# "small" dimensions like: 14x15 15x16 16x14 16x16 32x32
19343#	https://en.wikipedia.org/wiki/Favicon
19344>>>>>18	ulequad&0xffFFffC0ffFFffC0 =0	x
19345# https://www.politi-kdigital.de/favicon.ico
19346# http://forum.rpc1.org/favicon.ico
19347!:ext	bmp/ico
19348# "big" dimensions > 63
19349>>>>>18	default		x		x
19350!:ext	bmp
19351# number of bits per pixel (color depth); found 1 2 4 8 16 24 32
19352>>>28	uleshort	x		%d
19353# x, y coordinates of the hotspot; there is no hotspot in bitmaps, so values 0
19354#>>>6	uleshort	>0		\b, hotspot %ux
19355#>>>>8	uleshort	x		\b%u
19356# number of color planes (must be 1), except badplanes.bmp for testing
19357#>>>26	uleshort	>1		\b, %u color planes
19358# compression method: 0~no 1~RLE 8-bit/pixel 2~RLE 4-bit/pixel 3~Huffman 1D 6~RGBA bit field masks
19359#>>>30	ulelong		3		\b, Huffman 1D compression
19360>>>30	ulelong		>0		\b, %u compression
19361# image size is the size of raw bitmap; a dummy 0 can be given for BI_RGB bitmaps
19362>>>34	ulelong		>0		\b, image size %u
19363# horizontal and vertical resolution of the image (pixel per metre, signed integer)
19364>>>38	ulelong		>0		\b, resolution %d x
19365>>>>42	ulelong		x		%d px/m
19366# number of colors in palette 16 256, or 0 to default to 2**n
19367#>>>46	ulelong		>0		\b, %u colors
19368# number of important colors used, or 0 when every color is important
19369>>>50	ulelong		>0		\b, %u important colors
19370# cbSize; often size of file
19371>>>2	ulelong		x		\b, cbSize %u
19372#>>>2	ulelong		x		\b, cbSize %#x
19373# offBits; offset to bitmap data like 36h 76h BEh 236h 406h 436h 4E6h
19374>>>10	ulelong		x	\b, bits offset %u
19375#>>>10	ulelong		x	\b, bits offset %#x
19376#>>>(10.l) ubequad	!0	\b, bits %#16.16llxd
19377>14	ulelong		124		PC bitmap, Windows 98/2000 and newer format
19378!:mime	image/bmp
19379!:ext	bmp
19380>>18	ulelong		x		\b, %d x
19381>>22	ulelong		x		%d x
19382# color planes; must be 1
19383#>>>26	uleshort	>1		\b, %u color planes
19384# number of bits per pixel (color depth); found 4 8 16 24 32 1 (fmt-119-signature-id-121.bmp) 0 (rgb24jpeg.bmp rgb24png.bmp)
19385>>28	uleshort	x		%d
19386# x, y coordinates of the hotspot; should be zero for Windows variant
19387>>6	uleshort	>0		\b, hotspot %ux
19388>>>8	uleshort	x		\b%u
19389# cbSize; size of file like: 8E AA 48A 999 247A 4F02 7F8A 3F88E B216E 1D4C8A 100008A
19390>>2	ulelong		x		\b, cbSize %u
19391#>>2	ulelong		x		\b, cbSize 0x%x
19392# offBits; offset to bitmap data like: 8A 47A ABABABAB (fmt-119-signature-id-121.bmp)
19393>>10	ulelong		x	\b, bits offset %u
19394#>>10	ulelong		x	\b, bits offset 0x%x
19395>14	ulelong		108		PC bitmap, Windows 95/NT4 and newer format
19396!:mime	image/bmp
19397!:ext	bmp
19398>>18	ulelong		x		\b, %d x
19399>>22	ulelong		x		%d x
19400# number of bits per pixel (color depth); found 8 24 32
19401>>28	uleshort	x		%d
19402# x, y coordinates of the hotspot; should be zero for Windows variant
19403>>6	uleshort	>0		\b, hotspot %ux
19404>>>8	uleshort	x		\b%u
19405# cbSize; size of file like: 82 8A 9A 9F86 1E07A 3007A 88B7A C007A
19406>>2	ulelong		x		\b, cbSize %u
19407#>>2	ulelong		x		\b, cbSize 0x%x
19408# offBits; offset to bitmap data like: 7A 7E 46A
19409>>10	ulelong		x	\b, bits offset %u
19410#>>10	ulelong		x	\b, bits offset 0x%x
19411# Update:	Joerg Jenderek
19412# URL:		http://fileformats.archiveteam.org/wiki/OS/2_Icon
19413# Reference:	http://www.fileformat.info
19414#		/format/os2bmp/spec/902d5c253f2a43ada39c2b81034f27fd/view.htm
19415# Note: verified by command like `deark -l -d3 OS2MEMU.ICO`
194160	string		IC
19417# skip Lotus smart icon *.smi by looking for valid hotspot coordinates
19418>6	ulelong&0xFF00FF00	=0	OS/2 icon
19419# jump 4 bytes before end of header/file and test for accessibility
19420#>>(2.l-4) ubelong	x	End of header is OK!
19421!:mime	image/x-os2-ico
19422!:ext	ico
19423# cbSize; size of header or file in bytes like 1ah 120h 420h
19424>>2	ulelong		x	\b, cbSize %u
19425# xHotspot, yHotspot; coordinates of the hotspot for icons like 16 32
19426>>6	uleshort	x	\b, hotspot %ux
19427>>8	uleshort	x	\b%u
19428# offBits; offset in bytes to the beginning of the bit-map pel data like 20h
19429>>10	ulelong		x	\b, bits offset %u
19430#>>(10.l) ubequad	x	\b, bits %#16.16llx
19431#0	string		PI		PC pointer image data
19432#0	string		CI		PC color icon data
194330	string		CI
19434# test also for valid dib header sizes 12 or 64
19435>14	ulelong		<65		OS/2
19436# test also for valid hotspot coordinates
19437#>>6	ulelong&0xFE00FE00	=0	OS/2
19438!:mime	image/x-os2-ico
19439!:ext	ico
19440>>14	ulelong		12		1.x color icon
19441# image width and height fields are unsigned integers for OS/2
19442>>>18	uleshort	x		%u x
19443# stored height = 2 * real height
19444>>>20	uleshort/2	x		%u
19445# number of bits per pixel (color depth). Typical 32 24 16 8 4 but only 1 found
19446>>>24	uleshort	>1		x %u
19447# color planes; must be 1
19448#>>>22	uleshort	>1		\b, %u color planes
19449>>14	ulelong		64		2.x color icon
19450# image width and height
19451>>>18	ulelong		x		%u x
19452# stored height = 2 * real height
19453>>>22	ulelong/2	x		%u
19454# number of bits per pixel (color depth). only 1 found
19455>>>28	uleshort	>1		x %u
19456#>>>26	uleshort	>1		\b, %u color planes
19457# compression method: 0~no 3~Huffman 1D
19458>>>30	ulelong		3		\b, Huffman 1D compression
19459#>>>30	ulelong		>0		\b, %u compression
19460# xHotspot, yHotspot; coordinates of the hotspot like 0 1 16 20 32 33 63 64
19461>>6	uleshort	x	\b, hotspot %ux
19462>>8	uleshort	x	\b%u
19463# cbSize; size of header or maybe file in bytes like 1Ah 4Eh 84Eh
19464>>2	ulelong		x	\b, cbSize %u
19465#>>2	ulelong		x	\b, cbSize %x
19466# offBits; offset to bitmap data (pixel array) like E4h 3Ah 66h 6Ah 33Ah 4A4h
19467>>10	ulelong		x	\b, bits offset %u
19468#>>10	ulelong		x	\b, bits offset %#x
19469#>>(10.l) ubequad	!0	\b, bits %#16.16llx
19470# dib header size: 12~Ch~OS/2 1.x 64~40h~OS/2 2.x
19471#>>14	ulelong		x		\b, dib header size %u
19472#0	string		CP		PC color pointer image data
19473# URL:		http://fileformats.archiveteam.org/wiki/OS/2_Pointer
19474# Reference:	http://www.fileformat.info/format/os2bmp/egff.htm
194750	string		CP
19476# skip many Corel Photo-Paint image "CPT9FILE" by checking for positive bits offset
19477>10	ulelong		>0
19478# skip CPU-Z Report by checking for valid dib header sizes 12 or 64
19479>>14	ulelong		=12
19480>>>0		use		os2-ptr
19481>>14	ulelong		=64
19482>>>0		use		os2-ptr
19483#	display information of OS/2 pointer bitmaps
194840	name		os2-ptr
19485>14	ulelong		x		OS/2
19486# http://extension.nirsoft.net/PTR
19487!:mime	image/x-ibm-pointer
19488!:ext	ptr
19489>>14	ulelong		12		1.x color pointer
19490# image width and height fields are unsigned integers for OS/2
19491>>>18	uleshort	x		%u x
19492# stored height = 2 * real height
19493>>>20	uleshort/2	x		%u
19494# number of bits per pixel (color depth). Typical 32 24 16 8 4 but only 1 found
19495>>>24	uleshort	>1		x %u
19496# color planes; must be 1
19497#>>>22	uleshort	>1		\b, %u color planes
19498>>14	ulelong		64		2.x color pointer
19499# image width and height
19500>>>18	ulelong		x		%u x
19501# stored height = 2 * real height
19502>>>22	ulelong/2	x		%u
19503# number of bits per pixel (color depth). only 1 found
19504>>>28	uleshort	>1		x %u
19505#>>>26	uleshort	>1		\b, %u color planes
19506# compression method: 0~no 3~Huffman 1D
19507>>>30	ulelong		3		\b, Huffman 1D compression
19508#>>>30	ulelong		>0		\b, %u compression
19509# xHotspot, yHotspot; coordinates of the hotspot like 0 3 4 8 15 16 23 27 31
19510>>6	uleshort	x	\b, hotspot %ux
19511>>8	uleshort	x	\b%u
19512# cbSize; size of header or maybe file in bytes like 1Ah 4Eh
19513>>2	ulelong		x	\b, cbSize %u
19514#>>2	ulelong		x	\b, cbSize %x
19515# offBits; offset to bitmap data (pixel array) like 6Ah A4h E4h 4A4h
19516>>10	ulelong		x	\b, bits offset %u
19517#>>10	ulelong		x	\b, bits offset %#x
19518#>>(10.l) ubequad	!0	\b, bits %#16.16llx
19519# dib header size: 12~Ch~OS/2 1.x 64~40h~OS/2 2.x
19520#>>14	ulelong		x		\b, dib header size %u
19521# Conflicts with other entries [BABYL]
19522# URL:	http://fileformats.archiveteam.org/wiki/BMP#OS.2F2_Bitmap_Array
19523# Note:	container for OS/2 icon "IC", color icon "CI", color pointer "CP" or bitmap "BM"
19524#0	string		BA		PC bitmap array data
195250	string		BA
19526# skip old Emacs RMAIL BABYL ./mail.news by checking for low header size
19527>2	ulelong		<0x004c5942	OS/2 graphic array
19528!:mime	image/x-os2-graphics
19529#!:apple	????BMPf
19530# cbSize; size of header like 28h 5Ch
19531>>2	ulelong		x	\b, cbSize %u
19532#>>2	ulelong		x	\b, cbSize %#x
19533# offNext; offset to data like 0 48h F2h 4Eh 64h C6h D2h D6h DAh E6h EAh 348h
19534>>6	ulelong		>0	\b, data offset %u
19535#>>6	ulelong		>0	\b, data offset %#x
19536#>>(6.l) ubequad	!0	\b, data %#16.16llx
19537# dimensions of the intended device like 640 x 480 for VGA or 1024 x 768
19538>>10	uleshort	>0		\b, display %u
19539>>>12	uleshort	>0		x %u
19540# usType of first array element
19541#>>14	string		x		\b, usType %2.2s
19542# 1 space char after "1st"
19543# no *.bga examples found https://www.openwith.org/file-extensions/bga/1342
19544>>14	string		BM	\b; 1st
19545!:ext	bmp/bga
19546>>14	string		CI	\b; 1st
19547!:ext	ico
19548>>14	string		CP	\b; 1st
19549!:ext	ico
19550>>14	string		IC	\b; 1st
19551!:ext	ico
19552# no white-black pointer found
19553#>>14	string		PT	\b; 1st
19554#!:ext
19555>>14	indirect	x
19556
19557# XPM icons (Greg Roelofs, newt@uchicago.edu)
19558# Update:	Joerg Jenderek
19559# URL:		http://fileformats.archiveteam.org/wiki/XPM
19560# Reference:	http://www.x.org/docs/XPM/xpm.pdf
19561#		http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-xpm.trid.xml
19562# Note:		called "X PixMap bitmap" by TrID and "X-Windows Pixmap Image" by DROID via PUID x-fmt/208
19563# starting with c comment like: logo.xpm
195640	string			/*\040
19565# 9 byte c-comment "/* XPM */" not at the beginning like: mozicon16.xpm mozicon50.xpm (thunderbird)
19566>0	search/0xCE		/*\ XPM\ */
19567# skip DROID x-fmt-208-signature-id-620.xpm by looking for char aray without explict length
19568# and match mh-logo.xpm (emacs)
19569>>&0		search/1249	[]
19570>>>0		use		xpm-image
19571# non standard because no 9 byte c-comment "/* XPM */" like: logo.xpm in qemu package
19572>0	default			x
19573# words are separated by a white space which can be composed of space and tabulation characters
19574>>0		search/0x52	static\040char\040
19575# skip debug.c testmlc.c by looking for char aray without explict length
19576# https://www.clamav.net/downloads/production/clamav-0.104.2.tar.gz
19577# clamav-0.104.2\libclammspack\mspack\debug.c
19578>>>&0		search/64	[]
19579>>>>0		use		xpm-image
19580#	display X pixmap image information
195810	name			xpm-image
19582>0	string		x	X pixmap image text
19583#!:mime	text/plain
19584# https://reposcope.com/mimetype/image/x-xpixmap
19585# alias
19586#!:mime	image/x-xpm
19587!:mime	image/x-xpixmap
19588!:ext	xpm
19589# NO pm example found!
19590#!:ext	xpm/pm
19591# look for start of character array at beginning of a line like: psetupl.xpm (OpenOffice 4.1.7)
19592>0	search/0x406	\n"
19593# DEBUG VALUES string
19594#>>&0	string		x		'%s'
19595# width with optional white space before like: 16 24 32 48 1280
19596>>&0	regex/8		[0-9]{1,5}	\b, %s
19597# height with white space like: 15 16 17 24 32 48 1024
19598>>>&0	regex/8		[0-9]{1,5}	x %s
19599# number of colors with white space like: 1 2 3 4 5 8 11 14 162 255 but unrelistic 4294967295 by hardcopy tool
19600>>>>&0	regex/12	[0-9]{1,9}	x %s
19601# chars_per_pixel with white space like: 1 2
19602>>>>>&0	regex/14	[0-9]{1,2}	\b, %s chars/pixel
19603# non standard because not starting with 9 byte c-comment "/* XPM */"
19604>0	string		!/*\ XPM\ */
19605>>0	string		x	\b, 1st line "%s"
19606
19607# Utah Raster Toolkit RLE images (janl@ifi.uio.no)
196080	uleshort	0xcc52		RLE image data,
19609>6	uleshort	x		%d x
19610>8	uleshort	x		%d
19611>2	uleshort	>0		\b, lower left corner: %d
19612>4	uleshort	>0		\b, lower right corner: %d
19613>10	ubyte&0x1	=0x1		\b, clear first
19614>10	ubyte&0x2	=0x2		\b, no background
19615>10	ubyte&0x4	=0x4		\b, alpha channel
19616>10	ubyte&0x8	=0x8		\b, comment
19617>11	ubyte		>0		\b, %d color channels
19618>12	ubyte		>0		\b, %d bits per pixel
19619>13	ubyte		>0		\b, %d color map channels
19620
19621# image file format (Robert Potter, potter@cs.rochester.edu)
196220	string		Imagefile\ version-	iff image data
19623# this adds the whole header (inc. version number), informative but longish
19624>10	string		>\0		%s
19625
19626# Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com)
196270	ubelong		0x59a66a95	Sun raster image data
19628>4	ubelong		>0		\b, %d x
19629>8	ubelong		>0		%d,
19630>12	ubelong		>0		%d-bit,
19631#>16	ubelong		>0		%d bytes long,
19632>20	ubelong		0		old format,
19633#>20	ubelong		1		standard,
19634>20	ubelong		2		compressed,
19635>20	ubelong		3		RGB,
19636>20	ubelong		4		TIFF,
19637>20	ubelong		5		IFF,
19638>20	ubelong		0xffff		reserved for testing,
19639>24	ubelong		0		no colormap
19640>24	ubelong		1		RGB colormap
19641>24	ubelong		2		raw colormap
19642#>28	ubelong		>0		colormap is %d bytes long
19643
19644# SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com)
19645#
19646# See
19647#	http://reality.sgi.com/grafica/sgiimage.html
19648#
196490	ubeshort		474		SGI image data
19650#>2	ubyte		0		\b, verbatim
19651>2	ubyte		1		\b, RLE
19652#>3	ubyte		1		\b, normal precision
19653>3	ubyte		2		\b, high precision
19654>4	ubeshort	x		\b, %d-D
19655>6	ubeshort	x		\b, %d x
19656>8	ubeshort	x		%d
19657>10	ubeshort	x		\b, %d channel
19658>10	ubeshort	!1		\bs
19659>80	string		>0		\b, "%s"
19660
196610	string		IT01		FIT image data
19662>4	ubelong		x		\b, %d x
19663>8	ubelong		x		%d x
19664>12	ubelong		x		%d
19665#
196660	string		IT02		FIT image data
19667>4	ubelong		x		\b, %d x
19668>8	ubelong		x		%d x
19669>12	ubelong		x		%d
19670#
196712048	string		PCD_IPI		Kodak Photo CD image pack file
19672>0xe02	ubyte&0x03	0x00		, landscape mode
19673>0xe02	ubyte&0x03	0x01		, portrait mode
19674>0xe02	ubyte&0x03	0x02		, landscape mode
19675>0xe02	ubyte&0x03	0x03		, portrait mode
196760	string		PCD_OPA		Kodak Photo CD overview pack file
19677
19678# FITS format.  Jeff Uphoff <juphoff@tarsier.cv.nrao.edu>
19679# FITS is the Flexible Image Transport System, the de facto standard for
19680# data and image transfer, storage, etc., for the astronomical community.
19681# (FITS floating point formats are big-endian.)
196820	string	SIMPLE\ \ =	FITS image data
19683!:mime	image/fits
19684!:ext	fits/fts
19685>109	string	8		\b, 8-bit, character or unsigned binary integer
19686>108	string	16		\b, 16-bit, two's complement binary integer
19687>107	string	\ 32		\b, 32-bit, two's complement binary integer
19688>107	string	-32		\b, 32-bit, floating point, single precision
19689>107	string	-64		\b, 64-bit, floating point, double precision
19690
19691# other images
196920	string	This\ is\ a\ BitMap\ file	Lisp Machine bit-array-file
19693
19694# From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image
19695# stuff.
19696#
196970	ubeshort		0x1010		PEX Binary Archive
19698
19699# DICOM medical imaging data
19700# URL:		https://en.wikipedia.org/wiki/DICOM#Data_format
19701# Note:		"dcm" is the official file name extension
19702# 		XnView mention also "dc3" and "acr" as file name extension
19703128	string	DICM			DICOM medical imaging data
19704!:mime	application/dicom
19705!:ext dcm/dicom/dic
19706
19707# XWD - X Window Dump file.
19708# URL:		http://fileformats.archiveteam.org/wiki/XWD
19709# Reference:	https://wiki.multimedia.cx/index.php?title=XWD
19710#		http://mark0.net/download/triddefs_xml.7z/defs/x/xdm-x11.trid.xml
19711# Note:		called "X-Windows Screen Dump (X11)" by TrID and
19712#		"X-Windows Screen Dump" version X11 by DROID via PUID fmt/483
19713#		verfied by XnView `nconvert -in xwd -info *`
19714#		and ImageMagick 6.9.11 `identify -verbose *` as XWD X Windows system window dump
19715#		and `xwud -in fig41.wxd -dumpheader`
19716#   As described in /usr/X11R6/include/X11/XWDFile.h
19717#   used by the xwd program.
19718#   Bradford Castalia, idaeim, 1/01
19719#   updated by Adam Buchbinder, 2/09 and Joerg Jenderek, May 2022
19720# The following assumes version 7 of the format; the first long is the length
19721# of the header, which is at least 25 4-byte longs, and the one at offset 8
19722# is a constant which is always either 1 or 2. Offset 12 is the pixmap depth,
19723# which is a maximum of 32.
19724# Size of the entire file header (bytes) like: 100 104 105 106 107 109 110 113 114 115 118 172
197250	ubelong	>99
19726# pixmap_format; Pixmap format; 0~1-bit (XYBitmap) format 1~single-plane (XYPixmap) 2~bitmap with two or more planes (ZPixmap)
19727>8	ubelong	<3
19728# pixmap_depth; Pixmap depth; value 1 - 32
19729>>12	ubelong	<33
19730# file_version; XWD_FILE_VERSION=7
19731>>>4	ubelong	7
19732# skip DROID fmt-401-signature-id-618.xwd by test for existing border field
19733>>>>96	ubelong	x			X-Window screen dump image data, version X11
19734# ./images (version 1.205) labeled the above entry as "XWD X Window Dump image data"
19735# https://reposcope.com/mimetype/image/x-xwindowdump
19736!:mime	image/x-xwindowdump
19737#!:ext	xwd
19738!:ext	xwd/dmp
19739# https://www.xnview.com/en/image_formats/ NO example with x11 suffix FOUND!
19740#!:ext	xwd/dmp/x11
19741# https://www.nationalarchives.gov.uk/PRONOM/fmt/401 NO example with xdm suffix FOUND!
19742#!:ext	xwd/dmp/x11/xmd
19743# file comment if header > 100; so not in MARBLES.XWD and hardcopy-x-window-v11.xwd
19744>>>>>0	ubelong	>100
19745# comment or windows name
19746>>>>>>100 string	>\0			\b, "%s"
19747# pixmap_width;	pixmap width like: 576 800 1014 1280 1419 NOT -1414812757=abABabABh
19748>>>>>16	ubelong	x			\b, %dx
19749# pixmap_height; pixmap height like: 449 454 600 704 720 1001 1024 NOT -1414812757=abABabABh
19750>>>>>20	ubelong	x			\b%dx
19751# pixmap_depth;	pixmap depth
19752>>>>>12	ubelong	x			\b%d
19753# XOffset; Bitmap X offset; pixel numbers to ignore at the beginning of each scan-line
19754#>>>>>24	ubelong	x			\b, %u ignore
19755# ByteOrder; byte order of image data: 0~least significant byte first 1~most significant byte first
19756>>>>>28	ubelong	>0			\b, order %u
19757# BitmapUnit; bitmap base data size unit in each scan line like: 8 16 32
19758#>>>>>32	ubelong	x			\b, unit %u
19759# BitmapBitOrder; bit-order of image data; apparently same as ByteOrder
19760#>>>>>36	ubelong	x			\b, bit order %u
19761# BitmapPad; number of padding bits added to each scan line like: 8 16 32
19762#>>>>>40	ubelong	x			\b, pad %u
19763# BitsPerPixel; Bits per pixel: 1~StaticGray and GrayScale 2-15~StaticColor and PseudoColor 16,24,32~TrueColor and DirectColor
19764#>>>>>44	ubelong	x			\b, %u bits/pixel
19765# BytesPerLine; size of each scan line in bytes
19766#>>>>>48	ubelong	x			\b, %u bytes/line
19767# VisualClass; class of the image: 0~StaticGray 1~GrayScale 2~StaticColor 3~PseudoColor 4~TrueColor 5~DirectColor
19768#>>>>>52	ubelong	x			\b, %u Class
19769# RedMask; red RGB mask values used by ZPixmaps like: 0 0xff0000
19770#>>>>>56	ubelong	!0			\b, %#x red
19771# GreenMask; green mask like: 0
19772#>>>>>60	ubelong	!0			\b, %#x green
19773# BlueMask; blue mask like: 0 0xff
19774#>>>>>64	ubelong	!0			\b, %#x blue
19775# BitsPerRgb; Size of each color mask in bits like: 0 1 8 24
19776#>>>>>68	ubelong	x			\b, %u bits/RGB
19777# NumberOfColors; number of colors in image like: 256 4 2 0 (WHAT DOES THIS MEAN?)
19778>>>>>72	ubelong	x			\b, %u colors
19779# ColorMapEntries; number of entries in color map like: 256 16 2 0~no color map
19780>>>>>76	ubelong	x			%u entries
19781# WindowWidth; window width
19782#>>>>>80	ubelong	x			\b, %u width
19783# WindowHeight; window height
19784#>>>>>84	ubelong	x			\b, %u height
19785# WindowX; Window upper left X coordinate like: 0 24 32 80 237 290 422 466 568 (lenna.dmp)
19786>>>>>88	ubelong	!0			\b, x=%d
19787# WindowY; Window upper left Y coordinate like: 0 8 18 26 60 73 107 (fig41.xwd) 128
19788>>>>>92	ubelong	!0			\b, y=%d
19789# WindowBorderWidth; Window border width; apparently pixmap_width=WindowWidth+2*WindowBorderWidth
19790# like: 1 (fig41.xwd) 2 (maze.dmp) 3 (lenna.dmp mandrill.dmp)
19791>>>>>96	ubelong	>0			\b, %u border
19792# From:		Joerg Jenderek
19793# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/x/xdm-x10.trid.xml
19794# Note:		called "X-Windows Screen Dump (X10)" by TrID and
19795#		"X-Windows Screen Dump" version X10 by DROID via PUID x-fmt/300
19796#		verfied by XnView `nconvert -in xwd -info *`
19797# HeaderSize is the size of the header in bytes; always 40 for X10 variant
197980	ubelong		=0x000000028
19799# FileVersion; always 6 for X10 variant
19800>4	ubelong		=6
19801# skip DROID x-fmt-300-signature-id-619.xdm by test existing border field
19802>>36	ubeshort	x		X-Window screen dump image data, version X10
19803!:mime	image/x-xwindowdump
19804!:ext	xwd
19805# http://www.nationalarchives.gov.uk/pronom/fmt/401 NO example with xdm suffix FOUND!
19806#!:ext	xwd/xdm
19807# PixmapWidth; pixmap width like: 127 1280
19808>>>20	ubelong		x		\b, %d
19809# PixmapHeight; pixmap height like: 64 1024
19810>>>24	ubelong		x		\bx%d
19811# DisplayPlanes; number of display planes like: 1 4 8
19812>>>12	ubelong		x		\bx%u
19813# DisplayType; display type like: 1 3
19814#>>>8	ubelong		x		\b, type %u
19815# PixmapFormat; pixmap format like: 1~bitmap with two or more planes (ZPixmap) 0~single-plane bitmap (XYBitmap)
19816#>>>16	ubelong	x			\b, %u format
19817# WindowWidth; window width; probably PixmapWidth=WindowWidth+2*WindowBorderWidth
19818#>>>28	ubeshort	x		\b, width %u
19819# WindowHeight;  window height; probably PixmapWidth=PixmapHeight+2*WindowBorderWidth
19820#>>>30	ubeshort	x		\b, height %u
19821# WindowX; window upper left X coordinate like: 0
19822>>>32	ubeshort		!0	\b, x=%d
19823# WindowY; window upper left Y coordinate like: 0
19824>>>34	ubeshort		!0	\b, y=%d
19825# WindowBorderWidth; window border width like: 0
19826>>>36	ubeshort	!0		\b, %u border
19827# WindowNumColors; Number of color entries in window like: 2 16 256
19828#>>>38	ubeshort	x		\b, %u colors
19829# if the image is a PseudoColor image, a color map immediately follows the header. X10COLORMAP[WindowNumColors];
19830# EntryNumber; number of the color-map entry like: 0
19831#>>>40	ubeshort	x		\b, colors #%u
19832# Red; red-channel value
19833#>>>42	ubeshort	!0		\b, red %#x
19834# Green; green-channel value
19835#>>>44	ubeshort	!0		\b, green %#x
19836# Blue; blue-channel value
19837#>>>46	ubeshort	!0		\b, blue %#x
19838# 2ND Entry like: 2
19839#>>>48	ubeshort	x		\b, colors #%u
19840
19841# PDS - Planetary Data System
19842#   These files use Parameter Value Language in the header section.
19843#   Unfortunately, there is no certain magic, but the following
19844#   strings have been found to be most likely.
198450	string	NJPL1I00		PDS (JPL) image data
198462	string	NJPL1I			PDS (JPL) image data
198470	string	CCSD3ZF			PDS (CCSD) image data
198482	string	CCSD3Z			PDS (CCSD) image data
198490	string	PDS_			PDS image data
198500	string	LBLSIZE=		PDS (VICAR) image data
19851
19852# pM8x: ATARI STAD compressed bitmap format
19853#
19854# from Oskar Schirmer <schirmer@scara.com> Feb 2, 2001
19855# p M 8 5/6 xx yy zz data...
19856# Atari ST STAD bitmap is always 640x400, bytewise runlength compressed.
19857# bytes either run horizontally (pM85) or vertically (pM86). yy is the
19858# most frequent byte, xx and zz are runlength escape codes, where xx is
19859# used for runs of yy.
19860#
198610	string	pM85		Atari ST STAD bitmap image data (hor)
19862>5	ubyte	0x00		(white background)
19863>5	ubyte	0xFF		(black background)
198640	string	pM86		Atari ST STAD bitmap image data (vert)
19865>5	ubyte	0x00		(white background)
19866>5	ubyte	0xFF		(black background)
19867
19868# From: Alex Myczko <alex@aiei.ch>
19869# https://www.atarimax.com/jindroush.atari.org/afmtatr.html
198700	uleshort	0x0296		Atari ATR image
19871
19872# URL:		http://fileformats.archiveteam.org/wiki/DEGAS_image
19873# Reference:	https://wiki.multimedia.cx/index.php?title=Degas
19874# From:		Joerg Jenderek
19875#		http://mark0.net/download/triddefs_xml.7z/defs/b
19876#		bitmap-pi2-degas.trid.xml bitmap-pi3-degas.trid.xml
19877#		bitmap-pc1-degas.trid.xml bitmap-pc2-degas.trid.xml bitmap-pc3-degas.trid.xml
19878# Note:		verified by NetPBM `pi3topbm sigirl1.pi3 | file`
19879# 		`deark -m degas -l -d2 ataribak.pi1`
19880#		XnView `nconvert -fullinfo *.p??`
19881# DEGAS low-res uncompressed bitmap *.pi1
198820		beshort		0x0000
19883# skip some ISO 9660 CD-ROM filesystems like plpbt.iso by test for 4 non black colors in palette entries
19884>2		quad		!0
19885# skip g3test.g3 by test for unused bits of 2nd color entry
19886>>4		ubeshort&0xF000	0
19887#>>>0		beshort	x	1ST_VALUE=%x
19888>>>-0		offset	x	FILE_SIZE=%lld
19889# standard DEGAS low-res uncompressed bitmap *.pi1 with file size 32034
19890>>>-0		offset	=32034	VARIANT_STANDARD
19891#>>>>0		beshort	x	1st_VALUE=%x
19892# like: 8ball.pi1 teddy.pi1 sonic01.pi1
19893>>>>0		use		degas-bitmap
19894# about 61 DEGAS Elite low-res uncompressed bitmap *.pi1 with file size 32066
19895>>>-0		offset	=32066	VARIANT_ELITE
19896# like: spider.pi1 pinkgirl.pi1 frog3.pi1
19897>>>>0		use		degas-bitmap
19898# about 55 DEGAS Elite low-res uncompressed bitmap *.pi1 with file size 32128
19899>>>-0		offset	=32128	VARIANT_3
19900# like: mountain.pi1 bigspid.pi1 alf33.pi1
19901>>>>0		use		degas-bitmap
19902# 1 DEGAS Elite low-res uncompressed bitmap *.pi1 with file size 44834
19903>>>-0		offset	=44834	VARIANT_4
19904# like: kenshin.pi1
19905>>>>0		use		degas-bitmap
19906# DEGAS mid-res uncompressed bitmap *.pi2 (strength=50) after GEM Images like:
19907# BEETHVEN.IMG CHURCH.IMG GAMEOVR4.IMG TURKEY.IMG clinton.img
199080		beshort		0x0001
19909#!:strength +0
19910# skip many control files like gnucash-4.8.setup.exe.aria2 by test for non black in 4 palette entries
19911>2		quad		!0
19912# skip control file load-v0001.aria2 by test for unused bits of 5th color palette entry
19913>>10		ubeshort&0xF000	0
19914# skip many GEM Image data like DANCER.IMG GAMEOVR4.IMG SHIP.IMG by test for unused bits of 8th color palette entry
19915>>>16		ubeshort&0xF000	0
19916# skip many GEM Image data like BEETHVEN.IMG CABINETS.IMG MEMO.IMG by test for unused bits of 14th color palette entry
19917>>>>28		ubeshort&0xF000	0
19918# skip few GEM Image data like CHURCH.IMG by test for unused bits of 15th color palette entry
19919>>>>>30		ubeshort&0xF000	0
19920# skip many GEM Image data like TIGER.IMG TURKEY.IMG XMAS.IMG by test for unused bits of 16th color palette entry
19921>>>>>>32	ubeshort&0xF000	0
19922# skip GEM Image data like clinton.img by test for existing bytes at the end
19923>>>>>>>32026	quad		x
19924>>>>>>>>0	use		degas-bitmap
19925# DEGAS high-res uncompressed bitmap *.pi3
199260	beshort		0x0002
19927# skip Intel ia64 COFF msvcrt.lib by test for unused bits of 1st atari color palette entry
19928>2		ubeshort&0xF000	0
19929# skip few Adobe PhotoShop Brushes like Faux-Spitzen.abr by check
19930# for invalid Adobe PhotoShop Brush UTF16-LE string length
19931>>19		ubyte			=0
19932# many like: 4th_ofj2.pi3 GEMINI03.PI3 PEOPLE18.PI3 POWERFIX.PI3 abydos.pi3 highres.pi3 sigirl1.pi3 vanna5.pi3
19933>>>0		use		degas-bitmap
19934# Adobe PhotoShop Brush UTF16-LE string length 15 "Gitter - klein " 8 "Kreis 1 "
19935>>19		ubyte			!0
19936#>>19		ubyte			!0	\b, NOTE LENGTH %u
19937#>>>21		lestring16		x	\b, BRUSH NOTE "%s"
19938>>>(19.b*2)	ubequad			x
19939# maybe last character of Adobe PhotoShop Brush UTF16-LE string and terminating nul char like
19940# 006e0000 for n in "Faux-Spitzen.abr" 00310000 for 1 in "Verschiedene Spitzen.abr"
19941# 00000000 "LEREDACT.PI3" 03730773 "TBX_DEMO.PI3"
19942#>>>>&8		ubelong			x	\b, LAST CHAR+NIL %8.8x
19943>>>>&8		ubelong&0xff00ffFF	!0
19944# many DEGAS bitmap like: ARABDEMO.PI3 ELMRSESN.PI3 GEMVIEW.PI3 LEREDACT.PI3 PICCOLO.PI3 REPRO_JR.PI3 ST_TOOLS.PI3 TBX_DEMO.PI3 evgem7.pi3
19945>>>>>0		use		degas-bitmap
19946# test for last character of Adobe PhotoShop Brush UTF16-LE string and terminating nul char
19947>>>>&8		ubelong&0xff00ffFF	=0
19948# select last DEGAS bitmaps by invalid last char of brush note like BASICNES.PI3 DB_HELP.PI3 DB_WRITR.PI3 LEREDACT.PI3
19949>>>>>&-4	ubelong&0x00FF0000	<0x00200000
19950>>>>>>0		use		degas-bitmap
19951# last character of Adobe PhotoShop Brush UTF16-LE note
19952#>>>>>&-4	ubelong&0x00FF0000	>0x001F0000	\b, THAT IS ABR
19953# DEGAS low-res compressed bitmap *.pc1 like: BATTLSHP.PC1 GNUCHESS.PC1 MEDUSABL.PC1 MOONLORD.PC1 WILDROSE.PC1
199540		beshort			0x8000
19955# skip lif files handled via ./lif by test for unused bits of 1st palette entry
19956>2		ubeshort&0xF000		0
19957>>0		use		degas-bitmap
19958# DEGAS mid-res compressed bitmap *.pc2 like: abydos.pc2 ARTIS3.PC2 SMTHDRAW.PC2 STAR_2K.PC2 TX2_DEMO.PC2
199590		beshort			0x8001
19960>0		use		degas-bitmap
19961# DEGAS high-res compressed bitmap *.pc3 like: abydos.pc3 COYOTE.PC3 ELEPHANT.PC3 TX2_DEMO.PC3 SMTHDRAW.PC3
199620		beshort			0x8002
19963>0		use		degas-bitmap
19964# display information of Atari DEGAS and DEGAS Elite bitmap images
199650	name		degas-bitmap
19966>0	ubyte		x		Atari DEGAS
19967#!:mime	application/octet-stream
19968!:mime	image/x-atari-degas
19969# compressed
19970>0	ubyte		=0x80		Elite compressed
19971# uncompressed
19972#>0	ubyte		=0x00		uncompressed
19973#>0	ubyte		=0x00		un.
19974>0	ubyte		=0x00
19975# check for existence of footer for DEGAS Elite images
19976>>32042	ubequad		x		Elite
19977>0	beshort		0x0000		bitmap
19978!:ext	pi1
19979>0	beshort		0x0001		bitmap
19980!:ext	pi2
19981>0	beshort		0x0002		bitmap
19982# no example with SUH extension found
19983#!:ext	pi3/suh
19984!:ext	pi3
19985>0	beshort		0x8000		bitmap
19986!:ext	pc1
19987>0	beshort		0x8001		bitmap
19988!:ext	pc2
19989>0	beshort		0x8002		bitmap
19990!:ext	pc3
19991# low resolution; 320x200, 16 colors
19992>1	ubyte		=0		320 x 200 x 16
19993# medium resolution; 640x200, 4 colors
19994>1	ubyte		=1		640 x 200 x 4
19995# high resolution; 640x400, 2 colors
19996>1	ubyte		=2		640 x 400 x 2
19997# http://fileformats.archiveteam.org/wiki/Atari_ST_color_palette
19998# hardware_palette[16]; 9 bit ?????RRR?GGG?BBB; 12 bit ????RRRRGGGGBBBB for Atari STE
19999# for Atari DEGAS apparently no Spectrum 512 Enhanced 15 bit palette RGB?RRRRGGGGBBBB
20000# Red Green Blue unused bit ? often 0 but not bilboule.pi1; color_value (examples or numbers)
20001# 1st color palette entry like: 0777 (61) 0fff (LEREDACT.PI3) 0fcf (devgem7.pi3) 0001 (9)
20002>2	ubeshort	x		\b, color palette %4.4x
20003# 2nd palette entry like: 0000 (32) 0700 (38) 0f00 (LEREDACT.PI3 devgem7.pi3)
20004>4	ubeshort	x		%4.4x
20005# 3rd palette entry
20006>6	ubeshort	x		%4.4x
20007# 4th palette entry like: 0000 (72)
20008>8	ubeshort	x		%4.4x
20009# 5th palette entry
20010>10	ubeshort	x		%4.4x
20011>2	ubeshort	x		...
20012# 6th palette entry
20013#>12	ubeshort	x		%4.4x
20014# 7th palette entry like: 0000 (16) 0001 (ELMRSESN.PI3 elmrsesn.pi3) 0070 (51) 00f0 (BASICNES.PI3 LEREDACT.PI3) 00f8 (devgem7.pi3)
20015#>14	ubeshort	x		%4.4x
20016# 8th palette entry
20017#>16	ubeshort	x		%4.4x
20018# 9 palette entry
20019#>18	ubeshort	x		%4.4x
20020# 10 palette entry
20021#>20	ubeshort	x		%4.4x
20022# 11 palette entry
20023#>22	ubeshort	x		%4.4x
20024# 12 palette entry
20025#>24	ubeshort	x		%4.4x
20026# 13 palette entry
20027#>26	ubeshort	x		%4.4x
20028# 14th palette entry
20029#>28	ubeshort	x		%4.4x
20030# 15th palette entry
20031#>30	ubeshort	x		%4.4x
20032# 16th palette entry
20033#>32	ubeshort	x		%4.4x
20034# data[16000] for uncompressed images; pixel data
20035#>34	ubequad		x		\b, DATA %#16.16llx...
20036# footer for Elite variant images
20037# https://www.fileformat.info/format/atari/egff.htm
20038# https://pulkomandy.tk/projects/GrafX2/wiki/Develop/FileFormats/Atari
20039# left_color_animation[4]; like: 0000000000000000 0000000100020003 fffafff000000030 (bigspid.pi1)
20040#>32034  ubequad		!0		\b, color animations %16.16llx (left)
20041# right_color_animation[4]; like: 0000000000000000 0000000100020003
20042#>>32042  ubequad	!0		%16.16llx (right)
20043# channel_direction[4]; 0~left 1~none 2~right like: 0001000100010001 0002000000010001 (cycle2.pi1)
20044# sometimes unexpected like: feaafc0000000000 (bigspid.pi1)
20045#>32050  ubequad		!0		\b, channel directions %16.16llx
20046# channel_delay[4]; 128 - channel delay, timebase 1/60 s
20047#>32058  ubequad		!0		\b, channel delays %16.16llx
20048
20049# From:		Joerg Jenderek
20050# URL:		http://fileformats.archiveteam.org/wiki/ImageLab/PrintTechnic
20051# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-b_w.trid.xml
20052# Note:		called "ImageLab bitmap" by TrID
20053#		verfied by XnView `nconvert -fullinfo "MAEDCHEN.B&W"`
200540	string		B&W256	ImageLab bitmap
20055!:mime	image/x-ilab
20056#	https://www.xnview.com/de/image_formats/
20057# GRR: add char & inside parse_ext in ../../src/apprentice.c to avoid in file version 5.40 error like:
20058# Magdir\images, 1090: Warning: EXTENSION type `        b_w/b&w' has bad char '&'
20059!:ext	b_w/b&w
20060# Width
20061>6	ubeshort	x	\b, %u
20062# Height
20063>8	ubeshort	x	x %u
20064
20065# XXX:
20066# This is bad magic 0x5249 == 'RI' conflicts with RIFF and other
20067# magic.
20068# SGI RICE image file <mpruett@sgi.com>
20069#0	ubeshort	0x5249		RICE image
20070#>2	ubeshort	x		v%d
20071#>4	ubeshort	x		(%d x
20072#>6	ubeshort	x		%d)
20073#>8	ubeshort	0		8 bit
20074#>8	ubeshort	1		10 bit
20075#>8	ubeshort	2		12 bit
20076#>8	ubeshort	3		13 bit
20077#>10	ubeshort	0		4:2:2
20078#>10	ubeshort	1		4:2:2:4
20079#>10	ubeshort	2		4:4:4
20080#>10	ubeshort	3		4:4:4:4
20081#>12	ubeshort	1		RGB
20082#>12	ubeshort	2		CCIR601
20083#>12	ubeshort	3		RP175
20084#>12	ubeshort	4		YUV
20085
20086# PCX image files
20087# From: Dan Fandrich <dan@coneharvesters.com>
20088# updated by Joerg Jenderek at Feb 2013 by https://de.wikipedia.org/wiki/PCX
20089# https://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt
20090# GRR: original test was still too general as it catches xbase examples T5.DBT,T6.DBT with 0xa000000
20091# test for bytes 0x0a,version byte (0,2,3,4,5),compression byte flag(0,1), bit depth (>0) of PCX or T5.DBT,T6.DBT
200920	ubelong&0xffF8fe00	0x0a000000
20093# for PCX bit depth > 0
20094>3	ubyte		>0
20095# test for valid versions
20096>>1	ubyte		<6
20097>>>1	ubyte		!1	PCX
20098!:mime	image/x-pcx
20099#!:mime	image/pcx
20100>>>>1	ubyte		0	ver. 2.5 image data
20101>>>>1	ubyte		2	ver. 2.8 image data, with palette
20102>>>>1	ubyte		3	ver. 2.8 image data, without palette
20103>>>>1	ubyte		4	for Windows image data
20104>>>>1	ubyte		5	ver. 3.0 image data
20105>>>>4	uleshort	x	bounding box [%d,
20106>>>>6	uleshort	x	%d] -
20107>>>>8	uleshort	x	[%d,
20108>>>>10	uleshort	x	%d],
20109>>>>65	ubyte		>1	%d planes each of
20110>>>>3	ubyte		x	%d-bit
20111>>>>68	ubyte		1	colour,
20112>>>>68	ubyte		2	grayscale,
20113# this should not happen
20114>>>>68	default		x	image,
20115>>>>12	uleshort	>0	%d x
20116>>>>>14	uleshort	x	%d dpi,
20117>>>>2	ubyte		0	uncompressed
20118>>>>2	ubyte		1	RLE compressed
20119
20120# Adobe Photoshop
20121# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
20122# URL: 		http://fileformats.archiveteam.org/wiki/PSD
20123# Reference:	https://www.adobe.com/devnet-apps/photoshop/fileformatashtml/
20124# Note:		verfied by XnView `nconvert -fullinfo *.psd *.psb *.pdd`
20125#		and ImageMagick `identify -verbose *.pdd`
201260	string		8BPS
20127# skip DROID x-fmt-92-signature-id-277.psd by checking valid width
20128>18	ubelong		>0	Adobe Photoshop
20129!:mime	image/vnd.adobe.photoshop
20130!:apple	????8BPS
20131# version: always equal to 1, but 2 for PSB
20132>>4   beshort 1
20133# URL: 		http://fileformats.archiveteam.org/wiki/PhotoDeluxe
20134# EXTRAS/PHOTOS/DEMOPIX/ORIGINAL.PDD
20135>>>34	search/0xC0d7	PHUT	Image (PhotoDeluxe)
20136!:ext	pdd
20137>>>34	default		x	Image
20138!:ext	psd
20139# URL: 		http://fileformats.archiveteam.org/wiki/PSB
20140>>4   beshort 2 Image (PSB)
20141!:ext	psb
20142# width in pixels: 1-30000 1-300000 for PSB
20143>>18  belong  x \b, %d x
20144>>14  belong  x %d,
20145# The color mode; 0~Bitmap 1~Grayscale 2~Indexed 3~RGB 4~CMYK 7~Multichannel 9~Duotone 9~Lab
20146>>24  beshort 0 bitmap
20147>>24  beshort 1 grayscale
20148# the number of channels; range is 1 to 56
20149>>>12 beshort 2 with alpha
20150>>24  beshort 2 indexed
20151>>24  beshort 3 RGB
20152>>>12 beshort 4 \bA
20153>>24  beshort 4 CMYK
20154>>>12 beshort 5 \bA
20155>>24  beshort 7 multichannel
20156>>24  beshort 8 duotone
20157>>24  beshort 9 lab
20158>>12  beshort > 1
20159>>>12 beshort x \b, %dx
20160>>12  beshort 1 \b,
20161>>22  beshort x %d-bit channel
20162>>12  beshort > 1 \bs
20163# 6 reserved bytes; must be zero, but spaces inside ImageMagick input.psd
20164# https://download.imagemagick.org/ImageMagick/download/ImageMagick-7.0.11-11.zip
20165# ImageMagick-7.0.11-11\PerlMagick\t\input.psd
20166>>6   bequad&0xFFffFFffFFff0000 !0 \b, at offset 6
20167>>>6  belong  x	 0x%8.8x
20168>>>6  beshort x   \b%4.4x
20169
20170# XV thumbnail indicator (ThMO)
20171# URL:		https://en.wikipedia.org/wiki/Xv_(software)
20172# Reference:	http://fileformats.archiveteam.org/wiki/XV_thumbnail
20173# Update:	Joerg Jenderek
201740	string		P7\ 332		XV thumbnail image data
20175#0	string		P7\ 332		XV "thumbnail file" (icon) data
20176!:mime	image/x-xv-thumbnail
20177# thumbnail .xvpic/foo.bar for graphic foo.bar
20178!:ext	p7/gif/tif/xpm/jpg
20179
20180# NITF is defined by United States MIL-STD-2500A
201810	string	NITF	National Imagery Transmission Format
20182>25	string	>\0	dated %.14s
20183
20184# GEM Image: Version 1, Headerlen 8 (Wolfram Kleff)
20185# Format variations from: Bernd Nuernberger <bernd.nuernberger@web.de>
20186# Update: Joerg Jenderek
20187# See http://fileformats.archiveteam.org/wiki/GEM_Raster
20188# For variations, also see:
20189#    https://www.seasip.info/Gem/ff_img.html (Ventura)
20190#    http://www.atari-wiki.com/?title=IMG_file (XIMG, STTT)
20191#    http://www.fileformat.info/format/gemraster/spec/index.htm (XIMG, STTT)
20192#    http://sylvana.net/1stguide/1STGUIDE.ENG (TIMG)
201930       beshort     0x0001
20194# header_size
20195>2      beshort     0x0008
20196>>0     use gem_info
20197>2      beshort     0x0009
20198>>0     use gem_info
20199# no example for NOSIG
20200>2      beshort     24
20201>>0     use gem_info
20202# no example for HYPERPAINT
20203>2      beshort     25
20204>>0     use gem_info
2020516      string      XIMG\0
20206>0      use gem_info
20207# no example
2020816      string      STTT\0\x10
20209>0      use gem_info
20210# no example or description
2021116      string      TIMG\0
20212>0      use gem_info
20213
202140   name        gem_info
20215# version is 2 for some XIMG and 1 for all others
20216>0	ubeshort		<0x0003		GEM
20217# https://www.snowstone.org.uk/riscos/mimeman/mimemap.txt
20218!:mime	image/x-gem
20219# header_size 24 25 27 59 779 words for colored bitmaps
20220>>2	ubeshort	>9
20221>>>16	string		STTT\0\x10	STTT
20222>>>16	string		TIMG\0		TIMG
20223# HYPERPAINT or NOSIG variant
20224>>>16	string		\0\x80
20225>>>>2	ubeshort	=24		NOSIG
20226>>>>2	ubeshort	!24		HYPERPAINT
20227# NOSIG or XIMG variant
20228>>>16	default		x
20229>>>>16	string		!XIMG\0		NOSIG
20230>>16	string		=XIMG\0		XIMG Image data
20231!:ext	img/ximg
20232# to avoid Warning: Current entry does not yet have a description for adding a EXTENSION type
20233>>16	string		!XIMG\0		Image data
20234!:ext	img
20235# header_size is 9 for Ventura files and 8 for other GEM Paint files
20236>>2	ubeshort	9		(Ventura)
20237#>>2	ubeshort	8		(Paint)
20238>>12	ubeshort	x		%d x
20239>>14	ubeshort	x		%d,
20240# 1 4 8
20241>>4	ubeshort	x		%d planes,
20242# in tenths of a millimetre
20243>>8	ubeshort	x		%d x
20244>>10	ubeshort	x		%d pixelsize
20245# pattern_size 1-8. 2 for GEM Paint
20246>>6	ubeshort	!2		\b, pattern size %d
20247
20248# GEM Metafile (Wolfram Kleff)
202490	ulelong		0x0018FFFF	GEM Metafile data
20250>4	uleshort	x		version %d
20251
20252#
20253# SMJPEG. A custom Motion JPEG format used by Loki Entertainment
20254# Software Torbjorn Andersson <d91tan@Update.UU.SE>.
20255#
202560	string	\0\nSMJPEG	SMJPEG
20257>8	ubelong	x		%d.x data
20258# According to the specification you could find any number of _TXT
20259# headers here, but I can't think of any way of handling that. None of
20260# the SMJPEG files I tried it on used this feature. Even if such a
20261# file is encountered the output should still be reasonable.
20262>16	string		_SND		\b,
20263>>24	ubeshort	>0		%d Hz
20264>>26	ubyte		8		8-bit
20265>>26	ubyte		16		16-bit
20266>>28	string		NONE		uncompressed
20267# >>28	string		APCM		ADPCM compressed
20268>>27	ubyte		1		mono
20269>>28	ubyte		2		stereo
20270# Help! Isn't there any way to avoid writing this part twice?
20271# Yes, use a name/use
20272>>32	string		_VID		\b,
20273# >>>48	string		JFIF		JPEG
20274>>>40	ubelong		>0		%d frames
20275>>>44	ubeshort	>0		(%d x
20276>>>46	ubeshort	>0		%d)
20277>16	string		_VID		\b,
20278# >>32	string		JFIF		JPEG
20279>>24	ubelong		>0		%d frames
20280>>28	ubeshort	>0		(%d x
20281>>30	ubeshort	>0		%d)
20282
202830	string	Paint\ Shop\ Pro\ Image\ File	Paint Shop Pro Image File
20284
20285# taken from fkiss: (<yav@mte.biglobe.ne.jp> ?)
202860	string		KiSS		KISS/GS
20287>4	ubyte		16		color
20288>>5	ubyte		x		%d bit
20289>>8	uleshort	x		%d colors
20290>>10	uleshort	x		%d groups
20291>4	ubyte		32		cell
20292>>5	ubyte		x		%d bit
20293>>8	uleshort	x		%d x
20294>>10	uleshort	x		%d
20295>>12	uleshort	x		+%d
20296>>14	uleshort	x		+%d
20297
20298# Webshots (www.webshots.com), by John Harrison
202990       string          C\253\221g\230\0\0\0 Webshots Desktop .wbz file
20300
20301# Hercules DASD image files
20302# From Jan Jaeger <jj@septa.nl> and Jay Maynard <jaymaynard@gmail.com>
203030       string  CKD_P370        Hercules CKD DASD image file
20304>8      lelong  x               \b, %d heads per cylinder
20305>12     lelong  x               \b, track size %d bytes
20306>16     byte    x               \b, device type 33%2.2X
20307
203080       string  CKD_C370        Hercules compressed CKD DASD image file
20309>8      lelong  x               \b, %d heads per cylinder
20310>12     lelong  x               \b, track size %d bytes
20311>16     byte    x               \b, device type 33%2.2X
20312>552    lelong  x               \b, %d total cylinders
20313>>557   byte    0               \b, no compression
20314>>557   byte    1               \b, ZLIB compression
20315>>557   byte    2               \b, BZ2 compression
20316
203170       string  CKD_S370        Hercules CKD DASD shadow file
20318>8      lelong  x               \b, %d heads per cylinder
20319>12     lelong  x               \b, track size %d bytes
20320>16     byte    x               \b, device type 33%2.2X
20321
203220       string  CKD_P064        Hercules CKD64 DASD image file
20323>8      lelong  x               \b, %d heads per cylinder
20324>12     lelong  x               \b, track size %d bytes
20325>16     byte    x               \b, device type 33%2.2X
20326
203270       string  CKD_C064        Hercules compressed CKD64 DASD image file
20328>8      lelong  x               \b, %d heads per cylinder
20329>12     lelong  x               \b, track size %d bytes
20330>16     byte    x               \b, device type 33%2.2X
20331>524    lelong  x               \b, %d total cylinders
20332>>585   byte    0               \b, no compression
20333>>585   byte    1               \b, ZLIB compression
20334>>585   byte    2               \b, BZ2 compression
20335
203360       string  CKD_S064        Hercules CKD64 DASD shadow file
20337>8      lelong  x               \b, %d heads per cylinder
20338>12     lelong  x               \b, track size %d bytes
20339>16     byte    x               \b, device type 33%2.2X
20340
20341# Squeak images and programs - etoffi@softhome.net
203420	string		\146\031\0\0	Squeak image data
203430	search/1	'From\040Squeak	Squeak program text
20344
20345# partimage: file(1) magic for PartImage files (experimental, incomplete)
20346# Author: Hans-Joachim Baader <hjb@pro-linux.de>
203470		string	PaRtImAgE-VoLuMe	PartImage
20348>0x0020		string	0.6.1		file version %s
20349>>0x0060	ulelong	>-1		volume %d
20350#>>0x0064 8 byte identifier
20351#>>0x007c reserved
20352>>0x0200	string	>\0		type %s
20353>>0x1400	string	>\0		device %s,
20354>>0x1600	string	>\0		original filename %s,
20355# Some fields omitted
20356>>0x2744	ulelong	0		not compressed
20357>>0x2744	ulelong	1		gzip compressed
20358>>0x2744	ulelong	2		bzip2 compressed
20359>>0x2744	ulelong	>2		compressed with unknown algorithm
20360>0x0020		string	>0.6.1		file version %s
20361>0x0020		string	<0.6.1		file version %s
20362
20363# DCX is multi-page PCX, using a simple header of up to 1024
20364# offsets for the respective PCX components.
20365# From: Joerg Wunsch <joerg_wunsch@uriah.heep.sax.de>
20366# Update:	Joerg Jenderek
20367# URL:		http://fileformats.archiveteam.org/wiki/DCX
203680	ulelong	987654321	DCX multi-page
20369# http://www.nationalarchives.gov.uk/pronom/x-fmt/348
20370!:mime	image/x-dcx
20371!:ext	dcx
20372# The first file offset usually starts at file offset 0x1004
20373# print 1 space after 0x100? offset and then handles PCX images by ./images
20374>4	ulelong	x		\b, at %#x
20375>(4.l)	indirect		x
20376# possible 2nd PCX image
20377#>8	ulelong	!0		\b, at %#x
20378#>>(8.l)	indirect		x
20379# possible 3rd PCX image
20380#>12	ulelong	!0		\b, at %#x
20381#>>(12.l)	indirect		x
20382
20383# Simon Walton <simonw@matteworld.com>
20384# Kodak Cineon format for scanned negatives
20385# http://www.kodak.com/US/en/motion/support/dlad/
203860	ulelong  0xd75f2a80	Cineon image data
20387>200	ubelong  >0		\b, %d x
20388>204	ubelong  >0		%d
20389
20390
20391# Bio-Rad .PIC is an image format used by microscope control systems
20392# and related image processing software used by biologists.
20393# From: Vebjorn Ljosa <vebjorn@ljosa.com>
20394# BOOL values are two-byte integers; use them to rule out false positives.
20395# https://web.archive.org/web/20050317223257/www.cs.ubc.ca/spider/ladic/text/biorad.txt
20396# Samples: https://www.loci.wisc.edu/software/sample-data
2039714	uleshort	<2
20398>62	uleshort	<2
20399>>54	uleshort	12345		Bio-Rad .PIC Image File
20400>>>0	uleshort	>0		%d x
20401>>>2	uleshort	>0		%d,
20402>>>4	uleshort	=1		1 image in file
20403>>>4	uleshort	>1		%d images in file
20404
20405# From Jan "Yenya" Kasprzak <kas@fi.muni.cz>
20406# The description of *.mrw format can be found at
20407# http://www.dalibor.cz/minolta/raw_file_format.htm
204080	string	\000MRM			Minolta Dimage camera raw image data
20409
20410# Summary: DjVu image / document
20411# Extension: .djvu
20412# Reference: http://djvu.org/docs/DjVu3Spec.djvu
20413# Submitted by: Stephane Loeuillet <stephane.loeuillet@tiscali.fr>
20414# Modified by (1): Abel Cheung <abelcheung@gmail.com>
204150	string	AT&TFORM
20416>12	string	DJVM		DjVu multiple page document
20417!:mime	image/vnd.djvu
20418>12	string	DJVU		DjVu image or single page document
20419!:mime	image/vnd.djvu
20420>12	string	DJVI		DjVu shared document
20421!:mime	image/vnd.djvu
20422>12	string	THUM		DjVu page thumbnails
20423!:mime	image/vnd.djvu
20424
20425# Originally by Marc Espie
20426# Modified by Robert Minsk <robertminsk at yahoo.com>
20427# https://www.openexr.com/openexrfilelayout.pdf
204280	ulelong		20000630	OpenEXR image data,
20429!:mime image/x-exr
20430>4	ulelong&0x000000ff x		version %d,
20431>4	ulelong		^0x00000200	storage: scanline
20432>4	ulelong		&0x00000200	storage: tiled
20433>8	search/0x1000	compression\0	\b, compression:
20434>>&16	ubyte		0		none
20435>>&16	ubyte		1		rle
20436>>&16	ubyte		2		zips
20437>>&16	ubyte		3		zip
20438>>&16	ubyte		4		piz
20439>>&16	ubyte		5		pxr24
20440>>&16	ubyte		6		b44
20441>>&16	ubyte		7		b44a
20442>>&16	ubyte		8		dwaa
20443>>&16	ubyte		9		dwab
20444>>&16	ubyte		>9		unknown
20445>8	 search/0x1000	dataWindow\0	\b, dataWindow:
20446>>&10	ulelong		x		(%d
20447>>&14	ulelong		x		%d)-
20448>>&18	ulelong		x		\b(%d
20449>>&22	ulelong		x		%d)
20450>8	search/0x1000	displayWindow\0	\b, displayWindow:
20451>>&10	ulelong		x		(%d
20452>>&14	ulelong		x		%d)-
20453>>&18	ulelong		x		\b(%d
20454>>&22	ulelong		x		%d)
20455>8	search/0x1000	lineOrder\0	 \b, lineOrder:
20456>>&14	ubyte		0		increasing y
20457>>&14	ubyte		1		decreasing y
20458>>&14	ubyte		2		random y
20459>>&14	ubyte		>2		unknown
20460
20461# SMPTE Digital Picture Exchange Format, SMPTE DPX
20462#
20463# ANSI/SMPTE 268M-1994, SMPTE Standard for File Format for Digital
20464# Moving-Picture Exchange (DPX), v1.0, 18 February 1994
20465# Robert Minsk <robertminsk at yahoo.com>
20466# Modified by Harry Mallon <hjmallon at gmail.com>
204670	string		SDPX	DPX image data, big-endian,
20468!:mime image/x-dpx
20469>0	use		dpx_info
204700	string		XPDS	DPX image data, little-endian,
20471!:mime image/x-dpx
20472>0	use		\^dpx_info
20473
204740	name		dpx_info
20475>768	ubeshort	<4
20476>>772	ubelong		x	%dx
20477>>776	ubelong		x	\b%d,
20478>768	ubeshort	>3
20479>>776	ubelong		x	%dx
20480>>772	ubelong		x	\b%d,
20481>768	ubeshort	0	left to right/top to bottom
20482>768	ubeshort	1	right to left/top to bottom
20483>768	ubeshort	2	left to right/bottom to top
20484>768	ubeshort	3	right to left/bottom to top
20485>768	ubeshort	4	top to bottom/left to right
20486>768	ubeshort	5	top to bottom/right to left
20487>768	ubeshort	6	bottom to top/left to right
20488>768	ubeshort	7	bottom to top/right to left
20489
20490# From: Tom Hilinski <tom.hilinski@comcast.net>
20491# Update:	Joerg Jenderek
20492# URL: 		https://en.wikipedia.org/wiki/NetCDF
20493#		http://fileformats.archiveteam.org/wiki/NetCDF
20494# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/n/netcdf.trid.xml
20495#		https://www.loc.gov/preservation/digital/formats/fdd/fdd000330.shtml
20496# Note:		called "NetCDF Network Common Data Form" by TrID and
20497#		"netCDF-3 Classic" by DROID via PUID fmt/282
20498# https://www.unidata.ucar.edu/packages/netcdf/
204990	string	CDF\001
20500# skip DROID fmt-282-signature-id-298.nc by test for more content bytes
20501>3	uleshort	>0		NetCDF Data Format data
20502#!:mime	application/netcdf
20503# https://reposcope.com/mimetype/application/x-netcdf
20504!:mime	application/x-netcdf
20505!:ext	nc
20506# https://fileinfo.com/extension/cdf
20507# https://www.file-extensions.org/cdf-file-extension-unidata-network-common-data-form
20508# in 1994 changed from CDF to NC file extension avoid a clash with other file formats
20509#!:ext	nc/cdf
20510# 64-bit offset netcdf Classic https://www.unidata.ucar.edu/software/netcdf/docs/file_format_specifications
20511# Note:		called "netCDF-3 64-bit" by DROID via PUID fmt/283
205120	string	CDF\002
20513# skip DROID fmt-283-signature-id-299.nc by test for more content bytes
20514>3	uleshort	>0		NetCDF Data Format data (64-bit offset)
20515#!:mime	application/netcdf
20516!:mime	application/x-netcdf
20517!:ext	nc
20518
20519# From: Michael Liu
20520# https://en.wikipedia.org/wiki/Common_Data_Format
205210	ubelong	0xCDF30001	Common Data Format (Version 3 or later) data
20522!:mime  application/x-cdf
20523
205240	ubelong	0xCDF26002	Common Data Format (Version 2.6 or 2.7) data
20525!:mime  application/x-cdf
20526
205270	ubelong	0x0000FFFF	Common Data Format (Version 2.5 or earlier) data
20528!:mime  application/x-cdf
20529
20530# Hierarchical Data Format, used to facilitate scientific data exchange
20531# specifications at http://hdf.ncsa.uiuc.edu/
20532# URL: 		http://fileformats.archiveteam.org/wiki/HDF
20533#		https://en.wikipedia.org/wiki/Hierarchical_Data_Format
20534# Reference:	https://portal.hdfgroup.org/download/attachments/52627880/HDF5_File_Format_Specification_Version-3.0.pdf
205350	ubelong	0x0e031301	Hierarchical Data Format (version 4) data
20536!:mime	application/x-hdf
20537!:ext	hdf/hdf4/h4
205380	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) data
20539#!:mime	application/x-hdf
20540!:mime	application/x-hdf5
20541!:ext	h5/hdf5/hdf/he5
20542512	string	\211HDF\r\n\032\n
20543# skip Matlab v5 mat-file testhdf5_7.4_GLNX86.mat handled by ./mathematica
20544>0	string	!MATLAB			Hierarchical Data Format (version 5) with 512 bytes user block
20545#!:mime	application/x-hdf
20546!:mime	application/x-hdf5
20547!:ext	h5/hdf5/hdf/he5
205481024	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) with 1k user block
20549#!:mime	application/x-hdf
20550!:mime	application/x-hdf5
20551!:ext	h5/hdf5/hdf/he5
205522048	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) with 2k user block
20553#!:mime	application/x-hdf
20554!:mime	application/x-hdf5
20555!:ext	h5/hdf5/hdf/he5
205564096	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) with 4k user block
20557#!:mime	application/x-hdf
20558!:mime	application/x-hdf5
20559!:ext	h5/hdf5/hdf/he5
20560
20561# From: Tobias Burnus <burnus@net-b.de>
20562# Xara (for a while: Corel Xara) is a graphic package, see
20563# http://www.xara.com/ for Windows and as GPL application for Linux
205640	string	XARA\243\243	Xara graphics file
20565
20566# From:		Joerg Jenderek
20567# URL:		http://fileformats.archiveteam.org/wiki/Corel_Gallery
20568# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/b/bmf-corel.trid.xml
20569# Note:		called "Corel Binary Material Format" by TrID and
20570# 		"Corel Flow" by XnView
205710	string	@CorelBMF\n\rCorel\040Corporation 	Corel GALLERY Clipart
20572!:mime	image/x-corel-bmf
20573!:ext	bmf
20574
20575# https://www.cartesianinc.com/Tech/
20576# Reference:	http://fileformats.archiveteam.org/wiki/Cartesian_Perceptual_Compression
205770	string	CPC\262		Cartesian Perceptual Compression image
20578!:mime	image/x-cpi
20579!:ext	cpi/cpc
20580
20581# From Albert Cahalan <acahalan@gmail.com>
20582# puredigital used it for the CVS disposable camcorder
20583#8       lelong		4       ZBM bitmap image data
20584#>4      uleshort	x       %u x
20585#>6      uleshort	x       %u
20586
20587# From Albert Cahalan <acahalan@gmail.com>
20588# uncompressed 5:6:5 HighColor image for OLPC XO firmware icons
205890       string		C565     OLPC firmware icon image data
20590>4      uleshort	x       %u x
20591>6      uleshort	x       %u
20592
20593# Applied Images - Image files from Cytovision
20594# Gustavo Junior Alves <gjalves@gjalves.com.br>
205950	string	\xce\xda\xde\xfa	Cytovision Metaphases file
205960	string	\xed\xad\xef\xac	Cytovision Karyotype file
205970	string	\x0b\x00\x03\x00	Cytovision FISH Probe file
205980	string	\xed\xfe\xda\xbe	Cytovision FLEX file
205990	string	\xed\xab\xed\xfe	Cytovision FLEX file
206000	string	\xad\xfd\xea\xad	Cytovision RATS file
20601
20602# Wavelet Scalar Quantization format used in gray-scale fingerprint images
20603# From Tano M Fotang <mfotang@quanteq.com>
206040	string	\xff\xa0\xff\xa8\x00	Wavelet Scalar Quantization image data
20605
20606# Type:		PCO B16 image files
20607# URL:		http://www.pco.de/fileadmin/user_upload/db/download/MA_CWDCOPIE_0412b.pdf
20608# From:		Florian Philipp <florian.philipp@binarywings.net>
20609# Extension:	.b16
20610# Description:	Pixel image format produced by PCO Camware, typically used
20611#		together with PCO cameras.
20612# Note:		Different versions exist for e.g. 8 bit and 16 bit images.
20613#		Documentation is incomplete.
206140	string/b	PCO-	PCO B16 image data
20615>12	ulelong		x	\b, %dx
20616>16	ulelong		x	\b%d
20617>20	ulelong		0	\b, short header
20618>20	ulelong		-1	\b, extended header
20619>>24	ulelong		0	\b, grayscale
20620>>>36	ulelong		0	linear LUT
20621>>>36	ulelong		1	logarithmic LUT
20622>>>28	ulelong		x	[%d
20623>>>32	ulelong		x	\b,%d]
20624>>24	ulelong		1	\b, color
20625>>>64	ulelong		0	linear LUT
20626>>>64	ulelong		1	logarithmic LUT
20627>>>40	ulelong		x	r[%d
20628>>>44	ulelong		x	\b,%d]
20629>>>48	ulelong		x	g[%d
20630>>>52	ulelong		x	\b,%d]
20631>>>56	ulelong		x	b[%d
20632>>>60	ulelong		x	\b,%d]
20633
20634# Polar Monitor Bitmap (.pmb) used as logo for Polar Electro watches
20635# From: Markus Heidelberg <markus.heidelberg at web.de>
206360	string/t	[BitmapInfo2]	Polar Monitor Bitmap text
20637!:mime	image/x-polar-monitor-bitmap
20638
20639# From: Rick Richardson <rickrich@gmail.com>
20640# updated by: Joerg Jenderek
20641# URL: http://techmods.net/nuvi/
206420	string	GARMIN\ BITMAP\ 01	Garmin Bitmap file
20643# extension is also used for
20644# Sony SRF raw image (image/x-sony-srf)
20645# SRF map
20646# Terragen Surface Map (https://www.planetside.co.uk/terragen)
20647# FileLocator Pro search criteria file (https://www.mythicsoft.com/filelocatorpro)
20648!:ext srf
20649#!:mime	image/x-garmin-srf
20650# version 1.00,2.00,2.10,2.40,2.50
20651>0x2f	string		>0		\b, version %4.4s
20652# width (2880,2881,3240)
20653>0x55	uleshort	>0		\b, %dx
20654# height (80,90)
20655>>0x53	uleshort	x		\b%d
20656
20657# From:		Joerg Jenderek
20658# URL:		http://fileformats.archiveteam.org/wiki/Imageiio/imaginfo_(Ulead)
20659# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/p/pe3.trid.xml
20660# Note:		called "Ulead Imageiio/Imaginfo thumbnail" by TrID
206610	string	IIO1$			Ulead Photo Explorer 3
20662#!:mime	application/octet-stream
20663!:mime	image/x-ulead-pe3
20664# IMAGEIIO.PE3
20665!:ext	pe3
20666# look for DOS/Windows drive letter
20667>5	search/192/s	:\\
20668# directory or full name of corresponding imaginfo.pe3 like: "T:\SAMPLES\TEXTURES\SKY_SNOW\IIOE371.TMP "S:\PI3\PIMPACT3\PROGRAMS\PATTERNS\imaginfo.pe3"
20669>>&-1	string	x			"%s"
20670# look for DOS/Windows network path if no drive letter part
20671>5	default		x
20672>>5	search/192/s	\x5c\x5c
20673# full name of corresponding imaginfo.pe3 like: "\\Lionking\upi\SAMPLES\IMAGES\ANIMALS\imaginfo.pe3"
20674>>>&0	string	x			"%s"
20675# Type:	Ulead Photo Explorer5 (.pe5)
20676# URL:		http://fileformats.archiveteam.org/wiki/Imageiio/imaginfo_(Ulead)
20677# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/p/pe4.trid.xml
20678# From:	Simon Horman <horms@debian.org>
20679# Update:	Joerg Jenderek
20680# Note:		some called "Ulead Imageiio/Imaginfo thumbnail" by TrID
20681#		and used in various Ulead applications
206820	string	IIO2H			Ulead Photo Explorer 4 or 5
20683#!:mime	application/octet-stream
20684!:mime	image/x-ulead-pe4
20685# IMAGEIIO.PE4
20686!:ext	pe4/pe5
20687# look in most samples for JPEG signature like: SAMPLES/IMAGES/SCENES/IMAGINFO.PE4
20688>0x4c2	search/0xE02/s	JFIF		with JPEG image data
20689>>&-6	use			jpeg
20690# near the end list of image names like: Img0001.pcd 1116012L.JPG NCARD4.TPL
20691#
20692# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/p/pe3-imaginfo.trid.xml
2069311	string	\001\0\0\0\0
20694# check for version 3 part
20695>19	string	\0\001\0\003\0
20696>>0	use	ulead-imaginfo
20697# From:		Joerg Jenderek
20698# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/p/pe4-imaginfo.trid.xml
2069911	string	\001\0\0\0\0
20700# check for version 4 part
20701>19	string	\0\0\0\004\0
20702>>0	use	ulead-imaginfo
20703# display information about Ulead Imaginfo thumbnail (version, directory, image extension)
207040	name	ulead-imaginfo
20705>22	ubyte	x			Ulead Imaginfo thumbnail
20706#!:mime	application/octet-stream
20707!:mime	image/x-ulead-imaginfo
20708>22	ubyte	=3			\b, version 3
20709# IMAGINFO.PE3
20710!:ext	pe3
20711>22	ubyte	=4			\b, version 4
20712# IMAGINFO.PE4
20713!:ext	pe4
20714# MAYBE ALSO VERSION 5 ?
20715#>22	ubyte	=5			\b, version 5
20716#!:ext	pe5
20717>22	ubyte	x
20718# look for DOS/Windows driver letter
20719>>4	search/192/s	:\x5c
20720# skip f:\Programme\iPhoto Plus 4\Template\Business Cards\IMAGINFO.PE4
20721# by looking for driver letter in range A-Z
20722>>>&-1	ubyte	>0x40
20723# directory path like: "E:\iPE\CDSample\Images\Scenes" "D:\XmasCard\Samples" "C:\TEMP\PLANTS"
20724>>>>&-5	pstring/l	>0		\b, "%s"
20725# look for DOS/Windows network path if no valid drive letter part
20726>>>&-1	default		x
20727>>>>4	search/192/s	\x5c\x5c
20728# directory path like: "\\FSX\SYS\OPPS\IPE.ENG\TEMPLATE\BUSINESS" "\\Lionking\upi\SAMPLES\IMAGES\ANIMALS"
20729>>>>>&-4 pstring/l	>0		\b, "%s"
20730# look for DOS/Windows network path if no drive letter part
20731>>4	default		x
20732>>>4	search/192/s	\x5c\x5c
20733# directory path like: "\\FSX\SYS\opps\ipe.eng\samples" "\\DANIEL\IPE_CD\IPE.ITA"
20734>>>>&-4 pstring/l	>0		\b, "%s"
20735# look for point character inside image names
20736>56	search/38/s	.
20737# image name extension like: bmp jpg pcd tpl
20738>>&1	string	x			with %-.3s images
20739# Summary:	Ulead Pattern image (Corel Corporation)
20740# URL:		https://en.wikipedia.org/wiki/Ulead_Systems
20741#		https://www.file-extensions.org/pst-file-extension-ulead-pattern-image-format
20742# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/p/pst-ulead.trid.xml
20743# From:		Joerg Jenderek
20744# Note:		used also by CorelDraw Essentials 3 version 13.0.0.800
20745#		there seems to exist other versions
207460	ubelong		0xFFFF0100
20747>8	search/21	PresetInfo	Ulead pattern image
20748#!:mime	application/octet-stream
20749!:mime	image/x-ulead-pst
20750!:ext	pst
20751# string length like: 16 18 19 21 24
20752#>>4	uleshort	x		n=%u
20753# like: BlendPresetInfo DropShadowPresetInfo FileNewPresetInfo VectorExtrudePresetInfo EnvelopePresetInfo ContourPresetInfo DistortionPresetInfo
20754>>4	pstring/h	x		"%s"
20755
20756# Type:	X11 cursor
20757# URL:	http://webcvs.freedesktop.org/mime/shared-mime-info/freedesktop.org.xml.in?view=markup
20758# From:	Mathias Brodala <info@noctus.net>
207590	string	Xcur			X11 cursor
20760
20761# Type:	Olympus ORF raw images.
20762# URL:	https://libopenraw.freedesktop.org/wiki/Olympus_ORF
20763# From:	Adam Buchbinder <adam.buchbinder@gmail.com>
207640	string		MMOR		Olympus ORF raw image data, big-endian
20765!:mime	image/x-olympus-orf
207660	string		IIRO		Olympus ORF raw image data, little-endian
20767!:mime	image/x-olympus-orf
207680	string		IIRS		Olympus ORF raw image data, little-endian
20769!:mime	image/x-olympus-orf
20770
20771# Type: files used in modern AVCHD camcoders to store clip information
20772# Extension: .cpi
20773# From: Alexander Danilov <alexander.a.danilov@gmail.com>
207740	string	HDMV0100	AVCHD Clip Information
20775
20776# From: Adam Buchbinder <adam.buchbinder@gmail.com>
20777# URL: http://local.wasp.uwa.edu.au/~pbourke/dataformats/pic/
20778# Radiance HDR; usually has .pic or .hdr extension.
207790	string	#?RADIANCE\n	Radiance HDR image data
20780#!mime	image/vnd.radiance
20781
20782# From: Adam Buchbinder <adam.buchbinder@gmail.com>
20783# URL: https://www.mpi-inf.mpg.de/resources/pfstools/pfs_format_spec.pdf
20784# Used by the pfstools packages. The regex matches for the image size could
20785# probably use some work. The MIME type is made up; if there's one in
20786# actual common use, it should replace the one below.
207870	string	PFS1\x0a	PFS HDR image data
20788#!mime	image/x-pfs
20789>1	regex	[0-9]*\ 	\b, %s
20790>>1	regex	\ [0-9]{4}	\bx%s
20791
20792# Type: Foveon X3F
20793# URL:  https://www.photofo.com/downloads/x3f-raw-format.pdf
20794# From: Adam Buchbinder <adam.buchbinder@gmail.com>
20795# Note that the MIME type isn't defined anywhere that I can find; if
20796# there's a canonical type for this format, it should replace this one.
207970	string	FOVb	Foveon X3F raw image data
20798!:mime	image/x-x3f
20799>6	uleshort	x	\b, version %d.
20800>4	uleshort	x	\b%d
20801>28	ulelong		x	\b, %dx
20802>32	ulelong		x	\b%d
20803
20804# Paint.NET file
20805# From Adam Buchbinder <adam.buchbinder@gmail.com>
208060	string	PDN3	Paint.NET image data
20807!:mime	image/x-paintnet
20808
20809# Not really an image.
20810# From: "Tano M. Fotang" <mfotang@quanteq.com>
208110	string	\x46\x4d\x52\x00	ISO/IEC 19794-2 Format Minutiae Record (FMR)
20812
20813# doc: https://www.shikino.co.jp/eng/products/images/FLOWER.jpg.zip
20814# example: https://www.shikino.co.jp/eng/products/images/FLOWER.wdp.zip
2081590	ubequad		0x574D50484F544F00	JPEG-XR Image
20816>98	ubyte&0x08	=0x08			\b, hard tiling
20817>99	ubyte&0x80	=0x80			\b, tiling present
20818>99	ubyte&0x40	=0x40			\b, codestream present
20819>99	ubyte&0x38	x			\b, spatial xform=
20820>99	ubyte&0x38	0x00			\bTL
20821>99	ubyte&0x38	0x08			\bBL
20822>99	ubyte&0x38	0x10			\bTR
20823>99	ubyte&0x38	0x18			\bBR
20824>99	ubyte&0x38	0x20			\bBT
20825>99	ubyte&0x38	0x28			\bRB
20826>99	ubyte&0x38	0x30			\bLT
20827>99	ubyte&0x38	0x38			\bLB
20828>100	ubyte&0x80	=0x80			\b, short header
20829>>102	ubeshort+1	x			\b, %d
20830>>104	ubeshort+1	x			\bx%d
20831>100	ubyte&0x80	=0x00			\b, long header
20832>>102	ubelong+1	x			\b, %x
20833>>106	ubelong+1	x			\bx%x
20834>101	ubeshort&0xf	x			\b, bitdepth=
20835>>101	ubeshort&0xf	0x0			\b1-WHITE=1
20836>>101	ubeshort&0xf	0x1			\b8
20837>>101	ubeshort&0xf	0x2			\b16
20838>>101	ubeshort&0xf	0x3			\b16-SIGNED
20839>>101	ubeshort&0xf	0x4			\b16-FLOAT
20840>>101	ubeshort&0xf	0x5			\b(reserved 5)
20841>>101	ubeshort&0xf	0x6			\b32-SIGNED
20842>>101	ubeshort&0xf	0x7			\b32-FLOAT
20843>>101	ubeshort&0xf	0x8			\b5
20844>>101	ubeshort&0xf	0x9			\b10
20845>>101	ubeshort&0xf	0xa			\b5-6-5
20846>>101	ubeshort&0xf	0xb			\b(reserved %d)
20847>>101	ubeshort&0xf	0xc			\b(reserved %d)
20848>>101	ubeshort&0xf	0xd			\b(reserved %d)
20849>>101	ubeshort&0xf	0xe			\b(reserved %d)
20850>>101	ubeshort&0xf	0xf			\b1-BLACK=1
20851>101	ubeshort&0xf0	x			\b, colorfmt=
20852>>101	ubeshort&0xf0	0x00			\bYONLY
20853>>101	ubeshort&0xf0	0x10			\bYUV240
20854>>101	ubeshort&0xf0	0x20			\bYWV422
20855>>101	ubeshort&0xf0	0x30			\bYWV444
20856>>101	ubeshort&0xf0	0x40			\bCMYK
20857>>101	ubeshort&0xf0	0x50			\bCMYKDIRECT
20858>>101	ubeshort&0xf0	0x60			\bNCOMPONENT
20859>>101	ubeshort&0xf0	0x70			\bRGB
20860>>101	ubeshort&0xf0	0x80			\bRGBE
20861>>101	ubeshort&0xf0	>0x80			\b(reserved %#x)
20862
20863# From: Johan van der Knijff <johan.vanderknijff@kb.nl>
20864#
20865# BPG (Better Portable Graphics) format
20866# https://bellard.org/bpg/
20867# http://fileformats.archiveteam.org/wiki/BPG
20868#
208690	string	\x42\x50\x47\xFB	BPG (Better Portable Graphics)
20870!:mime  image/bpg
20871
20872# From: Joerg Jenderek
20873# URL: https://en.wikipedia.org/wiki/Apple_Icon_Image_format
208740	string		icns		Mac OS X icon
20875!:mime	image/x-icns
20876!:apple	????icns
20877!:ext icns
20878>4	ubelong		>0
20879# file size
20880>>4	ubelong		x		\b, %d bytes
20881# icon type
20882>>8	string		x		\b, "%4.4s" type
20883
20884# TIM images
20885# URL:		http://fileformats.archiveteam.org/wiki/TIM_(PlayStation_graphics)
20886# Reference:	https://mrclick.zophar.net/TilEd/download/timgfx.txt
20887# Update:	Joerg Jenderek
20888# Note:		called as "PSX TIM *bpp bitmap" by bitmap-tim-*.trid.xml
20889#		verified as "TIM PSX" by XnView `nconvert -fullinfo *.tim` and
20890#		by RECOIL `recoil2png -o TMP.PNG input.tim; file TMP.PNG` and often
20891#		as "PSX TIM" by ImageMagick version 7.1.0-10 command `identify *.tim`
20892#		here signed integers are used but according to Kaitai unsigned
208930		ulelong		0x00000010
20894# 32 Flag bits *cttt; c~CLUT flag t~type 000~4BPP 001~8BPP 010~16BPP 011~24BPP 100~Mixed
20895#>4		ulelong  	x		FLAGS=%#x
20896# 12+Size of CLUT (2Ch for 4BPP; 20Ch 40Ch 60Ch 80Ch C0Ch for 8BPP) or
20897# +image data size (800Ch 2000Ch 2580C for 16BPP) (02000003h for dBase memo test.dbt)
20898#>8		ulelong		x		\b, 12+CLUT or data size=%#8.8x
20899# CLUT or data size remainder is 12 (Ch), but 03 for dBase memo test.dbt
20900#>8		ubyte&0x0F	=0x0C		\b, SIZE REMAINDER IS 12
20901# skip dBase III memo test.dbt with invalid flags 22D10189h
20902>4		ulelong&0xffFFffF0	=0	Sony PlayStation PSX image,
20903# file (version 5.40) labeled the above entry as "TIM image"
20904!:mime	image/x-sony-tim
20905!:ext	tim
20906#>>4		ulelong&0x00000007	x	\b, BPP~%u
20907# 4BPP and 8BPP examples exist with CLUT or without CLUT
20908>>4		ulelong&0x07	0x0		4-Bit,
20909>>4		ulelong&0x07	0x1		8-Bit,
20910# 16BPP and 24BPP examples have no CLUT
20911>>4		ulelong  	0x2		15-Bit,
20912>>4		ulelong  	0x3		24-Bit,
20913# no example
20914>>4		ulelong&0x07  	0x4		Mixed-Bit,
20915# CLUT flag set
20916>>4		ulelong 	&8
20917# 12 + size of CLUT like: 1000Ch 800Ch 400Ch 40Ch and 2FEh (KAGE.TIM)
20918#>>>(8.l+8)	ulelong		x		\b, 12+CLUT SIZE=%#8.8x
20919>>>(8.l+12)	uleshort	x		Pixel at (%d,
20920>>>(8.l+14)	uleshort	x		\b%d) Size=
20921# image width (to get actual width multiply by 4 for 4BPP and by 2 for 8BPP)
20922>>>>4		ulelong  	0x8
20923>>>>>(8.l+16)	uleshort*4	x		\b%d
20924>>>>4		ulelong  	0x9
20925>>>>>(8.l+16)	uleshort*2	x		\b%d
20926# image height like: 32 64 128 144 160 208 256
20927>>>(8.l+18)	uleshort	x		\bx%d,
20928>>>4		ulelong 	0x8		16 CLUT Entries at
20929>>>4		ulelong 	0x9		256 CLUT Entries at
20930>>>12		uleshort	x		(%d,
20931>>>14		uleshort	x		\b%d)
20932# no Color LookUp Table (CLUT)
20933>>4		ulelong		^8
20934# image origin X Y
20935>>>12		uleshort	x		Pixel at (%d,
20936>>>14		uleshort	x		\b%d) Size=
20937# real image width = multiply by 4 (4BPP) 2 (8BPP) 1 (16BPP) 2/3 (24BPP)
20938>>>>4		ulelong  	0x0
20939>>>>>16		uleshort*4	x		\b%d
20940>>>>4		ulelong  	0x1
20941>>>>>16		uleshort*2	x		\b%d
20942>>>>4		ulelong  	0x2
20943>>>>>16		uleshort		x		\b%d
20944>>>>4		ulelong  	0x3
20945# GRR: NOT working
20946#>>>>>16		uleshort*2/3	x		\b%d
20947>>>>>16		uleshort		x		\b2/3*%d
20948# mixed format width not explained!
20949>>>>4		ulelong  	0x4
20950>>>>>16		uleshort		x		\b%d
20951# image height like: 64 240 256
20952>>>18		uleshort		x		\bx%d
20953# TIM image data
20954
20955# MDEC streams
209560		ulelong		0x80010160	MDEC video stream,
20957>16		uleshort	x		%dx
20958>18		uleshort	x		\b%d
20959#>8		ulelong		x		%d frames
20960#>4		uleshort	x		secCount=%d;
20961#>6		uleshort	x		nSectors=%d;
20962#>12		ulelong		x		frameSize=%d;
20963
20964# BS encoded bitstreams
209652		uleshort	0x3800		BS image,
20966>6		uleshort	x		Version %d,
20967>4		uleshort	x		Quantization %d,
20968>0		uleshort	x		(Decompresses to %d words)
20969
20970# Type: farbfeld image.
20971# Url: http://tools.suckless.org/farbfeld/
20972# From: Ian D. Scott <ian@iandouglasscott.com>
20973#
209740		string		farbfeld	farbfeld image data,
20975>8		ubelong		x		%dx
20976>12		ubelong		x		\b%d
20977
20978# Type: Microsoft DirectDraw Surface (DXGI formats)
20979# URL:	https://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp
20980# From: Morten Hustveit <morten@debian.org>
20981# Updated by: David Korth <gerbilsoft@gerbilsoft.com>
209820	name	ms-directdraw-dx10
20983>0	ulelong	x	\b, DXGI format:
20984>0	ulelong	1	R32G32B32A32_TYPELESS
20985>0	ulelong	2	R32G32B32A32_FLOAT
20986>0	ulelong	3	R32G32B32A32_UINT
20987>0	ulelong	4	R32G32B32A32_SINT
20988>0	ulelong	5	R32G32B32_TYPELESS
20989>0	ulelong	6	R32G32B32_FLOAT
20990>0	ulelong	7	R32G32B32_UINT
20991>0	ulelong	8	R32G32B32_SINT
20992>0	ulelong	9	R16G16B16A16_TYPELESS
20993>0	ulelong	10	R16G16B16A16_FLOAT
20994>0	ulelong	11	R16G16B16A16_UNORM
20995>0	ulelong	12	R16G16B16A16_UINT
20996>0	ulelong	13	R16G16B16A16_SNORM
20997>0	ulelong	14	R16G16B16A16_SINT
20998>0	ulelong	15	R32G32_TYPELESS
20999>0	ulelong	16	R32G32_FLOAT
21000>0	ulelong	17	R32G32_UINT
21001>0	ulelong	18	R32G32_SINT
21002>0	ulelong	19	R32G8X24_TYPELESS
21003>0	ulelong	20	D32_FLOAT_S8X24_UINT
21004>0	ulelong	21	R32_FLOAT_X8X24_TYPELESS
21005>0	ulelong	22	X32_TYPELESS_G8X24_UINT
21006>0	ulelong	23	R10G10B10A2_TYPELESS
21007>0	ulelong	24	R10G10B10A2_UNORM
21008>0	ulelong	25	R10G10B10A2_UINT
21009>0	ulelong	26	R11G11B10_FLOAT
21010>0	ulelong	27	R8G8B8A8_TYPELESS
21011>0	ulelong	28	R8G8B8A8_UNORM
21012>0	ulelong	29	R8G8B8A8_UNORM_SRGB
21013>0	ulelong	30	R8G8B8A8_UINT
21014>0	ulelong	31	R8G8B8A8_SNORM
21015>0	ulelong	32	R8G8B8A8_SINT
21016>0	ulelong	33	R16G16_TYPELESS
21017>0	ulelong	34	R16G16_FLOAT
21018>0	ulelong	35	R16G16_UNORM
21019>0	ulelong	36	R16G16_UINT
21020>0	ulelong	37	R16G16_SNORM
21021>0	ulelong	38	R16G16_SINT
21022>0	ulelong	39	R32_TYPELESS
21023>0	ulelong	40	D32_FLOAT
21024>0	ulelong	41	R32_FLOAT
21025>0	ulelong	42	R32_UINT
21026>0	ulelong	43	R32_SINT
21027>0	ulelong	44	R24G8_TYPELESS
21028>0	ulelong	45	D24_UNORM_S8_UINT
21029>0	ulelong	46	R24_UNORM_X8_TYPELESS
21030>0	ulelong	47	X24_TYPELESS_G8_UINT
21031>0	ulelong	48	R8G8_TYPELESS
21032>0	ulelong	49	R8G8_UNORM
21033>0	ulelong	50	R8G8_UINT
21034>0	ulelong	51	R8G8_SNORM
21035>0	ulelong	52	R8G8_SINT
21036>0	ulelong	53	R16_TYPELESS
21037>0	ulelong	54	R16_FLOAT
21038>0	ulelong	55	D16_UNORM
21039>0	ulelong	56	R16_UNORM
21040>0	ulelong	57	R16_UINT
21041>0	ulelong	58	R16_SNORM
21042>0	ulelong	59	R16_SINT
21043>0	ulelong	60	R8_TYPELESS
21044>0	ulelong	61	R8_UNORM
21045>0	ulelong	62	R8_UINT
21046>0	ulelong	63	R8_SNORM
21047>0	ulelong	64	R8_SINT
21048>0	ulelong	65	A8_UNORM
21049>0	ulelong	66	R1_UNORM
21050>0	ulelong	67	R9G9B9E5_SHAREDEXP
21051>0	ulelong	68	R8G8_B8G8_UNORM
21052>0	ulelong	69	G8R8_G8B8_UNORM
21053>0	ulelong	70	BC1_TYPELESS
21054>0	ulelong	71	BC1_UNORM
21055>0	ulelong	72	BC1_UNORM_SRGB
21056>0	ulelong	73	BC2_TYPELESS
21057>0	ulelong	74	BC2_UNORM
21058>0	ulelong	75	BC2_UNORM_SRGB
21059>0	ulelong	76	BC3_TYPELESS
21060>0	ulelong	77	BC3_UNORM
21061>0	ulelong	78	BC3_UNORM_SRGB
21062>0	ulelong	79	BC4_TYPELESS
21063>0	ulelong	80	BC4_UNORM
21064>0	ulelong	81	BC4_SNORM
21065>0	ulelong	82	BC5_TYPELESS
21066>0	ulelong	83	BC5_UNORM
21067>0	ulelong	84	BC5_SNORM
21068>0	ulelong	85	B5G6R5_UNORM
21069>0	ulelong	86	B5G5R5A1_UNORM
21070>0	ulelong	87	B8G8R8A8_UNORM
21071>0	ulelong	88	B8G8R8X8_UNORM
21072>0	ulelong	89	R10G10B10_XR_BIAS_A2_UNORM
21073>0	ulelong	90	B8G8R8A8_TYPELESS
21074>0	ulelong	91	B8G8R8A8_UNORM_SRGB
21075>0	ulelong	92	B8G8R8X8_TYPELESS
21076>0	ulelong	93	B8G8R8X8_UNORM_SRGB
21077>0	ulelong	94	BC6H_TYPELESS
21078>0	ulelong	95	BC6H_UF16
21079>0	ulelong	96	BC6H_SF16
21080>0	ulelong	97	BC7_TYPELESS
21081>0	ulelong	98	BC7_UNORM
21082>0	ulelong	99	BC7_UNORM_SRGB
21083>0	ulelong	100	AYUV
21084>0	ulelong	101	Y410
21085>0	ulelong	102	Y416
21086>0	ulelong	103	NV12
21087>0	ulelong	104	P010
21088>0	ulelong	105	P016
21089>0	ulelong	106	420_OPAQUE
21090>0	ulelong	107	YUY2
21091>0	ulelong	108	Y210
21092>0	ulelong	109	Y216
21093>0	ulelong	110	NV11
21094>0	ulelong	111	AI44
21095>0	ulelong	112	IA44
21096>0	ulelong	113	P8
21097>0	ulelong	114	A8P8
21098>0	ulelong	115	B4G4R4A4_UNORM
21099
21100>0	ulelong	116	XBOX_R10G10B10_7E3_A2_FLOAT
21101>0	ulelong	117	XBOX_R10G10B10_6E4_A2_FLOAT
21102>0	ulelong	118	XBOX_D16_UNORM_S8_UINT
21103>0	ulelong	119	XBOX_R16_UNORM_X8_TYPELESS
21104>0	ulelong	120	XBOX_X16_TYPELESS_G8_UINT
21105
21106>0	ulelong	130	DXGI_FORMAT_P208
21107>0	ulelong	131	DXGI_FORMAT_V208
21108>0	ulelong	132	DXGI_FORMAT_V408
21109
21110>0	ulelong	133	ASTC_4X4_TYPELESS
21111>0	ulelong	134	ASTC_4X4_UNORM
21112>0	ulelong	135	ASTC_4X4_UNORM_SRGB
21113>0	ulelong	137	ASTC_5X4_TYPELESS
21114>0	ulelong	138	ASTC_5X4_UNORM
21115>0	ulelong	139	ASTC_5X4_UNORM_SRGB
21116>0	ulelong	141	ASTC_5X5_TYPELESS
21117>0	ulelong	142	ASTC_5X5_UNORM
21118>0	ulelong	143	ASTC_5X5_UNORM_SRGB
21119>0	ulelong	145	ASTC_6X5_TYPELESS
21120>0	ulelong	146	ASTC_6X5_UNORM
21121>0	ulelong	147	ASTC_6X5_UNORM_SRGB
21122>0	ulelong	149	ASTC_6X6_TYPELESS
21123>0	ulelong	150	ASTC_6X6_UNORM
21124>0	ulelong	151	ASTC_6X6_UNORM_SRGB
21125>0	ulelong	153	ASTC_8X5_TYPELESS
21126>0	ulelong	154	ASTC_8X5_UNORM
21127>0	ulelong	155	ASTC_8X5_UNORM_SRGB
21128>0	ulelong	157	ASTC_8X6_TYPELESS
21129>0	ulelong	158	ASTC_8X6_UNORM
21130>0	ulelong	159	ASTC_8X6_UNORM_SRGB
21131>0	ulelong	161	ASTC_8X8_TYPELESS
21132>0	ulelong	162	ASTC_8X8_UNORM
21133>0	ulelong	163	ASTC_8X8_UNORM_SRGB
21134>0	ulelong	165	ASTC_10X5_TYPELESS
21135>0	ulelong	166	ASTC_10X5_UNORM
21136>0	ulelong	167	ASTC_10X5_UNORM_SRGB
21137>0	ulelong	169	ASTC_10X6_TYPELESS
21138>0	ulelong	170	ASTC_10X6_UNORM
21139>0	ulelong	171	ASTC_10X6_UNORM_SRGB
21140>0	ulelong	173	ASTC_10X8_TYPELESS
21141>0	ulelong	174	ASTC_10X8_UNORM
21142>0	ulelong	175	ASTC_10X8_UNORM_SRGB
21143>0	ulelong	177	ASTC_10X10_TYPELESS
21144>0	ulelong	178	ASTC_10X10_UNORM
21145>0	ulelong	179	ASTC_10X10_UNORM_SRGB
21146>0	ulelong	181	ASTC_12X10_TYPELESS
21147>0	ulelong	182	ASTC_12X10_UNORM
21148>0	ulelong	183	ASTC_12X10_UNORM_SRGB
21149>0	ulelong	185	ASTC_12X12_TYPELESS
21150>0	ulelong	186	ASTC_12X12_UNORM
21151>0	ulelong	187	ASTC_12X12_UNORM_SRGB
21152
21153>0	ulelong	190	XBOX_R10G10B10_SNORM_A2_UNORM
21154>0	ulelong	189	XBOX_R4G4_UNORM
21155>0	ulelong	0xFFFFFFFF	DXGI_FORMAT_FORCE_UINT
21156
21157# Type: Microsoft DirectDraw Surface (common data)
21158# URL:	https://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp
21159# From: Morten Hustveit <morten@debian.org>
21160# Updated by: David Korth <gerbilsoft@gerbilsoft.com>
211610	name	ms-directdraw-surface
21162>0x10	ulelong	x			%u x
21163>0x0C	ulelong	x			%u
21164# Color depth.
21165>0x58	ulelong	>0			\b, %u-bit color
21166# Determine the pixel format.
21167>0x50	ulelong&0x4	4
21168# FIXME: Handle DX10 and XBOX formats.
21169>>0x54	string	DX10
21170>>>0x80	use	ms-directdraw-dx10
21171>>0x54	string	!DX10			\b, compressed using %.4s
21172>0x50	ulelong&0x2	0x2		\b, alpha only
21173>0x50	ulelong&0x200	0x200		\b, YUV
21174>0x50	ulelong&0x20000	0x20000		\b, luminance
21175# RGB pixel format
21176>0x50	ulelong&0x40	0x40
21177
21178# Determine the RGB format using the color masks.
21179# ulequad order: 0xGGGGGGGGRRRRRRRR, 0xAAAAAAAABBBBBBBB
21180
21181>>0x58		ulelong	16
21182
21183# NOTE: 15-bit color formats usually have 16-bit listed as the color depth.
21184>>>0x5C		ulequad	0x000003E000007C00
21185>>>>0x64	ulequad 0x000000000000001F	\b, RGB555
21186>>>0x5C		ulequad	0x000003E000001F00
21187>>>>0x64	ulequad 0x000000000000007C	\b, BGR555
21188
21189>>>0x5C		ulequad	0x000007E00000F800
21190>>>>0x64	ulequad 0x000000000000001F	\b, RGB565
21191>>>0x5C		ulequad	0x000007E000001F00
21192>>>>0x64	ulequad 0x00000000000000F8	\b, BGR565
21193
21194>>>0x5C		ulequad	0x000000F000000F00
21195>>>>0x64	ulequad 0x0000F0000000000F	\b, ARGB4444
21196>>>0x5C		ulequad	0x000000F00000000F
21197>>>>0x64	ulequad 0x0000F00000000F00	\b, ABGR4444
21198
21199>>>0x5C		ulequad	0x00000F000000F000
21200>>>>0x64	ulequad 0x0000000F000000F0	\b, RGBA4444
21201>>>0x5C		ulequad	0x00000F00000000F0
21202>>>>0x64	ulequad 0x0000000F0000F000	\b, BGRA4444
21203
21204>>>0x5C		ulequad	0x000000F000000F00
21205>>>>0x64	ulequad 0x000000000000000F	\b, xRGB4444
21206>>>0x5C		ulequad	0x000000F00000000F
21207>>>>0x64	ulequad 0x0000000000000F00	\b, xBGR4444
21208
21209>>>0x5C		ulequad	0x00000F000000F000
21210>>>>0x64	ulequad 0x00000000000000F0	\b, RGBx4444
21211>>>0x5C		ulequad	0x00000F00000000F0
21212>>>>0x64	ulequad 0x000000000000F000	\b, BGRx4444
21213
21214>>>0x5C		ulequad	0x000003E000007C00
21215>>>>0x64	ulequad 0x000080000000001F	\b, ARGB1555
21216>>>0x5C		ulequad	0x000003E000001F00
21217>>>>0x64	ulequad 0x000080000000007C	\b, ABGR1555
21218>>>0x5C		ulequad	0x000007C00000F800
21219>>>>0x64	ulequad 0x000000010000003E	\b, RGBA5551
21220>>>0x5C		ulequad	0x000007C00000003E
21221>>>>0x64	ulequad 0x000000010000F800	\b, BGRA5551
21222
21223>>88		ulelong 24
21224>>>0x5C		ulequad	0x0000FF0000FF0000
21225>>>>0x64	ulequad 0x00000000000000FF	\b, RGB888
21226>>>0x5C		ulequad	0x0000FF00000000FF
21227>>>>0x64	ulequad 0x0000000000FF0000	\b, BGR888
21228
21229>>88		ulelong 32
21230>>>0x5C		ulequad	0x0000FF0000FF0000
21231>>>>0x64	ulequad 0xFF000000000000FF	\b, ARGB8888
21232>>>0x5C		ulequad	0x0000FF00000000FF
21233>>>>0x64	ulequad 0xFF00000000FF0000	\b, ABGR8888
21234
21235>>>0x5C		ulequad	0x00FF0000FF000000
21236>>>>0x64	ulequad 0x000000FF0000FF00	\b, RGBA8888
21237>>>0x5C		ulequad	0x00FF00000000FF00
21238>>>>0x64	ulequad 0x000000FFFF000000	\b, BGBA8888
21239
21240>>>0x5C		ulequad	0x0000FF0000FF0000
21241>>>>0x64	ulequad 0x00000000000000FF	\b, xRGB8888
21242>>>0x5C		ulequad	0x0000FF00000000FF
21243>>>>0x64	ulequad 0x0000000000FF0000	\b, xBGR8888
21244
21245>>>0x5C		ulequad	0x00FF0000FF000000
21246>>>>0x64	ulequad 0x000000000000FF00	\b, RGBx8888
21247>>>0x5C		ulequad	0x00FF00000000FF00
21248>>>>0x64	ulequad 0x00000000FF000000	\b, BGBx8888
21249
21250# Less common 32-bit color formats.
21251>>>0x5C		ulequad	0xFFFF00000000FFFF
21252>>>>0x64	ulequad 0x0000000000000000	\b, G16R16
21253>>>0x5C		ulequad	0x0000FFFFFFFF0000
21254>>>>0x64	ulequad 0x0000000000000000	\b, R16G16
21255
21256>>>0x5C		ulequad	0x000FFC003FF00000
21257>>>>0x64	ulequad 0xC0000000000003FF	\b, A2R10G10B10
21258>>>0x5C		ulequad	0x000FFC00000003FF
21259>>>>0x64	ulequad 0xC00000003FF00000	\b, A2B10G10R10
21260
21261# Type: Microsoft DirectDraw Surface
21262# URL:	https://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp
21263# From: Morten Hustveit <morten@debian.org>
21264# Updated by: David Korth <gerbilsoft@gerbilsoft.com>
212650	string/b	DDS\040\174\000\000\000 Microsoft DirectDraw Surface (DDS):
21266>0	use	ms-directdraw-surface
21267
21268# Type: Sega PVR image.
21269# From: David Korth <gerbilsoft@gerbilsoft.com>
21270# References:
21271# - https://fabiensanglard.net/Mykaruga/tools/segaPVRFormat.txt
21272# - https://github.com/yazgoo/pvrx2png
21273# - https://github.com/nickworonekin/puyotools
21274
21275# Sega PVR header.
212760	name	sega-pvr-image-header
21277>0x0C	uleshort	x	%u x
21278>0x0E	uleshort	x	%u
21279# Image format.
21280>0x08	ubyte	0	\b, ARGB1555
21281>0x08	ubyte	1	\b, RGB565
21282>0x08	ubyte	2	\b, ARGB4444
21283>0x08	ubyte	3	\b, YUV442
21284>0x08	ubyte	4	\b, Bump
21285>0x08	ubyte	5	\b, 4bpp
21286>0x08	ubyte	6	\b, 8bpp
21287# Image data type.
21288>0x09	ubyte	0x01	\b, square twiddled
21289>0x09	ubyte	0x02	\b, square twiddled & mipmap
21290>0x09	ubyte	0x03	\b, VQ
21291>0x09	ubyte	0x04	\b, VQ & mipmap
21292>0x09	ubyte	0x05	\b, 8-bit CLUT twiddled
21293>0x09	ubyte	0x06	\b, 4-bit CLUT twiddled
21294>0x09	ubyte	0x07	\b, 8-bit direct twiddled
21295>0x09	ubyte	0x08	\b, 4-bit direct twiddled
21296>0x09	ubyte	0x09	\b, rectangle
21297>0x09	ubyte	0x0B	\b, rectangular stride
21298>0x09	ubyte	0x0D	\b, rectangular twiddled
21299>0x09	ubyte	0x10	\b, small VQ
21300>0x09	ubyte	0x11	\b, small VQ & mipmap
21301>0x09	ubyte	0x12	\b, square twiddled & mipmap
21302
21303# Sega PVR image.
213040	string	PVRT
21305>0x10	string	DDS\040\174\000\000\000 Sega PVR (Xbox) image:
21306>>0x20	use	ms-directdraw-surface
21307>0x10	ubelong	!0x44445320		Sega PVR image:
21308>>0	use	sega-pvr-image-header
21309
21310# Sega PVR image with GBIX.
213110	string	GBIX
21312>0x10	string	PVRT
21313>>0x10	string	DDS\040\174\000\000\000 Sega PVR (Xbox) image:
21314>>>0x20	use	ms-directdraw-surface
21315>>0x10	ubelong	!0x44445320		Sega PVR image:
21316>>>0x10	use	sega-pvr-image-header
21317>>0x08	ulelong	x	\b, global index = %u
21318
21319# Sega GVR header.
213200	name	sega-gvr-image-header
21321>0x0C	ubeshort	x	%u x
21322>0x0E	ubeshort	x	%u
21323# Image data format.
21324>0x0B	ubyte	0	\b, I4
21325>0x0B	ubyte	1	\b, I8
21326>0x0B	ubyte	2	\b, IA4
21327>0x0B	ubyte	3	\b, IA8
21328>0x0B	ubyte	4	\b, RGB565
21329>0x0B	ubyte	5	\b, RGB5A3
21330>0x0B	ubyte	6	\b, ARGB8888
21331>0x0B	ubyte	8	\b, CI4
21332>0x0B	ubyte	9	\b, CI8
21333>0x0B	ubyte	14	\b, DXT1
21334
21335# Sega GVR image.
213360	string	GVRT	Sega GVR image:
21337>0x10	use	sega-gvr-image-header
21338
21339# Sega GVR image with GBIX.
213400	string	GBIX
21341>0x10	string	GVRT	Sega GVR image:
21342>>0x10	use	sega-gvr-image-header
21343>>0x08	ubelong	x	\b, global index = %u
21344
21345# Sega GVR image with GCIX. (Wii)
213460	string	GCIX
21347>0x10	string	GVRT	Sega GVR image:
21348>>0x10	use	sega-gvr-image-header
21349>>0x08	ubelong	x	\b, global index = %u
21350
21351# Light Field Picture
21352# Documentation: http://optics.miloush.net/lytro/TheFileFormat.aspx
21353# Typical file extensions: .lfp .lfr .lfx
21354
213550	ubelong	0x894C4650
21356>4	ubelong	0x0D0A1A0A
21357>12	ubelong	0x00000000	Lytro Light Field Picture
21358>8	ubelong	x		\b, version %d
21359
21360# Type: Vision Research Phantom CINE Format
21361# URL: https://www.phantomhighspeed.com/
21362# URL2: http://phantomhighspeed.force.com/vriknowledge/servlet/fileField?id=0BEU0000000Cfyk
21363# From: Harry Mallon <hjmallon at gmail.com>
21364#
21365# This has a short "CI" code but the 44 is the size of the struct which is
21366# stable
213670	string	CI
21368>2	uleshort 44		Vision Research CINE Video,
21369>>4	uleshort	0		Grayscale,
21370>>4	uleshort 1		JPEG Compressed,
21371>>4	uleshort 2		RAW,
21372>>6	uleshort x		version %d,
21373>>20	ulelong	x		%d frames,
21374>>48	ulelong	x		%dx
21375>>52	ulelong	x		\b%d
21376
21377# Type: ARRI Raw Image
21378# Info: SMPTE RDD30:2014
21379# From: Harry Mallon <hjmallon at gmail.com>
213800	string ARRI		ARRI ARI image data,
21381>4	ulelong 0x78563412	little-endian,
21382>4 	ulelong 0x12345678	big-endian,
21383>12	ulelong x		version %d,
21384>20	ulelong x 		%dx
21385>24	ulelong x		\b%d
21386
21387# Type: Khronos KTX texture.
21388# From: David Korth <gerbilsoft@gerbilsoft.com>
21389# Reference: https://www.khronos.org/opengles/sdk/tools/KTX/file_format_spec/
21390
21391# glEnum decoding.
21392# NOTE: Only the most common formats are listed here.
213930	name	khronos-ktx-glEnum
21394>0	ulelong	0x1907	\b, RGB
21395>0	ulelong	0x1908	\b, RGBA
21396>0	ulelong	0x1909	\b, LUMINANCE
21397>0	ulelong	0x190A	\b, LUMINANCE_ALPHA
21398>0	ulelong	0x80E1	\b, BGR
21399>0	ulelong	0x80E2	\b, BGRA
21400>0	ulelong	0x83A0	\b, RGB_S3TC
21401>0	ulelong	0x83A1	\b, RGB4_S3TC
21402>0	ulelong	0x83A2	\b, RGBA_S3TC
21403>0	ulelong	0x83A3	\b, RGBA4_S3TC
21404>0	ulelong	0x83A4	\b, RGBA_DXT5_S3TC
21405>0	ulelong	0x83A5	\b, RGBA4_DXT5_S3TC
21406>0	ulelong	0x83F0	\b, COMPRESSED_RGB_S3TC_DXT1_EXT
21407>0	ulelong	0x83F1	\b, COMPRESSED_RGBA_S3TC_DXT1_EXT
21408>0	ulelong	0x83F2	\b, COMPRESSED_RGBA_S3TC_DXT3_EXT
21409>0	ulelong	0x83F3	\b, COMPRESSED_RGBA_S3TC_DXT5_EXT
21410>0	ulelong	0x8D64	\b, ETC1_RGB8_OES
21411>0	ulelong	0x9270	\b, COMPRESSED_R11_EAC
21412>0	ulelong	0x9271	\b, COMPRESSED_SIGNED_R11_EAC
21413>0	ulelong	0x9272	\b, COMPRESSED_RG11_EAC
21414>0	ulelong	0x9273	\b, COMPRESSED_SIGNED_RG11_EAC
21415>0	ulelong	0x9274	\b, COMPRESSED_RGB8_ETC2
21416>0	ulelong	0x9275	\b, COMPRESSED_SRGB8_ETC2
21417>0	ulelong	0x9276	\b, COMPRESSED_RGB8_PUNCHTHROUGH_ALPHA1_ETC2
21418>0	ulelong	0x9277	\b, COMPRESSED_SRGB8_PUNCHTHROUGH_ALPHA1_ETC2
21419>0	ulelong	0x9278	\b, COMPRESSED_RGBA2_ETC2_EAC
21420>0	ulelong	0x9279	\b, COMPRESSED_SRGB8_ALPHA8_ETC2_EAC
21421>0	ulelong	0x93B0	\b, COMPRESSED_RGBA_ASTC_4x4_KHR
21422>0	ulelong	0x93B1	\b, COMPRESSED_RGBA_ASTC_5x4_KHR
21423>0	ulelong	0x93B2	\b, COMPRESSED_RGBA_ASTC_5x5_KHR
21424>0	ulelong	0x93B3	\b, COMPRESSED_RGBA_ASTC_6x5_KHR
21425>0	ulelong	0x93B4	\b, COMPRESSED_RGBA_ASTC_6x6_KHR
21426>0	ulelong	0x93B5	\b, COMPRESSED_RGBA_ASTC_8x5_KHR
21427>0	ulelong	0x93B6	\b, COMPRESSED_RGBA_ASTC_8x6_KHR
21428>0	ulelong	0x93B7	\b, COMPRESSED_RGBA_ASTC_8x8_KHR
21429>0	ulelong	0x93B8	\b, COMPRESSED_RGBA_ASTC_10x5_KHR
21430>0	ulelong	0x93B9	\b, COMPRESSED_RGBA_ASTC_10x6_KHR
21431>0	ulelong	0x93BA	\b, COMPRESSED_RGBA_ASTC_10x8_KHR
21432>0	ulelong	0x93BB	\b, COMPRESSED_RGBA_ASTC_10x10_KHR
21433>0	ulelong	0x93BC	\b, COMPRESSED_RGBA_ASTC_12x10_KHR
21434>0	ulelong	0x93BD	\b, COMPRESSED_RGBA_ASTC_12x12_KHR
21435>0	ulelong	0x93D0	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_4x4_KHR
21436>0	ulelong	0x93D1	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_5x4_KHR
21437>0	ulelong	0x93D2	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_5x5_KHR
21438>0	ulelong	0x93D3	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_6x5_KHR
21439>0	ulelong	0x93D4	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_6x6_KHR
21440>0	ulelong	0x93D5	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_8x5_KHR
21441>0	ulelong	0x93D6	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_8x6_KHR
21442>0	ulelong	0x93D7	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_8x8_KHR
21443>0	ulelong	0x93D8	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x5_KHR
21444>0	ulelong	0x93D9	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x6_KHR
21445>0	ulelong	0x93DA	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x8_KHR
21446>0	ulelong	0x93DB	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x10_KHR
21447>0	ulelong	0x93DC	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_12x10_KHR
21448>0	ulelong	0x93DD	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_12x12_KHR
21449
21450# Endian-specific KTX header.
21451# TODO: glType (all textures I've seen so far are GL_UNSIGNED_BYTE)
214520	name	khronos-ktx-endian-header
21453>20	ulelong	x	\b, %u
21454>24	ulelong	>1	x %u
21455>28	ulelong	>1	x %u
21456>8	ulelong	>0
21457>>8	use	khronos-ktx-glEnum
21458>8	ulelong	0
21459>>12	use	khronos-ktx-glEnum
21460
21461# Main KTX header.
21462# Determine endianness, then check the rest of the header.
214630	string	\xABKTX\ 11\xBB\r\n\x1A\n	Khronos KTX texture
21464>12	ulelong	0x04030201			(little-endian)
21465>>16	use	khronos-ktx-endian-header
21466>12	ubelong	0x04030201			(big-endian)
21467>>16	use	\^khronos-ktx-endian-header
21468
21469# Type: Khronos KTX2 texture.
21470# From: David Korth <gerbilsoft@gerbilsoft.com>
21471# Based on draft19.
21472# Reference: http://github.khronos.org/KTX-Specification/
21473
21474# Supercompression enum.
214750	name	khronos-ktx2-supercompression
21476>0	ulelong	1	BasisLZ
21477>0	ulelong	2	Zstandard
21478>0	ulelong	3	ZLIB
21479
21480# Vulkan format identifier.
21481# NOTE: Formats prohibited from KTX2 are commented out.
214820	name	khronos-ktx2-vkFormat
21483>0	ulelong	0	UNDEFINED
21484>0	ulelong	1	R4G4_UNORM_PACK8
21485>0	ulelong	2	R4G4B4A4_UNORM_PACK16
21486>0	ulelong	3	B4G4R4A4_UNORM_PACK16
21487>0	ulelong	4	R5G6B5_UNORM_PACK16
21488>0	ulelong	5	B5G6R5_UNORM_PACK16
21489>0	ulelong	6	R5G5B5A1_UNORM_PACK16
21490>0	ulelong	7	B5G5R5A1_UNORM_PACK16
21491>0	ulelong	8	A1R5G5B5_UNORM_PACK16
21492>0	ulelong	9	R8_UNORM
21493>0	ulelong	10	R8_SNORM
21494#>0	ulelong	11	R8_USCALED
21495#>0	ulelong	12	R8_SSCALED
21496>0	ulelong	13	R8_UINT
21497>0	ulelong	14	R8_SINT
21498>0	ulelong	15	R8_SRGB
21499>0	ulelong	16	R8G8_UNORM
21500>0	ulelong	17	R8G8_SNORM
21501#>0	ulelong	18	R8G8_USCALED
21502#>0	ulelong	19	R8G8_SSCALED
21503>0	ulelong	20	R8G8_UINT
21504>0	ulelong	21	R8G8_SINT
21505>0	ulelong	22	R8G8_SRGB
21506>0	ulelong	23	R8G8B8_UNORM
21507>0	ulelong	24	R8G8B8_SNORM
21508#>0	ulelong	25	R8G8B8_USCALED
21509#>0	ulelong	26	R8G8B8_SSCALED
21510>0	ulelong	27	R8G8B8_UINT
21511>0	ulelong	28	R8G8B8_SINT
21512>0	ulelong	29	R8G8B8_SRGB
21513>0	ulelong	30	B8G8R8_UNORM
21514>0	ulelong	31	B8G8R8_SNORM
21515#>0	ulelong	32	B8G8R8_USCALED
21516#>0	ulelong	33	B8G8R8_SSCALED
21517>0	ulelong	34	B8G8R8_UINT
21518>0	ulelong	35	B8G8R8_SINT
21519>0	ulelong	36	B8G8R8_SRGB
21520>0	ulelong	37	R8G8B8A8_UNORM
21521>0	ulelong	38	R8G8B8A8_SNORM
21522#>0	ulelong	39	R8G8B8A8_USCALED
21523#>0	ulelong	40	R8G8B8A8_SSCALED
21524>0	ulelong	41	R8G8B8A8_UINT
21525>0	ulelong	42	R8G8B8A8_SINT
21526>0	ulelong	43	R8G8B8A8_SRGB
21527>0	ulelong	44	B8G8R8A8_UNORM
21528>0	ulelong	45	B8G8R8A8_SNORM
21529#>0	ulelong	46	B8G8R8A8_USCALED
21530#>0	ulelong	47	B8G8R8A8_SSCALED
21531>0	ulelong	48	B8G8R8A8_UINT
21532>0	ulelong	49	B8G8R8A8_SINT
21533>0	ulelong	50	B8G8R8A8_SRGB
21534#>0	ulelong	51	A8B8G8R8_UNORM_PACK32
21535#>0	ulelong	52	A8B8G8R8_SNORM_PACK32
21536#>0	ulelong	53	A8B8G8R8_USCALED_PACK32
21537#>0	ulelong	54	A8B8G8R8_SSCALED_PACK32
21538#>0	ulelong	55	A8B8G8R8_UINT_PACK32
21539#>0	ulelong	56	A8B8G8R8_SINT_PACK32
21540#>0	ulelong	57	A8B8G8R8_SRGB_PACK32
21541>0	ulelong	58	A2R10G10B10_UNORM_PACK32
21542>0	ulelong	59	A2R10G10B10_SNORM_PACK32
21543#>0	ulelong	60	A2R10G10B10_USCALED_PACK32
21544#>0	ulelong	61	A2R10G10B10_SSCALED_PACK32
21545>0	ulelong	62	A2R10G10B10_UINT_PACK32
21546>0	ulelong	63	A2R10G10B10_SINT_PACK32
21547>0	ulelong	64	A2B10G10R10_UNORM_PACK32
21548>0	ulelong	65	A2B10G10R10_SNORM_PACK32
21549#>0	ulelong	66	A2B10G10R10_USCALED_PACK32
21550#>0	ulelong	67	A2B10G10R10_SSCALED_PACK32
21551>0	ulelong	68	A2B10G10R10_UINT_PACK32
21552>0	ulelong	69	A2B10G10R10_SINT_PACK32
21553>0	ulelong	70	R16_UNORM
21554>0	ulelong	71	R16_SNORM
21555#>0	ulelong	72	R16_USCALED
21556#>0	ulelong	73	R16_SSCALED
21557>0	ulelong	74	R16_UINT
21558>0	ulelong	75	R16_SINT
21559>0	ulelong	76	R16_SFLOAT
21560>0	ulelong	77	R16G16_UNORM
21561>0	ulelong	78	R16G16_SNORM
21562#>0	ulelong	79	R16G16_USCALED
21563#>0	ulelong	80	R16G16_SSCALED
21564>0	ulelong	81	R16G16_UINT
21565>0	ulelong	82	R16G16_SINT
21566>0	ulelong	83	R16G16_SFLOAT
21567>0	ulelong	84	R16G16B16_UNORM
21568>0	ulelong	85	R16G16B16_SNORM
21569#>0	ulelong	86	R16G16B16_USCALED
21570#>0	ulelong	87	R16G16B16_SSCALED
21571>0	ulelong	88	R16G16B16_UINT
21572>0	ulelong	89	R16G16B16_SINT
21573>0	ulelong	90	R16G16B16_SFLOAT
21574>0	ulelong	91	R16G16B16A16_UNORM
21575>0	ulelong	92	R16G16B16A16_SNORM
21576#>0	ulelong	93	R16G16B16A16_USCALED
21577#>0	ulelong	94	R16G16B16A16_SSCALED
21578>0	ulelong	95	R16G16B16A16_UINT
21579>0	ulelong	96	R16G16B16A16_SINT
21580>0	ulelong	97	R16G16B16A16_SFLOAT
21581>0	ulelong	98	R32_UINT
21582>0	ulelong	99	R32_SINT
21583>0	ulelong	100	R32_SFLOAT
21584>0	ulelong	101	R32G32_UINT
21585>0	ulelong	102	R32G32_SINT
21586>0	ulelong	103	R32G32_SFLOAT
21587>0	ulelong	104	R32G32B32_UINT
21588>0	ulelong	105	R32G32B32_SINT
21589>0	ulelong	106	R32G32B32_SFLOAT
21590>0	ulelong	107	R32G32B32A32_UINT
21591>0	ulelong	108	R32G32B32A32_SINT
21592>0	ulelong	109	R32G32B32A32_SFLOAT
21593>0	ulelong	110	R64_UINT
21594>0	ulelong	111	R64_SINT
21595>0	ulelong	112	R64_SFLOAT
21596>0	ulelong	113	R64G64_UINT
21597>0	ulelong	114	R64G64_SINT
21598>0	ulelong	115	R64G64_SFLOAT
21599>0	ulelong	116	R64G64B64_UINT
21600>0	ulelong	117	R64G64B64_SINT
21601>0	ulelong	118	R64G64B64_SFLOAT
21602>0	ulelong	119	R64G64B64A64_UINT
21603>0	ulelong	120	R64G64B64A64_SINT
21604>0	ulelong	121	R64G64B64A64_SFLOAT
21605>0	ulelong	122	B10G11R11_UFLOAT_PACK32
21606>0	ulelong	123	E5B9G9R9_UFLOAT_PACK32
21607>0	ulelong	124	D16_UNORM
21608>0	ulelong	125	X8_D24_UNORM_PACK32
21609>0	ulelong	126	D32_SFLOAT
21610>0	ulelong	127	S8_UINT
21611>0	ulelong	128	D16_UNORM_S8_UINT
21612>0	ulelong	129	D24_UNORM_S8_UINT
21613>0	ulelong	130	D32_SFLOAT_S8_UINT
21614
21615>0	ulelong	131	BC1_RGB_UNORM_BLOCK
21616>0	ulelong	132	BC1_RGB_SRGB_BLOCK
21617>0	ulelong	133	BC1_RGBA_UNORM_BLOCK
21618>0	ulelong	134	BC1_RGBA_SRGB_BLOCK
21619>0	ulelong	135	BC2_UNORM_BLOCK
21620>0	ulelong	136	BC2_SRGB_BLOCK
21621>0	ulelong	137	BC3_UNORM_BLOCK
21622>0	ulelong	138	BC3_SRGB_BLOCK
21623>0	ulelong	139	BC4_UNORM_BLOCK
21624>0	ulelong	140	BC4_SNORM_BLOCK
21625>0	ulelong	141	BC5_UNORM_BLOCK
21626>0	ulelong	142	BC5_SNORM_BLOCK
21627>0	ulelong	143	BC6H_UFLOAT_BLOCK
21628>0	ulelong	144	BC6H_SFLOAT_BLOCK
21629>0	ulelong	145	BC7_UNORM_BLOCK
21630>0	ulelong	146	BC7_SRGB_BLOCK
21631
21632>0	ulelong	147	ETC2_R8G8B8_UNORM_BLOCK
21633>0	ulelong	148	ETC2_R8G8B8_SRGB_BLOCK
21634>0	ulelong	149	ETC2_R8G8B8A1_UNORM_BLOCK
21635>0	ulelong	150	ETC2_R8G8B8A1_SRGB_BLOCK
21636>0	ulelong	151	ETC2_R8G8B8A8_UNORM_BLOCK
21637>0	ulelong	152	ETC2_R8G8B8A8_SRGB_BLOCK
21638
21639>0	ulelong	153	EAC_R11_UNORM_BLOCK
21640>0	ulelong	154	EAC_R11_SNORM_BLOCK
21641>0	ulelong	155	EAC_R11G11_UNORM_BLOCK
21642>0	ulelong	156	EAC_R11G11_SNORM_BLOCK
21643
21644>0	ulelong	157	ASTC_4x4_UNORM_BLOCK
21645>0	ulelong	158	ASTC_4x4_SRGB_BLOCK
21646>0	ulelong	159	ASTC_5x4_UNORM_BLOCK
21647>0	ulelong	160	ASTC_5x4_SRGB_BLOCK
21648>0	ulelong	161	ASTC_5x5_UNORM_BLOCK
21649>0	ulelong	162	ASTC_5x5_SRGB_BLOCK
21650>0	ulelong	163	ASTC_6x5_UNORM_BLOCK
21651>0	ulelong	164	ASTC_6x5_SRGB_BLOCK
21652>0	ulelong	165	ASTC_6x6_UNORM_BLOCK
21653>0	ulelong	166	ASTC_6x6_SRGB_BLOCK
21654>0	ulelong	167	ASTC_8x5_UNORM_BLOCK
21655>0	ulelong	168	ASTC_8x5_SRGB_BLOCK
21656>0	ulelong	169	ASTC_8x6_UNORM_BLOCK
21657>0	ulelong	170	ASTC_8x6_SRGB_BLOCK
21658>0	ulelong	171	ASTC_8x8_UNORM_BLOCK
21659>0	ulelong	172	ASTC_8x8_SRGB_BLOCK
21660>0	ulelong	173	ASTC_10x5_UNORM_BLOCK
21661>0	ulelong	174	ASTC_10x5_SRGB_BLOCK
21662>0	ulelong	175	ASTC_10x6_UNORM_BLOCK
21663>0	ulelong	176	ASTC_10x6_SRGB_BLOCK
21664>0	ulelong	177	ASTC_10x8_UNORM_BLOCK
21665>0	ulelong	178	ASTC_10x8_SRGB_BLOCK
21666>0	ulelong	179	ASTC_10x10_UNORM_BLOCK
21667>0	ulelong	180	ASTC_10x10_SRGB_BLOCK
21668>0	ulelong	181	ASTC_12x10_UNORM_BLOCK
21669>0	ulelong	182	ASTC_12x10_SRGB_BLOCK
21670>0	ulelong	183	ASTC_12x12_UNORM_BLOCK
21671>0	ulelong	184	ASTC_12x12_SRGB_BLOCK
21672
21673>0	ulelong	1000156000	G8B8G8R8_422_UNORM
21674>0	ulelong	1000156001	B8G8R8G8_422_UNORM
21675>0	ulelong	1000156002	G8_B8_R8_3PLANE_420_UNORM
21676>0	ulelong	1000156003	G8_B8R8_2PLANE_420_UNORM
21677>0	ulelong	1000156004	G8_B8_R8_3PLANE_422_UNORM
21678>0	ulelong	1000156005	G8_B8R8_2PLANE_422_UNORM
21679>0	ulelong	1000156006	G8_B8_R8_3PLANE_444_UNORM
21680>0	ulelong	1000156007	R10X6_UNORM_PACK16
21681>0	ulelong	1000156008	R10X6G10X6_UNORM_2PACK16
21682>0	ulelong	1000156009	R10X6G10X6B10X6A10X6_UNORM_4PACK16
21683>0	ulelong	1000156010	G10X6B10X6G10X6R10X6_422_UNORM_4PACK16
21684>0	ulelong	1000156011	B10X6G10X6R10X6G10X6_422_UNORM_4PACK16
21685>0	ulelong	1000156012	G10X6_B10X6_R10X6_3PLANE_420_UNORM_3PACK16
21686>0	ulelong	1000156013	G10X6_B10X6R10X6_2PLANE_420_UNORM_3PACK16
21687>0	ulelong	1000156014	G10X6_B10X6_R10X6_3PLANE_422_UNORM_3PACK16
21688>0	ulelong	1000156015	G10X6_B10X6R10X6_2PLANE_422_UNORM_3PACK16
21689>0	ulelong	1000156016	G10X6_B10X6_R10X6_3PLANE_444_UNORM_3PACK16
21690>0	ulelong	1000156017	R12X4_UNORM_PACK16
21691>0	ulelong	1000156018	R12X4G12X4_UNORM_2PACK16
21692>0	ulelong	1000156019	R12X4G12X4B12X4A12X4_UNORM_4PACK16
21693>0	ulelong	1000156020	G12X4B12X4G12X4R12X4_422_UNORM_4PACK16
21694>0	ulelong	1000156021	B12X4G12X4R12X4G12X4_422_UNORM_4PACK16
21695>0	ulelong	1000156022	G12X4_B12X4_R12X4_3PLANE_420_UNORM_3PACK16
21696>0	ulelong	1000156023	G12X4_B12X4R12X4_2PLANE_420_UNORM_3PACK16
21697>0	ulelong	1000156024	G12X4_B12X4_R12X4_3PLANE_422_UNORM_3PACK16
21698>0	ulelong	1000156025	G12X4_B12X4R12X4_2PLANE_422_UNORM_3PACK16
21699>0	ulelong	1000156026	G12X4_B12X4_R12X4_3PLANE_444_UNORM_3PACK16
21700>0	ulelong	1000156027	G16B16G16R16_422_UNORM
21701>0	ulelong	1000156028	B16G16R16G16_422_UNORM
21702>0	ulelong	1000156029	G16_B16_R16_3PLANE_420_UNORM
21703>0	ulelong	1000156030	G16_B16R16_2PLANE_420_UNORM
21704>0	ulelong	1000156031	G16_B16_R16_3PLANE_422_UNORM
21705>0	ulelong	1000156032	G16_B16R16_2PLANE_422_UNORM
21706>0	ulelong	1000156033	G16_B16_R16_3PLANE_444_UNORM
21707
21708>0	ulelong	1000054000	PVRTC1_2BPP_UNORM_BLOCK_IMG
21709>0	ulelong	1000054001	PVRTC1_4BPP_UNORM_BLOCK_IMG
21710>0	ulelong	1000054002	PVRTC2_2BPP_UNORM_BLOCK_IMG
21711>0	ulelong	1000054003	PVRTC2_4BPP_UNORM_BLOCK_IMG
21712>0	ulelong	1000054004	PVRTC1_2BPP_SRGB_BLOCK_IMG
21713>0	ulelong	1000054005	PVRTC1_4BPP_SRGB_BLOCK_IMG
21714>0	ulelong	1000054006	PVRTC2_2BPP_SRGB_BLOCK_IMG
21715>0	ulelong	1000054007	PVRTC2_4BPP_SRGB_BLOCK_IMG
21716
21717>0	ulelong	1000066000	ASTC_4x4_SFLOAT_BLOCK_EXT
21718>0	ulelong	1000066001	ASTC_5x4_SFLOAT_BLOCK_EXT
21719>0	ulelong	1000066002	ASTC_5x5_SFLOAT_BLOCK_EXT
21720>0	ulelong	1000066003	ASTC_6x5_SFLOAT_BLOCK_EXT
21721>0	ulelong	1000066004	ASTC_6x6_SFLOAT_BLOCK_EXT
21722>0	ulelong	1000066005	ASTC_8x5_SFLOAT_BLOCK_EXT
21723>0	ulelong	1000066006	ASTC_8x6_SFLOAT_BLOCK_EXT
21724>0	ulelong	1000066007	ASTC_8x8_SFLOAT_BLOCK_EXT
21725>0	ulelong	1000066008	ASTC_10x5_SFLOAT_BLOCK_EXT
21726>0	ulelong	1000066009	ASTC_10x6_SFLOAT_BLOCK_EXT
21727>0	ulelong	1000066010	ASTC_10x8_SFLOAT_BLOCK_EXT
21728>0	ulelong	1000066011	ASTC_10x10_SFLOAT_BLOCK_EXT
21729>0	ulelong	1000066012	ASTC_12x10_SFLOAT_BLOCK_EXT
21730>0	ulelong	1000066013	ASTC_12x12_SFLOAT_BLOCK_EXT
21731
21732# Main KTX2 header.
217330	string	\xABKTX\ 20\xBB\r\n\x1A\n	Khronos KTX2 texture
21734>20	ulelong	x	\b, %u
21735>24	ulelong	>1	x %u
21736>28	ulelong	>1	x %u
21737>32	ulelong	>1	\b, %u layers
21738>36	ulelong	>1	\b, %u faces
21739>40	ulelong	>1	\b, %u mipmaps
21740>44	ulelong	>0	\b,
21741>>44	use	khronos-ktx2-supercompression
21742>12	ulelong	>0	\b,
21743>>12	use	khronos-ktx2-vkFormat
21744
21745# Type: Valve VTF texture.
21746# From: David Korth <gerbilsoft@gerbilsoft.com>
21747# References:
21748# - https://developer.valvesoftware.com/wiki/Valve_Texture_Format
21749
21750# VTF image formats.
217510	name	vtf-image-format
21752>0	ulelong	0	RGBA8888
21753>0	ulelong	1	ABGR8888
21754>0	ulelong	2	RGB888
21755>0	ulelong	3	BGR888
21756>0	ulelong	4	RGB565
21757>0	ulelong	5	I8
21758>0	ulelong	6	IA88
21759>0	ulelong	7	P8
21760>0	ulelong	8	A8
21761>0	ulelong	9	RGB888 (bluescreen)
21762>0	ulelong	10	BGR888 (bluescreen)
21763>0	ulelong	11	ARGB8888
21764>0	ulelong	12	BGRA8888
21765>0	ulelong	13	DXT1
21766>0	ulelong	14	DXT3
21767>0	ulelong	15	DXT5
21768>0	ulelong	16	BGRx8888
21769>0	ulelong	17	BGR565
21770>0	ulelong	18	BGRx5551
21771>0	ulelong	19	BGRA4444
21772>0	ulelong	20	DXT1+A1
21773>0	ulelong	21	BGRA5551
21774>0	ulelong	22	UV88
21775>0	ulelong	23	UVWQ8888
21776>0	ulelong	24	RGBA16161616F
21777>0	ulelong	25	RGBA16161616
21778>0	ulelong	26	UVLX8888
21779
21780# Main VTF header.
217810	string	VTF\0				Valve Texture Format
21782>4	ulelong	x				v%u
21783>8	ulelong	x				\b.%u
21784>0x10	uleshort	x				\b, %u
21785>0x12	uleshort	>1				x %u
21786>4	lequad	0x0000000700000002
21787>>0x3F	uleshort	>1				x %u
21788>0x18	uleshort	>1				\b, %u frames
21789>0x38	ubyte	x				\b, mipmaps: %u
21790>0x34	ulelong	>-1				\b,
21791>>0x34	use	vtf-image-format
21792
21793# Type: Valve VTF3 (PS3) texture.
21794# From: David Korth <gerbilsoft@gerbilsoft.com>
217950	string		VTF3	Valve Texture Format (PS3)
21796>0x14	ubeshort		x	\b, %u
21797>0x16	ubeshort		x	\b x %u
21798>0x10	ubelong&0x2000	0	\b, DXT1
21799>0x10	ubelong&0x2000	0x2000	\b, DXT5
21800
21801# Type: ASTC texture.
21802# From: David Korth <gerbilsoft@gerbilsoft.com>
21803# References:
21804# - https://stackoverflow.com/questions/22600678/determine-internal-format-of-given-astc-compressed-image-through-its-header
21805# - https://stackoverflow.com/a/22682244
218060	ulelong	0x5ca1ab13			ASTC
21807>4	ubyte	x				%u
21808>5	ubyte	x				\bx%u
21809>6	ubyte	>1				\bx%u
21810# X, Y, and Z dimensions are stored as 24-bit LE.
21811# Pretend it's 32-bit and mask off the high byte.
21812>7	ulelong&0x00FFFFFF	x		texture, %u
21813>10	ulelong&0x00FFFFFF	x		x %u
21814>13	ulelong&0x00FFFFFF	>1		x %u
21815
21816# Zebra Metafile graphic
21817# http://www.fileformat.info/format/zbr/egff.htm
218180	ubeshort	0x9a02	Zebra Metafile graphic
21819>2	uleshort 1	(version 1.x)
21820>2	uleshort	2	(version 1.1x or 1.2x)
21821>2	uleshort	3	(version 1.49)
21822>2	uleshort	4	(version 1.50)
21823>4	string	x	(comment = %s)
21824
21825# Microsoft Paint graphic
21826# http://www.fileformat.info/format/mspaint/egff.htm
218270	string	DanM 	icrosoft Paint image data (version 1.x)
21828>4	uleshort	x	(%d
21829>>6	uleshort	x	x %d)
218300	string	LinS 	Microsoft Paint image data (version 2.0)
21831>4	uleshort	x	(%d
21832>>6	uleshort	x	x %d)
21833
21834# reMarkable tablet internal file format (https://www.remarkable.com/)
21835# https://github.com/ax3l/lines-are-beautiful
21836# https://plasma.ninja/blog/devices/remarkable/binary/format/2017/12/26/\
21837#	reMarkable-lines-file-format.html#what-to-do-next
21838# from Axel Huebl
218390		string	reMarkable
21840>11		string	lines
21841>>17		string	with
21842>>>22		string	selections
21843>>>>33		string	and
21844>>>>>37		string	layers
21845>>>>>>43	ulelong	x	reMarkable tablet notebook lines, 1404 x 1872, %x page(s)
21846
21847# newer per-page files for the reMarkable
218480		string	reMarkable
21849>11		string	.lines
21850>>18		string	file,
21851>>>24		string	version=
21852>>>>32		ubyte	x	reMarkable tablet page (v%c), 1404 x 1872,
21853>>>>>43		ulelong	x	%d layer(s)
21854
21855# Type: PVR3 texture.
21856# From: David Korth <gerbilsoft@gerbilsoft.com>
21857# References:
21858# - http://cdn.imgtec.com/sdk-documentation/PVR+File+Format.Specification.pdf
21859
21860# PVR3 pixel formats.
218610	name		pvr3-pixel-format
21862>0	ulelong	0	PVRTC 2bpp RGB
21863>0	ulelong	1	PVRTC 2bpp RGBA
21864>0	ulelong	2	PVRTC 4bpp RGB
21865>0	ulelong	3	PVRTC 4bpp RGBA
21866>0	ulelong	4	PVRTC-II 2bpp
21867>0	ulelong	5	PVRTC-II 4bpp
21868>0	ulelong	6	ETC1
21869>0	ulelong	7	DXT1
21870>0	ulelong	8	DXT2
21871>0	ulelong	9	DXT3
21872>0	ulelong	10	DXT4
21873>0	ulelong	11	DXT5
21874>0	ulelong	12	BC4
21875>0	ulelong	13	BC5
21876>0	ulelong	14	BC6
21877>0	ulelong	15	BC7
21878>0	ulelong	16	UYVY
21879>0	ulelong	17	YUY2
21880>0	ulelong	18	BW1bpp
21881>0	ulelong	19	R9G9B9E5 Shared Exponent
21882>0	ulelong	20	RGBG8888
21883>0	ulelong	21	GRGB8888
21884>0	ulelong	22	ETC2 RGB
21885>0	ulelong	23	ETC2 RGBA
21886>0	ulelong	24	ETC2 RGB A1
21887>0	ulelong	25	EAC R11
21888>0	ulelong	26	EAC RG11
21889>0	ulelong	27	ASTC_4x4
21890>0	ulelong	28	ASTC_5x4
21891>0	ulelong	29	ASTC_5x5
21892>0	ulelong	30	ASTC_6x5
21893>0	ulelong	31	ASTC_6x6
21894>0	ulelong	32	ASTC_8x5
21895>0	ulelong	33	ASTC_8x6
21896>0	ulelong	34	ASTC_8x8
21897>0	ulelong	35	ASTC_10x5
21898>0	ulelong	36	ASTC_10x6
21899>0	ulelong	37	ASTC_10x8
21900>0	ulelong	38	ASTC_10x10
21901>0	ulelong	39	ASTC_12x10
21902>0	ulelong	40	ASTC_12x12
21903>0	ulelong	41	ASTC_3x3x3
21904>0	ulelong	42	ASTC_4x3x3
21905>0	ulelong	43	ASTC_4x4x3
21906>0	ulelong	44	ASTC_4x4x4
21907>0	ulelong	45	ASTC_5x4x4
21908>0	ulelong	46	ASTC_5x5x4
21909>0	ulelong	47	ASTC_5x5x5
21910>0	ulelong	48	ASTC_6x5x5
21911>0	ulelong	49	ASTC_6x6x5
21912>0	ulelong	50	ASTC_6x6x6
21913
219140	string		PVR\x03			PowerVR 3.0 texture:
21915>0x18	ulelong		x	%u x
21916>0x1C	ulelong		x	%u
21917>0x20	ulelong		>1	x %u
21918>0x08	ubyte		x	\b,
21919>0x0C	ulelong		0
21920>>0x08	use	pvr3-pixel-format
21921>0x0C	ulelong		!0
21922>>0x08	ubyte	!0	%c
21923>>>0x0C	ubyte	!0	\b%u
21924>>0x09	ubyte	!0	\b%c
21925>>>0x0D	ubyte	!0	\b%u
21926>>0x0A	ubyte	!0	\b%c
21927>>>0x0E	ubyte	!0	\b%u
21928>>0x0B	ubyte	!0	\b%c
21929>>>0x0F	ubyte	!0	\b%u
21930>0x10	ulelong		1	\b, sRGB
21931>0x04	ulelong&0x02	0x02	\b, premultiplied alpha
21932
219330	string		\x03RVP			PowerVR 3.0 texture: BE,
21934>0x18	ubelong		x	%u x
21935>0x1C	ubelong		x	%u
21936>0x20	ubelong		>1	x %u
21937>0x08	ubyte		x	\b,
21938>0x0C	ubelong		0
21939>>0x08	use	pvr3-pixel-format
21940>0x0C	ubelong		!0
21941>>0x0B	ubyte	!0	%c
21942>>>0x0F	ubyte	!0	\b%u
21943>>0x0A	ubyte	!0	\b%c
21944>>>0x0E	ubyte	!0	\b%u
21945>>0x09	ubyte	!0	\b%c
21946>>>0x0D	ubyte	!0	\b%u
21947>>0x08	ubyte	!0	\b%c
21948>>>0x0C	ubyte	!0	\b%u
21949>0x10	ubelong		1	\b, sRGB
21950>0x04	ubelong&0x02	0x02	\b, premultiplied alpha
21951
21952# Type: Microsoft Xbox XPR0 texture.
21953# From: David Korth <gerbilsoft@gerbilsoft.com>
21954# References:
21955# - https://github.com/Cxbx-Reloaded/Cxbx-Reloaded/blob/develop/src/core/hle/D3D8/XbD3D8Types.h
21956
21957# XPR pixel formats.
219580	name	xbox-xpr-pixel-format
21959>0	ubyte	0x00	L8
21960>0	ubyte	0x01	AL8
21961>0	ubyte	0x02	ARGB1555
21962>0	ubyte	0x03	RGB555
21963>0	ubyte	0x04	ARGB4444
21964>0	ubyte	0x05	RGB565
21965>0	ubyte	0x06	ARGB8888
21966>0	ubyte	0x07	xRGB8888
21967>0	ubyte	0x0B	P8
21968>0	ubyte	0x0C	DXT1
21969>0	ubyte	0x0E	DXT2
21970>0	ubyte	0x0F	DXT4
21971>0	ubyte	0x10	Linear ARGB1555
21972>0	ubyte	0x11	Linear RGB565
21973>0	ubyte	0x12	Linear ARGB8888
21974>0	ubyte	0x13	Linear L8
21975>0	ubyte	0x16	Linear R8B8
21976>0	ubyte	0x17	Linear G8B8
21977>0	ubyte	0x19	A8
21978>0	ubyte	0x1A	A8L8
21979>0	ubyte	0x1B	Linear AL8
21980>0	ubyte	0x1C	Linear RGB555
21981>0	ubyte	0x1D	Linear ARGB4444
21982>0	ubyte	0x1E	Linear xRGB8888
21983>0	ubyte	0x1F	Linear A8
21984>0	ubyte	0x20	Linear A8L8
21985>0	ubyte	0x24	YUY2
21986>0	ubyte	0x25	UYVY
21987>0	ubyte	0x27	L6V5U5
21988>0	ubyte	0x28	V8U8
21989>0	ubyte	0x29	R8B8
21990>0	ubyte	0x2A	D24S8
21991>0	ubyte	0x2B	F24S8
21992>0	ubyte	0x2C	D16
21993>0	ubyte	0x2D	F16
21994>0	ubyte	0x2E	Linear D24S8
21995>0	ubyte	0x2F	Linear F24S8
21996>0	ubyte	0x30	Linear D16
21997>0	ubyte	0x31	Linear F16
21998>0	ubyte	0x32	L16
21999>0	ubyte	0x33	V16U16
22000>0	ubyte	0x35	Linear L16
22001>0	ubyte	0x36	Linear V16U16
22002>0	ubyte	0x37	Linear L6V5U5
22003>0	ubyte	0x38	RGBA5551
22004>0	ubyte	0x39	RGBA4444
22005>0	ubyte	0x3A	QWVU8888
22006>0	ubyte	0x3B	BGRA8888
22007>0	ubyte	0x3C	RGBA8888
22008>0	ubyte	0x3D	Linear RGBA5551
22009>0	ubyte	0x3E	Linear RGBA4444
22010>0	ubyte	0x3F	Linear ABGR8888
22011>0	ubyte	0x40	Linear BGRA8888
22012>0	ubyte	0x41	Linear RGBA8888
22013>0	ubyte	0x64	Vertex Data
22014
220150	string		XPR0	Microsoft Xbox XPR0 texture
22016>0x19	ubyte	x	\b, format:
22017>>0x19	use	xbox-xpr-pixel-format
22018
22019# ILDA Image Data Transfer Format
22020# https://www.ilda.com/resources/StandardsDocs/ILDA_IDTF14_rev011.pdf
22021#
22022# Updated by Chuck Hein (laser@geekdude.com)
22023#
220240	string		ILDA	ILDA Image Data Transfer Format
22025>7	ubyte		0x00	3D Coordinates with Indexed Color
22026>7	ubyte		0x01	2D Coordinates with Indexed Color
22027>7	ubyte		0x02	Color Palette
22028>7	ubyte		0x04	3D Coordinates with True Color
22029>7	ubyte		0x05	2D Coordinates with True Color
22030>8	string		>0	\b, palette %s
22031>16	string		>0	\b, company %s
22032>24	ubeshort	>0	\b, number of records %d
22033>>26	ubeshort	x	\b, palette number %d
22034>>28	ubeshort	>0	\b, number of frames %d
22035>>30	ubyte		>0	\b, projector number %d
22036
22037# Dropbox "lepton" compressed jpeg format
22038# https://github.com/dropbox/lepton
220390	ubelong&0xfffff0ff	0xcf84005a	Lepton image file
22040>2	ubyte			x		(version %d)
22041
22042# Apple QuickTake camera raw images
22043# https://en.wikipedia.org/wiki/Apple_QuickTake
22044# dcraw can decode them
220450	name quicktake
22046>4	ubelong		8
22047>>544	ubeshort	x	\b, %dx
22048>>546	ubeshort	x	\b%d
22049>4	ubelong		4
22050>>546	ubeshort	x	\b, %dx
22051>>544	ubeshort	x	\b%d
22052
220530	string	qktk	Apple QuickTake 100 Raw Image
22054>0	use quicktake
22055
220560	string	qktn
22057>4	ubyte	0	Apple QuickTake 150 Raw Image
22058>4	ubyte	>0	Apple QuickTake 200 Raw Image
22059>0	use quicktake
22060
22061# From:		Joerg Jenderek
22062# URL:		http://fileformats.archiveteam.org/wiki/Corel_Photo-Paint_image
22063# Reference:	http://blog.argasinski.eu/wp-content/uploads/2011/08/cpt-specification-0.01.pdf
220640	string	CPT
22065>4	string	FILE		Corel Photo-Paint image, version
22066# version like 7, 9 or 8
22067>>3	ubyte	x		%c,
22068!:mime	image/x-corel-cpt
22069!:ext	cpt
22070# if blocks_array_offset available jump blockNumber*8 bytes
22071>>0x34	ulelong		>0
22072>>>(0x28.l*8)	ubyte	x
22073# jump additional stored blocks_array_offset bytes forward to object block
22074>>>>&(0x34.l-1) ulelong x	%u
22075# object height in pixels
22076>>>>>&0		ulelong	x	x %u
22077# if no blocks_array_offset available jump blockNumber*8 bytes
22078>>0x34	ulelong		=0
22079>>>(0x28.l*8)	ubyte	x
22080# jump additional 0x13C bytes forward to object block
22081>>>>&0x13B	ulelong x	%u
22082>>>>>&0	ulelong		x	x %u
22083# image color model used
22084>>0x8	ulelong	x
22085>>>0x8	ulelong	0x1		RGB 24 bits
22086>>>0x8	ulelong	0x3		CMYK 24 bits
22087>>>0x8	ulelong	0x5		greyscale 8 bits
22088>>>0x8	ulelong	0x6		black and white 1 bit
22089>>>0x8	ulelong	0xA		RGB 8 bits
22090# palette_length  number of colors * 3 in case of 8-bit RGB paletted image
22091# 0 otherwise. Allowed values: 0 or [1..256] * 3
22092#>>0xC	ulelong	>0		\b, palette length %u
22093>>>>0xC	ulelong/3	<256	\b, %u colors
22094>>>0x8	ulelong	0xB		LAB
22095>>>0x8	ulelong	0xC		RGB 48 bits
22096>>>0x8	ulelong	0xE		greyscale 16 bits
22097# this should not happen
22098>>>0x8	default	x		color model
22099>>>>0x8	ulelong	x		%#x
22100# bit 1 in CPT file flags: UCS-2 file comment present
22101>>0x31	ubyte		&0x02
22102# look for comment marker
22103>>>0x100	search/0xc9d	\4\2\0\0
22104# UCS-2 file comment
22105>>>>&0		lestring16	x	"%s"
22106# if no UCS-2 is present show ANSI file comment[112] if available
22107>>0x31	ubyte&0x02	=0
22108>>>0x3C string		>\0	"%-.112s"
22109# reserved seems to be always 0
22110#>>0x10	ulelong		>0	\b, reserved1 %u
22111# horizontal real dpi = dpi_h * 25.4 / 10**6
22112>>0x18	ulelong	x		\b, %u micro dots/mm
22113# image vertical DPI in CPT DPI unit
22114#>>0x1C	ulelong	x		\b, %u micro dots/mm
22115# reserved seems to be always 0
22116#>>0x20	ulelong		>0	\b, reserved2 %u
22117#>>0x24	ulelong		>0	\b, reserved3 %u
22118# blocks_count; number of CPT_Block blocks. Allowed values: > 0
22119>>0x28	ulelong		x	\b, %u block
22120# plural s
22121>>0x28	ulelong		!1	\bs
22122# CPT file flags
22123# lower byte of CPT file flags: 0x94~CPT9FILE 0x01~often CPT7FILE 0x8C~CPT8FILE
22124#>>0x30	ubyte		x	\b, lower flags %#x
22125# upper byte of CPT file flags:
22126#>>0x31	ubyte		>0	\b, upper flags %#x
22127# bit 2 in CPT file flags: unknown
22128#>>0x31	ubyte		&0x04	\b, with UNKNOWN
22129# bits 3-7 in CPT file flags: unknown, seem to be often 0
22130# show unusual flag combinations
22131>>0x31	ubyte&0xFC	>0
22132>>>0x30	uleshort	x	\b, flags %#4.4x
22133# reserved seems to be always 0
22134#>>0x32	uleshort	>0	\b, reserved4 %#x
22135# blocks_array_offset is always 0 for CPT7 and CPT8 files created by PP7-PP8
22136# typical values like: 13Ch 154h 43Ch 4F0h DA8h
22137>>0x34	ulelong	x		\b, array offset %#x
22138# reserved seems to be often 0
22139>>0x38	ulelong		>0	\b, reserved5 %#x
22140# possible next master block
22141#>>0x100	ubequad		!0	\b, next block=%#llx...
22142# bit 0: ICC profile block present
22143>>0x31	ubyte		&0x01	\b, with ICC profile
22144# check for characteristic string acsp of color profile for DEBUGGING
22145#>>>0x178	string	x	icc=%.4s
22146#	display ICC/ICM color profile by ./icc
22147#>>>0x154	use		color-profile
22148
22149# Type: Crunch compressed texture.
22150# From: David Korth <gerbilsoft@gerbilsoft.com>
22151# References:
22152# - https://github.com/BinomialLLC/crunch/blob/44c8402e24441c7524ca364941fd224ab3b971e9/inc/crn_decomp.h#L267
221530	ubelong		0x4878004A	Crunch compressed texture:
22154>0x0C	ubeshort	x	%u x
22155>0x0E	ubeshort	x	%u
22156>0x12	ubyte		0	\b, DXT1
22157>0x12	ubyte		1	\b, DXT3
22158>0x12	ubyte		2	\b, DXT5
22159>0x12	ubyte		3	\b, DXT5 CCxY
22160>0x12	ubyte		4	\b, DXT5 xGxR
22161>0x12	ubyte		5	\b, DXT5 xGBR
22162>0x12	ubyte		6	\b, DXT5 AGBR
22163>0x12	ubyte		7	\b, DXn XY
22164>0x12	ubyte		8	\b, DXn YX
22165>0x12	ubyte		9	\b, DXT5 Alpha
22166>0x12	ubyte		10	\b, ETC1
22167>0x10	ubyte		>1	\b, %u images
22168>0x11	ubyte		>1	\b, %u faces
22169# TODO: Flags at 0x13? (ubeshort)
22170
22171# Type: BasisLZ compressed texture.
22172# From: David Korth <gerbilsoft@gerbilsoft.com>
22173# References:
22174# - https://github.com/BinomialLLC/basis_universal/blob/master/spec/basis_spec.txt
221750	uleshort		0x4273
22176>0x04	uleshort		0x4D	BasisLZ
22177>>0x02	uleshort		x	v%x compressed texture:
22178>>0x14	ubyte			0	ETC1S
22179>>0x14	ubyte			1	UASTC 4x4
22180>>0x0E	ulelong&0xFFFFFF	>1	\b, %u slices
22181>>0x11	ulelong&0xFFFFFF	>1	\b, %u images
22182>>0x15	uleshort&0x02		2	\b, Y-flipped
22183
22184# MIME registration: https://www.iana.org/assignments/media-types/model/e57
22185# Sample files: http://www.libe57.org/data.html
22186# Reference implementation: http://www.libe57.org/
22187# https://www.ri.cmu.edu/pub_files/2011/1/2011-huber-e57-v3.pdf
221880	string		ASTM-E57	ASTM E57 three-dimensional model
22189!:mime model/e57
22190!:ext e57
22191
22192# QOI [Quite OK Image Format] images
22193# (Horia Mihai David, mihaidavid@posteo.net)
22194#
22195# QOI format by Dominic Szablewski <http://phoboslab.org/>
22196#           <https://qoiformat.org/>
22197#
22198# Based on spec v1.0 (2022.01.05) <https://qoiformat.org/qoi-specification.pdf>
22199
222000	string		qoif	QOI image data
22201!:ext qoi
22202!:mime image/x-qoi
22203# See <https://github.com/phoboslab/qoi/issues/167>
22204>4      ubelong		x       %ux
22205>8      ubelong		x       \b%u,
22206>>13	ubyte		0	s
22207>>>12	ubyte		3	\bRGB
22208>>>12	ubyte		4	\bRGBA
22209>>>12	default		x
22210>>>>12	ubyte		x	\b*bad channels %u*
22211>>>13	ubyte		0	(linear alpha)
22212>>13	ubyte		1
22213>>>12	ubyte		3	RGB
22214>>>12	ubyte		4	RGBA
22215>>>13	ubyte		1	(all channels linear)
22216>>13	default		x
22217>>>13	ubyte		x	*bad colorspace %u*
22218
22219
22220# Type: Godot 3, 4 texture (pixel format)
22221# From: David Korth <gerbilsoft@gerbilsoft.com>
222220	name	godot-pixel-format
22223>0	ulelong&0xFFFFF	0	L8
22224>0	ulelong&0xFFFFF	1	LA8
22225>0	ulelong&0xFFFFF	2	R8
22226>0	ulelong&0xFFFFF	3	RG8
22227>0	ulelong&0xFFFFF	4	RGB8
22228>0	ulelong&0xFFFFF	5	RGBA8
22229>0	ulelong&0xFFFFF	6	RGBA4444
22230>0	ulelong&0xFFFFF	7	RGB565
22231>0	ulelong&0xFFFFF	8	RF
22232>0	ulelong&0xFFFFF	9	RGF
22233>0	ulelong&0xFFFFF	10	RGBF
22234>0	ulelong&0xFFFFF	11	RGBAF
22235>0	ulelong&0xFFFFF	12	RH
22236>0	ulelong&0xFFFFF	13	RGH
22237>0	ulelong&0xFFFFF	14	RGBH
22238>0	ulelong&0xFFFFF	15	RGBAH
22239>0	ulelong&0xFFFFF	16	RGBE9995
22240>0	ulelong&0xFFFFF	17	DXT1
22241>0	ulelong&0xFFFFF	18	DXT3
22242>0	ulelong&0xFFFFF	19	DXT5
22243>0	ulelong&0xFFFFF	20	RGTC_R
22244>0	ulelong&0xFFFFF	21	RGTC_RG
22245>0	ulelong&0xFFFFF	22	BPTC_RGBA
22246>0	ulelong&0xFFFFF	23	BPTC_RGBF
22247>0	ulelong&0xFFFFF	24	BPTC_RGBFU
22248>0	ulelong&0xFFFFF	25	PVRTC1_2
22249>0	ulelong&0xFFFFF	26	PVRTC1_2A
22250>0	ulelong&0xFFFFF	27	PVRTC1_4
22251>0	ulelong&0xFFFFF	28	PVRTC1_4A
22252>0	ulelong&0xFFFFF	29	ETC
22253>0	ulelong&0xFFFFF	30	ETC2_R11
22254>0	ulelong&0xFFFFF	31	ETC2_R11S
22255>0	ulelong&0xFFFFF	32	ETC2_RG11
22256>0	ulelong&0xFFFFF	33	ETC2_RG11S
22257>0	ulelong&0xFFFFF	34	ETC2_RGB8
22258>0	ulelong&0xFFFFF	35	ETC2_RGBA8
22259>0	ulelong&0xFFFFF	36	ETC2_RGB8A1
22260>0	ulelong&0xFFFFF	37	ASTC_8x8
22261
22262# Type: Godot 3, 4 texture (rescale display, width)
22263# From: David Korth <gerbilsoft@gerbilsoft.com>
22264# Shows rescale value if it's not a power of 2.
222650	name	godot-rescale-display-w
22266>0	uleshort	0
22267>0	uleshort	1
22268>0	uleshort	2
22269>0	uleshort	4
22270>0	uleshort	8
22271>0	uleshort	16
22272>0	uleshort	32
22273>0	uleshort	64
22274>0	uleshort	128
22275>0	uleshort	256
22276>0	uleshort	512
22277>0	uleshort	1024
22278>0	uleshort	2048
22279>0	uleshort	4096
22280>0	uleshort	8192
22281>0	uleshort	16384
22282>0	uleshort	32768
22283>0	default		x
22284>>0	uleshort	x	(rescale to %u x
22285
22286# Type: Godot 3, 4 texture (rescale display, height)
22287# From: David Korth <gerbilsoft@gerbilsoft.com>
22288# Shows rescale value if it's not a power of 2.
222890	name	godot-rescale-display-h
22290>0	clear	x
22291>0	uleshort	0
22292>0	uleshort	1
22293>0	uleshort	2
22294>0	uleshort	4
22295>0	uleshort	8
22296>0	uleshort	16
22297>0	uleshort	32
22298>0	uleshort	64
22299>0	uleshort	128
22300>0	uleshort	256
22301>0	uleshort	512
22302>0	uleshort	1024
22303>0	uleshort	2048
22304>0	uleshort	4096
22305>0	uleshort	8192
22306>0	uleshort	16384
22307>0	uleshort	32768
22308>0	default		x
22309>>0	uleshort	x	%u)
22310
22311# Type: Godot 3 texture
22312# From: David Korth <gerbilsoft@gerbilsoft.com>
22313# References:
22314# - https://github.com/godotengine/godot/blob/3.3/core/image.h
22315# - https://github.com/godotengine/godot/blob/3.3/scene/resources/texture.cpp
22316# - https://github.com/godotengine/godot/blob/3.3/scene/resources/texture.h
22317# TODO: Don't show "rescale to" if it matches the image size.
223180	string	GDST	Godot 3 texture:
22319!:ext	stex
22320!:mime	image/x-godot-stex
22321>4	uleshort	x	%u x
22322>8	uleshort	x	%u
22323>6	uleshort	0	\b,
22324>6	uleshort	!0
22325>>6	use	godot-rescale-display-w
22326>>10	use	godot-rescale-display-h
22327>>10	uleshort	x	\b,
22328>16	ulelong&0x800000	!0		has mipmaps,
22329>16	ulelong&0x100000	0x100000	lossless encoding
22330>16	ulelong&0x200000	0x200000	lossy encoding
22331>16	ulelong&0x300000	0
22332>>16	use	godot-pixel-format
22333
22334# Type: Godot 4 texture
22335# From: David Korth <gerbilsoft@gerbilsoft.com>
22336# References:
22337# - https://github.com/godotengine/godot/blob/master/core/io/image.h
22338# - https://github.com/godotengine/godot/blob/master/scene/resources/texture.cpp
22339# - https://github.com/godotengine/godot/blob/master/scene/resources/texture.h
22340# TODO: Don't show "rescale to" if it matches the image size.
223410	string	GST2	Godot 4 texture
22342!:ext	stex
22343!:mime	image/x-godot-stex
22344>4	ulelong		x	v%u:
22345>0x28	uleshort	x	%u x
22346>0x2A	uleshort	x	%u
22347>8	use	godot-rescale-display-w
22348>12	use	godot-rescale-display-h
22349>12	uleshort	x	\b,
22350>0x2C	ulelong		>1	%u mipmaps,
22351>0x30	use	godot-pixel-format
22352>0x24	ulelong		1	\b, embedded PNG image
22353>0x24	ulelong		2	\b, embedded WebP image
22354>0x24	ulelong		3	\b, Basis Universal
22355
22356# Summary:	iCEDraw graphic *.IDF
22357# URL:		http://fileformats.archiveteam.org/wiki/ICEDraw
22358# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/i/idf-icedraw.trid.xml
22359# From:		Joerg Jenderek
22360# Note:		called "iCEDraw graphic" by TrID, "iCEDraw text" by FFmpeg and "iCE Draw" by Ansilove
22361#		verified by FFmpeg command `ffprobe ICE-9605.IDF` and `ansilove -s SQ-FORCE.IDF`
223620	string		\0041.4\0\0\0\0O\0	iCEDraw graphic
22363#!:mime	application/octet-stream
22364!:mime	image/x-idf
22365!:ext	idf
22366
22367#------------------------------------------------------------------------------
22368# $File: inform,v 1.5 2009/09/19 16:28:09 christos Exp $
22369# inform:  file(1) magic for Inform interactive fiction language
22370
22371# URL:  http://www.inform-fiction.org/
22372# From: Reuben Thomas <rrt@sc3d.org>
22373
223740	search/100/cW	constant\ story		Inform source text
22375
22376#------------------------------------------------------------------------------
22377# $File: intel,v 1.22 2022/04/02 14:47:42 christos Exp $
22378# intel:  file(1) magic for x86 Unix
22379#
22380# Various flavors of x86 UNIX executable/object (other than Xenix, which
22381# is in "microsoft").  DOS is in "msdos"; the ambitious soul can do
22382# Windows as well.
22383#
22384# Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and
22385# whatever comes next (HP-PA Hummingbird?).  OS/2 may also go elsewhere
22386# as well, if, as, and when IBM makes it portable.
22387#
22388# The `versions' should be un-commented if they work for you.
22389# (Was the problem just one of endianness?)
22390#
223910	leshort		0502		basic-16 executable
22392>12	lelong		>0		not stripped
22393#>22	leshort		>0		- version %d
223940	leshort		0503		basic-16 executable (TV)
22395>12	lelong		>0		not stripped
22396#>22	leshort		>0		- version %d
223970	leshort		0510		x86 executable
22398>12	lelong		>0		not stripped
223990	leshort		0511		x86 executable (TV)
22400>12	lelong		>0		not stripped
224010	leshort		=0512		iAPX 286 executable small model (COFF)
22402>12	lelong		>0		not stripped
22403#>22	leshort		>0		- version %d
224040	leshort		=0522		iAPX 286 executable large model (COFF)
22405>12	lelong		>0		not stripped
22406#>22	leshort		>0		- version %d
22407# updated by Joerg Jenderek at Oct 2015
22408# https://de.wikipedia.org/wiki/Common_Object_File_Format
22409# http://www.delorie.com/djgpp/doc/coff/filhdr.html
22410# ./msdos (version 5.25) labeled the next entry as "MS Windows COFF Intel 80386 object file"
22411# ./intel (version 5.25) label labeled the next entry as "80386 COFF executable"
22412# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan
224130	leshort		=0514
22414# use subroutine to display name+flags+variables for common object formatted files
22415>0	use				display-coff
22416#>12	lelong		>0		not stripped
22417# no hint found, that at offset 22 is version
22418#>22	leshort		>0		- version %d
224190	leshort		0x0200
22420# no F_EXEC flag bit implies Intel ia64 COFF object file without optional header
22421>18	leshort		^0x0002
22422# skip some DEGAS high-res uncompressed bitmap *.pi3 handled by ./images like
22423# GEMINI03.PI3 MODEM2.PI3 POWERFIX.PI3 sigirl1.pi3 vanna5.pi3
22424# by test for valid starting character (often point 0x2E) of 1st section name
22425>>20	ubyte		>0x1F
22426>>>0	use				display-coff
22427# F_EXEC flag bit implies Intel ia64 COFF executable
22428>18	leshort		&0x0002
22429>>0	use				display-coff
224300	leshort		0x8664
22431>0	use				display-coff
22432
22433# rom: file(1) magic for BIOS ROM Extensions found in intel machines
22434#      mapped into memory between 0xC0000 and 0xFFFFF
22435# From: Alex Myczko <alex@aiei.ch>
22436# updated by Joerg Jenderek
22437# https://en.wikipedia.org/wiki/Option_ROM
22438# URL:		http://fileformats.archiveteam.org/wiki/BIOS
22439# Reference:	http://www.lejabeach.com/sisubb/BIOS_Disassembly_Ninjutsu_Uncovered.pdf
224400	beshort		0x55AA
22441# skip misidentified raspberry pi pieeprom-*.bin by check for
22442# unlikely high ROM size (0xF0*512=240*512) and not observed start instruction 0x0F
22443>2	ubeshort	!0xF00F
22444# skip 2 byte sized eof.bin with start magic
22445>>0	use		rom-x86
224460	name		rom-x86
22447>0	beshort		x		BIOS (ia32) ROM Ext.
22448#!:mime	application/octet-stream
22449!:mime	application/x-ibm-rom
22450!:ext	rom/bin
22451################################################################################
22452# not Plug aNd Play ($PnP) like 00000000 (ide_xtp.bin kvmvapic.bin V7VGA.ROM) 000000fc (MCT-VGA.bin)
22453# 55aaf00f (pieeprom-*.bin) 55aa40e9 (Trm3x5.bin) 24506f4f (sgabios-bin.rom)
22454# 55aa4be9 (vgabios-stdvga.rom vgabios-cirrus-bin.rom vgabios-vmware-bin.rom)
22455>(26.s)	ubelong		!0x24506e50
22456#>(26.s)	ubelong		!0x24506e50	NOT PNP=%8.8x
22457# also not PCI (PCIR) implies "old" ISA cards or foo like: 8a168404 (MCT-VGA.bin)
22458# 55aaf00f (pieeprom*.bin)
22459>>(24.s)	ubelong	!0x50434952
22460#>>(24.s)	ubelong	!0x50434952	ISA CARD=%8.8x
22461# "old" identification strings used in file version 5.41 and earlier
22462# probably an USB controller
22463>>>5	string		USB		USB
22464# probably	https://en.wikipedia.org/wiki/Preboot_Execution_Environment
22465>>>7	string		LDR		UNDI image
22466# probably another Adaptec SCSI controller
22467>>>26	string		Adaptec		Adaptec
22468# http://minuszerodegrees.net/rom/bin/adaptec_aha1542cp_bios_908501-00.bin
22469# already done by PNP variant
22470#>>>28	string		Adaptec		Adaptec
22471# probably Promise SCSI controller
22472>>>42	string		PROMISE		Promise
22473# old test for IBM compatible Video cards; INTERNAL FACTS WHY IS THIS WORKING?
22474>30      string          IBM          IBM comp. Video
22475# display exact text for IBM compatible Video cards with longer text
22476>>33	ubyte		!0
22477>>>30	string		x		"%s"
22478# http://minuszerodegrees.net/rom/bin/unknown/MCT-VGA-16%20-%20TDVGA%203588%20BIOS%20Version%20V1.04A.zip
22479# "IBM COMPATIBLETDVGA 3588 BIOS Version V1.04A2+"	"MCT-VGA-16 - TDVGA 3588 BIOS Version V1.04A.bin"
22480# "IBM VGA Compatible\001"				NVidia44.bin
22481# "IBM EGA ROM Video Seven BIOS Code, Version 1.04"	V7VGA.ROM
22482# "IBM"							vgabios-stdvga.rom
22483# "IBM"							vgabios-vmware-bin.rom:
22484# "IBM"							vgabios-cirrus-bin.rom
22485# "IBM"							vgabios-virtio-bin.rom
22486################################################################################
22487# ROM size in 512B blocks must be interpreted as unsigned for ROM of network cards
22488# like: efi-eepro100.rom efi-rtl8139.rom pxe-e1000.rom
22489>2       ubyte            x            (%u*512)
22490# file name		file size	calculated size	remark
22491# eof.bin		2		-		with start magic nothing is shown here
22492# orchid.bin		188		0	=0*512	on window 95 CD in Drivers\audio\orchid3d
22493# multiboot.bin		1024		1024	=2*512	QEMU emulator
22494# loader1.bin		512		2048	=4*512
22495# ide_xtp.bin		8192		8192	=16*512
22496# kvmvapic.bin		9216		9216	=18*512
22497# V7VGA.ROM		18832		16384	=32*512
22498# adaptec1542.bin	32768		16384	=32*512
22499# MCT-VGA.bin		32768		24576	=48*512
22500# 2975BIOS.BIN		32768		32256	=63*512
22501# efi-e1000.rom		196608		64000	=125*512
22502# efi-rtl8139.rom	176640		66048	=129*512
22503# pieeprom*.bin		524288		122880	=240*512
22504################################################################################
22505# initialization vector with executable code; often near JuMP instruction E9 yy zz
22506>3	ubyte			=0xE9	jmp
22507# jmp offset like: 008fh 0093h 009fh 00afh 0143h 3ad7h 5417h 54ech 594dh 895fh
22508>>4	uleshort		x	%#4.4x
22509# for initialization vector samples without 3 byte jump instruction
22510>3	ubyte			!0xE9	instruction
22511#	eb4b3734h	NVidia44.bin
22512#	00003234h	V7VGA.ROM
22513#	060e0731h	kvmvapic.bin
22514#	cb000000h	linuxboot-bin.rom
22515#	e80d0fcbh	PXE-Intel.rom
22516#	b8004875h	orchid.bin
22517>>3	ubelong			x	%#8.8x
22518# For misidetified raspberry pi pieeprom-*.bin like: 0xf00f
22519#>2	ubeshort		x	\b, AT 2 %#4.4x
22520################################################################################
22521#		new sections for BIOS (ia32) ROM Extension
22522# 4 bytes ASCII Signature "$PnP" for Plug aNd Play expansion header
22523>(26.s)	string		=$PnP		\b;
22524#>(26.s)	string		=$PnP		FOUND $PnP
22525# at 1Ah possible offset to expansion header structure; new for Plug aNd Play
22526>>26		uleshort	x	at %#x PNP
22527# Plug and Play vendor+device ID like: 0 0x000f1000 (2975BIOS.BIN) 0x31121095 (4243.bin) 0x04904215 (adaptec1542.bin)
22528#>>(26.s+0x0A)	ulelong		!0	NOT-nullID=%8.8x
22529>>(26.s+0x0A)	uleshort	!0
22530# show PnP Vendor identification in human readable text form instead of numeric
22531# For adaptec_ava1515_bios_585201-00.bin reverted endian! BUT IS THIS ALWAYS TRUE?
22532>>>(26.s+0x0C)	use		\^PCI-vendor
22533>>>(26.s+0x0A)	ubeshort	x	device=%#4.4x
22534# 3 byte Device type code; probably the same meaning as in PCI section?
22535# OK for	storage controller SCSI		(2975BIOS.BIN adaptec1542.bin)
22536# and		network controller ethernet	(efi-e1000.rom efi-rtl8139.rom)
22537>>(26.s+0x12)	use		PCI-class
22538# structure revision like: 01h
22539>>(26.s+4)	ubyte		!1	\b, revision %u
22540# PnP Header structure length in multiple of 16 bytes like: 2
22541>>(26.s+5)	uleshort	!2	\b, length %u*16
22542# offset to next header; 0 if none
22543>>(26.s+7)	uleshort	!0	\b, at %#x next header
22544# reserved byte; seems to be zero
22545>>(26.s+8)	ubyte		!0	\b, reserved %#x
22546# 8-bit checksum for this header; calculated and patched by patch2pnprom
22547>>(26.s+9)	ubyte		!0	\b, CRC %#x
22548# pointer to optional manufacturer string; like: 0 (4243.bin) 59h 5ch 60h c7h 14eh 27ch 296h 324h 3662h
22549>>(26.s+0x0E)	uleshort	>0	\b, at %#x
22550>>>(26.s+0x0C)	uleshort	x
22551# manufacturer ASCII-Z string like "http://ipxe.org" "Plop - Elmar Hanlhofer www.plop.at" "QEMU"
22552>>>>(&0.s)	string		x	"%s"
22553# pointer to optional product string; like: 0 (2975BIOS.BIN) 6ch 70h 7ch d9h 160h 281h 29bh 329h
22554>>(26.s+0x10)	uleshort	>0	\b, at %#x
22555>>>(26.s+0x0E)	uleshort	x
22556# often human readable product ASCII-Z string like "iPXE" "Plop Boot Manager"
22557# "multiboot loader" "Intel UNDI, PXE-2.0 (build 082)"
22558>>>>(&0.s)	string		x	"%s"
22559# PnP Device indicators; contains bits that identify the device as being capable of bootable
22560#>>(26.s+0x15)	ubyte		x	\b, INDICATORS %#x
22561# device is a display device
22562>>(26.s+0x15)	ubyte		&0x01	\b, display
22563# device is an input device
22564>>(26.s+0x15)	ubyte		&0x02	\b, input
22565# device is an IPL device
22566>>(26.s+0x15)	ubyte		&0x04	\b, IPL
22567#>>(26.s+0x15)	ubyte		&0x08	reserved
22568# ROM is only required if this device is selected as a boot device
22569>>(26.s+0x15)	ubyte		&0x10	\b, bootable
22570# indicates ROM is read cacheable
22571>>(26.s+0x15)	ubyte		&0x20	\b, cacheable
22572# ROM may be shadowed in RAM
22573>>(26.s+0x15)	ubyte		&0x40	\b, shadowable
22574# ROM supports the device driver initialization model
22575>>(26.s+0x15)	ubyte		&0x80	\b, InitialModel
22576# boot connection vector; an offset to a routine that hook into INT 9h, INT 10h, or INT 13h
22577# 0 means disabled 0x0429 (4650_sr5.bin) 0x0072 (adaptec1542.bin)
22578>>(26.s+0x16)	uleshort	!0	\b, boot vector offset %#x
22579# disconnect vector; offset to routine that do cleanup from an unsuccessful boot attempt
22580>>(26.s+0x18)	uleshort	!0	\b, disconnect offset %#x
22581# bootstrap entry point/vector (BEV); offset to a routine (like RPL) that hook into INT 19h
22582# 0 means disabled 0x3c (multiboot.bin) 0x358 (efi-rtl8139.rom) 0xae7 (PXE-Intel.rom)
22583>>(26.s+0x1A)	uleshort	!0	\b, bootstrap offset %#x
22584# 2nd reserved area; seems to be zero
22585>>(26.s+0x1C)	uleshort	!0	\b, 2nd reserved %#x
22586# static resource information vector; 0 means disabled
22587>>(26.s+0x1E)	uleshort	!0	\b, static offset %#4.4x
22588################################################################################
22589# 4 bytes ASCII Signature "PCIR" for PCI Data Structure
22590#>(24.s)	string			=PCIR	FOUND PCIR
22591>(24.s)	string			=PCIR	\b;
22592# pointer to PCI data structure like: 1Ch 38h 104h 8E44h
22593>>24	uleshort		x	at %#x PCI
22594# Vendor identification (ID)		https://pci-ids.ucw.cz/v2.2/pci.ids
22595#>>(24.s+4)	uleshort	x	ID=%4.4x
22596# show Vendor identification in human readable text form instead of numeric
22597>>(24.s+4)	use		PCI-vendor
22598# device identification (ID)
22599>>(24.s+6)	uleshort	x	device=%#4.4x
22600# Base+sub class code			https://wiki.osdev.org/PCI
22601>>(24.s+0x0D)	use		PCI-class
22602# pointer to vital product data (VPD); 0 indicates no VPD; WHAT EXACTLY iS VPD?
22603>>(24.s+8)	uleshort	!0	\b, at %#x VPD
22604# PCI data structure length like: 24h 28h
22605>>(24.s+0xA)	uleshort	>0x28	\b, length %u
22606# PCI data structure revision like: 0 3
22607>>(24.s+0xC)	ubyte		>0	\b, revison %u
22608# image length (hexadecimal) in multiple of 512 bytes like: 54 56 68 6a 76 78 7c 7d 7e 7f 80 81 83
22609# Apparently this gives the same information as given by byte at offset 2 but as 16-bit
22610#>>(24.s+0x10)	uleshort	x	\b, length %u*512
22611# revision level of code/data like: 0 1 201h 502h
22612>>(24.s+0xC)	ubyte		>1	\b, code revison %#x
22613# code type: 0~Intel x86/PC-AT compatible 1~Open firmware standard for PCI42 FF~Reserved
22614>>(24.s+0x14)	ubyte		>0	\b, code type %#x
22615# last image indicator; bit 7 indicates "last image"; bits 0-6 are reserved
22616>>(24.s+0x15)	ubyte		>0
22617>>>(24.s+0x15)	ubyte		=0x80	\b, last ROM
22618# THIS SHOULD NOT HAPPEN!
22619>>>(24.s+0x15)	ubyte		!0x80	\b, indicator %x
22620# 3rd reserved area; seems to be zero in most cases but not for
22621# efi-e1000.rom efi-rtl8139.rom
22622>>(24.s+0x16)	ubeshort	!0	\b, 3rd reserved %#x
22623
22624# Flash descriptors for Intel SPI flash roms.
22625# From Dr. Jesus <j@hug.gs>
226260	lelong		0x0ff0a55a	Intel serial flash for ICH/PCH ROM <= 5 or 3400 series A-step
2262716	lelong		0x0ff0a55a	Intel serial flash for PCH ROM
22628
22629# From: 	Joerg Jenderek
22630# URL:		https://en.wikipedia.org/wiki/Advanced_Configuration_and_Power_Interface
22631# Reference:	https://uefi.org/sites/default/files/resources/ACPI_6_3_final_Jan30.pdf
22632# Note:		generated for example by `cat /sys/firmware/acpi/tables/DSDT MyDSDT.aml`
226330	string		DSDT
22634>0	use		acpi-table
22635# not tested or other file format
226360	string		APIC
22637>0	use		acpi-table
22638#0	string		ASF!
22639#>0	use		acpi-table
226400	string		FACP
22641>0	use		acpi-table
22642#0	string		FACS
22643#>0	use		acpi-table
226440	string		MCFG
22645>0	use		acpi-table
226460	string		SLIC
22647>0	use		acpi-table
226480	string		SSDT
22649>0	use		acpi-table
226500	name		acpi-table
22651# skip ASCII text starting with DSDT by looking for valid "low" revision
22652>8	ubyte		<17	ACPI Machine Language file
22653# assume that ACPI tables size are lower than 16 MiB
22654#>4	ulelong		<0x01000000
22655# DSDT for Differentiated System Description Table
22656>>0	string		x	'%.4s'
22657#!:mime	application/octet-stream
22658!:mime	application/x-intel-aml
22659!:ext	aml
22660# the manufacture model ID like: VBOXBIOS BXDSDT
22661>>16	string		>\0	%.8s
22662# OEM revision of DSDT for supplied OEM Table ID like: 0 1 2 20090511
22663>>>24	ulelong		x	%x
22664# OEM ID like: INTEL VBOX (VirtualBox) BXDSDT (qemu) MEDION or \030\001\0\0 for s3pt.aml
22665>>10	ubyte		>040	by %c
22666>>>11		ubyte	>040	\b%c
22667>>>>12		ubyte	>040	\b%c
22668>>>>>13		ubyte	>040	\b%c
22669>>>>>>14	ubyte	>040	\b%c
22670>>>>>>>15	ubyte	>040	\b%c
22671# This field also sets the global integer width for the AML interpreter.
22672# Values less than two will cause the interpreter to use 32-bit.
22673# Values of two and greater will cause the interpreter to use full 64-bit.
22674# 16 for asf!.aml, 67 fo rsdp.aml
22675>>8	ubyte		x	\b, revision %u
22676# length, in bytes, of the entire DSDT (including the header)
22677>>4	ulelong		x	\b, %u bytes
22678# entire table must sum to zero
22679#>>9	ubyte		x	\b, checksum %#x
22680# vendor ID for the ASL Compiler like: INTL MSFT ...
22681>>28	string		>\0	\b, created by %.4s
22682# revision number of the ASL Compiler like: 20051117 20140724 20190703 20200110 ...
22683>>>32	ulelong		x	%x
22684
22685
22686#------------------------------------------------------------------------------
22687# $File: interleaf,v 1.10 2009/09/19 16:28:10 christos Exp $
22688# interleaf:  file(1) magic for InterLeaf TPS:
22689#
226900	string		=\210OPS	Interleaf saved data
226910	string		=<!OPS		Interleaf document text
22692>5	string		,\ Version\ =	\b, version
22693>>17	string		>\0		%.3s
22694
22695#------------------------------------------------------------------------------
22696# $File: island,v 1.5 2009/09/19 16:28:10 christos Exp $
22697# island:  file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1
22698# "/etc/magic":
22699# From: guy@netapp.com (Guy Harris)
22700#
227014	string		pgscriptver	IslandWrite document
2270213	string		DrawFile	IslandDraw document
22703
22704
22705#------------------------------------------------------------------------------
22706# $File: ispell,v 1.8 2009/09/19 16:28:10 christos Exp $
22707# ispell:  file(1) magic for ispell
22708#
22709# Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602.  This magic
22710# will match 0x9600 through 0x9603 in *both* little endian and big endian.
22711# (No other current magic entries collide.)
22712#
22713# Updated by Daniel Quinlan (quinlan@yggdrasil.com)
22714#
227150	leshort&0xFFFC	0x9600		little endian ispell
22716>0	byte		0		hash file (?),
22717>0	byte		1		3.0 hash file,
22718>0	byte		2		3.1 hash file,
22719>0	byte		3		hash file (?),
22720>2	leshort		0x00		8-bit, no capitalization, 26 flags
22721>2	leshort		0x01		7-bit, no capitalization, 26 flags
22722>2	leshort		0x02		8-bit, capitalization, 26 flags
22723>2	leshort		0x03		7-bit, capitalization, 26 flags
22724>2	leshort		0x04		8-bit, no capitalization, 52 flags
22725>2	leshort		0x05		7-bit, no capitalization, 52 flags
22726>2	leshort		0x06		8-bit, capitalization, 52 flags
22727>2	leshort		0x07		7-bit, capitalization, 52 flags
22728>2	leshort		0x08		8-bit, no capitalization, 128 flags
22729>2	leshort		0x09		7-bit, no capitalization, 128 flags
22730>2	leshort		0x0A		8-bit, capitalization, 128 flags
22731>2	leshort		0x0B		7-bit, capitalization, 128 flags
22732>2	leshort		0x0C		8-bit, no capitalization, 256 flags
22733>2	leshort		0x0D		7-bit, no capitalization, 256 flags
22734>2	leshort		0x0E		8-bit, capitalization, 256 flags
22735>2	leshort		0x0F		7-bit, capitalization, 256 flags
22736>4	leshort		>0		and %d string characters
227370	beshort&0xFFFC	0x9600		big endian ispell
22738>1	byte		0		hash file (?),
22739>1	byte		1		3.0 hash file,
22740>1	byte		2		3.1 hash file,
22741>1	byte		3		hash file (?),
22742>2	beshort		0x00		8-bit, no capitalization, 26 flags
22743>2	beshort		0x01		7-bit, no capitalization, 26 flags
22744>2	beshort		0x02		8-bit, capitalization, 26 flags
22745>2	beshort		0x03		7-bit, capitalization, 26 flags
22746>2	beshort		0x04		8-bit, no capitalization, 52 flags
22747>2	beshort		0x05		7-bit, no capitalization, 52 flags
22748>2	beshort		0x06		8-bit, capitalization, 52 flags
22749>2	beshort		0x07		7-bit, capitalization, 52 flags
22750>2	beshort		0x08		8-bit, no capitalization, 128 flags
22751>2	beshort		0x09		7-bit, no capitalization, 128 flags
22752>2	beshort		0x0A		8-bit, capitalization, 128 flags
22753>2	beshort		0x0B		7-bit, capitalization, 128 flags
22754>2	beshort		0x0C		8-bit, no capitalization, 256 flags
22755>2	beshort		0x0D		7-bit, no capitalization, 256 flags
22756>2	beshort		0x0E		8-bit, capitalization, 256 flags
22757>2	beshort		0x0F		7-bit, capitalization, 256 flags
22758>4	beshort		>0		and %d string characters
22759# ispell 4.0 hash files  kromJx <kromJx@crosswinds.net>
22760# Ispell 4.0
227610       string          ISPL            ispell
22762>4      long            x               hash file version %d,
22763>8      long            x               lexletters %d,
22764>12     long            x               lexsize %d,
22765>16     long            x               hashsize %d,
22766>20     long            x               stblsize %d
22767
22768#------------------------------------------------------------------------------
22769# $File: isz,v 1.5 2019/04/19 00:42:27 christos Exp $
22770# ISO Zipped file format
22771# https://www.ezbsystems.com/isz/iszspec.txt
227720	string	IsZ!	ISO Zipped file
22773>4	byte	x	\b, header size %u
22774>5	byte	x	\b, version %u
22775>8	lelong	x	\b, serial %u
22776#12	leshort	x	\b, sector size %u
22777#>16	lelong	x	\b, total sectors %u
22778>17	byte	>0	\b, password protected
22779#>24	lequad	x	\b, segment size %llu
22780#>32	lelong	x	\b, blocks %u
22781#>36	lelong	x	\b, block size %u
22782
22783#------------------------------------------------------------
22784# $File: java,v 1.21 2019/02/18 17:58:50 christos Exp $
22785# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the
22786# same magic number, 0xcafebabe, so they are both handled
22787# in the entry called "cafebabe".
22788#------------------------------------------------------------
22789# Java serialization
22790# From Martin Pool (m.pool@pharos.com.au)
227910	beshort		0xaced		Java serialization data
22792>2	beshort		>0x0004		\b, version %d
22793
227940	belong		0xfeedfeed	Java KeyStore
22795!:mime	application/x-java-keystore
227960	belong		0xcececece	Java JCE KeyStore
22797!:mime	application/x-java-jce-keystore
22798
22799# Java source
228000	regex	\^import.*;$	Java source
22801!:mime	text/x-java
22802
22803# Java HPROF dumps
22804# https://java.net/downloads/heap-snapshot/hprof-binary-format.html
228050	string		JAVA\x20PROFILE\x201.0.
22806>0x12	byte		0
22807>>0x11	ubyte-0x31	<2      Java HPROF dump,
22808>>>0x17	beqdate/1000	x       created %s
22809
22810# Java jmod module
22811# See https://hg.openjdk.java.net/jdk9/jdk9/jdk/file/tip/src/java.base/share/classes/jdk/internal/jmod/JmodFile.java
22812# Grr. 2 byte magic "JM", really? In 2019?
228130	belong		0x4a4d0100	Java jmod module version 1.0
22814!:mime	application/x-java-jmod
22815
22816# Java jlinked image
22817# See https://hg.openjdk.java.net/jdk9/jdk9/jdk/file/tip/src/java.base/share/native/libjimage/imageFile.hpp
228180	belong	0xcafedada	Java module image (big endian)
22819>4	beshort	>0x00	\b, version %d
22820>6	beshort	x	\b.%d
22821!:mime	application/x-java-image
22822
228230	lelong	0xcafedada	Java module image (little endian)
22824>6	leshort	>0x00	\b, version %d
22825>4	leshort	x	\b.%d
22826!:mime	application/x-java-image
22827
22828#------------------------------------------------------------------------------
22829# $File: javascript,v 1.4 2022/09/02 08:08:17 christos Exp $
22830# javascript:  magic for javascript and node.js scripts.
22831#
228320	string/w	#!/bin/node		Node.js script text executable
22833!:mime application/javascript
228340	string/w	#!/usr/bin/node		Node.js script text executable
22835!:mime application/javascript
228360	string/w	#!/bin/nodejs		Node.js script text executable
22837!:mime application/javascript
228380	string/w	#!/usr/bin/nodejs	Node.js script text executable
22839!:mime application/javascript
228400	string		#!/usr/bin/env\ node	Node.js script text executable
22841!:mime application/javascript
228420	string		#!/usr/bin/env\ nodejs	Node.js script text executable
22843!:mime application/javascript
22844# Hermes by Facebook https://hermesengine.dev/
22845# https://github.com/facebook/hermes/blob/master/include/hermes/\
22846# BCGen/HBC/BytecodeFileFormat.h#L24
228470	lequad		0x1F1903C103BC1FC6	Hermes JavaScript bytecode
22848>8	lelong		x			\b, version %d
22849
22850# v8 JavaScript engine bytecode
22851# From: Alexandre Iooss <erdnaxe@crans.org>
22852# URL:	https://v8.dev/docs/ignition
22853# Note: used in bytenode and NW.js protected source code
22854# V8 bytecode extraction was added in NodeJS v5.7.0 (V8 4.6.85.31).
22855# Version information is provided for some v8 versions found in NodeJS releases.
228562	uleshort		=0xC0DE
22857>0	ulelong^0xC0DE0000	>0
22858# Reservation table starts at 40
22859>>40	ulelong&0xFFFFFF00	=0x80000000
22860# Stub keys present
22861>>>24	ulelong			>0
22862>>>>0	ulelong^0xC0DE0000	x		v8 bytecode, external reference table size: %u bytes,
22863>>>>4	ulelong			=0xEE4BF478	version 5.1.281.111,
22864>>>>4	ulelong			=0xC4A0100C	version 5.5.372.43,
22865>>>>8	ulelong			x		source size: %u bytes,
22866>>>>12	ulelong			x		cpu features: %#08X,
22867>>>>16	ulelong			x		flag hash: %#08X,
22868>>>>20	ulelong			x		%u reservations,
22869>>>>28	ulelong			x		payload size: %u bytes,
22870>>>>32	ulelong			x		checksum1: %#08X,
22871>>>>36	ulelong			x		checksum2: %#08X
22872# No stub keys
22873>>>24	ulelong			=0
22874>>>>0	ulelong^0xC0DE0000	x		v8 bytecode, external reference table size: %u bytes,
22875>>>>4	ulelong			=0x54F0AD81	version 6.2.414.46,
22876>>>>4	ulelong			=0X7D1BF182	version 6.2.414.54,
22877>>>>4	ulelong			=0x35BA122E	version 6.2.414.77,
22878>>>>4	ulelong			=0X9319F9C2	version 6.2.414.78,
22879>>>>4	ulelong			=0xB1240060	version 6.6.346.32,
22880>>>>4	ulelong			=0x2B757060	version 6.7.288.46,
22881>>>>4	ulelong			=0x09D147AA	version 6.7.288.49,
22882>>>>4	ulelong			=0xF4D4F48A	version 6.8.275.32,
22883>>>>4	ulelong			=0xD3961326	version 7.0.276.38,
22884>>>>8	ulelong			x		source size: %u bytes,
22885>>>>12	ulelong			x		cpu features: %#08X,
22886>>>>16	ulelong			x		flag hash: %#08X,
22887>>>>20	ulelong			x		%u reservations,
22888>>>>28	ulelong			x		payload size: %u bytes,
22889>>>>32	ulelong			x		checksum1: %#08X,
22890>>>>36	ulelong			x		checksum2: %#08X
22891# Reservation table starts at 32
22892>>32	ulelong&0xFFFFFF00	=0x80000000
22893# Second checksum present
22894>>>28	ulelong			>0
22895>>>>0	ulelong^0xC0DE0000	x		v8 bytecode, external reference table size: %u bytes,
22896>>>>4	ulelong			=0x21DDF627	version 7.4.288.21,
22897>>>>4	ulelong			=0x1FC9FE84	version 7.4.288.27,
22898>>>>4	ulelong			=0x60A99E8B	version 7.5.288.22,
22899>>>>4	ulelong			=0x4F665E90	version 7.6.303.29,
22900>>>>4	ulelong			=0xC7ACFCDE	version 7.7.299.11,
22901>>>>4	ulelong			=0x7F641D8F	version 7.7.299.13,
22902>>>>4	ulelong			=0xFD9A4F2E	version 7.8.279.17,
22903>>>>4	ulelong			=0x3A845324	version 7.8.279.23,
22904>>>>4	ulelong			=0xFF52FEAF	version 7.9.317.25,
22905>>>>8	ulelong			x		source size: %u bytes,
22906>>>>12	ulelong			x		flag hash: %#08X,
22907>>>>16	ulelong			x		%u reservations,
22908>>>>20	ulelong			x		payload size: %u bytes,
22909>>>>24	ulelong			x		checksum1: %#08X,
22910>>>>28	ulelong			x		checksum2: %#08X
22911# No second checksum
22912>>>28	ulelong			=0
22913>>>>0	ulelong^0xC0DE0000	x		v8 bytecode, external reference table size: %u bytes,
22914>>>>4	ulelong			=0x8725E0F8	version 8.1.307.30,
22915>>>>4	ulelong			=0x09ED1289	version 8.1.307.31,
22916>>>>4	ulelong			=0xA5728C87	version 8.3.110.9,
22917>>>>4	ulelong			=0xB45C5D30	version 8.4.371.23,
22918>>>>4	ulelong			=0xED9C278B	version 8.4.371.19,
22919>>>>4	ulelong			=0xD27BFF42	version 8.6.395.16,
22920>>>>8	ulelong			x		source size: %u bytes,
22921>>>>12	ulelong			x		flag hash: %#08X,
22922>>>>16	ulelong			x		%u reservations,
22923>>>>20	ulelong			x		payload size: %u bytes,
22924>>>>24	ulelong			x		payload checksum: %#08X
22925# No reservation table and code starts at 24
22926>>32	ulelong		=0
22927>>>0	ulelong^0xC0DE0000	x		v8 bytecode, external reference table size: %u bytes,
22928>>>4	ulelong			=0x9A6F0B0F	version 9.0.257.17,
22929>>>4	ulelong			=0x271D5D1E	version 9.0.257.24,
22930>>>4	ulelong			=0x4EEA75DF	version 9.0.257.25,
22931>>>4	ulelong			=0x80809479	version 9.1.269.36,
22932>>>4	ulelong			=0x55C46F65	version 9.1.269.38,
22933>>>4	ulelong			=0x8A9C758A	version 9.2.230.21,
22934>>>4	ulelong			=0x9712F0E1	version 9.3.345.16,
22935>>>4	ulelong			=0x29593715	version 9.4.146.19,
22936>>>4	ulelong			=0xCD991825	version 9.4.146.24,
22937>>>4	ulelong			=0xACDD64EE	version 9.4.146.26,
22938>>>4	ulelong			=0xC96B4CD5	version 9.5.172.21,
22939>>>4	ulelong			=0xBCCE4578	version 9.5.172.25,
22940>>>4	ulelong			=0xA2EEA077	version 9.6.180.15,
22941>>>4	ulelong			=0xFD350011	version 10.1.124.8,
22942>>>4	ulelong			=0xBEF4028F	version 10.2.154.13,
22943>>>4	ulelong			=0xAF632352	version 10.2.154.4,
22944>>>8	ulelong			x		source size: %u bytes,
22945>>>12	ulelong			x		flag hash: %#08X,
22946>>>16	ulelong			x		payload size: %u bytes,
22947>>>20	ulelong			x		payload checksum: %#08X
22948
22949#------------------------------------------------------------------------------
22950# $File: jpeg,v 1.37 2022/06/17 18:03:35 christos Exp $
22951# JPEG images
22952# SunOS 5.5.1 had
22953#
22954#	0	string		\377\330\377\340	JPEG file
22955#	0	string		\377\330\377\356	JPG file
22956#
22957# both of which turn into "JPEG image data" here.
22958#
229590	belong			0xffd8fff7	JPEG-LS image data
22960!:mime	image/jls
22961!:ext jls
22962>0	use			jpeg
22963
229640	belong&0xffffff00	0xffd8ff00	JPEG image data
22965!:mime	image/jpeg
22966!:apple	8BIMJPEG
22967!:strength *3
22968!:ext jpeg/jpg/jpe/jfif
22969>0	use			jpeg
22970
229710	name		jpeg
22972>6	string		JFIF		\b, JFIF standard
22973# The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06
22974# in a vain attempt to add image size reporting for JFIF.  Note that these
22975# tests are not fool-proof since some perfectly valid JPEGs are currently
22976# impossible to specify in magic(4) format.
22977# First, a little JFIF version info:
22978>>11	byte		x		\b %d.
22979>>12	byte		x		\b%02d
22980# Next, the resolution or aspect ratio of the image:
22981>>13	byte		0		\b, aspect ratio
22982>>13	byte		1		\b, resolution (DPI)
22983>>13	byte		2		\b, resolution (DPCM)
22984>>14	beshort		x		\b, density %dx
22985>>16	beshort		x		\b%d
22986>>4	beshort		x		\b, segment length %d
22987# Next, show thumbnail info, if it exists:
22988>>18	byte		!0		\b, thumbnail %dx
22989>>>19	byte		x		\b%d
22990>6	string		Exif		\b, Exif standard: [
22991>>12	indirect/r	x
22992>>12	string		x		\b]
22993
22994# Jump to the first segment
22995>(4.S+4)	use		jpeg_segment
22996
22997# This uses recursion...
229980		name		jpeg_segment
22999>0	beshort		0xFFFE
23000# Recursion handled by FFE0
23001#>>(2.S+2)	use			jpeg_segment
23002>>2	pstring/HJ	x		\b, comment: "%s"
23003
23004>0	beshort		0xFFC0
23005>>(2.S+2)	use			jpeg_segment
23006>>4	byte		x		\b, baseline, precision %d
23007>>7	beshort		x		\b, %dx
23008>>5	beshort		x		\b%d
23009>>9	byte		x		\b, components %d
23010
23011>0	beshort		0xFFC1
23012>>(2.S+2)	use			jpeg_segment
23013>>4	byte		x		\b, extended sequential, precision %d
23014>>7	beshort		x		\b, %dx
23015>>5	beshort		x		\b%d
23016>>9	byte		x		\b, components %d
23017
23018>0	beshort		0xFFC2
23019>>(2.S+2)	use			jpeg_segment
23020>>4	byte		x		\b, progressive, precision %d
23021>>7	beshort		x		\b, %dx
23022>>5	beshort		x		\b%d
23023>>9	byte		x		\b, components %d
23024
23025# Define Huffman Tables
23026>0	beshort		0xFFC4
23027>>(2.S+2)	use			jpeg_segment
23028
23029>0	beshort		0xFFE1
23030# Recursion handled by FFE0
23031#>>(2.S+2)	use			jpeg_segment
23032>>4	string		Exif		\b, Exif Standard: [
23033>>>10	indirect/r	x
23034>>>10	string		x		\b]
23035
23036# Application specific markers
23037>0	beshort&0xFFE0	=0xFFE0
23038>>(2.S+2)	use			jpeg_segment
23039
23040# DB: Define Quantization tables
23041# DD: Define Restart interval [XXX: wrong here, it is 4 bytes]
23042# D8: Start of image
23043# D9: End of image
23044# Dn: Restart
23045>0	beshort&0xFFD0	=0xFFD0
23046>>0	beshort&0xFFE0	!0xFFE0
23047>>>(2.S+2)	use			jpeg_segment
23048
23049#>0	beshort		x		unknown %#x
23050#>>(2.S+2)	use			jpeg_segment
23051
23052# HSI is Handmade Software's proprietary JPEG encoding scheme
23053# Update:	Joerg Jenderek
23054# URL:		http://fileformats.archiveteam.org/wiki/HSI_JPEG
23055# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-hsi1.trid.xml
23056# Note:         called by TrID "HSI JPEG bitmap"
230570	string		hsi1		JPEG image data, HSI proprietary
23058#!:mime	application/octet-stream
23059!:mime	image/x-hsi
23060!:ext	hsi/jpg
23061
23062# From: David Santinoli <david@santinoli.com>
230630	string		\x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A	JPEG 2000
23064# delete from ./animation (version 1.87) with jP (=6A50h) magic at offset 4
23065# From: Johan van der Knijff <johan.vanderknijff@kb.nl>
23066# Added sub-entries for JP2, JPX, JPM and MJ2 formats; added mimetypes
23067# https://github.com/bitsgalore/jp2kMagic
23068#
23069# Now read value of 'Brand' field, which yields a few possibilities:
23070# Update:	Joerg Jenderek
23071# URL:		http://fileformats.archiveteam.org/wiki/JP2
23072# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-jpeg2k.trid.xml
23073# Note:         called by TrID "JPEG 2000 bitmap"
23074>20	string		\x6a\x70\x32\x20	Part 1 (JP2)
23075# aliases	image/jpeg2000, image/jpeg2000-image, image/x-jpeg2000-image
23076!:mime	image/jp2
23077!:ext	jp2
23078# URL:		http://fileformats.archiveteam.org/wiki/JPX
23079# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-jpx.trid.xml
23080# Note:         called by TrID "JPEG 2000 eXtended bitmap"
23081>20	string		\x6a\x70\x78\x20	Part 2 (JPX)
23082!:mime	image/jpx
23083!:ext	jpf/jpx
23084# URL:		http://fileformats.archiveteam.org/wiki/JPM
23085# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-jpm.trid.xml
23086# Note:         called by TrID "JPEG 2000 eXtended bitmap"
23087>20	string		\x6a\x70\x6d\x20	Part 6 (JPM)
23088!:mime	image/jpm
23089!:ext	jpm
23090# URL:		http://fileformats.archiveteam.org/wiki/MJ2
23091# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/v/video-mj2.trid.xml
23092# Note:         called by TrID "Motion JPEG 2000 video"
23093>20	string		\x6d\x6a\x70\x32	Part 3 (MJ2)
23094!:mime	video/mj2
23095!:ext	mj2/mjp2
23096
23097# Type: JPEG 2000 codesream
23098# From: Mathieu Malaterre <mathieu.malaterre@gmail.com>
23099# Update:	Joerg Jenderek
23100# URL:		http://fileformats.archiveteam.org/wiki/JPEG_2000_codestream
23101# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-jpc.trid.xml
23102# Note:         called by TrID "JPEG-2000 Code Stream bitmap"
231030	belong		0xff4fff51						JPEG 2000 codestream
23104# value like: 0701h FF50h
23105#>45	ubeshort	x	\b, at 45 %#4.4x
23106#!:mime	application/octet-stream
23107# https://reposcope.com/mimetype/image/x-jp2-codestream
23108!:mime	image/x-jp2-codestream
23109!:ext	jpc/j2c/j2k
23110# MAYBE also JHC like in byte_causal.jhc ?
23111# WHAT IS THAT? DEAD ENTRY?
23112#45	beshort		0xff52
23113
23114# JPEG extended range
23115# URL:		http://fileformats.archiveteam.org/wiki/JPEG_XR
23116# Reference:	https://www.itu.int/rec/T-REC-T.832
23117#		http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-wmp.trid.xml
23118# Note:         called by TrID "JPEG XR bitmap"
231190	string		\x49\x49\xbc
23120# FILE_VERSION_ID; shall be equal to 1; other values are reserved for future use
23121>3	byte		1
23122# FIRST_IFD_OFFSET; shall be an integer multiple of 2; so skip DROID fmt-590-signature-id-931.wdp
23123>>4	lelong%2	0	JPEG-XR
23124#!:mime	image/vnd.ms-photo
23125!:mime	image/jxr
23126# NO example for HDP !
23127!:ext	jxr/wdp/hdp
23128# MAYBE also WMP ?
23129#!:ext	jxr/wdp/hdp/wmp
23130# moved from ./images (version 1.205 ), merged and
23131# partly verified by XnView `nconvert -info abydos.jxr FLOWER.wdp`
23132# example: https://web.archive.org/web/20160403012904/
23133# http://shikino.co.jp/solution/upfile/FLOWER.wdp.zip
23134>90	bequad		0x574D50484F544F00
23135>>98	byte&0x08	=0x08			\b, hard tiling
23136>>99	byte&0x80	=0x80			\b, tiling present
23137>>99	byte&0x40	=0x40			\b, codestream present
23138>>99	byte&0x38	x			\b, spatial xform=
23139>>99	byte&0x38	0x00			\bTL
23140>>99	byte&0x38	0x08			\bBL
23141>>99	byte&0x38	0x10			\bTR
23142>>99	byte&0x38	0x18			\bBR
23143>>99	byte&0x38	0x20			\bBT
23144>>99	byte&0x38	0x28			\bRB
23145>>99	byte&0x38	0x30			\bLT
23146>>99	byte&0x38	0x38			\bLB
23147>>100	byte&0x80	=0x80			\b, short header
23148>>>102	beshort+1	x			\b, %d
23149>>>104	beshort+1	x			\bx%d
23150>>100	byte&0x80	=0x00			\b, long header
23151>>>102	belong+1	x			\b, %x
23152>>>106	belong+1	x			\bx%x
23153>>101	beshort&0xf	x			\b, bitdepth=
23154>>>101	beshort&0xf	0x0			\b1-WHITE=1
23155>>>101	beshort&0xf	0x1			\b8
23156>>>101	beshort&0xf	0x2			\b16
23157>>>101	beshort&0xf	0x3			\b16-SIGNED
23158>>>101	beshort&0xf	0x4			\b16-FLOAT
23159>>>101	beshort&0xf	0x5			\b(reserved 5)
23160>>>101	beshort&0xf	0x6			\b32-SIGNED
23161>>>101	beshort&0xf	0x7			\b32-FLOAT
23162>>>101	beshort&0xf	0x8			\b5
23163>>>101	beshort&0xf	0x9			\b10
23164>>>101	beshort&0xf	0xa			\b5-6-5
23165>>>101	beshort&0xf	0xb			\b(reserved %d)
23166>>>101	beshort&0xf	0xc			\b(reserved %d)
23167>>>101	beshort&0xf	0xd			\b(reserved %d)
23168>>>101	beshort&0xf	0xe			\b(reserved %d)
23169>>>101	beshort&0xf	0xf			\b1-BLACK=1
23170>>101	beshort&0xf0	x			\b, colorfmt=
23171>>>101	beshort&0xf0	0x00			\bYONLY
23172>>>101	beshort&0xf0	0x10			\bYUV240
23173>>>101	beshort&0xf0	0x20			\bYWV422
23174>>>101	beshort&0xf0	0x30			\bYWV444
23175>>>101	beshort&0xf0	0x40			\bCMYK
23176>>>101	beshort&0xf0	0x50			\bCMYKDIRECT
23177>>>101	beshort&0xf0	0x60			\bNCOMPONENT
23178>>>101	beshort&0xf0	0x70			\bRGB
23179>>>101	beshort&0xf0	0x80			\bRGBE
23180>>>101	beshort&0xf0	>0x80			\b(reserved %#x)
23181
23182# JPEG XL
23183# From: Ian Tester
23184# Update:	Joerg Jenderek
23185# URL:		http://fileformats.archiveteam.org/wiki/JPEG_XL
23186# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-jxl.trid.xml
23187# Note:         called by TrID "JPEG XL bitmap"
231880	string	\xff\x0a				JPEG XL codestream
23189#!:mime  image/jxl
23190!:mime	image/x-jxl
23191!:ext jxl
23192
23193# JPEG XL (transcoded JPEG file)
23194# Update:	Joerg Jenderek
23195# URL:		http://fileformats.archiveteam.org/wiki/JPEG_XL
23196# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-jxl-iso.trid.xml
23197# Note:         called by TrID "JPEG XL bitmap (ISOBMFF)"
231980	string	\x00\x00\x00\x0cJXL\x20\x0d\x0a\x87\x0a	JPEG XL container
23199#!:mime  image/jxl
23200!:mime	image/x-jxl
23201!:ext jxl
23202
23203#------------------------------------------------------------------------------
23204# $File: karma,v 1.8 2015/08/29 07:10:35 christos Exp $
23205# karma:  file(1) magic for Karma data files
23206#
23207# From <rgooch@atnf.csiro.au>
23208
232090	string	KarmaRHD\040Version	Karma Data Structure Version
23210>16	belong		x		%u
23211
23212#------------------------------------------------------------------------------
23213# $File: kde,v 1.5 2010/11/25 15:00:12 christos Exp $
23214# kde:  file(1) magic for KDE
23215
232160		string/t	[KDE\ Desktop\ Entry]	KDE desktop entry
23217!:mime	application/x-kdelnk
232180		string/t	#\ KDE\ Config\ File	KDE config file
23219!:mime	application/x-kdelnk
232200		string/t	#\ xmcd	xmcd database file for kscd
23221!:mime	text/x-xmcd
23222
23223#------------------------------------------------------------------------------
23224# $File: keepass,v 1.2 2019/04/19 00:42:27 christos Exp $
23225# keepass: file(1) magic for KeePass file
23226#
23227# Keepass Password Safe:
23228#  * original one: https://keepass.info/
23229#  * *nix port:    https://www.keepassx.org/
23230#  * android port: https://code.google.com/p/keepassdroid/
23231
232320	lelong		0x9AA2D903	Keepass password database
23233>4	lelong		0xB54BFB65	1.x KDB
23234>>48	lelong		>0		\b, %d groups
23235>>52	lelong		>0		\b, %d entries
23236>>8	lelong&0x0f	1		\b, SHA-256
23237>>8	lelong&0x0f	2		\b, AES
23238>>8	lelong&0x0f	4		\b, RC4
23239>>8	lelong&0x0f	8		\b, Twofish
23240>>120	lelong		>0		\b, %d key transformation rounds
23241>4	lelong		0xB54BFB67	2.x KDBX
23242
23243#------------------------------------------------------------------------------
23244# $File: kerberos,v 1.3 2019/04/19 00:42:27 christos Exp $
23245# kerberos: MIT kerberos file binary formats
23246#
23247
23248# This magic entry is for demonstration purposes and could be improved
23249# if the following features were implemented in file:
23250#
23251# Strings inside [[ .. ]] in the descriptions have special meanings and
23252# are not printed.
23253#
23254# 	- Provide some form of iteration in number of components
23255#		[[${counter}=%d]] in the description
23256#		then append
23257#		[${counter}--] in the offset of the entries
23258#	- Provide a way to round the next offset
23259#		Add [R:4] after the offset?
23260#	- Provide a way to have optional entries
23261#		XXX: Syntax:
23262#	- Provide a way to "save" entries to print them later.
23263#		if the description is [[${name}=%s]], then nothing is
23264#		printed and a subsequent entry in the same magic file
23265#		can refer to ${name}
23266#	- Provide a way to format strings as hex values
23267#
23268# https://www.gnu.org/software/shishi/manual/html_node/\
23269#	The-Keytab-Binary-File-Format.html
23270#
23271
232720		name		keytab_entry
23273#>0		beshort		x		\b, size=%d
23274#>2		beshort		x		\b, components=%d
23275>4		pstring/H	x		\b, realm=%s
23276>>&0		pstring/H	x		\b, principal=%s/
23277>>>&0		pstring/H	x		\b%s
23278>>>>&0		belong		x		\b, type=%d
23279>>>>>&0		bedate		x		\b, date=%s
23280>>>>>>&0	byte		x		\b, kvno=%u
23281#>>>>>>>&0	pstring/H	x
23282#>>>>>>>>&0	belong		x
23283#>>>>>>>>>>&0	use		keytab_entry
23284
232850		belong		0x05020000	Kerberos Keytab file
23286>4		use		keytab_entry
23287
23288#------------------------------------------------------------------------------
23289# $File: kicad,v 1.2 2020/05/06 14:03:28 christos Exp $
23290# kicad:  file(1) magic for KiCad files
23291#
23292# See
23293#
23294#	http://kicad-pcb.org
23295#
23296
23297# KiCad Schematic Document
232980	    string  (kicad_sch
23299>10	    byte    0x20		KiCad Schematic Document
23300!:ext kicad_sch/kicad_sch-bak
23301>>11	    string  (version
23302>>>19	    byte    0x20
23303>>>>20	    regex   [0-9.]+		(Version %s)
23304
23305# KiCad Schematic Document (Legacy)
233060	    string  EESchema
23307>8	    byte    0x20
23308>>9	    string  Schematic
23309>>>18	    byte    0x20		KiCad Schematic Document (Legacy)
23310!:ext sch/bak
23311>>>>24	    string  Version
23312>>>>>31	    byte    0x20
23313>>>>>>32    string  x			(Version %s)
23314
23315# KiCad Symbol Library
233160	    string  (kicad_symbol_lib
23317>17	    byte    0x20		KiCad Symbol Library
23318!:ext kicad_sym
23319>>18	    string  (version
23320>>>26	    byte    0x20
23321>>>>27	    regex   [0-9.]+		(Version %s)
23322
23323# KiCad Symbol Library (Legacy)
233240	    string  EESchema-LIBRARY
23325>16	    byte    0x20		KiCad Symbol Library (Legacy)
23326!:ext lib
23327>>17	    string  Version
23328>>>24	    byte    0x20
23329>>>>25	    string  x			(Version %s)
23330
23331# KiCad Symbol Library Documentation (Legacy)
233320	    string  EESchema-DOCLIB
23333>15	    byte    0x20		KiCad Symbol Library Documentation (Legacy)
23334!:ext dcm
23335>>17	    string  Version
23336>>>24	    byte    0x20
23337>>>>25	    string  x			(Version %s)
23338
23339# KiCad Board Layout
233400	    string  (kicad_pcb
23341>10	    byte    0x20		KiCad Board Layout
23342!:ext kicad_pcb/kicad_pcb-bak
23343>>11	    string  (version
23344>>>19	    byte    0x20
23345>>>>20	    regex   [0-9.]+		(Version %s)
23346
23347# KiCad Footprint
233480	    string  (module
23349>7	    byte    0x20		KiCad Footprint
23350!:ext kicad_mod
23351
23352# KiCad Footprint (Legacy)
233530	    string  PCBNEW-LibModule-V1	    KiCad Footprint (Legacy)
23354!:ext mod
23355
23356# KiCad Netlist
233570	    string  (export
23358>7	    byte    0x20		KiCad Netlist
23359!:ext net
23360
23361# KiCad Symbol Library Table
233620	    string  (sym_lib_table
23363>14	    byte    0xA			KiCad Symbol Library Table
23364>14	    byte    0xD			KiCad Symbol Library Table
23365>14	    byte    0x20		KiCad Symbol Library Table
23366
23367# KiCad Footprint Library Table
233680	    string  (fp_lib_table
23369>13	    byte    0xA			KiCad Footprint Library Table
23370>13	    byte    0xD			KiCad Footprint Library Table
23371>13	    byte    0x20		KiCad Footprint Library Table
23372
23373#------------------------------------------------------------------------------
23374# $File: kml,v 1.6 2019/05/21 04:50:10 christos Exp $
23375# Type: Google KML, formerly Keyhole Markup Language
23376# Future development of this format has been handed
23377# over to the Open Geospatial Consortium.
23378# https://www.opengeospatial.org/standards/kml/
23379# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
233800 string/t    \<?xml
23381>20  search/400 \ xmlns=
23382>>&0 regex ['"]http://earth.google.com/kml Google KML document
23383!:mime application/vnd.google-earth.kml+xml
23384>>>&1 string 2.0' \b, version 2.0
23385>>>&1 string 2.1' \b, version 2.1
23386>>>&1 string 2.2' \b, version 2.2
23387
23388#------------------------------------------------------------------------------
23389# Type: OpenGIS KML, formerly Keyhole Markup Language
23390# This standard is maintained by the
23391# Open Geospatial Consortium.
23392# https://www.opengeospatial.org/standards/kml/
23393# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
23394>>&0 regex ['"]http://www.opengis.net/kml OpenGIS KML document
23395!:mime application/vnd.google-earth.kml+xml
23396>>>&1 string/t 2.2 \b, version 2.2
23397
23398#------------------------------------------------------------------------------
23399# Type: Google KML Archive (ZIP based)
23400# https://code.google.com/apis/kml/documentation/kml_tut.html
23401# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
234020 string    PK\003\004
23403>4  byte    0x14
23404>>30  string doc.kml Compressed Google KML Document, including resources.
23405!:mime application/vnd.google-earth.kmz
23406#------------------------------------------------------------------------------
23407# $File: lammps,v 1.1 2021/03/14 16:24:18 christos Exp $
23408#
23409
23410# Magic file patterns for use with file(1) for the
23411# LAMMPS molecular dynamics simulation software.
23412# https://lammps.sandia.gov
23413#
23414# Updated: 2021-03-14 by akohlmey@gmail.com
23415
23416# Binary restart file for the LAMMPS MD code
234170        string  LammpS\ RestartT  LAMMPS binary restart file
23418>0x14    long    x                 (rev %d),
23419>>0x20   string  x                 Version %s,
23420>>>0x10  lelong  0x0001            Little Endian
23421>>>0x10  lelong  0x1000            Big Endian
23422
23423# Atom style binary dump file for the LAMMPS MD code
23424# written on a little endian machine
234250         lequad  -8
23426>0x08     string  DUMPATOM     LAMMPS atom style binary dump
23427>>0x14    long    x            (rev %d),
23428>>>0x10   lelong  0x0001       Little Endian,
23429>>>>0x18  lequad  x            First time step: %lld
23430
23431# written on a big endian machine
234320         bequad  -8
23433>0x08     string  DUMPATOM     LAMMPS atom style binary dump
23434>>0x14    belong  x            (rev %d),
23435>>>0x10   lelong  0x1000       Big Endian,
23436>>>>0x18  bequad  x            First time step: %lld
23437
23438# Atom style binary dump file for the LAMMPS MD code
23439# written on a little endian machine
234400         lequad  -10
23441>0x08     string  DUMPCUSTOM   LAMMPS custom style binary dump
23442>>0x16    lelong  x            (rev %d),
23443>>>0x12   lelong  0x0001       Little Endian,
23444>>>>0x1a  lequad  x            First time step: %lld
23445
23446# written on a big endian machine
234470         bequad  -10
23448>0x08     string  DUMPCUSTOM   LAMMPS custom style binary dump
23449>>0x16    belong  x            (rev %d),
23450>>>0x12   lelong  0x1000       Big Endian,
23451>>>>0x1a  bequad  x            First time step: %lld
23452
23453# LAMMPS log file
234540         string LAMMPS\ (                    LAMMPS log file
23455>8        regex/16 [0-9]+\ [A-Za-z]+\ [0-9]+  written by version %s
23456
23457# Data file written either by LAMMPS, msi2lmp or VMD/TopoTools
234580      string LAMMPS\ data\ file  LAMMPS data file
23459>0x12  string CGCMM\ style        written by TopoTools
23460>0x12  string msi2lmp             written by msi2lmp
23461>0x11  string via\ write_data     written by LAMMPS
23462
23463# LAMMPS data file written by OVITO
234640      string #\ LAMMPS\ data\ file   LAMMPS data file
23465>0x13  string written\ by\ OVITO      written by OVITO
23466
23467# LAMMPS text mode dump file
234680      string    ITEM:\ TIMESTEP      LAMMPS text mode dump,
23469>15    regex/16  [0-9]+               First time step: %s
23470
23471#------------------------------------------------------------------------------
23472# $File: lecter,v 1.4 2009/09/19 16:28:10 christos Exp $
23473# DEC SRC Virtual Paper: Lectern files
23474# Karl M. Hegbloom <karlheg@inetarena.com>
234750	string	lect	DEC SRC Virtual Paper Lectern file
23476
23477#------------------------------------------------------------------------------
23478# $File: lex,v 1.6 2009/09/19 16:28:10 christos Exp $
23479# lex:  file(1) magic for lex
23480#
23481#	derived empirically, your offsets may vary!
234820	search/100	yyprevious	C program text (from lex)
23483>3	search/1	>\0		 for %s
23484# C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com>
234850	search/100	generated\ by\ flex	C program text (from flex)
23486# lex description file, from Daniel Quinlan <quinlan@yggdrasil.com>
234870	search/1	%{		lex description text
23488
23489#------------------------------------------------------------------------------
23490# $File: lif,v 1.10 2021/04/26 15:56:00 christos Exp $
23491# lif:  file(1) magic for lif
23492#
23493# (Daniel Quinlan <quinlan@yggdrasil.com>)
23494#
23495# Modified by:	Joerg Jenderek
23496# URL:		https://www.hp9845.net/9845/projects/hpdir/
23497#		https://github.com/bug400/lifutils
23498# Reference:	https://www.hp9845.net/9845/downloads/manuals/LIF_excerpt_64941-90906_flpRef_Jan84.pdf
23499# Note:		called by TrID "HP Logical Interchange Format disk image"
235000	beshort		0x8000
23501# GRR: line above is too general as it catches also compressed DEGAS low-res bitmap *.pc1
23502# skip many compressed DEGAS low-res bitmap *.pc1 by test for unused bytes
23503>14	beshort		=0
23504# skip MUNCHIE.PC1 BOARD.PC1 ENEMIES.PC1 by test for low version number
23505>>20	ubeshort	<0x0100
23506# skip DEGAS MUNCHIE.PC1 BOARD.PC1 ENEMIES.PC1 by test for ASCII like volume name
23507#>>>2	ubelong		>0x2020201F
23508>>>0	use		lif-file
235090	name		lif-file
23510# LIF ID
23511>0	beshort		x		lif file
23512!:mime	application/x-lif-disk
23513# lif used by Tony Duell LIF utilities; enhanced version by Joachim Siebold use also dat; hpi used by hpdir
23514!:ext	lif/hpi/dat
23515# volume label; A-Z 0-9 _ ; default are 6 spaces
23516>2	string		x		"%.6s"
23517# version number; 0 for systems without extensions or 1 for model 64000
23518>20	ubeshort	x		\b, version %u
23519# LIF identifier; 010000 for system 3000
23520>12	beshort		!0x1000		\b, LIF identifier %#x
23521# directory start address in units like: 2
23522>8	ubelong		x		\b, directory
23523>8	ubelong		!2		start address %u
23524# length of directory like: 2 4 7 10 12 14 (for model 64000) 16 18 20 24 30 50 57 77 80
23525>16	ubelong		x		length %u
23526# level 1 extensions
23527>20	beshort		=0
23528>>24	ubequad		!0		\b, for extensions %#llx...
23529>20	beshort		>0
23530>>24	ubequad		!0		\b, extensions %#llx...
23531# word 21-126 reserved for extensions and future use; set to nil
23532>42	ubequad		!0		\b, RESERVED %#llx
23533# lif first file name for standard directory; 0xffff... means uninitialized
23534>8	ubelong		2
23535>>512	string		<\xff\xff	\b, 1st file %-.10s
23536
23537
23538#------------------------------------------------------------------------------
23539# $File: linux,v 1.82 2022/09/07 11:23:44 christos Exp $
23540# linux:  file(1) magic for Linux files
23541#
23542# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
23543# The following basic Linux magic is useful for reference, but using
23544# "long" magic is a better practice in order to avoid collisions.
23545#
23546# 2	leshort		100		Linux/i386
23547# >0	leshort		0407		impure executable (OMAGIC)
23548# >0	leshort		0410		pure executable (NMAGIC)
23549# >0	leshort		0413		demand-paged executable (ZMAGIC)
23550# >0	leshort		0314		demand-paged executable (QMAGIC)
23551#
235520	lelong		0x00640107	Linux/i386 impure executable (OMAGIC)
23553>16	lelong		0		\b, stripped
235540	lelong		0x00640108	Linux/i386 pure executable (NMAGIC)
23555>16	lelong		0		\b, stripped
235560	lelong		0x0064010b	Linux/i386 demand-paged executable (ZMAGIC)
23557>16	lelong		0		\b, stripped
235580	lelong		0x006400cc	Linux/i386 demand-paged executable (QMAGIC)
23559>16	lelong		0		\b, stripped
23560#
235610	string		\007\001\000	Linux/i386 object file
23562>20	lelong		>0x1020		\b, DLL library
23563# Linux-8086 stuff:
235640	string		\01\03\020\04	Linux-8086 impure executable
23565>28	long		!0		not stripped
235660	string		\01\03\040\04	Linux-8086 executable
23567>28	long		!0		not stripped
23568#
235690	string		\243\206\001\0	Linux-8086 object file
23570#
235710	string		\01\03\020\20	Minix-386 impure executable
23572>28	long		!0		not stripped
235730	string		\01\03\040\20	Minix-386 executable
23574>28	long		!0		not stripped
235750	string		\01\03\04\20	Minix-386 NSYM/GNU executable
23576>28	long		!0		not stripped
23577# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov>
23578216	lelong		0421		Linux/i386 core file
23579!:strength / 2
23580>220	string		>\0		of '%s'
23581>200	lelong		>0		(signal %d)
23582#
23583# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com>
23584# this can be overridden by the DOS executable (COM) entry
235852	string		LILO		Linux/i386 LILO boot/chain loader
23586#
23587# Linux make config build file, from Ole Aamot <oka@oka.no>
23588# Updated by Ken Sharp
2358928	string		make\ config		Linux make config build file (old)
2359049	search/70	Kernel\ Configuration	Linux make config build file
23591
23592#
23593# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com>
23594# Updated by Adam Buchbinder <adam.buchbinder@gmail.com>
23595# See: https://www.win.tue.nl/~aeb/linux/kbd/font-formats-1.html
235960	leshort		0x0436		Linux/i386 PC Screen Font v1 data,
23597>2	byte&0x01	0		256 characters,
23598>2	byte&0x01	!0		512 characters,
23599>2	byte&0x02	0		no directory,
23600>2	byte&0x02	!0		Unicode directory,
23601>3	byte		>0		8x%d
236020	string		\x72\xb5\x4a\x86\x00\x00 Linux/i386 PC Screen Font v2 data,
23603>16	lelong		x		%d characters,
23604>12	lelong&0x01	0		no directory,
23605>12	lelong&0x01	!0		Unicode directory,
23606>24	lelong		x		%d
23607>28	lelong		x		\bx%d
23608
23609# Linux swap and hibernate files
23610# Linux kernel: include/linux/swap.h
23611# util-linux: libblkid/src/superblocks/swap.c
23612
23613# format v0, unsupported since 2002
236140xff6	string		SWAP-SPACE	Linux old swap file, 4k page size
236150x1ff6	string		SWAP-SPACE	Linux old swap file, 8k page size
236160x3ff6	string		SWAP-SPACE	Linux old swap file, 16k page size
236170x7ff6	string		SWAP-SPACE	Linux old swap file, 32k page size
236180xfff6	string		SWAP-SPACE	Linux old swap file, 64k page size
23619
23620# format v1, supported since 1998
236210		name	linux-swap
23622>0x400	lelong		1	little endian, version %u,
23623>>0x404	lelong		x	size %u pages,
23624>>0x408	lelong		x	%u bad pages,
23625>0x400	belong		1	big endian, version %u,
23626>>0x404	belong		x	size %u pages,
23627>>0x408	belong		x	%u bad pages,
23628>0x41c	string		\0	no label,
23629>0x41c	string		>\0	LABEL=%s,
23630>0x40c	ubelong		x	UUID=%08x
23631>0x410	ubeshort	x	\b-%04x
23632>0x412	ubeshort	x	\b-%04x
23633>0x414	ubeshort	x	\b-%04x
23634>0x416	ubelong		x	\b-%08x
23635>0x41a	ubeshort	x	\b%04x
23636
236370xff6	string		SWAPSPACE2	Linux swap file, 4k page size,
23638>0		use			linux-swap
236390x1ff6	string		SWAPSPACE2	Linux swap file, 8k page size,
23640>0		use			linux-swap
236410x3ff6	string		SWAPSPACE2	Linux swap file, 16k page size,
23642>0		use			linux-swap
236430x7ff6	string		SWAPSPACE2	Linux swap file, 32k page size,
23644>0		use			linux-swap
236450xfff6	string		SWAPSPACE2	Linux swap file, 64k page size,
23646>0		use			linux-swap
23647
236480	name	linux-hibernate
23649>0	string	S1SUSPEND	\b, with SWSUSP1 image
23650>0	string	S2SUSPEND	\b, with SWSUSP2 image
23651>0	string	ULSUSPEND	\b, with uswsusp image
23652>0	string	LINHIB0001	\b, with compressed hibernate image
23653>0	string	\xed\xc3\x02\xe9\x98\x56\xe5\x0c	\b, with tuxonice image
23654>0	default	x			\b, with unknown hibernate image
23655
236560xfec	string		SWAPSPACE2	Linux swap file, 4k page size,
23657>0		use			linux-swap
23658>0xff6	use			linux-hibernate
236590x1fec	string		SWAPSPACE2	Linux swap file, 8k page size,
23660>0		use			linux-swap
23661>0x1ff6	use			linux-hibernate
236620x3fec	string		SWAPSPACE2	Linux swap file, 16k page size,
23663>0		use			linux-swap
23664>0x3ff6	use			linux-hibernate
236650x7fec	string		SWAPSPACE2	Linux swap file, 32k page size,
23666>0		use			linux-swap
23667>0x7ff6	use			linux-hibernate
236680xffec	string		SWAPSPACE2	Linux swap file, 64k page size,
23669>0		use			linux-swap
23670>0xfff6	use			linux-hibernate
23671
23672#
23673# Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu>
23674# and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de>
23675# and Nicolas Lichtmaier <nick@debian.org>
23676# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29
23677# Linux kernel boot images (i386 arch) (Wolfram Kleff)
23678# URL: https://www.kernel.org/doc/Documentation/x86/boot.txt
23679514	string		HdrS		Linux kernel
23680!:strength + 55
23681# often no extension like in linux, vmlinuz, bzimage or memdisk but sometimes
23682# Acronis Recovery kernel64.dat and Plop Boot Manager plpbtrom.bin
23683# DamnSmallLinux 1.5 damnsmll.lnx
23684!:ext	/dat/bin/lnx
23685>510	leshort		0xAA55		x86 boot executable
23686>>518	leshort		>0x1ff
23687>>>529	byte		0		zImage,
23688>>>529	byte		1		bzImage,
23689>>>526	lelong		>0
23690>>>>(526.s+0x200) string	>\0	version %s,
23691>>498	leshort		1		RO-rootFS,
23692>>498	leshort		0		RW-rootFS,
23693>>508	leshort		>0		root_dev %#X,
23694>>502	leshort		>0		swap_dev %#X,
23695>>504	leshort		>0		RAMdisksize %u KB,
23696>>506	leshort		0xFFFF		Normal VGA
23697>>506	leshort		0xFFFE		Extended VGA
23698>>506	leshort		0xFFFD		Prompt for Videomode
23699>>506	leshort		>0		Video mode %d
23700# This also matches new kernels, which were caught above by "HdrS".
237010		belong	0xb8c0078e	Linux kernel
23702>0x1e3		string	Loading		version 1.3.79 or older
23703>0x1e9		string	Loading		from prehistoric times
23704
23705# System.map files - Nicolas Lichtmaier <nick@debian.org>
237068	search/1	\ A\ _text	Linux kernel symbol map text
23707
23708# LSM entries - Nicolas Lichtmaier <nick@debian.org>
237090	search/1	Begin3	Linux Software Map entry text
237100	search/1	Begin4	Linux Software Map entry text (new format)
23711
23712# From Matt Zimmerman, enhanced for v3 by Matthew Palmer
237130	belong	0x4f4f4f4d	User-mode Linux COW file
23714>4	belong	<3		\b, version %d
23715>>8	string	>\0		\b, backing file %s
23716>4	belong	>2		\b, version %d
23717>>32	string	>\0		\b, backing file %s
23718
23719############################################################################
23720# Linux kernel versions
23721
237220		string		\xb8\xc0\x07\x8e\xd8\xb8\x00\x90	Linux
23723>497		leshort		0		x86 boot sector
23724>>514		belong		0x8e	of a kernel from the dawn of time!
23725>>514		belong		0x908ed8b4	version 0.99-1.1.42
23726>>514		belong		0x908ed8b8	for memtest86
23727
23728>497		leshort		!0		x86 kernel
23729>>504		leshort		>0		RAMdisksize=%u KB
23730>>502		leshort		>0		swap=%#X
23731>>508		leshort		>0		root=%#X
23732>>>498		leshort		1		\b-ro
23733>>>498		leshort		0		\b-rw
23734>>506		leshort		0xFFFF		vga=normal
23735>>506		leshort		0xFFFE		vga=extended
23736>>506		leshort		0xFFFD		vga=ask
23737>>506		leshort		>0		vga=%d
23738>>514		belong		0x908ed881	version 1.1.43-1.1.45
23739>>514		belong		0x15b281cd
23740>>>0xa8e	belong		0x55AA5a5a	version 1.1.46-1.2.13,1.3.0
23741>>>0xa99	belong		0x55AA5a5a	version 1.3.1,2
23742>>>0xaa3	belong		0x55AA5a5a	version 1.3.3-1.3.30
23743>>>0xaa6	belong		0x55AA5a5a	version 1.3.31-1.3.41
23744>>>0xb2b	belong		0x55AA5a5a	version 1.3.42-1.3.45
23745>>>0xaf7	belong		0x55AA5a5a	version 1.3.46-1.3.72
23746>>514		string		HdrS
23747>>>518		leshort		>0x1FF
23748>>>>529		byte		0		\b, zImage
23749>>>>529		byte		1		\b, bzImage
23750>>>>(526.s+0x200) string 	>\0		\b, version %s
23751
23752# Linux boot sector thefts.
237530		belong		0xb8c0078e	Linux
23754>0x1e6		belong		0x454c4b53	ELKS Kernel
23755>0x1e6		belong		!0x454c4b53	style boot sector
23756
23757############################################################################
23758# Linux S390 kernel image
23759# Created by: Jan Kaluza <jkaluza@redhat.com>
237608 string \x02\x00\x00\x18\x60\x00\x00\x50\x02\x00\x00\x68\x60\x00\x00\x50\x40\x40\x40\x40\x40\x40\x40\x40 Linux S390
23761>0x00010000 search/b/4096 \x00\x0a\x00\x00\x8b\xad\xcc\xcc
23762# 64bit
23763>>&0 string \xc1\x00\xef\xe3\xf0\x68\x00\x00 Z10 64bit kernel
23764>>&0 string \xc1\x00\xef\xc3\x00\x00\x00\x00 Z9-109 64bit kernel
23765>>&0 string \xc0\x00\x20\x00\x00\x00\x00\x00 Z990 64bit kernel
23766>>&0 string \x00\x00\x00\x00\x00\x00\x00\x00 Z900 64bit kernel
23767# 32bit
23768>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z10 32bit kernel
23769>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z9-109 32bit kernel
23770>>&0 string \x80\x00\x20\x00\x00\x00\x00\x00 Z990 32bit kernel
23771>>&0 string \x80\x00\x00\x00\x00\x00\x00\x00 Z900 32bit kernel
23772
23773############################################################################
23774# Linux ARM compressed kernel image
23775# From: Kevin Cernekee <cernekee@gmail.com>
23776# Update: Joerg Jenderek
237770x24	lelong	0x016f2818	Linux kernel ARM boot executable zImage
23778# There are three possible situations: LE, BE with LE bootloader and pure BE.
23779# In order to aid telling these apart a new endian flag was added. In order
23780# to support kernels before the flag and BE with LE bootloader was added we'll
23781# do a negative check against the BE variant of the flag when we see a LE magic.
23782>0x30	belong	!0x04030201	(little-endian)
23783# raspian "kernel7.img", Vu+ Ultimo4K "kernel_auto.bin"
23784!:ext	img/bin
23785>0x30	belong	0x04030201	(big-endian)
237860x24	belong	0x016f2818	Linux kernel ARM boot executable zImage (big-endian)
23787
23788############################################################################
23789# Linux AARCH64 kernel image
237900x38    lelong  0x644d5241  Linux kernel ARM64 boot executable Image
23791>0x18   lelong  ^1          \b, little-endian
23792>0x18   lelong  &1          \b, big-endian
23793>0x18   lelong  &2          \b, 4K pages
23794>0x18   lelong  &4          \b, 16K pages
23795>0x18   lelong  &6          \b, 32K pages
23796
23797############################################################################
23798# Linux 8086 executable
237990	lelong&0xFF0000FF 0xC30000E9	Linux-Dev86 executable, headerless
23800>5	string		.
23801>>4	string		>\0		\b, libc version %s
23802
238030	lelong&0xFF00FFFF 0x4000301	Linux-8086 executable
23804>2	byte&0x01	!0		\b, unmapped zero page
23805>2	byte&0x20	0		\b, impure
23806>2	byte&0x20	!0
23807>>2	byte&0x10	!0		\b, A_EXEC
23808>2	byte&0x02	!0		\b, A_PAL
23809>2	byte&0x04	!0		\b, A_NSYM
23810>2	byte&0x08	!0		\b, A_STAND
23811>2	byte&0x40	!0		\b, A_PURE
23812>2	byte&0x80	!0		\b, A_TOVLY
23813>28     long            !0              \b, not stripped
23814>37	string		.
23815>>36	string		>\0		\b, libc version %s
23816
23817# 0	lelong&0xFF00FFFF 0x10000301	ld86 I80386 executable
23818# 0	lelong&0xFF00FFFF 0xB000301	ld86 M68K executable
23819# 0	lelong&0xFF00FFFF 0xC000301	ld86 NS16K executable
23820# 0	lelong&0xFF00FFFF 0x17000301	ld86 SPARC executable
23821
23822# SYSLINUX boot logo files (from 'ppmtolss16' sources)
23823# https://www.syslinux.org/wiki/index.php/SYSLINUX#Display_graphic_from_filename:
23824# file extension .lss .16
238250	lelong	=0x1413f33d		SYSLINUX' LSS16 image data
23826# syslinux-4.05/mime/image/x-lss16.xml
23827!:mime image/x-lss16
23828>4	leshort	x			\b, width %d
23829>6	leshort	x			\b, height %d
23830
238310	string	OOOM			User-Mode-Linux's Copy-On-Write disk image
23832>4	belong	x			version %d
23833
23834# SE Linux policy database
23835# From: Mike Frysinger <vapier@gentoo.org>
238360	lelong	0xf97cff8c		SE Linux policy
23837>16	lelong	x			v%d
23838>20	lelong	1			MLS
23839>24	lelong	x			%d symbols
23840>28	lelong	x			%d ocons
23841
23842# Linux Logical Volume Manager (LVM)
23843# Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net>
23844#
23845# System ID, UUID and volume group name are 128 bytes long
23846# but they should never be full and initialized with zeros...
23847#
23848# LVM1
23849#
238500x0	string/b	HM\001		LVM1 (Linux Logical Volume Manager), version 1
23851>0x12c	string/b	>\0		, System ID: %s
23852
238530x0	string/b	HM\002		LVM1 (Linux Logical Volume Manager), version 2
23854>0x12c	string/b	>\0		, System ID: %s
23855
23856#  LVM2
23857#
23858# It seems that the label header can be in one the four first sector
23859# of the disk... (from _find_labeller in lib/label/label.c of LVM2)
23860#
23861# 0x200 seems to be the common case
238620		name	lvm2
23863# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
23864>0x0          string  >\x2f          \b, UUID: %.6s
23865>0x6          string  >\x2f          \b-%.4s
23866>0xa          string  >\x2f          \b-%.4s
23867>0xe          string  >\x2f          \b-%.4s
23868>0x12         string  >\x2f          \b-%.4s
23869>0x16         string  >\x2f          \b-%.4s
23870>0x1a         string  >\x2f          \b-%.6s
23871>0x20         lequad  x              \b, size: %lld
23872
23873
23874# read the offset to add to the start of the header, and the header
23875# start in 0x200
238760x218           string/b  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
23877>&(&-12.l-0x20) use	lvm2
23878
238790x018           string/b  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
23880>&(&-12.l-0x20) use	lvm2
23881
238820x418           string/b  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
23883>&(&-12.l-0x20) use	lvm2
23884
238850x618           string/b  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
23886>&(&-12.l-0x20) use	lvm2
23887
23888# LVM snapshot
23889# from Jason Farrel
238900	string	SnAp	LVM Snapshot (CopyOnWrite store)
23891>4	lelong	!0	- valid,
23892>4	lelong	0	- invalid,
23893>8	lelong	x	version %d,
23894>12	lelong	x	chunk_size %d
23895
23896# SE Linux policy database
238970	lelong	0xf97cff8c		SE Linux policy
23898>16	lelong	x			v%d
23899>20	lelong	1			MLS
23900>24	lelong	x			%d symbols
23901>28	lelong	x			%d ocons
23902
23903# Summary: Xen saved domain file
23904# Created by: Radek Vokal <rvokal@redhat.com>
239050	string		LinuxGuestRecord	Xen saved domain
23906>20	search/256	(name
23907>>&1	string		x			(name %s)
23908
23909# Type: Xen, the virtual machine monitor
23910# From: Radek Vokal <rvokal@redhat.com>
239110	string		LinuxGuestRecord	Xen saved domain
23912#>2	regex		\(name\ [^)]*\)		%s
23913>20	search/256	(name			(name
23914>>&1	string		x			%s...)
23915
23916# Systemd journald files
23917# See https://www.freedesktop.org/wiki/Software/systemd/journal-files/.
23918# From: Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl>
23919
23920# check magic
239210	string	LPKSHHRH
23922# check that state is one of known values
23923>16		ubyte&252	0
23924# check that each half of three unique id128s is non-zero
23925>>24		ubequad		>0
23926>>>32		ubequad		>0
23927>>>>40		ubequad		>0
23928>>>>>48		ubequad		>0
23929>>>>>>56	ubequad		>0
23930>>>>>>>64	ubequad		>0	Journal file
23931!:mime application/octet-stream
23932# provide more info
23933>>>>>>>>184	leqdate		0	empty
23934>>>>>>>>16	ubyte		0	\b, offline
23935>>>>>>>>16	ubyte		1	\b, online
23936>>>>>>>>16	ubyte		2	\b, archived
23937>>>>>>>>8	ulelong&1	1	\b, sealed
23938>>>>>>>>12	ulelong&1	1	\b, compressed
23939
23940# BCache backing and cache devices
23941# From: Gabriel de Perthuis <g2p.code@gmail.com>
239420x1008		lequad		8
23943>0x1018		string		\xc6\x85\x73\xf6\x4e\x1a\x45\xca\x82\x65\xf5\x7f\x48\xba\x6d\x81	BCache
23944>>0x1010	ulequad		0	cache device
23945>>0x1010	ulequad		1	backing device
23946>>0x1010	ulequad		3	cache device
23947>>0x1010	ulequad		4	backing device
23948>>0x1048	string		>0	\b, label "%.32s"
23949>>0x1028	ubelong		x	\b, uuid %08x
23950>>0x102c	ubeshort	x	\b-%04x
23951>>0x102e	ubeshort	x	\b-%04x
23952>>0x1030	ubeshort	x	\b-%04x
23953>>0x1032	ubelong		x	\b-%08x
23954>>0x1036	ubeshort	x	\b%04x
23955>>0x1038	ubelong		x	\b, set uuid %08x
23956>>0x103c	ubeshort	x	\b-%04x
23957>>0x103e	ubeshort	x	\b-%04x
23958>>0x1040	ubeshort	x	\b-%04x
23959>>0x1042	ubelong		x	\b-%08x
23960>>0x1046	ubeshort	x	\b%04x
23961
23962# Linux device tree:
23963# File format description can be found in the Linux kernel sources at
23964# Documentation/devicetree/booting-without-of.txt
23965# From Christoph Biedl
239660		belong		0xd00dfeed
23967# structure must be within blob, strings are omitted to handle devicetrees > 1M
23968>&(8.L)		byte		x
23969>>20		belong		>1	Device Tree Blob version %d
23970>>>4		belong		x	\b, size=%d
23971>>>20		belong		>1
23972>>>>28		belong		x	\b, boot CPU=%d
23973>>>20		belong		>2
23974>>>>32		belong		x	\b, string block size=%d
23975>>>20		belong		>16
23976>>>>36		belong		x	\b, DT structure block size=%d
23977
23978# glibc locale archive as defined in glibc locale/locarchive.h
239790		lelong		0xde020109	locale archive
23980>24		lelong		x		%d strings
23981
23982# Linux Software RAID (mdadm)
23983# Russell Coker <russell@coker.com.au>
239840	name	linuxraid
23985>16	belong	x		UUID=%8x:
23986>20	belong	x		\b%8x:
23987>24	belong	x		\b%8x:
23988>28	belong	x		\b%8x
23989>32	string	x		name=%s
23990>72	lelong	x		level=%d
23991>92	lelong	x		disks=%d
23992
239934096	lelong	0xa92b4efc	Linux Software RAID
23994>4100	lelong	x		version 1.2 (%d)
23995>4096	use	linuxraid
23996
239970	lelong	0xa92b4efc	Linux Software RAID
23998>4	lelong	x		version 1.1 (%d)
23999>0	use	linuxraid
24000
24001# Summary:     Database file for mlocate
24002# Description: A database file as used by mlocate, a fast implementation
24003#              of locate/updatedb. It uses merging to reuse the existing
24004#              database and avoid rereading most of the filesystem. It's
24005#              the default version of locate on Arch Linux (and others).
24006# File path:   /var/lib/mlocate/mlocate.db by default (but configurable)
24007# Site:        https://fedorahosted.org/mlocate/
24008# Format docs: https://linux.die.net/man/5/mlocate.db
24009# Type: mlocate database file
24010# URL:  https://fedorahosted.org/mlocate/
24011# From: Wander Nauta <info@wandernauta.nl>
240120		string		\0mlocate	mlocate database
24013>12		byte		x		\b, version %d
24014>13		byte		1		\b, require visibility
24015>16		string		x		\b, root %s
24016
24017# Dump files for iproute2 tool. Generated by the "ip r|a save" command. URL:
24018# https://www.linuxfoundation.org/collaborate/workgroups/networking/iproute2
24019# From: Pavel Emelyanov <xemul@parallels.com>
240200		lelong		0x45311224	iproute2 routes dump
240210		lelong		0x47361222	iproute2 addresses dump
24022
24023# Image and service files for CRIU tool.
24024# URL: https://criu.org
24025# From: Pavel Emelyanov <xemul@parallels.com>
240260		lelong		0x54564319	CRIU image file v1.1
240270		lelong		0x55105940	CRIU service file
240280		lelong		0x58313116	CRIU inventory
24029
24030# Kdump compressed dump files
24031# https://sourceforge.net/p/makedumpfile/code/ci/master/tree/IMPLEMENTATION
24032
240330		string		KDUMP          	Kdump compressed dump
24034>8		long		x		v%d
24035>12		string		>\0		\b, system %s
24036>77		string		>\0		\b, node %s
24037>142		string		>\0		\b, release %s
24038>207		string		>\0		\b, version %s
24039>272		string		>\0		\b, machine %s
24040>337		string		>\0		\b, domain %s
24041
24042# Device Tree files
240430		search/1024	/dts-v1/	Device Tree File (v1)
24044# beat c code
24045!:strength +14
24046
24047
24048# e2fsck undo file
24049# David Gilman <davidgilman1@gmail.com>
240500		string		E2UNDO02	e2fsck undo file, version 2
24051>44		lelong		x		\b, undo file is
24052>>44		lelong&1	0		not finished
24053>>44		lelong&1	1		finished
24054>48		lelong		x		\b, undo file features:
24055>>48		lelong&1	0		lacks filesystem offset
24056>>48		lelong&1	1		has filesystem offset
24057>>>64		lequad		x		at %#llx
24058
24059# ansible vault (does not really belong here)
240600		string		$ANSIBLE_VAULT;	Ansible Vault
24061>&0		regex		[0-9]+\\.[0-9]+	\b, version %s
24062>>&0		string		;
24063>>>&0		regex		[A-Z0-9]+	\b, encryption %s
24064
24065# From:		Joerg Jenderek
24066# URL:		https://www.gnu.org/software/grub
24067# Reference:	https://ftp.gnu.org/gnu/grub/grub-2.06.tar.gz
24068#		grub-2.06/include/grub/keyboard_layouts.h
24069#		grub-2.06/grub-core/commands/keylayouts.c
24070# GRUB_KEYBOARD_LAYOUTS_FILEMAGIC
240710	string		GRUBLAYO		GRUB Keyboard
24072!:mime			application/x-grub-keyboard
24073!:ext			gkb
24074# GRUB_KEYBOARD_LAYOUTS_VERSION like: 10
24075>8	ulelong		!10			\b, version %u
24076# 4 grub_uint32_t grub_keyboard_layout[160]
24077# for normal french keyboard this is letter a
24078>92	ubyte		!0x71
24079>>92	ubyte		>0x40			\b, english q is %c
24080#>732	ubyte		x			\b, english Q is %c
24081# for normal german keyboard this is letter z
24082>124	ubyte		!0x79
24083>>124	ubyte		>0x40			\b, english y is %c
24084#>764	ubyte		x			\b, english Y is %c
24085
24086#------------------------------------------------------------------------------
24087# $File: lisp,v 1.27 2020/08/14 19:23:39 christos Exp $
24088# lisp:  file(1) magic for lisp programs
24089#
24090# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
24091
24092# updated by Joerg Jenderek
24093# GRR: This lot is too weak
24094#0	string	;;
24095# windows INF files often begin with semicolon and use CRLF as line end
24096# lisp files are mainly created on unix system with LF as line end
24097#>2	search/4096	!\r		Lisp/Scheme program text
24098#>2	search/4096	\r		Windows INF file
24099
241000	search/4096	(setq\ 			Lisp/Scheme program text
24101!:mime	text/x-lisp
241020	search/4096	(defvar\ 		Lisp/Scheme program text
24103!:mime	text/x-lisp
241040	search/4096	(defparam\ 		Lisp/Scheme program text
24105!:mime	text/x-lisp
241060	search/4096	(defun\  		Lisp/Scheme program text
24107!:mime	text/x-lisp
241080	search/4096	(autoload\ 		Lisp/Scheme program text
24109!:mime	text/x-lisp
241100	search/4096	(custom-set-variables\ 	Lisp/Scheme program text
24111!:mime	text/x-lisp
24112
24113# URL: https://en.wikipedia.org/wiki/Emacs_Lisp
24114# Reference: https://ftp.gnu.org/old-gnu/emacs/elisp-manual-18-1.03.tar.gz
24115# Update: Joerg Jenderek
24116# Emacs 18 - this is always correct, but not very magical.
241170	string	\012(
24118# look for emacs lisp keywords
24119# GRR: split regex because it is too long or get error like
24120# lisp, 36: Warning: cannot get string from `^(defun|defvar|defconst|defmacro|setq|fset|put|provide|require|'
24121>&0	regex	\^(defun|defvar|defconst|defmacro|setq|fset)	Emacs v18 byte-compiled Lisp data
24122!:mime	application/x-elc
24123# https://searchcode.com/codesearch/view/2173420/
24124# not really pure text
24125!:apple	EMAxTEXT
24126!:ext elc
24127# remaining regex
24128>&0	regex	\^(put|provide|require|random)	Emacs v18 byte-compiled Lisp data
24129!:mime	application/x-elc
24130!:apple	EMAxTEXT
24131!:ext elc
24132# missed cl.elc dbx.elc simple.elc look like normal lisp starting with ;;;
24133
24134# Emacs 19+ - ver. recognition added by Ian Springer
24135# Also applies to XEmacs 19+ .elc files; could tell them apart with regexs
24136# - Chris Chittleborough <cchittleborough@yahoo.com.au>
24137# Update: Joerg Jenderek
241380	string	;ELC
24139# version\0\0\0
24140>4	byte	>18			Emacs/XEmacs v%d byte-compiled Lisp data
24141# why less than 32 ? does not make sense to me. GNU Emacs version is 24.5 at April 2015
24142#>4	byte    <32			Emacs/XEmacs v%d byte-compiled Lisp data
24143!:mime	application/x-elc
24144!:apple	EMAxTEXT
24145!:ext elc
24146
24147# Files produced by GNU/Emacs pdumper
241480	string	DUMPEDGNUEMACS	GNU/Emacs pdumper image
24149
24150# Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr>
241510	string	(SYSTEM::VERSION\040'	CLISP byte-compiled Lisp program (pre 2004-03-27)
241520	string	(|SYSTEM|::|VERSION|\040'	CLISP byte-compiled Lisp program text
24153
241540	long	0x70768BD2		CLISP memory image data
241550	long	0xD28B7670		CLISP memory image data, other endian
24156
24157#.com and .bin for MIT scheme
241580	string	\372\372\372\372	MIT scheme (library?)
24159
24160# From: David Allouche <david@allouche.net>
241610	search/1	\<TeXmacs|	TeXmacs document text
24162!:mime	text/texmacs
24163
24164#------------------------------------------------------------------------------
24165# $File: llvm,v 1.9 2019/04/19 00:42:27 christos Exp $
24166# llvm:  file(1) magic for LLVM byte-codes
24167# URL:  https://llvm.org/docs/BitCodeFormat.html
24168# From: Al Stone <ahs3@fc.hp.com>
24169
241700	string	llvm	LLVM byte-codes, uncompressed
241710	string	llvc0	LLVM byte-codes, null compression
241720	string	llvc1	LLVM byte-codes, gzip compression
241730	string	llvc2	LLVM byte-codes, bzip2 compression
24174
241750	lelong	0x0b17c0de	LLVM bitcode, wrapper
24176# Are these Mach-O ABI values?  They appear to be.
24177>16	lelong	0x01000007	x86_64
24178>16	lelong	0x00000007	i386
24179>16	lelong	0x00000012	ppc
24180>16	lelong	0x01000012	ppc64
24181>16	lelong 	0x0000000c	arm
24182
241830	string	BC\xc0\xde	LLVM IR bitcode
24184
24185#------------------------------------------------------------------------------
24186# $File: locoscript,v 1.1 2021/01/03 20:56:25 christos Exp $
24187# locoscript:  file(1) magic for LocoScript documents and related files
24188#
24189# See http://fileformats.archiveteam.org/wiki/LocoScript
241900	string	JOY\x01\x01	LocoScript 1 document
241910	string	JOY\x01\x02	LocoScript 2 document
241920	string	JOY\x01\x04	LocoScript 3 document
241930	string	JOY\x01\x06	LocoScript 4 document
241940	string	DOC\x01\x01	LocoScript PC document
241950	string	DOC\x01\x03	LocoScript Professional document
24196
24197#------------------------------------------------------------------------------
24198# $File: lua,v 1.8 2020/10/08 23:23:56 christos Exp $
24199# lua:  file(1) magic for Lua scripting language
24200# URL:  https://www.lua.org/
24201# From: Reuben Thomas <rrt@sc3d.org>, Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr>
24202
24203# Lua scripts
242040	search/1/w	#!\ /usr/bin/lua	Lua script text executable
24205!:mime	text/x-lua
242060	search/1/w	#!\ /usr/local/bin/lua	Lua script text executable
24207!:mime	text/x-lua
242080	search/1	#!/usr/bin/env\ lua	Lua script text executable
24209!:mime	text/x-lua
242100	search/1	#!\ /usr/bin/env\ lua	Lua script text executable
24211!:mime	text/x-lua
24212
24213# Lua bytecode
242140	string		\033Lua			Lua bytecode,
24215# 2.4 uses 0x23 as its version byte because it shares the format
24216# with 2.3 (which was never released publicly).
24217>4	byte		0x23			version 2.4
24218>4	byte		0x25			version 2.5/3.0
24219>4	byte		0x31			version 3.1
24220>4	byte		0x32			version 3.2
24221>4	byte		0x40			version 4.0
24222>4	byte		0x50			version 5.0
24223>4	byte		0x51			version 5.1
24224>4	byte		0x52			version 5.2
24225>4	byte		0x53			version 5.3
24226>4	byte		0x54			version 5.4
24227
24228#------------------------------------------------------------------------------
24229# $File: luks,v 1.5 2022/09/07 11:23:44 christos Exp $
24230# luks:  file(1) magic for Linux Unified Key Setup
24231# URL:		https://en.wikipedia.org/wiki/Linux_Unified_Key_Setup
24232#		http://fileformats.archiveteam.org/wiki/LUKS
24233# From:	Anthon van der Neut <anthon@mnt.org>
24234# Update:	Joerg Jenderek
24235# Note:		verfied by command like `cryptsetup luksDump /dev/sda3`
24236
242370	string		LUKS\xba\xbe	LUKS encrypted file,
24238# https://reposcope.com/mimetype/application/x-raw-disk-image
24239!:mime	application/x-raw-disk-image
24240#!:mime	application/x-luks-volume
24241# img is the generic extension; no suffix for partitions; luksVolumeHeaderBackUp via zuluCrypt
24242!:ext	/luks/img/luksVolumeHeaderBackUp
24243# version like: 1 2
24244>6	beshort		x		ver %d
24245# test for version 1 variant
24246>6	beshort		1
24247>>0			use		luks-v1
24248# test for version 2 variant
24249>6	beshort		>1
24250>>0			use		luks-v2
24251# Reference:	https://mirrors.edge.kernel.org/pub/linux/utils/cryptsetup/LUKS_docs/on-disk-format.pdf
24252#		http://mark0.net/download/triddefs_xml.7z/defs/l/luks.trid.xml
24253# display information about LUKS version 1
242540	name		luks-v1
24255# cipher-name like: aes twofish
24256>8	string		x		[%s,
24257# cipher-mode like: xts-plain64 cbc-essiv
24258>40	string		x		%s,
24259# hash specification like: sha256 sha1 ripemd160
24260>72	string		x		%s]
24261>168	string		x		UUID: %s
24262# NEW PART!
24263# payload-offset; start offset of the bulk data
24264>104	 ubelong	x		\b, at %#x data
24265# key-bytes; number of key bytes; key-bytes*8=MK-bits
24266>108	 ubelong	x		\b, %u key bytes
24267# mk-digest[20]; master key checksum from PBKDF2
24268>112	ubequad		x		\b, MK digest %#16.16llx
24269>>120	ubequad		x		\b%16.16llx
24270>>128	ubelong		x		\b%8.8x
24271# mk-digest-salt[32]; salt parameter for master key PBKDF2
24272>132	ubequad		x		\b, MK salt %#16.16llx
24273>>140	ubequad		x		\b%16.16llx
24274>>148	ubequad		x		\b%16.16llx
24275>>156	ubequad		x		\b%16.16llx
24276# mk-digest-iter; iterations parameter for master key PBKDF2
24277>164	ubelong		x		\b, %u MK iterations
24278# key slot 1
24279>208	ubelong		=0x00AC71F3	\b; slot #0
24280>>208			use		luks-slot
24281# key slot 2
24282>256	ubelong		=0x00AC71F3	\b; slot #1
24283>>256			use		luks-slot
24284# key slot 3
24285>304	ubelong		=0x00AC71F3	\b; slot #2
24286>>304			use		luks-slot
24287# key slot 4
24288>352	ubelong		=0x00AC71F3	\b; slot #3
24289>>352			use		luks-slot
24290# key slot 5
24291>400	ubelong		=0x00AC71F3	\b; slot #4
24292>>400			use		luks-slot
24293# key slot 6
24294>448	ubelong		=0x00AC71F3	\b; slot #5
24295>>448			use		luks-slot
24296# key slot 7
24297>496	ubelong		=0x00AC71F3	\b; slot #6
24298>>496			use		luks-slot
24299# key slot 8
24300>544	ubelong		=0x00AC71F3	\b; slot #7
24301>>544			use		luks-slot
24302# Reference:	https://gitlab.com/cryptsetup/LUKS2-docs/-/raw/master/luks2_doc_wip.pdf
24303#		http://mark0.net/download/triddefs_xml.7z/defs/l/luks2.trid.xml
24304# display information about LUKS version 2
243050	name		luks-v2
24306# hdr_size; size including JSON area called Metadata area by cryptsetup with value like: 16384
24307>8	ubequad		x		\b, header size %llu
24308# possible check for MAGIC_2ND after header
24309#>(8.Q) 	 string		SKUL\xba\xbe	\b, 2nd_HEADER_OK
24310# seqid; sequence ID, increased on update; called Epoch by cryptsetup with value like: 3 4 8 10
24311>16	ubequad		x		\b, ID %llu
24312# label[48]; optional ASCII label or empty; called Label by cryptsetup with value like: "LUKS2_EXT4_ROOT"
24313>24	string		>\0		\b, label %s
24314# csum_alg[32]; checksum algorithm like: sha256 sha1 sha512 wirlpool ripemd160
24315>72	string		x		\b, algo %s
24316# salt[64]; salt , unique for every header
24317>104	ubequad		x		\b, salt %#llx...
24318# uuid[40]; UID of device as string like: 242256c6-396e-4a35-af5f-5b70cb7af9a7
24319>168	string		x		\b, UUID: %-.40s
24320# subsystem[48]; optional owner subsystem label or empty
24321>208	string		>\0		\b, sub label %-.48s
24322# hdr_offset; offset from device start [ bytes ] like: 0
24323>256	ubequad		!0		\b, offset %llx
24324# char _padding [184]; must be zeroed
24325#>264	ubequad		x		\b, padding %#16.16llx
24326#>440	ubequad		x		\b...%16.16llx
24327# csum[64]; header checksum
24328>448	ubequad		x		\b, crc %#llx...
24329# char _padding4096 [7*512];  Padding , must be zeroed
24330#>512	ubequad		x		\b, more padding %#16.16llx
24331#>4088	ubequad		x		\b...%16.16llx
24332# JSON text data terminated by the zero character; unused remainder empty and filled with zeroes like:
24333# {"keyslots":{"0":{"type":"luks2","key_size":64,"af":{"type":"luks1","stripes":4000,"hash":"sha256"},"area":{"type":"raw","offse"
24334>0x1000	string		x		\b, at 0x1000 %s
24335#>0x1000	indirect	x
24336# display information (like active) about LUKS1 slot
243370	name		luks-slot
24338# state of keyslot; 0x00AC71F3~active 0x0000DEAD~inactive
24339#>0	ubelong		x		\b, status %#8.8x
24340>0	ubelong		=0x00AC71F3	active
24341>0	ubelong		=0x0000DEAD	inactive
24342# iteration parameter for PBKDF2
24343#>4	ubelong		x		\b, %u iterations
24344# salt parameter for PBKDF2
24345#>8	ubequad		x		\b, salt %#16.16llx
24346#>>16	ubequad		x		\b%16.16llx
24347#>>24	ubequad		x		\b%16.16llx
24348#>>32	ubequad		x		\b%16.16llx
24349# start sector of key material like: 8 0x200 0x3f8 0x5f0 0xdd0
24350>40	ubelong		x		\b, %#x material offset
24351# number of anti-forensic stripes like: 4000
24352>44	ubelong		!4000		\b, %u stripes
24353#------------------------------------------------------------------------------
24354# $File: m4,v 1.3 2019/02/27 16:46:23 christos Exp $
24355# make:  file(1) magic for M4 scripts
24356#
243570	search/8192	dnl
24358>0	regex	\^dnl\ 		M4 macro processor script text
24359!:mime	text/x-m4
243600	search/8192	AC_DEFUN
24361>0	regex	\^AC_DEFUN\\(\\[	M4 macro processor script text
24362!:strength + 15
24363!:mime	text/x-m4
24364
24365#------------------------------------------------------------
24366# $File: mach,v 1.29 2021/04/26 15:56:00 christos Exp $
24367# Mach has two magic numbers, 0xcafebabe and 0xfeedface.
24368# Unfortunately the first, cafebabe, is shared with
24369# Java ByteCode, so they are both handled in the file "cafebabe".
24370# The "feedface" ones are handled herein.
24371#------------------------------------------------------------
24372# if set, it's for the 64-bit version of the architecture
24373# yes, this is separate from the low-order magic number bit
24374# it's also separate from the "64-bit libraries" bit in the
24375# upper 8 bits of the CPU subtype
24376
24377# Reference:	https://opensource.apple.com/source/cctools/cctools-949.0.1/
24378#               include/mach-o/loader.h
24379# display CPU type as string like: i386 x86_64 ... armv7 armv7k ...
243800	name	mach-o-cpu
24381>0	belong&0xff000000	0
24382#
24383# 32-bit ABIs.
24384#
24385#				1	vax
24386>>0	belong&0x00ffffff	1
24387>>>4		belong&0x00ffffff	0	vax
24388>>>4		belong&0x00ffffff	1	vax11/780
24389>>>4		belong&0x00ffffff	2	vax11/785
24390>>>4		belong&0x00ffffff	3	vax11/750
24391>>>4		belong&0x00ffffff	4	vax11/730
24392>>>4		belong&0x00ffffff	5	uvaxI
24393>>>4		belong&0x00ffffff	6	uvaxII
24394>>>4		belong&0x00ffffff	7	vax8200
24395>>>4		belong&0x00ffffff	8	vax8500
24396>>>4		belong&0x00ffffff	9	vax8600
24397>>>4		belong&0x00ffffff	10	vax8650
24398>>>4		belong&0x00ffffff	11	vax8800
24399>>>4		belong&0x00ffffff	12	uvaxIII
24400>>>4		belong&0x00ffffff	>12	vax subarchitecture=%d
24401>>0	belong&0x00ffffff	2	romp
24402>>0	belong&0x00ffffff	3	architecture=3
24403>>0	belong&0x00ffffff	4	ns32032
24404>>0	belong&0x00ffffff	5	ns32332
24405>>0	belong&0x00ffffff	6	m68k
24406#				7	x86
24407>>0	belong&0x00ffffff	7
24408>>>4	belong&0x0000000f	3		i386
24409>>>4	belong&0x0000000f	4		i486
24410>>>>4	belong&0x00fffff0	0
24411>>>>4	belong&0x00fffff0	0x80		\bsx
24412>>>4	belong&0x0000000f	5		i586
24413>>>4	belong&0x0000000f	6
24414>>>>4	belong&0x00fffff0	0		p6
24415>>>>4	belong&0x00fffff0	0x10		pentium_pro
24416>>>>4	belong&0x00fffff0	0x20		pentium_2_m0x20
24417>>>>4	belong&0x00fffff0	0x30		pentium_2_m3
24418>>>>4	belong&0x00fffff0	0x40		pentium_2_m0x40
24419>>>>4	belong&0x00fffff0	0x50		pentium_2_m5
24420>>>>4	belong&0x00fffff0	>0x50		pentium_2_m%#x
24421>>>4	belong&0x0000000f	7		celeron
24422>>>>4	belong&0x00fffff0	0x00		\b_m%#x
24423>>>>4	belong&0x00fffff0	0x10		\b_m%#x
24424>>>>4	belong&0x00fffff0	0x20		\b_m%#x
24425>>>>4	belong&0x00fffff0	0x30		\b_m%#x
24426>>>>4	belong&0x00fffff0	0x40		\b_m%#x
24427>>>>4	belong&0x00fffff0	0x50		\b_m%#x
24428>>>>4	belong&0x00fffff0	0x60
24429>>>>4	belong&0x00fffff0	0x70		\b_mobile
24430>>>>4	belong&0x00fffff0	>0x70		\b_m%#x
24431>>>4	belong&0x0000000f	8		pentium_3
24432>>>>4	belong&0x00fffff0	0x00
24433>>>>4	belong&0x00fffff0	0x10		\b_m
24434>>>>4	belong&0x00fffff0	0x20		\b_xeon
24435>>>>4	belong&0x00fffff0	>0x20		\b_m%#x
24436>>>4	belong&0x0000000f	9		pentiumM
24437>>>>4	belong&0x00fffff0	0x00
24438>>>>4	belong&0x00fffff0	>0x00		\b_m%#x
24439>>>4	belong&0x0000000f	10		pentium_4
24440>>>>4	belong&0x00fffff0	0x00
24441>>>>4	belong&0x00fffff0	0x10		\b_m
24442>>>>4	belong&0x00fffff0	>0x10		\b_m%#x
24443>>>4	belong&0x0000000f	11		itanium
24444>>>>4	belong&0x00fffff0	0x00
24445>>>>4	belong&0x00fffff0	0x10		\b_2
24446>>>>4	belong&0x00fffff0	>0x10		\b_m%#x
24447>>>4	belong&0x0000000f	12		xeon
24448>>>>4	belong&0x00fffff0	0x00
24449>>>>4	belong&0x00fffff0	0x10		\b_mp
24450>>>>4	belong&0x00fffff0	>0x10		\b_m%#x
24451>>>4	belong&0x0000000f	>12		ia32 family=%d
24452>>>>4	belong&0x00fffff0	0x00
24453>>>>4	belong&0x00fffff0	>0x00		model=%x
24454>>0	belong&0x00ffffff	8	mips
24455>>>4		belong&0x00ffffff	1	R2300
24456>>>4		belong&0x00ffffff	2	R2600
24457>>>4		belong&0x00ffffff	3	R2800
24458>>>4		belong&0x00ffffff	4	R2000a
24459>>>4		belong&0x00ffffff	5	R2000
24460>>>4		belong&0x00ffffff	6	R3000a
24461>>>4		belong&0x00ffffff	7	R3000
24462>>>4		belong&0x00ffffff	>7	subarchitecture=%d
24463>>0	belong&0x00ffffff	9	ns32532
24464>>0	belong&0x00ffffff	10	mc98000
24465>>0	belong&0x00ffffff	11	hppa
24466>>>4		belong&0x00ffffff	0	7100
24467>>>4		belong&0x00ffffff	1	7100LC
24468>>>4		belong&0x00ffffff	>1	subarchitecture=%d
24469>>0	belong&0x00ffffff	12	arm
24470>>>4		belong&0x00ffffff	0
24471>>>4		belong&0x00ffffff	1	subarchitecture=%d
24472>>>4		belong&0x00ffffff	2	subarchitecture=%d
24473>>>4		belong&0x00ffffff	3	subarchitecture=%d
24474>>>4		belong&0x00ffffff	4	subarchitecture=%d
24475>>>4		belong&0x00ffffff	5	\bv4t
24476>>>4		belong&0x00ffffff	6	\bv6
24477>>>4		belong&0x00ffffff	7	\bv5tej
24478>>>4		belong&0x00ffffff	8	\bxscale
24479>>>4		belong&0x00ffffff	9	\bv7
24480>>>4		belong&0x00ffffff	10	\bv7f
24481>>>4		belong&0x00ffffff	11	\bv7s
24482>>>4		belong&0x00ffffff	12	\bv7k
24483>>>4		belong&0x00ffffff	13	\bv8
24484>>>4		belong&0x00ffffff	14	\bv6m
24485>>>4		belong&0x00ffffff	15	\bv7m
24486>>>4		belong&0x00ffffff	16	\bv7em
24487>>>4		belong&0x00ffffff	>16	subarchitecture=%d
24488#				13	m88k
24489>>0	belong&0x00ffffff	13
24490>>>4		belong&0x00ffffff	0	mc88000
24491>>>4		belong&0x00ffffff	1	mc88100
24492>>>4		belong&0x00ffffff	2	mc88110
24493>>>4		belong&0x00ffffff	>2	mc88000 subarchitecture=%d
24494>>0	belong&0x00ffffff	14	SPARC
24495>>0	belong&0x00ffffff	15	i860g
24496>>0	belong&0x00ffffff	16	alpha
24497>>0	belong&0x00ffffff	17	rs6000
24498>>0	belong&0x00ffffff	18	ppc
24499>>>4		belong&0x00ffffff	0
24500>>>4		belong&0x00ffffff	1	\b_601
24501>>>4		belong&0x00ffffff	2	\b_602
24502>>>4		belong&0x00ffffff	3	\b_603
24503>>>4		belong&0x00ffffff	4	\b_603e
24504>>>4		belong&0x00ffffff	5	\b_603ev
24505>>>4		belong&0x00ffffff	6	\b_604
24506>>>4		belong&0x00ffffff	7	\b_604e
24507>>>4		belong&0x00ffffff	8	\b_620
24508>>>4		belong&0x00ffffff	9	\b_750
24509>>>4		belong&0x00ffffff	10	\b_7400
24510>>>4		belong&0x00ffffff	11	\b_7450
24511>>>4		belong&0x00ffffff	100	\b_970
24512>>>4		belong&0x00ffffff	>100	subarchitecture=%d
24513>>0	belong&0x00ffffff	>18	architecture=%d
24514>0	belong&0xff000000	0x01000000
24515#
24516# 64-bit ABIs.
24517#
24518>>0	belong&0x00ffffff	0	64-bit architecture=%d
24519>>0	belong&0x00ffffff	1	64-bit architecture=%d
24520>>0	belong&0x00ffffff	2	64-bit architecture=%d
24521>>0	belong&0x00ffffff	3	64-bit architecture=%d
24522>>0	belong&0x00ffffff	4	64-bit architecture=%d
24523>>0	belong&0x00ffffff	5	64-bit architecture=%d
24524>>0	belong&0x00ffffff	6	64-bit architecture=%d
24525>>0	belong&0x00ffffff	7	x86_64
24526>>>4		belong&0x00ffffff	0	subarchitecture=%d
24527>>>4		belong&0x00ffffff	1	subarchitecture=%d
24528>>>4		belong&0x00ffffff	2	subarchitecture=%d
24529>>>4		belong&0x00ffffff	3
24530>>>4		belong&0x00ffffff	4	\b_arch1
24531>>>4		belong&0x00ffffff	8	\b_haswell
24532>>>4		belong&0x00ffffff	>4	subarchitecture=%d
24533>>0	belong&0x00ffffff	8	64-bit architecture=%d
24534>>0	belong&0x00ffffff	9	64-bit architecture=%d
24535>>0	belong&0x00ffffff	10	64-bit architecture=%d
24536>>0	belong&0x00ffffff	11	64-bit architecture=%d
24537>>0	belong&0x00ffffff	12	arm64
24538>>>4		belong&0x00ffffff	0
24539>>>4		belong&0x00ffffff	1	\bv8
24540>>>4		belong&0x00ffffff	2	\be
24541>>>>7		ubyte&0xff		>0	(caps:
24542>>>>7		ubyte&0xff		<0x80	%#02x
24543>>>>7		ubyte&0xc0		0x80	PAC
24544>>>>>7		ubyte&0x3f		x	\b%02d
24545>>>>7		ubyte&0xc0		0xc0	PAK
24546>>>>>7		ubyte&0x3f		x	\b%02d
24547>>>>7		ubyte&0xff		x	\b)
24548>>>4		belong&0x00ffffff	>2	subarchitecture=%d
24549>>0	belong&0x00ffffff	13	64-bit architecture=%d
24550>>0	belong&0x00ffffff	14	64-bit architecture=%d
24551>>0	belong&0x00ffffff	15	64-bit architecture=%d
24552>>0	belong&0x00ffffff	16	64-bit architecture=%d
24553>>0	belong&0x00ffffff	17	64-bit architecture=%d
24554>>0	belong&0x00ffffff	18	ppc64
24555>>>4		belong&0x00ffffff	0
24556>>>4		belong&0x00ffffff	1		\b_601
24557>>>4		belong&0x00ffffff	2		\b_602
24558>>>4		belong&0x00ffffff	3		\b_603
24559>>>4		belong&0x00ffffff	4		\b_603e
24560>>>4		belong&0x00ffffff	5		\b_603ev
24561>>>4		belong&0x00ffffff	6		\b_604
24562>>>4		belong&0x00ffffff	7		\b_604e
24563>>>4		belong&0x00ffffff	8		\b_620
24564>>>4		belong&0x00ffffff	9		\b_650
24565>>>4		belong&0x00ffffff	10		\b_7400
24566>>>4		belong&0x00ffffff	11		\b_7450
24567>>>4		belong&0x00ffffff	100		\b_970
24568>>>4		belong&0x00ffffff	>100		subarchitecture=%d
24569>>0	belong&0x00ffffff	>18	64-bit architecture=%d
24570>0	belong&0xff000000	0x02000000
24571#
24572# 64_32-bit ABIs.
24573#
24574>>0	belong&0x00ffffff	0	64_32-bit architecture=%d
24575>>0	belong&0x00ffffff	1	64_32-bit architecture=%d
24576>>0	belong&0x00ffffff	2	64_32-bit architecture=%d
24577>>0	belong&0x00ffffff	3	64_32-bit architecture=%d
24578>>0	belong&0x00ffffff	4	64_32-bit architecture=%d
24579>>0	belong&0x00ffffff	5	64_32-bit architecture=%d
24580>>0	belong&0x00ffffff	6	64_32-bit architecture=%d
24581>>0	belong&0x00ffffff	7	64_32-bit architecture=%d
24582>>0	belong&0x00ffffff	8	64_32-bit architecture=%d
24583>>0	belong&0x00ffffff	9	64_32-bit architecture=%d
24584>>0	belong&0x00ffffff	10	64_32-bit architecture=%d
24585>>0	belong&0x00ffffff	11	64_32-bit architecture=%d
24586>>0	belong&0x00ffffff	12	64_32-bit arm
24587>>>4		belong&0x00ffffff	0
24588>>>4		belong&0x00ffffff	1	\bv8
24589>>>4		belong&0x00ffffff	>1	subarchitecture=%d
24590>>0	belong&0x00ffffff	13	64_32-bit architecture=%d
24591>>0	belong&0x00ffffff	14	64_32-bit architecture=%d
24592>>0	belong&0x00ffffff	15	64_32-bit architecture=%d
24593>>0	belong&0x00ffffff	16	64_32-bit architecture=%d
24594>>0	belong&0x00ffffff	17	64_32-bit architecture=%d
24595>>0	belong&0x00ffffff	18	64_32-bit architecture=%d
24596>>0	belong&0x00ffffff	>18	64_32-bit architecture=%d
24597
245980	name		mach-o-be
24599>0	byte		0xcf		64-bit
24600>4	use		mach-o-cpu
24601>12	belong		1		object
24602# GRR: Does not work for Mach-O with 2 architectures; instead display oo
24603#!:ext	o
24604!:ext	o/
24605>12	belong		2		executable
24606# the executables normally have no file extension like perl,
24607# but exceptions like perl5.18 perl5.16
24608!:ext	16/18/
24609>12	belong		3		fixed virtual memory shared library
24610>12	belong		4		core
24611>12	belong		5		preload executable
24612>12	belong		6		dynamically linked shared library
24613# GRR: Does not work for Mach-O with 2 architectures; instead display dylibdylib
24614#!:ext	dylib
24615!:ext	dylib/
24616>12	belong		7		dynamic linker
24617>12	belong		8		bundle
24618# normally name extension bundle; but exceptions like: AMDil_r700.dylib
24619!:ext	bundle/dylib/
24620>12	belong		9		dynamically linked shared library stub
24621>12	belong		10		dSYM companion file
24622>12	belong		11		kext bundle
24623>12	belong		>11
24624>>12	belong		x		filetype=%d
24625>24	belong		>0		\b, flags:<
24626>>24	belong		&0x00000001	\bNOUNDEFS
24627>>24	belong		&0x00000002	\b|INCRLINK
24628>>24	belong		&0x00000004	\b|DYLDLINK
24629>>24	belong		&0x00000008	\b|BINDATLOAD
24630>>24	belong		&0x00000010	\b|PREBOUND
24631>>24	belong		&0x00000020	\b|SPLIT_SEGS
24632>>24	belong		&0x00000040	\b|LAZY_INIT
24633>>24	belong		&0x00000080	\b|TWOLEVEL
24634>>24	belong		&0x00000100	\b|FORCE_FLAT
24635>>24	belong		&0x00000200	\b|NOMULTIDEFS
24636>>24	belong		&0x00000400	\b|NOFIXPREBINDING
24637>>24	belong		&0x00000800	\b|PREBINDABLE
24638>>24	belong		&0x00001000	\b|ALLMODSBOUND
24639>>24	belong		&0x00002000	\b|SUBSECTIONS_VIA_SYMBOLS
24640>>24	belong		&0x00004000	\b|CANONICAL
24641>>24	belong		&0x00008000	\b|WEAK_DEFINES
24642>>24	belong		&0x00010000	\b|BINDS_TO_WEAK
24643>>24	belong		&0x00020000	\b|ALLOW_STACK_EXECUTION
24644>>24	belong		&0x00040000	\b|ROOT_SAFE
24645>>24	belong		&0x00080000	\b|SETUID_SAFE
24646>>24	belong		&0x00100000	\b|NO_REEXPORTED_DYLIBS
24647>>24	belong		&0x00200000	\b|PIE
24648>>24	belong		&0x00400000	\b|DEAD_STRIPPABLE_DYLIB
24649>>24	belong		&0x00800000	\b|HAS_TLV_DESCRIPTORS
24650>>24	belong		&0x01000000	\b|NO_HEAP_EXECUTION
24651>>24	belong		&0x02000000	\b|APP_EXTENSION_SAFE
24652>>24	belong		&0x04000000	\b|NLIST_OUTOFSYNC_WITH_DYLDINFO
24653>>24	belong		&0x08000000	\b|SIM_SUPPORT
24654>>24	belong		&0x80000000	\b|DYLIB_IN_CACHE
24655>>24	belong		x		\b>
24656
24657#
246580	lelong&0xfffffffe	0xfeedface	Mach-O
24659!:strength +1
24660!:mime application/x-mach-binary
24661>0	use	\^mach-o-be
24662
246630	belong&0xfffffffe	0xfeedface	Mach-O
24664!:strength +1
24665!:mime application/x-mach-binary
24666>0	use	mach-o-be
24667
24668#------------------------------------------------------------------------------
24669# $File: macintosh,v 1.32 2021/04/26 15:56:00 christos Exp $
24670# macintosh description
24671#
24672# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
24673# Daniel Quinlan, quinlan@yggdrasil.com
24674# Update:	Joerg Jenderek
24675# URL:		https://en.wikipedia.org/wiki/BinHex
24676# Reference:	http://fileformats.archiveteam.org/wiki/BinHex
24677# Note:		only tested with version 4.0 and hqx extension
24678# Any text/binary before the characteristic comment sentence is to be ignored like in
24679# http://ftp.vim.org/pub/ftp/ftp/infomac/disk/mac-update-40b7.hqx
246800	search/1602	(This\ file\
24681>&0	use		binhex
24682# http://ftp.vim.org/pub/ftp/ftp/infomac/_Disk_&_File/zap-res-forks-101.hqx
246830	search/2652/b	(This\ file\
24684>&0	use		binhex
246850	name				binhex
24686# keep split search string format similar like in version 5.37
24687>0	string	must\ be\ converted\ with\ BinHex\ 	BinHex binary text, version
24688# http://www.macdisk.com/binhexen.php3
24689!:apple	BNHQTEXT
24690# http://www.faqs.org/faqs/macintosh/comm-faq/part1/
24691>>&0	string	1.0					1.0
24692!:mime	application/mac-binhex
24693!:ext	hex
24694>>&0	string	2.0					2.0
24695!:mime	application/mac-binhex
24696!:ext	hcx
24697# BinHex	3.0 never existed
24698>>&0	string	4.0					4.0
24699!:mime	application/mac-binhex40
24700!:ext	hqx
24701# BinHex	5.0 also MacBinary I
24702>>&0	string	5.0					5.0
24703!:mime	application/mac-binhex40
24704!:ext	hqx
24705# this should never happen
24706>>&0	default	x
24707>>>&0	string	x					%.3s
24708!:mime	application/mac-binhex
24709!:ext	hqx
24710
24711# Stuffit archives are the de facto standard of compression for Macintosh
24712# files obtained from most archives. (franklsm@tuns.ca)
247130	string		SIT!			StuffIt Archive (data)
24714!:mime	application/x-stuffit
24715!:apple	SIT!SIT!
24716>2	string		x			: %s
247170	string		SITD			StuffIt Deluxe (data)
24718>2	string		x			: %s
247190	string		Seg			StuffIt Deluxe Segment (data)
24720>2	string		x			: %s
24721
24722# Newer StuffIt archives (grant@netbsd.org)
247230	string		StuffIt			StuffIt Archive
24724!:mime	application/x-stuffit
24725!:apple	SIT!SIT!
24726#>162	string		>0			: %s
24727
24728# Macintosh Applications and Installation binaries (franklsm@tuns.ca)
24729# GRR: Too weak
24730#0	string		APPL			Macintosh Application (data)
24731#>2	string		x			\b: %s
24732
24733# Macintosh System files (franklsm@tuns.ca)
24734# GRR: Too weak
24735#0	string		zsys			Macintosh System File (data)
24736#0	string		FNDR			Macintosh Finder (data)
24737#0	string		libr			Macintosh Library (data)
24738#>2	string		x			: %s
24739#0	string		shlb			Macintosh Shared Library (data)
24740#>2	string		x			: %s
24741#0	string		cdev			Macintosh Control Panel (data)
24742#>2	string		x			: %s
24743#0	string		INIT			Macintosh Extension (data)
24744#>2	string		x			: %s
24745#0	string		FFIL			Macintosh Truetype Font (data)
24746#>2	string		x			: %s
24747#0	string		LWFN			Macintosh Postscript Font (data)
24748#>2	string		x			: %s
24749
24750# Additional Macintosh Files (franklsm@tuns.ca)
24751# GRR: Too weak
24752#0	string		PACT			Macintosh Compact Pro Archive (data)
24753#>2	string		x			: %s
24754#0	string		ttro			Macintosh TeachText File (data)
24755#>2	string		x			: %s
24756#0	string		TEXT			Macintosh TeachText File (data)
24757#>2	string		x			: %s
24758#0	string		PDF			Macintosh PDF File (data)
24759#>2	string		x			: %s
24760
24761# MacBinary format (Eric Fischer, enf@pobox.com)
24762# Update: Joerg Jenderek
24763# URL: https://en.wikipedia.org/wiki/MacBinary
24764# Reference: https://files.stairways.com/other/macbinaryii-standard-info.txt
24765#
24766# Unfortunately MacBinary doesn't really have a magic number prior
24767# to the MacBinary III format.
24768#
24769
24770# old version number, must be kept at zero for compatibility
247710	byte	0
24772# length of filename (must be in the range 1-63)
24773>1	ubyte	>0
24774# skip T.PIC.LZ INSTRUMENT.7T INVENTORY
24775>>1	ubyte	<64
24776# skip Docs.MWII ReadMe.MacWrite "Notes (MacWrite II)"
24777# by looking for printable characters at beginning of file name
24778>>>2	ubelong	>0x1F000000
24779# zero fill, must be zero for compatibility
24780>>>>74	byte	0
24781# zero fill, must be zero for compatibility
24782>>>>>82	byte	0
24783# MacBinary I		test for valid version numbers
24784>>>>>>122	ubeshort	0
24785# additional check for creation date after 1 Jan 1970 ~ 7C25B080h
24786#>>>>>>>91	ubelong		>0x7c25b07F
24787# additional check for undefined header fields in MacBinary I
24788#>>>>>>>101	ulong		0
24789>>>>>>>0	use	mac-bin
24790# MacBinary II		the newer versions begins at 129
24791>>>>>>122	ubeshort	0x8181
24792>>>>>>>0	use	mac-bin
24793# MacBinary III with MacBinary II to read
24794>>>>>122	ubeshort	0x8281
24795>>>>>>0	use	mac-bin
24796
24797#	display information of MacBinary file
247980	name		mac-bin
24799>122	ubyte	x	MacBinary
24800# versions for MacBinary II/III
24801>122	ubyte	129		II
24802>122	ubyte	130		III
24803# only in MacBinary III
24804>>102	string	!mBIN		with surprising version
24805!:mime	application/x-macbinary
24806!:apple	PSPTBINA
24807!:ext	bin/macbin
24808# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified as MacBinary
24809#>1	ubyte	>63		\b, name length %u too BIG!
24810#>122	ubeshort	x	\b, version %#x
24811# Finder flags if not 0
24812# >73	byte		!0		\b, flags 0x
24813# >73	byte		=0
24814# >>101	byte		!0		\b, flags 0x
24815# # original Finder flags (Bits 8-15)
24816# >73	byte		!0		\b%x
24817# # finder flags, bits 0-7
24818# >101	byte		!0		\b%x
24819>73	byte		&0x01		\b, inited
24820>73	byte		&0x02		\b, changed
24821>73	byte		&0x04		\b, busy
24822>73	byte		&0x08		\b, bozo
24823>73	byte		&0x10		\b, system
24824>73	byte		&0x20		\b, bundle
24825>73	byte		&0x40		\b, invisible
24826>73	byte		&0x80		\b, locked
24827
24828# 75	beshort				# vertical posn in window
24829#>75	beshort		!0		\b, v.pos %u
24830# 77	beshort				# horiz posn in window
24831#>77	beshort		!0		\b, h.pos %u
24832# 79	beshort				# window or folder ID
24833>79	ubeshort	!0		\b, ID %#x
24834# protected flag
24835>81	byte		!0		\b, protected %#x
24836# length of comment after resource
24837>99	ubeshort	!0		\b, comment length %u
24838# char. code of file name
24839>106	ubyte		!0		\b, char. code %#x
24840# still more Finder flags
24841>107	ubyte		!0		\b, more flags %#x
24842# length of total files when unpacked only used when pack and unpack on the fly
24843>116	ubelong		!0		\b, total length %u
24844# 120	beshort				# length of add'l header
24845>120	ubeshort	!0		\b, 2nd header length %u
24846# 124	beshort				# checksum
24847#>124	ubeshort	!0		\b, CRC %#x
24848# creation date in seconds since MacOS epoch start. So 1 Jan 1970 ~ 7C25B080
24849>91	beldate-0x7C25B080	x	\b, %s
24850# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified or time overflow
24851>91	ubelong		<0x7c25b080	INVALID date
24852#>91	belong-0x7C25B080	x	\b, DEBUG DATE %d
24853# last modified date
24854>95	beldate-0x7C25B080	x	\b, modified %s
24855# Apple creator+typ if not null
24856# file creator (normally expressed as four characters)
24857>69	ulong			!0	\b, creator
24858# instead 4 character code display full creator name
24859>>69	use			apple-creator
24860# file type (normally expressed as four characters)
24861>65	ulong			!0	\b, type
24862>>65	use			apple-type
24863# length of data segment
24864>83	ubelong			!0	\b, %u bytes
24865# filename (in the range 1-63)
24866>1	pstring			x	"%s"
24867# print 1 space and then at offset 128 inspect data fork content if it has one
24868>83	ubelong			!0	\b
24869>>128	indirect		x
24870# Afterwards resource fork if length of resource segment not zero
24871>87	ubelong			!0
24872# calculate resource fork offset
24873>>83	ubelong+128		x	\b, at %#x
24874# length of resource segment
24875>>87	ubelong			!0	%u bytes
24876>>(83.S+128)	ubequad		x	resource
24877# further resource fork content inspection
24878>>>&-8	indirect		x
24879
24880# Apple Type/Creator Database
24881# URL: https://en.wikipedia.org/wiki/Type_code
24882# Reference:	https://www.lacikam.co.il/tcdb/
24883#		https://www.macdisk.com/macsigen.php
24884# Note:	classic Mac OS files have two 4 character codes for type and creator.
24885#	Thereby the Finder attach documents types to applications.
24886
24887#>65	string		x		\b, type "%4.4s"
24888
24889#	display information about apple type
248900	name		apple-type
24891>0	string		8BIM		PhotoShop
24892>0	string		ALB3		PageMaker 3
24893>0	string		ALB4		PageMaker 4
24894>0	string		ALT3		PageMaker 3
24895>0	string		APPL		application
24896>0	string		AWWP		AppleWorks word processor
24897>0	string		CIRC		simulated circuit
24898>0	string		DRWG		MacDraw
24899>0	string		EPSF		Encapsulated PostScript
24900>0	string		FFIL		font suitcase
24901>0	string		FKEY		function key
24902>0	string		FNDR		Macintosh Finder
24903>0	string		GIFf		GIF image
24904>0	string		Gzip		GNU gzip
24905>0	string		INIT		system extension
24906>0	string		LIB\ 		library
24907>0	string		LWFN		PostScript font
24908>0	string		MSBC		Microsoft BASIC
24909>0	string		PACT		Compact Pro archive
24910>0	string		PDF\ 		Portable Document Format
24911>0	string		PICT		picture
24912>0	string		PNTG		MacPaint picture
24913>0	string		PREF		preferences
24914>0	string		PROJ		Think C project
24915>0	string		QPRJ		Think Pascal project
24916>0	string		SCFL		Defender scores
24917>0	string		SCRN		startup screen
24918>0	string		SITD		StuffIt Deluxe
24919>0	string		SPn3		SuperPaint
24920>0	string		STAK		HyperCard stack
24921>0	string		Seg\ 		StuffIt segment
24922>0	string		TARF		Unix tar archive
24923>0	string		TEXT		ASCII
24924>0	string		TIFF		TIFF image
24925>0	string		TOVF		Eudora table of contents
24926>0	string		WDBN		Microsoft Word word processor
24927>0	string		WORD		MacWrite word processor
24928>0	string		XLS\ 		Microsoft Excel
24929>0	string		ZIVM		compress (.Z)
24930>0	string		ZSYS		Pre-System 7 system file
24931>0	string		acf3		Aldus FreeHand
24932>0	string		cdev		control panel
24933>0	string		dfil		Desk Accessory suitcase
24934>0	string		libr		library
24935>0	string		nX^d		WriteNow word processor
24936>0	string		nX^w		WriteNow dictionary
24937>0	string		rsrc		resource
24938>0	string		scbk		Scrapbook
24939>0	string		shlb		shared library
24940>0	string		ttro		SimpleText read-only
24941>0	string		zsys		system file
24942
24943#	additional types added in Dec 2017
24944>0	string		BINA		binary file
24945>0	string		BMPp		BMP image
24946>0	string		JPEG		JPEG image
24947#>0	string		W4BN		Microsoft Word x.y word processor?
24948# if type name is not known display 4 character identifier
24949>0	default		x
24950>>0	string		x		'%4.4s'
24951
24952#>69	string		x		\b, creator "%4.4s"
24953
24954# Now Apple has no repository of registered Creator IDs any more. These are
24955# just the ones that I happened to have files from and was able to identify.
24956
24957#	display information about apple creator
249580	name		apple-creator
24959>0	string		8BIM		Adobe Photoshop
24960>0	string		ALD3		PageMaker 3
24961>0	string		ALD4		PageMaker 4
24962>0	string		ALFA		Alpha editor
24963>0	string		APLS		Apple Scanner
24964>0	string		APSC		Apple Scanner
24965>0	string		BRKL		Brickles
24966>0	string		BTFT		BitFont
24967>0	string		CCL2		Common Lisp 2
24968>0	string		CCL\ 		Common Lisp
24969>0	string		CDmo		The Talking Moose
24970>0	string		CPCT		Compact Pro
24971>0	string		CSOm		Eudora
24972>0	string		DMOV		Font/DA Mover
24973>0	string		DSIM		DigSim
24974>0	string		EDIT		Macintosh Edit
24975>0	string		ERIK		Macintosh Finder
24976>0	string		EXTR		self-extracting archive
24977>0	string		Gzip		GNU gzip
24978>0	string		KAHL		Think C
24979>0	string		LWFU		LaserWriter Utility
24980>0	string		LZIV		compress
24981>0	string		MACA		MacWrite
24982>0	string		MACS		Macintosh operating system
24983>0	string		MAcK		MacKnowledge terminal emulator
24984>0	string		MLND		Defender
24985>0	string		MPNT		MacPaint
24986>0	string		MSBB		Microsoft BASIC (binary)
24987>0	string		MSWD		Microsoft Word
24988>0	string		NCSA		NCSA Telnet
24989>0	string		PJMM		Think Pascal
24990>0	string		PSAL		Hunt the Wumpus
24991#>0	string		PSI2		Apple File Exchange
24992>0	string		R*ch		BBEdit
24993>0	string		RMKR		Resource Maker
24994>0	string		RSED		Resource Editor
24995>0	string		Rich		BBEdit
24996>0	string		SIT!		StuffIt
24997>0	string		SPNT		SuperPaint
24998>0	string		Unix		NeXT Mac filesystem
24999>0	string		VIM!		Vim editor
25000>0	string		WILD		HyperCard
25001>0	string		XCEL		Microsoft Excel
25002>0	string		aCa2		Fontographer
25003>0	string		aca3		Aldus FreeHand
25004>0	string		dosa		Macintosh MS-DOS file system
25005>0	string		movr		Font/DA Mover
25006>0	string		nX^n		WriteNow
25007>0	string		pdos		Apple ProDOS file system
25008>0	string		scbk		Scrapbook
25009>0	string		ttxt		SimpleText
25010>0	string		ufox		Foreign File Access
25011#	additional creators added in Dec 2017
25012# Claris/Apple Works
25013>0	string		BOBO		Apple Works
25014# CU-SeeMe_0.87b3_(68K).bin
25015#>0	string		CUce		bar
25016>0	string		PSPT		Apple File Exchange
25017# Disk_Copy_4.2.sea.bin
25018#>0	string		NCse		foo
25019# probably StuffIt/Aladdin by Smith Micro Software, Inc.
25020>0	string		STi0		stuffit
25021# MacGzip-1.1.3.sea.bin
25022#>0	string		aust		bar
25023# D-Disk_Copy_6.3.3.smi.bin
25024>0	string		oneb		Disk Copy Self Mounting
25025# if creator name is not known display 4 character identifier
25026>0	default		x
25027>>0	string		x		'%4.4s'
25028
25029# sas magic from Bruce Foster (bef@nwu.edu)
25030#
25031#0	string		SAS		SAS
25032#>8	string		x		%s
250330	string		SAS		SAS
25034>24	string		DATA		data file
25035>24	string		CATALOG		catalog
25036>24	string		INDEX		data file index
25037>24	string		VIEW		data view
25038# sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com)
25039#
250400x54    string          SAS             SAS 7+
25041>0x9C   string          DATA            data file
25042>0x9C   string          CATALOG         catalog
25043>0x9C   string          INDEX           data file index
25044>0x9C   string          VIEW            data view
25045
25046# spss magic for SPSS system and portable files,
25047#	 from Bruce Foster (bef@nwu.edu).
25048
250490	long		0xc1e2c3c9	SPSS Portable File
25050>40	string 		x		%s
25051
250520	string		$FL2		SPSS System File
25053>24	string		x		%s
25054
250550	string		$FL3		SPSS System File
25056>24	string		x		%s
25057
25058# Macintosh filesystem data
25059# From "Tom N Harris" <telliamed@mac.com>
25060# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net>
25061# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these
25062# entries depend on the data arithmetic added after v.35
25063# There's also some Pascal strings in here, ditto...
25064
25065# The boot block signature, according to IM:Files, is
25066# "for HFS volumes, this field always contains the value 0x4C4B."
25067# But if this is true for MFS or HFS+ volumes, I don't know.
25068# Alternatively, the boot block is supposed to be zeroed if it's
25069# unused, so a simply >0 should suffice.
25070
250710x400	beshort			0xD2D7		Macintosh MFS data
25072>0	beshort			0x4C4B		(bootable)
25073>0x40a	beshort			&0x8000		(locked)
25074>0x402	beldate-0x7C25B080	x		created: %s,
25075>0x406	beldate-0x7C25B080	>0		last backup: %s,
25076>0x414	belong			x		block size: %d,
25077>0x412	beshort			x		number of blocks: %d,
25078>0x424	pstring			x		volume name: %s
25079
25080# *.hfs updated by Joerg Jenderek
25081# https://en.wikipedia.org/wiki/Hierarchical_File_System
25082# "BD" gives many false positives
250830x400	beshort			0x4244
25084# ftp://ftp.mars.org/pub/hfs/hfsutils-3.2.6.tar.gz/hfsutils-3.2.6/libhfs/apple.h
25085# first block of volume bit map (always 3)
25086>0x40e	ubeshort		0x0003
25087# maximal length of volume name is 27
25088>>0x424		ubyte			<28	Macintosh HFS data
25089!:mime	application/x-apple-diskimage
25090#!:apple	hfsdINIT
25091#!:apple	MACSdisk
25092# https://www.macdisk.com/macsigen.php
25093#!:apple	ddskdevi
25094!:apple	????devi
25095# https://en.wikipedia.org/wiki/Apple_Disk_Image
25096!:ext hfs/dmg
25097>>>0		beshort			0x4C4B	(bootable)
25098#>>>0		beshort			0x0000	(not bootable)
25099>>>0x40a	beshort			&0x8000	(locked)
25100>>>0x40a	beshort			^0x0100	(mounted)
25101>>>0x40a	beshort			&0x0200	(spared blocks)
25102>>>0x40a	beshort			&0x0800	(unclean)
25103>>>0x47C	beshort			0x482B	(Embedded HFS+ Volume)
25104# https://www.epochconverter.com/
25105# 0x7C245F00 seconds	~ 2082758400	~ 01 Jan 2036 00:00:00	~ 66 years to 1970
25106# 0x7C25B080 seconds	~ 2082844800	~ 02 Jan 2036 00:00:00
25107# construct not working
25108#>>>0x402	beldate-0x7C25B080	x	created: %s,
25109#>>>0x406	beldate-0x7C25B080	x	last modified: %s,
25110#>>>0x440	beldate-0x7C25B080	>0	last backup: %s,
25111# found block sizes 200h,1200h,2800h
25112>>>0x414	belong			x	block size: %d,
25113>>>0x412	beshort			x	number of blocks: %d,
25114>>>0x424	pstring			x	volume name: %s
25115
251160x400	beshort			0x482B		Macintosh HFS Extended
25117>&0	beshort			x		version %d data
25118>0	beshort			0x4C4B		(bootable)
25119>0x404	belong			^0x00000100	(mounted)
25120>&2	belong			&0x00000200	(spared blocks)
25121>&2	belong			&0x00000800	(unclean)
25122>&2	belong			&0x00008000	(locked)
25123>&6	string			x		last mounted by: '%.4s',
25124# really, that should be treated as a belong and we print a string
25125# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1"
25126>&14	beldate-0x7C25B080	x		created: %s,
25127# only the creation date is local time, all other timestamps in HFS+ are UTC.
25128>&18	bedate-0x7C25B080	x		last modified: %s,
25129>&22	bedate-0x7C25B080	>0		last backup: %s,
25130>&26	bedate-0x7C25B080	>0		last checked: %s,
25131>&38	belong			x		block size: %d,
25132>&42	belong			x		number of blocks: %d,
25133>&46	belong			x		free blocks: %d
25134
25135## AFAIK, only the signature is different
25136# same as Apple Partition Map
25137# GRR: This magic is too weak, it is just "TS"
25138#0x200		beshort		0x5453		Apple Old Partition data
25139#>0x2		beshort		x		block size: %d,
25140#>0x230		string		x		first type: %s,
25141#>0x210		string		x		name: %s,
25142#>0x254		belong		x		number of blocks: %d,
25143#>0x400		beshort		0x504D
25144#>>0x430		string		x		second type: %s,
25145#>>0x410		string		x		name: %s,
25146#>>0x454		belong		x		number of blocks: %d,
25147#>>0x800		beshort		0x504D
25148#>>>0x830	string		x		third type: %s,
25149#>>>0x810	string		x		name: %s,
25150#>>>0x854	belong		x		number of blocks: %d,
25151#>>>0xa00	beshort		0x504D
25152#>>>>0xa30	string		x		fourth type: %s,
25153#>>>>0xa10	string		x		name: %s,
25154#>>>>0xa54	belong		x		number of blocks: %d
25155
25156# From: Remi Mommsen <mommsen@slac.stanford.edu>
251570		string		BOMStore	Mac OS X bill of materials (BOM) file
25158
25159# From: Adam Buchbinder <adam.buchbinder@gmail.com>
25160# URL: https://en.wikipedia.org/wiki/Datafork_TrueType
25161# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is
25162# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I
25163# don't know what they mean.
251640	belong	0x100
25165>(0x4.L+24)	beshort	x
25166>>&4	belong	0x73666e74	Mac OSX datafork font, TrueType
25167>>&4	belong	0x464f4e54	Mac OSX datafork font, 'FONT'
25168>>&4	belong	0x4e464e54	Mac OSX datafork font, 'NFNT'
25169>>&4	belong	0x504f5354	Mac OSX datafork font, PostScript
25170
25171#------------------------------------------------------------------------------
25172# $File: macos,v 1.1 2012/12/21 16:41:07 christos Exp $
25173# MacOS files
25174#
25175
251760	string		book\0\0\0\0mark\0\0\0\0	MacOS Alias file
25177
25178#------------------------------------------------------------------------------
25179# $File: magic,v 1.10 2010/11/25 15:00:12 christos Exp $
25180# magic:  file(1) magic for magic files
25181#
251820	string/t		#\ Magic	magic text file for file(1) cmd
251830	lelong		0xF11E041C	magic binary file for file(1) cmd
25184>4	lelong		x		(version %d) (little endian)
251850	belong		0xF11E041C	magic binary file for file(1) cmd
25186>4	belong		x		(version %d) (big endian)
25187#------------------------------------------------------------------------------
25188# $File: mail.news,v 1.29 2022/06/17 18:02:19 christos Exp $
25189# mail.news:  file(1) magic for mail and news
25190#
25191# Unfortunately, saved netnews also has From line added in some news software.
25192#0	string		From 		mail text
251930	string/t		Relay-Version: 	old news text
25194!:mime	message/rfc822
251950	string/t		#!\ rnews	batched news text
25196!:mime	message/rfc822
251970	string/t		N#!\ rnews	mailed, batched news text
25198!:mime	message/rfc822
251990	string/t		Forward\ to 	mail forwarding text
25200!:mime	message/rfc822
252010	string/t		Pipe\ to 	mail piping text
25202!:mime	message/rfc822
252030	string/tc		delivered-to:	SMTP mail text
25204!:mime	message/rfc822
252050	string/tc		return-path:	SMTP mail text
25206!:mime	message/rfc822
252070	string/t		Path:		news text
25208!:mime	message/news
252090	string/t		Xref:		news text
25210!:mime	message/news
252110	string/t		From:		news or mail text
25212!:mime	message/rfc822
252130	string/t		Date:		news or mail text
25214!:mime	message/rfc822
252150	string/t		Article 	saved news text
25216!:mime	message/news
25217# Reference:	http://quimby.gnus.org/notes/BABYL
25218# Update:	Joerg Jenderek
25219# Note:		used by Rmail in Emacs version 22 and before
25220#		is not text because of characters like Control-L Control-_
252210	string/b		BABYL\ OPTIONS:	Emacs RMAIL
25222#0	string/t		BABYL		Emacs RMAIL text
25223# https://reposcope.com/mimetype/message/x-gnu-rmail
25224!:mime	message/x-gnu-rmail
25225# ~/RMAIL
25226!:ext	/
252270	string/t		Received:	RFC 822 mail text
25228!:mime	message/rfc822
252290	string/t		MIME-Version:	MIME entity text
25230#0	string/t		Content-	MIME entity text
25231
25232# TNEF files...
25233# URL:		http://fileformats.archiveteam.org/wiki/Transport_Neutral_Encapsulation_Format
25234#		https://en.wikipedia.org/wiki/Transport_Neutral_Encapsulation_Format
25235# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/t/tnef.trid.xml
25236#		https://interoperability.blob.core.windows.net/files/MS-OXTNEF/%5bMS-OXTNEF%5d-210817.pdf
25237# Update:	Joerg Jenderek
25238# Note:		moved and merged from ./msdos (version 1.154) there just called "TNEF"
25239#		partly verified by `tnef --list -v -f voice.tnef` and `ytnef -v  triples.tnef`
25240# TNEF magic From "Joomy" <joomy@se-ed.net>
25241# TNEF_SIGNATURE
252420	lelong		0x223E9F78	Transport Neutral Encapsulation Format (TNEF)
25243!:mime	application/vnd.ms-tnef
25244# winmail.dat or win.dat by Microsoft Outlook
25245!:ext	tnef/dat
25246# https://docs.microsoft.com/en-us/openspecs/exchange_server_protocols/ms-oxtnef/7fdb64ee-7f63-4d95-9af1-c672e7475c3a
25247# LegacyKey
25248#>4	uleshort	x		\b, key %#4.4x
25249# attrLevelMessage; Level where attribute applies like: 1~attrLevelMessage 2~attrLevelAttachment
25250>6	ubyte		!1		\b, 1st level %#2.2x
25251# other ID (like 02900000h) or TnefVersion ID (idTnefVersion=06900800h)
25252>7	ubelong		!0x06900800	\b, 1st id %#8.8x
25253>7	ubelong		=0x06900800
25254# TnefVersion lenght like: 4
25255>>11	ulelong		!4		\b, TnefVersion length %x
25256# TNEFVersionData; TnefVersion data like: 00010000h
25257>>15	ulelong		!0x00010000h	\b, version %#8.8x
25258# Checksum like: 1
25259>>19	uleshort	!1		\b, checksum %#4.4x
25260# attrLevelMessage; level of attOemCodepage like: 1
25261>>21	ubyte		!1		\b, level %#2.2x
25262# idOEMCodePage; OEMCodePage ID like: 07900600h
25263>>22	ubelong		=0x07900600	\b, OEM codepage
25264# OEMCodePage length like: 8
25265>>>26	ulelong		=8
25266# OEMCodePageData; PrimaryCodePage like: 1251 1252
25267>>>>30	ulelong		x		%u
25268# OEMCodePageData; SecondaryCodePage; unused and SHOULD contain zero
25269>>>>34	ulelong		!0		and %u
25270# OEMCodePageData Checksum like: E7h E8h
25271>>>>38	uleshort	x		(checksum %#x)
25272# attrLevelMessage of attMessageClass like: 1
25273>>40	ubyte		!1		\b, level %u
25274# idMessageClass; ID of attMessageClass like: 08800700h
25275>>41	ubelong		=0x08800700	\b, MessageAttribute
25276# attMessageClass length like: 16 24 25
25277#>>>45	ulelong		x		(length %u)
25278# attMessageClass data like: "IPM.Microsoft Mail.Note" "IPM.Note.Portada Newseum"
25279# "IPM.Appointment" "IPM.Note.Microsoft.Voicemail.UM.CA"
25280>>>45	pstring/l	x		"%s"
25281
25282# From: Kevin Sullivan <ksulliva@psc.edu>
252830	string		*mbx*		MBX mail folder
25284
25285# From: Simon Matter <simon.matter@invoca.ch>
252860	string		\241\002\213\015skiplist\ file\0\0\0	Cyrus skiplist DB
252870	string		\241\002\213\015twoskip\ file\0\0\0\0	Cyrus twoskip DB
25288
25289# JAM(mbp) Fidonet message area databases
25290# JHR file
252910	string	JAM\0			JAM message area header file
25292>12	leshort >0			(%d messages)
25293
25294# Squish Fidonet message area databases
25295# SQD file (requires at least one message in the area)
25296# XXX: Weak magic
25297#256	leshort	0xAFAE4453		Squish message area data file
25298#>4	leshort	>0			(%d messages)
25299
25300#0	string		\<!--\ MHonArc		text/html; x-type=mhonarc
25301
25302# Cyrus: file(1) magic for compiled Cyrus sieve scripts
25303# URL: https://www.cyrusimap.org/docs/cyrus-imapd/2.4.6/internal/bytecode.php
25304# URL: http://git.cyrusimap.org/cyrus-imapd/tree/sieve/bytecode.h?h=master
25305# From: Philipp Hahn <hahn@univention.de>
25306
25307# Compiled Cyrus sieve script
253080       string CyrSBytecode     Cyrus sieve bytecode data,
25309>12     belong =1       version 1, big-endian
25310>12     lelong =1       version 1, little-endian
25311>12     belong x        version %d, network-endian
25312
25313# Dovecot mail server, version 2.2 and later.
25314# Dovecot mailing list: dovecot@dovecot.org
25315# File format spec: https://wiki.dovecot.org/Design/Dcrypt/#File_format
25316# From: Stephen Gildea
253170	string	CRYPTED\003\007		Dovecot encrypted message
25318>9	byte	x			\b, dcrypt version %d
25319#------------------------------------------------------------------------------
25320# $File: make,v 1.5 2022/03/12 15:09:47 christos Exp $
25321# make:  file(1) magic for makefiles
25322#
25323# URL: https://en.wikipedia.org/wiki/Make_(software)
253240	regex/100l	\^(CFLAGS|VPATH|LDFLAGS|all:|\\.PRECIOUS)	makefile script text
25325!:mime	text/x-makefile
25326!:strength -15
25327# Update: Joerg Jenderek
25328# Reference: https://www.freebsd.org/cgi/man.cgi?make(1)
25329# exclude grub-core\lib\libgcrypt\mpi\Makefile.am with "#BEGIN_ASM_LIST"
25330# by additional escaping point character
25331# exclude MS Windows help file CoNtenT with ":include FOOBAR.CNT"
25332# and NSIS script with "!include" by additional escaping point character
253330	regex/100l	\^\\.(BEGIN|endif|include)	BSD makefile script text
25334!:mime	text/x-makefile
25335!:ext	/mk
25336!:strength -10
253370	regex/100l	\^SUBDIRS[[:space:]]+=	automake makefile script text
25338!:mime	text/x-makefile
25339!:strength -15
25340
25341
25342#------------------------------------------------------------------------------
25343# $File: map,v 1.9 2021/04/26 15:56:00 christos Exp $
25344# map:  file(1) magic for Map data
25345#
25346
25347# Garmin .FIT files https://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml
253488	string	.FIT		FIT Map data
25349>15	byte	0
25350>>35	belong	x		\b, unit id %d
25351>>39	lelong	x		\b, serial %u
25352# https://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml
25353# 20 years after unix epoch
25354# TZ=GMT date -d '1989-12-31 0:00' +%s
25355>>43	leldate+631065600	x	\b, %s
25356
25357>>47	leshort x		\b, manufacturer %d
25358>>47	leshort	1		\b (garmin)
25359>>49	leshort x		\b, product %d
25360>>53	byte	x		\b, type %d
25361>>53	byte	1		\b (Device)
25362>>53	byte	2		\b (Settings)
25363>>53	byte	3		\b (Sports/Cycling)
25364>>53	byte	4		\b (Activity)
25365>>53	byte	8		\b (Elevations)
25366>>53	byte	10		\b (Totals)
25367
25368# Summary: Garmin map
25369# From:	Joerg Jenderek
25370# URL: https://en.wikipedia.org/wiki/Garmin_.img
25371# Reference: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/IMG_File_Format
25372# sourceforge.net/projects/garmin-img/files/IMG%20File%20Format/1.0/imgformat-1.0.pdf
25373# GRR: similar to MBR boot sector handled by ./filesystems
253740x1FE	leshort		=0xAA55
25375# look for valid map signature
25376>0x13	string		=IMG\0
25377>>0	use		garmin-map
253780	name				garmin-map
25379>0	ubyte		x		Garmin
25380!:mime	application/x-garmin-map
25381# If non-zero, every byte of the entire .img file is to be XORed with this value
25382>0	ubyte		!0		\b, %#x XORed
25383# goto block before FAT
25384>(0x40.b*512)	ubyte	x
25385# 1st fat name "DLLINFO TXT" only found for vpm
25386>>&512 		string	=DLLINFO\ TXT 	map (Voice Processing)
25387# there exist 2 other Garmin VPM formats; see ./audio
25388!:ext	vpm
25389# Deutsch__Yannick_D4481-00_0210.vpm
25390#>>>512	search/0x0116da60/s	RIFF	\b; with
25391# determine type voice type by ./riff
25392#>>>>&0	indirect	x	\b
25393>>&512 		string	!DLLINFO\ TXT 	map
25394!:ext	img
25395# 9 zeros
25396>1 	ubelong		!0 		\b, zeroes %#x
25397# Map's version major
25398>8	ubyte		x		v%u
25399# Map's version minor
25400>9	ubyte		x		\b.%.2u
25401# Map description[20], 0x20 padded
25402>0x49	string		x		%.20s
25403# Map name, continued (0x20 padded, \0 terminated)
25404>0x65	string		>\ 		\b%.31s
25405# Update year (+1900 for val >= 0x63, +2000 for val <= 0x62)
25406>0xB	ubyte		x		\b, updated
25407>>0xB	ubyte		>0x62
25408>>>0xB	ubyte-100	x		20%.2u
25409>>0xB	ubyte		<0x63
25410>>>0xB	ubyte		x		20%.2u
25411# Update month (0-11)
25412>0xA	ubyte		x		\b-%.2u
25413# All zeroes
25414>0xc 	uleshort	!0 		\b, zeroes %#x
25415# Mapsource flag, 1 - file created by Mapsource, 0 - Garmin map visible in Basecamp and Homeport
25416#>0xE	ubyte		!0		\b, Mapsource flag %#x
25417>0xE	ubyte		1		\b, Mapsource
25418# Checksum, sum of all bytes modulo 256 should be 0
25419#>0xF	ubyte		x		\b, Checksum %#x
25420# Signature: DSKIMG 0x00 or DSDIMG 0x00 for demo map
25421>0x10	string		!DSKIMG		\b, signature "%.7s"
25422>0x39	use		garmin-date
25423# Map file identifier like GARMIN\0
25424>0x41	string		!GARMIN		\b, id "%.7s"
25425# Block size exponent, E1; appears to always be 0x09; minimum block size 512 bytes
25426>0x61	ubyte		!0x09		\b, E1=%u
25427# Block size exponent, E2 ; file blocksize=2**(E1+E2)
25428>>0x62	ubyte		x		\b, E2=%u
25429>0x61	ubyte		=0x09		\b, blocksize
25430>>0x62	ubyte		0		512
25431>>0x62	ubyte		1		1024
25432>>0x62	ubyte		2		2048
25433>>0x62	ubyte		3		4096
25434>>0x62	ubyte		4		8192
25435>>0x62	ubyte		5		16384
25436>>0x62	default		x
25437>>>0x62	ubyte		x		E2=%u
25438# MBR signature
25439>0x1FE	leshort		!0xAA55		\b, invalid MBR
25440# 512 zeros
25441>0x200 	uquad		!0		\b, zeroes %#llx
25442# First sub-file offset (absolute); sometimes NO/UNKNOWN sub file!
25443>0x40C	ulelong		>0		\b, at %#x
25444# sub-file Header length
25445#>>(0x40C.l)	uleshort	x	\b, header len %#x
25446>>(0x40C.l)	uleshort	x	%u bytes
25447# sub-file Type[10] like "GARMIN RGN" "GARMIN TRE", "GARMIN TYP", etc.
25448>>(0x40C.l+2)	ubyte	>0x1F
25449>>>(0x40C.l+2)	ubyte	<0xFF
25450>>>>(0x40C.l+2)	string	x		"%.10s"
25451# 0x00 for most maps, 0x80 for locked maps (City Nav, City Select, etc.)
25452>>>>(0x40C.l+13)	ubyte	>0		\b, locked %#x
25453# Block sequence numbers like 0000 0100 0200 ... FFFF
25454# >0x420	ubequad		>0	\b, seq. %#16.16llx
25455# >>0x428	ubequad		>0	\b%16.16llx
25456# >>>0x430	ubequad	>0	\b%16.16llx
25457# >>>>0x438	ubequad	>0	\b%16.16llx
25458# >>>>>0x440	ubequad	>0	\b%16.16llx
25459# >>>>>>0x448	ubequad	>0	\b%16.16llx
25460# >>>>>>>0x450	ubequad	>0	\b%16.16llx
25461# >>>>>>>>0x458	ubequad	>0	\b%16.16llx
25462# >>>>>>>>>0x460	ubequad	>0	\b%16.16llx
25463# >>>>>>>>>>0x468	ubequad	>0	\b%16.16llx
25464# >>>>>>>>>>>0x470	ubequad	>0	\b%16.16llx
25465# >>>>>>>>>>>>0x478	ubequad	>0	\b%16.16llx
25466# >>>>>>>>>>>>>0x480	ubequad	>0	\b%16.16llx
25467# >>>>>>>>>>>>>>0x488	ubequad	>0	\b%16.16llx
25468# >>>>>>>>>>>>>>>0x490	ubequad	>0	\b%16.16llx
25469# >>>>>>>>>>>>>>>>0x498	ubequad	>0	\b%16.16llx
25470# >>>>>>>>>>>>>>>>>0x4A0	ubequad	>0	\b%16.16llx
25471# >>>>>>>>>>>>>>>>>>0x4A8	ubequad	>0	\b%16.16llx
25472# look for end of FAT
25473#>>0x420	search/512/s	\xff\xff	FAT END
25474# Physical block number of FAT header
25475#>0x40	ubyte		x		\b, FAT at phy. block %u
25476>0x40	ubyte		x
25477>>(0x40.b*512)	ubyte	x
25478# 1st FAT block
25479>>>&511 	use	garmin-fat
25480# 2nd FAT block
25481>>>&1023 	use	garmin-fat
25482# 3th FAT block
25483>>>&1535 	use	garmin-fat
25484# 4th FAT block
25485>>>&2047 	use	garmin-fat
25486# ... xth FAT block
25487#
25488# 314 zeros but not in vpm and also gmaptz.img
25489>0x84 	uquad		!0		\b, at 0x84 %#llx
25490# display FileAllocationTable block entry in garmin map
254910	name				garmin-fat
25492>0	ubyte		x		\b;
25493# sub file part; 0x0003 seems to be garbage
25494>0x10	uleshort	!0		next %#4.4x
25495>0x10	uleshort	=0
25496# fat flag 0~dummy block 1~true sub file
25497>>0	ubyte		!1		flag %u
25498>>0	ubyte		=1
25499# sub-file name like MAKEGMAP 12345678
25500>>>0x1	string		x		%.8s
25501# sub-file typ like RGN TRE MDR LBL
25502>>>0x9	string		x		\b.%.3s
25503# size of sub file
25504>>>0xC	ulelong		x		\b, %u bytes
25505# 32-bit block sequence numbers
25506#>>>0x20	ubequad		x		\b, seq. %#16.16llx
25507
25508#	display date stored inside Garmin maps like yyyy-mm-dd h:mm:ss
255090	name				garmin-date
25510# year like 2018
25511>0 	uleshort	x 		\b, created %u
25512# month (0-11)
25513>2	ubyte		x		\b-%.2u
25514# day (1-31)
25515>3	ubyte		x		\b-%.2u
25516# hour (0-23)
25517>4	ubyte		x		%u
25518# minute (0-59)
25519>5	ubyte		x		\b:%.2u
25520# second (0-59)
25521>6	ubyte		x		\b:%.2u
25522
25523# Summary: Garmin Map subfiles
25524# From:	Joerg Jenderek
25525# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/IMG_File_Format
25526# Garmin Common Header
255272	string	GARMIN\
25528# skip ASCII text by checking for low header length
25529>0	uleshort <0x1000	Garmin map,
25530# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/GMP_Subfile_Format
25531>>9	string	GMP				subtile
25532!:mime			application/x-garmin-gpm
25533!:ext			gmp
25534# copyright message
25535>>>(0.s)		string		x	%s
25536>>>0x0E 		use		garmin-date
25537# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/MDR_Subfile_Format
25538# This contains the searchable address table used for finding routing destinations
25539>>9	string	MDR				address table
25540!:mime			application/x-garmin-mdr
25541!:ext			mdr
25542# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/NOD_Subfile_Format
25543# http://svn.parabola.me.uk/display/trunk/doc/nod.txt
25544# This contains the routing information
25545>>9	string	NOD				routing
25546!:mime			application/x-garmin-nod
25547!:ext			nod
25548>>>0x0E 		use		garmin-date
25549#>>>0x15			ulelong		x	\b, at %#x
25550#>>>0x19			ulelong		x	%#x bytes NOD1
25551#>>>0x25			ulelong		x	\b, at %#x
25552#>>>0x29			ulelong		x	%#x bytes NOD2
25553#>>>0x31			ulelong		x	\b, at %#x
25554#>>>0x35			ulelong		x	%#x bytes NOD3
25555# URL: http://www.pinns.co.uk/osm/net.html
25556# routable highways (length, direction, allowed speed,house address information)
25557>>9	string	NET				highways
25558!:mime			application/x-garmin-net
25559!:ext			net
25560#>>>0x15			ulelong		x	\b, at %#x
25561#>>>0x19			ulelong		x	%#x bytes NET1
25562#>>>0x22			ulelong		>0
25563#>>>>0x1E		ulelong		x	\b, at %#x
25564#>>>>0x22		ulelong		x	%#x bytes NET2
25565#>>>0x2B			ulelong		>0
25566#>>>>0x27		ulelong		x	\b, at %#x
25567#>>>>0x2B		ulelong		x	%#x bytes NET3
25568# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/LBL_Subfile_Format
25569>>9	string	LBL				labels
25570!:mime			application/x-garmin-lbl
25571!:ext			lbl
25572>>>(0.s)		string	x	%s
25573# Label coding type 6h 9h and ah
25574>>>0x1E			ubyte		x	\b, coding type %#x
25575#>>>0x15			ulelong		x	\b, at %#x
25576#>>>0x19			ulelong		x	%#x bytes LBL1
25577#>>>0x1F			ulelong		x	\b, at %#x
25578#>>>0x23			ulelong		x	%#x bytes LBL2
25579#>>>0x2D			ulelong		x	\b, at %#x
25580#>>>0x31			ulelong		x	%#x bytes LBL3
25581# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/SRT_Subfile_Format
25582# A lookup table of the chars in the map's codepage, and their collating sequence
25583>>9	string	SRT				sort table
25584!:mime			application/x-garmin-srt
25585!:ext			srt
25586>>>0x0E 		use		garmin-date
25587# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/TRE_Subfile_Format
25588>>9	string	TRE				tree
25589!:mime			application/x-garmin-tre
25590!:ext			tre
25591# title like City Nav Europe NTU 2019.2 Basemap
25592# or OSM Street map
25593>>>(0.s)		string		x	%s
25594# 2nd title like Copyright 1995-2018 by GARMIN Corporation.
25595# or http://www.openstreetmap.org/
25596>>>>&1			string		x	%s
25597>>>0x0E 		use		garmin-date
25598#>>>0x21			ulelong		x	\b, at %#x
25599#>>>0x25			ulelong		x	%#x bytes TRE1
25600#>>>0x29			ulelong		x	\b, at %#x
25601#>>>0x2D			ulelong		x	%#x bytes TRE2
25602#>>>0x31			ulelong		x	\b, at %#x
25603#>>>0x35			ulelong		x	%#x bytes TRE3
25604# Copyright record size
25605#>>>0x39			uleshort	x	\b, copyright record size %u
25606# Map ID
25607>>>0x74			ulelong		x	\b, ID %#x
25608# URL: https://www.gpspower.net/garmin-tutorials/353310-basecamp-installing-free-desktop-map.html
25609# For road traffic information service (RDS/TMS/TMC). Commonly seen in City Navigator maps
25610>>9	string	TRF				traffic,
25611!:mime			application/x-garmin-trf
25612!:ext			trf
25613# city/region like Preitenegg
25614>>>(0.s+1) 		string		x	1st %s
25615# highway part like L606/L148
25616>>>>&1			string		x	%s
25617# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/Format
25618# Reference: http://www.pinns.co.uk/osm/typformat.html
25619# customize the appearance of objects. For GPS and MapSource/Qlandkarte better looking maps
25620>>9	string	TYP				types
25621!:mime			application/x-garmin-typ
25622!:ext			typ
25623>>>0x0E 		use		garmin-date
25624# character set 1252 65001~UTF8
25625>>>0x15			uleshort	x	\b, code page %u
25626# POIs
25627#>>>0x17			ulelong		x	\b, at %#x
25628#>>>0x1B			ulelong		x	%#x bytes TYP1
25629# extra pois
25630#>>>0x5B			ulelong		x	\b, at %#x
25631#>>>0x5F			ulelong		x	%#x bytes TYP8
25632# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/RGN_Subfile_Format
25633# http://www.pinns.co.uk/osm/RGN.html
25634# region data used by the Garmin software
25635>>9	string	RGN				region
25636!:mime			application/x-garmin-rgn
25637!:ext			rgn
25638# POIs,Indexed POIs,Polylines or Polygons or first map level
25639#>>>0x15			ulelong	       x	\b, at %#x
25640#>>>0x19			ulelong	       x	%#x bytes RGN1
25641# polygons with extended types
25642#>>>0x21			ulelong	       >0
25643#>>>>0x1D		ulelong	       x	\b, at %#x
25644#>>>>0x21		ulelong	       x	%#x bytes RGN2
25645# polylines with extended types
25646#>>>0x3D			ulelong	       >0
25647#>>>>0x39		ulelong	       x	\b, at %#x
25648#>>>>0x3D		ulelong	       x	%#x bytes RGN3
25649# extended POIs
25650#>>>0x59			ulelong	       >0
25651#>>>>0x55		ulelong	       x	\b, at %#x
25652#>>>>0x59		ulelong	       x	%#x bytes RGN3
25653#>>9	default		x		unknown map type
25654# Header length; GMP:31h 35h 3Dh,MDR:11Eh 238h 2C4h 310h,NOD:3Fh 7Fh,NET:64h,
25655# LBL:2A9h,SRT:1Dh 25h 27h,TRE:CFh 135h,TRF:5Ah,TYP:5Bh 6Eh 7Ch AEh,RGN:7Dh
25656>>0	uleshort	x		\b, header length %#x
25657
25658# URL:		https://www.memotech.franken.de/FileFormats/
25659# Reference:	https://www.memotech.franken.de/FileFormats/Garmin_RGN_Format.pdf
25660# From:		Joerg Jenderek
256610	string		KpGr		Garmin update
25662# format version like: 0064h~1.0
25663>0x4	uleshort	!0x0064
25664>>4	uleshort/100	x		\b, version %u
25665>>4	uleshort%100	x		\b.%u
25666# 1st Garmin entry
25667>6	use	garmin-entry
25668# 2nd Garmin entry
25669>(0x6.l+10)	ubyte		x
25670>>&0		use		garmin-entry
25671# 3rd entry
25672>(0x6.l+10)	ubyte		x
25673>>&(&0.l+4)	ubyte		x
25674>>>&0		use		garmin-entry
25675# look again at version to use default clause
25676>0x4	uleshort	x
25677# test for region content by looking for
25678# Garmin *.srf by ./images with normal builder name "SQA" or longer "hales"
25679# 1 space after equal sign
25680>>0x3a	search/5/s	GARMIN\ BITMAP	\b=
25681!:mime	image/x-garmin-exe
25682!:ext	exe
25683>>>&0	indirect	x
25684# if not bitmap *.srf then region; 1 space after equal sign
25685>>0x3a	default		x		\b=
25686!:mime	application/x-garmin-rgn
25687!:ext	rgn
25688# recursiv embedded
25689>>>0x3a	search/5/s	KpGrd
25690>>>>&0	indirect	x
25691# look for ZIP or JAR archive by ./archive and ./zip
25692>>>0x3a	search/5/s	PK\003\004
25693>>>>&0	indirect	x
25694# TODO: other garmin RGN record content like foo
25695#>>0x3a	search/5/s	bar		BAR
25696#		display information of Garmin RGN record
256970	name	garmin-entry
25698# record length: 2 for Data, for Application often 1Bh sometimes 1Dh, "big" for Region
25699#>0	ulelong		x		\b, length %#x
25700# data record (ID='D') with version content like 0064h~1.0
25701>4	ubyte		=0x44
25702>>5	uleshort	!0x0064		\b; Data
25703>>>5	uleshort/100	x		\b, version %u
25704>>>5	uleshort%100	x		\b.%u
25705# Application Record (ID='A')
25706>4	ubyte		=0x41		\b; App
25707# version content like 00c8h~2.0
25708>>5	uleshort	!0x00C8
25709>>>5	uleshort/100	x		\b, version %u
25710>>>5	uleshort%100	x		\b.%u
25711# builder name like: SQA sqa build hales
25712>>7	string		x		\b, build by %s
25713# build date like: Oct 25 1999, Oct 1 2008, Feb 23 2009, Dec 15 2009
25714>>>&1	string		x		%s
25715# build time like: 11:26:12, 11:45:54, 14:16:13, 18:23:01
25716>>>>&1	string		x		%s
25717# region record (ID='R')
25718>4	ubyte		=0x52		\b; Region
25719# region ID:14~fw_all.bin: 78~ZIP, RGN or SRF bitmap; 148~ZIP or JAR; 249~display firmware; 251~WiFi or GCD firmware; 255~ZIP
25720>>5	uleshort	x		ID=%u
25721# delay in ms: like 0, 500
25722>>7	ulelong		!0		\b, %u ms
25723# region size (is record length - 10)
25724#>>11	ulelong		x		\b, length %#x
25725# region content like:
25726# "KpGr"~recursiv embedded,"GARMIN BITMAP"~Garmin Bitmap *.srf, "PK"~ZIP archive
25727#>>15	string		x		\b, content "%s"
25728>>15	ubequad		x		\b, content %#llx...
25729# This does NOT WORK!
25730#>>15	indirect	x		\b; contains
25731>4	default		x		\b; other
25732# garmin Record ID Identifies the record content like: D A R
25733>>4	ubyte		x		ID '%c'
25734
25735# TOM TOM GPS watches ttbin files:
25736# https://github.com/ryanbinns/ttwatch/tree/master/ttbin
25737# From: Daniel Lenski
257380	byte	0x20
25739>1	leshort	0x0007
25740>>0x76	byte	0x20
25741>>>0x77	leshort	0x0075		TomTom activity file, v7
25742>>>>8	leldate	x		(%s,
25743>>>>3	byte    x		device firmware %d.
25744>>>>4	byte	x		\b%d.
25745>>>>5	byte	x		\b%d,
25746>>>>6	leshort	x		product ID %04d)
25747
25748
25749#------------------------------------------------------------------------------
25750# $File: maple,v 1.10 2021/08/30 13:31:25 christos Exp $
25751# maple:  file(1) magic for maple files
25752# "H. Nanosecond" <aldomel@ix.netcom.com>
25753# Maple V release 4, a multi-purpose math program
25754#
25755
25756# maple library .lib
25757# URL:		https://en.wikipedia.org/wiki/Maple_(software)
25758# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/l/lib-maple-v-r4.trid.xml
25759# Update:	Joerg Jenderek
257600	string	\000MVR4\nI	Maple Vr4 library
25761#!:mime	application/octet-stream
25762!:mime	application/x-maple-lib
25763!:ext	lib
25764
25765# URL:		https://en.wikipedia.org/wiki/Maple_(software)
25766# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/l/lib-maple-v-r5.trid.xml
25767# From:		Joerg Jenderek
257680	string	\000MVR5\n	Maple Vr5 library
25769#!:mime	application/octet-stream
25770!:mime	application/x-maple-lib
25771!:ext	lib
25772
25773# From:		Joerg Jenderek
257740x400	string	M7R0\nI		Maple Vr7 library
25775#!:mime	application/octet-stream
25776!:mime	application/x-maple-lib
25777!:ext	lib
25778# null terminated library name like: C:\Maple12/Cliffordlib\maple.lib ../Maplets/Tutors.lib
25779>5	string	x		%s
25780# probably library name padding with nil or points (0x2E)
25781#>0xF8	uquad	x		\b, PADDING 0x%16.16llx
25782# null terminated strings like: Exterior Clifford FunctionArithmetics
25783# like: 1 20 40
25784>0x115	ulelong	x		\b, %u string
25785# plural s
25786>0x115	ulelong	>1		\bs
25787>0x119	string	x		1st '%s'
25788# probably second name section padding with nil or points (0x2E)
25789#>0x3F0	uquad	x		\b, 2nd PADDING 0x%16.16llx
25790# line feed separated ASCII string with maximal 79 length
25791#>0x407	string	x		\b, section "%s"
25792>0x454	ubyte	!0x0a		\b, at 0x454 0x%x
25793
25794# .ind
25795# no magic for these :-(
25796# they are compiled indexes for maple files
25797
25798# .hdb
25799# Update:	Joerg Jenderek
25800# URL:		https://www.maplesoft.com/support/help/maple/view.aspx?path=Formats/HDB
25801# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/h/hdb-maple.trid.xml
25802# Note:		This format was replaced in Maple 18 by the Maple Help format (*.help)
258030	string	\000\004\000\000
25804# skip xBASE Compound Index file *.CDX by looking for version
25805>1028	string		version	Maple help database
25806# length of string version
25807#>>1024	ulelong		!7	\b, at 0x400 unexpected %u
25808#!:mime application/octet-stream
25809!:mime application/x-maple-hdb
25810!:ext	hdb
25811>1028	default		x
25812# skip more xBASE Compound Index file *.CDX by looking for keyword Maple
25813# like hsum.hdb
25814>>4	search/0xCC41	Maple	Maple help database
25815!:mime	application/x-maple-hdb
25816!:ext	hdb
25817
25818# .mhp
25819# this has the form <PACKAGE=name>
258200	string	\<PACKAGE=	Maple help file
258210	string	\<HELP\ NAME=	Maple help file
258220	string	\n\<HELP\ NAME=	Maple help file with extra carriage return at start (yuck)
25823#0	string	#\ Newton	Maple help file, old style
258240	string	#\ daub	Maple help file, old style
25825#0	string	#===========	Maple help file, old style
25826
25827# .mws
258280	string	\000\000\001\044\000\221	Maple worksheet
25829#this is anomalous
258300	string	WriteNow\000\002\000\001\000\000\000\000\100\000\000\000\000\000	Maple worksheet, but weird
25831# this has the form {VERSION 2 3 "IBM INTEL NT" "2.3" }\n
25832# that is {VERSION major_version miunor_version computer_type version_string}
258330	string	{VERSION\ 	Maple worksheet
25834>9	string	>\0	version %.1s.
25835>>11	string	>\0	%.1s
25836
25837# .mps
258380	string	\0\0\001$	Maple something
25839# from byte 4 it is either 'nul E' or 'soh R'
25840# I think 'nul E' means a file that was saved as  a different name
25841# a sort of revision marking
25842# 'soh R' means new
25843>4	string	\000\105	An old revision
25844>4	string	\001\122	The latest save
25845
25846# .mpl
25847# some of these are the same as .mps above
25848#0000000 000 000 001 044 000 105 same as .mps
25849#0000000 000 000 001 044 001 122 same as .mps
25850
258510	string	#\n##\ <SHAREFILE=	Maple something
258520	string	\n#\n##\ <SHAREFILE=	Maple something
258530	string	##\ <SHAREFILE=	Maple something
258540	string	#\r##\ <SHAREFILE=	Maple something
258550	string	\r#\r##\ <SHAREFILE=	Maple something
258560	string	#\ \r##\ <DESCRIBE>	Maple something anomalous.
25857#--------------------------------------------
25858# marc21: file(1) magic for MARC 21 Format
25859#
25860# Kevin Ford (kefo@loc.gov)
25861#
25862# MARC21 formats are for the representation and communication
25863# of bibliographic and related information in machine-readable
25864# form.  For more info, see https://www.loc.gov/marc/
25865
25866
25867# leader position 20-21 must be 45
25868# and 22-23 also 00 so far, but we check that later.
2586920	string		45
25870>0	search/2048	\x1e
25871
25872# leader starts with 5 digits, followed by codes specific to MARC format
25873>>0	regex/1l	(^[0-9]{5})[acdnp][^bhlnqsu-z]	MARC21 Bibliographic
25874!:mime	application/marc
25875>>0	regex/1l	(^[0-9]{5})[acdnosx][z]	MARC21 Authority
25876!:mime	application/marc
25877>>0	regex/1l	(^[0-9]{5})[cdn][uvxy]	MARC21 Holdings
25878!:mime	application/marc
25879>>0	regex/1l	(^[0-9]{5})[acdn][w]	MARC21 Classification
25880!:mime	application/marc
25881>>0	regex/1l	(^[0-9]{5})[cdn][q]	MARC21 Community
25882!:mime	application/marc
25883
25884# leader position 22-23, should be "00" but is it?
25885>>0	regex/1l	(^.{21})([^0]{2})	(non-conforming)
25886!:mime	application/marc
25887
25888#------------------------------------------------------------------------------
25889# $File: mathcad,v 1.5 2009/09/19 16:28:10 christos Exp $
25890# mathcad:  file(1) magic for Mathcad documents
25891# URL:	http://www.mathsoft.com/
25892# From:	Josh Triplett <josh@freedesktop.org>
25893
258940	string	.MCAD\t		Mathcad document
25895
25896#------------------------------------------------------------------------------
25897# $File: mathematica,v 1.14 2021/11/07 16:27:36 christos Exp $
25898# mathematica:  file(1) magic for mathematica files
25899# "H. Nanosecond" <aldomel@ix.netcom.com>
25900# Mathematica a multi-purpose math program
25901# versions 2.2 and 3.0
25902
25903#mathematica .mb
259040	string	\064\024\012\000\035\000\000\000	Mathematica version 2 notebook
25905!:ext mb
259060	string	\064\024\011\000\035\000\000\000	Mathematica version 2 notebook
25907!:ext mb
25908
25909# .ma
25910# multiple possibilities:
25911
259120	string	(*^\n\n::[\011frontEndVersion\ =\ 	Mathematica notebook
25913#>41	string	>\0	%s
25914!:ext mb
25915
25916#0	string	(*^\n\n::[\011palette	Mathematica notebook version 2.x
25917
25918#0	string	(*^\n\n::[\011Information	Mathematica notebook version 2.x
25919#>675	string	>\0	%s #doesn't work well
25920
25921# there may be 'cr' instead of 'nl' in some does this matter?
25922
25923# generic:
259240	string	(*^\r\r::[\011	Mathematica notebook version 2.x
25925!:ext mb
259260	string	(*^\r\n\r\n::[\011	Mathematica notebook version 2.x
25927!:ext mb
259280	string	(*^\015			Mathematica notebook version 2.x
25929!:ext mb
259300	string	(*^\n\r\n\r::[\011	Mathematica notebook version 2.x
25931!:ext mb
259320	string	(*^\r::[\011	Mathematica notebook version 2.x
25933!:ext mb
259340	string	(*^\r\n::[\011	Mathematica notebook version 2.x
25935!:ext mb
259360	string	(*^\n\n::[\011	Mathematica notebook version 2.x
25937!:ext mb
259380	string	(*^\n::[\011	Mathematica notebook version 2.x
25939!:ext mb
25940
25941
25942# Mathematica .mx files
25943
25944#0	string	(*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*)	Mathematica binary file
259450	string	(*This\ is\ a\ Mathematica\ binary\ 	Mathematica binary file
25946#>71	string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000
25947# >71... is optional
25948>88	string	>\0	from %s
25949
25950
25951# Mathematica files PBF:
25952# 115 115 101 120 102 106 000 001 000 000 000 203 000 001 000
259530	string	MMAPBF\000\001\000\000\000\203\000\001\000	Mathematica PBF (fonts I think)
25954
25955# .ml files  These are menu resources I think
25956# these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\
25957# how to put that into a magic rule?
259584	string	\ A~	MAthematica .ml file
25959
25960# .nb files
25961#too long 0	string	(***********************************************************************\n\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Mathematica-Compatible Notebook	Mathematica 3.0 notebook
259620	string	(***********************	Mathematica 3.0 notebook
25963
25964# other (* matches it is a comment start in these langs
25965# GRR: Too weak; also matches other languages e.g. ML
25966#0	string	(*	Mathematica, or Pascal, Modula-2 or 3 code text
25967
25968#########################
25969# MatLab v5
25970# URL:		http://fileformats.archiveteam.org/wiki/MAT
25971# Reference:	https://www.mathworks.com/help/pdf_doc/matlab/matfile_format.pdf
25972# first 116 bytes of header contain text in human-readable form
259730       string  MATLAB  Matlab v
25974#>11	string/T	x	\b, at 11 "%.105s"
25975#!:mime	application/octet-stream
25976!:mime	application/x-matlab-data
25977!:ext	mat
25978#	https://de.mathworks.com/help/matlab/import_export/mat-file-versions.html
25979# level of the MAT-file like: 5.0 7.0 or maybe 7.3
25980#>7	string	x	LEVEL "%.3s"
25981>7	ubyte	=0x35	\b5 mat-file
25982>7	ubyte	!0x35
25983>>7	string	x	\b%.3s mat-file
25984>126    short   0x494d  (big endian)
25985>>124   beshort x       version %#04x
25986>126    short   0x4d49  (little endian)
25987# 0x0100 for level 5.0 and 0x0200 for level 7.0
25988>>124   leshort x       version %#04x
25989# test again so that default clause works
25990>126	short	x
25991# created by MATLAB include Platform sometimes without leading comma (0x2C) or missing
25992# like: GLNX86 PCWIN PCWIN64 SOL2 Windows\0407 nt posix
25993>>20	search/2	Platform:\040	\b, platform
25994>>>&0	string		x		%-0.2s
25995>>>&2		ubyte	!0x2C		\b%c
25996>>>>&0		ubyte	!0x2C		\b%c
25997>>>>>&0		ubyte	!0x2C		\b%c
25998>>>>>>&0	ubyte	!0x2C		\b%c
25999>>>>>>>&0	ubyte	!0x2C		\b%c
26000>>>>>>>>&0	ubyte	!0x2C		\b%c
26001>>>>>>>>>&0	ubyte	!0x2C		\b%c
26002# examples without Platform tag like one_by_zero_char.mat
26003>>20	default		x
26004>>>11	string		x	"%s"
26005# created by MATLAB include time like: Fri Feb 20 15:26:59 2009
26006>34	search/9/c	created\040on:\040	\b, created
26007>>&0	string	x		%-.24s
26008#	MatLab v4
26009# From:	Joerg Jenderek
26010# check for valid imaginary flag of Matlab matrix version 4
2601113	ushort	0
26012# check for valid ASCII matrix name
26013>20	ubyte	>0x1F
26014# skip PreviousEntries.dat with "invalid high" name \304P\344@\001
26015>>20	ubyte	<0304
26016# skip some Netwfw*.dat and $I3KREPH.dat by checking for non zero number of rows
26017>>>4	ulong		!0
26018# skip some CD-ROM filesystem like test-hfs.iso by looking for valid big endian type flag
26019>>>>0	ubelong&0xFFffFF00	0x00000300
26020>>>>>0	use	matlab4
26021# no example for 8-bit and 16-bit integers matrix
26022>>>>0	ubelong&0xFFffFF00	0x00000400
26023>>>>>0	use	matlab4
26024#	branch for Little-Endian variant of Matlab MATrix version 4
26025# skip big endian variant by looking for valid low lttle endian type flag
26026>>>>0	ulelong		<53
26027# skip tokens.dat and some Netwfw*.dat by check for valid imaginary flag value of MAT version 4
26028>>>>>12	ulelong		<2
26029# no misidentfied little endian MATrix example with "short" matrix name
26030>>>>>>16	ulelong		<3
26031>>>>>>>0	use	\^matlab4
26032# little endian MATrix with "long" matrix name or some misidentified samples
26033>>>>>>16	ulelong		>2
26034# skip TileCacheLogo-*.dat with invalid 2nd character \001 of matrix name with length 96
26035>>>>>>>21 ubyte	>0x1F
26036>>>>>>>>0 use	\^matlab4
26037#	display information of Matlab v4 mat-file
260380	name	matlab4		Matlab v4 mat-file
26039#!:mime	application/octet-stream
26040!:mime	application/x-matlab-data
26041!:ext	mat
26042# 20-byte header with 5 long integers that contains information describing certain attributes of the Matrix
26043# type flag decimal MOPT; maximal 4052=FD4h; maximal 52=34h for little endian
26044#>0	ubelong		x	\b, type flag %u
26045#>0	ubelong		x	(%#x)
26046# M: 0~little endian 1~Big Endian 2~VAX D-float 3~VAX G-float 4~Cray
26047#>0	ubelong/1000	x	\b, M=%u
26048>0	ubelong/1000	0	(little endian)
26049>0	ubelong/1000	1	(big endian)
26050>0	ubelong/1000	2	(VAX D-float)
26051>0	ubelong/1000	3	(VAX G-float)
26052>0	ubelong/1000	4	(Cray)
26053# namlen; the length of the matrix name
26054#>16	ubelong		x	\b, name length %u
26055#>(16.L+19)	ubyte	x	\b, TERMINATING NAME CHARACTER=%#x
26056# nul terminated matrix name like: fit_params testmatrix testsparsecomplex teststringarray
26057#>20	string		x	\b, MATRIX NAME="%s"
26058#>21		ubyte	x	\b, MAYBE 2ND CHAR=%c
26059>16	pstring/L	x	%s
26060# T indicates the matrix type: 0~numeric 1~text 2~sparse
26061#>0	ubelong%10	x	\b, T=%u
26062>0	ubelong%10	0	\b, numeric
26063>0	ubelong%10	1	\b, text
26064>0	ubelong%10	2	\b, sparse
26065# mrows; number of rows in the matrix like: 1 3 8
26066>4	ubelong		x	\b, rows %u
26067# ncols; number of columns in the matrix like: 1 3 4 5 9 43
26068>8	ubelong		x	\b, columns %u
26069# imagf; imaginary flag; 1~matrix has an imaginary part 0~only real data
26070>12	ubelong		!0	\b, imaginary (%u)
26071# real; Real part of the matrix consists of mrows * ncols numbers
26072
26073#------------------------------------------------------------------------------
26074# $File: matroska,v 1.9 2019/04/19 00:42:27 christos Exp $
26075# matroska:  file(1) magic for Matroska files
26076#
26077# See https://www.matroska.org/
26078#
26079
26080# EBML id:
260810		belong		0x1a45dfa3
26082# DocType id:
26083>4		search/4096 	\x42\x82
26084# DocType contents:
26085>>&1		string		webm		WebM
26086!:mime  video/webm
26087>>&1		string		matroska	Matroska data
26088!:mime  video/x-matroska
26089
26090#------------------------------------------------------------------------------
26091# $File: mcrypt,v 1.6 2022/02/08 18:51:45 christos Exp $
26092# Mavroyanopoulos Nikos <nmav@hellug.gr>
26093# mcrypt:   file(1) magic for mcrypt 2.2.x;
26094# URL: 		https://en.wikipedia.org/wiki/Mcrypt
26095#		http://fileformats.archiveteam.org/wiki/MCrypt
26096# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/n/nc-mcrypt.trid.xml
26097# Update:	Joerg Jenderek
26098# Note:		called by TrID "mcrypt encrypted (v2.5)"
260990	string		\0m\3		mcrypt 2.5 encrypted data,
26100#!:mime	application/octet-stream
26101!:mime	application/x-crypt-nc
26102!:ext	nc
26103>4	string		>\0		algorithm: %s,
26104>>&1	leshort		>0		keysize: %d bytes,
26105>>>&0	string		>\0		mode: %s,
26106
26107# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/n/nc-mcrypt-22.trid.xml
26108# Note:		called by TrID "mcrypt encrypted (v2.2)"
261090	string		\0m\2		mcrypt 2.2 encrypted data,
26110#!:mime	application/octet-stream
26111!:mime	application/x-crypt-nc
26112# no example
26113!:ext	nc
26114>3	byte		0		algorithm: blowfish-448,
26115>3	byte		1		algorithm: DES,
26116>3	byte		2		algorithm: 3DES,
26117>3	byte		3		algorithm: 3-WAY,
26118>3	byte		4		algorithm: GOST,
26119>3	byte		6		algorithm: SAFER-SK64,
26120>3	byte		7		algorithm: SAFER-SK128,
26121>3	byte		8		algorithm: CAST-128,
26122>3	byte		9		algorithm: xTEA,
26123>3	byte		10		algorithm: TWOFISH-128,
26124>3	byte		11		algorithm: RC2,
26125>3	byte		12		algorithm: TWOFISH-192,
26126>3	byte		13		algorithm: TWOFISH-256,
26127>3	byte		14		algorithm: blowfish-128,
26128>3	byte		15		algorithm: blowfish-192,
26129>3	byte		16		algorithm: blowfish-256,
26130>3	byte		100		algorithm: RC6,
26131>3	byte		101		algorithm: IDEA,
26132>4	byte		0		mode: CBC,
26133>4	byte		1		mode: ECB,
26134>4	byte		2		mode: CFB,
26135>4	byte		3		mode: OFB,
26136>4	byte		4		mode: nOFB,
26137>5	byte		0		keymode: 8bit
26138>5	byte		1		keymode: 4bit
26139>5	byte		2		keymode: SHA-1 hash
26140>5	byte		3		keymode: MD5 hash
26141
26142#------------------------------------------------------------------------------
26143# $File: measure,v 1.3 2021/03/25 17:30:10 christos Exp $
26144# measure: file(1) magic for measurement data
26145
26146# DIY-Thermocam raw data
261470	name	diy-thermocam-parser
26148>0	beshort	x	scale %d-
26149>2	beshort x	\b%d,
26150>4	lefloat	x	spot sensor temperature %f,
26151>9	ubyte	0	unit celsius,
26152>9	ubyte	1	unit fahrenheit,
26153>8	ubyte	x	color scheme %d
26154>10	ubyte	1	\b, show spot sensor
26155>11	ubyte	1	\b, show scale bar
26156>12	ubyte	&1	\b, minimum point enabled
26157>12	ubyte	&2	\b, maximum point enabled
26158>13	lefloat	x	\b, calibration: offset %f,
26159>17	lefloat x	slope %f
26160
261610	name	diy-thermocam-checker
26162>9	ubyte	<2
26163>>10	ubyte	<2
26164>>>11	ubyte	<2
26165>>>>12	ubyte	<4
26166>>>>>17	lefloat	>0.0001	DIY-Thermocam raw data
26167
26168# V2 and Leption 3.x:
2616938408	ubyte	<19
26170>38400	use	diy-thermocam-checker
26171>>38400	default x	(Lepton 3.x),
26172>>>38400	use	diy-thermocam-parser
26173
26174# V1 or Lepton 2.x
261759608	ubyte	<19
26176>9600	use	diy-thermocam-checker
26177>>9600	default	x	(Lepton 2.x),
26178>>>9600	use	diy-thermocam-parser
26179
26180# Becker & Hickl Photon Counting (PMS) data file
26181# format documentation: https://www.becker-hickl.com/wp-content/uploads/2018/11/opm-pms400-v01.pdf (page 57)
26182(0x02.l)	string	*IDENTIFICATION		Becker & Hickl PMS Data File
26183>0x12		short	x			(%d data blocks)
26184!:ext sdt
26185
26186#------------------------------------------------------------------------------
26187# $File: mercurial,v 1.5 2019/04/19 00:42:27 christos Exp $
26188# mercurial:  file(1) magic for Mercurial changeset bundles
26189# https://www.selenic.com/mercurial/wiki/
26190#
26191# Jesse Glick (jesse.glick@sun.com)
26192#
26193
261940	string		HG10		Mercurial changeset bundle
26195>4	string		UN		(uncompressed)
26196>4	string		GZ		(gzip compressed)
26197>4	string		BZ		(bzip2 compressed)
26198
26199#------------------------------------------------------------------------------
26200# $File: metastore,v 1.3 2019/04/19 00:42:27 christos Exp $
26201# metastore:  file(1) magic for metastore files
26202# From: Thomas Wissen
26203# see https://david.hardeman.nu/software.php#metastore
262040	string		MeTaSt00r3	Metastore data file,
26205>10	bequad		x		version %0llx
26206
26207#------------------------------------------------------------------------------
26208# $File: meteorological,v 1.2 2017/03/17 21:35:28 christos Exp $
26209# rinex:  file(1) magic for RINEX files
26210# http://igscb.jpl.nasa.gov/igscb/data/format/rinex210.txt
26211# ftp://cddis.gsfc.nasa.gov/pub/reports/formats/rinex300.pdf
26212# data for testing: ftp://cddis.gsfc.nasa.gov/pub/gps/data
2621360	string		RINEX
26214>80	search/256	XXRINEXB	RINEX Data, GEO SBAS Broadcast
26215>>&32	string		x		\b, date %15.15s
26216>>5	string		x		\b, version %6.6s
26217!:mime	rinex/broadcast
26218>80	search/256	XXRINEXD	RINEX Data, Observation (Hatanaka comp)
26219>>&32	string		x		\b, date %15.15s
26220>>5	string		x		\b, version %6.6s
26221!:mime	rinex/observation
26222>80	search/256	XXRINEXC	RINEX Data, Clock
26223>>&32	string		x		\b, date %15.15s
26224>>5	string		x		\b, version %6.6s
26225!:mime	rinex/clock
26226>80	search/256	XXRINEXH	RINEX Data, GEO SBAS Navigation
26227>>&32	string		x		\b, date %15.15s
26228>>5	string		x		\b, version %6.6s
26229!:mime	rinex/navigation
26230>80	search/256	XXRINEXG	RINEX Data, GLONASS Navigation
26231>>&32	string		x		\b, date %15.15s
26232>>5	string		x		\b, version %6.6s
26233!:mime	rinex/navigation
26234>80	search/256	XXRINEXL	RINEX Data, Galileo Navigation
26235>>&32	string		x		\b, date %15.15s
26236>>5	string		x		\b, version %6.6s
26237!:mime	rinex/navigation
26238>80	search/256	XXRINEXM	RINEX Data, Meteorological
26239>>&32	string		x		\b, date %15.15s
26240>>5	string		x		\b, version %6.6s
26241!:mime	rinex/meteorological
26242>80	search/256	XXRINEXN	RINEX Data, Navigation
26243>>&32	string		x		\b, date %15.15s
26244>>5	string		x		\b, version %6.6s
26245!:mime	rinex/navigation
26246>80	search/256	XXRINEXO	RINEX Data, Observation
26247>>&32	string		x		\b, date %15.15s
26248>>5	string		x		\b, version %6.6s
26249!:mime	rinex/observation
26250
26251# https://en.wikipedia.org/wiki/GRIB
262520	string	GRIB
26253>7	byte	=1	Gridded binary (GRIB) version 1
26254>7	byte	=2	Gridded binary (GRIB) version 2
26255
26256#------------------------------------------------------------------------------
26257# $File: microfocus,v 1.3 2019/04/19 00:42:27 christos Exp $
26258# Micro Focus COBOL data files.
26259
26260# https://documentation.microfocus.com/help/index.jsp?topic=\
26261# %2FGUID-0E0191D8-C39A-44D1-BA4C-D67107BAF784%2FHRFLRHFILE05.html
26262# http://www.cobolproducts.com/datafile/data-viewer.html
26263# https://github.com/miracle2k/mfcobol-export
26264
262650 string \x30\x00\x00\x7C
26266>36 string \x00\x3E Micro Focus File with Header (DAT)
26267!:mime application/octet-stream
26268
262690 string \x30\x7E\x00\x00
26270>36 string \x00\x3E Micro Focus File with Header (DAT)
26271!:mime application/octet-stream
26272
2627339 string \x02
26274>136 string \x02\x02\x04\x04 Micro Focus Index File (IDX)
26275!:mime application/octet-stream
26276
26277#------------------------------------------------------------------------------
26278# $File: mime,v 1.8 2017/03/17 22:20:22 christos Exp $
26279# mime:  file(1) magic for MIME encoded files
26280#
262810	string/t		Content-Type:\040
26282>14	string		>\0		%s
262830	string/t		Content-Type:
26284>13	string		>\0		%s
26285
26286#------------------------------------------------------------------------------
26287# $File: mips,v 1.10 2014/04/30 21:41:02 christos Exp $
26288# mips:  file(1) magic for MIPS ECOFF and Ucode, as used in SGI IRIX
26289# and DEC Ultrix
26290#
262910	beshort	0x0160		MIPSEB ECOFF executable
26292>20	beshort	0407		(impure)
26293>20	beshort	0410		(swapped)
26294>20	beshort	0413		(paged)
26295>8	belong	>0		not stripped
26296>8	belong	0		stripped
26297>22	byte	x		- version %d
26298>23	byte	x		\b.%d
26299#
263000	beshort	0x0162		MIPSEL-BE ECOFF executable
26301>20	beshort	0407		(impure)
26302>20	beshort	0410		(swapped)
26303>20	beshort	0413		(paged)
26304>8	belong	>0		not stripped
26305>8	belong	0		stripped
26306>23	byte	x		- version %d
26307>22	byte	x		\b.%d
26308#
263090	beshort	0x6001		MIPSEB-LE ECOFF executable
26310>20	beshort	03401		(impure)
26311>20	beshort	04001		(swapped)
26312>20	beshort	05401		(paged)
26313>8	belong	>0		not stripped
26314>8	belong	0		stripped
26315>23	byte	x		- version %d
26316>22	byte	x		\b.%d
26317#
263180	beshort	0x6201		MIPSEL ECOFF executable
26319>20	beshort	03401		(impure)
26320>20	beshort	04001		(swapped)
26321>20	beshort	05401		(paged)
26322>8	belong	>0		not stripped
26323>8	belong	0		stripped
26324>23	byte	x		- version %d
26325>22	byte	x		\b.%d
26326#
26327# MIPS 2 additions
26328#
263290	beshort	0x0163		MIPSEB MIPS-II ECOFF executable
26330>20	beshort	0407		(impure)
26331>20	beshort	0410		(swapped)
26332>20	beshort	0413		(paged)
26333>8	belong	>0		not stripped
26334>8	belong	0		stripped
26335>22	byte	x		- version %d
26336>23	byte	x		\b.%d
26337#
263380	beshort	0x0166		MIPSEL-BE MIPS-II ECOFF executable
26339>20	beshort	0407		(impure)
26340>20	beshort	0410		(swapped)
26341>20	beshort	0413		(paged)
26342>8	belong	>0		not stripped
26343>8	belong	0		stripped
26344>22	byte	x		- version %d
26345>23	byte	x		\b.%d
26346#
263470	beshort	0x6301		MIPSEB-LE MIPS-II ECOFF executable
26348>20	beshort	03401		(impure)
26349>20	beshort	04001		(swapped)
26350>20	beshort	05401		(paged)
26351>8	belong	>0		not stripped
26352>8	belong	0		stripped
26353>23	byte	x		- version %d
26354>22	byte	x		\b.%d
26355#
263560	beshort	0x6601		MIPSEL MIPS-II ECOFF executable
26357>20	beshort	03401		(impure)
26358>20	beshort	04001		(swapped)
26359>20	beshort	05401		(paged)
26360>8	belong	>0		not stripped
26361>8	belong	0		stripped
26362>23	byte	x		- version %d
26363>22	byte	x		\b.%d
26364#
26365# MIPS 3 additions
26366#
263670	beshort	0x0140		MIPSEB MIPS-III ECOFF executable
26368>20	beshort	0407		(impure)
26369>20	beshort	0410		(swapped)
26370>20	beshort	0413		(paged)
26371>8	belong	>0		not stripped
26372>8	belong	0		stripped
26373>22	byte	x		- version %d
26374>23	byte	x		\b.%d
26375#
263760	beshort	0x0142		MIPSEL-BE MIPS-III ECOFF executable
26377>20	beshort	0407		(impure)
26378>20	beshort	0410		(swapped)
26379>20	beshort	0413		(paged)
26380>8	belong	>0		not stripped
26381>8	belong	0		stripped
26382>22	byte	x		- version %d
26383>23	byte	x		\b.%d
26384#
263850	beshort	0x4001		MIPSEB-LE MIPS-III ECOFF executable
26386>20	beshort	03401		(impure)
26387>20	beshort	04001		(swapped)
26388>20	beshort	05401		(paged)
26389>8	belong	>0		not stripped
26390>8	belong	0		stripped
26391>23	byte	x		- version %d
26392>22	byte	x		\b.%d
26393#
263940	beshort	0x4201		MIPSEL MIPS-III ECOFF executable
26395>20	beshort	03401		(impure)
26396>20	beshort	04001		(swapped)
26397>20	beshort	05401		(paged)
26398>8	belong	>0		not stripped
26399>8	belong	0		stripped
26400>23	byte	x		- version %d
26401>22	byte	x		\b.%d
26402#
264030	beshort	0x180		MIPSEB Ucode
264040	beshort	0x182		MIPSEL-BE Ucode
26405
26406#------------------------------------------------------------------------------
26407# $File: mirage,v 1.7 2009/09/19 16:28:10 christos Exp $
26408# mirage:  file(1) magic for Mirage executables
26409#
26410# XXX - byte order?
26411#
264120	long	31415		Mirage Assembler m.out executable
26413
26414#-----------------------------------------------------------------------------
26415# $File: misctools,v 1.20 2021/05/25 15:13:55 christos Exp $
26416# misctools:  file(1) magic for miscellaneous UNIX tools.
26417#
264180	search/1	%%!!			X-Post-It-Note text
264190	string/c	BEGIN:VCALENDAR		vCalendar calendar file
26420!:mime	text/calendar
26421# updated by Joerg Jenderek at Apr 2015, May 2021
26422# https://en.wikipedia.org/wiki/VCard
26423# URL: 	http://fileformats.archiveteam.org/wiki/VCard
26424# https://datatracker.ietf.org/doc/html/rfc6350
26425# the value is case-insensitive
264260	string/c	begin:vcard
26427# skip DROID fmt-395-signature-id-634.vcf
26428>13	string		!VERSION:END		vCard visiting card
26429# deprecated
26430#!:mime	text/x-vcard
26431!:mime	text/vcard
26432!:apple	????vCrd
26433!:ext	vcf/vcard
26434# VERSION must come right after BEGIN for 3.0 or 4.0 except in 2.1 , where it can be anywhere
26435# Joerg_Jenderek_67.vcf
26436>>12	search/0x113b4/c	version:
26437# VERSION 2.1 , 3.0 or 4.0
26438>>>&0	string		x			\b, version %-.3s
26439>>>&0	string		!2.1
26440>>>>13	string		!VERSION:		\b, 2nd line does not start with VERSION:
26441# downcase violates RFC 6350, but some "bad" software produce such vcards
26442>>0	string		!BEGIN			\b, not up case
26443# http://ftp.mozilla.org/pub/thunderbird/candidates/
26444# 78.10.1-candidates/build1/source/thunderbird-78.10.1.source.tar.xz
26445# thunderbird-78.10.1/comm/mailnews/import/test/unit/resources/basic_vcard_addressbook.vcf
26446>>11	beshort		!0x0D0A			\b, lines not separated by CRLF
26447
26448# Summary: Libtool library file
26449# Extension: .la
26450# Submitted by: Tomasz Trojanowski <tomek@uninet.com.pl>
264510	search/80	.la\ -\ a\ libtool\ library\ file	libtool library file
26452
26453# Summary: Libtool object file
26454# Extension: .lo
26455# Submitted by: Abel Cheung <abelcheung@gmail.com>
264560	search/80	.lo\ -\ a\ libtool\ object\ file	libtool object file
26457
26458# From: Daniel Novotny <dnovotny@redhat.com>
26459# Update: Joerg Jenderek
26460# URL: https://en.wikipedia.org/wiki/Core_dump#User-mode_memory_dumps
26461# Reference: https://msdn.microsoft.com/en-us/library/ms680378%28VS.85%29.aspx
26462#
26463# "Windows Minidump" by TrID
26464# ./misctools (version 5.25) labeled the entry as "MDMP crash report data"
264650	string		MDMP					Mini DuMP crash report
26466# https://filext.com/file-extension/DMP
26467!:mime	application/x-dmp
26468!:ext	dmp/mdmp
26469# The high-order word is an internal value that is implementation specific.
26470# The low-order word is MINIDUMP_VERSION 0xA793
26471>4	ulelong&0x0000FFFF	!0xA793				\b, version %#4.4x
26472# NumberOfStreams 8,9,10,13
26473>8	ulelong			x				\b, %d streams
26474# StreamDirectoryRva 0x20
26475>12	ulelong			!0x20				\b, %#8.8x RVA
26476# CheckSum 0
26477>16	ulelong			!0				\b, CheckSum %#8.8x
26478# Reserved or TimeDateStamp
26479>20	ledate			x				\b, %s
26480# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680519%28v=vs.85%29.aspx
26481# Flags MINIDUMP_TYPE enumeration type 0 0x121 0x800
26482>24	ulelong			x				\b, %#x type
26483# >24	ulelong			>0				\b; include
26484# >>24	ulelong			&0x00000001			\b data sections,
26485# >>24	ulelong			&0x00000020			\b list of unloaded modules,
26486# >>24	ulelong			&0x00000100			\b process and thread information,
26487# >>24	ulelong			&0x00000800			\b memory information,
26488
26489# Summary: abook addressbook file
26490# Submitted by: Mark Schreiber <mark7@alumni.cmu.edu>
264910	string	#\x20abook\x20addressbook\x20file abook address book
26492!:mime application/x-abook-addressbook
26493
26494#------------------------------------------------------------------------------
26495# $File: mkid,v 1.6 2009/09/19 16:28:10 christos Exp $
26496# mkid:  file(1) magic for mkid(1) databases
26497#
26498# ID is the binary tags database produced by mkid(1).
26499#
26500# XXX - byte order?
26501#
265020	string		\311\304	ID tags data
26503>2	short		>0		version %d
26504
26505#------------------------------------------------------------------------------
26506# $File: mlssa,v 1.4 2009/09/19 16:28:10 christos Exp $
26507# mlssa: file(1) magic for MLSSA datafiles
26508#
265090		lelong		0xffffabcd	MLSSA datafile,
26510>4		leshort		x		algorithm %d,
26511>10		lelong		x		%d samples
26512
26513#------------------------------------------------------------------------------
26514# $File: mmdf,v 1.6 2009/09/19 16:28:10 christos Exp $
26515# mmdf:  file(1) magic for MMDF mail files
26516#
265170	string	\001\001\001\001	MMDF mailbox
26518
26519#------------------------------------------------------------------------------
26520# $File: modem,v 1.10 2021/04/26 15:56:00 christos Exp $
26521# modem:  file(1) magic for modem programs
26522#
26523# From: Florian La Roche <florian@knorke.saar.de>
265241	string		PC\ Research,\ Inc	Digifax-G3-File
26525>29	byte		1			\b, fine resolution
26526>29	byte		0			\b, normal resolution
26527
26528# Summary: CCITT Group 3 Facsimile in "raw" form (i.e. no header).
26529# Modified by: Joerg Jenderek
26530# URL: https://de.wikipedia.org/wiki/Fax
26531# Reference: https://web.archive.org/web/20020628195336/http://www.netnam.vn/unescocourse/computervision/104.htm
26532# GRR: EOL of G3 is too general as it catches also TrueType fonts, Postscript PrinterFontMetric, others
265330	short		0x0100
26534# 16 0-bits near beginning like True Type fonts *.ttf, Postscript PrinterFontMetric *.pfm, FTYPE.HYPERCARD, XFER
26535>2	search/9	\0\0
26536# maximal 7 0-bits for pixel sequences or 11 0-bits for EOL in G3
26537>2	default		x
26538# skip IRCAM file (VAX big-endian)	./audio
26539>>0	belong		!0x0001a364
26540# skip GEM Image data			./images
26541>>>2	beshort		!0x0008
26542# look for first keyword of Panorama database *.pan
26543>>>>11	search/262	\x06DESIGN
26544# skip Panorama database
26545>>>>11	default		x
26546# old Apple DreamWorld DreamGrafix *.3200 with keyword at end of g3 looking files
26547>>>>>27118	search/1864	DreamWorld
26548>>>>>27118	default		x
26549# skip MouseTrap/Mt.Defaults with file size 16 found on Golden Orchard Apple II CD Rom
26550>>>>>>8		ubequad		!0x2e01010454010203
26551# skip PICTUREH.SML found on Golden Orchard Apple II CD Rom
26552>>>>>>>8	ubequad		!0x5dee74ad1aa56394	raw G3 (Group 3) FAX, byte-padded
26553# version 5.25 labeled the entry above "raw G3 data, byte-padded"
26554!:mime	image/g3fax
26555#!:apple	????TIFF
26556!:ext	g3
26557# unusual image starting with black pixel
26558#0	short		0x1300		raw G3 (Group 3) FAX
265590	short		0x1400
26560# 16 0-bits near beginning like PicturePuzzler found on Golden Orchard Apple CD Rom
26561>2	search/9	\0\0
26562# maximal 7 0-bits for pixel sequences or 11 0-bits for EOL in G3
26563>2	default		x		raw G3 (Group 3) FAX
26564# version 5.25 labeled the above entry as "raw G3 data"
26565!:mime	image/g3fax
26566!:ext	g3
26567# unusual image with black pixel near beginning
26568#0	short		0x1900		raw G3 (Group 3) FAX
26569
26570#
26571# Magic data for vgetty voice formats
26572# (Martin Seine & Marc Eberhard)
26573
26574#
26575# raw modem data version 1
26576#
265770    string    RMD1      raw modem data
26578>4   string    >\0       (%s /
26579>20  short     >0        compression type %#04x)
26580
26581#
26582# portable voice format 1
26583#
265840    string    PVF1\n         portable voice format
26585>5   string    >\0       (binary %s)
26586
26587#
26588# portable voice format 2
26589#
265900    string    PVF2\n         portable voice format
26591>5   string >\0          (ascii %s)
26592
26593# From: Bernd Nuernberger <bernd.nuernberger@web.de>
26594# Brooktrout G3 fax data incl. 128 byte header
26595# Common suffixes: 3??, BRK, BRT, BTR
265960	leshort		0x01bb
26597>2	leshort		0x0100		Brooktrout 301 fax image,
26598>>9	leshort		x		%d x
26599>>0x2d	leshort		x		%d
26600>>6	leshort		200		\b, fine resolution
26601>>6	leshort		100		\b, normal resolution
26602>>11	byte		1		\b, G3 compression
26603>>11	byte		2		\b, G32D compression
26604
26605#------------------------------------------------------------------------------
26606# $File: modulefile,v 1.1 2019/10/15 18:04:40 christos Exp $
26607# modulefile:  file(1) magic for user's environment modulefile
26608# URL: http://modules.sourceforge.net/
26609# Reference: https://modules.readthedocs.io/en/stable/modulefile.html
26610# From: Xavier Delaruelle <xavier.delaruelle@cea.fr>
266110	string	#%Module	modulefile
26612!:mime	text/x-modulefile
26613
26614#------------------------------------------------------------------------------
26615# $File: motorola,v 1.12 2021/04/26 15:56:00 christos Exp $
26616# motorola:  file(1) magic for Motorola 68K and 88K binaries
26617#
26618# 68K
26619#
266200	beshort		0520		mc68k COFF
26621>18	beshort		^00000020	object
26622>18	beshort		&00000020	executable
26623>12	belong		>0		not stripped
26624>168	string		.lowmem		Apple toolbox
26625>20	beshort		0407		(impure)
26626>20	beshort		0410		(pure)
26627>20	beshort		0413		(demand paged)
26628>20	beshort		0421		(standalone)
266290	beshort		0521		mc68k executable (shared)
26630>12	belong		>0		not stripped
266310	beshort		0522		mc68k executable (shared demand paged)
26632>12	belong		>0		not stripped
26633#
26634# Motorola/UniSoft 68K Binary Compatibility Standard (BCS)
26635#
266360	beshort		0554		68K BCS executable
26637#
26638# 88K
26639#
26640# Motorola/88Open BCS
26641#
266420	beshort		0555		88K BCS executable
26643#
26644# Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de>
266450   string      S0          Motorola S-Record; binary data in text format
26646
26647# ATARI ST relocatable PRG
26648#
26649# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001
26650# (according to Roland Waldi, Oct 21, 1987)
26651# besides the magic 0x601a, the text segment size is checked to be
26652# not larger than 1 MB (which is a lot on ST).
26653# The additional 0x601b distinction I took from Doug Lee's magic.
266540	belong&0xFFFFFFF0	0x601A0000	Atari ST M68K contiguous executable
26655>2	belong			x		(txt=%d,
26656>6	belong			x		dat=%d,
26657>10	belong			x		bss=%d,
26658>14	belong			x		sym=%d)
266590	belong&0xFFFFFFF0	0x601B0000	Atari ST M68K non-contig executable
26660>2	belong			x		(txt=%d,
26661>6	belong			x		dat=%d,
26662>10	belong			x		bss=%d,
26663>14	belong			x		sym=%d)
26664
26665# Atari ST/TT... program format (sent by Wolfram Kleff <kleff@cs.uni-bonn.de>)
266660       beshort         0x601A          Atari 68xxx executable,
26667>2      belong          x               text len %u,
26668>6      belong          x               data len %u,
26669>10     belong          x               BSS len %u,
26670>14     belong          x               symboltab len %u,
26671>18     belong          0
26672>22     belong          &0x01           fastload flag,
26673>22     belong          &0x02           may be loaded to alternate RAM,
26674>22     belong          &0x04           malloc may be from alternate RAM,
26675>22     belong          x               flags: %#X,
26676>26     beshort         0               no relocation tab
26677>26     beshort         !0              + relocation tab
26678>30     string          SFX             [Self-Extracting LZH SFX archive]
26679>38     string          SFX             [Self-Extracting LZH SFX archive]
26680>44     string          ZIP!            [Self-Extracting ZIP SFX archive]
26681
266820       beshort         0x0064          Atari 68xxx CPX file
26683>8      beshort         x               (version %04x)
26684
26685#------------------------------------------------------------------------------
26686# $File: mozilla,v 1.12 2021/04/26 15:56:00 christos Exp $
26687# mozilla:  file(1) magic for Mozilla XUL fastload files
26688# (XUL.mfasl and XPC.mfasl)
26689# URL:	https://www.mozilla.org/
26690# From:	Josh Triplett <josh@freedesktop.org>
26691
266920	string	XPCOM\nMozFASL\r\n\x1A		Mozilla XUL fastload data
26693# Probably the next magic line contains misspelled "mozLz40\0"
266940	string	mozLz4a				Mozilla lz4 compressed bookmark data
26695# From: Joerg Jenderek
26696# URL: https://lz4.github.io/lz4/
26697# Reference: https://github.com/avih/dejsonlz4/archive/master.zip/
26698# dejsonlz4-master\src\dejsonlz4.c
26699# Note: mostly JSON compressed with a non-standard LZ4 header
26700# can be unpacked by dejsonlz4 but not lz4 program.
267010	string	mozLz40\0			Mozilla lz4 compressed data
26702!:mime	application/x-lz4+json
26703# mozlz4 extension seems to be used for search/store, while jsonlz4 for bookmarks
26704!:ext	jsonlz4/mozlz4
26705# decomp_size
26706>8	ulelong	x				\b, originally %u bytes
26707# lz4 data
26708#>12	ubequad	x				\b, lz4 data %#16.16llx
26709
26710# From: Joerg Jenderek
26711# URL: https://en.wikipedia.org/wiki/Firefox_4
26712# Reference: https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT
26713# Note:	Most ZIP utilities are able to extract such archives
26714#	maybe only partly or after some warnings. Example:
26715#	zip -FF omni.ja --out omni.zip
267164	string	PK\001\002	Mozilla archive omni.ja
26717!:mime	application/x-zip
26718!:ext	ja
26719# TODO:
26720#>4	use	zip-dir-entry
26721
26722#------------------------------------------------------------------------------
26723# $File: msdos,v 1.158 2022/09/07 11:17:31 christos Exp $
26724# msdos:  file(1) magic for MS-DOS files
26725#
26726
26727# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
26728# updated by Joerg Jenderek at Oct 2008,Apr 2011
267290	string/t	@
26730>1	string/cW	\ echo\ off	DOS batch file text
26731!:mime	text/x-msdos-batch
26732!:ext	bat
26733>1	string/cW	echo\ off	DOS batch file text
26734!:mime	text/x-msdos-batch
26735!:ext	bat
26736>1	string/cW	rem		DOS batch file text
26737!:mime	text/x-msdos-batch
26738!:ext	bat
26739>1	string/cW	set\ 		DOS batch file text
26740!:mime	text/x-msdos-batch
26741!:ext	bat
26742
26743
26744# OS/2 batch files are REXX. the second regex is a bit generic, oh well
26745# the matched commands seem to be common in REXX and uncommon elsewhere
26746100	search/0xffff   rxfuncadd
26747>100	regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc	OS/2 REXX batch file text
26748100	search/0xffff   say
26749>100	regex/c =^[\ \t]{0,10}say\ ['"]			OS/2 REXX batch file text
26750
26751# updated by Joerg Jenderek at Oct 2015
26752# https://de.wikipedia.org/wiki/Common_Object_File_Format
26753# http://www.delorie.com/djgpp/doc/coff/filhdr.html
26754# ./intel already labeled COFF type 0x14c=0514 as "80386 COFF executable"
26755#0	leshort		0x14c	MS Windows COFF Intel 80386 object file
26756#>4	ledate		x	stamp %s
267570	leshort		0x166	MS Windows COFF MIPS R4000 object file
26758#>4	ledate		x	stamp %s
267590	leshort		0x184	MS Windows COFF Alpha object file
26760#>4	ledate		x	stamp %s
267610	leshort		0x268	MS Windows COFF Motorola 68000 object file
26762#>4	ledate		x	stamp %s
267630	leshort		0x1f0	MS Windows COFF PowerPC object file
26764#>4	ledate		x	stamp %s
267650	leshort		0x290	MS Windows COFF PA-RISC object file
26766#>4	ledate		x	stamp %s
26767
26768# Tests for various EXE types.
26769#
26770# Many of the compressed formats were extracted from IDARC 1.23 source code.
26771#
267720	string/b	MZ
26773# All non-DOS EXE extensions have the relocation table more than 0x40 bytes into the file.
26774>0x18	leshort <0x40 MS-DOS executable
26775!:mime	application/x-dosexec
26776# Windows and later versions of DOS will allow .EXEs to be named with a .COM
26777# extension, mostly for compatibility's sake.
26778# URL:		https://en.wikipedia.org/wiki/Personal_NetWare#VLM
26779# Reference:	https://mark0.net/download/triddefs_xml.7z/defs/e/exe-vlm-msg.trid.xml
26780!:ext	exe/com/vlm
26781# These traditional tests usually work but not always.  When test quality support is
26782# implemented these can be turned on.
26783#>>0x18	leshort	0x1c	(Borland compiler)
26784#>>0x18	leshort	0x1e	(MS compiler)
26785
26786# Maybe it's a PE?
26787>(0x3c.l)	string		PE\0\0	PE
26788!:mime	application/x-dosexec
26789>>(0x3c.l+24)	leshort		0x010b	\b32 executable
26790>>(0x3c.l+24)	leshort		0x020b	\b32+ executable
26791>>(0x3c.l+24)	leshort		0x0107	ROM image
26792>>(0x3c.l+24)	default		x	Unknown PE signature
26793>>>&0 		leshort		x	%#x
26794>>(0x3c.l+22)	leshort&0x2000	>0	(DLL)
26795>>(0x3c.l+92)	leshort		1
26796# Native PEs include ntoskrnl.exe, hal.dll, smss.exe, autochk.exe, and all the
26797# drivers in Windows/System32/drivers/*.sys.
26798>>>(0x3c.l+22)	leshort&0x2000	>0	(native)
26799!:ext	dll/sys
26800>>>(0x3c.l+22)	leshort&0x2000	0	(native)
26801!:ext	exe/sys
26802>>(0x3c.l+92)	leshort		2
26803>>>(0x3c.l+22)	leshort&0x2000	>0	(GUI)
26804# These could probably be at least partially distinguished from one another by
26805# looking for specific exported functions.
26806# CPL: Control Panel item
26807# TLB: Type library
26808# OCX: OLE/ActiveX control
26809# ACM: Audio compression manager codec
26810# AX: DirectShow source filter
26811# IME: Input method editor
26812!:ext	dll/cpl/tlb/ocx/acm/ax/ime
26813>>>(0x3c.l+22)	leshort&0x2000	0	(GUI)
26814# Screen savers typically include code from the scrnsave.lib static library, but
26815# that's not guaranteed.
26816!:ext	exe/scr
26817>>(0x3c.l+92)	leshort		3
26818>>>(0x3c.l+22)	leshort&0x2000	>0	(console)
26819!:ext	dll/cpl/tlb/ocx/acm/ax/ime
26820>>>(0x3c.l+22)	leshort&0x2000	0	(console)
26821!:ext	exe/com
26822# https://docs.microsoft.com/en-us/windows/win32/debug/pe-format
26823>>(0x3c.l+92)	leshort		7	(POSIX)
26824>>(0x3c.l+92)	leshort		9	(Windows CE)
26825>>(0x3c.l+92)	leshort		10	(EFI application)
26826>>(0x3c.l+92)	leshort		11	(EFI boot service driver)
26827>>(0x3c.l+92)	leshort		12	(EFI runtime driver)
26828>>(0x3c.l+92)	leshort		13	(EFI ROM)
26829>>(0x3c.l+92)	leshort		14	(XBOX)
26830>>(0x3c.l+92)	leshort		15	(Windows boot application)
26831>>(0x3c.l+92)	default		x	(Unknown subsystem
26832>>>&0		leshort		x	%#x)
26833>>(0x3c.l+4)	leshort		0x14c	Intel 80386
26834>>(0x3c.l+4)	leshort		0x166	MIPS R4000
26835>>(0x3c.l+4)	leshort		0x168	MIPS R10000
26836>>(0x3c.l+4)	leshort		0x184	Alpha
26837>>(0x3c.l+4)	leshort		0x1a2	Hitachi SH3
26838>>(0x3c.l+4)	leshort		0x1a3	Hitachi SH3 DSP
26839>>(0x3c.l+4)	leshort		0x1a8	Hitachi SH5
26840>>(0x3c.l+4)	leshort		0x169	MIPS WCE v2
26841>>(0x3c.l+4)	leshort		0x1a6	Hitachi SH4
26842>>(0x3c.l+4)	leshort		0x1c0	ARM
26843>>(0x3c.l+4)	leshort		0x1c2	ARM Thumb
26844>>(0x3c.l+4)	leshort		0x1c4	ARMv7 Thumb
26845>>(0x3c.l+4)	leshort		0x1d3	Matsushita AM33
26846>>(0x3c.l+4)	leshort		0x1f0	PowerPC
26847>>(0x3c.l+4)	leshort		0x1f1	PowerPC with FPU
26848>>(0x3c.l+4)	leshort		0x1f2	PowerPC (big-endian)
26849>>(0x3c.l+4)	leshort		0x200	Intel Itanium
26850>>(0x3c.l+4)	leshort		0x266	MIPS16
26851>>(0x3c.l+4)	leshort		0x268	Motorola 68000
26852>>(0x3c.l+4)	leshort		0x290	PA-RISC
26853>>(0x3c.l+4)	leshort		0x366	MIPSIV
26854>>(0x3c.l+4)	leshort		0x466	MIPS16 with FPU
26855>>(0x3c.l+4)	leshort		0xebc	EFI byte code
26856>>(0x3c.l+4)	leshort		0x5032	RISC-V 32-bit
26857>>(0x3c.l+4)	leshort		0x5064	RISC-V 64-bit
26858>>(0x3c.l+4)	leshort		0x5128	RISC-V 128-bit
26859>>(0x3c.l+4)	leshort		0x9041	Mitsubishi M32R
26860>>(0x3c.l+4)	leshort		0x8664	x86-64
26861>>(0x3c.l+4)	leshort		0xaa64	Aarch64
26862>>(0x3c.l+4)	leshort		0xc0ee	MSIL
26863>>(0x3c.l+4)	default		x	Unknown processor type
26864>>>&0		leshort		x	%#x
26865>>(0x3c.l+22)	leshort&0x0200	>0	(stripped to external PDB)
26866>>(0x3c.l+22)	leshort&0x1000	>0	system file
26867>>(0x3c.l+24)	leshort		0x010b
26868>>>(0x3c.l+232) lelong	>0	Mono/.Net assembly
26869>>(0x3c.l+24)	leshort		0x020b
26870>>>(0x3c.l+248) lelong	>0	Mono/.Net assembly
26871
26872# hooray, there's a DOS extender using the PE format, with a valid PE
26873# executable inside (which just prints a message and exits if run in win)
26874>>(8.s*16)		string		32STUB	\b, 32rtm DOS extender
26875>>(8.s*16)		string		!32STUB	\b, for MS Windows
26876>>(0x3c.l+0xf8)		string		UPX0 \b, UPX compressed
26877>>(0x3c.l+0xf8)		search/0x140	PEC2 \b, PECompact2 compressed
26878>>(0x3c.l+0xf8)		search/0x140	UPX2
26879>>>(&0x10.l+(-4))	string		PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
26880>>(0x3c.l+0xf8)		search/0x140	.idata
26881>>>(&0xe.l+(-4))	string		PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
26882>>>(&0xe.l+(-4))	string		ZZ0 \b, ZZip self-extracting archive
26883>>>(&0xe.l+(-4))	string		ZZ1 \b, ZZip self-extracting archive
26884>>(0x3c.l+0xf8)		search/0x140	.rsrc
26885>>>(&0x0f.l+(-4))	string		a\\\4\5 \b, WinHKI self-extracting archive
26886>>>(&0x0f.l+(-4))	string		Rar! \b, RAR self-extracting archive
26887>>>(&0x0f.l+(-4))	search/0x3000	MSCF \b, InstallShield self-extracting archive
26888>>>(&0x0f.l+(-4))	search/32	Nullsoft \b, Nullsoft Installer self-extracting archive
26889>>(0x3c.l+0xf8)		search/0x140	.data
26890>>>(&0x0f.l)		string		WEXTRACT \b, MS CAB-Installer self-extracting archive
26891>>(0x3c.l+0xf8)		search/0x140	.petite\0 \b, Petite compressed
26892>>>(0x3c.l+0xf7)	byte		x
26893>>>>(&0x104.l+(-4))	string		=!sfx! \b, ACE self-extracting archive
26894>>(0x3c.l+0xf8)		search/0x140	.WISE \b, WISE installer self-extracting archive
26895>>(0x3c.l+0xf8)		search/0x140	.dz\0\0\0 \b, Dzip self-extracting archive
26896>>&(0x3c.l+0xf8)	search/0x100	_winzip_ \b, ZIP self-extracting archive (WinZip)
26897>>&(0x3c.l+0xf8)	search/0x100	SharedD \b, Microsoft Installer self-extracting archive
26898>>0x30			string		Inno \b, InnoSetup self-extracting archive
26899
26900# If the relocation table is 0x40 or more bytes into the file, it's definitely
26901# not a DOS EXE.
26902>0x18  leshort >0x3f
26903
26904# Hmm, not a PE but the relocation table is too high for a traditional DOS exe,
26905# must be one of the unusual subformats.
26906>>(0x3c.l) string !PE\0\0 MS-DOS executable
26907!:mime	application/x-dosexec
26908
26909>>(0x3c.l)		string		NE \b, NE
26910!:mime	application/x-dosexec
26911>>>(0x3c.l+0x36)	byte		1 for OS/2 1.x
26912>>>(0x3c.l+0x36)	byte		2 for MS Windows 3.x
26913>>>(0x3c.l+0x36)	byte		3 for MS-DOS
26914>>>(0x3c.l+0x36)	byte		4 for Windows 386
26915>>>(0x3c.l+0x36)	byte		5 for Borland Operating System Services
26916>>>(0x3c.l+0x36)	default		x
26917>>>>(0x3c.l+0x36)	byte		x (unknown OS %x)
26918>>>(0x3c.l+0x36)	byte		0x81 for MS-DOS, Phar Lap DOS extender
26919>>>(0x3c.l+0x0c)	leshort&0x8000	0x8000 (DLL or font)
26920# DRV: Driver
26921# 3GR: Grabber device driver
26922# CPL: Control Panel Item
26923# VBX: Visual Basic Extension
26924# FON: Bitmap font
26925# FOT: Font resource file
26926!:ext	dll/drv/3gr/cpl/vbx/fon/fot
26927>>>(0x3c.l+0x0c)	leshort&0x8000	0 (EXE)
26928!:ext	exe/scr
26929>>>&(&0x24.s-1)		string		ARJSFX \b, ARJ self-extracting archive
26930>>>(0x3c.l+0x70)	search/0x80	WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip)
26931
26932>>(0x3c.l)		string		LX\0\0 \b, LX
26933!:mime	application/x-dosexec
26934>>>(0x3c.l+0x0a)	leshort		<1 (unknown OS)
26935>>>(0x3c.l+0x0a)	leshort		1 for OS/2
26936>>>(0x3c.l+0x0a)	leshort		2 for MS Windows
26937>>>(0x3c.l+0x0a)	leshort		3 for DOS
26938>>>(0x3c.l+0x0a)	leshort		>3 (unknown OS)
26939>>>(0x3c.l+0x10)	lelong&0x28000	=0x8000 (DLL)
26940>>>(0x3c.l+0x10)	lelong&0x20000	>0 (device driver)
26941>>>(0x3c.l+0x10)	lelong&0x300	0x300 (GUI)
26942>>>(0x3c.l+0x10)	lelong&0x28300	<0x300 (console)
26943>>>(0x3c.l+0x08)	leshort		1 i80286
26944>>>(0x3c.l+0x08)	leshort		2 i80386
26945>>>(0x3c.l+0x08)	leshort		3 i80486
26946>>>(8.s*16)		string		emx \b, emx
26947>>>>&1			string		x %s
26948>>>&(&0x54.l-3)		string		arjsfx \b, ARJ self-extracting archive
26949
26950# MS Windows system file, supposedly a collection of LE executables
26951>>(0x3c.l)		string		W3 \b, W3 for MS Windows
26952!:mime	application/x-dosexec
26953
26954>>(0x3c.l)		string		LE\0\0 \b, LE executable
26955!:mime	application/x-dosexec
26956>>>(0x3c.l+0x0a)	leshort		1
26957# some DOS extenders use LE files with OS/2 header
26958>>>>0x240		search/0x100	DOS/4G for MS-DOS, DOS4GW DOS extender
26959>>>>0x240		search/0x200	WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender
26960>>>>0x440		search/0x100	CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender
26961>>>>0x40		search/0x40	PMODE/W for MS-DOS, PMODE/W DOS extender
26962>>>>0x40		search/0x40	STUB/32A for MS-DOS, DOS/32A DOS extender (stub)
26963>>>>0x40		search/0x80	STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub)
26964>>>>0x40		search/0x80	DOS/32A for MS-DOS, DOS/32A DOS extender (embedded)
26965# this is a wild guess; hopefully it is a specific signature
26966>>>>&0x24		lelong		<0x50
26967>>>>>(&0x4c.l)		string		\xfc\xb8WATCOM
26968>>>>>>&0		search/8	3\xdbf\xb9 \b, 32Lite compressed
26969# another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP
26970#>>>>(0x3c.l+0x1c)	lelong		>0x10000 for OS/2
26971# fails with DOS-Extenders.
26972>>>(0x3c.l+0x0a)	leshort		2 for MS Windows
26973>>>(0x3c.l+0x0a)	leshort		3 for DOS
26974>>>(0x3c.l+0x0a)	leshort		4 for MS Windows (VxD)
26975# VXD: VxD for Windows 95/98/Me
26976# 386: VxD for Windows 2.10, 3.0, 3.1x
26977# PDR: Port driver
26978# MPD: Miniport driver (?)
26979!:ext	vxd/386/pdr/mpd
26980>>>(&0x7c.l+0x26)	string		UPX \b, UPX compressed
26981>>>&(&0x54.l-3)		string		UNACE \b, ACE self-extracting archive
26982
26983# looks like ASCII, probably some embedded copyright message.
26984# and definitely not NE/LE/LX/PE
26985>>0x3c		lelong	>0x20000000
26986>>>(4.s*512)	leshort !0x014c \b, MZ for MS-DOS
26987!:mime	application/x-dosexec
26988!:ext	exe/com
26989# header data too small for extended executable
26990>2		long	!0
26991>>0x18		leshort <0x40
26992>>>(4.s*512)	leshort !0x014c
26993
26994>>>>&(2.s-514)	string	!LE
26995>>>>>&-2	string	!BW \b, MZ for MS-DOS
26996!:mime	application/x-dosexec
26997>>>>&(2.s-514)	string	LE \b, LE
26998>>>>>0x240	search/0x100	DOS/4G for MS-DOS, DOS4GW DOS extender
26999# educated guess since indirection is still not capable enough for complex offset
27000# calculations (next embedded executable would be at &(&2*512+&0-2)
27001# I suspect there are only LE executables in these multi-exe files
27002>>>>&(2.s-514)	string	BW
27003>>>>>0x240	search/0x100	DOS/4G	\b, LE for MS-DOS, DOS4GW DOS extender (embedded)
27004>>>>>0x240	search/0x100	!DOS/4G	\b, BW collection for MS-DOS
27005
27006# This sequence skips to the first COFF segment, usually .text
27007>(4.s*512)	leshort		0x014c \b, COFF
27008!:mime	application/x-dosexec
27009>>(8.s*16)	string		go32stub for MS-DOS, DJGPP go32 DOS extender
27010>>(8.s*16)	string		emx
27011>>>&1		string		x for DOS, Win or OS/2, emx %s
27012>>&(&0x42.l-3)	byte		x
27013>>>&0x26	string		UPX \b, UPX compressed
27014# and yet another guess: small .text, and after large .data is unusual, could be 32lite
27015>>&0x2c		search/0xa0	.text
27016>>>&0x0b	lelong		<0x2000
27017>>>>&0		lelong		>0x6000 \b, 32lite compressed
27018
27019>(8.s*16) string $WdX \b, WDos/X DOS extender
27020
27021# By now an executable type should have been printed out.  The executable
27022# may be a self-uncompressing archive, so look for evidence of that and
27023# print it out.
27024#
27025# Some signatures below from Greg Roelofs, newt@uchicago.edu.
27026#
27027>0x35	string	\x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed
27028>0xe7	string	LH/2\ 	Self-Extract \b, %s
27029>0x1c	string	UC2X	\b, UCEXE compressed
27030>0x1c	string	WWP\ 	\b, WWPACK compressed
27031>0x1c	string	RJSX 	\b, ARJ self-extracting archive
27032>0x1c	string	diet 	\b, diet compressed
27033>0x1c	string	LZ09 	\b, LZEXE v0.90 compressed
27034>0x1c	string	LZ91 	\b, LZEXE v0.91 compressed
27035>0x1c	string	tz 	\b, TinyProg compressed
27036>0x1e	string	Copyright\ 1989-1990\ PKWARE\ Inc.	Self-extracting PKZIP archive
27037!:mime	application/zip
27038# Yes, this really is "Copr", not "Corp."
27039>0x1e	string	PKLITE\ Copr.	Self-extracting PKZIP archive
27040!:mime	application/zip
27041# winarj stores a message in the stub instead of the sig in the MZ header
27042>0x20	search/0xe0	aRJsfX \b, ARJ self-extracting archive
27043>0x20	string AIN
27044>>0x23	string 2	\b, AIN 2.x compressed
27045>>0x23	string <2	\b, AIN 1.x compressed
27046>>0x23	string >2	\b, AIN 1.x compressed
27047>0x24	string	LHa's\ SFX \b, LHa self-extracting archive
27048!:mime	application/x-lha
27049>0x24	string	LHA's\ SFX \b, LHa self-extracting archive
27050!:mime	application/x-lha
27051>0x24	string	\ $ARX \b, ARX self-extracting archive
27052>0x24	string	\ $LHarc \b, LHarc self-extracting archive
27053>0x20	string	SFX\ by\ LARC \b, LARC self-extracting archive
27054>0x40	string aPKG \b, aPackage self-extracting archive
27055>0x64	string	W\ Collis\0\0 \b, Compack compressed
27056>0x7a	string		Windows\ self-extracting\ ZIP	\b, ZIP self-extracting archive
27057>>&0xf4 search/0x140 \x0\x40\x1\x0
27058>>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive
27059>1638	string	-lh5- \b, LHa self-extracting archive v2.13S
27060>0x17888 string Rar! \b, RAR self-extracting archive
27061
27062# Skip to the end of the EXE.  This will usually work fine in the PE case
27063# because the MZ image is hardcoded into the toolchain and almost certainly
27064# won't match any of these signatures.
27065>(4.s*512)	long	x
27066>>&(2.s-517)	byte	x
27067>>>&0	string		PK\3\4 \b, ZIP self-extracting archive
27068>>>&0	string		Rar! \b, RAR self-extracting archive
27069>>>&0	string		=!\x11 \b, AIN 2.x self-extracting archive
27070>>>&0	string		=!\x12 \b, AIN 2.x self-extracting archive
27071>>>&0	string		=!\x17 \b, AIN 1.x self-extracting archive
27072>>>&0	string		=!\x18 \b, AIN 1.x self-extracting archive
27073>>>&7	search/400	**ACE** \b, ACE self-extracting archive
27074>>>&0	search/0x480	UC2SFX\ Header \b, UC2 self-extracting archive
27075
27076# a few unknown ZIP sfxes, no idea if they are needed or if they are
27077# already captured by the generic patterns above
27078>(8.s*16)	search/0x20	PKSFX \b, ZIP self-extracting archive (PKZIP)
27079# TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive
27080#
27081
27082# TELVOX Teleinformatica CODEC self-extractor for OS/2:
27083>49801	string	\x79\xff\x80\xff\x76\xff	\b, CODEC archive v3.21
27084>>49824 leshort		=1			\b, 1 file
27085>>49824 leshort		>1			\b, %u files
27086
27087# Summary:	OS/2 LX Library and device driver (no DOS stub)
27088# From:		Joerg Jenderek
27089# URL:		http://en.wikipedia.org/wiki/EXE
27090# Reference:	http://www.textfiles.com/programming/FORMATS/lxexe.txt
27091#		https://github.com/open-watcom/open-watcom-v2/blob/master/bld/watcom/h/exeflat.h
27092# Note:		by dll-os2-no-dos-stub.trid.xml called "OS/2 Dynamic Link Library (no DOS stub)"
27093# TODO:		unify with DOS stub variant (MZ magic)
270940	string/b	LX
27095>2	ushort		=0
27096>>0	use			lx-executable
27097# no examples found for big endian variant
27098>2	ushort		=0x0101
27099>>0	use			\^lx-executable
271000       name    	lx-executable
27101# similar looking like variant with MS-DOS stub (MZ magic): "MS-DOS executable, LX"
27102#>0x00	uleshort		x	executable,
27103# signature OSF_FLAT_LX_SIGNATURE~0x584C~LX OSF_FLAT_SIGNATURE~0x454C~LE
27104>0x00	uleshort		=0x584c	LX
27105>0x00	uleshort		=0x454C	LE
27106>0x00	uleshort		x	executable
27107#!:mime	application/x-msdownload
27108!:mime	application/x-lx-executable
27109# byte order: 00h~little-endian non-zero=1~big-endian
27110#>0x02	ubyte			=0		(little-endian)
27111>0x02	ubyte			!0		(big-endian)
27112# FOR DEBUGGING!
27113# word order: 00h~little-endian non-zero=1~big-endian
27114#>0x03	ubyte			=0		\b, little-endian word order
27115#>0x03	ubyte			!0		\b, big-endian word order
27116# cpu_type; CPU type like: 1~286 2~386 3~486 4 20h~i860 21h~Intel N11 40h~MIPS R2000,R3000 41h~MIPS R6000 42h~MIPS R4000
27117#>0x08	uleshort		x		\b, CPU %u
27118# os_type; target operating system like: 0~unknown 1~OS/2 2~Windows 3~DOS 4.x 4~Windows 386
27119#>0x0A	leshort			x		\b, OS %u
27120# flags; module type flags
27121#>0x10	ulelong			x		\b, FLAGS %#8.8x
27122# 00000002h				~Reserved for system use
27123#>0x10	ulelong			&0x00000002	\b, 2h reserved
27124# OSF_INIT_INSTANCE=00000004h		~Per-Process Library Initialization; setting this bit for EXE file is invalid
27125#>0x10	ulelong			&0x00000004	\b, per-process library Initialization
27126# OSF_INTERNAL_FIXUPS_DONE=00000010h	~Internal fixups for the module have been applied
27127#>0x10	ulelong			&0x00000010	\b, int. fixup
27128# OSF_EXTERNAL_FIXUPS_DONE=00000020h	~External fixups for the module have been applied
27129#>0x10	ulelong			&0x00000020	\b, ext. fixup
27130# OSF_NOT_PM_COMPATIBLE=00000100h	~Incompatible with PM windowing
27131#>0x10	ulelong&0x00000100	=0x00000100	\b, incompatible with PM windowing
27132# OSF_PM_COMPATIBLE=00000200h		~Compatible with PM windowing
27133#>0x10	ulelong&0x00000200	=0x00000200	\b, compatible with PM windowing
27134# bit 17; device driver
27135#>0x10	ulelong&0x00020000	>0		\b, device driver
27136# Per-process Library Termination; setting this bit for EXE file is invalid
27137#>0x10	ulelong&0x40000000	=0x40000000	\b, per-process library termination
27138>0x0a	leshort			1		for OS/2
27139# no example found
27140>0x0a	leshort			3		for DOS
27141# http://www.ctyme.com/intr/rb-2939.htm#Table1610
27142# library by module type mask 00038000h (bits 15-17);
27143# 0h ~exectable Program module
27144>0x10	ulelong&0x00038000	=0x00000000	(program)
27145#!:ext	exe
27146# OSF_IS_DLL=8000h			~Library module (DLL)
27147>0x10	ulelong&0x00038000	>0x00000000
27148# OSF_PHYS_DEVICE=00020000h		~device driver
27149>>0x10	ulelong&0x00020000	>0		(device driver)
27150!:ext	sys
27151# if not device driver it is library (DLL)
27152>>0x10	ulelong&0x00020000	=0		(library)
27153!:ext	dll
27154# bits 8-10; OSF_PM_APP=300h in flags	~Uses PM windowing API; either it is GUI or console
27155>0x10  	ulelong&0x00000300	=0x00000300	(GUI)
27156>0x10	ulelong&0x00000300	!0x00000300	(console)
27157# CPU type
27158>0x08	uleshort		1		i80286
27159# all inspected examples
27160>0x08	uleshort		2		i80386
27161>0x08	uleshort		3		i80486
27162>0x08	uleshort		4		i80586
27163# 21h 	Intel "N11" or compatible
27164# 40h 	MIPS Mark I ( R2000, R3000) or compatible
27165# 41h 	MIPS Mark II ( R6000 ) or compatible
27166# 42h 	MIPS Mark III ( R4000 ) or compatible
27167
27168# added by Joerg Jenderek of https://www.freedos.org/software/?prog=kc
27169# and https://www.freedos.org/software/?prog=kpdos
27170# for FreeDOS files like KEYBOARD.SYS, KEYBRD2.SYS, KEYBRD3.SYS, *.KBD
271710	string/b	KCF		FreeDOS KEYBoard Layout collection
27172# only version=0x100 found
27173>3	uleshort	x		\b, version %#x
27174# length of string containing author,info and special characters
27175>6	ubyte		>0
27176#>>6	pstring		x		\b, name=%s
27177>>7	string		>\0		\b, author=%-.14s
27178>>7	search/254	\xff		\b, info=
27179#>>>&0	string		x		\b%-s
27180>>>&0	string		x		\b%-.15s
27181# for FreeDOS *.KL files
271820	string/b	KLF		FreeDOS KEYBoard Layout file
27183# only version=0x100 or 0x101 found
27184>3	uleshort	x		\b, version %#x
27185# stringlength
27186>5	ubyte		>0
27187>>8	string		x		\b, name=%-.2s
271880	string	\xffKEYB\ \ \ \0\0\0\0
27189>12	string	\0\0\0\0`\004\360	MS-DOS KEYBoard Layout file
27190
27191# DOS device driver updated by Joerg Jenderek at May 2011,Mar 2017,Aug 2020
27192# URL:		http://fileformats.archiveteam.org/wiki/DOS_device_driver
27193# Reference:	http://www.delorie.com/djgpp/doc/rbinter/it/46/16.html
27194# https://amaus.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009
271950	ulequad&0x07a0ffffffff		0xffffffff
27196# skip OS/2 INI ./os2
27197>4  ubelong   !0x14000000
27198>>0	use				msdos-driver
271990       name    			msdos-driver		DOS executable (
27200#!:mime	application/octet-stream
27201!:mime	application/x-dosdriver
27202# also found FreeDOS print driver SPOOL.DEV and disc compression driver STACLOAD.BIN
27203# and IBM Token-Ring adapter IBMTOK.DOS. Why and when DOS instead SYS is used?
27204# PROTMAN.DOS ELNKPL.DOS
27205!:ext	sys/dev/bin/dos
27206# 1 space char after "UPX compressed" to get phrase like "UPX compressed character device"
27207>40	search/7			UPX!			\bUPX compressed
27208# DOS device driver attributes
27209>4	uleshort&0x8000			0x0000			\bblock device driver
27210# character device
27211>4	uleshort&0x8000			0x8000			\b
27212# 1 space char after "clock" to get phrase like "clock character device driver CLOCK$"
27213>>4	uleshort&0x0008			0x0008			\bclock
27214# fast video output by int 29h
27215# 1 space char after "fast" to get phrase like "fast standard input/output character device driver"
27216>>4	uleshort&0x0010			0x0010			\bfast
27217# standard input/output device
27218# 1 space char after "standard" to get phrase like "standard input/output character device driver"
27219>>4	uleshort&0x0003			>0			\bstandard
27220>>>4	uleshort&0x0001			0x0001			\binput
27221>>>4	uleshort&0x0003			0x0003			\b/
27222# 1 space char after "output" to get phrase like "input/output character device driver"
27223>>>4	uleshort&0x0002			0x0002			\boutput
27224>>4	uleshort&0x8000			0x8000			\bcharacter device driver
27225>0	ubyte				x
27226# upx compressed device driver has garbage instead of real in name field of header
27227>>40	search/7			UPX!
27228>>40	default				x
27229# leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped
27230# 1 space char before device driver name to get phrase like "device driver PROTMAN$"
27231>>>12		ubyte			>0x2E			\b
27232>>>>10		ubyte			>0x20
27233>>>>>10		ubyte			!0x2E
27234>>>>>>10	ubyte			!0x2A			\b%c
27235>>>>11		ubyte			>0x20
27236>>>>>11		ubyte			!0x2E			\b%c
27237>>>>12		ubyte			>0x20
27238>>>>>12		ubyte			!0x39
27239>>>>>>12	ubyte			!0x2E			\b%c
27240>>>13		ubyte			>0x20
27241>>>>13		ubyte			!0x2E			\b%c
27242>>>>14		ubyte			>0x20
27243>>>>>14		ubyte			!0x2E			\b%c
27244>>>>15		ubyte			>0x20
27245>>>>>15		ubyte			!0x2E			\b%c
27246>>>>16		ubyte			>0x20
27247>>>>>16		ubyte			!0x2E
27248>>>>>>16	ubyte			<0xCB			\b%c
27249>>>>17		ubyte			>0x20
27250>>>>>17		ubyte			!0x2E
27251>>>>>>17	ubyte			<0x90			\b%c
27252# some character device drivers like ASPICD.SYS, btcdrom.sys and Cr_atapi.sys contain only spaces or points in name field
27253>>>12		ubyte			<0x2F
27254# they have their real name at offset 22
27255# also block device drivers like DUMBDRV.SYS
27256>>>>22		string			>\056			%-.6s
27257>4	uleshort&0x8000			0x0000
27258# 32 bit sector addressing ( > 32 MB) for block devices
27259>>4	uleshort&0x0002			0x0002			\b,32-bit sector-
27260# support by driver functions 13h, 17h, 18h
27261>4	uleshort&0x0040			0x0040			\b,IOCTL-
27262# open, close, removable media support by driver functions 0Dh, 0Eh, 0Fh
27263>4	uleshort&0x0800			0x0800			\b,close media-
27264# output until busy support by int 10h for character device driver
27265>4	uleshort&0x8000			0x8000
27266>>4	uleshort&0x2000			0x2000			\b,until busy-
27267# direct read/write support by driver functions 03h,0Ch
27268>4	uleshort&0x4000			0x4000			\b,control strings-
27269>4	uleshort&0x8000			0x8000
27270>>4	uleshort&0x6840			>0			\bsupport
27271>4	uleshort&0x8000			0x0000
27272>>4	uleshort&0x4842			>0			\bsupport
27273>0	ubyte				x			\b)
27274>0	ulelong				!0xffffffff		with pointer %#x
27275# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header
272760	ulequad				0x0513c00000000012
27277>0	use				msdos-driver
27278# DOS drivers DC2975.SYS, DUMBDRV.SYS, ECHO.SYS has also none 0xffffffff for pointer field
272790	ulequad				0x32f28000ffff0016
27280>0	use				msdos-driver
272810	ulequad				0x007f00000000ffff
27282>0	use				msdos-driver
27283# https://www.uwe-sieber.de/files/cfg_echo.zip
272840	ulequad				0x001600000000ffff
27285>0	use				msdos-driver
27286# DOS drivers LS120.SYS, MKELS120.SYS use reserved bits of attribute field
272870	ulequad				0x0bf708c2ffffffff
27288>0	use				msdos-driver
272890	ulequad				0x07bd08c2ffffffff
27290>0	use				msdos-driver
27291# 3Com EtherLink 3C501 CID\SERVER\IBMLS\IBM500D1\DLSNETDR.ZIP\ELNK.DOS
272920	ulequad				0x027ac0c0ffffffff
27293>0	use				msdos-driver
27294# IBM Streamer CID\SERVER\IBMLS\IBM500D1\DLSNETDR.ZIP\IBMMPC.DOS
272950	ulequad				0x00228880ffffffff
27296>0	use				msdos-driver
27297
27298# updated by Joerg Jenderek
27299# GRR: line below too general as it catches also
27300# rt.lib DYADISKS.PIC and many more
27301# start with assembler instruction MOV
273020	ubyte		0x8c
27303# skip "AppleWorks word processor data" like ARTICLE.1 ./apple
27304>4	string			!O====
27305# skip some unknown basic binaries like RocketRnger.SHR
27306>>5	string			!MAIN
27307# skip "GPG symmetrically encrypted data" ./gnu
27308# skip "PGP symmetric key encrypted data" ./pgp
27309# openpgpdefs.h: fourth byte < 14 indicate cipher algorithm type
27310>>>4	ubyte			>13
27311>>>>0		use	msdos-com
27312# the remaining files should be DOS *.COM executables
27313# dosshell.COM	8cc0 2ea35f07 e85211 e88a11 b80058 cd
27314# hmload.COM	8cc8 8ec0 bbc02b 89dc 83c30f c1eb04 b4
27315# UNDELETE.COM	8cca 2e8916 6503 b430 cd21 8b 2e0200 8b
27316# BOOTFIX.COM	8cca 2e8916 9603 b430 cd21 8b 2e0200 8b
27317# RAWRITE3.COM	8cca 2e8916 d602 b430 cd21 8b 2e0200 8b
27318# SHARE.COM	8cca 2e8916 d602 b430 cd21 8b 2e0200 8b
27319# validchr.COM	8cca 2e8916 9603 b430 cd21 8b 2e028b1e
27320# devload.COM	8cca 8916ad01 b430 cd21 8b2e0200 892e
27321
273220       name    msdos-com
27323# URL:		http://fileformats.archiveteam.org/wiki/DOS_executable_(.com)
27324>0  byte        x               DOS executable (
27325# DOS execuable with JuMP 16-bit instruction
27326>0	byte			=0xE9
27327# check for probably nil padding til offset 64 of Lotus driver name
27328>>56		quad		=0
27329# check for "long" alpabetical Lotus driver name like:
27330# Diablo "COMPAQ Text Display" "IBM Monochrome Display" "Plantronics ColorPlus"
27331>>>24			regex	=^[A-Z][A-Za-z\040]{5,21}	\bLotus driver) %s
27332!:mime				application/x-dosexec
27333# like: CPQ0TD.DRV IBM0MONO.DRV (Lotus 123 10a) SDIAB4.DRV SPL0CPLS.DRV (Lotus Symphony 2)
27334!:ext				drv
27335# COM with nils like MODE.COM IBMDOS.COM (pcdos 3.31 ru Compaq) RSSTUB.COM (PC-DOS 2000 de) ACCESS.COM (Lotus Symphony 1)
27336>>>24			default	x				\bCOM)
27337!:mime				application/x-dosexec
27338!:ext				com
27339# DOS excutable with JuMP 16-bit and without nil padding
27340>>56		quad		!0
27341# https://wiki.syslinux.org/wiki/index.php?title=Doc/comboot
27342# TODO: HOWTO distinguish COMboot from pure DOS executables?
27343# look for unreliable Syslinux specific api call INTerrupt 22h for 16-bit COMBOOT program
27344>>>1			search/0xc088	\xcd\x22		\bCOM or COMBOOT 16-bit)
27345!:mime				application/x-dosexec
27346# like: sbm.cbt command.com (Windows XP) UNI2ASCI.COM (FreeDOS 1.2)
27347!:ext				com/cbt
27348>>>1			default		x			\bCOM)
27349!:mime				application/x-dosexec
27350!:ext				com
27351# DOS executable without JuMP 16-bit instruction
27352>0	byte			!0xE9
27353# SCREATE.SYS	https://en.wikipedia.org/wiki/Stac_Electronics
27354>>10		string		=?STACVOL			\bSCREATE.SYS)
27355!:mime			application/x-dosexec
27356!:ext			sys
27357# COM executable without JuMP 16-bit instruction and not SCREATE.SYS
27358>>10		string		!?STACVOL			\bCOM)
27359!:mime			application/x-dosexec
27360!:ext			com
27361>6	string		SFX\ of\ LHarc	\b, %s
27362>0x1FE leshort	0xAA55		    \b, boot code
27363>85	string		UPX		        \b, UPX compressed
27364>4	string		\ $ARX		    \b, ARX self-extracting archive
27365>4	string		\ $LHarc	    \b, LHarc self-extracting archive
27366>0x20e string	SFX\ by\ LARC	\b, LARC self-extracting archive
27367# like: E30ODI.COM MADGEODI.COM UNI2ASCI.COM RECOVER.COM (DOS 2) COMMAND.COM (DOS 2)
27368>1	search/0xc088	\xcd\x22	\b, maybe with interrupt 22h
27369>0	ubelong		x		\b, start instruction %#8.8x
27370# show more instructions but not in samples like: rem.com (DJGPP)
27371>4	ubelong		x		%8.8x
27372
27373# JMP 8bit
273740	        byte	0xeb
27375# byte 0xeb conflicts with magic leshort 0xn2eb of "SYMMETRY i386" handled by ./sequent
27376# allow forward jumps only
27377>1          byte    >-1
27378# that offset must be accessible
27379# with hexadecimal values like: 0e 2e 50 8c 8d ba bc bd be e8 fb fc
27380>>(1.b+2)   byte    x
27381# if look like COM executable with x86 boot signature then this
27382# implies FAT volume with x86 real mode code already handled by ./filesystems
27383#
27384# No x86 boot signature implies often DOS executable
27385# check for unrealistic high number of FATs. Then it is an unusual disk image or often a DOS executable
27386# like: FIXBIOS.COM (50 bytes)
27387>>>16		ubyte		>3
27388# https://www.drivedroid.io/
27389# skip MBR disk image drivedroid.img version 12 July 2013 by start message
27390>>>>2		string		!DriveDroid
27391# ftp://old-dos.ru/OSCollect/OS/MS-DOS/Final Releases/
27392# skip unusual floppy image disk1.img of MS-DOS 1.25 (Corona Data Systems OEM)
27393# by check for characteristic message text near the beginning
27394>>>>>15		string		!Non\040System\040disk
27395# "ftp://old-dos.ru/OSCollect/OS/BeOS/BeOS 4.0.rar"
27396# skip BeOS 4 bootfloppy.img done as "Linux kernel x86 boot executable" by ./linux
27397# by check for characteristic message text near the beginning
27398>>>>>>6		string		!read\040error\015
27399# https://github.com/ventoy/Ventoy/releases/download/v1.0.78/ventoy-1.0.78-windows.zip
27400# skip ventoy 1.0.78 boot_hybrid.img
27401>>>>>>>24	string		!\220\220\353I$\022\017
27402# "ftp://old-dos.ru/OSCollect/OS/MS-DOS/Final Releases/PC-DOS 1.0 (5.25).rar"
27403# skip unusual floppy image PCDOS100.IMG of DOS 1.0
27404# by check for characteristic message text near the beginning
27405>>>>>>>>9	string		!7-May-81
27406# "ftp://old-dos.ru/OSCollect/OS/BeOS/BeOS 5.0 Personal (BA).rar"
27407# skip BeOS 5 floppy_1.44.00.ima done as "DOS/MBR boot sector" by ./filesystems
27408# by check for characteristic message near the beginning
27409>>>>>>>>>3	string		!\370sdfS\270
27410# like: FIXBIOS.COM (50 bytes)
27411>>>>>>>>>>0		use		msdos-com
27412# check for unrealistic low number of FATs. Then it is an unusual FAT disk image or often a DOS executable
27413# like: DEVICE.COM INSTALL.COM (GAG 4.10) WORD.COM (Word 1.15)
27414>>>16		ubyte		=0
27415# if low FATs with x86 boot signature it can be unusual disk image like: boot.img (Ventoy 1.0.27) geodspms.img (Syslinux)
27416>>>>0x1FE	leshort		=0xAA55
27417>>>>0x1FE	default		x
27418# https://thestarman.pcministry.com/tool/hxd/dimtut.htm
27419# skip unusual floppy image TK-DOS11.img IBMDOS11.img of IBM DOS 1.10
27420# by check for characteristic bootloader names near end of boot sector
27421>>>>>395	string		!ibmbio\040\040com
27422>>>>>>0			use		msdos-com
27423# 8-bit jump with valid number of FAT implies FAT volume already handled by ./filesystems
27424# like: balder.img
27425>>>16		default		x
27426# skip disk images with boot signature at end of 1st sector
27427# like: TDSK-64b.img
27428>>>>(11.s-2)	uleshort	!0xAA55
27429# skip unusual floppy image without boot signature like 360k-256.img (mtools 4.0.18)
27430# by check for characteristic file system type text for FAT (12 bit or 16 bit)
27431>>>>>54		string		!FAT
27432# "ftp://old-dos.ru/OSCollect/OS/MS-DOS/Final Releases/Microsoft MS-DOS 3.31 (Compaq OEM) (3.5).rar"
27433# skip unusual floppy image Disk4.img without boot signature and file system type text
27434# by check for characteristic OEM-ID text
27435>>>>>>3		string		!COMPAQ\040\040
27436# no such DOS COM executables found
27437>>>>>>>0		use		msdos-com
27438# JMP 16bit
274390           byte    0xe9
27440# 16-bit offset; for DEBUGGING!; can be negative like: USBDRIVE.COM
27441#>1		leshort		x	\b, OFFSET %d
27442# forward jumps
27443>1		leshort	>-1
27444# that offset must be accessible
27445# with hexadecimal values like: 06 1e 0e 2e 60 8c 8d b4 ba be e8 fc
27446>>(1.s+3)   byte    x
27447# check for unrealistic high number of FATs. Then it is not a disk image and it is a DOS executable
27448# like: CALLVER.COM CPUCACHE.COM K437_EUR.COM SHSUCDX.COM UMBFILL.COM (183 bytes)
27449>>>16		ubyte		>3
27450>>>>0			use		msdos-com
27451# check for unrealistic low number of FATs. Then it is not a disk image and it is a DOS executable
27452# like: GAG.COM DRMOUSE.COM NDN.COM CPQ0TD.DRV
27453>>>16		ubyte		=0
27454>>>>0			use		msdos-com
27455# maybe disc image with valid number of FATs or DOS executable
27456# like: IPXODI.COM PERUSE.COM TASKID.COM
27457>>>16		default	x
27458# invalid low media descriptor. Then it is not a disk image and it is a DOS executable
27459>>>>21		ubyte		<0xE5
27460>>>>>0			use		msdos-com
27461# valid media descriptor. Then it is maybe disk image or DOS executable
27462>>>>21		ubyte		>0xE4
27463# invalid sectorsize not a power of 2 from 32-32768. Then it is not a disk image and it must be DOS executable
27464# like: LEARN.COM (Word 1.15)
27465>>>>>11		uleshort&0x001f	!0
27466>>>>>>0			use		msdos-com
27467# negative offset, must not lead into PSP
27468# like: BASICA.COM (PC dos 3.20) FORMAT.COM SMC8100.COM WORD.COM (word4)
27469# HIDSUPT1.COM USBDRIVE.COM USBSUPT1.COM USBUHCI.COM (FreeDOS USBDOS)
27470>1		leshort	<-259
27471# that offset must be accessible
27472# add 10000h to jump at end of 64 KiB segment, add 1 for jump instruction and 2 for 16-bit offset
27473>>(1,s+65539)   byte    x
27474# after jump next instruction for DEBUGGING!
27475#>>>&-1		ubelong	x	\b, NEXT instruction %#8.8x
27476>>>0        use msdos-com
27477
27478# updated by Joerg Jenderek at Oct 2008,2015,2022
27479# following line is too general
274800	ubyte		0xb8
27481# skip 2 linux kernels like memtest.bin with "\xb8\xc0\x07\x8e" in ./linux
27482>0	string		!\xb8\xc0\x07\x8e
27483# modified by Joerg Jenderek
27484# syslinux COM32 or COM32R executable
27485>>1	lelong&0xFFFFFFFe 0x21CD4CFe	COM executable (32-bit COMBOOT
27486# https://www.syslinux.org/wiki/index.php/Comboot_API
27487# Since version 5.00 c32 modules switched from the COM32 object format to ELF
27488!:mime	application/x-c32-comboot-syslinux-exec
27489!:ext c32
27490# https://syslinux.zytor.com/comboot.php
27491# older syslinux version ( <4 )
27492# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode
27493# start with assembler instructions mov eax,21cd4cffh
27494>>>1	lelong		0x21CD4CFf	\b)
27495# syslinux:doc/comboot.txt
27496# A COM32R program must start with the byte sequence B8 FE 4C CD 21 (mov
27497# eax,21cd4cfeh) as a magic number.
27498# syslinux version (4.x)
27499# "COM executable (COM32R)" or "Syslinux COM32 module" by TrID
27500>>>1	lelong		0x21CD4CFe	\b, relocatable)
27501>>1	default	x
27502# look for interrupt instruction like in rem.com (DJGPP) LOADER.COM (DR-DOS 7.x)
27503>>>3	search/118	\xCD
27504# FOR DEBUGGING; possible hexadecimal interupt number like: 10~BANNER.COM 13~bcdw_cl.com 15~poweroff.com (Syslinux)
27505# 1A~BERNDPCI.COM 20~SETENHKB.COM 21~mostly 22~gfxboot.com (Syslinux) 2F~SHUTDOWN.COM (GEMSYS)
27506#>>>>&0	ubyte	x			\b, INTERUPT %#x
27507# few examples with interrupt 0x13 instruction
27508>>>>&0	ubyte	=0x13
27509# FOR DEBUGGING!
27510#>>>>>3	ubequad	x			\b, 2nd INSTRUCTION %#16.16llx
27511# skip Gpt.com Mbr.com (edk2-UDK2018 bootsector) described as "DOS/MBR boot sector" by ./filesystems
27512# by check for assembler instructions: mov  es,ax ; mov  ax,07c0h ; mov ds,ax
27513>>>>>3	ubequad	!0x8ec0b8c0078ed88d
27514# few COM exectables with interrupt 0x13 instruction like: Bootable CD Wizard executables bcdw_cl.com fdemuoff.com
27515# http://bootcd.narod.ru/bcdw150z_en.zip
27516>>>>>>0		use		msdos-com
27517# few examples with interrupt 0x16 instruction like flashimg.img
27518>>>>&0	ubyte	=0x16
27519# skip Syslinux 3.71 flashimg.img done as "DOS/MBR boot sector" by ./filesystems
27520# by check for assembler instructions: cmp ax 0xE4E4 (magic); jnz
27521>>>>>8	ubelong	!0x3DE4E475
27522# no DOS executable with interrupt 0x16 found
27523>>>>>>0		use		msdos-com
27524# most examples with interrupt instruction unequal 0x13 and 0x16
27525>>>>&0	default	x
27526#>>>>>&-1 ubyte	x			\b, INTERUPT %#x
27527# like: LOADER.COM SETENHKB.COM banner.com copybs.com gif2raw.com poweroff.com rem.com
27528>>>>>0		use		msdos-com
27529# few COM executables without interupt instruction like RESTART.COM (DOS 7.10) REBOOT.COM
27530# or some EUC-KR text files or one Ulead Imaginfo thumbnail
27531>>>3	default	x
27532# FOR DEBUGGING; 2nd instruction like 0x50 (RESTART.COM) 0x8e (REBOOT.COM)
27533# or random like: 0x0 (IMAGINFO.PE3 sky_snow) 0xb1 (euckr_.txt)
27534#>>>>3	ubyte	x			\b, 2nd INSTRUCTION %#x
27535# skip 1 Ulead Imaginfo thumbnail (IMAGINFO.PE3 sky_snow)
27536# inside SAMPLES/TEXTURES/SKY_SNOW
27537# from https://archive.org/download/PI3CANON/PI3CANON.iso
27538>>>>3	ubyte	!0x0
27539# skip some EUC-KR text files like: euckr_falsepositive.txt
27540# https://bugs.astron.com/view.php?id=186
27541>>>>>3	ubyte	!0xb1
27542# like: RESTART.COM (DOS 7.10) REBOOT.COM
27543>>>>>>0	use		msdos-com
27544
27545# URL:		https://en.wikipedia.org/wiki/UPX
27546# Reference:	https://github.com/upx/upx/archive/v3.96.zip/upx-3.96/
27547#		src/stub/src/i086-dos16.com.S
27548# Update:	Joerg Jenderek
27549# assembler instructions: cmp sp, offset sp_limit
275500	string/b	\x81\xfc
27551#>2	uleshort	x		\b, sp_limit=%#x
27552# assembler instructions: jump above +2; int 0x20; mov cx, offset bytes_to_copy
27553>4	string	\x77\x02\xcd\x20\xb9
27554#>9	uleshort	x		\b, [bytes_to_copy]=%#x
27555# at different offsets assembler instructions: push di; jump decomp_start_n2b
27556>0x1e	search/3	\x57\xe9
27557#>>&0	uleshort	x		\b, decomp_start_n2b=%#x
27558# src/stub/src/include/header.S; UPX_MAGIC_LE32
27559>>&2	string		UPX!		FREE-DOS executable (COM), UPX
27560!:mime	application/x-dosexec
27561# UPX compressed *.CPI; See ./fonts
27562>>>&21	string		=FONT		compressed DOS code page font
27563!:ext	cpx
27564>>>&21	string		!FONT		compressed
27565!:ext	com
27566# compressed size?
27567#>>>&14	uleshort+152	x		\b, %u bytes
27568# uncompressed len
27569>>>&12	uleshort	x		\b, uncompressed %u bytes
27570252	string Must\ have\ DOS\ version DR-DOS executable (COM)
27571!:mime	application/x-dosexec
27572!:ext	com
27573# GRR search is not working
27574#2	search/28	\xcd\x21	COM executable for MS-DOS
27575#WHICHFAT.cOM
275762	string	\xcd\x21		COM executable for DOS
27577!:mime	application/x-dosexec
27578!:ext	com
27579#DELTREE.cOM DELTREE2.cOM
275804	string	\xcd\x21		COM executable for DOS
27581!:mime	application/x-dosexec
27582!:ext	com
27583#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM
275845	string	\xcd\x21		COM executable for DOS
27585!:mime	application/x-dosexec
27586!:ext	com
27587#DELTMP.COm HASFAT32.cOM
275887	string	\xcd\x21
27589>0	byte	!0xb8			COM executable for DOS
27590!:mime	application/x-dosexec
27591!:ext	com
27592#COMP.cOM MORE.COm
2759310	string	\xcd\x21
27594>5	string	!\xcd\x21		COM executable for DOS
27595!:mime	application/x-dosexec
27596!:ext	com
27597#comecho.com
2759813	string	\xcd\x21		COM executable for DOS
27599!:mime	application/x-dosexec
27600!:ext	com
27601#HELP.COm EDIT.coM
2760218	string	\xcd\x21
27603# not printable before it?
27604>17	byte	>32
27605>>17	byte	<126
27606>>17	default	x			COM executable for MS-DOS
27607!:mime	application/x-dosexec
27608!:ext	com
27609#NWRPLTRM.COm
2761023	string	\xcd\x21		COM executable for MS-DOS
27611!:mime	application/x-dosexec
27612!:ext	com
27613#LOADFIX.cOm LOADFIX.cOm
2761430	string	\xcd\x21		COM executable for MS-DOS
27615!:mime	application/x-dosexec
27616!:ext	com
27617#syslinux.com 3.11
2761870	string	\xcd\x21		COM executable for DOS
27619!:mime	application/x-dosexec
27620!:ext	com
27621# many compressed/converted COMs start with a copy loop instead of a jump
276220x6	search/0xa	\xfc\x57\xf3\xa5\xc3	COM executable for MS-DOS
27623!:mime	application/x-dosexec
27624!:ext	com
276250x6	search/0xa	\xfc\x57\xf3\xa4\xc3	COM executable for DOS
27626!:mime	application/x-dosexec
27627!:ext	com
27628>0x18	search/0x10	\x50\xa4\xff\xd5\x73	\b, aPack compressed
276290x3c	string		W\ Collis\0\0		COM executable for MS-DOS, Compack compressed
27630!:mime	application/x-dosexec
27631!:ext	com
27632# FIXME: missing diet .com compression
27633
27634# miscellaneous formats
276350	string/b	LZ		MS-DOS executable (built-in)
27636#0	byte		0xf0		MS-DOS program library data
27637#
27638
27639# AAF files:
27640# <stuartc@rd.bbc.co.uk> Stuart Cunningham
276410	string/b	\320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377			AAF legacy file using MS Structured Storage
27642>30	byte	9		(512B sectors)
27643>30	byte	12		(4kB sectors)
276440	string/b	\320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001			AAF file using MS Structured Storage
27645>30	byte	9		(512B sectors)
27646>30	byte	12		(4kB sectors)
27647
27648# Popular applications
27649#
27650# Update:	Joerg Jenderek
27651# URL:		http://fileformats.archiveteam.org/wiki/DOC
27652# Reference:	https://web.archive.org/web/20170206041048/
27653#		http://www.msxnet.org/word2rtf/formats/ffh-dosword5
27654# wIdent+dty
276550	belong	0x31be0000
27656# skip droid skeleton like x-fmt-274-signature-id-488.doc
27657>128	ubyte		>0  			Microsoft
27658>>96	uleshort	=0			Word
27659!:mime	application/msword
27660!:apple	MSWDWDBN
27661# DCX is used in the Unix version.
27662!:ext	doc/dcx
27663>>>0x6E	ulequad		=0			1.0-4.0
27664>>>0x6E	ulequad		!0			5.0-6.0
27665>>>0x6E	ulequad		x			(DOS) Document
27666# https://web.archive.org/web/20130831064118/http://msxnet.org/word2rtf/formats/write.txt
27667>>96	uleshort	!0			Write 3.0 (Windows) Document
27668!:mime	application/x-mswrite
27669!:apple	MSWDWDBN
27670# sometimes also doc like in splitter.doc srchtest.doc
27671!:ext	wri/doc
27672# wTool must be 0125400 octal
27673#>>4	uleshort	!0xAB00			\b, wTool %o
27674# reserved; must be zero
27675#>>6	ulelong		!0			\b, reserved %u
27676# block pointer to the block containing optional file manager information
27677#>>0x1C	uleshort	x			\b, at %#x info block
27678# jump to File manager information block
27679>>(0x1C.s*128)	uleshort x
27680# test for valid information start; maybe also 0012h
27681>>>&-2		uleshort	=0x0014
27682# Document ASCIIZ name
27683>>>>&0x12	string		x		%s
27684# author name
27685>>>>>&1		string		x		\b, author %s
27686# reviser name
27687>>>>>>&1	string		x		\b, reviser %s
27688# keywords
27689>>>>>>>&1	string		x		\b, keywords %s
27690# comment
27691>>>>>>>>&1	string		x		\b, comment %s
27692# version number
27693>>>>>>>>>&1	string		x		\b, version %s
27694# date of last change MM/DD/YY
27695>>>>>>>>>>&1	string		x		\b, %-.8s
27696# creation date MM/DD/YY
27697>>>>>>>>>>&9	string		x		created %-.8s
27698# file name of print format like NORMAL.STY
27699>>0x1E	string		>0			\b, formatted by %-.66s
27700# count of pages in whole file for write variant; maybe some times wrong
27701>>96	uleshort	>0			\b, %u pages
27702# name of the printer driver like HPLASMS
27703>>0x62	string		>0			\b, %-.8s printer
27704# number of blocks used in the file; seems to be 0 for Word 4.0 and Write 3.0
27705>>0x6A	uleshort	>0			\b, %u blocks
27706# bit field for corrected text areas
27707#>>0x6C	uleshort	x			\b, %#x bit field
27708# text of document; some times start with 4 non printable characters like CR LF
27709>>128	ubyte		x			\b,
27710>>>128		ubyte	>0x1F
27711>>>>128		string	x			%s
27712>>>128		ubyte	<0x20
27713>>>>129		ubyte	>0x1F
27714>>>>>129	string	x			%s
27715>>>>129		ubyte	<0x20
27716>>>>>130	ubyte	>0x1F
27717>>>>>>130	string	x			%s
27718>>>>>130	ubyte	<0x20
27719>>>>>>131	ubyte	>0x1F
27720>>>>>>>131	string	x			%s
27721>>>>>>131	ubyte	<0x20
27722>>>>>>>132	ubyte	>0x1F
27723>>>>>>>>132	string	x			%s
27724>>>>>>>132	ubyte	<0x20
27725>>>>>>>>133	ubyte	>0x1F
27726>>>>>>>>>133	string	x			%s
27727#
277280	string/b	PO^Q`				Microsoft Word 6.0 Document
27729!:mime	application/msword
27730#
277314   long        0
27732>0  belong      0xfe320000      Microsoft Word for Macintosh 1.0
27733!:mime	application/msword
27734!:ext   mcw
27735>0  belong      0xfe340000      Microsoft Word for Macintosh 3.0
27736!:mime	application/msword
27737!:ext   mcw
27738>0  belong      0xfe37001c      Microsoft Word for Macintosh 4.0
27739!:mime	application/msword
27740!:ext   mcw
27741>0  belong      0xfe370023      Microsoft Word for Macintosh 5.0
27742!:mime	application/msword
27743!:ext   mcw
27744
277450	string/b	\333\245-\0\0\0			Microsoft Word 2.0 Document
27746!:mime	application/msword
27747!:ext   doc
27748# Note: seems already recognized as "OLE 2 Compound Document" in ./ole2compounddocs
27749#512	string/b	\354\245\301			Microsoft Word Document
27750#!:mime	application/msword
27751
27752#
277530	string/b	\xDB\xA5\x2D\x00		Microsoft WinWord 2.0 Document
27754!:mime application/msword
27755#
277560	string/b	\xDB\xA5\x2D\x00		Microsoft WinWord 2.0 Document
27757!:mime application/msword
27758
27759#
277600	string/b	\x09\x04\x06\x00\x00\x00\x10\x00	Microsoft Excel Worksheet
27761!:mime	application/vnd.ms-excel
27762# https://www.macdisk.com/macsigen.php
27763!:apple	XCELXLS4
27764!:ext	xls
27765#
27766# Update: Joerg Jenderek
27767# URL: https://en.wikipedia.org/wiki/Lotus_1-2-3
27768# Reference: http://www.aboutvb.de/bas/formate/pdf/wk3.pdf
27769# Note: newer Lotus versions >2 use longer BOF record
27770# record type (BeginningOfFile=0000h) + length (001Ah)
277710	belong	0x00001a00
27772# reserved should be 0h but 8c0dh for TUTMAC.WK3, 5h for SAMPADNS.WK3, 1h for a_readme.wk3, 1eh for K&G86.WK3
27773#>18	uleshort&0x73E0	0
27774# Lotus Multi Byte Character Set (LMBCS=1-31)
27775>20	ubyte		>0
27776>>20	ubyte		<32	Lotus 1-2-3
27777#!:mime	application/x-123
27778!:mime	application/vnd.lotus-1-2-3
27779!:apple	????L123
27780# (version 5.26) labeled the entry as "Lotus 1-2-3 wk3 document data"
27781>>>4	uleshort	0x1000	WorKsheet, version 3
27782!:ext	wk3
27783# (version 5.26) labeled the entry as "Lotus 1-2-3 wk4 document data"
27784>>>4	uleshort	0x1002	WorKsheet, version 4
27785# also worksheet template 4 (.wt4)
27786!:ext	wk4/wt4
27787# no example or documentation for wk5
27788#>>4	uleshort	0x????	WorKsheet, version 4
27789#!:ext	wk5
27790# only MacrotoScript.123 example
27791>>>4	uleshort	0x1003	WorKsheet, version 97
27792# also worksheet template Smartmaster (.12M)?
27793!:ext	123
27794# only Set_Y2K.123 example
27795>>>4	uleshort	0x1005	WorKsheet, version 9.8 Millennium
27796!:ext	123
27797# no example for this version
27798>>>4	uleshort	0x8001	FoRMatting data
27799!:ext	frm
27800# (version 5.26) labeled the entry as "Lotus 1-2-3 fm3 or fmb document data"
27801# TrID labeles the entry as "Formatting Data for Lotus 1-2-3 worksheet"
27802>>>4	uleshort	0x8007	ForMatting data, version 3
27803!:ext	fm3
27804>>>4	default		x	unknown
27805# file revision sub code 0004h for worksheets
27806>>>>6	uleshort	=0x0004	worksheet
27807!:ext	wXX
27808>>>>6	uleshort	!0x0004	formatting data
27809!:ext	fXX
27810# main revision number
27811>>>>4	uleshort	x	\b, revision %#x
27812>>>6	uleshort	=0x0004	\b, cell range
27813# active cellcoord range (start row, page,column ; end row, page, column)
27814# start values normally 0~1st sheet A1
27815>>>>8	ulelong		!0
27816>>>>>10	ubyte		>0	\b%d*
27817>>>>>8	uleshort	x	\b%d,
27818>>>>>11	ubyte		x	\b%d-
27819# end page mostly 0
27820>>>>14	ubyte		>0	\b%d*
27821# end raw, column normally not 0
27822>>>>12	uleshort	x	\b%d,
27823>>>>15	ubyte		x	\b%d
27824# Lotus Multi Byte Character Set (1~cp850,2~cp851,...,16~japan,...,31~??)
27825>>>>20	ubyte		>1	\b, character set %#x
27826# flags
27827>>>>21	ubyte		x	\b, flags %#x
27828>>>6	uleshort	!0x0004
27829# record type (FONTNAME=00AEh)
27830>>>>30	search/29	\0\xAE
27831# variable length m (2) + entries (1) + ?? (1) + LCMBS string (n)
27832>>>>>&4	string		>\0	\b, 1st font "%s"
27833#
27834# Update: Joerg Jenderek
27835# URL: http://fileformats.archiveteam.org/wiki/Lotus_1-2-3
27836# Reference: http://www.schnarff.com/file-formats/lotus-1-2-3/WSFF2.TXT
27837# Note: Used by both old Lotus 1-2-3 and Lotus Symphony (DOS) til version 2.x
27838# record type (BeginningOfFile=0000h) + length (0002h)
278390	belong	0x00000200
27840# GRR: line above is too general as it catches also MS Windows CURsor
27841# to display MS Windows cursor (strength=70) before Lotus 1-2-3 (strength=70-1)
27842!:strength -1
27843# skip Windows cursors with image height <256 and keep Lotus with low opcode 0001-0083h
27844>7	ubyte		0
27845# skip Windows cursors with image width 256 and keep Lotus with positive opcode
27846>>6	ubyte		>0	Lotus
27847# !:mime	application/x-123
27848!:mime	application/vnd.lotus-1-2-3
27849!:apple	????L123
27850# revision number (0404h = 123 1A, 0405h = Lotus Symphony , 0406h = 123 2.x wk1 , 8006h = fmt , ...)
27851# undocumented; (version 5.26) labeled the configurations as "Lotus 1-2-3"
27852>>>4	uleshort	0x0007	1-2-3 CoNFiguration, version 2.x (PGRAPH.CNF)
27853!:ext	cnf
27854>>>4	uleshort	0x0C05	1-2-3 CoNFiguration, version 2.4J
27855!:ext	cnf
27856>>>4	uleshort	0x0801	1-2-3 CoNFiguration, version 1-2.1
27857!:ext	cnf
27858>>>4	uleshort	0x0802	Symphony CoNFiguration
27859!:ext	cnf
27860>>>4	uleshort	0x0804	1-2-3 CoNFiguration, version 2.2
27861!:ext	cnf
27862>>>4	uleshort	0x080A	1-2-3 CoNFiguration, version 2.3-2.4
27863!:ext	cnf
27864>>>4	uleshort	0x1402	1-2-3 CoNFiguration, version 3.x
27865!:ext	cnf
27866>>>4	uleshort	0x1450	1-2-3 CoNFiguration, version 4.x
27867!:ext	cnf
27868# (version 5.26) labeled the entry as "Lotus 123"
27869# TrID labeles the entry as "Lotus 123 Worksheet (generic)"
27870>>>4	uleshort	0x0404	1-2-3 WorKSheet, version 1
27871# extension "wks" also for Microsoft Works document
27872!:ext	wks
27873# (version 5.26) labeled the entry as "Lotus 123"
27874# TrID labeles the entry as "Lotus 123 Worksheet (generic)"
27875>>>4	uleshort	0x0405	Symphony WoRksheet, version 1.0
27876!:ext	wrk/wr1
27877# (version 5.26) labeled the entry as "Lotus 1-2-3 wk1 document data"
27878# TrID labeles the entry as "Lotus 123 Worksheet (V2)"
27879>>>4	uleshort	0x0406	1-2-3/Symphony worksheet, version 2
27880# Symphony (.wr1)
27881!:ext	wk1/wr1
27882# no example for this japan version
27883>>>4	uleshort	0x0600	1-2-3 WorKsheet, version 1.xJ
27884!:ext	wj1
27885# no example or documentation for wk2
27886#>>>4	uleshort	0x????	1-2-3 WorKsheet, version 2
27887#!:ext	wk2
27888# undocumented japan version
27889>>>4	uleshort	0x0602	1-2-3 worksheet, version 2.4J
27890!:ext	wj3
27891# (version 5.26) labeled the entry as "Lotus 1-2-3 fmt document data"
27892>>>4	uleshort	0x8006	1-2-3 ForMaTting data, version 2.x
27893# japan version 2.4J (fj3)
27894!:ext	fmt/fj3
27895# no example for this version
27896>>>4	uleshort	0x8007	1-2-3 FoRMatting data, version 2.0
27897!:ext	frm
27898# (version 5.26) labeled the entry as "Lotus 1-2-3"
27899>>>4	default		x	unknown worksheet or configuration
27900!:ext	cnf
27901>>>>4	uleshort	x	\b, revision %#x
27902# 2nd record for most worksheets describes cells range
27903>>>6		use	lotus-cells
27904# 3rd record for most japan worksheets describes cells range
27905>>>(8.s+10)	use	lotus-cells
27906#	check and then display Lotus worksheet cells range
279070	name		lotus-cells
27908# look for type (RANGE=0006h) + length (0008h) at record begin
27909>0	ubelong	0x06000800	\b, cell range
27910# cell range (start column, row, end column, row) start values normally 0,0~A1 cell
27911>>4	ulong		!0
27912>>>4	uleshort	x	\b%d,
27913>>>6	uleshort	x	\b%d-
27914# end of cell range
27915>>8	uleshort	x	\b%d,
27916>>10	uleshort	x	\b%d
27917# EndOfLotus123
279180	string/b		WordPro\0	Lotus WordPro
27919!:mime	application/vnd.lotus-wordpro
279200	string/b		WordPro\r\373	Lotus WordPro
27921!:mime	application/vnd.lotus-wordpro
27922
27923
27924# Summary: Script used by InstallScield to uninstall applications
27925# Extension: .isu
27926# Submitted by: unknown
27927# Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry)
279280		string		\x71\xa8\x00\x00\x01\x02
27929>12		string		Stirling\ Technologies,		InstallShield Uninstall Script
27930
27931# Winamp .avs
27932#0	string	Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player
279330	string/b	Nullsoft\ AVS\ Preset\ 	Winamp plug in
27934
27935# Windows Metafile .WMF
279360	string/b	\327\315\306\232	Windows metafile
27937!:mime	image/wmf
27938!:ext	wmf
279390	string/b	\002\000\011\000	Windows metafile
27940!:mime	image/wmf
27941!:ext	wmf
279420	string/b	\001\000\011\000	Windows metafile
27943!:mime	image/wmf
27944!:ext	wmf
27945
27946#tz3 files whatever that is (MS Works files)
279470	string/b	\003\001\001\004\070\001\000\000	tz3 ms-works file
279480	string/b	\003\002\001\004\070\001\000\000	tz3 ms-works file
279490	string/b	\003\003\001\004\070\001\000\000	tz3 ms-works file
27950
27951# PGP sig files .sig
27952#0 string \211\000\077\003\005\000\063\237\127 065 to  \027\266\151\064\005\045\101\233\021\002 PGP sig
279530 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig
279540 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig
279550 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig
279560 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig
279570 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig
279580 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig
27959
27960# windows zips files .dmf
279610	string/b	MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file
27962
27963# Windows icons
27964# Update: Joerg Jenderek
27965# URL: https://en.wikipedia.org/wiki/CUR_(file_format)
27966# Note: similar to Windows CURsor. container for BMP (only DIB part) or PNG
279670   belong  0x00000100
27968>9  byte    0
27969>>0 byte    x
27970>>0 use     cur-ico-dir
27971>9  ubyte   0xff
27972>>0 byte    x
27973>>0 use     cur-ico-dir
27974#	displays number of icons and information for icon or cursor
279750	name		cur-ico-dir
27976# skip some Lotus 1-2-3 worksheets, CYCLE.PIC and keep Windows cursors with
27977# 1st data offset = dir header size + n * dir entry size = 6 + n * 10h = ?6h
27978>18		ulelong		&0x00000006
27979# skip remaining worksheets, because valid only for DIB image (40) or PNG image (\x89PNG)
27980>>(18.l)	ulelong		x		MS Windows
27981>>>0		ubelong		0x00000100	icon resource
27982# https://www.iana.org/assignments/media-types/image/vnd.microsoft.icon
27983!:mime		image/vnd.microsoft.icon
27984#!:mime		image/x-icon
27985!:ext		ico
27986>>>>4 		uleshort	x		- %d icon
27987# plural s
27988>>>>4 		uleshort	>1		\bs
27989# 1st icon
27990>>>>0x06	use		ico-entry
27991# 2nd icon
27992>>>>4 		uleshort	>1
27993>>>>>0x16	use		ico-entry
27994>>>0		ubelong		0x00000200	cursor resource
27995#!:mime		image/x-cur
27996!:mime		image/x-win-bitmap
27997!:ext		cur
27998>>>>4 		uleshort	x		- %d icon
27999>>>>4 		uleshort	>1		\bs
28000# 1st cursor
28001>>>>0x06	use		cur-entry
28002#>>>>0x16	use		cur-entry
28003#	display information of one cursor entry
280040	name		cur-entry
28005>0	use		cur-ico-entry
28006>4	uleshort	x	\b, hotspot @%dx
28007>6	uleshort	x	\b%d
28008#	display information of one icon entry
280090	name		ico-entry
28010>0			use	cur-ico-entry
28011# normally 0 1 but also found 14
28012>4	uleshort	>1	\b, %d planes
28013# normally 0 1 but also found some 3, 4, some 6, 8, 24, many 32, two 256
28014>6	uleshort	>1	\b, %d bits/pixel
28015#	display shared information of cursor or icon entry
280160		name		cur-ico-entry
28017>0		byte		=0		\b, 256x
28018>0		byte		!0		\b, %dx
28019>1		byte        	=0		\b256
28020>1		byte        	!0		\b%d
28021# number of colors in palette
28022>2		ubyte		!0		\b, %d colors
28023# reserved 0 FFh
28024#>3		ubyte        	x		\b, reserved %x
28025#>8		ulelong		x		\b, image size %d
28026# offset of PNG or DIB image
28027#>12		ulelong		x		\b, offset %#x
28028# PNG header (\x89PNG)
28029>(12.l)		ubelong		=0x89504e47
28030# 1 space char after "with" to get phrase "with PNG image" by magic in ./images
28031>>&-4		indirect	x	\b with
28032# DIB image
28033>(12.l)		ubelong		!0x89504e47
28034#>>&-4		use     	dib-image
28035
28036# Windows non-animated cursors
28037# Update: Joerg Jenderek
28038# URL: https://en.wikipedia.org/wiki/CUR_(file_format)
28039# Note: similar to Windows ICOn. container for BMP ( only DIB part)
28040# GRR: line below is too general as it catches also Lotus 1-2-3 files
280410   belong  0x00000200
28042>9  byte    0
28043>>0 use     cur-ico-dir
28044>9  ubyte   0xff
28045>>0 use     cur-ico-dir
28046
28047# .chr files
280480	string/b	PK\010\010BGI	Borland font
28049>4	string	>\0	%s
28050# then there is a copyright notice
28051
28052
28053# .bgi files
280540	string/b	pk\010\010BGI	Borland device
28055>4	string	>\0	%s
28056# then there is a copyright notice
28057
28058
28059# Windows Recycle Bin record file (named INFO2)
28060# By Abel Cheung (abelcheung AT gmail dot com)
28061# Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes
28062# Since Vista uses another structure, INFO2 structure probably won't change
28063# anymore. Detailed analysis in:
28064# http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf
280650	lelong		0x00000004
28066>12	lelong		0x00000118	Windows Recycle Bin INFO2 file (Win98 or below)
28067
280680	lelong		0x00000005
28069>12	lelong		0x00000320	Windows Recycle Bin INFO2 file (Win2k - WinXP)
28070
28071# From Doug Lee via a FreeBSD pr
280729	string		GERBILDOC	First Choice document
280739	string		GERBILDB	First Choice database
280749	string		GERBILCLIP	First Choice database
280750	string		GERBIL		First Choice device file
280769	string		RABBITGRAPH	RabbitGraph file
280770	string		DCU1		Borland Delphi .DCU file
280780	string		=!<spell>	MKS Spell hash list (old format)
280790	string		=!<spell2>	MKS Spell hash list
28080# Too simple - MPi
28081#0	string		AH		Halo(TM) bitmapped font file
280820	lelong		0x08086b70	TurboC BGI file
280830	lelong		0x08084b50	TurboC Font file
28084
28085# Debian#712046: The magic below identifies "Delphi compiled form data".
28086# An additional source of information is available at:
28087# http://www.woodmann.com/fravia/dafix_t1.htm
280880	string		TPF0
28089>4	pstring		>\0		Delphi compiled form '%s'
28090
28091# tests for DBase files moved, updated and merged to database
28092
280930	string		PMCC		Windows 3.x .GRP file
280941	string		RDC-meg		MegaDots
28095>8	byte		>0x2F		version %c
28096>9	byte		>0x2F		\b.%c file
280970	lelong		0x4C
28098>4	lelong		0x00021401	Windows shortcut file
28099
28100# .PIF files added by Joerg Jenderek from https://smsoft.ru/en/pifdoc.htm
28101# only for windows versions equal or greater 3.0
281020x171	string	MICROSOFT\ PIFEX\0	Windows Program Information File
28103!:mime	application/x-dosexec
28104!:ext	pif
28105#>2	string	 	>\0		\b, Title:%.30s
28106>0x24	string		>\0		\b for %.63s
28107>0x65	string		>\0		\b, directory=%.64s
28108>0xA5	string		>\0		\b, parameters=%.64s
28109#>0x181	leshort	x	\b, offset %x
28110#>0x183	leshort	x	\b, offsetdata %x
28111#>0x185	leshort	x	\b, section length %x
28112>0x187	search/0xB55	WINDOWS\ VMM\ 4.0\0
28113>>&0x5e		ubyte	>0
28114>>>&-1		string	<PIFMGR.DLL		\b, icon=%s
28115#>>>&-1		string	PIFMGR.DLL		\b, icon=%s
28116>>>&-1		string	>PIFMGR.DLL		\b, icon=%s
28117>>&0xF0		ubyte	>0
28118>>>&-1		string	<Terminal		\b, font=%.32s
28119#>>>&-1		string	=Terminal		\b, font=%.32s
28120>>>&-1		string	>Terminal		\b, font=%.32s
28121>>&0x110	ubyte	>0
28122>>>&-1		string	<Lucida\ Console	\b, TrueTypeFont=%.32s
28123#>>>&-1		string	=Lucida\ Console	\b, TrueTypeFont=%.32s
28124>>>&-1		string	>Lucida\ Console	\b, TrueTypeFont=%.32s
28125#>0x187	search/0xB55	WINDOWS\ 286\ 3.0\0	\b, Windows 3.X standard mode-style
28126#>0x187	search/0xB55	WINDOWS\ 386\ 3.0\0	\b, Windows 3.X enhanced mode-style
28127>0x187	search/0xB55	WINDOWS\ NT\ \ 3.1\0	\b, Windows NT-style
28128#>0x187	search/0xB55	WINDOWS\ NT\ \ 4.0\0	\b, Windows NT-style
28129>0x187	search/0xB55	CONFIG\ \ SYS\ 4.0\0	\b +CONFIG.SYS
28130#>>&06		string	x			\b:%s
28131>0x187	search/0xB55	AUTOEXECBAT\ 4.0\0	\b +AUTOEXEC.BAT
28132#>>&06		string	x			\b:%s
28133
28134# DOS EPS Binary File Header
28135# From: Ed Sznyter <ews@Black.Market.NET>
281360	belong		0xC5D0D3C6	DOS EPS Binary File
28137!:mime	image/x-eps
28138>4	long		>0		Postscript starts at byte %d
28139>>8	long		>0		length %d
28140>>>12	long		>0		Metafile starts at byte %d
28141>>>>16	long		>0		length %d
28142>>>20	long		>0		TIFF starts at byte %d
28143>>>>24	long		>0		length %d
28144
28145# Norton Guide (.NG , .HLP) files added by Joerg Jenderek from source NG2HTML.C
28146# of http://www.davep.org/norton-guides/ng2h-105.tgz
28147# https://en.wikipedia.org/wiki/Norton_Guides
281480	string		NG\0\001
28149# only value 0x100 found at offset 2
28150>2	ulelong		0x00000100	Norton Guide
28151!:mime	application/x-norton-guide
28152# often like NORTON.NG but some times like NC.HLP
28153!:ext	ng/hlp
28154# Title[40]
28155>>8	string		>\0		"%-.40s"
28156#>>6	uleshort	x		\b, MenuCount=%u
28157# szCredits[5][66]
28158>>48	string		>\0		\b, %-.66s
28159>>114	string		>\0		%-.66s
28160
28161# URL:		https://en.wikipedia.org/wiki/Norton_Commander
28162# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/m/msg-nc-eng.trid.xml
28163# From:		Joerg Jenderek
28164# Note:		Message file is used by executable with same main name.
28165#		Only tested with version 5.50 (english) and 2.01 (Windows)
281660	string		Abort
28167# \0 or i
28168#>5	ubyte		x		%x
28169# skip ASCII Abort text by looking for error message like in NCVIEW.MSG
28170>6	search/7089	Non-DOS\ disk	Norton Commander module message
28171!:mime	application/x-norton-msg
28172!:ext	msg
28173
28174# URL:		http://www.antonis.de/dos/dos-tuts/mpdostip/html/nwdostip.htm
28175# Reference:	https://mark0.net/download/triddefs_xml.7z/defs/m/msg-netware-dos.trid.xml
28176# From:		Joerg Jenderek
281770	string	DOS\ Client\ Message\ File:	Novell DOS client message
28178#!:mime	application/octet-stream
28179#!:mime	application/x-novell-msg
28180!:ext	msg
28181# look for second letter instead space character
28182>26	ubyte		>0x20
28183# digit 1 or often main or program name like: IPXODI.COM TASKID pnwtrap DOSRqstr
28184>>25		ubyte	!0x20			%c
28185>>>26		ubyte	!0x20			\b%c
28186>>>>27		ubyte	!0x20			\b%c
28187>>>>>28		ubyte	!0x20			\b%c
28188>>>>>>29	ubyte	!0x20			\b%c
28189>>>>>>>30	ubyte	!0x20			\b%c
28190>>>>>>>>31	ubyte	!0x20			\b%c
28191>>>>>>>>>32	ubyte	!0x20			\b%c
28192>>>>>>>>>>33	ubyte	!0x20			\b%c
28193>>>>>>>>>>>34	ubyte	!0x20			\b%c
28194>>>>>>>>>>>>35	ubyte	!0x20			\b%c
28195>>>>>>>>>>>>>36	ubyte	!0x20			\b%c
28196# followed by string like: 0 v.10 V1.20
28197#
28198# followed by ,\040Tran
28199>28	search/14	,\040Tran
28200# probably translated version string like: 0 v1.00
28201>>&0	string	x				\b, tran version %s
28202# followed by Ctrl-J Ctrl-Z
28203>>>&0	ubyte		!0xa			\b, terminated by %#2.2x
28204>>>>&0	ubyte		x			\b%2.2x
28205# Ctrl-Z
28206>0x65	ubyte		!0x1A			\b, at 0x65 %#x
28207# one
28208>0x66	ubyte		!0x01			\b, at 0x66 %#x
28209# URL:		https://en.wikipedia.org/wiki/NetWare
28210# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/d/dat-novell-msg.trid.xml
28211# ftp://ftp.iitb.ac.in/LDP/en/NLM-HOWTO/NLM-HOWTO-single.html
28212# From:		Joerg Jenderek
282130	string	Novell\ Message\ Librarian\ Data\ File	Novell message librarian data
28214#>35	string	Version\ 1.00
28215#>49	string	COPYRIGHT\ (c)\ 1985\ by\ Novell,\ Inc.
28216#>83	string	\ \ All\ Rights\ Reserved
28217#!:mime	application/octet-stream
28218#!:mime	application/x-novell-msg
28219!:ext	msg
28220#!:ext	msg/dat
28221# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS
28222# of https://www.4dos.info/
28223# pointer,HelpID[8]=4DHnnnmm
282240	ulelong	0x48443408		4DOS help file
28225>4	string	x			\b, version %-4.4s
28226
28227# old binary Microsoft (.HLP) files added by Joerg Jenderek from http://file-extension.net/seeker/file_extension_hlp
282280	ulequad	0x3a000000024e4c	MS Advisor help file
28229
28230# HtmlHelp files (.chm)
282310	string/b	ITSF\003\000\000\000\x60\000\000\000	MS Windows HtmlHelp Data
28232!:mime	application/vnd.ms-htmlhelp
28233!:ext	chm
28234
28235# GFA-BASIC (Wolfram Kleff)
282362	string/b	GFA-BASIC3	GFA-BASIC 3 data
28237
28238#------------------------------------------------------------------------------
28239# From Stuart Caie <kyzer@4u.net> (developer of cabextract)
28240# Update: Joerg Jenderek
28241# URL: https://en.wikipedia.org/wiki/Cabinet_(file_format)
28242# Reference: https://msdn.microsoft.com/en-us/library/bb267310.aspx
28243# Note: verified by `7z l *.cab`
28244# Microsoft Cabinet files
282450	string/b	MSCF\0\0\0\0	Microsoft Cabinet archive data
28246#
28247# https://support.microsoft.com/en-us/help/973559/frequently-asked-questions-about-the-microsoft-support-diagnostic-tool
28248# CAB with *.{diagcfg,diagpkg} is used by Microsoft Support Diagnostic Tool MSDT.EXE
28249# because some archive does not have *.diag* as 1st or 2nd archive member like
28250# O15CTRRemove.diagcab or AzureStorageAnalyticsLogs_global.DiagCab
28251# brute looking after header for filenames with diagcfg or diagpkg extension in CFFILE section
28252>0x2c	search/980/c	.diag		\b, Diagnostic
28253!:mime	application/vnd.ms-cab-compressed
28254!:ext	diagcab
28255# http://fileformats.archiveteam.org/wiki/PUZ
28256# Microsoft Publisher version about 2003 has a "Pack and Go" feature that
28257# bundles a Publisher document *PNG.pub with all links into a CAB
28258>0x2c	search/300/c	png.pub\0		\b, Publisher Packed and Go
28259!:mime	application/vnd.ms-cab-compressed
28260!:ext	puz
28261# ppz variant with Microsoft PowerPoint Viewer ppview32.exe to play PowerPoint presentation
28262>0x2c	search/17/c	ppview32.exe\0		\b, PowerPoint Viewer Packed and Go
28263!:mime	application/vnd.ms-powerpoint
28264#!:mime	application/mspowerpoint
28265!:ext	ppz
28266# URL:		https://en.wikipedia.org/wiki/Windows_Desktop_Gadgets
28267# Reference:	https://docs.microsoft.com/en-us/previous-versions/windows/desktop/sidebar/
28268# http://win10gadgets.com/download/273/ All_CPU_Meter1.zip/All_CPU_Meter_V4.7.3.gadget
28269>0x2c	search/968/c	gadget.xml		\b, Windows Desktop Gadget
28270#!:mime	application/vnd.ms-cab-compressed
28271# http://extension.nirsoft.net/gadget
28272!:mime	application/x-windows-gadget
28273!:ext	gadget
28274# http://www.incredimail.com/
28275# IncrediMail CAB contains an initialisation file "content.ini" like in im2.ims
28276>0x2c	search/3369/c	content.ini\0	\b, IncrediMail
28277!:mime	application/x-incredimail
28278# member Flavor.htm implies IncrediMail ecard like in tell_a_friend.imf
28279>>0x2c	search/83/c	Flavor.htm\0	ecard
28280!:ext	imf
28281# member Macromedia Flash data *.swf implies IncrediMail skin like in im2.ims
28282>>0x2c	search/211/c	.swf\0		skin
28283!:ext	ims
28284# member anim.im3 implies IncrediMail animation like in letter_fold.ima
28285>>0x2c	search/92/c	anim.im3\0	animation
28286!:ext	ima
28287# other IncrediMail cab archive
28288>>0x2c	default		x
28289>>>0x2c	search/116/c	thumb		ecard, image, notifier or skin
28290!:ext	imf/imi/imn/ims
28291# http://file-extension.net/seeker/file_extension_ime
28292>>>0x2c	default		x		emoticons or sound
28293!:ext	ime/imw
28294# no Diagnostic, Packed and Go, Windows Desktop Gadget, IncrediMail
28295>0x2c	default		x
28296# look for 1st member name
28297>>(16.l+16)	ubyte	x
28298# https://en.wikipedia.org/wiki/SNP_file_format
28299>>>&-1	string/c 	_accrpt_.snp	\b, Access report snapshot
28300!:mime	application/msaccess
28301!:ext	snp
28302# https://en.wikipedia.org/wiki/Microsoft_InfoPath
28303>>>&-1	string 		manifest.xsf	\b, InfoPath Form Template
28304!:mime	application/vnd.ms-cab-compressed
28305#!:mime	application/vnd.ms-infopath
28306!:ext	xsn
28307# https://www.cabextract.org.uk/wince_cab_format/
28308# extension of DOS 8+3 name with ".000" of 1st archive member name implies Windows CE installer
28309>>>&7	string 		=.000		\b, WinCE install
28310!:mime	application/vnd.ms-cab-compressed
28311!:ext	cab
28312
28313# https://support.microsoft.com/kb/934307/en-US
28314# All inspected MSU contain a file with name WSUSSCAN.cab
28315# that is called "Windows Update meta data" by Microsoft
28316>>>&-1	string/c 	wsusscan.cab	\b, Microsoft Standalone Update
28317!:mime	application/vnd.ms-cab-compressed
28318!:ext	msu
28319>>>&-1	default		x
28320# look at point character of 1st archive member name for file name extension
28321>>>>&-1	search/255 	.
28322# http://www.pptfaq.com/FAQ00164_What_is_a_PPZ_file-.htm
28323# PPZ were created using Pack & Go feature of PowerPoint versions 97 - 2002
28324# packs optional files, a PowerPoint presentation *.ppt with optional PLAYLIST.LST to CAB
28325>>>>>&0	string/c	ppt\0		\b, PowerPoint Packed and Go
28326!:mime	application/vnd.ms-powerpoint
28327#!:mime	application/mspowerpoint
28328!:ext	ppz
28329# https://msdn.microsoft.com/en-us/library/windows/desktop/bb773190(v=vs.85).aspx
28330# first member *.theme implies Windows 7 Theme Pack like in CommunityShowcaseAqua3.themepack
28331# or Windows 8 Desktop Theme Pack like in PanoramicGlaciers.deskthemepack
28332>>>>>&0	string/c	theme		\b, Windows
28333!:mime	application/x-windows-themepack
28334# https://www.drewkeller.com/content/using-theme-both-windows-7-and-windows-8
28335# 1st member Panoramic.theme or Panoramas.theme implies Windows 8-10 Theme Pack
28336# with MTSM=RJSPBS in [MasterThemeSelector] inside *.theme
28337>>>>>>(16.l+16)	string	=Panoram	8
28338!:ext	deskthemepack
28339>>>>>>(16.l+16)	string	!Panoram	7 or 8
28340!:ext	themepack/deskthemepack
28341>>>>>>(16.l+16)	ubyte	x		Theme Pack
28342# URL:		https://en.wikipedia.org/wiki/Microsoft_OneNote#File_format
28343#		http://fileformats.archiveteam.org/wiki/OneNote
28344# Reference:	https://mark0.net/download/triddefs_xml.7z/defs/o/onepkg.trid.xml
28345# 1st member name like: "Class Notes.one" "test-onenote.one" "Open Notebook.onetoc2" "Editor �ffnen.onetoc2"
28346>>>>>&0	string/c	one		\b, OneNote Package
28347!:mime	application/msonenote
28348!:ext	onepkg
28349>>>>>&0	default		x
28350# look for null terminator of 1st member name
28351>>>>>>&0	search/255 	\0
28352# 2nd member name WSUSSCAN.cab like in Microsoft-Windows-MediaFeaturePack-OOB-Package.msu
28353>>>>>>>&16	string/c 	wsusscan.cab	\b, Microsoft Standalone Update
28354!:mime	application/vnd.ms-cab-compressed
28355!:ext	msu
28356>>>>>>>&16	default	x
28357# archive with more then one file need some output in version 5.32 to avoid error message like
28358# Magdir/msdos, 1138: Warning: Current entry does not yet have a description for adding a MIME type
28359# Magdir/msdos, 1139: Warning: Current entry does not yet have a description for adding a EXTENSION type
28360# file: could not find any valid magic files!
28361>>>>>>>>28	uleshort	>1	\b, many
28362!:mime	application/vnd.ms-cab-compressed
28363!:ext	cab
28364# remaining archives with just one file
28365>>>>>>>>28	uleshort	=1
28366# neither extra bytes nor cab chain implies Windows 2000,XP setup files in directory i386
28367>>>>>>>>>30	uleshort	=0x0000	\b, Windows 2000/XP setup
28368# cut of last char of source extension and add underscore to generate extension
28369# TERMCAP._ ... FXSCOUNT.H_ ... L3CODECA.AC_ ... NPDRMV2.ZI_
28370!:mime	application/vnd.ms-cab-compressed
28371!:ext	_/?_/??_
28372# archive need some output like "single" in version 5.32 to avoid error messages
28373>>>>>>>>>30	uleshort	!0x0000	\b, single
28374!:mime	application/vnd.ms-cab-compressed
28375!:ext	cab
28376# TODO: additional extensions like
28377# .xtp	InfoPath Template Part
28378# .lvf	Logitech Video Effects Face Accessory
28379>8	ulelong		x		\b, %u bytes
28380>28	uleshort		1		\b, 1 file
28381>28	uleshort		>1		\b, %u files
28382# Reserved fields, set to zero
28383#>4	belong		!0		\b, reserved1 %x
28384#>12	belong		!0		\b, reserved2 %x
28385# offset of the first CFFILE entry coffFiles: minimal 2Ch
28386>16	ulelong		x		\b, at %#x
28387>(16.l)	use		cab-file
28388# at least also 2nd member
28389>28	uleshort		>1
28390>>(16.l+16)	ubyte	x
28391>>>&0	search/255 	\0
28392# second member info
28393>>>>&0	use		cab-file
28394#>20	belong		!0		\b, reserved %x
28395# Cabinet file format version. Currently, versionMajor = 1 and versionMinor = 3
28396>24	ubeshort	!0x0301		\b version %#x
28397# number of CFFOLDER entries
28398>26	uleshort	>1		\b, %u cffolders
28399# cabinet file option indicators 1~PREVIOUS, 2~NEXT, 4~reserved fields
28400# only found for flags 0 1 2 3 4 not 7
28401>30	uleshort	>0		\b, flags %#x
28402# Cabinet files have a 16-bit cabinet setID field that is designed for application use.
28403# default is zero, however, the -i option of cabarc can be used to set this field
28404>32	uleshort	>0		\b, ID %u
28405# iCabinet is number of this cabinet file in a set, where 0 for the first cabinet
28406#>34	uleshort	x		\b, iCabinet %u
28407# add one for display because humans start numbering by 1 and also fit to name of disk szDisk*
28408>34	uleshort+1	x		\b, number %u
28409>30	uleshort	&0x0004		\b, extra bytes
28410# cbCFHeader optional size of per-cabinet reserved area 14h 1800h
28411>>36	uleshort	>0		%u in head
28412# cbCFFolder is optional size of per-folder reserved area
28413>>38	ubyte		>0		%u in folder
28414# cbCFData is optional size of per-datablock reserved area
28415>>39	ubyte		>0		%u in data block
28416# optional per-cabinet reserved area abReserve[cbCFHeader]
28417>>36	uleshort	>0
28418# 1st CFFOLDER after reserved area in header
28419>>>(36.s+40)	use			cab-folder
28420# no reserved area in header
28421>30	uleshort	^0x0004
28422# no previous and next cab archive
28423>>30	uleshort		=0x0000
28424>>>36	use				cab-folder
28425# only previous cab archive
28426>>30	uleshort		=0x0001	\b, previous
28427>>>36	use				cab-anchor
28428# only next cab archive
28429>>30	uleshort		=0x0002	\b, next
28430>>>36	use				cab-anchor
28431# previous+next cab archive
28432# can not use sub routine cab-anchor to display previous and next cabinet together
28433#>>>36	use				cab-anchor
28434#>>>>&0	use				cab-anchor
28435>>30	uleshort		=0x0003	\b, previous
28436>>>36	string		x		%s
28437# optional name of previous disk szDisk*
28438>>>>&1	string		x		disk %s
28439>>>>>&1	string		x		\b, next %s
28440# optional name of previous disk szDisk*
28441>>>>>>&1	string		x	disk %s
28442>>>>>>>&1	use			cab-folder
28443#	display filename and disk name of previous or next cabinet
284440       name    			cab-anchor
28445# optional name of previous/next cabinet file szCabinet*[255]
28446>&0	string		x		%s
28447# optional name of previous/next disk szDisk*[255]
28448>>&1	string		x		disk %s
28449#	display folder structure CFFOLDER information like compression of cabinet
284500       name    			cab-folder
28451# offset of the CFDATA block in this folder
28452#>0	ulelong		x		\b, coffCabStart %#x
28453# number of CFDATA blocks in folder
28454>4	uleshort	x		\b, %u datablock
28455# plural s
28456>4	uleshort	>1		\bs
28457# compression typeCompress: 0~None 1~MSZIP 0x1503~LZX:21 0x1003~LZX:16 0x0f03~LZX:15
28458>6	uleshort	x		\b, %#x compression
28459# optional per-folder reserved area
28460#>8	ubequad		x		\b, abReserve %#llx
28461#	display member structure CFFILE information like member name of cabinet
284620       name    			cab-file
28463# cbFile is uncompressed size of file in bytes
28464#>0	ulelong		x		\b, cbFile %u
28465# uoffFolderStart is uncompressed offset of file in folder
28466#>4	ulelong		>0		\b, uoffFolderStart %#x
28467# iFolder is index into the CFFOLDER area. 0 indicates first folder in cabinet
28468# define ifoldCONTINUED_FROM_PREV      (0xFFFD)
28469# define ifoldCONTINUED_TO_NEXT        (0xFFFE)
28470# define ifoldCONTINUED_PREV_AND_NEXT  (0xFFFF)
28471>8	uleshort	>0		\b, iFolder %#x
28472# date stamp for file
28473#>10	uleshort	x		\b, date %#x
28474# time stamp for file
28475#>12	uleshort	x		\b, time %#x
28476# attribs is attribute flags for file
28477# define  _A_RDONLY       (0x01)  file is read-only
28478# define  _A_HIDDEN       (0x02)  file is hidden
28479# define  _A_SYSTEM       (0x04)  file is a system file
28480# define  _A_ARCH         (0x20)  file modified since last backup
28481# example http://sebastien.kirche.free.fr/pebuilder_plugins/depends.cab
28482# define  _A_EXEC         (0x40)  run after extraction
28483# define  _A_NAME_IS_UTF  (0x80)  szName[] contains UTF
28484# define  UNKNOWN       (0x0100)  undocumented or accident
28485#>14	uleshort	x		\b, attribs %#x
28486>14	uleshort	>0		+
28487>>14	uleshort	&0x0001		\bR
28488>>14	uleshort	&0x0002		\bH
28489>>14	uleshort	&0x0004		\bS
28490>>14	uleshort	&0x0020		\bA
28491>>14	uleshort	&0x0040		\bX
28492>>14	uleshort	&0x0080		\bUtf
28493# unknown 0x0100 flag found on one XP_CD:\I386\DRIVER.CAB
28494>>14	uleshort	&0x0100		\b?
28495# szName is name of archive member
28496>16	string		x		"%s"
28497# next archive member name if more files
28498#>>&17	string		>\0		\b, NEXT NAME %-.50s
28499
28500# InstallShield Cabinet files
285010	string/b	ISc(		InstallShield Cabinet archive data
28502>5	byte&0xf0	=0x60		version 6,
28503>5	byte&0xf0	!0x60		version 4/5,
28504>(12.l+40)	lelong	x		%u files
28505
28506# Windows CE package files
285070	string/b	MSCE\0\0\0\0	Microsoft WinCE install header
28508>20	lelong		0		\b, architecture-independent
28509>20	lelong		103		\b, Hitachi SH3
28510>20	lelong		104		\b, Hitachi SH4
28511>20	lelong		0xA11		\b, StrongARM
28512>20	lelong		4000		\b, MIPS R4000
28513>20	lelong		10003		\b, Hitachi SH3
28514>20	lelong		10004		\b, Hitachi SH3E
28515>20	lelong		10005		\b, Hitachi SH4
28516>20	lelong		70001		\b, ARM 7TDMI
28517>52	leshort		1		\b, 1 file
28518>52	leshort		>1		\b, %u files
28519>56	leshort		1		\b, 1 registry entry
28520>56	leshort		>1		\b, %u registry entries
28521
28522
28523# Windows Enhanced Metafile (EMF)
28524# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp
28525# for further information.
285260	ulelong 1
28527>40	string	\ EMF		Windows Enhanced Metafile (EMF) image data
28528>>44	ulelong x		version %#x
28529
28530
285310	string/b	\224\246\056		Microsoft Word Document
28532!:mime	application/msword
28533
28534# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
28535# Magic type for Dell's BIOS .hdr files
28536# Dell's .hdr
285370	string/b $RBU
28538>23	string Dell			%s system BIOS
28539>5	byte   2
28540>>48	byte   x			version %d.
28541>>49	byte   x			\b%d.
28542>>50	byte   x			\b%d
28543>5	byte   <2
28544>>48	string x			version %.3s
28545
28546# Type: Microsoft Document Imaging Format (.mdi)
28547# URL:	https://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format
28548# From: Daniele Sempione <scrows@oziosi.org>
28549# Too weak (EP)
28550#0	short	0x5045			Microsoft Document Imaging Format
28551
28552# MS eBook format (.lit)
285530	string/b	ITOLITLS		Microsoft Reader eBook Data
28554>8	lelong	x			\b, version %u
28555!:mime					application/x-ms-reader
28556
28557# Windows CE Binary Image Data Format
28558# From: Dr. Jesus <j@hug.gs>
285590	string/b	B000FF\n	Windows Embedded CE binary image
28560
28561# The second byte of these signatures is a file version; I don't know what,
28562# if anything, produced files with version numbers 0-2.
28563# From: John Elliott <johne@seasip.demon.co.uk>
285640	string	\xfc\x03\x00	Mallard BASIC program data (v1.11)
285650	string	\xfc\x04\x00	Mallard BASIC program data (v1.29+)
285660	string	\xfc\x03\x01	Mallard BASIC protected program data (v1.11)
285670	string	\xfc\x04\x01	Mallard BASIC protected program data (v1.29+)
28568
285690	string	MIOPEN		Mallard BASIC Jetsam data
285700	string	Jetsam0		Mallard BASIC Jetsam index data
28571
28572# DOS backup 2.0 to 3.2
28573# URL:		http://fileformats.archiveteam.org/wiki/BACKUP_(MS-DOS)
28574# Reference:	http://www.ibiblio.org/pub/micro/pc-stuff/freedos/files/dos/restore/brtecdoc.htm
28575# backupid.@@@
28576
28577# plausibility check for date
285780x3	ushort	>1979
28579>0x5	ubyte-1 <31
28580>>0x6	ubyte-1 <12
28581# actually 121 nul bytes
28582>>>0x7	string	\0\0\0\0\0\0\0\0
28583>>>>0x1 ubyte	x	DOS 2.0 backup id file, sequence %d
28584#!:mime	application/octet-stream
28585!:ext @@@
28586>>>>0x0 ubyte	0xff	\b, last disk
28587
28588# backed up file
28589
28590# skip some AppleWorks word like Tomahawk.Awp, WIN98SE-DE.vhd
28591# by looking for trailing nul of maximal file name string
285920x52	ubyte	0
28593# test for flag byte: FFh~complete file, 00h~split file
28594# FFh -127 =	-1 -127 =	-128
28595# 00h -127 =	 0 -127 =	-127
28596>0	byte-127	<-126
28597# plausibility check for file name length
28598>>0x53	ubyte-1	<78
28599# looking for terminating nul of file name string
28600>>>(0x53.b+4)	ubyte	0
28601# looking if last char of string is valid DOS file name
28602>>>>(0x53.b+3)	ubyte	>0x1F
28603# actually 44 nul bytes
28604# but sometimes garbage according to Ralf Quint. So can not be used as test
28605#>0x54	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
28606# first char of full file name is DOS (5Ch) or UNIX (2Fh) path separator
28607# only DOS variant found. UNIX variant according to V32SLASH.TXT in archive PD0315.EXE
28608>>>>>5	ubyte&0x8C	0x0C
28609# ./msdos (version 5.30) labeled the entry as
28610# "DOS 2.0 backed up file %s, split file, sequence %d" or
28611# "DOS 2.0 backed up file %s, complete file"
28612>>>>>>0	ubyte	x	DOS 2.0-3.2 backed up
28613#>>>>>>0	ubyte	0xff	complete
28614>>>>>>0	ubyte	0
28615>>>>>>>1 uleshort	x	sequence %d of
28616# full file name with path but without drive letter and colon stored from 0x05 til 0x52
28617>>>>>>0x5	string	x	file %s
28618#!:mime	application/octet-stream
28619# backup name is original filename
28620#!:ext	doc/exe/rar/zip
28621#!:ext	*
28622# magic/Magdir/msdos, 1169: Warning: EXTENSION type `     *' has bad char '*'
28623# file: line 1169: Bad magic entry '  *'
28624# after header original file content
28625>>>>>>128	indirect x	\b;
28626
28627
28628# DOS backup 3.3 to 5.x
28629
28630# CONTROL.nnn files
286310	string	\x8bBACKUP\x20
28632# actually 128 nul bytes
28633>0xa	string	\0\0\0\0\0\0\0\0
28634>>0x9	ubyte	x	DOS 3.3 backup control file, sequence %d
28635>>0x8a	ubyte	0xff	\b, last disk
28636
28637# NB: The BACKUP.nnn files consist of the files backed up,
28638# concatenated.
28639
28640# From:		Joerg Jenderek
28641# URL:		http://fileformats.archiveteam.org/wiki/MS-DOS_date/time
28642# Reference:	https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-dosdatetimetofiletime
28643# Note:		DOS date+time format is different from formats such as Unix epoch
28644#		bit encoded; uses year values relative to 1980 and 2 second precision
286450	name		dos-date
28646# HHHHHMMMMMMSSSSS bit encoded Hour (0-23) Minute (0-59) SecondPart (*2)
28647#>0	uleshort	x	RAW TIME [%#4.4x]
28648# hour part
28649#>0	uleshort/2048	x	hour [%u]
28650# YYYYYMMMMDDDDD bit encoded YearPart (+1980) Month (1-12) Day (1-31)
28651#>2	uleshort	x	RAW DATE [%#4.4x]
28652# day part
28653>2	uleshort&0x001F	x	%u
28654#>2	uleshort/16	x	MONTH PART [%#x]
28655# GRR: not working
28656#>2	uleshort/16	&0x000F	MONTH [%u]
28657#>2	uleshort&0x01E0	x	MONTH PART [%#4.4x]
28658>2	uleshort&0x01E0	=0x0020	jan
28659>2	uleshort&0x01E0	=0x0040	feb
28660>2	uleshort&0x01E0	=0x0060	mar
28661>2	uleshort&0x01E0	=0x0080	apr
28662>2	uleshort&0x01E0	=0x00A0	may
28663>2	uleshort&0x01E0	=0x00C0	jun
28664>2	uleshort&0x01E0	=0x00E0	jul
28665>2	uleshort&0x01E0	=0x0100	aug
28666>2	uleshort&0x01E0	=0x0120	sep
28667>2	uleshort&0x01E0	=0x0140	oct
28668>2	uleshort&0x01E0	=0x0160	nov
28669>2	uleshort&0x01E0	=0x0180	dec
28670# year part
28671>2	uleshort/512	x	1980+%u
28672#
28673
28674#------------------------------------------------------------------------------
28675# $File: msooxml,v 1.18 2022/08/16 11:16:39 christos Exp $
28676# msooxml:  file(1) magic for Microsoft Office XML
28677# From: Ralf Brown <ralf.brown@gmail.com>
28678
28679# .docx, .pptx, and .xlsx are XML plus other files inside a ZIP
28680#   archive.  The first member file is normally "[Content_Types].xml".
28681#   but some libreoffice generated files put this later. Perhaps skip
28682#   the "[Content_Types].xml" test?
28683# Since MSOOXML doesn't have anything like the uncompressed "mimetype"
28684#   file of ePub or OpenDocument, we'll have to scan for a filename
28685#   which can distinguish between the three types
28686
286870		name		msooxml
28688>0		string		word/		Microsoft Word 2007+
28689!:mime application/vnd.openxmlformats-officedocument.wordprocessingml.document
28690!:ext	docx
28691>0		string		ppt/		Microsoft PowerPoint 2007+
28692!:mime application/vnd.openxmlformats-officedocument.presentationml.presentation
28693!:ext	pptx
28694>0		string		xl/		Microsoft Excel 2007+
28695!:mime application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
28696!:ext	xlsx
28697>0		string		visio/		Microsoft Visio 2013+
28698!:mime application/vnd.ms-visio.drawing.main+xml
28699>0		string		AppManifest.xaml	Microsoft Silverlight Application
28700!:mime application/x-silverlight-app
28701
28702# start by checking for ZIP local file header signature
287030		string		PK\003\004
28704!:strength +10
28705# make sure the first file is correct
28706>0x1E		use		msooxml
28707>0x1E		default		x
28708>>0x1E		regex		\\[Content_Types\\]\\.xml|_rels/\\.rels|docProps|customXml
28709# skip to the second local file header
28710# since some documents include a 520-byte extra field following the file
28711# header, we need to scan for the next header
28712>>>(18.l+49)	search/6000	PK\003\004
28713# now skip to the *third* local file header; again, we need to scan due to a
28714# 520-byte extra field following the file header
28715>>>>&26		search/6000	PK\003\004
28716# and check the subdirectory name to determine which type of OOXML
28717# file we have.  Correct the mimetype with the registered ones:
28718# https://technet.microsoft.com/en-us/library/cc179224.aspx
28719>>>>>&26		use		msooxml
28720>>>>>&26		default		x
28721# OpenOffice/Libreoffice orders ZIP entry differently, so check the 4th file
28722>>>>>>&26	search/6000	PK\003\004
28723>>>>>>>&26	use		msooxml
28724# Some OOXML generators add an extra customXml directory. Check another file.
28725>>>>>>>&26	default		x
28726>>>>>>>>&26	search/6000	PK\003\004
28727>>>>>>>>>&26	use		msooxml
28728>>>>>>>>>&26	default		x		Microsoft OOXML
28729>>>>>>>&26	default		x		Microsoft OOXML
28730>>>>>&26	default		x		Microsoft OOXML
28731
28732#------------------------------------------------------------------------------
28733# $File: msvc,v 1.11 2022/01/17 17:17:30 christos Exp $
28734# msvc:  file(1) magic for msvc
28735# "H. Nanosecond" <aldomel@ix.netcom.com>
28736# Microsoft visual C
28737#
28738# I have version 1.0
28739
28740# .aps
287410	string	HWB\000\377\001\000\000\000	Microsoft Visual C .APS file
28742
28743# .ide
28744#too long 0	string	\102\157\162\154\141\156\144\040\103\053\053\040\120\162\157\152\145\143\164\040\106\151\154\145\012\000\032\000\002\000\262\000\272\276\372\316	MSVC .ide
287450	string	\102\157\162\154\141\156\144\040\103\053\053\040\120\162\157	MSVC .ide
28746
28747# .res
287480	string	\000\000\000\000\040\000\000\000\377	MSVC .res
287490	string	\377\003\000\377\001\000\020\020\350	MSVC .res
287500	string	\377\003\000\377\001\000\060\020\350	MSVC .res
28751
28752#.lib
28753# URL: 		https://en.wikipedia.org/wiki/Microsoft_Visual_C%2B%2B
28754#		http://fileformats.archiveteam.org/wiki/Microsoft_Library
28755#		http://fileformats.archiveteam.org/wiki/OMF
28756# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/l/lib-msvc.trid.xml
28757#		https://pierrelib.pagesperso-orange.fr/exec_formats/OMF_v1.1.pdf
28758# Update:	Joerg Jenderek
28759#0	string	\360\015\000\000	Microsoft Visual C library
28760#0	string	\360\075\000\000	Microsoft Visual C library
28761#0	string	\360\175\000\000	Microsoft Visual C library
28762# test for RecordType~LibraryHeaderRecord=0xF0 + RecordLength=???Dh + dictionary offset is multiple of 0x200
287630	ubelong&0xFF0f80ff	=0xF00d0000
28764# Microsoft Visual C library (strength=70) before MIDI SysEx messages (strength=50) handled by ./sysex
28765#!:strength +0
28766# test for valid 2nd RecordType~Translator Header Record=THEADR=80h or LHEADR=82h
28767>(1.s+3)	ubyte&0xFD	=0x80
28768>>0		use		omf-lib
28769#	display information about Microsoft Visual C/OMF library
287700	name			omf-lib
28771# RecordType~LibraryHeaderRecord=0xF0
28772#>0	byte			0xF0		Microsoft Visual C library
28773# the above description was used in file version 5.41
28774>0	byte			0xF0		Microsoft Visual C/OMF library
28775#>0	byte			0xF0		relocatable Object Module Format (OMF) libray
28776#!:mime	application/octet-stream
28777!:mime	application/x-omf-lib
28778!:ext	lib
28779# 1st record data length like 13=0Dh 29=1Dh 61=3Dh 125=7Dh 509=01FDh ... 32765=7FFDh
28780#>1	uleshort		x		\b, 1st record data length %u
28781#>1	uleshort		x		\b, 1st record data length %#x
28782# 2**4=16 <= RecordLength+3 = PageSize = 2**n {16 32 512 no examples 64 128 256 1024 2048 ...32768} <= 2**15=32768
28783>1	uleshort+3		x		\b, page size %u
28784# dictionary offset like: 400h 600h a00h c00h 1200h 1800h 2400h 5600h 12800h 19200h 28a00h
28785>3		ulelong		x		\b, at %#x dictionary
28786# dictionary block a 512 bytes; the first 37 bytes correspond to the 37 buckets
28787#>(3.l)	ubequad			x		(%#16.16llx...)
28788# dictionary size; length in 512-byte blocks; a prime number? like:
28789# 1 2 3 4 5 6 7 9 11 13 15 16 18 21 22 23 24 25 31 50 53 89 101 117 277
28790>7		uleshort	x		with %u block
28791# plurals s
28792>7		uleshort	>1		\bs
28793# If dictionary byte 38 (FFLAG) has the value 255, there is no space left
28794>(3.l+37)	ubyte		<0xFF		(FFLAG=%#x)
28795>(3.l+37)	ubyte		=0xFF		(FFLAG=full)
28796# dictionary entry; length byte of following symbol, the following text bytes of symbol, two bytes specifies the page number
28797# like: dbfntx1! DBFNTX.LIB zlibCompileFlags_ ZLIB.LIB atoi! mwlibc.lib
28798>(3.l+38)	pstring		x		1st entry %s
28799# like: 1 33 41 47 458 8783
28800>>&0		uleshort	x		in page %u
28801# library flags; 0 or 1, but WHAT IS 0x4d in MOUSE.LIB ?
28802>9	ubyte			>1		\b, flags %#x
28803>9	ubyte			=1		case sensitive
28804# In the library after header comes first object module with a Library Module Header Record (LHEADR=82h)
28805# but in examples Translator Header Record (THEADR=80h) which is handled identically
28806>(1.s+3)	ubyte		x		\b, 2nd record
28807>(1.s+3)	ubyte		!0x80		(type %#x)
28808#>(1.s+4)	uleshort	x		\b, 2nd record data length %u
28809# Module name often source name like "dos\crt0.asm" in mlibce.lib or "QB4UTIL.ASM" in QB4UTIL.LIB
28810# or "C:\Documents and Settings\Allan Campbell\My Documents\FDOSBoot\zlib\zutil.c" in ZLIB.LIB
28811# or title like "87INIT" in FP87.LIB or "ACOSASIN" in MATHC.LIB or "Copyright" in calc-bcc.lib
28812>(1.s+6)	pstring		x		"%s"
28813# 2nd record checksum
28814#>>&0		ubyte		x		checksum %#x
28815# 3rd RecordType: 96h~LNAMES 88h~COMENT
28816>>&1		ubyte		x		\b, 3rd record
28817>>&1		ubyte		!0x88
28818>>>&-1		ubyte		!0x96
28819# 3rd unusual record type
28820>>>>&-1		ubyte		x		(type %#x)
28821# 3rd record is a List of Names Record (LNAMES=96h)
28822>>&1		ubyte		=0x96		LNAMES
28823# LNAMES record length like: 2 15 19
28824#>>>&0			uleshort	x	\b, LNAMES record length %u
28825>>>&0			uleshort	>2
28826# 1st LNAME string length; null is valid; maximal 255
28827#>>>>&0			ubyte		x	1st LNAME length %u
28828>>>>&0			ubyte		=0
28829# 2nd LNAME length like: 4 7 8 17 31
28830#>>>>>&0			ubyte		x	2nd LNAME length %u
28831# name used for segment, class, group, overlay, etc like:
28832# CODE (mwlibc.lib) _TEXT32 (JMPPM32.LIB) _OVLCODE (WOVL.LIB)
28833>>>>>&0			pstring		x	%s
28834# 3rd LNAME length like: 4 5
28835#>>>>>>&0		ubyte		x	3rd LNAME length %u
28836# like: DATA (mwlibc.lib) CODE (JMPPM32.LIB) _TEXT (EMU87.LIB)
28837>>>>>>&0		pstring		x	%s
28838# maybe 4th LNAME length like: 4 6
28839>>>>>>>&0		ubyte		<44
28840# like: DATA (DEBUG.LIB) DGROUP (mwlibc.lib MOUSE.LIB)
28841>>>>>>>>&-1		pstring		x	%s
28842# 3rd record is a COMMENT (Including all comment class extensions)
28843>>&1		ubyte		=0x88		COMMENT
28844# comment record length like: 3 FLIB7M.LIB 1Bh 1Eh 23h 27h 2Bh 30h freetype-bcc.lib
28845#>>>&0		uleshort	x		\b, record length %#x
28846# real comment length = record length - 1 (comment type) - 1 (comment Class) - 1 (checksum) -1 (char count)
28847# like: 2 LIBFL.LIB 4 "UUID" 5 "dscap" 6 "int386" 7 "qb4util" 8 "AMSGEXIT" 16 REXX.LIB 20 27 35 44 freetype-bcc.lib
28848#>>>>&-2		uleshort-4	>0		\b, comment length %u
28849# check that record contain at least comment type (1 byte), comment class (1 byte), checksum (1 byte)
28850# probably always true
28851>>>&0		uleshort	>2
28852# comment type: 80h~NP~no purge bit 40h~NL~no list bit
28853#>>>>&0		ubyte		!0		Type %#x
28854>>>>&0		ubyte		&0x80		Preserved
28855# no example
28856>>>>&0		ubyte		&0x40		NoList
28857# comment class like: 0~Translator A0~OMF extensions A3~LIBMOD A1~New OMF extensions AA~UNKNOWN
28858>>>>&1		ubyte		x		class=%#x
28859# check that comment record contains at least real content
28860>>>>&-2		uleshort	>3
28861# Translator comment record (0); it may name the source language or translator
28862>>>>>&1		ubyte		=0		Translator
28863#>>>>>>&0		ubyte	x		Translator length %u
28864# like: "TC86 Borland Turbo C 2.01 " (GEMS.LIB) "TC86 Borland Turbo C++ 3.00" (CATDB.LIB)
28865>>>>>>&0		pstring	x		"%s"
28866# OMF extensions comment record (A0); first byte of commentary string identifies subtype
28867>>>>>&1		ubyte		=0xA0		OMF extensions
28868# A0 subtype like: 1~IMPDEF
28869>>>>>>&0		ubyte	!1		subtype %#x
28870# Import Definition Record (Comment Class A0, Subtype 01~IMPDEF)
28871>>>>>>&0		ubyte	1		IMPDEF
28872# ordinal flag; determines form of Entry Ident field. If nonzero (seems to be 1) Entry is ordinal
28873>>>>>>>&0		ubyte	!0		ordinal
28874# like: IMPORT.LIB DOSCALLS.LIB mlibw.lib mwinlibc.lib REXX.LIB
28875>>>>>>>>&-1		ubyte	>1		%u
28876# Internal Name in count, char string format; module name for the imported symbol
28877# like: 7 "REXXSAA" 9 11 13 14 15 16 20 21 26 "_Z10_clip_linePdS_S_S_dddd"
28878#>>>>>>>&1		ubyte	x		internal name length %u
28879# internal module name like: _DllGetVersion DllGetVersion BezierTerminationTest Copyright
28880>>>>>>>&1		pstring	x		%s
28881# module name in count, char string format; DLL name that supplies a matching export symbol
28882# like: jpeg62.dll (jpeg-bcc.lib) unrar3.dll (unrar-bcc.lib) REXX (REXX.LIB)
28883>>>>>>>>&0		pstring	x		exported by %s
28884# Entry Ident; 16-bit if ordinal flag != 0 or imported name in count, char string format if ordinal flag = 0
28885# like: \0 (calc-bcc.lib) DllGetVersion (libtiff-bcc.lib) UTF8ToHtml (libxml2-bcc.lib) xslAddCall (libxslt-bcc.lib)
28886#>>>>>>>>>&0		pstring	>\0		entry ident %s
28887# "New OMF" extensions comment (A1); indicate version of symbolic debug information
28888# like: LIBFL.LIB
28889>>>>>&1		ubyte		=0xA1		New OMF extensions
28890# symbolic debug information version n
28891>>>>>>&0		ubyte	x		n=%u
28892# symbolic debug information style like: HL~IBM PM Debugger style (LIBFL.LIB) DX~AIX style CV~Microsoft symbol and type style
28893>>>>>>>&0		string	HL		IBM style
28894>>>>>>>&0		string	DX		AIX style
28895>>>>>>>&0		string	CV		Microsoft style
28896# LIBMOD comment record (A3) used only by the librarian
28897# Microsoft extension added for LIB version 3.07 in macro assembler (MASM 5.0)
28898>>>>>&1		ubyte		=0xA3		LIBMOD
28899# The A3 LIBMOD record contains only the ASCII string of the module name in count char format
28900#>>>>>>&0		ubyte	x		LIBMOD length %u
28901# LIBMOD comment record module name without path and extension like:
28902# qb4util (QB4UTIL.LIB) affaldiv (libh.lib) crt0 (slibc.lib) clipper (DDDRAWS.LIB) dinpdev (DINPUTS.LIB) UUID (UUID.LIB)
28903>>>>>>&0		pstring	x		%s
28904# GRR: WHAT iS THAT? AA foo comment record
28905#>>>>>&1		ubyte		=0xAA		AA-comment
28906# like: OS220
28907#>>>>>>&0		string	x		what=%-5.5s
28908#
28909
28910#.pch
289110	string	DTJPCH0\000\022\103\006\200	Microsoft Visual C .pch
28912
28913# Summary: Symbol Table / Debug info used by Microsoft compilers
28914# URL: https://en.wikipedia.org/wiki/Program_database
28915# Reference: https://code.google.com/p/pdbparser/wiki/MSF_Format
28916# Update: Joerg Jenderek
28917# Note:	test only for Windows XP+SP3 x86 , 8.1 x64 arm and 10.1 x86
28918#	info does only applies partly for older files like msvbvm50.pdb about year 2001
289190	string	Microsoft\ C/C++\040
28920# "Microsoft Program DataBase" by TrID
28921>24	search/14	\r\n\x1A	MSVC program database
28922!:mime	application/x-ms-pdb
28923!:ext	pdb
28924# "MSF 7.00" "program database 2.00" for msvbvm50.pdb
28925>>16	regex	\([0-9.]+\)	ver %s
28926#>>>0x38	search/128123456	/LinkInfo	\b with linkinfo
28927# "MSF 7.00" variant
28928>>0x1e	leshort	0
28929# PageSize 400h 1000h
28930>>>0x20	lelong	x	\b, %d
28931# Page Count
28932>>>0x28	lelong	x	\b*%d bytes
28933# "program database 2.00"  variant
28934>>0x1e	leshort	!0
28935# PageSize 400h
28936>>>0x2c	lelong	x	\b, %d
28937# Page Count for msoo-dll.pdb 4379h
28938>>>0x32	leshort	x	\b*%d bytes
28939
28940# Reference: https://github.com/Microsoft/vstest/pull/856/commits/fdc7a9f074ca5a8dfeec83b1be9162bf0cf4000d
289410       string/c bsjb\001\000\001\000\000\000\000\000\f\000\000\000pdb\ v1.0     Microsoft Roslyn C# debugging symbols version 1.0
28942
28943#.sbr
289440	string	\000\002\000\007\000	MSVC .sbr
28945>5	string 	>\0	%s
28946
28947#.bsc
289480	string	\002\000\002\001	MSVC .bsc
28949
28950#.wsp
289510	string	1.00\ .0000.0000\000\003	MSVC .wsp version 1.0000.0000
28952# these seem to start with the version and contain menus
28953
28954#------------------------------------------------------------------------------
28955# msx:  file(1) magic for the MSX Home Computer
28956# v1.3
28957# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
28958
28959############## MSX Music file formats ##############
28960
28961# Gigamix MGSDRV music file
289620	string/b		MGS	MSX Gigamix MGSDRV3 music file,
28963>6	ubeshort	0x0D0A
28964>>3	byte		x	\bv%c
28965>>4	byte		x	\b.%c
28966>>5	byte		x	\b%c
28967>>8	string		>\0	\b, title: %s
28968
289691	string/b		mgs2\ 	MSX Gigamix MGSDRV2 music file
28970>6	uleshort	0x80
28971>>0x2E	uleshort	0
28972>>>0x30	string		>\0	\b, title: %s
28973
28974# KSS music file
289750	string/b		KSCC	KSS music file v1.03
28976>0xE	byte		0
28977>>0xF	byte&0x02	0	\b, soundchips: AY-3-8910, SCC(+)
28978>>0xF	byte&0x02	2	\b, soundchip(s): SN76489
28979>>>0xF	byte&0x04	4	stereo
28980>>0xF	byte&0x01	1	\b, YM2413
28981>>0xF	byte&0x08	8	\b, Y8950
28982
289830	string/b		KSSX	KSS music file v1.20
28984>0xE	byte&0xEF	0
28985>>0xF	byte&0x40	0x00	\b, 60Hz
28986>>0xF	byte&0x40	0x40	\b, 50Hz
28987>>0xF	byte&0x02	0	\b, soundchips: AY-3-8910, SCC(+)
28988>>0xF	byte&0x02	0x02	\b, soundchips: SN76489
28989>>>0xF	byte&0x04	0x04	stereo
28990>>0xF	byte&0x01	0x01	\b,
28991>>>0xF	byte&0x18	0x00	\bYM2413
28992>>>0xF	byte&0x18	0x08	\bYM2413, Y8950
28993>>>0xF	byte&0x18	0x18	\bYM2413+Y8950 pseudostereo
28994>>0xF	byte&0x18	0x10	\b, Majyutsushi DAC
28995
28996# Moonblaster for Moonsound
289970	string/b		MBMS
28998>4	byte		0x10	MSX Moonblaster for MoonSound music
28999
29000# Music Player K-kaz
290010	string/b		MPK	MSX Music Player K-kaz song
29002>6	ubeshort	0x0D0A
29003>>3	byte		x	v%c
29004>>4	byte		x	\b.%c
29005>>5	byte		x	\b%c
29006
29007# I don't know why these don't work
29008#0	search/0xFFFF	\r\n.FM9
29009#>0	search/0xFFFF	\r\n#FORMAT	MSX Music Player K-kaz source MML file
29010#0	search/0xFFFF	\r\nFM1\ \=
29011#>0	search/0xFFFF	\r\nPSG1\=
29012#>>0	search/0xFFFF	\r\nSCC1\=		MSX MuSiCa MML source file
29013
29014# OPX Music file
290150x35	beshort		0x0d0a
29016>0x7B	beshort		0x0d0a
29017>>0x7D	byte		0x1a
29018>>>0x87	uleshort	0		MSX OPX Music file
29019>>>>0x86	byte		0		v1.5
29020>>>>>0	string		>\32		\b, title: %s
29021>>>>0x86	byte		1		v2.4
29022>>>>>0	string		>\32		\b, title: %s
29023
29024# SCMD music file
290250x8B	string/b		SCMD
29026>0xCE	uleshort	0	MSX SCMD Music file
29027#>>-2	uleshort	0x6a71	; The file must end with this value. How to code this here?
29028>>0x8F	string		>\0		\b, title: %s
29029
290300	search/0xFFFF	\r\n@title
29031>&0	search/0xFFFF	\r\n@m=[	MSX SCMD source MML file
29032
29033
29034############## MSX image file formats ##############
29035
29036# MSX raw VRAM dump
290370	ubyte		0xFE
29038>1	uleshort	0
29039>>5	uleshort	0
29040>>>3	uleshort	0x37FF		MSX SC2/GRP raw image
29041>>>3	uleshort	0x6A00		MSX Graph Saurus SR5 raw image
29042>>>3	uleshort	>0x769E
29043>>>>3	uleshort	<0x8000		MSX GE5/GE6 raw image
29044>>>>>3	uleshort	0x7FFF		\b, with sprite patterns
29045>>>3	uleshort	0xD3FF		MSX screen 7-12 raw image
29046>>>3	uleshort	0xD400		MSX Graph Saurus SR7/SR8/SRS raw image
29047
29048# Graph Saurus compressed images
290490	ubyte		0xFD
29050>1	uleshort	0
29051>>5	uleshort	0
29052>>>3	uleshort	>0x013D		MSX Graph Saurus compressed image
29053
29054# MSX G9B image file
290550	string/b		G9B
29056>1	uleshort	11
29057>>3	uleshort	>10
29058>>>5	ubyte		>0		MSX G9B image, depth=%d
29059>>>>8	uleshort	x		\b, %dx
29060>>>>10	uleshort	x		\b%d
29061>>>>5	ubyte		<9
29062>>>>>6	ubyte		0
29063>>>>>>7	ubyte		x		\b, codec=%d RGB color palettes
29064>>>>>6	ubyte		64		\b, codec=RGB fixed color
29065>>>>>6	ubyte		128		\b, codec=YJK
29066>>>>>6	ubyte		192		\b, codec=YUV
29067>>>>5	ubyte		>8		codec=RGB fixed color
29068>>>>12	ubyte		0		\b, raw
29069>>>>12	ubyte		1		\b, bitbuster compression
29070
29071############## Other MSX file formats ##############
29072
29073# MSX internal ROMs
290740		ubeshort	0xF3C3
29075>2		uleshort	<0x4000
29076>>8		ubyte		0xC3
29077>>>9		uleshort	<0x4000
29078>>>>0x0B	ubeshort	0x00C3
29079>>>>>0x0D	uleshort	<0x4000
29080>>>>>>0x0F	ubeshort	0x00C3
29081>>>>>>>0x11	uleshort	<0x4000
29082>>>>>>>>0x13	ubeshort	0x00C3
29083>>>>>>>>>0x15	uleshort	<0x4000
29084>>>>>>>>>>0x50	ubyte		0xC3
29085>>>>>>>>>>>0x51	uleshort	<0x4000
29086>>>>>>>>>>>>(9.s)	ubyte	0xC3
29087>>>>>>>>>>>>>&0	uleshort	>0x4000
29088>>>>>>>>>>>>>>&0	ubyte	0xC3		MSX BIOS+BASIC
29089>>>>>>>>>>>>>>>0x002D	ubyte+1	<3		\b. version=MSX%d
29090>>>>>>>>>>>>>>>0x002D	ubyte	2		\b, version=MSX2+
29091>>>>>>>>>>>>>>>0x002D	ubyte	3		\b, version=MSX Turbo-R
29092>>>>>>>>>>>>>>>0x002D	ubyte	>3		\b, version=Unknown MSX %d version
29093>>>>>>>>>>>>>>>0x0006	ubyte	x		\b, VDP.DR=%#2x
29094>>>>>>>>>>>>>>>0x0007	ubyte	x		\b, VDP.DW=%#2x
29095>>>>>>>>>>>>>>>0x002B	ubyte&0xF	0		\b, charset=Japanese
29096>>>>>>>>>>>>>>>0x002B	ubyte&0xF	1		\b, charset=International
29097>>>>>>>>>>>>>>>0x002B	ubyte&0xF	2		\b, charset=Korean
29098>>>>>>>>>>>>>>>0x002B	ubyte&0xF	>2		\b, charset=Unknown id:%d
29099>>>>>>>>>>>>>>>0x002B	ubyte&0x70	0x00		\b, date format=Y-M-D
29100>>>>>>>>>>>>>>>0x002B	ubyte&0x70	0x10		\b, date format=M-D-Y
29101>>>>>>>>>>>>>>>0x002B	ubyte&0x70	0x20		\b, date format=D-M-Y
29102>>>>>>>>>>>>>>>0x002B	ubyte&0x80	0x00		\b, vfreq=60Hz
29103>>>>>>>>>>>>>>>0x002B	ubyte&0x80	0x80		\b, vfreq=50Hz
29104>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	0		\b, keyboard=Japanese
29105>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	1		\b, keyboard=International
29106>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	2		\b, keyboard=French
29107>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	3		\b, keyboard=UK
29108>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	4		\b, keyboard=German
29109>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	5		\b, keyboard=Unknown id:%d
29110>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	6		\b, keyboard=Spanish
29111>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	>6		\b, keyboard=Unknown id:%d
29112>>>>>>>>>>>>>>>0x002C	ubyte&0xF0	0x00		\b, basic=Japanese
29113>>>>>>>>>>>>>>>0x002C	ubyte&0xF0	0x10		\b, basic=International
29114>>>>>>>>>>>>>>>0x002C	ubyte&0xF0	>0x10		\b, basic=Unknown id:%d
29115>>>>>>>>>>>>>>>0x002E	ubyte&1		1		\b, built-in MIDI
29116
29117
291180		string/b		CD
29119>2		uleshort	>0x10
29120>>2		uleshort	<0x4000
29121>>>4		uleshort	<0x4000
29122>>>>6		uleshort	<0x4000
29123>>>>>8		ubyte		0xC3
29124>>>>>>9		uleshort	<0x4000
29125>>>>>>>0x10	ubyte		0xC3
29126>>>>>>>>0x11	uleshort	<0x4000
29127>>>>>>>>>0x14	ubyte		0xC3
29128>>>>>>>>>>0x15	uleshort	<0x4000		MSX2/2+/TR SubROM
29129
291300		string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
29131>0x5F0		ubequad		0x8282828244380000
29132>>0x150		ubyte		0x38
29133>>>0x170	string		\20\20\20
29134>>>>0x1E32	string		())
29135>>>>>0x2130	ubequad		0xA5A5594924231807
29136>>>>>0x2138	ubequad		0x4A4A3424488830C0	MSX Kanji Font
29137
29138
29139
29140# MSX extension ROMs
291410	string/b		AB
29142>2	uleshort	0x0010			MSX ROM
29143>>2	uleshort	x			\b, init=%#4x
29144>>4	uleshort	>0			\b, stahdl=%#4x
29145>>6	uleshort	>0			\b, devhdl=%#4x
29146>>8	uleshort	>0			\b, bas=%#4x
29147>2	uleshort	0x4010			MSX ROM
29148>>2	uleshort	x			\b, init=%#04x
29149>>4	uleshort	>0			\b, stahdl=%#04x
29150>>6	uleshort	>0			\b, devhdl=%#04x
29151>>8	uleshort	>0			\b, bas=%#04x
29152>2	uleshort	0x8010			MSX ROM
29153>>2	uleshort	x			\b, init=%#04x
29154>>4	uleshort	>0			\b, stahdl=%#04x
29155>>6	uleshort	>0			\b, devhdl=%#04x
29156>>8	uleshort	>0			\b, bas=%#04x
291570	string/b		AB\0\0
29158>6	uleshort	0
29159>>4	uleshort	>0x400F			MSX-BASIC extension ROM
29160>>>4	uleshort	>0			\b, stahdl=%#04x
29161>>>6	uleshort	>0			\b, devhdl=%#04x
29162>>>0x1C		string		OPLL			\b, MSX-Music
29163>>>>0x18	string		PAC2			\b (external)
29164>>>>0x18	string		APRL			\b (internal)
29165
291660	string/b		AB\0\0\0\0
29167>6	uleshort	>0x400F			MSX device BIOS
29168>>6	uleshort	>0			\b, devhdl=%#04x
29169
29170
291710	string/b		AB
29172#>2	string		5JSuperLAYDOCK		MSX Super Laydock ROM
29173#>3	string		@HYDLIDE3MSX		MSX Hydlide-3 ROM
29174#>3	string		@3\x80IA862		Golvellius MSX1 ROM
29175>2	uleshort	>15
29176>>2	uleshort	<0xC000
29177>>>8	string		\0\0\0\0\0\0\0\0
29178>>>>(2.s&0x3FFF)	uleshort	>0		MSX ROM
29179>>>>>0x10	string		YZ\0\0\0\0		Konami Game Master 2 MSX ROM
29180>>>>>0x10	string		CD			\b, Konami RC-
29181>>>>>>0x12	ubyte		x			\b%d
29182>>>>>>0x13	ubyte/16	x			\b%d
29183>>>>>>0x13	ubyte&0xF	x			\b%d
29184>>>>>0x10	string		EF			\b, Konami RC-
29185>>>>>>0x12	ubyte		x			\b%d
29186>>>>>>0x13	ubyte/16	x			\b%d
29187>>>>>>0x13	ubyte&0xF	x			\b%d
29188>>>>>2	uleshort	x			\b, init=%#04x
29189>>>>>4	uleshort	>0			\b, stahdl=%#04x
29190>>>>>6	uleshort	>0			\b, devhdl=%#04x
29191>>>>>8	uleshort	>0			\b, bas=%#04x
29192>>>2	uleshort	0
29193>>>>4	uleshort	0
29194>>>>>6	uleshort	0
29195>>>>>>8	uleshort	>0			MSX BASIC program in ROM, bas=%#04x
29196
291970x4000	string/b		AB
29198>0x4002	uleshort	>0x400F
29199>>0x400A	string		\0\0\0\0\0\0	MSX ROM with nonstandard page order
29200>>>0x4002	uleshort	x			\b, init=%#04x
29201>>>0x4004	uleshort	>0			\b, stahdl=%#04x
29202>>>0x4006	uleshort	>0			\b, devhdl=%#04x
29203>>>0x4008	uleshort	>0			\b, bas=%#04x
29204
292050x8000	string/b		AB
29206>0x8002	uleshort	>0x400F
29207>>0x800A	string		\0\0\0\0\0\0	MSX ROM with nonstandard page order
29208>>>0x8002	uleshort	x			\b, init=%#04x
29209>>>0x8004	uleshort	>0			\b, stahdl=%#04x
29210>>>0x8006	uleshort	>0			\b, devhdl=%#04x
29211>>>0x8008	uleshort	>0			\b, bas=%#04x
29212
29213
292140x3C000	string/b		AB
29215>0x3C008	string		\0\0\0\0\0\0\0\0	MSX MegaROM with nonstandard page order
29216>>0x3C002	uleshort	x			\b, init=%#04x
29217>>0x3C004	uleshort	>0			\b, stahdl=%#04x
29218>>0x3C006	uleshort	>0			\b, devhdl=%#04x
29219>>0x3C008	uleshort	>0			\b, bas=%#04x
29220
29221# MSX BIN file
29222#0	byte		0xFE
29223#>1	uleshort	>0x8000
29224#>>3	uleshort	>0x8004
29225#>>>5	uleshort	>0x8000			MSX BIN file
29226
29227# MSX-BASIC file
292280	byte		0xFF
29229>3	uleshort	0x000A
29230>>1	uleshort	>0x8000			MSX-BASIC program
29231
29232# MSX .CAS file
292330	string/b	\x1F\xA6\xDE\xBA\xCC\x13\x7D\x74	MSX cassette archive
29234
29235# Mega-Assembler file
292360	byte		0xFE
29237>1	uleshort	0x0001
29238>>5	uleshort	0xffff
29239>>>6	byte		0x0A		MSX Mega-Assembler source
29240
29241# Execrom Patchfile
292420	string		ExecROM\ patchfile\x1A	MSX ExecROM patchfile
29243>0x12	ubyte/16	x		v%d
29244>0x12	ubyte&0xF	x		\b.%d
29245>0x13	ubyte		x		\b, contains %d patches
29246
29247# Konami's King's Valley-2 custom stage (ELG file)
292484	uleshort	0x0900
29249>0xF	byte		1
29250>>0x14	byte		0
29251>>>0x1E	string		\040\040\040
29252>>>>0x23	byte	1
29253>>>>>0x25	byte	0
29254>>>>>>0x15	string	>\x30
29255>>>>>>>0x15	string	<\x5A		Konami King's Valley-2 custom stage, title: "%-8.8s"
29256>>>>>>>>0x1D	byte	<32	\b, theme: %d
29257
29258# Metal Gear 1 savegame
29259#0x4F	string	\x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF
29260#>>0x60	string	\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF
29261#>>>0x7B	string	\0x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\x00	Metal Gear 1 savegame
29262
29263# ------------------------------------------------------------------------
29264# $File: mup,v 1.5 2017/03/17 21:35:28 christos Exp $
29265# mup: file(1) magic for Mup (Music Publisher) input file.
29266#
29267# From: Abel Cheung <abel (@) oaka.org>
29268#
29269# NOTE: This header is mainly proposed in the Arkkra mailing list,
29270# and is not a mandatory header because of old mup input file
29271# compatibility. Noteedit also use mup format, but is not forcing
29272# user to use any header as well.
29273#
292740		search/1	//!Mup		Mup music publication program input text
29275>6		string		-Arkkra		(Arkkra)
29276>>13		string		-
29277>>>16		string		.
29278>>>>14		string		x		\b, need V%.4s
29279>>>15		string		.
29280>>>>14		string		x		\b, need V%.3s
29281>6		string		-
29282>>9		string		.
29283>>>7		string		x		\b, need V%.4s
29284>>8		string		.
29285>>>7		string		x		\b, need V%.3s
29286#------------------------------------------------------------------------------
29287# $File: music,v 1.1 2011/11/25 03:28:17 christos Exp $
29288# music:  file (1) magic for music formats
29289
29290# BWW format used by Bagpipe Music Writer Gold by Robert MacNeil Musicworks
29291# and Bagpipe Writer by Doug Wickstrom
29292#
292930	string		Bagpipe		Bagpipe
29294>8	string		Reader		Reader
29295>>15	string		>\0		(version %.3s)
29296>8	string		Music\ Writer	Music Writer
29297>>20	string		:
29298>>>21	string		>\0		(version %.3s)
29299>>21	string		Gold		Gold
29300>>>25	string		:
29301>>>>26	string		>\0		(version %.3s)
29302
29303
29304#------------------------------------------------------------------------------
29305# nasa:	file(1) magic
29306
29307# From: Barry Carter <carter.barry@gmail.com>
293080	string	DAF/SPK				NASA SPICE file (binary format)
293090	string	DAFETF\ NAIF\ DAF\ ENCODED	NASA SPICE file (transfer format)
29310
29311#-----------------------------------------------------------------------------
29312# $File: natinst,v 1.6 2014/06/03 19:17:27 christos Exp $
29313# natinst:  file(1) magic for National Instruments Code Files
29314
29315#
29316# From <egamez@fcfm.buap.mx> Enrique Gamez-Flores
29317# version 1
29318# Many formats still missing, we use, for the moment LabVIEW
29319# We guess VXI format file. VISA, LabWindowsCVI, BridgeVIEW, etc, are missing
29320#
293210       string          RSRC            National Instruments,
29322# Check if it's a LabVIEW File
29323>8      string          LV              LabVIEW File,
29324# Check which kind of file it is
29325>>10    string          SB              Code Resource File, data
29326>>10    string          IN              Virtual Instrument Program, data
29327>>10    string          AR              VI Library, data
29328# This is for Menu Libraries
29329>8      string          LMNULBVW        Portable File Names, data
29330# This is for General Resources
29331>8      string          rsc             Resources File, data
29332# This is for VXI Package
293330       string          VMAP            National Instruments, VXI File, data
29334
29335#------------------------------------------------------------------------------
29336# $File: ncr,v 1.8 2014/04/30 21:41:02 christos Exp $
29337# ncr:  file(1) magic for NCR Tower objects
29338#
29339# contributed by
29340# Michael R. Wayne  ***  TMC & Associates  ***  INTERNET: wayne@ford-vax.arpa
29341# uucp: {philabs | pyramid} !fmsrl7!wayne   OR   wayne@fmsrl7.UUCP
29342#
293430	beshort		000610	Tower/XP rel 2 object
29344>12	   belong		>0	not stripped
29345>20	   beshort		0407	executable
29346>20	   beshort		0410	pure executable
29347>22	   beshort		>0	- version %d
293480	beshort		000615	Tower/XP rel 2 object
29349>12	   belong		>0	not stripped
29350>20	   beshort		0407	executable
29351>20	   beshort		0410	pure executable
29352>22	   beshort		>0	- version %d
293530	beshort		000620	Tower/XP rel 3 object
29354>12	   belong		>0	not stripped
29355>20	   beshort		0407	executable
29356>20	   beshort		0410	pure executable
29357>22	   beshort		>0	- version %d
293580	beshort		000625	Tower/XP rel 3 object
29359>12	   belong		>0	not stripped
29360>20	   beshort		0407	executable
29361>20	   beshort		0410	pure executable
29362>22	   beshort		>0	- version %d
293630	beshort		000630	Tower32/600/400 68020 object
29364>12	   belong		>0	not stripped
29365>20	   beshort		0407	executable
29366>20	   beshort		0410	pure executable
29367>22	   beshort		>0	- version %d
293680	beshort		000640	Tower32/800 68020
29369>18	   beshort		&020000	w/68881 object
29370>18	   beshort		&040000	compatible object
29371>18	   beshort		&060000	object
29372>20	   beshort		0407	executable
29373>20	   beshort		0413	pure executable
29374>12	   belong		>0	not stripped
29375>22	   beshort		>0	- version %d
293760	beshort		000645	Tower32/800 68010
29377>18	   beshort		&040000	compatible object
29378>18	   beshort		&060000 object
29379>20	   beshort		0407	executable
29380>20	   beshort		0413	pure executable
29381>12	   belong		>0	not stripped
29382>22	   beshort		>0	- version %d
29383
29384#------------------------------------------------------------------------------
29385# $File: netbsd,v 1.26 2019/01/01 03:11:23 christos Exp $
29386# netbsd:  file(1) magic for NetBSD objects
29387#
29388# All new-style magic numbers are in network byte order.
29389# The old-style magic numbers are indistinguishable from the same magic
29390# numbers used in other systems, and are handled, for all those systems,
29391# in aout.
29392#
29393
293940	name	netbsd-detail
29395>20	lelong	x		@%#x
29396>4	lelong	>0		\b+T=%d
29397>8	lelong	>0		\b+D=%d
29398>12	lelong	>0		\b+B=%d
29399>16	lelong	>0		\b+S=%d
29400>24	lelong	>0		\b+TR=%d
29401>28	lelong	>0		\b+TD=%d
29402
294030	name			netbsd-4096
29404>0	byte			&0x80
29405>>20	lelong			<4096		shared library
29406>>20	lelong			=4096		dynamically linked executable
29407>>20	lelong			>4096		dynamically linked executable
29408>0	byte			^0x80		executable
29409>16	lelong			>0		not stripped
29410
294110	name			netbsd-8192
29412>0	byte			&0x80
29413>>20	lelong			<8192		shared library
29414>>20	lelong			=8192		dynamically linked executable
29415>>20	lelong			>8192		dynamically linked executable
29416>0	byte			^0x80		executable
29417>16	lelong			>0		not stripped
29418>0	use			netbsd-detail
29419
294200	name			netbsd-normal
29421>0	byte			&0x80		dynamically linked executable
29422>0	byte			^0x80
29423>>0	byte			&0x40		position independent
29424>>20	lelong			!0		executable
29425>>20	lelong			=0		object file
29426>16	lelong			>0		not stripped
29427>0	use			netbsd-detail
29428
294290	name			netbsd-pure
29430>0	byte			&0x80		dynamically linked executable
29431>0	byte			^0x80		executable
29432>16	lelong			>0		not stripped
29433>0	use			netbsd-detail
29434
294350	name			netbsd-core
29436>12	string			>\0		from '%s'
29437>32	lelong			!0		(signal %d)
29438
294390	belong&0377777777	041400413	a.out NetBSD/i386 demand paged
29440>0	use			netbsd-4096
29441
294420	belong&0377777777	041400410	a.out NetBSD/i386 pure
29443>0	use			netbsd-pure
29444
294450	belong&0377777777	041400407	a.out NetBSD/i386
29446>0	use			netbsd-normal
29447
294480	belong&0377777777	041400507	a.out NetBSD/i386 core
29449>0	use			netbsd-core
29450
294510	belong&0377777777	041600413	a.out NetBSD/m68k demand paged
29452>0	use			\^netbsd-8192
29453
294540	belong&0377777777	041600410	a.out NetBSD/m68k pure
29455>0	use			\^netbsd-pure
29456
294570	belong&0377777777	041600407	a.out NetBSD/m68k
29458>0	use			\^netbsd-normal
29459
294600	belong&0377777777	041600507	a.out NetBSD/m68k core
29461>0	use			\^netbsd-core
29462
294630	belong&0377777777	042000413	a.out NetBSD/m68k4k demand paged
29464>0	use			\^netbsd-4096
29465
294660	belong&0377777777	042000410	a.out NetBSD/m68k4k pure
29467>0	use			\^netbsd-pure
29468
294690	belong&0377777777	042000407	a.out NetBSD/m68k4k
29470>0	use			\^netbsd-normal
29471
294720	belong&0377777777	042000507	a.out NetBSD/m68k4k core
29473>0	use			\^netbsd-core
29474
294750	belong&0377777777	042200413	a.out NetBSD/ns32532 demand paged
29476>0	use			netbsd-4096
29477
294780	belong&0377777777	042200410	a.out NetBSD/ns32532 pure
29479>0	use			netbsd-pure
29480
294810	belong&0377777777	042200407	a.out NetBSD/ns32532
29482>0	use			netbsd-normal
29483
294840	belong&0377777777	042200507	a.out NetBSD/ns32532 core
29485>0	use			netbsd-core
29486
294870	belong&0377777777	045200507	a.out NetBSD/powerpc core
29488>0	use			netbsd-core
29489
294900	belong&0377777777	042400413	a.out NetBSD/SPARC demand paged
29491>0	use			\^netbsd-8192
29492
294930	belong&0377777777	042400410	a.out NetBSD/SPARC pure
29494>0	use			\^netbsd-pure
29495
294960	belong&0377777777	042400407	a.out NetBSD/SPARC
29497>0	use			\^netbsd-normal
29498
294990	belong&0377777777	042400507	a.out NetBSD/SPARC core
29500>0	use			\^netbsd-core
29501
295020	belong&0377777777	042600413	a.out NetBSD/pmax demand paged
29503>0	use			netbsd-4096
29504
295050	belong&0377777777	042600410	a.out NetBSD/pmax pure
29506>0	use			\^netbsd-pure
29507
295080	belong&0377777777	042600407	a.out NetBSD/pmax
29509>0	use			netbsd-normal
29510
295110	belong&0377777777	042600507	a.out NetBSD/pmax core
29512>0	use			netbsd-core
29513
295140	belong&0377777777	043000413	a.out NetBSD/vax 1k demand paged
29515>0	use			netbsd-4096
29516
295170	belong&0377777777	043000410	a.out NetBSD/vax 1k pure
29518>0	use			netbsd-pure
29519
295200	belong&0377777777	043000407	a.out NetBSD/vax 1k
29521>0	use			netbsd-normal
29522
295230	belong&0377777777	043000507	a.out NetBSD/vax 1k core
29524>0	use			netbsd-core
29525
295260	belong&0377777777	045400413	a.out NetBSD/vax 4k demand paged
29527>0	use			netbsd-4096
29528
295290	belong&0377777777	045400410	a.out NetBSD/vax 4k pure
29530>0	use			netbsd-pure
29531
295320	belong&0377777777	045400407	a.out NetBSD/vax 4k
29533>0	use			netbsd-normal
29534
295350	belong&0377777777	045400507	a.out NetBSD/vax 4k core
29536>0	use			netbsd-core
29537
29538# NetBSD/alpha does not support (and has never supported) a.out objects,
29539# so no rules are provided for them.  NetBSD/alpha ELF objects are
29540# dealt with in "elf".
295410	lelong		0x00070185		ECOFF NetBSD/alpha binary
29542>10	leshort		0x0001			not stripped
29543>10	leshort		0x0000			stripped
295440	belong&0377777777	043200507	a.out NetBSD/alpha core
29545>12	string			>\0		from '%s'
29546>32	lelong			!0		(signal %d)
29547
295480	belong&0377777777	043400413	a.out NetBSD/mips demand paged
29549>0	use			\^netbsd-8192
29550
29551>16	belong			>0		not stripped
295520	belong&0377777777	043400410	a.out NetBSD/mips pure
29553>0	use			netbsd-pure
29554
295550	belong&0377777777	043400407	a.out NetBSD/mips
29556>0	use			netbsd-normal
29557
295580	belong&0377777777	043400507	a.out NetBSD/mips core
29559>0	use			netbsd-core
29560
295610	belong&0377777777	043600413	a.out NetBSD/arm32 demand paged
29562>0	use			netbsd-4096
29563
295640	belong&0377777777	043600410	a.out NetBSD/arm32 pure
29565>0	use			netbsd-pure
29566
295670	belong&0377777777	043600407	a.out NetBSD/arm32
29568>0	use			netbsd-normal
29569
29570# NetBSD/arm26 has always used ELF objects, but it shares a core file
29571# format with NetBSD/arm32.
295720	belong&0377777777	043600507	a.out NetBSD/arm core
29573>0	use			netbsd-core
29574
29575# Kernel core dump format
295760	belong&0x0000ffff 0x00008fca	NetBSD kernel core file
29577>0	belong&0x03ff0000 0x00000000	\b, Unknown
29578>0	belong&0x03ff0000 0x00010000	\b, sun 68010/68020
29579>0	belong&0x03ff0000 0x00020000	\b, sun 68020
29580>0	belong&0x03ff0000 0x00640000	\b, 386 PC
29581>0	belong&0x03ff0000 0x00860000	\b, i386 BSD
29582>0	belong&0x03ff0000 0x00870000	\b, m68k BSD (8K pages)
29583>0	belong&0x03ff0000 0x00880000	\b, m68k BSD (4K pages)
29584>0	belong&0x03ff0000 0x00890000	\b, ns32532 BSD
29585>0	belong&0x03ff0000 0x008a0000	\b, SPARC/32 BSD
29586>0	belong&0x03ff0000 0x008b0000	\b, pmax BSD
29587>0	belong&0x03ff0000 0x008c0000	\b, vax BSD (1K pages)
29588>0	belong&0x03ff0000 0x008d0000	\b, alpha BSD
29589>0	belong&0x03ff0000 0x008e0000	\b, mips BSD (Big Endian)
29590>0	belong&0x03ff0000 0x008f0000	\b, arm6 BSD
29591>0	belong&0x03ff0000 0x00900000	\b, m68k BSD (2K pages)
29592>0	belong&0x03ff0000 0x00910000	\b, sh3 BSD
29593>0	belong&0x03ff0000 0x00950000	\b, ppc BSD (Big Endian)
29594>0	belong&0x03ff0000 0x00960000	\b, vax BSD (4K pages)
29595>0	belong&0x03ff0000 0x00970000	\b, mips1 BSD
29596>0	belong&0x03ff0000 0x00980000	\b, mips2 BSD
29597>0	belong&0x03ff0000 0x00990000	\b, m88k BSD
29598>0	belong&0x03ff0000 0x00920000	\b, parisc BSD
29599>0	belong&0x03ff0000 0x009b0000	\b, sh5/64 BSD
29600>0	belong&0x03ff0000 0x009c0000	\b, SPARC/64 BSD
29601>0	belong&0x03ff0000 0x009d0000	\b, amd64 BSD
29602>0	belong&0x03ff0000 0x009e0000	\b, sh5/32 BSD
29603>0	belong&0x03ff0000 0x009f0000	\b, ia64 BSD
29604>0	belong&0x03ff0000 0x00b70000	\b, aarch64 BSD
29605>0	belong&0x03ff0000 0x00b80000	\b, or1k BSD
29606>0	belong&0x03ff0000 0x00b90000	\b, Risk-V BSD
29607>0	belong&0x03ff0000 0x00c80000	\b, hp200 BSD
29608>0	belong&0x03ff0000 0x012c0000	\b, hp300 BSD
29609>0	belong&0x03ff0000 0x020b0000	\b, hp800 HP-UX
29610>0	belong&0x03ff0000 0x020c0000	\b, hp200/hp300 HP-UX
29611>0	belong&0xfc000000 0x04000000	\b, CPU
29612>0	belong&0xfc000000 0x08000000	\b, DATA
29613>0	belong&0xfc000000 0x10000000	\b, STACK
29614>4	leshort	x			\b, (headersize = %d
29615>6	leshort	x			\b, segmentsize = %d
29616>8	lelong	x			\b, segments = %d)
29617
29618# little endian only for now.
296190	name		ktrace
29620>4	leshort		7
29621>>6	leshort		<3		NetBSD ktrace file version %d
29622>>>12	string		x		from %s
29623>>>56	string		x		\b, emulation %s
29624>>>8	lelong		<65536		\b, pid=%d
29625
2962656	string		netbsd
29627>0	use		ktrace
2962856	string		linux
29629>0	use		ktrace
2963056	string		sunos
29631>0	use		ktrace
2963256	string		hpux
29633>0	use		ktrace
29634
29635#------------------------------------------------------------------------------
29636# $File: netscape,v 1.8 2017/03/17 21:35:28 christos Exp $
29637# netscape:  file(1) magic for Netscape files
29638# "H. Nanosecond" <aldomel@ix.netcom.com>
29639# version 3 and 4 I think
29640#
29641
29642# Netscape Address book  .nab
296430	string \000\017\102\104\000\000\000\000\000\000\001\000\000\000\000\002\000\000\000\002\000\000\004\000 Netscape Address book
29644
29645# Netscape Communicator address book
296460   string   \000\017\102\111 Netscape Communicator address book
29647
29648# .snm Caches
296490	string		#\ Netscape\ folder\ cache	Netscape folder cache
296500	string	\000\036\204\220\000	Netscape folder cache
29651# .n2p
29652# Net 2 Phone
29653#0	string	123\130\071\066\061\071\071\071\060\070\061\060\061\063\060
296540	string	SX961999	Net2phone
29655
29656#
29657#This is files ending in .art, FIXME add more rules
296580	string	JG\004\016\0\0\0\0	AOL ART image
296590	string	JG\003\016\0\0\0\0	AOL ART image
29660
29661#------------------------------------------------------------------------------
29662# $File: netware,v 1.5 2020/09/04 16:30:51 christos Exp $
29663# netware:  file(1) magic for NetWare Loadable Modules (NLMs)
29664# From: Mads Martin Joergensen <mmj@suse.de>
29665# URL:		https://en.wikipedia.org/wiki/NetWare_Loadable_Module
29666
296670	string	NetWare\ Loadable\ Module	NetWare Loadable Module
29668#!:mime	application/octet-stream
29669!:ext	nlm
29670
29671
29672#------------------------------------------------------------------------------
29673# $File: news,v 1.6 2009/09/19 16:28:11 christos Exp $
29674# news:  file(1) magic for SunOS NeWS fonts (not "news" as in "netnews")
29675#
296760	string		StartFontMetrics	ASCII font metrics
296770	string		StartFont	ASCII font bits
296780	belong		0x137A2944	NeWS bitmap font
296790	belong		0x137A2947	NeWS font family
296800	belong		0x137A2950	scalable OpenFont binary
296810	belong		0x137A2951	encrypted scalable OpenFont binary
296828	belong		0x137A2B45	X11/NeWS bitmap font
296838	belong		0x137A2B48	X11/NeWS font family
29684
29685#------------------------------------------------------------------------------
29686# $File: nifty,v 1.1 2022/02/14 16:51:15 christos Exp $
29687# file(1) magic for the NIfTI file format
29688
29689# Type: NIfTI, Neuroimaging file format
29690# URL:  https://nifti.nimh.nih.gov/
29691# From: Yann Leprince <yann.leprince@cea.fr>, 2022
29692
29693344	string		n+1\0		NIfTI-1 neuroimaging data,
29694!:mime	image/x.nifti
29695!:ext	nii
29696>0	use		nifti1
29697344	string		ni1\0		NIfTI-1 neuroimaging data header,
29698!:mime	image/x.nifti
29699!:ext	hdr
29700>0	use		nifti1
29701
297024	string		n+2\0\r\n\032\n	NIfTI-2 neuroimaging data,
29703!:mime	image/x.nifti
29704!:ext	nii
29705>0	use		nifti2
297064	string		ni2\0\r\n\032\n	NIfTI-2 neuroimaging data header,
29707!:mime	image/x.nifti
29708!:ext	hdr
29709>0	use		nifti2
29710
29711# Main subroutine for NIfTI-1
297120	name		nifti1
29713>0	clear		x
29714>0	lelong		=348		little endian
29715>>70	use		nifti-datatype-le
29716>>112	lefloat	!0		with scaling
29717>>0	use		nifti1-dim-le
29718>>252	leshort	>0		\b, with qform
29719>>>252	use		xform-code-nifti1-le
29720>>254	leshort	>0		\b, with sform
29721>>>254	use		xform-code-nifti1-le
29722>>136	string		>\0		\b, description: %s
29723>0	belong		=348		big endian
29724>>70	use		\^nifti-datatype-le
29725>>112	befloat	!0		with scaling
29726>>0	use		\^nifti1-dim-le
29727>>252	beshort	>0		\b, with qform
29728>>>252	use		\^xform-code-nifti1-le
29729>>254	beshort	>0		\b, with sform
29730>>>254	use		\^xform-code-nifti1-le
29731>>136	string		>\0		\b, description: %s
29732>0	default	x
29733>>0	long		x		invalid sizeof_hdr=%d
29734
29735# Main subroutine for NIfTI-2
297360	name		nifti2
29737>0	clear		x
29738>0	lelong		=540		little endian
29739>>12	use		nifti-datatype-le
29740>>176	lefloat	!0		with scaling
29741>>0	use		nifti2-dim-le
29742>>344	lelong		>0		\b, with qform
29743>>>344	use		xform-code-nifti2-le
29744>>348	lelong		>0		\b, with sform
29745>>>348	use		xform-code-nifti2-le
29746>>240	string		>\0		\b, description: %s
29747>0	belong		=540		big endian
29748>>12	use		\^nifti-datatype-le
29749>>176	befloat	!0		with scaling
29750>>0	use		\^nifti2-dim-le
29751>>344	lelong		>0		\b, with qform
29752>>>344	use		\^xform-code-nifti2-le
29753>>348	lelong		>0		\b, with sform
29754>>>348	use		\^xform-code-nifti2-le
29755>>240	string		>\0		\b, description: %s
29756>0	default	x
29757>>0	long		x		invalid sizeof_hdr=%d
29758
29759
29760# Other subroutines for details of NIfTI files
29761
297620	name		nifti-datatype-le
29763>0	clear		x
29764>0	leshort	=1		\b, binary datatype
29765>0	leshort	=2		\b, uint8 datatype
29766>0	leshort	=4		\b, int16 datatype
29767>0	leshort	=8		\b, int32 datatype
29768>0	leshort	=16		\b, float32 datatype
29769>0	leshort	=32		\b, complex64 datatype
29770>0	leshort	=64		\b, float64 datatype
29771>0	leshort	=128		\b, RGB24 datatype
29772>0	leshort	=256		\b, int8 datatype
29773>0	leshort	=512		\b, uint16 datatype
29774>0	leshort	=768		\b, uint32 datatype
29775>0	leshort	=1024		\b, int64 datatype
29776>0	leshort	=1280		\b, uint64 datatype
29777>0	leshort	=1536		\b, float128 datatype
29778>0	leshort	=1792		\b, complex128 datatype
29779>0	leshort	=2048		\b, complex256 datatype
29780>0	leshort	=2304		\b, RGBA32 datatype
29781>0	default	x
29782>>0	leshort	x		\b, unknown datatype 0x%x
29783>>2	leshort	x		(%d bits/pixel)
29784
297850	name		nifti1-dim-le
29786>0	clear		x
29787>40	leshort	<0		\b, INVALID dim[0]=%d
29788>40	leshort	>7		\b, INVALID dim[0]=%d
29789>0	default	x
29790>>40	leshort	x		\b, %d-dimensional (size
29791>>42	leshort	x		%d
29792>>40	leshort	>1
29793>>>44	leshort	x		\bx%d
29794>>40	leshort	>2
29795>>>46	leshort	x		\bx%d
29796>>40	leshort	>3
29797>>>48	leshort	x		\bx%d
29798>>40	leshort	>4
29799>>>50	leshort	x		\bx%d
29800>>40	leshort	>5
29801>>>52	leshort	x		\bx%d
29802>>40	leshort	>6
29803>>>54	leshort	x		\bx%d
29804>>80	lefloat	x		\b, voxel size %f
29805>>40	leshort	>1
29806>>>84	lefloat	x		x %f
29807>>40	leshort	>2
29808>>>88	lefloat	x		x %f
29809>>123	use		nifti1-xyz-unit
29810>>40	leshort	>3
29811>>>92	lefloat	x		x %f
29812>>>123	use		nifti1-t-unit
29813>>40	leshort	x		\b)
29814
298150	name		nifti2-dim-le
29816>0	clear		x
29817>16	lequad		<0		\b, INVALID dim[0]=%lld
29818>16	lequad		>7		\b, INVALID dim[0]=%lld
29819>0	default	x
29820>>16	lequad		x		\b, %lld-dimensional (size
29821>>24	lequad		x		%lld
29822>>16	lequad		>1
29823>>>32	lequad		x		\bx%lld
29824>>16	lequad		>2
29825>>>40	lequad		x		\bx%lld
29826>>16	lequad		>3
29827>>>48	lequad		x		\bx%lld
29828>>16	lequad		>4
29829>>>56	lequad		x		\bx%lld
29830>>16	lequad		>5
29831>>>64	lequad		x		\bx%lld
29832>>16	lequad		>6
29833>>>72	lequad		x		\bx%lld,
29834>>112	ledouble	x		\b, voxel size %f
29835>>16	lequad		>1
29836>>>120	ledouble	x		x %f
29837>>16	lequad		>2
29838>>>128	ledouble	x		x %f
29839>>500	use		nifti2-xyz-unit
29840>>16	lequad		>3
29841>>>136	ledouble	x		x %f
29842>>>500	use		nifti2-t-unit
29843>>16	lequad		x		\b)
29844
298450	name		xform-code-nifti1-le
29846>0	leshort	=1		to scanner-based coordinates
29847>0	leshort	=2		to aligned coordinates
29848>0	leshort	=3		to Talairach coordinates
29849>0	leshort	=4		to MNI152 coordinates
29850>0	leshort	=5		to template coordinates
29851
298520	name		xform-code-nifti2-le
29853>0	lelong		=1		to scanner-based coordinates
29854>0	lelong		=2		to aligned coordinates
29855>0	lelong		=3		to Talairach coordinates
29856>0	lelong		=4		to MNI152 coordinates
29857>0	lelong		=5		to template coordinates
29858
298590	name		nifti1-xyz-unit
29860>0	byte		&0x01
29861>>0	byte		^0x02		m
29862>>0	byte		&0x02		micron
29863>0	byte		^0x01
29864>>0	byte		&0x02		mm
29865
298660	name		nifti1-t-unit
29867>0	byte		&0x08
29868>>0	byte		^0x10		s
29869>>0	byte		&0x10		ms
29870>0	byte		^0x08
29871>>0	byte		&0x10		microsecond
29872
298730	name		nifti2-xyz-unit
29874>0	lelong		&0x01
29875>>0	lelong		^0x02		m
29876>>0	lelong		&0x02		micron
29877>0	lelong		^0x01
29878>>0	lelong		&0x02		mm
29879
298800	name		nifti2-t-unit
29881>0	lelong		&0x08
29882>>0	lelong		^0x10		s
29883>>0	lelong		&0x10		ms
29884>0	lelong		^0x08
29885>>0	lelong		&0x10		microsecond
29886
29887#------------------------------------------------------------------------------
29888# $File: nim-lang,v 1.3 2021/07/06 12:34:06 christos Exp $
29889# nim-lang:  file(1) magic for nim
29890# URL:  https://nim-lang.org/
29891
298920	search/8192	import
29893>&0	search/64	os
29894>>&0	use		nim1
29895>&0	default		x
29896>>&0	search/64	osproc
29897>>>&0	use		nim1
29898>>&0	default		x
29899>>>&0	search/64	strutils
29900>>>>&0	use		nim1
29901
299020	name		nim1
29903>&0	search/8192	proc
29904>>&0	use		nim2
29905>&0	default		x
29906>>&0	search/8192	template
29907>>>&0	use		nim2
29908>>&0	default		x
29909>>>&0	search/8192	let
29910>>>>&0	use		nim2
29911
299120	name		nim2
29913>&0	search/8192	when	Nim source code
29914!:ext	nim
29915
29916#------------------------------------------------------------------------------
29917# $File: nitpicker,v 1.8 2019/04/19 00:42:27 christos Exp $
29918# nitpicker:  file(1) magic for Flowfiles.
29919# From: Christian Jachmann <C.Jachmann@gmx.net> https://www.nitpicker.de
299200	string	NPFF	NItpicker Flow File
29921>4	byte	x	V%d.
29922>5	byte	x	%d
29923>6	bedate	x	started: %s
29924>10	bedate	x	stopped: %s
29925>14	belong	x	Bytes: %u
29926>18	belong	x	Bytes1: %u
29927>22	belong	x	Flows: %u
29928>26	belong	x	Pkts: %u
29929
29930#------------------------------------------------------------------------------
29931# $File: numpy,v 1.1 2019/05/09 16:24:36 christos Exp $
29932# numpy: file(1) magic for NumPy array binary serialization format
29933# Reference: https://docs.scipy.org/doc/numpy/reference/generated/numpy.lib.format.html
299340	string		\x93NUMPY	NumPy array,
29935>6	ubyte		x		version %d
29936>7	ubyte		x		\b.%d,
29937>8	uleshort	x		header length %d
29938
29939#------------------------------------------------------------------------------
29940# $File: oasis,v 1.2 2014/06/03 19:17:27 christos Exp $
29941# OASIS
29942# Summary: OASIS stream file
29943# Long description: Open Artwork System Interchange Standard
29944# File extension: .oas
29945# Full name:	Ben Cowley (bcowley@broadcom.com)
29946#		Philip Dixon (pdixon@broadcom.com)
29947# Reference: http://www.wrcad.com/oasis/oasis-3626-042303-draft.pdf
29948#		(see page 3)
299490	string	%SEMI-OASIS\r\n		OASIS Stream file
29950
29951#------------------------------------------------------------------------------
29952# $File: ocaml,v 1.5 2010/09/20 18:55:20 rrt Exp $
29953# ocaml: file(1) magic for Objective Caml files.
299540	string	Caml1999	OCaml
29955>8	string	X		exec file
29956>8	string	I		interface file (.cmi)
29957>8	string	O		object file (.cmo)
29958>8	string	A		library file (.cma)
29959>8	string	Y		native object file (.cmx)
29960>8	string	Z		native library file (.cmxa)
29961>8	string	M		abstract syntax tree implementation file
29962>8	string	N		abstract syntax tree interface file
29963>9	string	>\0		(Version %3.3s)
29964
29965#------------------------------------------------------------------------------
29966# $File: octave,v 1.4 2009/09/19 16:28:11 christos Exp $
29967# octave binary data file(1) magic, from Dirk Eddelbuettel <edd@debian.org>
299680	string		Octave-1-L	Octave binary data (little endian)
299690	string		Octave-1-B	Octave binary data (big endian)
29970
29971#------------------------------------------------------------------------------
29972# $File: ole2compounddocs,v 1.19 2022/09/11 20:52:40 christos Exp $
29973# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured
29974# storage (https://en.wikipedia.org/wiki/Compound_File_Binary_Format)
29975# Additional tests for OLE 2 Compound Documents should be under this recipe.
29976# reference:	https://www.openoffice.org/sc/compdocfileformat.pdf
29977
299780   string  \320\317\021\340\241\261\032\341
29979# https://digital-preservation.github.io/droid/
29980# skip droid skeleton like fmt-39-signature-id-128.doc by valid version
29981>0x1A	ushort		!0xABAB		OLE 2 Compound Document
29982#>0x1C	uleshort		x			\b, endnian %#4.4x
29983# big endian not tested
29984>>0x1C	ubeshort		=0xfffe			\b, big-endian
29985>>>546	string	jbjb			: Microsoft Word Document
29986!:mime	application/msword
29987!:apple	MSWDWDBN
29988!:ext	doc
29989# Byte Order 0xFFFE means little-endian found in real world applications
29990#>>0x1C	uleshort		=0xfffe			\b, little-endian
29991>>0x1C	uleshort		=0xfffe
29992# From:		Joerg Jenderek
29993# Major Version 3 or 4
29994>>>0x1A	uleshort		x			\b, v%u
29995# Minor Version 32h=50 3Bh=59 3Eh=62
29996>>>0x18	uleshort		x			\b.%u
29997# SecID of first sector of the directory stream is often 1 but high like 3144h
29998>>>48	ulelong			x			\b, SecID %#x
29999# Sector Shift Exponent in short-stream container stream: 6~64 bytes
30000>>>32	uleshort		!6			\b, exponent of short stream %u
30001# total number of sectors used for the FAT
30002>>>44	ulelong			>1			\b, %u FAT sectors
30003# SecID of first sector of the short-sector allocation table (Mini FAT)
30004# or -2 (End Of ChainSecID) if not extant
30005>>>60	ulelong			!0xffFFffFE		\b, Mini FAT start sector %#x
30006# total number of sectors used for the short-sector allocation table
30007>>>64	ulelong			!1			\b, %u Mini FAT sector
30008# plural s
30009>>>>64	ulelong			>1			\bs
30010# SecID of first sector of the master sector allocation table (DIFAT)
30011# or -2 (End Of Chain SecID) if no additional sectors used
30012>>>68	ulelong			!0xffFFffFE		\b, DIFAT start sector %#x
30013# total number of sectors used for the master sector allocation table (DIFAT)
30014>>>72	ulelong			>0			\b, %u DIFAT sectors
30015# First part of the master sector allocation table (DIFAT) containing 109 SecIDs
30016#>>>76 	ubequad			x			\b, DIFAT=%#16.16llx
30017#>>>84 	ubequad			x			\b%16.16llx...
30018# pointer to root entry only works with standard configuration for SecID ~< 800h
30019# Red-Carpet-presentation-1.0-1.sdd sg10.sdv 2000_GA_Annual_Review_Data.xls
30020# "ORLEN Factbook 2017.xls" XnView_metadata.doc
30021# "Barham, Lisa - Die Shopping-Prinzessinnen.doc" then not recognized
30022>>>48	ulelong			>0x800			too big for FILE_BYTES_MAX = 1 MiB
30023# Sector Shift Exponent 9~512 for major version 3 or C~4096 for major version 4
30024>>>0x1E	uleshort		0xc			\b, blocksize 4096
30025# jump to one block (4096 bytes per block) before root storage block
30026>>>>(48.l*4096)	ubyte	x
30027>>>>>&4095 	use		ole2-directory
30028#>>>0x1E	uleshort		9			\b, blocksize 512
30029>>>0x1E	uleshort		9
30030# jump to one block (512 bytes per block) before root storage block
30031# in 5.37 only true for offset ~< FILE_BYTES_MAX=7 MiB defined in ../../src/file.h
30032>>>>(48.l*512)	ubyte		x
30033>>>>>&511 	use		ole2-directory
30034# check directory entry structure and display types by GUID
300350	name			ole2-directory
30036# directory entry name like "Root Entry"
30037#>0 	lestring16	x 			\b, 1st %.10s
30038# type of the entry; 5~Root storage
30039#>66 	ubyte		x			\b, type %x
30040# node colour of the entry: 00H ~ Red 01H ~ Black
30041#>67 	ubyte		x			\b, color %x
30042# the DirIDs of the child nodes. Should both be -1 in the root storage entry
30043#>68 	bequad		!0xffffffffffffffff	\b, DirIDs %llx
30044# second directory entry name like VisioDocument Control000
30045#>128	lestring16	x \b, 2nd %.20s
30046# third directory entry like WordDocument
30047#>256	lestring16	x \b, 3rd %.20s
30048# forth
30049#>384	lestring16	x \b, 4th %.10s
30050# 5th
30051#>512	lestring16	x \b, 5th %.10s
30052# 6th
30053#>640	lestring16	x \b, 6th %.10s
30054# 7th
30055#>768	lestring16	x \b, 7th %.10s
30056#	https://wikileaks.org/ciav7p1/cms/page_13762814.html
30057#	https://m.blog.naver.com/superman4u/40047693679
30058#	https://misc.daniel-marschall.de/projects/guid_analysis/guid.txt
30059#	https://toolslick.com/conversion/data/guid
30060#>80 	ubequad		!0			\b, clsid %#16.16llx
30061#>>88 	ubequad		x			\b%16.16llx
30062# test for "Root Entry" inside directory by type 5 value
30063>66 	ubyte		5
30064# look for CLSID GUID 0
30065>>88 	ubequad		0x0
30066>>>80 	ubequad		0x0
30067# - Microstation V8 DGN files (www.bentley.com)
30068# URL:	https://en.wikipedia.org/wiki/MicroStation
30069#   Last update on 10/23/2006 by Lester Hightower
30070#   07/24/2019 by Joerg Jenderek
30071# Second directory entry name like Dgn~H Dgn~S
30072>>>>128 	lestring16	Dgn~			: Microstation V8 CAD
30073#!:mime	application/x-ole-storage
30074!:mime	application/x-bentley-dgn
30075# http://www.q-cad.com/files/samples_cad_files/1344468165.dgn
30076!:ext	dgn
30077#
30078# URL:	http://fileformats.archiveteam.org/wiki/WordPerfect
30079# Second directory entry name PerfectOffice_
30080>>>>128 	lestring16	PerfectOffice_		: WordPerfect 7-X3 presentations Master, Document or Graphic
30081!:mime	application/vnd.wordperfect
30082# https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd
30083!:apple	????WPC7
30084!:ext	mst/wpd/wpg
30085#
30086# URL:	http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
30087# Second directory entry name MatOST_
30088>>>>128 	lestring16	MatOST			: Microsoft Works 3.0 document
30089!:mime	application/vnd.ms-works
30090!:apple	????AWWP
30091!:ext	wps
30092#
30093# URL:	http://fileformats.archiveteam.org/wiki/Microsoft_Works_Spreadsheet
30094# 3rd directory entry name WksSSWorkBook
30095>>>>256 	lestring16	WksSSWorkBook		: Microsoft Works 6-9 spreadsheet
30096!:mime	application/vnd.ms-works
30097!:apple	????AWSS
30098!:ext	xlr
30099#
30100# URL:	http://fileformats.archiveteam.org/wiki/XLS
30101# what is the difference to {00020820-0000-0000-c000-000000000046} ?
30102# Second directory entry name Workbook
30103>>>>128 	lestring16	Workbook
30104>>>>>256 	lestring16	!WksSSWorkBook		: Microsoft Excel 97-2003 worksheet 0 clsid
30105!:mime	application/vnd.ms-excel
30106# https://www.macdisk.com/macsigen.php	XLS5 for Excel 5
30107!:apple	????XLS9
30108!:ext	xls
30109#
30110# URL:	http://fileformats.archiveteam.org/wiki/PPT
30111# Second directory entry name Object1 Object12 Object35
30112>>>>128 	lestring16	Object			: Microsoft PowerPoint 4 presentation
30113!:mime	application/vnd.ms-powerpoint
30114# https://www.macdisk.com/macsigen.php
30115!:apple	????PPT3
30116!:ext	ppt
30117#
30118# URL:	https://www.msoutlook.info/question/164
30119# Second directory entry name __CollDataStm
30120>>>>128 	lestring16	__CollDataStm		: Microsoft Outlook Send Receive Settings
30121#!:mime	application/vnd.ms-outlook
30122!:mime	application/x-ms-srs
30123# %APPDATA%\Microsoft\Outlook\Outlook.srs
30124!:ext	srs
30125#
30126# URL:	https://www.file-extensions.org/cag-file-extension
30127# Second directory entry name Category
30128>>>>128 	lestring16	Category		: Microsoft Clip Art Gallery
30129#!:mime	application/x-ole-storage
30130!:mime	application/x-ms-cag
30131!:apple	MScgCGdb
30132!:ext	cag/
30133#
30134# URL:	https://www.filesuffix.com/de/extension/rra
30135# 3rd directory entry name StrIndex_StringTable
30136>>>>256 	lestring16	StrIndex_StringTable	: Windows temporarily installer
30137#!:mime	application/x-ole-storage
30138!:mime	application/x-ms-rra
30139!:ext	rra
30140#
30141# URL:	https://www.forensicswiki.org/wiki/Jump_Lists
30142# 3rd directory entry name DestList
30143>>>>256 	lestring16	DestList		: Windows jump list
30144#!:mime	application/x-ole-storage
30145!:mime	application/x-ms-jumplist
30146# %APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\*.automaticDestinations-ms
30147!:ext	automaticDestinations-ms
30148#
30149# URL:	https://en.wikipedia.org/wiki/Windows_thumbnail_cache
30150# Second directory entry name 256_
30151>>>>128 	lestring16	256_			: Windows thumbnail database 256
30152#!:mime	application/x-ole-storage
30153!:mime	application/x-ms-thumbnail
30154# Thumbs.db
30155!:ext	db
30156>>>>128 	lestring16	96_			: Windows thumbnail database 96
30157!:mime	application/x-ms-thumbnail
30158!:ext	db
30159# 3rd directory entry name Catalog_
30160>>>>256 	lestring16	Catalog			: Windows thumbnail database
30161!:mime	application/x-ms-thumbnail
30162!:ext	db
30163#
30164# URL:	https://support.microsoft.com/en-us/help/300887/how-to-use-system-information-msinfo32-command-line-tool-switches
30165# Note:	older Microsoft Systeminfo (MSInfo Configuration File of msinfo32); newer use xml based
30166# Second directory entry name Control000
30167>>>>128 	lestring16	Control000		: Microsoft old Systeminfo
30168#!:mime	application/x-ole-storage
30169!:mime	application/x-ms-info
30170!:ext	nfo
30171#
30172# From:		Joerg Jenderek
30173# URL:		https://en.wikipedia.org/wiki/Microsoft_Access
30174# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/m/mdz.trid.xml
30175#		http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
30176# Note:		only version foo tested and called "Microsoft Access Wizard template" by TrID
30177# Fourth directory entry name TemplateID
30178>>>>384 	lestring16	TemplateID		: Microsoft Access wizard template
30179# Second directory entry name like \005SummaryInformation and 3rd name like \005DocumentSummaryInformation
30180#!:mime	application/x-ole-storage
30181#!:mime	application/vnd.ms-office
30182#!:mime	application/vnd.ms-access
30183#!:mime	application/msaccess
30184!:mime	application/x-ms-mdz
30185# http://extension.nirsoft.net/mdz
30186!:ext	mdz
30187#
30188# URL:	http://fileformats.archiveteam.org/wiki/Corel_Print_House
30189# Second directory entry name Thumbnail
30190>>>>128 	lestring16	Thumbnail		: Corel PrintHouse image
30191#!:mime	application/x-ole-storage
30192!:mime	application/x-corel-cph
30193!:ext	cph
30194# 3rd directory entry name Thumbnail
30195>>>>256 	lestring16	Thumbnail		: Corel PrintHouse image
30196!:mime	application/x-corel-cph
30197!:ext	cph
30198# URL:	http://fileformats.archiveteam.org/wiki/Corel_Gallery
30199# Note:	format since Gallery 2; sometimes called Corel Multimedia Manager Album
30200# third directory entry name _INFO_
30201>>>>256 	lestring16	_INFO_			: Corel Gallery
30202# second directory entry name _ITEM_ or _DATA_
30203# later directory entry names: _ALBUM_ _THUMBNAIL_
30204#!:mime	application/x-ole-storage
30205!:mime	application/x-corel-gal
30206!:ext	gal
30207#
30208# From:		Joerg Jenderek
30209# URL:		https://archive.org/details/iPhoto-Plus-4
30210#		https://filext.com/file-extension/TPL
30211# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/t/tpl-ulead.trid.xml
30212# Note:		found in Template sub directory in program directory of software iPhoto Plus version 4
30213# second, third and fourth directory entry name like TplHeader TplMainImage TplPreview
30214>>>>128 	lestring16	TplHeader		: Ulead iPhoto Template
30215#!:mime	application/x-ole-storage
30216!:mime	image/x-ulead-tpl
30217# https://www.file-extensions.org/tpl-file-extension-ulead-photo-express-template
30218!:ext	tpl
30219#
30220# URL:	https://en.wikipedia.org/wiki/Hangul_(word_processor)
30221# Note:	"HWP Document File" signature found in FileHeader
30222# Second directory entry name FileHeader hint for Thinkfree Office document
30223>>>>128 	lestring16	FileHeader		: Hangul (Korean) 5.0 Word Processor File
30224#!:mime	application/haansofthwp
30225!:mime	application/x-hwp
30226# https://example-files.online-convert.com/document/hwp/example.hwp
30227!:ext	hwp
30228#
30229# URL:	https://ask.libreoffice.org/en/question/26303/creating-new-themes-for-the-gallery-not-functioning/
30230# Second directory entry name like dd2000 dd2001 dd2036 dd2060 dd2083
30231>>>>128 	lestring16	dd2			: StarOffice Gallery view
30232#!:mime	application/x-ole-storage
30233!:mime	application/x-star-sdv
30234!:ext	sdv
30235# URL:	https://en.wikipedia.org/wiki/SoftMaker_Office
30236# second directory entry name Current User
30237>>>>128 	lestring16	Current\ User		: SoftMaker
30238# third directory entry name SMNativeObjData
30239>>>>>256	lestring16	SMNativeObjData
30240# 5th directory entry name PowerPoint
30241>>>>>>512	lestring16	PowerPoint		PowerPoint presentation or template
30242!:mime	application/vnd.ms-powerpoint
30243!:ext	ppt/pps/pot
30244# 4th directory entry name PowerPoint
30245>>>>>384	lestring16	PowerPoint		Presentations or template
30246# http://extension.nirsoft.net/prv
30247!:mime	application/vnd.softmaker.presentations
30248!:ext	prd/prv
30249# third directory entry name like Current User
30250>>>>256 	lestring16	Current\ User		: SoftMaker
30251# 5th directory entry name PowerPoint
30252>>>>>512	lestring16	PowerPoint		Presentations or template
30253# http://extension.nirsoft.net/prd
30254!:mime	application/vnd.softmaker.presentations
30255!:ext	prd/prv
30256# 2nd directory entry name Pictures
30257>>>>>>128 	lestring16	Pictures		with pictures
30258#
30259# URL:		http://fileformats.archiveteam.org/wiki/PageMaker
30260# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/p
30261#		pagemaker-generic.trid.xml
30262#		pagemaker-pm6.trid.xml
30263#		pagemaker-pm65.trid.xml
30264#		pmd-pm7.trid.xml
30265# From:		Joerg Jenderek
30266# Note:		since version 6 embedd as stream with PageMaker name the "old" format handled by ./wordprocessors
30267#		verified by Michal Mutl Structured Storage Viewer `SSView.exe brochus.pt6`
30268# Second directory entry name PageMaker
30269>>>>128 	lestring16	PageMaker		:
30270# look for magic of "old" PageMaker like in 02TEMPLT.T65
30271>>>>>0	search/0xa900/s	\0\0\0\0\0\0\xff\x99
30272# GRR: jump to PageMaker stream and inspect it by sub routine PageMaker of ./wordprocessors failed with wrong version!
30273#>>>>>>&0	use		PageMaker
30274# THIS WORKS PARTLY!
30275>>>>>>&0	indirect	x
30276#	remaining null clsid
30277>>>>128 	default		x			: UNKNOWN
30278# second directory entry name like VisioDocument Control000
30279>>>>>128	lestring16	x with names %.20s
30280# third directory entry like WordDocument
30281>>>>>256	lestring16	x %.20s
30282# forth
30283>>>>>384	lestring16	x %.20s
30284!:mime	application/x-ole-storage
30285# according to file version 5.41 with -e soft option
30286#!:mime	application/CDFV2
30287#!:ext	???
30288#	look for known clsid GUID
30289# - Visio documents
30290# URL:	http://fileformats.archiveteam.org/wiki/Visio
30291#   Last update on 10/23/2006 by Lester Hightower, 07/20/2019 by Joerg Jenderek
30292>>88 	ubequad		0xc000000000000046	: Microsoft
30293>>>80 	ubequad		0x131a020000000000	Visio 2000-2002 Document, stencil or template
30294!:mime	application/vnd.visio
30295# VSD~Drawing VSS~Stencil VST~Template
30296!:ext	vsd/vss/vst
30297>>>80 	ubequad		0x141a020000000000	Visio 2003-2010 Document, stencil or template
30298!:mime	application/vnd.visio
30299!:ext	vsd/vss/vst
30300#
30301# URL:	http://fileformats.archiveteam.org/wiki/Windows_Installer
30302>>>80 	ubequad		0x84100c0000000000	Windows Installer Package
30303!:mime	application/x-msi
30304#!:mime	application/x-ms-win-installer
30305!:ext	msi
30306>>>80 	ubequad		0x86100c0000000000	Windows Installer Patch
30307# ??
30308!:mime	application/x-wine-extension-msp
30309#!:mime	application/x-ms-msp
30310!:ext	msp
30311#
30312# URL:	http://fileformats.archiveteam.org/wiki/DOC
30313>>>80 	ubequad		0x0009020000000000	Word 6-95 document or template
30314!:mime	application/msword
30315# for template MSWDW8TN
30316!:apple	MSWDWDBN
30317!:ext	doc/dot
30318>>>80 	ubequad		0x0609020000000000	Word 97-2003 document or template
30319!:mime	application/msword
30320!:apple	MSWDWDBN
30321# dot for template; no extension on Macintosh
30322!:ext	doc/dot/
30323#
30324# URL:	http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
30325>>>80 	ubequad		0x0213020000000000	Works 3-4 document or template
30326!:mime	application/vnd.ms-works
30327!:apple	????AWWP
30328# ps for template	https://filext.com/file-extension/PS	bps for backup
30329!:ext	wps/ps/bps
30330#
30331# URL:	http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database
30332>>>80 	ubequad		0x0313020000000000	Works 3-4 database or template
30333!:mime	application/vnd.ms-works-db
30334# https://www.macdisk.com/macsigen.php
30335!:apple	????AWDB
30336# db for template www.file-extensions.org/db-file-extension-microsoft-works-data bdb for backup
30337!:ext	wdb/db/bdb
30338#
30339# URL:	https://en.wikipedia.org/wiki/Microsoft_Excel
30340>>>80 	ubequad		0x1008020000000000	Excel 5-95 worksheet, addin or template
30341!:mime	application/vnd.ms-excel
30342# https://www.macdisk.com/macsigen.php
30343!:apple	????XLS5
30344# worksheet/addin/template/no extension on Macintosh
30345!:ext	xls/xla/xlt/
30346#
30347>>>80 	ubequad		0x2008020000000000	Excel 97-2003
30348!:mime	application/vnd.ms-excel
30349# https://www.macdisk.com/macsigen.php	XLS5 for Excel 5
30350!:apple	????XLS9
30351# 3rd directory entry name
30352>>>>256 	lestring16	_VBA_PROJECT_CUR	addin
30353!:ext	xla/
30354# 4th directory entry name
30355>>>>384 	lestring16	_VBA_PROJECT_CUR	addin
30356!:ext	xla
30357#!:ext	xla/
30358>>>>256 	default		x			worksheet or template
30359!:ext	xls/xlt
30360#!:ext	xls/xlt/
30361#
30362# URL:	http://fileformats.archiveteam.org/wiki/OLE2
30363>>>80 	ubequad		0x0b0d020000000000	Outlook 97-2003 item
30364#>>>80 	ubequad		0x0b0d020000000000	Outlook 97-2003 Message
30365#!:mime	application/vnd.ms-outlook
30366!:mime	application/x-ms-msg
30367!:ext	msg
30368# URL:	https://wiki.fileformat.com/email/oft/
30369>>>80 	ubequad		0x46f0060000000000	Outlook 97-2003 item template
30370#!:mime	application/vnd.ms-outlook
30371!:mime	application/x-ms-oft
30372!:ext	oft
30373#
30374# URL:	http://fileformats.archiveteam.org/wiki/PPT
30375>>>80 	ubequad		0x5148040000000000	PowerPoint 4.0 presentation
30376!:mime	application/vnd.ms-powerpoint
30377# https://www.macdisk.com/macsigen.php
30378!:apple	????PPT3
30379!:ext	ppt
30380#??
30381# URL:	http://www.checkfilename.com/view-details/Microsoft-Works/RespageIndex/0/sTab/2/
30382>>88 	ubequad		0xa29a00aa004a1a72	: Microsoft
30383# URL:	http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
30384>>>80 	ubequad		0xc2dbcd28e20ace11	Works 4 document
30385!:mime	application/vnd.ms-works
30386!:apple	????AWWP
30387!:ext	wps
30388#
30389# URL:	http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database
30390>>>80 	ubequad		0xc3dbcd28e20ace11	Works 4 database
30391!:mime	application/vnd.ms-works-db
30392!:apple	????AWDB
30393!:ext	wdb/bdb
30394#??
30395>>88 	ubequad		0xa40700c04fb932ba	: Microsoft
30396# URL:	http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
30397>>>80 	ubequad		0xb25aa40e0a9ed111	Works 5-6 document
30398!:mime	application/vnd.ms-works
30399!:apple	????AWWP
30400!:ext	wps
30401# From:		Joerg Jenderek
30402# URL:		https://en.wikipedia.org/wiki/Microsoft_Works
30403# Reference:	http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
30404# Note:		probably version 6 and 7
30405# organize pictures like JPFG images in streams __cf1 with names like
30406# 001.JPG, 002.JPG ... in streams __fname
30407>>88 	ubequad		0xa1c800c04f612452	: Microsoft
30408>>>80 	ubequad		0xc0c7266eb98cd311	Works portfolio
30409# 2nd directory entry name PfOrder, 3rd __LastID and 4th __SizeUsed
30410#!:mime	application/x-ole-storage
30411# https://www.iana.org/assignments/media-types/application/vnd.ms-works
30412!:mime	application/vnd.ms-works
30413# https://extension.nirsoft.net/wsb
30414# like: wsbsamp.wsb WORKS2003_CD:\MSWorks\Common\Sammlung.wsb
30415!:ext	wsb
30416#??
30417# URL:	http://fileformats.archiveteam.org/wiki/Microsoft_Publisher
30418>>88 	ubequad		0x00c0000000000046	: Microsoft
30419>>>80 	ubequad		0x0112020000000000	Publisher
30420!:mime	application/vnd.ms-publisher
30421!:ext	pub
30422#
30423# URL:	http://fileformats.archiveteam.org/wiki/PPT
30424#??
30425>>88 	ubequad		0xa90300aa00510ea3	: Microsoft
30426>>>80 	ubequad		0x70ae7bea3bfbcd11	PowerPoint 95 presentation
30427!:mime	application/vnd.ms-powerpoint
30428# https://www.macdisk.com/macsigen.php
30429!:apple	????PPT3
30430!:ext	ppt/pot
30431#??
30432>>88 	ubequad		0x86ea00aa00b929e8	: Microsoft
30433>>>80 	ubequad		0x108d81649b4fcf11	PowerPoint 97-2003 presentation or template
30434!:mime	application/vnd.ms-powerpoint
30435!:apple	????PPT3
30436# /autostart/template
30437!:ext	ppt/pps/pot
30438# From:		Joerg Jenderek
30439# URL:		https://www.file-extensions.org/ppa-file-extension
30440#		https://en.wikipedia.org/wiki/Microsoft_PowerPoint#cite_note-231
30441# Reference:	http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
30442>>88 	ubequad		0x871800aa0060263b	: Microsoft
30443# only version 8 (97) tested; PowerPoint 4.0 to 11.0 (2004) (Wikipedia); 97 to 2003 (file-extensions.org)
30444>>>80 	ubequad		0xf04672810a72cf11	PowerPoint Addin or Wizard
30445# second, third and fourth directory entry name like VBA PROJECT PROJECTwm
30446# http://extension.nirsoft.net/pwz
30447!:mime	application/vnd.ms-powerpoint
30448# like: BSHPPT97.PPA "AutoContent Wizard.pwz"
30449!:ext	ppa/pwz
30450#
30451# From:		Joerg Jenderek
30452# URL:		http://fileformats.archiveteam.org/wiki/AWD_(At_Work_Document)
30453# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/a/awd-fax.trid.xml
30454# Note:		called "Microsoft At Work Fax document" by TrID
30455>>88 	ubequad		0xb29400dd010f2bf9	: Microsoft
30456>>>80 	ubequad		0x801cb0023de01a10	At Work fax Document
30457#!:mime	application/x-ole-storage
30458!:mime	image/x-ms-awd
30459!:ext	awd
30460#
30461# URL:	https://en.wikipedia.org/wiki/Microsoft_Project
30462#??
30463>>88 	ubequad		0xbe1100c04fb6faf1	: Microsoft
30464>>>80 	ubequad		0x3a8fb774c8c8d111	Project
30465!:mime	application/vnd.ms-project
30466!:ext	mpp
30467# From:		Joerg Jenderek
30468# URL:		https://en.wikipedia.org/wiki/Microsoft_Office_shared_tools#Binder
30469# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/o/obd.trid.xml
30470#		http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
30471# Note:		only version 8 tested and called "Office Binder Document" by TrID and
30472#		"Microsoft Office Binder File for Windows" version 97-2000 by DROID fmt/240
30473>>88 	ubequad		0xb21c00aa004ba90b	: Microsoft
30474>>>80 	ubequad		0x0004855964661b10	Office Binder Document, Template or wizard
30475# second directory entry name like Binder
30476# https://www.file-extensions.org/obd-file-extension
30477#!:mime	application/vnd.ms-binder
30478!:mime	application/x-msbinder
30479# obt for template; obz for Microsoft Office Binder wizard
30480!:ext	obd/obt/obz
30481#
30482# URL:		http://fileformats.archiveteam.org/wiki/WordPerfect
30483# Reference:	http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
30484#		https://github.com/OneWingedShark/WordPerfect/
30485#		blob/master/doc/SDK_Help/FileFormats/WPFF_DocumentStructure.htm
30486# From:		Joerg Jenderek
30487# Note:		internal version x.2 or 2.2 like in embedded ole6-PerfectOffice_MAIN.wpd
30488# 3rd directory entry name PerfectOffice_OBJECT and 2nd PerfectOffice_MAIN,
30489# which contains WordPerfect document \xffWPC signature handled by ./wordprocessors
30490>>88 	ubequad		0x19370000929679cd	: WordPerfect 7
30491>>>80 	ubequad		0xff739851ad2d2002	Document
30492!:mime	application/vnd.wordperfect
30493#!:apple	????WPC?
30494# https://fossies.org/linux/wp2latex/test/ole6.wpd
30495!:ext	wpd
30496#>>>>0	search/0xc01/s	\xffWPC			\b, WPC SIGNATURE
30497# inspect embedded WordPerfect document by ./wordprocessors with 1 space at end
30498#>>>>>&0	indirect	x	\b; contains
30499# GRR: the above expression does not work correctly
30500#
30501# URL:	http://fileformats.archiveteam.org/wiki/SHW_(Corel)
30502#???
30503>>88 	ubequad		0x99ae04021c007002	: WordPerfect
30504>>>80 	ubequad		0x62fe2e4099191b10	7-X3 presentation
30505!:mime	application/x-corelpresentations
30506#!:mime	application/x-shw-viewer
30507#!:mime	image/x-presentations
30508!:ext	shw
30509#
30510# URL:	http://www.checkfilename.com/view-details/WordPerfect-Office-X3/RespageIndex/0/sTab/2/
30511>>>80 	ubequad		0x60fe2e4099191b10	9 Graphic
30512#!:mime	application/x-wpg
30513#!:mime	image/x-wordperfect-graphics
30514!:mime	image/x-wpg
30515# https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd
30516!:apple	????WPC9
30517!:ext	wpg
30518#
30519# URL:	http://fileformats.archiveteam.org/wiki/StarOffice_binary_formats
30520>>88 	ubequad		0x996104021c007002	: StarOffice
30521>>>80 	ubequad		0x407e5cdc5cb31b10	StarWriter 3.0 document or template
30522# https://www.openoffice.org/framework/documentation/mimetypes/mimetypes.html
30523!:mime	application/x-starwriter
30524!:ext	sdw/vor
30525#
30526>>>80 	ubequad		0xa03f543fa6b61b10	StarCalc 3.0 spreadsheet or template
30527!:mime	application/x-starcalc
30528!:ext	sdc/vor
30529#
30530>>>80 	ubequad		0xe0aa10af6db31b10	StarDraw 3.0 drawing or template
30531!:mime	application/x-starimpress
30532#!:mime	application/x-stardraw
30533# sda ??
30534!:ext	sdd/sda/vor
30535#??
30536>>88 	ubequad		0x89cb008029e4b0b1	: StarOffice
30537>>>80 	ubequad		0x41d461633542d011	StarCalc 4.0 spreadsheet or template
30538!:mime	application/x-starcalc
30539!:ext	sdc/vor
30540#
30541>>>80 	ubequad		0x61b8a5c6d685d111	StarCalc 5.0 spreadsheet or template
30542!:mime	application/vnd.stardivision.cal
30543!:ext	sdc/vor
30544#
30545>>>80 	ubequad		0xc03c2d011642d011	StarImpress 4.0 presentation or template
30546!:mime	application/x-starimpress
30547!:ext	sdd/vor
30548#??
30549>>88 	ubequad		0xb12a04021c007002	: StarOffice
30550>>>80 	ubequad		0x600459d4fd351c10	StarMath 3.0
30551!:mime	application/x-starmath
30552!:ext	smf
30553#??
30554>>88 	ubequad		0x8e2c00001b4cc711	: StarOffice
30555>>>80 	ubequad		0xe0999cfb6d2c1c10	StarChart 3.0
30556!:mime	application/x-starchart
30557!:ext	sds
30558#??
30559>>88 	ubequad		0xa45e00a0249d57b1	: StarOffice
30560>>>80 	ubequad		0xb0e9048b0e42d011	StarWriter 4.0 document or template
30561!:mime	application/x-starwriter
30562!:ext	sdw/vor
30563#??
30564>>88 	ubequad		0x89ca008029e4b0b1	: StarOffice
30565>>>80 	ubequad		0xe1b7b3022542d011	StarMath 4.0
30566!:mime	application/x-starmath
30567!:ext	smf
30568#
30569>>>80 	ubequad		0xe0b7b3022542d011	StarChart 4.0
30570!:mime	application/x-starchart
30571!:ext	sds
30572#??
30573>>88 	ubequad		0xa53f00a0249d57b1	: StarOffice
30574>>>80 	ubequad		0x70c90a340de3d011	Master 4.0 document
30575!:mime	application/x-starwriter-global
30576!:ext	sgl
30577#??
30578>>88 	ubequad		0x89d0008029e4b0b1	: StarOffice
30579>>>80 	ubequad		0x40e6b5ffde85d111	StarMath 5.0
30580!:mime	application/vnd.stardivision.math
30581!:ext	smf
30582#
30583>>>80 	ubequad		0xa005892ebd85d111	StarDraw 5.0 drawing or template
30584!:mime	application/vnd.stardivision.draw
30585!:ext	sda/vor
30586#
30587>>>80 	ubequad		0x21725c56bc85d111	StarImpress 5.0 presentation or template
30588!:mime	application/vnd.stardivision.impress
30589# sda is used for what?
30590!:ext	sdd/vor/sda
30591#
30592>>>80 	ubequad		0x214388bfdd85d111	StarChart 5.0
30593!:mime	application/vnd.stardivision.chart
30594!:ext	sds
30595# ??
30596>>88 	ubequad		0xaab4006097da561a	: StarOffice
30597>>>80 	ubequad		0xd1f90cc2ae85d111	StarWriter 5.0 document or template
30598!:mime	application/vnd.stardivision.writer
30599!:ext	sdw/vor
30600#
30601>>>80 	ubequad		0xd3f90cc2ae85d111	Master 5.0 document
30602!:mime	application/vnd.stardivision.writer-global
30603!:ext	sgl
30604#??
30605# URL:	http://fileformats.archiveteam.org/wiki/FlashPix
30606>>88 	ubequad		0x855300aa00a1f95b	: Kodak
30607>>>80 	ubequad		0x0067615654c1ce11	FlashPIX Image
30608!:mime	image/vnd.fpx
30609!:apple	????FPix
30610!:ext	fpx
30611# URL:	https://en.wikipedia.org/wiki/SoftMaker_Office
30612>>88 	ubequad		0x95f600a0cc3cca14	: PlanMaker
30613>>>80 	ubequad		0x9174088a6452d411	document or template
30614!:mime	application/vnd.softmaker.planmaker
30615# pmv for template	https://www.file-extensions.org/pmv-file-extension
30616!:ext	pmd/pmv
30617# URL:		http://fileformats.archiveteam.org/wiki/MAX_(3ds_Max)
30618#		https://en.wikipedia.org/wiki/Autodesk_3ds_Max
30619# Reference:	http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
30620# Note:		called "3D Studio Max Scene" by TrID and "3DS Max" by DROID and
30621#		"3DSMax thumbnail" by XnView and verfied by `nconvert -info A380.max`
30622#		applies only to "newer" versions (about 2008-2020)
30623>>88 	ubequad		0x9fed04143144cc1e	: Autodesk
30624>>>80 	ubequad		0x7b8cdd1cc081a045	3ds Max
30625#!:mime	application/x-ole-storage
30626!:mime	model/x-autodesk-max
30627# like: https://static.free3d.com/models/dropbox/dropbox/sq/A380.7z/A380.max
30628!:ext	max
30629# also chr for character file according to DROID https://www.nationalarchives.gov.uk/PRONOM/fmt/978
30630#!:ext	max/chr
30631# remaining non null clsid
30632>>88 	default		x
30633# GRR: check again for non null clsid because wrong when called by indirect directive
30634>>>88 	ubequad		!0			: UNKNOWN
30635# https://reposcope.com/mimetype/application/x-ole-storage
30636!:mime	application/x-ole-storage
30637# according to file version 5.41 with -e soft option
30638#!:mime	application/CDFV2
30639#!:ext	???
30640>>>>80 	ubequad		!0			\b, clsid %#16.16llx
30641>>>>88 	ubequad		x			\b%16.16llx
30642
30643
30644#------------------------------------------------------------------------------
30645# $File: olf,v 1.4 2009/09/19 16:28:11 christos Exp $
30646# olf:  file(1) magic for OLF executables
30647#
30648# We have to check the byte order flag to see what byte order all the
30649# other stuff in the header is in.
30650#
30651# MIPS R3000 may also be for MIPS R2000.
30652# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
30653#
30654# Created by Erik Theisen <etheisen@openbsd.org>
30655# Based on elf from Daniel Quinlan <quinlan@yggdrasil.com>
306560	string		\177OLF		OLF
30657>4	byte		0		invalid class
30658>4	byte		1		32-bit
30659>4	byte		2		64-bit
30660>7	byte		0		invalid os
30661>7	byte		1		OpenBSD
30662>7	byte		2		NetBSD
30663>7	byte		3		FreeBSD
30664>7	byte		4		4.4BSD
30665>7	byte		5		Linux
30666>7	byte		6		SVR4
30667>7	byte		7		esix
30668>7	byte		8		Solaris
30669>7	byte		9		Irix
30670>7	byte		10		SCO
30671>7	byte		11		Dell
30672>7	byte		12		NCR
30673>5	byte		0		invalid byte order
30674>5	byte		1		LSB
30675>>16	leshort		0		no file type,
30676>>16	leshort		1		relocatable,
30677>>16	leshort		2		executable,
30678>>16	leshort		3		shared object,
30679# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de>
30680# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de>
30681>>16	leshort		4		core file
30682>>>(0x38+0xcc) string	>\0		of '%s'
30683>>>(0x38+0x10) lelong	>0		(signal %d),
30684>>16	leshort		&0xff00		processor-specific,
30685>>18	leshort		0		no machine,
30686>>18	leshort		1		AT&T WE32100 - invalid byte order,
30687>>18	leshort		2		SPARC - invalid byte order,
30688>>18	leshort		3		Intel 80386,
30689>>18	leshort		4		Motorola 68000 - invalid byte order,
30690>>18	leshort		5		Motorola 88000 - invalid byte order,
30691>>18	leshort		6		Intel 80486,
30692>>18	leshort		7		Intel 80860,
30693>>18	leshort		8		MIPS R3000_BE - invalid byte order,
30694>>18	leshort		9		Amdahl - invalid byte order,
30695>>18	leshort		10		MIPS R3000_LE,
30696>>18	leshort		11		RS6000 - invalid byte order,
30697>>18	leshort		15		PA-RISC - invalid byte order,
30698>>18	leshort		16		nCUBE,
30699>>18	leshort		17		VPP500,
30700>>18	leshort		18		SPARC32PLUS,
30701>>18	leshort		20		PowerPC,
30702>>18	leshort		0x9026		Alpha,
30703>>20	lelong		0		invalid version
30704>>20	lelong		1		version 1
30705>>36	lelong		1		MathCoPro/FPU/MAU Required
30706>8	string		>\0		(%s)
30707>5	byte		2		MSB
30708>>16	beshort		0		no file type,
30709>>16	beshort		1		relocatable,
30710>>16	beshort		2		executable,
30711>>16	beshort		3		shared object,
30712>>16	beshort		4		core file,
30713>>>(0x38+0xcc) string	>\0		of '%s'
30714>>>(0x38+0x10) belong	>0		(signal %d),
30715>>16	beshort		&0xff00		processor-specific,
30716>>18	beshort		0		no machine,
30717>>18	beshort		1		AT&T WE32100,
30718>>18	beshort		2		SPARC,
30719>>18	beshort		3		Intel 80386 - invalid byte order,
30720>>18	beshort		4		Motorola 68000,
30721>>18	beshort		5		Motorola 88000,
30722>>18	beshort		6		Intel 80486 - invalid byte order,
30723>>18	beshort		7		Intel 80860,
30724>>18	beshort		8		MIPS R3000_BE,
30725>>18	beshort		9		Amdahl,
30726>>18	beshort		10		MIPS R3000_LE - invalid byte order,
30727>>18	beshort		11		RS6000,
30728>>18	beshort		15		PA-RISC,
30729>>18	beshort		16		nCUBE,
30730>>18	beshort		17		VPP500,
30731>>18	beshort		18		SPARC32PLUS,
30732>>18	beshort		20		PowerPC or cisco 4500,
30733>>18	beshort		21		cisco 7500,
30734>>18	beshort		24		cisco SVIP,
30735>>18	beshort		25		cisco 7200,
30736>>18	beshort		36		cisco 12000,
30737>>18	beshort		0x9026		Alpha,
30738>>20	belong		0		invalid version
30739>>20	belong		1		version 1
30740>>36	belong		1		MathCoPro/FPU/MAU Required
30741
30742#------------------------------------------------------------------------------
30743# $File: openfst,v 1.1 2019/09/30 15:58:24 christos Exp $
30744# openfs:  file(1) magic for OpenFST (Weighted finite-state tranducer library)
30745
307460	long		0x7eb2fdd6	OpenFst binary FST data
30747>&0	pstring/l	x		\b, fst type: %s
30748>>&0	pstring/l	x		\b, arc type: %s
30749>>>&0	long		x		\b, version: %d
30750>>>>&20	quad		x		\b, num states: %lld
30751>>>>>&0	quad		>0		\b, num arcs: %lld
30752
307530	long    0x56515c	OpenFst binary FAR data, far type: stlist
30754>4	long 	x		\b, version: %d
30755
307560	long	0x7eb2f35c	OpenFst binary FAR data, far type: sttable
30757>4	long	x		\b, version: %d
30758
30759#------------------------------------------------------------
30760# $File: opentimestamps,v 1.1 2019/05/27 01:27:31 christos Exp $
30761# OpenTimestamps related magic entries
30762# https://opentimestamps.org/
30763# https://en.wikipedia.org/wiki/OpenTimestamps
30764# "Emanuele Cisbani" <emanuele.cisbani@gmail.com>
30765#------------------------------------------------------------
30766
30767# OpenTimestamps Proof .ots format.
30768# Magic is defined here:
30769# https://github.com/opentimestamps/python-opentimestamps/\
30770# blob/master/opentimestamps/core/timestamp.py#L273
30771
307720	string	\x00\x4f\x70\x65\x6e\x54\x69\x6d\x65\x73\x74\x61\x6d\x70\x73\x00 OpenTimestamps
30773>16	string	\x00\x50\x72\x6f\x6f\x66\x00\xbf\x89\xe2\xe8\x84\xe8\x92\x94\x01 Proof
30774
30775#------------------------------------------------------------------------------
30776# $File: oric,v 1.2 2022/04/25 17:28:20 christos Exp $
30777# Oric tape files
30778# From: Stefan A. Haubenthal <polluks@sdf.lonestar.org>
30779# References:
30780# http://fileformats.archiveteam.org/wiki/TAP_(Oric)
30781# http://fileformats.archiveteam.org/wiki/DSK_(Oric)
307820	string		\x16\x16\x16\x24	Oric tape,
30783>6	byte		=0x00			BASIC,
30784>6	byte		=0x80			memory block,
30785>7	byte		>0x00			autorun,
30786>13	string		x			"%.15s"
30787
307880	string		ORICDISK		Oric Image
307890	string		MFM_DISK		Oric Image
30790
30791#------------------------------------------------------------------------------
30792# $File: os2,v 1.14 2022/03/21 21:25:50 christos Exp $
30793# os2:  file(1) magic for OS/2 files
30794#
30795
30796# Provided 1998/08/22 by
30797# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
307981	search/100	InternetShortcut	MS Windows 95 Internet shortcut text
30799!:mime	application/x-mswinurl
30800!:ext	url
30801>17	search/100	URL= 			(URL=<
30802>>&0	string		x			\b%s>)
30803
30804# OS/2 URL objects
30805# Provided 1998/08/22 by
30806# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
30807#0	string	http:			OS/2 URL object text
30808#>5	string	>\			(WWW) <http:%s>
30809#0	string	mailto:			OS/2 URL object text
30810#>7	string	>\			(email) <%s>
30811#0	string	news:			OS/2 URL object text
30812#>5	string	>\			(Usenet) <%s>
30813#0	string	ftp:			OS/2 URL object text
30814#>4	string	>\			(FTP) <ftp:%s>
30815#0	string	file:			OS/2 URL object text
30816#>5	string	>\			(Local file) <%s>
30817
30818# >>>>> OS/2 INF/HLP <<<<<  (source: Daniel Dissett ddissett@netcom.com)
30819# URL:		http://fileformats.archiveteam.org/wiki/INF/HLP_(OS/2)
30820# Reference:	http://www.edm2.com/0308/inf.html
30821# Carl Hauser (chauser.parc@xerox.com) and
30822# Marcus Groeber (marcusg@ph-cip.uni-koeln.de)
30823# list the following header format in inf02a.doc:
30824#
30825#  int16 ID;           // ID magic word (5348h = "HS")
30826#  int8  unknown1;     // unknown purpose, could be third letter of ID
30827#  int8  flags;        // probably a flag word...
30828#                      //  bit 0: set if INF style file
30829#                      //  bit 4: set if HLP style file
30830#                      // patching this byte allows reading HLP files
30831#                      // using the VIEW command, while help files
30832#                      // seem to work with INF settings here as well.
30833#  int16 hdrsize;      // total size of header
30834#  int16 unknown2;     // unknown purpose
30835#
308360   string  HSP\x01\x9b\x00 OS/2 INF
30837!:mime	application/x-os2-inf
30838!:ext	inf
30839>107 string >0                      (%s)
308400   string  HSP\x10\x9b\x00     OS/2 HLP
30841!:mime	application/x-os2-hlp
30842!:ext	hlp
30843>107 string >0                      (%s)
30844
30845# From:		Joerg Jenderek
30846# URL:		http://fileformats.archiveteam.org/wiki/MSG_(OS/2)
30847# Reference:	https://github.com/OS2World/UTIL-SYSTEM-MKMSGF/blob/master/mkmsgf.h
30848# Note:		created by MKMSGF.EXE. Text source can be recreated by E_MSGF
30849#		example like OS001H.MSG
308500	string			\xffMKMSGF\0	OS/2 help message
30851!:mime	application/x-os2-msg
30852!:ext	msg
30853# identifier[3] like: DOS NET REX SYS ...
30854>8	string				x	'%.3s'
30855# msgnumber: number of messages
30856>11	uleshort			x	\b, %u messages
30857# firstmsgnumber; number of the first message like: some times 0 often 1 169 1000 3502
30858>13	uleshort      			>1	\b, 1st number %u
30859# offset16bit; 1~Index table has 16-bit offsets (files<64k) 0~Index table has 32-bit offsets
30860>15	ubyte				=0	\b, 32-bit
30861#>15	ubyte				=1	\b, 16-bit
30862# version; file version: 2~new 0~old
30863>16	uleshort      			!2	\b, version %u
30864# indextaboffset; offset of index table: 1F~after header 0~no index table for version 0?
30865>18	uleshort			>0
30866>>18		uleshort		!0x1f	\b, at %#x index
30867#	32-bit offset
30868>>15		ubyte			=0
30869# offset with message table
30870>>>(18.s)		ulelong		x	\b, at %#x
30871# 1st message
30872# http://www.os2museum.com/files/docs/os210ptk/os2-1.0-ptk-tools-1988.pdf
30873# message type: E~Error H~Help I~Information P~Prompt W~Warning ?
30874>>>>(&-4.l)		ubyte		x	%c-type
30875>>>>>&0			string		x	%s
30876#	16-bit offset
30877>>15		ubyte			=1
30878# msgnum; message number
30879>>>(18.s)		uleshort	x	\b, number %u
30880# msgindex; offset of message from begin of file
30881>>>(18.s+2)		uleshort	x	at %#x
30882# message type E H I P W ?
30883>>>>(&-2.s)		ubyte		x	%c-type
30884# skip newline carriage return
30885>>>>>&0			ubeshort	=0x0D0a
30886>>>>>>&0		string		x	%s
30887>>>>>&0			ubeshort	!0x0D0a
30888>>>>>>&-2		string		x	%s
30889#		for version 0 index table apparently at offset 1F
30890>16	uleshort      			0
30891>>15		ubyte			1
30892# 1st message 16-bit
30893>>>0x1F			uleshort	x	\b, at %#x
30894# message type: E~Error H~Help I~Information P~Prompt W~Warning ?
30895>>>>(0x1F.s)		ubyte		x	%c-type
30896>>>>>&0			string		x	%s
30897# 2nd message 16-bit
30898>>>0x21			uleshort	x	\b, at %#x
30899>>>>(0x21.s)		ubyte		x	%c-type
30900>>>>>&0			string		x	%s
30901# 3rd message 16-bit
30902>>>0x23			uleshort	x	\b, at %#x
30903>>>>(0x23.s)		ubyte		x	%c-type
30904>>>>>&0			string		x	%s
30905#		version 0 32-bit
30906>>15		ubyte			0
30907# 1st message 32-bit
30908>>>0x1f			ulelong		x	\b, at %#x
30909>>>>(0x1F.l)		ubyte		x	%c-type
30910>>>>>&0			string		x	%s
30911# 2nd message 32-bit
30912>>>0x23			ulelong		x	\b, at %#x
30913>>>>(0x23.l)		ubyte		x	%c-type
30914>>>>>&0			string		x	%s
30915# 3rd message 32-bit
30916>>>0x27			ulelong		x	\b, AT %#x
30917>>>>(0x27.l)		ubyte		x	 %c-type
30918>>>>>&0			string		x	%s
30919# countryinfo; offset of country info block: 0 for version 0
30920>20	uleshort			!0	\b, at %#x countryinfo
30921# nextcoutryinfo
30922>>22		uleshort		>0	\b, at %#x next
30923# reserved[5]; Must be 0
30924>>25	ulelong		!0		\b, RESERVED %#x
30925>>(20.s) use				os2-msg-info
30926#	display country info block of MKMSGF message file
309270	name		os2-msg-info
30928# bytesperchar; bytes per char: 1~SBCS 2~DBCS
30929>0	ubyte		>1		\b, %u bytes/char
30930# reserved; Not known
30931>1	uleshort	!0		\b, reserved %#x
30932# langfamilyID; language family ID like: 0~? 1~Arabic ... 7~German ... 9~English  ... 34~Slovene
30933>3	uleshort	>0		\b, language %u
30934# langversionID; like: 7_1~German 7_2~Swiss German 12_1~French 12_3~Canadian French
30935>>5	uleshort	x		\b_%u
30936# langfamilyID too high. This should not happen
30937>3	uleshort	>34		(invalid language)
30938# codepagesnumber; number of codepages like: 1 2 ... 16
30939>7	uleshort	x		\b, %u code page
30940# plural s
30941>7	uleshort	>1		\bs
30942# too many number of codepages. This should not happen
30943>7	uleshort	>16		(Too many)
30944# codepages[16]; codepages list like 437 850 ...
30945>7	uleshort	<17
30946# 1st code page
30947>>9	uleshort	>0		%u
30948# possible 2nd code page number
30949>>>7	uleshort	>1
30950>>>>11	uleshort	x		%u
30951# filename[260]; name of file like: dbaseos2.msg dde4c01e.msg os2ldr.mgr xdfh.msg ...
30952>41	string		x	 	\b, %s
30953
30954# OS/2 INI (this is a guess)
309550  string   \xff\xff\xff\xff\x14\0\0\0  OS/2 INI
30956!:mime	application/x-os2-ini
30957!:ext	ini
30958
30959# From:		Joerg Jenderek
30960# URL:		http://warpin.netlabs.org/
30961# Reference:    http://mark0.net/download/triddefs_xml.7z/defs/a/ark-wpi.trid.xml
30962# Note:		called by TrID "WarpIN Installer"
30963# probably magic at the beginning
309640	ubelong		=0x770402BE	WarpIN Installer
30965#>4	ubelong		=0x03000000
30966#!:mime	application/octet-stream
30967!:mime	application/x-os2-wpi
30968!:ext	wpi
30969# creator program name like: "reserved" or "WIC x.y.z"
30970>0x106	string		x		\b, created by %s
30971# name like: "reserved" or "OS/2 Netlabs"
30972>0x146	string		x		\b, '%s'
30973# name like: "N/A" "http://warpin.netlabs.org"
30974>0x186	string		x		\b, URL %s
30975
30976
30977#------------------------------------------------------------------------------
30978# $File: os400,v 1.5 2009/09/19 16:28:11 christos Exp $
30979# os400:  file(1) magic for IBM OS/400 files
30980#
30981# IBM OS/400 (i5/OS) Save file (SAVF) - gerardo.cacciari@gmail.com
30982# In spite of its quite variable format (due to internal memory page
30983# length differences between CISC and RISC versions of the OS) the
30984# SAVF structure hasn't suitable offsets to identify the catalog
30985# header in the first descriptor where there are some useful infos,
30986# so we must search in a somewhat large area for a particular string
30987# that represents the EBCDIC encoding of 'QSRDSSPC' (save/restore
30988# descriptor space) preceded by a two byte constant.
30989#
309901090	 search/7393	\x19\xDB\xD8\xE2\xD9\xC4\xE2\xE2\xD7\xC3 IBM OS/400 save file data
30991>&212	 byte		0x01			 \b, created with SAVOBJ
30992>&212	 byte		0x02			 \b, created with SAVLIB
30993>&212	 byte		0x07			 \b, created with SAVCFG
30994>&212	 byte		0x08			 \b, created with SAVSECDTA
30995>&212	 byte		0x0A			 \b, created with SAVSECDTA
30996>&212	 byte		0x0B			 \b, created with SAVDLO
30997>&212	 byte		0x0D			 \b, created with SAVLICPGM
30998>&212	 byte		0x11			 \b, created with SAVCHGOBJ
30999>&213	 byte		0x44			 \b, at least V5R4 to open
31000>&213	 byte		0x43			 \b, at least V5R3 to open
31001>&213	 byte		0x42			 \b, at least V5R2 to open
31002>&213	 byte		0x41			 \b, at least V5R1 to open
31003>&213	 byte		0x40			 \b, at least V4R5 to open
31004>&213	 byte		0x3F			 \b, at least V4R4 to open
31005>&213	 byte		0x3E			 \b, at least V4R3 to open
31006>&213	 byte		0x3C			 \b, at least V4R2 to open
31007>&213	 byte		0x3D			 \b, at least V4R1M4 to open
31008>&213	 byte		0x3B			 \b, at least V4R1 to open
31009>&213	 byte		0x3A			 \b, at least V3R7 to open
31010>&213	 byte		0x35			 \b, at least V3R6 to open
31011>&213	 byte		0x36			 \b, at least V3R2 to open
31012>&213	 byte		0x34			 \b, at least V3R1 to open
31013>&213	 byte		0x31			 \b, at least V3R0M5 to open
31014>&213	 byte		0x30			 \b, at least V2R3 to open
31015
31016#------------------------------------------------------------------------------
31017# $File: os9,v 1.8 2017/03/17 21:35:28 christos Exp $
31018#
31019# Copyright (c) 1996 Ignatios Souvatzis. All rights reserved.
31020#
31021# Redistribution and use in source and binary forms, with or without
31022# modification, are permitted provided that the following conditions
31023# are met:
31024# 1. Redistributions of source code must retain the above copyright
31025#    notice, this list of conditions and the following disclaimer.
31026# 2. Redistributions in binary form must reproduce the above copyright
31027#    notice, this list of conditions and the following disclaimer in the
31028#    documentation and/or other materials provided with the distribution.
31029#
31030# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
31031# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
31032# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
31033# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
31034# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
31035# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
31036# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
31037# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
31038# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
31039# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31040#
31041#
31042#
31043# OS9/6809 module descriptions:
31044#
310450	beshort		0x87CD	OS9/6809 module:
31046#
31047>6	byte&0x0f	0x00	non-executable
31048>6	byte&0x0f	0x01	machine language
31049>6	byte&0x0f	0x02	BASIC I-code
31050>6	byte&0x0f	0x03	Pascal P-code
31051>6	byte&0x0f	0x04	C I-code
31052>6	byte&0x0f	0x05	COBOL I-code
31053>6	byte&0x0f	0x06	Fortran I-code
31054#
31055>6	byte&0xf0	0x10	program executable
31056>6	byte&0xf0	0x20	subroutine
31057>6	byte&0xf0	0x30	multi-module
31058>6	byte&0xf0	0x40	data module
31059#
31060>6	byte&0xf0	0xC0	system module
31061>6	byte&0xf0	0xD0	file manager
31062>6	byte&0xf0	0xE0	device driver
31063>6	byte&0xf0	0xF0	device descriptor
31064#
31065# OS9/m68k stuff (to be continued)
31066#
310670	beshort		0x4AFC	OS9/68K module:
31068#
31069# attr
31070>0x14	byte&0x80	0x80	re-entrant
31071>0x14	byte&0x40	0x40	ghost
31072>0x14	byte&0x20	0x20	system-state
31073#
31074# lang:
31075#
31076>0x13	byte		1	machine language
31077>0x13	byte		2	BASIC I-code
31078>0x13	byte		3	Pascal P-code
31079>0x13	byte		4	C I-code
31080>0x13	byte		5	COBOL I-code
31081>0x13	byte		6	Fortran I-code
31082#
31083#
31084# type:
31085#
31086>0x12	byte		1	program executable
31087>0x12	byte		2	subroutine
31088>0x12	byte		3	multi-module
31089>0x12	byte		4	data module
31090>0x12	byte		11	trap library
31091>0x12	byte		12	system module
31092>0x12	byte		13	file manager
31093>0x12	byte		14	device driver
31094>0x12	byte		15	device descriptor
31095
31096#------------------------------------------------------------------------------
31097# $File: osf1,v 1.7 2009/09/19 16:28:11 christos Exp $
31098#
31099# Mach magic number info
31100#
311010	long		0xefbe	OSF/Rose object
31102# I386 magic number info
31103#
311040	short		0565	i386 COFF object
31105
31106#------------------------------------------------------------------------------
31107# $File: palm,v 1.15 2021/12/16 21:50:06 christos Exp $
31108# palm:	 file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks
31109#
31110# Brian Lalor <blalor@hcirisc.cs.binghamton.edu>
31111
31112# These are weak, byte 59 is not guaranteed to be 0 and there are
31113# 8 character identifiers at byte 60, one I found for appl is BIGb.
31114# What are the possibilities and where is this documented?
31115
31116# The common header format for PalmOS .pdb/.prc files is
31117# {
31118#         char            name[ 32 ];
31119#         Word            attributes;
31120#         Word            version;
31121#         DWord           creationDate;
31122#         DWord           modificationDate;
31123#         DWord           lastBackupDate;
31124#         DWord           modificationNumber;
31125#         DWord           appInfoID;
31126#         DWord           sortInfoID;
31127#         char            type[4];
31128#         char            creator[4];
31129#         DWord           uniqueIDSeed;
31130#         RecordListType  recordList;
31131# };
31132#
31133# Datestamps are unsigned seconds since the MacOS epoch (Jan 1, 1904),
31134# or Unix/POSIX time + 2082844800.
31135
311360		name		aportisdoc
31137# date is supposed to be big-endian seconds since 1 Jan 1904, but many
31138# files contain the timestamp in little-endian or a completely
31139# nonsensical value...
31140#>36		bedate-2082844800	>0	\b, created %s
31141# compression: 1=uncomp, 2=orig, 0x4448=HuffDic
31142>(78.L)		beshort		=1		\b, uncompressed
31143# compressed
31144>(78.L)		beshort		>1
31145>>(78.L+4)	belong		x		\b, %d bytes uncompressed
31146
31147# appl
31148#60		string		appl		PalmOS application
31149#>0		string		>\0		"%s"
31150
31151# HACK
31152#60		string		HACK		HackMaster hack
31153#>0		string		>\0		"%s"
31154
31155# iSiloX e-book
3115660		string		SDocSilX	iSiloX E-book
31157>0		string		>\0		"%s"
31158
31159# Mobipocket (www.mobipocket.com), donated by Carl Witty
31160# expanded by Ralf Brown
3116160		string	 	BOOKMOBI	Mobipocket E-book
31162!:mime	application/x-mobipocket-ebook
31163# MobiPocket stores a full title, pointed at by the belong at offset
31164# 0x54 in its header at (78.L), with length given by the belong at
31165# offset 0x58.
31166# there's no guarantee that the title string is null-terminated, but
31167# we currently can't specify a variable-length string where the length
31168# field is not at the start of the string; in practice, the data
31169# following the string always seems to start with a zero byte
31170>(78.L)		belong		x
31171>>&(&0x50.L-4)	string		>\0		"%s"
31172>0		use		aportisdoc
31173>>(78.L+0x68)	belong		>0		\b, version %d
31174>>(78.L+0x1C)	belong		!0		\b, codepage %d
31175>>(78.L+0x0C)	beshort	 	>0		\b, encrypted (type %d)
31176
31177# AportisDoc/PalmDOC
3117860		string		TEXtREAd	AportisDoc/PalmDOC E-book
31179>0		string		>\0		"%s"
31180>0		use		aportisdoc
31181
31182# Variety of PalmOS document types
31183# Michael-John Turner <mj@debian.org>
31184# Thanks to Hasan Umit Ezerce <humit@tr-net.net.tr> for his DocType
3118560	string			BVokBDIC	BDicty PalmOS document
31186>0	string			>\0		"%s"
3118760	string			DB99DBOS	DB PalmOS document
31188>0	string			>\0		"%s"
3118960	string			vIMGView	FireViewer/ImageViewer PalmOS document
31190>0	string			>\0		"%s"
3119160	string			PmDBPmDB	HanDBase PalmOS document
31192>0	string			>\0		"%s"
3119360	string			InfoINDB	InfoView PalmOS document
31194>0	string			>\0		"%s"
3119560	string			ToGoToGo	iSilo PalmOS document
31196>0	string			>\0		"%s"
3119760	string			JfDbJBas	JFile PalmOS document
31198>0	string			>\0		"%s"
3119960	string			JfDbJFil	JFile Pro PalmOS document
31200>0	string			>\0		"%s"
3120160	string			DATALSdb	List PalmOS document
31202>0	string			>\0		"%s"
3120360	string			Mdb1Mdb1	MobileDB PalmOS document
31204>0	string			>\0		"%s"
3120560	string			PNRdPPrs	PeanutPress PalmOS document
31206>0	string			>\0		"%s"
3120760	string			DataPlkr	Plucker PalmOS document
31208>0	string			>\0		"%s"
3120960	string			DataSprd	QuickSheet PalmOS document
31210>0	string			>\0		"%s"
3121160	string			SM01SMem	SuperMemo PalmOS document
31212>0	string			>\0		"%s"
3121360	string			TEXtTlDc	TealDoc PalmOS document
31214>0	string			>\0		"%s"
3121560	string			InfoTlIf	TealInfo PalmOS document
31216>0	string			>\0		"%s"
3121760	string			DataTlMl	TealMeal PalmOS document
31218>0	string			>\0		"%s"
3121960	string			DataTlPt	TealPaint PalmOS document
31220>0	string			>\0		"%s"
3122160	string			dataTDBP	ThinkDB PalmOS document
31222>0	string			>\0		"%s"
3122360	string			TdatTide	Tides PalmOS document
31224>0	string			>\0		"%s"
3122560	string			ToRaTRPW	TomeRaider PalmOS document
31226>0	string			>\0		"%s"
31227
31228# A GutenPalm zTXT etext for use on Palm Pilots (http://gutenpalm.sf.net)
31229# For version 1.xx zTXTs, outputs version and numbers of bookmarks and
31230#   annotations.
31231# For other versions, just outputs version.
31232#
3123360		string		zTXT		A GutenPalm zTXT e-book
31234>0		string		>\0		"%s"
31235>(0x4E.L)	byte		0
31236>>(0x4E.L+1)	byte		x		(v0.%02d)
31237>(0x4E.L)	byte		1
31238>>(0x4E.L+1)	byte		x		(v1.%02d)
31239>>>(0x4E.L+10)	beshort		>0
31240>>>>(0x4E.L+10) beshort		<2		- 1 bookmark
31241>>>>(0x4E.L+10) beshort		>1		- %d bookmarks
31242>>>(0x4E.L+14)	beshort		>0
31243>>>>(0x4E.L+14) beshort		<2		- 1 annotation
31244>>>>(0x4E.L+14) beshort		>1		- %d annotations
31245>(0x4E.L)	byte		>1		(v%d.
31246>>(0x4E.L+1)	byte		x		%02d)
31247
31248# Palm OS .prc file types
3124960		string		libr
31250# flags, only bit 0 or bit 6
31251# https://en.wikipedia.org/wiki/PRC_%28Palm_OS%29
31252# https://web.mit.edu/tytso/www/pilot/prc-format.html
31253>0x20		beshort&0xffbe	0
31254>>0		string		>\0		Palm OS dynamic library data "%s"
3125560		string		ptch		Palm OS operating system patch data
31256>0		string		>\0		"%s"
31257
31258# Mobipocket (www.mobipocket.com), donated by Carl Witty
3125960	string			BOOKMOBI	Mobipocket E-book
31260>0	string			>\0		"%s"
31261
31262#------------------------------------------------------------------------------
31263# $File: parix,v 1.5 2020/03/08 22:18:32 christos Exp $
31264#
31265# Parix COFF executables
31266# From: Ignatios Souvatzis <ignatios@cs.uni-bonn.de>
31267#
312680	beshort&0xefff	0x8ACE	PARIX
31269>0	byte&0xf0	0x80	T800
31270>0	byte&0xf0	0x90	T9000
31271>19	byte&0x02	0x02	executable
31272>19	byte&0x02	0x00	object
31273>19	byte&0x0c	0x00	not stripped
31274#------------------------------------------------------------------------------
31275# $File: parrot,v 1.2 2019/04/19 00:42:27 christos Exp $
31276# parrot: file(1) magic for Parrot Virtual Machine
31277# URL:	https://www.lua.org/
31278# From: Lubomir Rintel <lkundrak@v3.sk>
31279
31280# Compiled Parrot byte code
312810	string	\376PBC\r\n\032\n	Parrot bytecode
31282>64	byte	x			%d.
31283>72	byte	x			\b%d,
31284>8	byte	>0			%d byte words,
31285>16	byte	0			little-endian,
31286>16	byte	1			big-endian,
31287>32	byte	0			IEEE-754 8 byte double floats,
31288>32	byte	1			x86 12 byte long double floats,
31289>32	byte	2			IEEE-754 16 byte long double floats,
31290>32	byte	3			MIPS 16 byte long double floats,
31291>32	byte	4			AIX 16 byte long double floats,
31292>32	byte	5			4-byte floats,
31293>40	byte	x			Parrot %d.
31294>48	byte	x			\b%d.
31295>56	byte	x			\b%d
31296#------------------------------------------------------------------------------
31297# $File: pascal,v 1.4 2022/07/30 16:53:06 christos Exp $
31298# pascal:  file(1) magic for Pascal source
31299#
313000	search/8192	(input,		Pascal source text
31301!:mime	text/x-pascal
31302#0	regex		\^program	Pascal source text
31303#!:mime	text/x-pascal
31304#0	regex           	\^record		Pascal source text
31305#!:mime	text/x-pascal
31306
31307# Free Pascal
313080	string	PPU	Pascal unit
31309>3	string	x	\b, version %s
31310
31311# From:		Joerg Jenderek
31312# URL:		https://en.wikipedia.org/wiki/Dan_Bricklin
313130	string/b	Type
31314# URL:		https://dl.winworldpc.com/Dan%20Bricklins%20Demo%20II%20Version%202%20Manual.7z
31315# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/d/dbd-v2.trid.xml
31316>4	string		D2		Dan Bricklin's Demo 2 demo
31317#!:mime	application/octet-stream
31318!:ext	dbd
31319# URL:		https://muhaz.org/turbo-pascal-download-details.html
31320# From:		Joerg Jenderek
31321# Note:		used by Turbo Pascal 5.5 TOUR.EXE
31322>4	string		T2		Turbo Pascal TOUR data
31323#!:mime	application/octet-stream
31324!:mime	application/x-borland-cbt
31325!:ext	cbt
31326# WHAT iS THAT?
31327#>4	string		\040P		Dan Bricklin's Demo 2 foo
31328#!:mime	application/octet-stream
31329# _PPRINT.SG2 _PASCII.SG2
31330#!:ext	sg2
31331# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/d/dbd-gen.trid.xml
31332>4	default		x		Dan Bricklin's Demo demo (generic)
31333#!:mime	application/octet-stream
31334!:ext	dbd
31335
31336#------------------------------------------------------------------------------
31337# $File: pbf,v 1.3 2019/04/19 00:42:27 christos Exp $
31338# file(1) magic(5) data for OpenStreetMap
31339
31340# OpenStreetMap Protocolbuffer Binary Format (.osm.pbf)
31341# https://wiki.openstreetmap.org/wiki/PBF_Format
31342# From: Markus Heidelberg <markus.heidelberg@web.de>
313430	belong&0xfffffff0	0
31344>4	beshort			0x0A09
31345>>6	string			OSMHeader	OpenStreetMap Protocolbuffer Binary Format
31346
31347#------------------------------------------------------------------------------
31348# $File: pbm,v 1.6 2009/09/19 16:28:11 christos Exp $
31349# pbm:  file(1) magic for Portable Bitmap files
31350#
31351# XXX - byte order?
31352#
313530	short	0x2a17	"compact bitmap" format (Poskanzer)
31354#------------------------------------------------------------------------------
31355# pc88:  file(1) magic for the NEC Home Computer
31356# v1.0
31357# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
31358
31359# PC88 2D disk image
313600x20		ulelong&0xFFFFFEFF	0x2A0
31361>0x10		string		\0\0\0\0\0\0\0\0\0\0
31362>>0x280		string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
31363>>>0x1A		ubyte&0xEF	0
31364>>>>0x1B	ubyte&0x8F	0
31365>>>>>0x1B	ubyte&70	<0x40
31366>>>>>>0x1C	ulelong	>0x21
31367>>>>>>>0		regex	[[:print:]]*	NEC PC-88 disk image, name=%s
31368>>>>>>>>0x1B	ubyte	0	\b, media=2D
31369>>>>>>>>0x1B	ubyte	0x10	\b, media=2DD
31370>>>>>>>>0x1B	ubyte	0x20	\b, media=2HD
31371>>>>>>>>0x1B	ubyte	0x30	\b, media=1D
31372>>>>>>>>0x1B	ubyte	0x40	\b, media=1DD
31373>>>>>>>>0x1A	ubyte	0x10	\b, write-protected
31374
31375
31376
31377
31378#------------------------------------------------------------------------------
31379# pc98:  file(1) magic for the MSX Home Computer
31380# v1.0
31381# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
31382
31383# Maki-chan v1 Graphic format
31384# The image resolution should be X=(44.L - 40.L) and Y=(46.L - 42.L), but I couldn't find a way to do so
31385# http://www.jisyo.com/viewer/faq/maki_tech.htm
313860	string/b		MAKI01 	Maki-chan v1.
31387>6	ubyte|0x20	x		\b%c image
31388>8	ubelong		>0x40404040	\b, system ID:
31389>>8	byte		x		%c
31390>>9	byte		x		\b%c
31391>>10	byte		x		\b%c
31392>>11	byte		x		\b%c
31393>44	ubeshort	x		\b, %dx
31394>46	ubeshort	x		\b%d
31395>38	ubeshort&2	0		\b, 16 paletted RGB colors
31396>38	ubeshort&2	2		\b, 8 fixed RGB colors
31397>38	ubeshort&1	1		\b, 2:1 dot aspect ratio
31398
31399# Maki-chan v2 Graphic format
31400# http://www.jisyo.com/viewer/faq/mag_tech.htm
31401# https://mooncore.eu/bunny/txt/makichan.htm
31402# http://metanest.jp/mag/mag.xhtml
314030	string/b		MAKI02\ \ 	Maki-chan v2 image,
31404>8	byte		x		system ID: %c
31405>9	byte		x		\b%c
31406>10	byte		x		\b%c
31407>11	byte		x		\b%c,
31408>13	search/0x200	\x1A
31409#Maki-chan video modes are a bit messy and seems to have been expanded over the years without too much planing:
31410#1) When offset1(ubeshort) !=0x0344:
31411# 1.1) And  offset3(ubyte).b7=0:
31412# - b0=pixel aspect ratio: 1=2:1   (note: this ignores that the machine's 1:1 pixel aspect ratio isn't really 1:1)
31413# - b1=number of colors: 0=16 colors, 1=8 colors
31414# - b2=Palette or fixed colors flag (called "analog" and "digital" in the doc): 0=Paletted, 1=Fixed colors encoded directly in the pixel data
31415# 1.2) And  offset3(ubyte).B7=1:
31416# - b0=256 paletted colors
31417# - b1=256 fixed colors using the MSX SCR8 palette
31418#2) When offset1(ubeshort) =0x0344:
31419# - 256x212 image with 19268 YJK colors. The usual resolution and color information fields from the file must be ignored
31420>>&1	ubeshort	0x0344		256x212, 19268 fixed YJK colors
31421>>&1	ubeshort	!0x0344
31422>>>&5	uleshort+1	x		%dx
31423>>>&7	uleshort+1	x		\b%d,
31424>>>&0	ubyte&0x86	0x00		16 paletted RGB colors
31425>>>&0	ubyte&0x86	0x02		8 paletted RGB colors
31426>>>&0	ubyte&0x86	0x04		16 fixed RGB colors
31427>>>&0	ubyte&0x86	0x06		8 fixed RGB colors
31428>>>&0	ubyte&0x81	0x80		256 paletted RGB colors
31429>>>&0	ubyte&0x81	0x81		256 fixed MSX-SCR8 colors
31430>>>&0	ubyte&0x01	1		\b, 2:1 dot aspect ratio
31431
31432# XLD4 (Q4) picture
3143311	string/b	MAJYO		XLD4(Q4) picture
31434
31435# Yanagisawa Pi picture
31436#0	string		Pi\x1A\0	Yanagisawa Pi picture
31437#>3	search/0x200	\x04
314380	string		Pi
31439>2	search/0x200	\x1A
31440>>&0	ubyte		0
31441>>>&3	ubyte		4		Yanagisawa Pi 16 color picture,
31442>>>&4	byte		x		system ID: %c
31443>>>&5	byte		x		\b%c
31444>>>&6	byte		x		\b%c
31445>>>&7	byte		x		\b%c,
31446>>>&10	ubeshort	x		%dx
31447>>>&12	ubeshort	x		\b%d
31448>>>&3	ubyte		8		Yanagisawa Pi 256 color picture
31449>>>&4	byte		x		system ID: %c
31450>>>&5	byte		x		\b%c
31451>>>&6	byte		x		\b%c
31452>>>&7	byte		x		\b%c,
31453>>>&10	ubeshort	x		%dx
31454>>>&12	ubeshort	x		\b%d
31455
31456#------------------------------------------------------------------------------
31457# $File: pci_ids,v 1.1 2022/04/02 14:47:42 christos Exp $
31458# pci.ids:  file(1) magic for PCI specific informations
31459#
31460
31461# Vendor identification (ID)		https://pci-ids.ucw.cz/v2.2/pci.ids
31462# show hexadecimal PCI vendor identification in human readable text form
314630	name	PCI-vendor
31464#			ID	vendor name
31465#>0	uleshort	=0x0f00	fOO
31466>0	uleshort	=0x1000	Broadcom
31467>0	uleshort	=0x1002	AMD/ATI
31468>0	uleshort	=0x1013	Cirrus Logic
31469>0	uleshort	=0x1014	IBM
31470>0	uleshort	=0x1022	AMD
31471>0	uleshort	=0x1050	Winbond
31472>0	uleshort	=0x105a	Promise
31473>0	uleshort	=0x1095	Silicon
31474>0	uleshort	=0x10EC	Realtek
31475>0	uleshort	=0x10de	NVIDIA
31476>0	uleshort	=0x1106	VIA
31477# Woodward McCoach, Inc.
31478>0	uleshort	=0x1231	Woodward
31479#
31480>0	uleshort	=0x1234	Bochs
31481>0	uleshort	=0x15ad	VMware
31482>0	uleshort	=0x1af4	Virtio
31483>0	uleshort	=0x1b36	QEMU
31484>0	uleshort	=0x1de1	Tekram
31485# maybe also Promise?
31486#>0	uleshort	=0x4289	Promise
31487#>0	uleshort	=0x66a1	FOO
31488>0	uleshort	=0x8086	Intel
31489>0	uleshort	=0x9004	Adaptec
31490# also Adaptec; but no example
31491>0	uleshort	=0x9005	Adaptec
31492# for unknown/missing manufactors
31493>0	default		x	UNKNOWN
31494>>0	uleshort		x	(%#4.4x)
31495
31496# https://blog.ladsai.com/pci-configuration-space-class-code.html
31497# Base class code			https://wiki.osdev.org/PCI
31498# show hexadecimal PCI class+sub+ProgIF identification in human readable text form
314990	name		PCI-class
31500#>0	ubyte		x	CLASS=%x
31501>0	ubyte		x
31502# Device was built prior definition of the class code field
31503>>0	ubyte		0x00	PRIOR
31504# Any device except for VGA-Compatible devices like: 2975BIOS.BIN Trm3x5.bin
31505# BUT also NVidia44.bin vgabios-stdvga-bin.rom
31506#>>>0	ubyte		0x00		NOT VGA
31507# VGA-Compatible Device; NO EXAMPLE found here!!
31508#>>>0	ubyte		0x01		VGA
31509# like 4243.bin
31510#>>>0	ubyte		0x04		SUB_CLASS_4
31511>>0	ubyte		0x01	storage controller
31512# device sub-type and its definition is dependent upon the base-type code
31513>>>1	ubyte		0x00		SCSI
31514>>>1	ubyte		0x01		IDE
31515>>>1	ubyte		0x02		Floppy
31516>>>1	ubyte		0x03		IPI
31517>>>0	ubyte		0x04		RAID
31518>>>1	ubyte		0x05		ATA
31519>>>1	ubyte		0x06		SATA
31520>>>1	ubyte		0x07		SAS
31521>>>1	ubyte		0x08		NVM
31522# 4650_sr5.bin "PROMISE" "FT TX4650 Ary X"
31523>>>1	ubyte		0x80		OTHER
31524>>0	ubyte		0x02	network controller
31525>>>1	ubyte		0x00		ethernet
31526>>>1	ubyte		0x01		token ring
31527>>>1	ubyte		0x02		FDDI
31528>>>1	ubyte		0x03		ATM
31529>>>1	ubyte		0x04		ISDN
31530>>>1	ubyte		0x05		WorldFip
31531# PICMG 2.14 Multi Computing
31532>>>1	ubyte		0x06		PICMG
31533>>>1	ubyte		0x80		OTHER
31534>>0	ubyte		0x03	display controller
31535>>0	ubyte		0x04	multimedia controller
31536>>0	ubyte		0x05	memory controller
31537>>0	ubyte		0x06	bridge device
31538# Simple Communication Controllers
31539>>0	ubyte		0x07	communication controller
31540# Base System Peripherals
31541>>0	ubyte		0x08	base peripheral
31542# Input Devices
31543>>0	ubyte		0x09	input device
31544# Docking Stations
31545>>0	ubyte		0x0A	docking station
31546>>0	ubyte		0x0B	processor
31547>>0	ubyte		0x0C	serial bus controller
31548>>0	ubyte		0x0D	wireless controller
31549# Intelligent I/O Controllers
31550>>0	ubyte		0x0E	I/O controller
31551# Satellite Communication Controllers
31552>>0	ubyte		0x0F	satellite controller
31553# Encryption/Decryption Controllers
31554>>0	ubyte		0x10	encryption controller
31555# Data Acquisition and Signal Processing Controllers
31556>>0	ubyte		0x11	signal controller
31557# Processing Accelerator
31558>>0	ubyte		0x12	processing accelerator
31559# Non-Essential Instrumentation
31560>>0	ubyte		0x13	non-essential
31561# reserved or unassigned
31562>>0	default		x
31563# device does not fit any defined class; Unassigned Class (Vendor specific)
31564>>>0		ubyte	0xFF		UNASSIGNED
31565# THIS SHOULD NOT HAPPEN! BUT CLASS=8f for Promise 4650_sr5.bin 8660_sr5.bin
31566>>>0		default	x		RESERVED
31567>>>>0 	ubyte	x		(%#x)
31568# Prog IF of PCI class code?
31569# defines the specific device programming interface
31570>2	ubyte		>0	\b, ProgIF=%u
31571
31572#------------------------------------------------------------------------------
31573# $File: pcjr,v 1.1 2021/01/09 15:09:58 christos Exp $
31574# pcjr:  file(1) magic for PCjr Cartridge image file format
31575# From: Francis Laniel <laniel_francis@privacyrequired.com>
315760	string	PCjr
31577>0x80	beshort	0x55aa	PCjr Cartridge image
31578>0x200	beshort	0x55aa	PCjr Cartridge image
31579
31580#------------------------------------------------------------------------------
31581# $File: pdf,v 1.16 2021/07/30 11:47:07 christos Exp $
31582# pdf:  file(1) magic for Portable Document Format
31583#
31584
315850	name	pdf
31586>8	search		/Count
31587>>&0	regex		[0-9]+		\b, %s pages
31588>8	search/512	/Filter/FlateDecode/	(zip deflate encoded)
31589
315900	string		%PDF-		PDF document
31591!:mime	application/pdf
31592!:strength +60
31593!:ext	pdf
31594>5	byte		x		\b, version %c
31595>7	byte		x		\b.%c
31596>0	use		pdf
31597
315980	string		\012%PDF-	PDF document
31599!:mime	application/pdf
31600!:strength +60
31601!:ext	pdf
31602>6	byte		x		\b, version %c
31603>8	byte		x		\b.%c
31604>0	use		pdf
31605
316060	string		\xef\xbb\xbf%PDF-	PDF document (UTF-8)
31607!:mime	application/pdf
31608!:strength +60
31609!:ext	pdf
31610>6	byte		x		\b, version %c
31611>8	byte		x		\b.%c
31612>0	use		pdf
31613
31614# From: Nick Schmalenberger <nick@schmalenberger.us>
31615# Forms Data Format
316160       string          %FDF-           FDF document
31617!:mime application/vnd.fdf
31618!:strength +60
31619!:ext	pdf
31620>5      byte            x               \b, version %c
31621>7      byte            x               \b.%c
31622
316230	search/256	%PDF-		PDF document
31624!:mime	application/pdf
31625!:strength +60
31626!:ext	pdf
31627>&0	byte		x		\b, version %c
31628>&2	byte		x		\b.%c
31629>0	use		pdf
31630
31631#------------------------------------------------------------------------------
31632# $File: pdp,v 1.11 2017/03/17 21:35:28 christos Exp $
31633# pdp:  file(1) magic for PDP-11 executable/object and APL workspace
31634#
316350	lelong		0101555		PDP-11 single precision APL workspace
316360	lelong		0101554		PDP-11 double precision APL workspace
31637#
31638# PDP-11 a.out
31639#
316400	leshort		0407		PDP-11 executable
31641>8	leshort		>0		not stripped
31642>15	byte		>0		- version %d
31643
31644# updated by Joerg Jenderek at Mar 2013
31645# GRR: line below too general as it catches also Windows precompiled setup information *.PNF
316460	leshort		0401
31647# skip *.PNF with WinDirPathOffset 58h
31648>68	ulelong		!0x00000058	PDP-11 UNIX/RT ldp
31649# skip *.PNF with high byte of InfVersionDatumCount zero
31650#>>15	byte		!0		PDP-11 UNIX/RT ldp
316510	leshort		0405		PDP-11 old overlay
31652
316530	leshort		0410		PDP-11 pure executable
31654>8	leshort		>0		not stripped
31655>15	byte		>0		- version %d
31656
316570	leshort		0411		PDP-11 separate I&D executable
31658>8	leshort		>0		not stripped
31659>15	byte		>0		- version %d
31660
316610	leshort		0437		PDP-11 kernel overlay
31662
31663# These last three are derived from 2.11BSD file(1)
316640	leshort		0413		PDP-11 demand-paged pure executable
31665>8	leshort		>0		not stripped
31666
316670	leshort		0430		PDP-11 overlaid pure executable
31668>8	leshort		>0		not stripped
31669
316700	leshort		0431		PDP-11 overlaid separate executable
31671>8	leshort		>0		not stripped
31672#------------------------------------------------------------------------------
31673# $File: perl,v 1.26 2017/02/21 18:34:55 christos Exp $
31674# perl:  file(1) magic for Larry Wall's perl language.
31675#
31676# The `eval' lines recognizes an outrageously clever hack.
31677# Keith Waclena <keith@cerberus.uchicago.edu>
31678# Send additions to <perl5-porters@perl.org>
316790	search/1024	eval\ "exec\ perl		Perl script text
31680!:mime	text/x-perl
316810	search/1024	eval\ "exec\ /bin/perl		Perl script text
31682!:mime	text/x-perl
316830	search/1024	eval\ "exec\ /usr/bin/perl	Perl script text
31684!:mime	text/x-perl
316850	search/1024	eval\ "exec\ /usr/local/bin/perl	Perl script text
31686!:mime	text/x-perl
316870	search/1024	eval\ 'exec\ perl		Perl script text
31688!:mime	text/x-perl
316890	search/1024	eval\ 'exec\ /bin/perl		Perl script text
31690!:mime	text/x-perl
316910	search/1024	eval\ 'exec\ /usr/bin/perl	Perl script text
31692!:mime	text/x-perl
316930	search/1024	eval\ 'exec\ /usr/local/bin/perl	Perl script text
31694!:mime	text/x-perl
316950	search/1024	eval\ '(exit\ $?0)'\ &&\ eval\ 'exec	Perl script text
31696!:mime	text/x-perl
316970	string	#!/usr/bin/env\ perl	Perl script text executable
31698!:mime	text/x-perl
316990	string	#!\ /usr/bin/env\ perl	Perl script text executable
31700!:mime	text/x-perl
317010	string	#!
31702>0	regex	\^#!.*/bin/perl([[:space:]].*)*$	Perl script text executable
31703!:mime	text/x-perl
31704
31705# by Dmitry V. Levin and Alexey Tourbin
31706# check the first line
317070	search/8192	package
31708>0	regex		\^package[\ \t]+[0-9A-Za-z_:]+\ *;	Perl5 module source text
31709!:strength + 40
31710# not 'p', check other lines
317110	search/8192	!p
31712>0	regex		\^package[\ \t]+[0-9A-Za-z_:]+\ *;
31713>>0	regex		\^1\ *;|\^(use|sub|my)\ .*[(;{=]	Perl5 module source text
31714!:strength + 75
31715
31716# Perl POD documents
31717# From: Tom Hukins <tom@eborcom.com>
317180	search/1024/W	\=pod\n		Perl POD document text
317190	search/1024/W	\n\=pod\n	Perl POD document text
317200	search/1024/W	\=head1\ 	Perl POD document text
317210	search/1024/W	\n\=head1\ 	Perl POD document text
317220	search/1024/W	\=head2\ 	Perl POD document text
317230	search/1024/W	\n\=head2\ 	Perl POD document text
317240	search/1024/W	\=encoding\ 	Perl POD document text
317250	search/1024/W	\n\=encoding\ 	Perl POD document text
31726
31727
31728# Perl Storable data files.
317290	string	perl-store	perl Storable (v0.6) data
31730>4	byte	>0	(net-order %d)
31731>>4	byte	&01	(network-ordered)
31732>>4	byte	=3	(major 1)
31733>>4	byte	=2	(major 1)
31734
317350	string	pst0	perl Storable (v0.7) data
31736>4	byte	>0
31737>>4	byte	&01	(network-ordered)
31738>>4	byte	=5	(major 2)
31739>>4	byte	=4	(major 2)
31740>>5	byte	>0	(minor %d)
31741
31742# This is Debian #742949 by Zefram <zefram@fysh.org>:
31743# -----------------------------------------------------------
31744# The Perl module Hash::SharedMem
31745# <https://metacpan.org/release/Hash-SharedMem> defines a file format
31746# for a key/value store.  Details of the file format are in the "DESIGN"
31747# file in the module distribution.  Magic:
317480	bequad	=0xa58afd185cbf5af7	Hash::SharedMem master file, big-endian
31749>8	bequad	<0x1000000
31750>>15	byte	>2	\b, line size 2^%d byte
31751>>14	byte	>2	\b, page size 2^%d byte
31752>>13	byte	&1
31753>>>13	byte	>1	\b, max fanout %d
317540	lequad	=0xa58afd185cbf5af7	Hash::SharedMem master file, little-endian
31755>8	lequad	<0x1000000
31756>>8	byte	>2	\b, line size 2^%d byte
31757>>9	byte	>2	\b, page size 2^%d byte
31758>>10	byte	&1
31759>>>10	byte	>1	\b, max fanout %d
317600	bequad	=0xc693dac5ed5e47c2	Hash::SharedMem data file, big-endian
31761>8	bequad	<0x1000000
31762>>15	byte	>2	\b, line size 2^%d byte
31763>>14	byte	>2	\b, page size 2^%d byte
31764>>13	byte	&1
31765>>>13	byte	>1	\b, max fanout %d
317660	lequad	=0xc693dac5ed5e47c2	Hash::SharedMem data file, little-endian
31767>8	lequad	<0x1000000
31768>>8	byte	>2	\b, line size 2^%d byte
31769>>9	byte	>2	\b, page size 2^%d byte
31770>>10	byte	&1
31771>>>10	byte	>1	\b, max fanout %d
31772
31773#------------------------------------------------------------------------------
31774# $File: pgf,v 1.3 2021/02/23 00:51:10 christos Exp $
31775# pgf: file(1) magic for Progressive Graphics File (PGF)
31776#
31777# <http://www.libpgf.org/uploads/media/PGF_Details_01.pdf>
31778# 2013 by Philipp Hahn <pmhahn debian org>
317790 string PGF Progressive Graphics image data,
31780!:mime image/x-pgf
31781>3	string	2	version %s,
31782>3	string	4	version %s,
31783>3	string	5	version %s,
31784>3	string	6	version %s,
31785#	PGFPreHeader
31786#>>4	lelong	x	header size %d,
31787#	PGFHeader
31788>>8	lelong	x	%d x
31789>>12	lelong	x	%d,
31790>>16	byte	x	%d levels,
31791>>17	byte	x	compression level %d,
31792>>18	byte	x	%d bpp,
31793>>19	byte	x	%d channels,
31794>>20	clear	x
31795>>20	byte	0	bitmap,
31796>>20	byte	1	gray scale,
31797>>20	byte	2	indexed color,
31798>>20	byte	3	RGB color,
31799>>20	byte	4	CMYK color,
31800>>20	byte	5	HSL color,
31801>>20	byte	6	HSB color,
31802>>20	byte	7	multi-channel,
31803>>20	byte	8	duo tone,
31804>>20	byte	9	LAB color,
31805>>20	byte	10	gray scale 16,
31806>>20	byte	11	RGB color 48,
31807>>20	byte	12	LAB color 48,
31808>>20	byte	13	CMYK color 64,
31809>>20	byte	14	deep multi-channel,
31810>>20	byte	15	duo tone 16,
31811>>20	byte	17	RGBA color,
31812>>20	byte	18	gray scale 32,
31813>>20	byte	19	RGB color 12,
31814>>20	byte	20	RGB color 16,
31815>>20	byte	255	unknown format,
31816>>20	default	x	format
31817>>>20	byte	x	\b %d,
31818>>21	byte	x	%d bpc
31819#	PGFPostHeader
31820#	Level-Sizes
31821#>>(4.l+4)	lelong x level 0 size: %d
31822#>>(4.l+8)	lelong x level 1 size: %d
31823#>>(4.l+12)	lelong x level 2 size: %d
31824
31825#------------------------------------------------------------------------------
31826# $File: pgp,v 1.25 2021/04/26 15:56:00 christos Exp $
31827# pgp:  file(1) magic for Pretty Good Privacy
31828
31829# Handling of binary PGP keys is in pgp-binary-keys.
31830# see https://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html
31831#
318320	beshort		0xa600			PGP encrypted data
31833#!:mime	application/pgp-encrypted
31834#0	string		-----BEGIN\040PGP	text/PGP armored data
31835!:mime	text/PGP # encoding: armored data
31836#>15	string	PUBLIC\040KEY\040BLOCK-	public key block
31837#>15	string	MESSAGE-		message
31838#>15	string	SIGNED\040MESSAGE-	signed message
31839#>15	string	PGP\040SIGNATURE-	signature
31840
31841# Update:	Joerg Jenderek
31842# URL:		http://en.wikipedia.org/wiki/Pretty_Good_Privacy
31843# Reference:	https://reposcope.com/mimetype/application/pgp-keys
318442	string	---BEGIN\040PGP\040PRIVATE\040KEY\040BLOCK-	PGP private key block
31845#!:mime	text/PGP
31846!:mime	application/pgp-keys
31847!:ext	asc
318482	string	---BEGIN\040PGP\040PUBLIC\040KEY\040BLOCK-	PGP public key block
31849!:mime	application/pgp-keys
31850!:ext	asc
31851>10	search/100	\n\n
31852>>&0	use		pgp
318530	string	-----BEGIN\040PGP\040MESSAGE-		PGP message
31854# https://reposcope.com/mimetype/application/pgp-encrypted
31855#!:mime	application/pgp
31856!:mime	application/pgp-encrypted
31857!:ext	asc
31858#!:ext	asc/pgp/gpg
31859>10	search/100	\n\n
31860>>&0	use		pgp
31861# Reference:	https://www.gnupg.org/gph/en/manual/x135.html
318620	string	-----BEGIN\040PGP\040SIGNED\040MESSAGE-	PGP signed message
31863#!:mime	text/plain
31864!:mime	text/PGP
31865#!:mime	application/pgp
31866!:ext	asc
318670	string	-----BEGIN\040PGP\040SIGNATURE-		PGP signature
31868# https://reposcope.com/mimetype/application/pgp-signature
31869!:mime	application/pgp-signature
31870!:ext	asc
31871>10	search/100	\n\n
31872>>&0	use		pgp
31873
31874# Decode the type of the packet based on it's base64 encoding.
31875# Idea from Mark Martinec
31876# The specification is in RFC 4880, section 4.2 and 4.3:
31877# https://tools.ietf.org/html/rfc4880#section-4.2
31878
318790	name		pgp
31880>0	byte		0x67		Reserved (old)
31881>0	byte		0x68		Public-Key Encrypted Session Key (old)
31882>0	byte		0x69		Signature (old)
31883>0	byte		0x6a		Symmetric-Key Encrypted Session Key (old)
31884>0	byte		0x6b		One-Pass Signature (old)
31885>0	byte		0x6c		Secret-Key (old)
31886>0	byte		0x6d		Public-Key (old)
31887>0	byte		0x6e		Secret-Subkey (old)
31888>0	byte		0x6f		Compressed Data (old)
31889>0	byte		0x70		Symmetrically Encrypted Data (old)
31890>0	byte		0x71		Marker (old)
31891>0	byte		0x72		Literal Data (old)
31892>0	byte		0x73		Trust (old)
31893>0	byte		0x74		User ID (old)
31894>0	byte		0x75		Public-Subkey (old)
31895>0	byte		0x76		Unused (old)
31896>0	byte		0x77
31897>>1	byte&0xc0	0x00		Reserved
31898>>1	byte&0xc0	0x40		Public-Key Encrypted Session Key
31899>>1	byte&0xc0	0x80		Signature
31900>>1	byte&0xc0	0xc0		Symmetric-Key Encrypted Session Key
31901>0	byte		0x78
31902>>1	byte&0xc0	0x00		One-Pass Signature
31903>>1	byte&0xc0	0x40		Secret-Key
31904>>1	byte&0xc0	0x80		Public-Key
31905>>1	byte&0xc0	0xc0		Secret-Subkey
31906>0	byte		0x79
31907>>1	byte&0xc0	0x00		Compressed Data
31908>>1	byte&0xc0	0x40		Symmetrically Encrypted Data
31909>>1	byte&0xc0	0x80		Marker
31910>>1	byte&0xc0	0xc0		Literal Data
31911>0	byte		0x7a
31912>>1	byte&0xc0	0x00		Trust
31913>>1	byte&0xc0	0x40		User ID
31914>>1	byte&0xc0	0x80		Public-Subkey
31915>>1	byte&0xc0	0xc0		Unused [z%x]
31916>0	byte		0x30
31917>>1	byte&0xc0	0x00		Unused [0%x]
31918>>1	byte&0xc0	0x40		User Attribute
31919>>1	byte&0xc0	0x80		Sym. Encrypted and Integrity Protected Data
31920>>1	byte&0xc0	0xc0		Modification Detection Code
31921
31922# magic signatures to detect PGP crypto material (from stef)
31923# detects and extracts metadata from:
31924#  - symmetric encrypted packet header
31925#  - RSA (e=65537) secret (sub-)keys
31926
31927# 1024b RSA encrypted data
31928
319290	string	\x84\x8c\x03		PGP RSA encrypted session key -
31930>3	belong	x			keyid: %08X
31931>7	belong	x			%08X
31932>11	byte	0x01			RSA (Encrypt or Sign) 1024b
31933>11	byte	0x02			RSA Encrypt-Only 1024b
31934>12	string	\x04\x00
31935>12	string	\x03\xff
31936>12	string	\x03\xfe
31937>12	string	\x03\xfd
31938>12	string	\x03\xfc
31939>12	string	\x03\xfb
31940>12	string	\x03\xfa
31941>12	string	\x03\xf9
31942>142	byte	0xd2			.
31943
31944# 2048b RSA encrypted data
31945
319460	string	\x85\x01\x0c\x03	PGP RSA encrypted session key -
31947>4	belong	x			keyid: %08X
31948>8	belong	x			%08X
31949>12	byte	0x01			RSA (Encrypt or Sign) 2048b
31950>12	byte	0x02			RSA Encrypt-Only 2048b
31951>13	string	\x08\x00
31952>13	string	\x07\xff
31953>13	string	\x07\xfe
31954>13	string	\x07\xfd
31955>13	string	\x07\xfc
31956>13	string	\x07\xfb
31957>13	string	\x07\xfa
31958>13	string	\x07\xf9
31959>271	byte	0xd2			.
31960
31961# 3072b RSA encrypted data
31962
319630	string	\x85\x01\x8c\x03	PGP RSA encrypted session key -
31964>4	belong	x			keyid: %08X
31965>8	belong	x			%08X
31966>12	byte	0x01			RSA (Encrypt or Sign) 3072b
31967>12	byte	0x02			RSA Encrypt-Only 3072b
31968>13	string	\x0c\x00
31969>13	string	\x0b\xff
31970>13	string	\x0b\xfe
31971>13	string	\x0b\xfd
31972>13	string	\x0b\xfc
31973>13	string	\x0b\xfb
31974>13	string	\x0b\xfa
31975>13	string	\x0b\xf9
31976>399	byte	0xd2			.
31977
31978# 4096b RSA encrypted data
31979
319800	string	\x85\x02\x0c\x03	PGP RSA encrypted session key -
31981>4	belong	x			keyid: %08X
31982>8	belong	x			%08X
31983>12	byte	0x01			RSA (Encrypt or Sign) 4096b
31984>12	byte	0x02			RSA Encrypt-Only 4096b
31985>13	string	\x10\x00
31986>13	string	\x0f\xff
31987>13	string	\x0f\xfe
31988>13	string	\x0f\xfd
31989>13	string	\x0f\xfc
31990>13	string	\x0f\xfb
31991>13	string	\x0f\xfa
31992>13	string	\x0f\xf9
31993>527	byte	0xd2			.
31994
31995# 8192b RSA encrypted data
31996
319970	string	\x85\x04\x0c\x03	PGP RSA encrypted session key -
31998>4	belong	x			keyid: %08X
31999>8	belong	x			%08X
32000>12	byte	0x01			RSA (Encrypt or Sign) 8192b
32001>12	byte	0x02			RSA Encrypt-Only 8192b
32002>13	string	\x20\x00
32003>13	string	\x1f\xff
32004>13	string	\x1f\xfe
32005>13	string	\x1f\xfd
32006>13	string	\x1f\xfc
32007>13	string	\x1f\xfb
32008>13	string	\x1f\xfa
32009>13	string	\x1f\xf9
32010>1039	byte	0xd2			.
32011
32012# 1024b Elgamal encrypted data
32013
320140	string	\x85\x01\x0e\x03	PGP Elgamal encrypted session key -
32015>4	belong	x			keyid: %08X
32016>8	belong	x			%08X
32017>12	byte	0x10			Elgamal Encrypt-Only 1024b.
32018>13	string	\x04\x00
32019>13	string	\x03\xff
32020>13	string	\x03\xfe
32021>13	string	\x03\xfd
32022>13	string	\x03\xfc
32023>13	string	\x03\xfb
32024>13	string	\x03\xfa
32025>13	string	\x03\xf9
32026
32027# 2048b Elgamal encrypted data
32028
320290	string	\x85\x02\x0e\x03	PGP Elgamal encrypted session key -
32030>4	belong	x			keyid: %08X
32031>8	belong	x			%08X
32032>12	byte	0x10			Elgamal Encrypt-Only 2048b.
32033>13	string	\x08\x00
32034>13	string	\x07\xff
32035>13	string	\x07\xfe
32036>13	string	\x07\xfd
32037>13	string	\x07\xfc
32038>13	string	\x07\xfb
32039>13	string	\x07\xfa
32040>13	string	\x07\xf9
32041
32042# 3072b Elgamal encrypted data
32043
320440	string	\x85\x03\x0e\x03	PGP Elgamal encrypted session key -
32045>4	belong	x			keyid: %08X
32046>8	belong	x			%08X
32047>12	byte	0x10			Elgamal Encrypt-Only 3072b.
32048>13	string	\x0c\x00
32049>13	string	\x0b\xff
32050>13	string	\x0b\xfe
32051>13	string	\x0b\xfd
32052>13	string	\x0b\xfc
32053>13	string	\x0b\xfb
32054>13	string	\x0b\xfa
32055>13	string	\x0b\xf9
32056
32057# crypto algo mapper
32058
320590	name	crypto
32060>0	byte	0x00			Plaintext or unencrypted data
32061>0	byte	0x01			IDEA
32062>0	byte	0x02			TripleDES
32063>0	byte	0x03			CAST5 (128 bit key)
32064>0	byte	0x04			Blowfish (128 bit key, 16 rounds)
32065>0	byte	0x07			AES with 128-bit key
32066>0	byte	0x08			AES with 192-bit key
32067>0	byte	0x09			AES with 256-bit key
32068>0	byte	0x0a			Twofish with 256-bit key
32069
32070# hash algo mapper
32071
320720	name	hash
32073>0	byte	0x01			MD5
32074>0	byte	0x02			SHA-1
32075>0	byte	0x03			RIPE-MD/160
32076>0	byte	0x08			SHA256
32077>0	byte	0x09			SHA384
32078>0	byte	0x0a			SHA512
32079>0	byte	0x0b			SHA224
32080
32081# display public key algorithms as human readable text
320820	name	key_algo
32083>0	byte	0x01			RSA (Encrypt or Sign)
32084# keep old look of version 5.28 without parentheses
32085>0	byte	0x02			RSA Encrypt-Only
32086>0	byte	0x03			RSA (Sign-Only)
32087>0	byte	16			ElGamal (Encrypt-Only)
32088>0	byte	17			DSA
32089>0	byte	18			Elliptic Curve
32090>0	byte	19			ECDSA
32091>0	byte	20			ElGamal (Encrypt or Sign)
32092>0	byte	21			Diffie-Hellman
32093>0	default	x
32094>>0	ubyte	<22			unknown (pub %d)
32095# this should never happen
32096>>0	ubyte	>21			invalid (%d)
32097
32098# pgp symmetric encrypted data
32099
321000	byte	0x8c			PGP symmetric key encrypted data -
32101>1	byte	0x0d
32102>1	byte	0x0c
32103>2	byte	0x04
32104>3	use	crypto
32105>4	byte	0x01			salted -
32106>>5	use	hash
32107>>14	byte	0xd2			.
32108>>14	byte	0xc9			.
32109>4	byte	0x03			salted & iterated -
32110>>5	use	hash
32111>>15	byte	0xd2			.
32112>>15	byte	0xc9			.
32113
32114# encrypted keymaterial needs s2k & can be checksummed/hashed
32115
321160	name	chkcrypto
32117>0	use	crypto
32118>1	byte	0x00			Simple S2K
32119>1	byte	0x01			Salted S2K
32120>1	byte	0x03			Salted&Iterated S2K
32121>2	use	hash
32122
32123# all PGP keys start with this prolog
32124# containing version, creation date, and purpose
32125
321260	name	keyprolog
32127>0	byte	0x04
32128>1	beldate	x			created on %s -
32129>5	byte	0x01			RSA (Encrypt or Sign)
32130>5	byte	0x02			RSA Encrypt-Only
32131
32132# end of secret keys known signature
32133# contains e=65537 and the prolog to
32134# the encrypted parameters
32135
321360	name	keyend
32137>0	string	\x00\x11\x01\x00\x01	e=65537
32138>5	use	crypto
32139>5	byte	0xff			checksummed
32140>>6	use	chkcrypto
32141>5	byte	0xfe			hashed
32142>>6	use	chkcrypto
32143
32144# PGP secret keys contain also the public parts
32145# these vary by bitsize of the key
32146
321470	name	x1024
32148>0	use	keyprolog
32149>6	string	\x03\xfe
32150>6	string	\x03\xff
32151>6	string	\x04\x00
32152>136	use	keyend
32153
321540	name	x2048
32155>0	use	keyprolog
32156>6	string	\x80\x00
32157>6	string	\x07\xfe
32158>6	string	\x07\xff
32159>264	use	keyend
32160
321610	name	x3072
32162>0	use	keyprolog
32163>6	string	\x0b\xfe
32164>6	string	\x0b\xff
32165>6	string	\x0c\x00
32166>392	use	keyend
32167
321680	name	x4096
32169>0	use	keyprolog
32170>6	string	\x10\x00
32171>6	string	\x0f\xfe
32172>6	string	\x0f\xff
32173>520	use	keyend
32174
32175# \x00|\x1f[\xfe\xff]).{1024})'
321760	name	x8192
32177>0	use	keyprolog
32178>6	string	\x20\x00
32179>6	string	\x1f\xfe
32180>6	string	\x1f\xff
32181>1032	use	keyend
32182
32183# depending on the size of the pkt
32184# we branch into the proper key size
32185# signatures defined as x{keysize}
32186
321870	name	pgpkey
32188>0	string	\x01\xd8	1024b
32189>>2	use	x1024
32190>0	string	\x01\xeb	1024b
32191>>2	use	x1024
32192>0	string	\x01\xfb	1024b
32193>>2	use	x1024
32194>0	string	\x01\xfd	1024b
32195>>2	use	x1024
32196>0	string	\x01\xf3	1024b
32197>>2	use	x1024
32198>0	string	\x01\xee	1024b
32199>>2	use	x1024
32200>0	string	\x01\xfe	1024b
32201>>2	use	x1024
32202>0	string	\x01\xf4	1024b
32203>>2	use	x1024
32204>0	string	\x02\x0d	1024b
32205>>2	use	x1024
32206>0	string	\x02\x03	1024b
32207>>2	use	x1024
32208>0	string	\x02\x05	1024b
32209>>2	use	x1024
32210>0	string	\x02\x15	1024b
32211>>2	use	x1024
32212>0	string	\x02\x00	1024b
32213>>2	use	x1024
32214>0	string	\x02\x10	1024b
32215>>2	use	x1024
32216>0	string	\x02\x04	1024b
32217>>2	use	x1024
32218>0	string	\x02\x06	1024b
32219>>2	use	x1024
32220>0	string	\x02\x16	1024b
32221>>2	use	x1024
32222>0	string	\x03\x98	2048b
32223>>2	use	x2048
32224>0	string	\x03\xab	2048b
32225>>2	use	x2048
32226>0	string	\x03\xbb	2048b
32227>>2	use	x2048
32228>0	string	\x03\xbd	2048b
32229>>2	use	x2048
32230>0	string	\x03\xcd	2048b
32231>>2	use	x2048
32232>0	string	\x03\xb3	2048b
32233>>2	use	x2048
32234>0	string	\x03\xc3	2048b
32235>>2	use	x2048
32236>0	string	\x03\xc5	2048b
32237>>2	use	x2048
32238>0	string	\x03\xd5	2048b
32239>>2	use	x2048
32240>0	string	\x03\xae	2048b
32241>>2	use	x2048
32242>0	string	\x03\xbe	2048b
32243>>2	use	x2048
32244>0	string	\x03\xc0	2048b
32245>>2	use	x2048
32246>0	string	\x03\xd0	2048b
32247>>2	use	x2048
32248>0	string	\x03\xb4	2048b
32249>>2	use	x2048
32250>0	string	\x03\xc4	2048b
32251>>2	use	x2048
32252>0	string	\x03\xc6	2048b
32253>>2	use	x2048
32254>0	string	\x03\xd6	2048b
32255>>2	use	x2048
32256>0	string	\x05X		3072b
32257>>2	use	x3072
32258>0	string	\x05k		3072b
32259>>2	use	x3072
32260>0	string	\x05{		3072b
32261>>2	use	x3072
32262>0	string	\x05}		3072b
32263>>2	use	x3072
32264>0	string	\x05\x8d	3072b
32265>>2	use	x3072
32266>0	string	\x05s		3072b
32267>>2	use	x3072
32268>0	string	\x05\x83	3072b
32269>>2	use	x3072
32270>0	string	\x05\x85	3072b
32271>>2	use	x3072
32272>0	string	\x05\x95	3072b
32273>>2	use	x3072
32274>0	string	\x05n		3072b
32275>>2	use	x3072
32276>0	string	\x05\x7e	3072b
32277>>2	use	x3072
32278>0	string	\x05\x80	3072b
32279>>2	use	x3072
32280>0	string	\x05\x90	3072b
32281>>2	use	x3072
32282>0	string	\x05t		3072b
32283>>2	use	x3072
32284>0	string	\x05\x84	3072b
32285>>2	use	x3072
32286>0	string	\x05\x86	3072b
32287>>2	use	x3072
32288>0	string	\x05\x96	3072b
32289>>2	use	x3072
32290>0	string	\x07[		4096b
32291>>2	use	x4096
32292>0	string	\x07\x18	4096b
32293>>2	use	x4096
32294>0	string	\x07+		4096b
32295>>2	use	x4096
32296>0	string	\x07;		4096b
32297>>2	use	x4096
32298>0	string	\x07=		4096b
32299>>2	use	x4096
32300>0	string	\x07M		4096b
32301>>2	use	x4096
32302>0	string	\x073		4096b
32303>>2	use	x4096
32304>0	string	\x07C		4096b
32305>>2	use	x4096
32306>0	string	\x07E		4096b
32307>>2	use	x4096
32308>0	string	\x07U		4096b
32309>>2	use	x4096
32310>0	string	\x07.		4096b
32311>>2	use	x4096
32312>0	string	\x07>		4096b
32313>>2	use	x4096
32314>0	string	\x07@		4096b
32315>>2	use	x4096
32316>0	string	\x07P		4096b
32317>>2	use	x4096
32318>0	string	\x074		4096b
32319>>2	use	x4096
32320>0	string	\x07D		4096b
32321>>2	use	x4096
32322>0	string	\x07F		4096b
32323>>2	use	x4096
32324>0	string	\x07V		4096b
32325>>2	use	x4096
32326>0	string	\x0e[		8192b
32327>>2	use	x8192
32328>0	string	\x0e\x18	8192b
32329>>2	use	x8192
32330>0	string	\x0e+		8192b
32331>>2	use	x8192
32332>0	string	\x0e;		8192b
32333>>2	use	x8192
32334>0	string	\x0e=		8192b
32335>>2	use	x8192
32336>0	string	\x0eM		8192b
32337>>2	use	x8192
32338>0	string	\x0e3		8192b
32339>>2	use	x8192
32340>0	string	\x0eC		8192b
32341>>2	use	x8192
32342>0	string	\x0eE		8192b
32343>>2	use	x8192
32344>0	string	\x0eU		8192b
32345>>2	use	x8192
32346>0	string	\x0e.		8192b
32347>>2	use	x8192
32348>0	string	\x0e>		8192b
32349>>2	use	x8192
32350>0	string	\x0e@		8192b
32351>>2	use	x8192
32352>0	string	\x0eP		8192b
32353>>2	use	x8192
32354>0	string	\x0e4		8192b
32355>>2	use	x8192
32356>0	string	\x0eD		8192b
32357>>2	use	x8192
32358>0	string	\x0eF		8192b
32359>>2	use	x8192
32360>0	string	\x0eV		8192b
32361>>2	use	x8192
32362
32363# PGP RSA (e=65537) secret (sub-)key header
32364
323650	byte	0x97			PGP Secret Sub-key -
32366>1	use	pgpkey
323670	byte	0x9d
32368# Update: Joerg Jenderek
32369# secret subkey packet (tag 7) with same structure as secret key packet (tag 5)
32370# skip Fetus.Sys16 CALIBUS.MAIN OrbFix.Sys16.Ex by looking for positive len
32371>1	ubeshort	>0
32372#>1	ubeshort	x		\b, body length %#x
32373# next packet type often 88h,89h~(tag 2)~Signature Packet
32374#>>(1.S+3)	ubyte	x		\b, next packet type %#x
32375# skip Dragon.SHR DEMO.INIT by looking for positive version
32376>>3	ubyte		>0
32377# skip BUISSON.13 GUITAR1 by looking for low version number
32378>>>3	ubyte		<5		PGP Secret Sub-key
32379# sub-key are normally part of secret key. So it does not occur as standalone file
32380#!:ext	bin
32381# version 2,3~old 4~new . Comment following line for version 5.28 look
32382>>>>3	ubyte		x		(v%d)
32383>>>>3	ubyte		x		-
32384# old versions 2 or 3 but no real example found
32385>>>>3	ubyte		<4
32386# 2 byte for key bits in version 5.28 look
32387>>>>>11		ubeshort	x	%db
32388>>>>>4		beldate		x	created on %s -
32389# old versions use 2 additional bytes after time stamp
32390#>>>>>8		ubeshort	x	%#x
32391# display key algorithm 1~RSA Encrypt|Sign - 21~Diffie-Hellman
32392>>>>>10	  	use		key_algo
32393>>>>>(11.S/8)	ubequad		x
32394# look after first key
32395>>>>>>&5	use		keyend
32396# new version
32397>>>>3	ubyte		>3
32398>>>>>9		ubeshort	x	%db
32399>>>>>4		beldate		x	created on %s -
32400# display key algorithm
32401>>>>>8		use		key_algo
32402>>>>>(9.S/8)	ubequad		x
32403# look after first key for something like s2k
32404>>>>>>&3	use		keyend
32405
32406#------------------------------------------------------------------------------
32407# $File: pgp-binary-keys,v 1.2 2021/04/26 15:56:00 christos Exp $
32408# pgp-binary-keys: This file handles pgp binary keys.
32409#
32410# An PGP certificate or message doesn't have a fixed header.  Instead,
32411# they are sequences of packets:
32412#
32413#   https://tools.ietf.org/html/rfc4880#section-4.3
32414#
32415# whose order conforms to a grammar:
32416#
32417#   https://tools.ietf.org/html/rfc4880#section-11
32418#
32419# Happily most packets have a few fields that are constrained, which
32420# allow us to fingerprint them with relatively high certainty.
32421#
32422# A PGP packet is described by a single byte: the so-called CTB.  The
32423# high-bit is always set.  If bit 6 is set, then it is a so-called
32424# new-style CTB; if bit 6 is clear, then it is a so-called old-style
32425# CTB.  Old-style CTBs have only four bits of type information; bits
32426# 1-0 are used to describe the length.  New-style CTBs have 6 bits of
32427# type information.
32428#
32429# Following the CTB is the packet's length in bytes.  If we blindly
32430# advance the file cursor by this amount past the end of the length
32431# information we come to the next packet.
32432#
32433# Data Structures
32434# ===============
32435#
32436# New Style CTB
32437# -------------
32438#
32439# https://tools.ietf.org/html/rfc4880#section-4.2.2
32440#
32441#   76543210
32442#   ||\----/
32443#   ||  tag
32444#   |always 1
32445#   always 1
32446#
32447#      Tag   bits 7 and 6 set
32448#       0       0xC0        -- Reserved - a packet tag MUST NOT have this value
32449#       1       0xC1        -- Public-Key Encrypted Session Key Packet
32450#       2       0xC2        -- Signature Packet
32451#       3       0xC3        -- Symmetric-Key Encrypted Session Key Packet
32452#       4       0xC4        -- One-Pass Signature Packet
32453#       5       0xC5        -- Secret-Key Packet
32454#       6       0xC6        -- Public-Key Packet
32455#       7       0xC7        -- Secret-Subkey Packet
32456#       8       0xC8        -- Compressed Data Packet
32457#       9       0xC9        -- Symmetrically Encrypted Data Packet
32458#       10      0xCA        -- Marker Packet
32459#       11      0xCB        -- Literal Data Packet
32460#       12      0xCC        -- Trust Packet
32461#       13      0xCD        -- User ID Packet
32462#       14      0xCE        -- Public-Subkey Packet
32463#       17      0xD1        -- User Attribute Packet
32464#       18      0xD2        -- Sym. Encrypted and Integrity Protected Data Packet
32465#       19      0xD3        -- Modification Detection Code Packet
32466#       60 to 63 -- Private or Experimental Values
32467#
32468# The CTB is followed by the length header, which is densely encoded:
32469#
32470#   if length[0] is:
32471#     0..191: one byte length (length[0])
32472#     192..223: two byte length ((length[0] - 192) * 256 + length[2] + 192
32473#     224..254: four byte length (big endian interpretation of length[1..5])
32474#     255: partial body encoding
32475#
32476# The partial body encoding is similar to HTTP's chunk encoding.  It
32477# is only allowed for container packets (SEIP, Compressed Data and
32478# Literal).
32479#
32480# Old Style CTB
32481# -------------
32482#
32483#  https://tools.ietf.org/html/rfc4880#section-4.2.1
32484#
32485# CTB:
32486#
32487#   76543210
32488#   ||\--/\/
32489#   ||  |  length encoding
32490#   ||  tag
32491#   |always 0
32492#   always 1
32493#
32494# Tag:
32495#
32496#      Tag   bit 7 set, bits 6, 1, 0 clear
32497#       0       0x80        -- Reserved - a packet tag MUST NOT have this value
32498#       1       0x84        -- Public-Key Encrypted Session Key Packet
32499#       2       0x88        -- Signature Packet
32500#       3       0x8C        -- Symmetric-Key Encrypted Session Key Packet
32501#       4       0x90        -- One-Pass Signature Packet
32502#       5       0x94        -- Secret-Key Packet
32503#       6       0x98        -- Public-Key Packet
32504#       7       0x9C        -- Secret-Subkey Packet
32505#       8       0xA0        -- Compressed Data Packet
32506#       9       0xA4        -- Symmetrically Encrypted Data Packet
32507#       10      0xA8        -- Marker Packet
32508#       11      0xAC        -- Literal Data Packet
32509#       12      0xB0        -- Trust Packet
32510#       13      0xB4        -- User ID Packet
32511#       14      0xB8        -- Public-Subkey Packet
32512#
32513# Length encoding:
32514#
32515#     Value
32516#       0      1 byte length (following byte is the length)
32517#       1      2 byte length (following two bytes are the length)
32518#       2      4 byte length (following four bytes are the length)
32519#       3      indeterminate length: natural end of packet, e.g., EOF
32520#
32521# An indeterminate length is only allowed for container packets
32522# (SEIP, Compressed Data and Literal).
32523#
32524# Certificates
32525# ------------
32526#
32527# We check the first three packets to determine if a sequence of
32528# OpenPGP packets is likely to be a certificate.  The grammar allows
32529# the following prefixes:
32530#
32531#   [Primary Key] [SIG] (EOF or another certificate)
32532#   [Primary Key] [SIG]            [User ID]        [SIG]...
32533#   [Primary Key] [SIG]            [User Attribute] [SIG]...
32534#   [Primary Key] [SIG]            [Subkey]         [SIG]...
32535#   [Primary Key] [User ID]        [SIG]...
32536#   [Primary Key] [User Attribute] [SIG]...
32537#   [Primary Key] [Subkey]         [SIG]...
32538#
32539# Any number of marker packets are also allowed between each packet,
32540# but they are not normally used and we don't currently check for
32541# them.
32542#
32543# The keys and subkeys may be public or private.
32544#
32545
32546# Key packets and signature packets are versioned.  There are two
32547# packet versions that we need to worry about in practice: v3 and v4.
32548# v4 packets were introduced in RFC 2440, which was published in 1998.
32549# It also deprecated v3 packets.  There are no actively used v3
32550# certificates (GnuPG removed the code to support them in November
32551# 2014).  But there are v3 keys lying around and it is useful to
32552# identify them.  The next version of OpenPGP will introduce v5 keys.
32553# The document has not yet been standardized so changes are still
32554# possible.  But, for our purposes, it appears that v5 data structures
32555# will be identical to v4 data structures modulo the version number.
32556#
32557#   https://tools.ietf.org/html/rfc2440
32558#   https://lists.gnupg.org/pipermail/gnupg-announce/2014q4/000358.html
32559#   https://www.ietf.org/id/draft-ietf-openpgp-rfc4880bis-09.html#name-key-material-packet
32560
32561
32562
32563
32564# The first packet has to be a public key or a secret key.
32565#
32566# New-Style Public Key
325670	ubyte			=0xC6	OpenPGP Public Key
32568>&0	use			primary_key_length_new
32569# New-Style Secret Key
325700	ubyte			=0xC5	OpenPGP Secret Key
32571>&0	use			primary_key_length_new
32572# Old-Style Public Key
325730	ubyte&0xFC		=0x98	OpenPGP Public Key
32574>&-1	use			primary_key_length_old
32575# Old-Style Secret Key
325760	ubyte&0xFC		=0x94	OpenPGP Secret Key
32577>&-1	use			primary_key_length_old
32578
32579# Parse the length, check the packet's body and finally advance to the
32580# next packet.
32581
32582# There are 4 different new-style length encodings, but the partial
32583# body encoding is only acceptable for the SEIP, Compressed Data, and
32584# Literal packets, which isn't valid for any packets in a certificate
32585# so we ignore it.
325860		name		primary_key_length_new
32587>&0		ubyte		<192
32588#>>&0		ubyte		x		(1 byte length encoding, %d bytes)
32589>>&0		use		pgp_binary_key_pk_check
32590>>>&(&-1.B)	use		sig_or_component_1
32591>&0		ubyte		>191
32592>>&-1		ubyte		<225
32593# offset = ((offset[0] - 192) << 8) + offset[1] + 192 (for the length header)
32594# raw - (192 * 256 - 192)
32595# = 48960
32596#>>>&0		ubeshort		x	(2 byte length encoding, %d bytes)
32597>>>&1		use		pgp_binary_key_pk_check
32598>>>>&(&-2.S-48960)	use	sig_or_component_1
32599>&0		ubyte		=255
32600#>>&0   	belong		x		(5 byte length encoding, %d bytes)
32601>>&4		use		pgp_binary_key_pk_check
32602>>>&(&-4.L)	use		sig_or_component_1
32603# Partial body encoding (only valid for container packets).
32604# >&0		ubyte	>224
32605# >>&0		ubyte		<255		partial body encoding
32606
32607# There are 4 different old-style length encodings, but the
32608# indeterminate length encoding is only acceptable for the SEIP,
32609# Compressed Data, and Literal packets, which isn't valid for any
32610# packets in a certificate.
326110		name		primary_key_length_old
32612#>&0		ubyte		x		(ctb: %x)
32613>&0		ubyte&0x3	=0
32614#>>&0    	ubyte		x		(1 byte length encoding, %d bytes)
32615>>&1		use		pgp_binary_key_pk_check
32616>>>&(&-1.B)	use		sig_or_component_1
32617>&0		ubyte&0x3	=1
32618#>>&0    	ubeshort	x		(2 byte length encoding, %d bytes)
32619>>&2		use		pgp_binary_key_pk_check
32620>>>&(&-2.S)	use		sig_or_component_1
32621>&0		ubyte&0x3	=2
32622#>>&0    	ubelong	x		(4 byte length encoding, %d bytes)
32623>>&4		use		pgp_binary_key_pk_check
32624>>>&(&-4.L)	use		sig_or_component_1
32625
32626# Check the Key.
32627#
32628# https://tools.ietf.org/html/rfc4880#section-5.5.2
326290		name		pgp_binary_key_pk_check
32630# Valid versions are: 2, 3, 4.  5 is proposed in RFC 4880bis.
32631# Anticipate a v6 / v7 format that like v5 is compatible with v4.
32632# key format in a decade or so :D.
32633>&0		ubyte		>1
32634>>&-1		ubyte		<8
32635>>>&-1		byte		x		Version %d
32636# Check that keys were created after 1990.
32637# (1990 - 1970) * 365.2524 * 24 * 60 * 60 = 631156147
32638>>>&0		bedate		>631156147      \b, Created %s
32639>>>>&-5		ubyte		>3
32640>>>>>&4		use		pgp_binary_key_algo
32641>>>>&-5		ubyte		<4
32642>>>>>&6		use		pgp_binary_key_algo
32643
32644# Print out the key's algorithm and the number of bits, if this is
32645# relevant (ECC keys are a fixed size).
326460		name		pgp_binary_key_algo
32647>0		clear		x
32648>&0		ubyte		=1	\b, RSA (Encrypt or Sign,
32649>>&0		ubeshort	x	\b %d bits)
32650>&0		ubyte		=2	\b, RSA (Encrypt,
32651>>&0		ubeshort	x	\b %d bits)
32652>&0		ubyte		=3	\b, RSA (Sign,
32653>>&0		ubeshort	x	\b %d bits)
32654>&0		ubyte		=16	\b, El Gamal (Encrypt,
32655>>&0		ubeshort	x	\b %d bits)
32656>&0		ubyte		=17	\b, DSA
32657>>&0		ubeshort	x	\b (%d bits)
32658>&0		ubyte		=18	\b, ECDH
32659>&0		ubyte		=19	\b, ECDSA
32660>&0		ubyte		=20	\b, El Gamal (Encrypt or Sign,
32661>>&0		ubeshort	x	\b %d bits)
32662>&0		ubyte		=22	\b, EdDSA
32663>&0		default         x
32664>>&0		ubyte		x	\b, Unknown Algorithm (%#x)
32665
32666# Match all possible second packets.
326670	name		sig_or_component_1
32668#>0	ubyte		x	(ctb: %x)
32669>&0	ubyte		=0xC2
32670>>0	ubyte		x	\b; Signature
32671>>&0	use		sig_or_component_1_length_new
32672>&0	ubyte		=0xCD
32673>>0	ubyte		x	\b; User ID
32674>>&0	use		sig_or_component_1_length_new
32675>&0	ubyte		=0xCE
32676>>0	ubyte		x	\b; Public Subkey
32677>>&0	use		sig_or_component_1_length_new
32678>&0	ubyte		=0xC7
32679>>0	ubyte		x	\b; Secret Subkey
32680>>&0	use		sig_or_component_1_length_new
32681>&0	ubyte		=0xD1
32682>>0	ubyte		x	\b; User Attribute
32683>>&0	use		sig_or_component_1_length_new
32684>&0	ubyte&0xFC	=0x88
32685>>0	ubyte		x	\b; Signature
32686>>&-1	use		sig_or_component_1_length_old
32687>&0	ubyte&0xFC	=0xB4
32688>>0	ubyte		x	\b; User ID
32689>>&-1	use		sig_or_component_1_length_old
32690>&0	ubyte&0xFC	=0xB8
32691>>0	ubyte		x	\b; Public Subkey
32692>>&-1	use		sig_or_component_1_length_old
32693>&0	ubyte&0xFC	=0x9C
32694>>0	ubyte		x	\b; Secret Subkey
32695>>&-1	use		sig_or_component_1_length_old
32696
32697# Copy of 'primary_key_length_new', but calls cert_packet_3.
326980		name		sig_or_component_1_length_new
32699>&0		ubyte		<192
32700#>>&0		ubyte		x		(1 byte new length encoding, %d bytes)
32701>>&(&-1.B)	use		cert_packet_3
32702>&0		ubyte		>191
32703>>&-1		ubyte		<225
32704# offset = ((offset[0] - 192) << 8) + offset[1] + 192 + 1 (for the length header)
32705# raw - (192 * 256 - 192 - 1)
32706# = 48959
32707#>>>&-1		ubeshort		x	(2 byte new length encoding, %d bytes)
32708>>>&(&-1.S-48959)	use	cert_packet_3
32709>&0		ubyte		=255
32710#>>&0   	belong		x		(5 byte new length encoding, %d bytes)
32711>>&(&-4.L)	use		cert_packet_3
32712# Partial body encoding (only valid for container packets).
32713# >&0		ubyte	>224
32714# >>&0		ubyte		<255		partial body encoding
32715
327160		name		sig_or_component_1_length_old
32717#>&0		ubyte		x		(ctb: %x)
32718>&0		ubyte&0x3	=0
32719#>>&0    	ubyte		x		(1 byte old length encoding, %d bytes)
32720>>&(&0.B+1)	use		cert_packet_3
32721>&0		ubyte&0x3	=1
32722#>>&0    	ubeshort	x		(2 byte old length encoding, %d bytes)
32723>>&(&0.S+2)	use		cert_packet_3
32724>&0		ubyte&0x3	=2
32725#>>&0    	ubelong	x		(4 byte old length encoding, %d bytes)
32726>>&(&0.L+4)	use		cert_packet_3
32727
32728# Copy of above.
327290	name		cert_packet_3
32730#>0	ubyte		x	(ctb: %x)
32731>&0	ubyte		=0xC2
32732>>0	ubyte		x	\b; Signature
32733>>&0	use		cert_packet_3_length_new
32734>&0	ubyte		=0xCD
32735>>0	ubyte		x	\b; User ID
32736>>&0	use		cert_packet_3_length_new
32737>&0	ubyte		=0xCE
32738>>0	ubyte		x	\b; Public Subkey
32739>>&0	use		cert_packet_3_length_new
32740>&0	ubyte		=0xC7
32741>>0	ubyte		x	\b; Secret Subkey
32742>>&0	use		cert_packet_3_length_new
32743>&0	ubyte		=0xD1
32744>>0	ubyte		x	\b; User Attribute
32745>>&0	use		cert_packet_3_length_new
32746>&0	ubyte&0xFC	=0x88
32747>>0	ubyte		x	\b; Signature
32748>>&-1	use		cert_packet_3_length_old
32749>&0	ubyte&0xFC	=0xB4
32750>>0	ubyte		x	\b; User ID
32751>>&-1	use		cert_packet_3_length_old
32752>&0	ubyte&0xFC	=0xB8
32753>>0	ubyte		x	\b; Public Subkey
32754>>&-1	use		cert_packet_3_length_old
32755>&0	ubyte&0xFC	=0x9C
32756>>0	ubyte		x	\b; Secret Subkey
32757>>&-1	use		cert_packet_3_length_old
32758
32759# Copy of above.
327600		name		cert_packet_3_length_new
32761>&0		ubyte		<192
32762#>>&0		ubyte		x		(1 byte new length encoding, %d bytes)
32763>>&(&-1.B)	use		pgp_binary_keys_end
32764>&0		ubyte		>191
32765>>&-1		ubyte		<225
32766# offset = ((offset[0] - 192) << 8) + offset[1] + 192 + 1 (for the length header)
32767# raw - (192 * 256 - 192 - 1)
32768# = 48959
32769#>>>&-1		ubeshort		x	(2 byte new length encoding, %d bytes)
32770>>>&(&-1.S-48959)	use	pgp_binary_keys_end
32771>&0		ubyte		=255
32772#>>&0   	belong		x		(5 byte new length encoding, %d bytes)
32773>>&(&-4.L)	use		pgp_binary_keys_end
32774
327750		name		cert_packet_3_length_old
32776#>&0		ubyte		x		(ctb: %x)
32777>&0		ubyte&0x3	=0
32778#>>&0    	ubyte		x		(1 byte old length encoding, %d bytes)
32779>>&(&0.B+1)	use		pgp_binary_keys_end
32780>&0		ubyte&0x3	=1
32781#>>&0    	ubeshort	x		(2 byte old length encoding, %d bytes)
32782>>&(&0.S+2)	use		pgp_binary_keys_end
32783>&0		ubyte&0x3	=2
32784#>>&0    	ubelong	x		(4 byte old length encoding, %d bytes)
32785>>&(&0.L+4)	use		pgp_binary_keys_end
32786
32787# We managed to parse the first three packets of the certificate.  Declare
32788# victory.
327890		name		pgp_binary_keys_end
32790>0		byte		x		\b; OpenPGP Certificate
32791!:mime		application/pgp-keys
32792!:ext		pgp/gpg/pkr/asd
32793
32794#------------------------------------------------------------------------------
32795# $File: pkgadd,v 1.6 2009/09/19 16:28:11 christos Exp $
32796# pkgadd:  file(1) magic for SysV R4 PKG Datastreams
32797#
327980       string          #\ PaCkAgE\ DaTaStReAm  pkg Datastream (SVR4)
32799!:mime	application/x-svr4-package
32800
32801#------------------------------------------------------------------------------
32802# $File: plan9,v 1.6 2021/07/30 12:25:13 christos Exp $
32803# plan9:  file(1) magic for AT&T Bell Labs' Plan 9 executables and object files
32804# From: "Stefan A. Haubenthal" <polluks@web.de>
32805#
328060	belong		0x00000107	Plan 9 executable, Motorola 68k
328070	belong		0x00000197	Plan 9 executable, AT&T Hobbit
328080	belong		0x000001EB	Plan 9 executable, Intel 386
328090	belong		0x00000247	Plan 9 executable, Intel 960
328100	belong		0x000002AB	Plan 9 executable, SPARC
328110	belong		0x00000407	Plan 9 executable, MIPS R3000
328120	belong		0x0000048B	Plan 9 executable, AT&T DSP 3210
328130	belong		0x00000517	Plan 9 executable, MIPS R4000 BE
328140	belong		0x000005AB	Plan 9 executable, AMD 29000
328150	belong		0x00000647	Plan 9 executable, ARM 7-something
328160	belong		0x000006EB	Plan 9 executable, PowerPC
328170	belong		0x00000797	Plan 9 executable, MIPS R4000 LE
328180	belong		0x0000084B	Plan 9 executable, DEC Alpha
32819
328200	belong		0x3A11013C	Plan 9 object file, MIPS R3000
328210	belong		0x430D013C	Plan 9 object file, AT&T Hobbit
328220	belong		0x4D013201	Plan 9 object file, Motorola 68k
328230	belong		0x7410013C	Plan 9 object file, SPARC
328240	belong		0x7E004501	Plan 9 object file, Intel 386
32825
32826#------------------------------------------------------------------------------
32827# $File: plus5,v 1.6 2009/09/19 16:28:11 christos Exp $
32828# plus5:  file(1) magic for Plus Five's UNIX MUMPS
32829#
32830# XXX - byte order?  Paging Hokey....
32831#
328320	short		0x259		mumps avl global
32833>2	byte		>0		(V%d)
32834>6	byte		>0		with %d byte name
32835>7	byte		>0		and %d byte data cells
328360	short		0x25a		mumps blt global
32837>2	byte		>0		(V%d)
32838>8	short		>0		- %d byte blocks
32839>15	byte		0x00		- P/D format
32840>15	byte		0x01		- P/K/D format
32841>15	byte		0x02		- K/D format
32842>15	byte		>0x02		- Bad Flags
32843
32844#------------------------------------------------------------------------------
32845# $File: pmem,v 1.4 2021/04/26 15:56:00 christos Exp $
32846# pmem: file(1) magic for Persistent Memory Development Kit pool files
32847#
328480	string		PMEM
32849>4	string		POOLSET		Persistent Memory Poolset file
32850>>11	search		REPLICA		with replica
32851>4	regex		LOG|BLK|OBJ	Persistent Memory Pool file, type: %s,
32852>>8	lelong		>0		version: %#x,
32853>>12	lelong		x		compat: %#x,
32854>>16	lelong		x		incompat: %#x,
32855>>20	lelong		x		ro_compat: %#x,
32856
32857
32858>>120	leqldate	x		crtime: %s,
32859>>128	lequad		x		alignment_desc: %#016llx,
32860
32861>>136	clear		x
32862>>136	byte		2		machine_class: 64-bit,
32863>>136	default		x		machine_class: unknown
32864>>>136	byte		x		(%#d),
32865
32866>>137	clear		x
32867>>137	byte		1		data: little-endian,
32868>>137	byte		2		data: big-endian,
32869>>137	default		x		data: unknown
32870>>>137	byte		x		(%#d),
32871
32872>>138	byte		!0		reserved[0]: %d,
32873>>139	byte		!0		reserved[1]: %d,
32874>>140	byte		!0		reserved[2]: %d,
32875>>141	byte		!0		reserved[3]: %d,
32876
32877>>142	clear		x
32878>>142	leshort		62		machine: x86_64
32879>>142	leshort		183		machine: aarch64
32880>>142	default		x		machine: unknown
32881>>>142	leshort		x		(%#d)
32882
32883>4	string		BLK
32884>>4096	lelong		x		\b, blk.bsize: %d
32885
32886>4	string		OBJ
32887>>4096	string		>0		\b, obj.layout: '%s'
32888>>4096	string		<0		\b, obj.layout: NULL
32889
32890#------------------------------------------------------------------------------
32891# $File: polyml,v 1.2 2019/04/19 00:42:27 christos Exp $
32892# polyml:  file(1) magic for PolyML
32893#
32894# PolyML
32895# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)
32896# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)
32897
32898# [0]: https://www.polyml.org/
32899# [1]: https://github.com/polyml/polyml/blob/master/\
32900#	libpolyml/savestate.cpp#L146-L147
32901# [2]: https://github.com/polyml/polyml/blob/master/\
32902#	libpolyml/savestate.cpp#L1262-L1263
32903
32904# Type: Poly/ML saved data
32905# From: Matthew Fernandez <matthew.fernandez@gmail.com>
32906
329070	string	POLYSAVE	Poly/ML saved state
32908>8	long	x		version %u
32909
329100	string  POLYMODU	Poly/ML saved module
32911>8	long	x		version %u
32912
32913#------------------------------------------------------------------------------
32914# $File: printer,v 1.29 2019/04/19 00:42:27 christos Exp $
32915# printer:  file(1) magic for printer-formatted files
32916#
32917
32918# PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com)
329190	string		%!		PostScript document text
32920!:mime	application/postscript
32921!:apple	ASPSTEXT
32922>2	string		PS-Adobe-	conforming
32923>>11	string		>\0		DSC level %.3s
32924>>>15	string		EPS		\b, type %s
32925>>>15	string		Query		\b, type %s
32926>>>15	string		ExitServer	\b, type %s
32927>>>15   search/1000		%%LanguageLevel:\040
32928>>>>&0	string		>\0		\b, Level %s
32929# Some PCs have the annoying habit of adding a ^D as a document separator
329300	string		\004%!		PostScript document text
32931!:mime	application/postscript
32932!:apple	ASPSTEXT
32933>3	string		PS-Adobe-	conforming
32934>>12	string		>\0		DSC level %.3s
32935>>>16	string		EPS		\b, type %s
32936>>>16	string		Query		\b, type %s
32937>>>16	string		ExitServer	\b, type %s
32938>>>16   search/1000		%%LanguageLevel:\040
32939>>>>&0	string		>\0		\b, Level %s
329400	string		\033%-12345X%!PS	PostScript document
32941
32942# DOS EPS Binary File Header
32943# From: Ed Sznyter <ews@Black.Market.NET>
329440       belong          0xC5D0D3C6      DOS EPS Binary File
32945>4      long            >0              Postscript starts at byte %d
32946>>8     long            >0              length %d
32947>>>12   long            >0              Metafile starts at byte %d
32948>>>>16  long            >0              length %d
32949>>>20   long            >0              TIFF starts at byte %d
32950>>>>24  long            >0              length %d
32951
32952# Summary: Adobe's PostScript Printer Description File
32953# Extension: .ppd
32954# Reference: https://partners.adobe.com/public/developer/en/ps/5003.PPD_Spec_v4.3.pdf, Section 3.8
32955# Submitted by: Yves Arrouye <arrouye@marin.fdn.fr>
32956#
329570	string		*PPD-Adobe:\x20	PPD file
32958>&0	string		x		\b, version %s
32959
32960# HP Printer Job Language
329610	string		\033%-12345X@PJL	HP Printer Job Language data
32962# HP Printer Job Language
32963# The header found on Win95 HP plot files is the "Silliest Thing possible"
32964# (TM)
32965# Every driver puts the language at some random position, with random case
32966# (LANGUAGE and Language)
32967# For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10
32968# From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de>
32969#
329700	string		\033%-12345X@PJL	HP Printer Job Language data
32971>&0	string		>\0			%s
32972>>&0	string		>\0			%s
32973>>>&0	string		>\0			%s
32974>>>>&0	string		>\0			%s
32975#>15	string		\ ENTER\ LANGUAGE\ =
32976#>31	string		PostScript		PostScript
32977
32978# From: Stefan Thurner <thurners@nicsys.de>
329790	string		\033%-12345X@PJL
32980>&0	search/10000	%!			PJL encapsulated PostScript document text
32981
32982# Rick Richardson <rickrich@gmail.com>
32983
32984# For Fuji-Xerox Printers - HBPL stands for Host Based Printer Language
32985# For Oki Data Printers - HIPERC
32986# For Konica Minolta Printers - LAVAFLOW
32987# For Samsung Printers - QPDL
32988# For HP Printers - ZJS stands for Zenographics ZJStream
329890	string		\033%-12345X@PJL	HP Printer Job Language data
32990>0	search/10000	@PJL\ ENTER\ LANGUAGE=HBPL	- HBPL
32991>0	search/10000	@PJL\ ENTER\ LANGUAGE=HIPERC	- Oki Data HIPERC
32992>0	search/10000	@PJL\ ENTER\ LANGUAGE=LAVAFLOW	- Konica Minolta LAVAFLOW
32993>0	search/10000	@PJL\ ENTER\ LANGUAGE=QPDL	- Samsung QPDL
32994>0	search/10000	@PJL\ ENTER\ LANGUAGE\ =\ QPDL	- Samsung QPDL
32995>0	search/10000	@PJL\ ENTER\ LANGUAGE=ZJS	- HP ZJS
32996
32997
32998# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com)
329990	string		\033E\033	HP PCL printer data
33000>3	string		\&l0A		- default page size
33001>3	string		\&l1A		- US executive page size
33002>3	string		\&l2A		- US letter page size
33003>3	string		\&l3A		- US legal page size
33004>3	string		\&l26A		- A4 page size
33005>3	string		\&l80A		- Monarch envelope size
33006>3	string		\&l81A		- No. 10 envelope size
33007>3	string		\&l90A		- Intl. DL envelope size
33008>3	string		\&l91A		- Intl. C5 envelope size
33009>3	string		\&l100A		- Intl. B5 envelope size
33010>3	string		\&l-81A		- No. 10 envelope size (landscape)
33011>3	string		\&l-90A		- Intl. DL envelope size (landscape)
33012
33013# IMAGEN printer-ready files:
330140	string	@document(		Imagen printer
33015# this only works if "language xxx" is first item in Imagen header.
33016>10	string	language\ impress	(imPRESS data)
33017>10	string	language\ daisy		(daisywheel text)
33018>10	string	language\ diablo	(daisywheel text)
33019>10	string	language\ printer	(line printer emulation)
33020>10	string	language\ tektronix	(Tektronix 4014 emulation)
33021# Add any other languages that your Imagen uses - remember
33022# to keep the word `text' if the file is human-readable.
33023# [GRR 950115:  missing "postscript" or "ultrascript" (whatever it was called)]
33024#
33025# Now magic for IMAGEN font files...
330260	string		Rast		RST-format raster font data
33027>45	string		>0		face %s
33028# From Jukka Ukkonen
330290	string		\033[K\002\0\0\017\033(a\001\0\001\033(g	Canon Bubble Jet BJC formatted data
33030
33031# From <mike@flyn.org>
33032# These are the /etc/magic entries to decode data sent to an Epson printer.
330330       string          \x1B\x40\x1B\x28\x52\x08\x00\x00REMOTE1P        Epson Stylus Color 460 data
33034
33035
33036#------------------------------------------------------------------------------
33037# zenographics:  file(1) magic for Zenographics ZjStream printer data
33038# Rick Richardson <rickrich@gmail.com>
330390	string		JZJZ
33040>0x12	string		ZZ		Zenographics ZjStream printer data (big-endian)
330410	string		ZJZJ
33042>0x12	string		ZZ		Zenographics ZjStream printer data (little-endian)
33043
33044
33045#------------------------------------------------------------------------------
33046# Oak Technologies printer stream
33047# Rick Richardson <rickrich@gmail.com>
330480       string          OAK
33049>0x07	byte		0
33050>0x0b	byte		0	Oak Technologies printer stream
33051
33052# This would otherwise be recognized as PostScript - nick@debian.org
330530	string		%!VMF 		SunClock's Vector Map Format data
33054
33055#------------------------------------------------------------------------------
33056# HP LaserJet 1000 series downloadable firmware file
330570	string	\xbe\xefABCDEFGH	HP LaserJet 1000 series downloadable firmware
33058
33059# From: Paolo <oopla@users.sf.net>
33060# Epson ESC/Page, ESC/PageColor
330610	string	\x1b\x01@EJL	Epson ESC/Page language printer data
33062
33063#------------------------------------------------------------------------------
33064# $File: project,v 1.5 2017/03/17 21:35:28 christos Exp $
33065# project:  file(1) magic for Project management
33066#
33067# Magic strings for ftnchek project files. Alexander Mai
330680	string	FTNCHEK_\ P	project file for ftnchek
33069>10	string	1		version 2.7
33070>10	string	2		version 2.8 to 2.10
33071>10	string	3		version 2.11 or later
33072
33073#------------------------------------------------------------------------------
33074# $File: psdbms,v 1.8 2017/03/17 21:35:28 christos Exp $
33075# psdbms:  file(1) magic for psdatabase
33076#
33077# Update: Joerg Jenderek
33078# GRR: line below too general as it catches also some Panorama database *.pan ,
33079# AppleWorks word processor
330800	belong&0xff00ffff	0x56000000
33081# assume version starts with digit
33082>1	regex/s			=^[0-9]		ps database
33083>>1	string	>\0	version %s
33084# kernel name
33085>>4	string	>\0	from kernel %s
33086
33087#------------------------------------------------------------------------------
33088# $File: psl,v 1.3 2019/04/19 00:42:27 christos Exp $
33089# psl:  file(1) magic for Public Suffix List representations
33090# From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
33091# URL: https://publicsuffix.org
33092# see also: https://thread.gmane.org/gmane.network.dns.libpsl.bugs/162/focus=166
33093
330940	search/512	\n\n//\ ===BEGIN\ ICANN\ DOMAINS===\n\n Public Suffix List data
33095
330960	string	.DAFSA@PSL_
33097>15	string	\n	Public Suffix List data (optimized)
33098>>11	byte	>0x2f
33099>>>11	byte	<0x3a   (Version %c)
33100
33101#------------------------------------------------------------------------------
33102# $File: pulsar,v 1.5 2009/09/19 16:28:12 christos Exp $
33103# pulsar:  file(1) magic for Pulsar POP3 daemon binary files
33104#
33105# http://pulsar.sourceforge.net
33106# mailto:rok.papez@lugos.si
33107#
33108
331090	belong	0x1ee7f11e	Pulsar POP3 daemon mailbox cache file.
33110>4	ubelong	x		Version: %d.
33111>8	ubelong	x		\b%d
33112
33113
33114#------------------------------------------------------------------------------
33115# $File: puzzle,v 1.2 2021/10/07 15:40:40 christos Exp $
33116# wsdl: Magic for various puzzles
33117
33118# PUZ crossword puzzles from Alan De Smet
33119# Test files can be found at
33120# https://theworld.com/~wij/puzzles/wij-themed.html or using the
33121# "Universal" or "WS Journal" links on the right side of
33122# https://www.cruciverb.com/ .
33123
331242	string	ACROSS&DOWN	PUZ crossword puzzle
33125>0x2c	byte	x		%d x
33126>0x2d	byte	x		%d,
33127>0x2e	leshort	x		%d clues,
33128>0x1e	leshort	0x0000		plain text solution
33129>0x1e	leshort	!0x0000		scrambled solution
33130
33131#------------------------------------------------------------------------------
33132# $File: pwsafe,v 1.2 2019/04/19 00:42:27 christos Exp $
33133# pwsafe: file(1) magic for passwordsafe file
33134#
33135# Password Safe
33136# http://passwordsafe.sourceforge.net/
33137# file format specs
33138# https://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV3.txt
33139# V2 https://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV2.txt
33140# V1 https://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/notes.txt
33141# V2 and V1 have no easy identifier that I can find
33142# .psafe3
331430	string	PWS3	Password Safe V3 database
33144
33145#------------------------------------------------------------------------------
33146# $File: pyramid,v 1.7 2009/09/19 16:28:12 christos Exp $
33147# pyramid:  file(1) magic for Pyramids
33148#
33149# XXX - byte order?
33150#
331510	long		0x50900107	Pyramid 90x family executable
331520	long		0x50900108	Pyramid 90x family pure executable
33153>16	long		>0		not stripped
331540	long		0x5090010b	Pyramid 90x family demand paged pure executable
33155>16	long		>0		not stripped
33156
33157#------------------------------------------------------------------------------
33158# $File: python,v 1.45 2022/07/24 23:59:37 christos Exp $
33159# python:  file(1) magic for python
33160#
33161# Outlook puts """ too for urgent messages
33162# From: David Necas <yeti@physics.muni.cz>
33163# often the module starts with a multiline string
331640	string/t	"""	Python script text executable
33165# MAGIC as specified in Python/import.c (1.0 to 3.7)
33166# and in Lib/importlib/_bootstrap_external.py (3.5+)
33167# two bytes of magic followed by "\r\n" in little endian order
331680	belong		0x02099900	python 1.0 byte-compiled
33169!:mime application/x-bytecode.python
331700	belong		0x03099900	python 1.1/1.2 byte-compiled
33171!:mime application/x-bytecode.python
331720	belong		0x892e0d0a	python 1.3 byte-compiled
33173!:mime application/x-bytecode.python
331740	belong		0x04170d0a	python 1.4 byte-compiled
33175!:mime application/x-bytecode.python
331760	belong		0x994e0d0a	python 1.5 byte-compiled
33177!:mime application/x-bytecode.python
331780	belong		0xfcc40d0a	python 1.6 byte-compiled
33179!:mime application/x-bytecode.python
331800	belong		0xfdc40d0a	python 1.6 byte-compiled
33181!:mime application/x-bytecode.python
331820	belong		0x87c60d0a	python 2.0 byte-compiled
33183!:mime application/x-bytecode.python
331840	belong		0x88c60d0a	python 2.0 byte-compiled
33185!:mime application/x-bytecode.python
331860	belong		0x2aeb0d0a	python 2.1 byte-compiled
33187!:mime application/x-bytecode.python
331880	belong		0x2beb0d0a	python 2.1 byte-compiled
33189!:mime application/x-bytecode.python
331900	belong		0x2ded0d0a	python 2.2 byte-compiled
33191!:mime application/x-bytecode.python
331920	belong		0x2eed0d0a	python 2.2 byte-compiled
33193!:mime application/x-bytecode.python
331940	belong		0x3bf20d0a	python 2.3 byte-compiled
33195!:mime application/x-bytecode.python
331960	belong		0x3cf20d0a	python 2.3 byte-compiled
33197!:mime application/x-bytecode.python
331980	belong		0x45f20d0a	python 2.3 byte-compiled
33199!:mime application/x-bytecode.python
332000	belong		0x59f20d0a	python 2.4 byte-compiled
33201!:mime application/x-bytecode.python
332020	belong		0x63f20d0a	python 2.4 byte-compiled
33203!:mime application/x-bytecode.python
332040	belong		0x6df20d0a	python 2.4 byte-compiled
33205!:mime application/x-bytecode.python
332060	belong		0x6ef20d0a	python 2.4 byte-compiled
33207!:mime application/x-bytecode.python
332080	belong		0x77f20d0a	python 2.5 byte-compiled
33209!:mime application/x-bytecode.python
332100	belong		0x81f20d0a	python 2.5 byte-compiled
33211!:mime application/x-bytecode.python
332120	belong		0x8bf20d0a	python 2.5 byte-compiled
33213!:mime application/x-bytecode.python
332140	belong		0x8cf20d0a	python 2.5 byte-compiled
33215!:mime application/x-bytecode.python
332160	belong		0x95f20d0a	python 2.5 byte-compiled
33217!:mime application/x-bytecode.python
332180	belong		0x9ff20d0a	python 2.5 byte-compiled
33219!:mime application/x-bytecode.python
332200	belong		0xa9f20d0a	python 2.5 byte-compiled
33221!:mime application/x-bytecode.python
332220	belong		0xb3f20d0a	python 2.5 byte-compiled
33223!:mime application/x-bytecode.python
332240	belong		0xb4f20d0a	python 2.5 byte-compiled
33225!:mime application/x-bytecode.python
332260	belong		0xc7f20d0a	python 2.6 byte-compiled
33227!:mime application/x-bytecode.python
332280	belong		0xd1f20d0a	python 2.6 byte-compiled
33229!:mime application/x-bytecode.python
332300	belong		0xd2f20d0a	python 2.6 byte-compiled
33231!:mime application/x-bytecode.python
332320	belong		0xdbf20d0a	python 2.7 byte-compiled
33233!:mime application/x-bytecode.python
332340	belong		0xe5f20d0a	python 2.7 byte-compiled
33235!:mime application/x-bytecode.python
332360	belong		0xeff20d0a	python 2.7 byte-compiled
33237!:mime application/x-bytecode.python
332380	belong		0xf9f20d0a	python 2.7 byte-compiled
33239!:mime application/x-bytecode.python
332400	belong		0x03f30d0a	python 2.7 byte-compiled
33241!:mime application/x-bytecode.python
332420	belong		0x04f30d0a	python 2.7 byte-compiled
33243!:mime application/x-bytecode.python
332440	belong		0x0af30d0a	PyPy2.7 byte-compiled
33245!:mime application/x-bytecode.python
332460	belong		0xb80b0d0a	python 3.0 byte-compiled
33247!:mime application/x-bytecode.python
332480	belong		0xc20b0d0a	python 3.0 byte-compiled
33249!:mime application/x-bytecode.python
332500	belong		0xcc0b0d0a	python 3.0 byte-compiled
33251!:mime application/x-bytecode.python
332520	belong		0xd60b0d0a	python 3.0 byte-compiled
33253!:mime application/x-bytecode.python
332540	belong		0xe00b0d0a	python 3.0 byte-compiled
33255!:mime application/x-bytecode.python
332560	belong		0xea0b0d0a	python 3.0 byte-compiled
33257!:mime application/x-bytecode.python
332580	belong		0xf40b0d0a	python 3.0 byte-compiled
33259!:mime application/x-bytecode.python
332600	belong		0xf50b0d0a	python 3.0 byte-compiled
33261!:mime application/x-bytecode.python
332620	belong		0xff0b0d0a	python 3.0 byte-compiled
33263!:mime application/x-bytecode.python
332640	belong		0x090c0d0a	python 3.0 byte-compiled
33265!:mime application/x-bytecode.python
332660	belong		0x130c0d0a	python 3.0 byte-compiled
33267!:mime application/x-bytecode.python
332680	belong		0x1d0c0d0a	python 3.0 byte-compiled
33269!:mime application/x-bytecode.python
332700	belong		0x1f0c0d0a	python 3.0 byte-compiled
33271!:mime application/x-bytecode.python
332720	belong		0x270c0d0a	python 3.0 byte-compiled
33273!:mime application/x-bytecode.python
332740	belong		0x3b0c0d0a	python 3.0 byte-compiled
33275!:mime application/x-bytecode.python
332760	belong		0x450c0d0a	python 3.1 byte-compiled
33277!:mime application/x-bytecode.python
332780	belong		0x4f0c0d0a	python 3.1 byte-compiled
33279!:mime application/x-bytecode.python
332800	belong		0x580c0d0a	python 3.2 byte-compiled
33281!:mime application/x-bytecode.python
332820	belong		0x620c0d0a	python 3.2 byte-compiled
33283!:mime application/x-bytecode.python
332840	belong		0x6c0c0d0a	python 3.2 byte-compiled
33285!:mime application/x-bytecode.python
332860	belong		0x760c0d0a	python 3.3 byte-compiled
33287!:mime application/x-bytecode.python
332880	belong		0x800c0d0a	python 3.3 byte-compiled
33289!:mime application/x-bytecode.python
332900	belong		0x8a0c0d0a	python 3.3 byte-compiled
33291!:mime application/x-bytecode.python
332920	belong		0x940c0d0a	python 3.3 byte-compiled
33293!:mime application/x-bytecode.python
332940	belong		0x9e0c0d0a	python 3.3 byte-compiled
33295!:mime application/x-bytecode.python
332960	belong		0xb20c0d0a	python 3.4 byte-compiled
33297!:mime application/x-bytecode.python
332980	belong		0xbc0c0d0a	python 3.4 byte-compiled
33299!:mime application/x-bytecode.python
333000	belong		0xc60c0d0a	python 3.4 byte-compiled
33301!:mime application/x-bytecode.python
333020	belong		0xd00c0d0a	python 3.4 byte-compiled
33303!:mime application/x-bytecode.python
333040	belong		0xda0c0d0a	python 3.4 byte-compiled
33305!:mime application/x-bytecode.python
333060	belong		0xe40c0d0a	python 3.4 byte-compiled
33307!:mime application/x-bytecode.python
333080	belong		0xee0c0d0a	python 3.4 byte-compiled
33309!:mime application/x-bytecode.python
333100	belong		0xf80c0d0a	python 3.5.1- byte-compiled
33311!:mime application/x-bytecode.python
333120	belong		0x020d0d0a	python 3.5.1- byte-compiled
33313!:mime application/x-bytecode.python
333140	belong		0x0c0d0d0a	python 3.5.1- byte-compiled
33315!:mime application/x-bytecode.python
333160	belong		0x160d0d0a	python 3.5.1- byte-compiled
33317!:mime application/x-bytecode.python
333180	belong		0x170d0d0a	python 3.5.2+ byte-compiled
33319!:mime application/x-bytecode.python
333200	belong		0x200d0d0a	python 3.6 byte-compiled
33321!:mime application/x-bytecode.python
333220	belong		0x210d0d0a	python 3.6 byte-compiled
33323!:mime application/x-bytecode.python
333240	belong		0x2a0d0d0a	python 3.6 byte-compiled
33325!:mime application/x-bytecode.python
333260	belong		0x2b0d0d0a	python 3.6 byte-compiled
33327!:mime application/x-bytecode.python
333280	belong		0x2c0d0d0a	python 3.6 byte-compiled
33329!:mime application/x-bytecode.python
333300	belong		0x2d0d0d0a	python 3.6 byte-compiled
33331!:mime application/x-bytecode.python
333320	belong		0x2f0d0d0a	python 3.6 byte-compiled
33333!:mime application/x-bytecode.python
333340	belong		0x300d0d0a	python 3.6 byte-compiled
33335!:mime application/x-bytecode.python
333360	belong		0x310d0d0a	python 3.6 byte-compiled
33337!:mime application/x-bytecode.python
333380	belong		0x320d0d0a	python 3.6 byte-compiled
33339!:mime application/x-bytecode.python
333400	belong		0x330d0d0a	python 3.6 byte-compiled
33341!:mime application/x-bytecode.python
333420	belong		0x3e0d0d0a	python 3.7 byte-compiled
33343!:mime application/x-bytecode.python
333440	belong		0x3f0d0d0a	python 3.7 byte-compiled
33345!:mime application/x-bytecode.python
33346
33347# magic 3392+ implements PEP 552: Deterministic pycs
333480	name		pyc-pep552
33349# the flag field determines how .pyc validity is checked
33350>4	ulelong&1	0		timestamp-based,
33351>>8	uledate		x		.py timestamp: %s UTC,
33352>>12	ulelong		x		.py size: %d bytes
33353>4	ulelong&1	!0		hash-based, check-source flag
33354>>4	ulelong&2	0		unset,
33355>>4	ulelong&2	!0		set,
33356>>8	ulequad		x		hash: 0x%llx
33357
33358# uleshort magic followed by \x0d\0xa
333592		string		\x0d\x0a
33360# extra check: only two bits of flag field are currently used
33361>4		ulelong		<0x4
33362# \x0d as part of magic should suffice till Python 3.14 (magic 3600)
33363>>1		ubyte		0x0d		Byte-compiled Python module for
33364!:mime application/x-bytecode.python
33365# now look at the magic number to determine the version
33366>>>0		uleshort	<3400		CPython 3.7,
33367>>>0		default		x
33368>>>>0		uleshort	<3420		CPython 3.8,
33369>>>>0		default		x
33370>>>>>0		uleshort	<3430		CPython 3.9,
33371>>>>>0		default		x
33372>>>>>>0		uleshort	<3450		CPython 3.10,
33373>>>>>>0		default		x
33374>>>>>>>0	uleshort	<3500		CPython 3.11,
33375>>>>>>>0	default		x		CPython 3.12 or newer,
33376>>>0		use		pyc-pep552
33377>>0		uleshort	240		Byte-compiled Python module for PyPy3.7,
33378!:mime application/x-bytecode.python
33379>>>0		use		pyc-pep552
33380>>0		uleshort	256		Byte-compiled Python module for PyPy3.8,
33381!:mime application/x-bytecode.python
33382>>>0		use		pyc-pep552
33383>>0		uleshort	336		Byte-compiled Python module for PyPy3.9,
33384!:mime application/x-bytecode.python
33385>>>0		use		pyc-pep552
33386
333870	search/1/w	#!\040/usr/bin/python	Python script text executable
33388!:strength + 15
33389!:mime text/x-script.python
333900	search/1/w	#!\040/usr/local/bin/python	Python script text executable
33391!:strength + 15
33392!:mime text/x-script.python
333930	search/10/w	#!\040/usr/bin/env\040python	Python script text executable
33394!:strength + 15
33395!:mime text/x-script.python
33396
33397
33398# from module.submodule import func1, func2
333990	search/8192	import
33400>0	regex		\^from[\040\t]+([A-Za-z0-9_]|\\.)+[\040\t]+import.*$	Python script text executable
33401!:strength + 15
33402!:mime text/x-script.python
33403
33404# def __init__ (self, ...):
334050	search/4096	def\ __init__
33406>&0	search/64 self	Python script text executable
33407!:strength + 15
33408!:mime text/x-script.python
33409
33410# if __name__ == "__main__":
334110 search/4096 if\ __name__
33412>&0 search/64 '__main__'	Python script text executable
33413>&0 search/64 "__main__"	Python script text executable
33414!:strength + 15
33415!:mime text/x-script.python
33416
33417# import module [as abrev]
334180	search/8192	import
33419>0	regex	\^import\ [_[:alpha:]]+\ as\ [[:alpha:]][[:space:]]*$ Python script text executable
33420!:mime text/x-script.python
33421
33422# comments
33423#0	search/4096	'''
33424#>&0	regex	.*'''$	Python script text executable
33425#!:mime text/x-script.python
33426
33427#0	search/4096	"""
33428#>&0	regex	.*"""$	Python script text executable
33429#!:mime text/x-script.python
33430
33431# try:
33432# except: or finally:
33433# block
334340	search/4096	try:
33435>&0	regex	\^[[:space:]]*except.*:$	Python script text executable
33436!:strength + 15
33437!:mime text/x-script.python
33438>&0	search/4096	finally:	Python script text executable
33439!:mime text/x-script.python
33440
33441# class name[(base classes,)]: [pass]
334420	search/8192	class
33443>0	regex	\^class\ [_[:alpha:]]+(\\(.*\\))?(\ )*:([\ \t]+pass)?$		Python script text executable
33444!:strength + 15
33445!:mime text/x-script.python
33446
33447# def name(*args, **kwargs):
334480	search/8192	def\
33449>0	regex	 \^[[:space:]]{0,50}def\ {1,50}[_a-zA-Z]{1,100}
33450>>&0	regex	 \\(([[:alpha:]*_,\ ]){0,255}\\):$ Python script text executable
33451!:strength + 15
33452!:mime text/x-script.python
33453
33454# https://numpy.org/devdocs/reference/generated/numpy.lib.format.html
334550	string	\223NUMPY		NumPy data file
33456!:mime  application/x-numpy-data
33457>6	byte	x			\b, version %d
33458>7	byte	x			\b.%d
33459#>8	leshort	x			\b, header length=%d
33460>10	string	x			\b, description %s
33461
33462#------------------------------------------------------------------------------
33463# $File: qt,v 1.3 2019/04/19 00:42:27 christos Exp $
33464# qt:  file(1) magic for Qt
33465
33466# https://doc.qt.io/qt-5/resources.html
334670	string		\<!DOCTYPE\040RCC\>	Qt Resource Collection file
33468
33469# https://qt.gitorious.org/qt/qtbase/source/\
33470# 5367fa356233da4c0f28172a8f817791525f5457:\
33471# src/tools/rcc/rcc.cpp#L840
334720	string		qres\0\0		Qt Binary Resource file
334730	search/1024	The\040Resource\040Compiler\040for\040Qt	Qt C-code resource file
33474
33475# https://qt.gitorious.org/qt/qtbase/source/\
33476# 5367fa356233da4c0f28172a8f817791525f5457:\
33477# src/corelib/kernel/qtranslator.cpp#L62
334780	string		\x3c\xb8\x64\x18\xca\xef\x9c\x95
33479>8	string		\xcd\x21\x1c\xbf\x60\xa1\xbd\xdd	Qt Translation file
33480
33481#------------------------------------------------------------------------------
33482# $File: revision,v 1.11 2019/04/19 00:42:27 christos Exp $
33483# file(1) magic for revision control files
33484# From Hendrik Scholz <hendrik@scholz.net>
334850	string/t	/1\ :pserver:	cvs password text file
33486
33487# Conary changesets
33488# From: Jonathan Smith <smithj@rpath.com>
334890	belong	0xea3f81bb	Conary changeset data
33490
33491# Type: Git bundles (git-bundle)
33492# From: Josh Triplett <josh@freedesktop.org>
334930	string	#\ v2\ git\ bundle\n	Git bundle
33494
33495# Type: Git pack
33496# From: Adam Buchbinder <adam.buchbinder@gmail.com>
33497# Update: Joerg Jenderek
33498# URL: http://fileformats.archiveteam.org/wiki/Git
33499# reference: https://github.com/git/git/blob/master/Documentation/technical/pack-format.txt
33500# The actual magic is 'PACK', but that clashes with Doom/Quake packs. However,
33501# those have a little-endian offset immediately following the magic 'PACK',
33502# the first byte of which is never 0, while the first byte of the Git pack
33503# version, since it's a tiny number stored in big-endian format, is always 0.
335040	string	PACK
33505# GRR: line above is too general as it matches also PackDir archive ./acorn
33506# test for major version. Git 2017 accepts version number 2 or 3
33507>4	ubelong	<9
33508# Acorn PackDir with method 0 compression has root like ADFS::HardDisc4.$.AsylumSrc
33509# or SystemDevice::foobar
33510>>9	search/13 ::
33511# but in git binary
33512>>9	default	x	Git pack
33513!:mime	application/x-git
33514!:ext	pack
33515# 4 GB limit implies unsigned integer
33516>>>4	ubelong	x		\b, version %u
33517>>>8	ubelong	x		\b, %u objects
33518
33519# Type: Git pack index
33520# From: Adam Buchbinder <adam.buchbinder@gmail.com>
335210	string	\377tOc		Git pack index
33522>4	belong	=2		\b, version 2
33523
33524# Type: Git index file
33525# From: Frederic Briare <fbriere@fbriere.net>
335260	string	DIRC		Git index
33527>4	belong	>0		\b, version %d
33528>>8	belong	>0		\b, %d entries
33529
33530# Type:	Mercurial bundles
33531# From:	Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr>
335320	string	HG10		Mercurial bundle,
33533>4	string	UN		uncompressed
33534>4	string	BZ		bzip2 compressed
33535
33536# Type:	Subversion (SVN) dumps
33537# From:	Uwe Zeisberger <zeisberg@informatik.uni-freiburg.de>
335380	string	SVN-fs-dump-format-version:	Subversion dumpfile
33539>28	string	>\0				(version: %s)
33540
33541# Type:	Bazaar revision bundles and merge requests
33542# URL:	https://www.bazaar-vcs.org/
33543# From:	Jelmer Vernooij <jelmer@samba.org>
335440	string	#\ Bazaar\ revision\ bundle\ v Bazaar Bundle
335450	string	#\ Bazaar\ merge\ directive\ format Bazaar merge directive
33546
33547#------------------------------------------------------------------------------
33548# $File: riff,v 1.45 2022/07/24 23:47:49 christos Exp $
33549# riff:  file(1) magic for RIFF format
33550# See
33551#
33552#	https://www.seanet.com/users/matts/riffmci/riffmci.htm
33553#	http://www-mmsp.ece.mcgill.ca/Documents/AudioFormats/WAVE/Docs/riffmci.pdf
33554#	https://www.iana.org/assignments/wave-avi-codec-registry/wave-avi-codec-registry.xml
33555#
33556
33557# audio format tag. Assume limits: max 1024 bit, 128 channels, 1 MHz
335580   name    riff-wave
33559>0	leshort		0x01		\b, Microsoft PCM
33560>>14	leshort		>0
33561>>>14	leshort		<1024	\b, %d bit
33562>0	leshort		0x02		\b, Microsoft ADPCM
33563>0	leshort		0x03		\b, IEEE Float
33564>0	leshort		0x04		\b, Compaq VSELP
33565>0	leshort		0x05		\b, IBM CVSD
33566>0	leshort		0x06		\b, ITU G.711 A-law
33567>0	leshort		0x07		\b, ITU G.711 mu-law
33568>0	leshort		0x08		\b, Microsoft DTS
33569>0	leshort		0x10		\b, OKI ADPCM
33570>0	leshort		0x11		\b, IMA ADPCM
33571>0	leshort		0x12		\b, MediaSpace ADPCM
33572>0	leshort		0x13		\b, Sierra ADPCM
33573>0	leshort		0x14		\b, ITU G.723 ADPCM (Yamaha)
33574>0	leshort		0x15		\b, DSP Solutions DIGISTD
33575>0	leshort		0x16		\b, DSP Solutions DIGIFIX
33576>0	leshort		0x17		\b, Dialogic OKI ADPCM
33577>0	leshort		0x18		\b, MediaVision ADPCM
33578>0	leshort		0x19		\b, HP CU
33579>0	leshort		0x20		\b, Yamaha ADPCM
33580>0	leshort		0x21		\b, Speech Compression SONARC
33581>0	leshort		0x22		\b, DSP Group True Speech
33582>0	leshort		0x23		\b, Echo Speech EchoSC1
33583>0	leshort		0x24		\b, AudioFile AF36
33584>0	leshort		0x25		\b, APTX
33585>0	leshort		0x26		\b, AudioFile AF10
33586>0	leshort		0x27		\b, Prosody 1612
33587>0	leshort		0x28		\b, LRC
33588>0	leshort		0x30		\b, Dolby AC2
33589>0	leshort		0x31		\b, GSM 6.10
33590>0	leshort		0x32		\b, MSN Audio
33591>0	leshort		0x33		\b, Antex ADPCME
33592>0	leshort		0x34		\b, Control Res VQLPC
33593>0	leshort		0x35		\b, Digireal
33594>0	leshort		0x36		\b, DigiADPCM
33595>0	leshort		0x37		\b, Control Res CR10
33596>0	leshort		0x38		\b, NMS VBXADPCM
33597>0	leshort		0x39		\b, Roland RDAC
33598>0	leshort		0x3A		\b, Echo Speech EchoSC3
33599>0	leshort		0x3B		\b, Rockwell ADPCM
33600>0	leshort		0x3C		\b, Rockwell Digitalk
33601>0	leshort		0x3D		\b, Xebec
33602>0	leshort		0x40		\b, ITU G.721 ADPCM
33603>0	leshort		0x41		\b, ITU G.728 CELP
33604>0	leshort		0x42		\b, MSG723
33605>0	leshort		0x50		\b, MPEG
33606>0	leshort		0x52		\b, RT24
33607>0	leshort		0x53		\b, PAC
33608>0	leshort		0x55		\b, MPEG Layer 3
33609>0	leshort		0x59		\b, Lucent G.723
33610>0	leshort		0x60		\b, Cirrus
33611>0	leshort		0x61		\b, ESPCM
33612>0	leshort		0x62		\b, Voxware
33613>0	leshort		0x63		\b, Canopus Atrac
33614>0	leshort		0x64		\b, ITU G.726 ADPCM
33615>0	leshort		0x65		\b, ITU G.722 ADPCM
33616>0	leshort		0x66		\b, DSAT
33617>0	leshort		0x67		\b, DSAT Display
33618>0	leshort		0x69		\b, Voxware Byte Aligned
33619>0	leshort		0x70		\b, Voxware AC8
33620>0	leshort		0x71		\b, Voxware AC10
33621>0	leshort		0x72		\b, Voxware AC16
33622>0	leshort		0x73		\b, Voxware AC20
33623>0	leshort		0x74		\b, Voxware MetaVoice
33624>0	leshort		0x75		\b, Voxware MetaSound
33625>0	leshort		0x76		\b, Voxware RT29HW
33626>0	leshort		0x77		\b, Voxware VR12
33627>0	leshort		0x78		\b, Voxware VR18
33628>0	leshort		0x79		\b, Voxware TQ40
33629>0	leshort		0x80		\b, Softsound
33630>0	leshort		0x81		\b, Voxware TQ60
33631>0	leshort		0x82		\b, MSRT24
33632>0	leshort		0x83		\b, ITU G.729A
33633>0	leshort		0x84		\b, MVI MV12
33634>0	leshort		0x85		\b, DF G.726
33635>0	leshort		0x86		\b, DF GSM610
33636>0	leshort		0x88		\b, ISIAudio
33637>0	leshort		0x89		\b, Onlive
33638>0	leshort		0x91		\b, SBC24
33639>0	leshort		0x92		\b, Dolby AC3 S/PDIF
33640>0	leshort		0x97		\b, ZyXEL ADPCM
33641>0	leshort		0x98		\b, Philips LPCBB
33642>0	leshort		0x99		\b, Packed
33643>0	leshort		0x100		\b, Rhetorex ADPCM
33644>0	leshort		0x101		\b, BeCubed Software IRAT
33645>0	leshort		0x111		\b, Vivo G.723
33646>0	leshort		0x112		\b, Vivo Siren
33647>0	leshort		0x123		\b, Digital G.723
33648>0	leshort		0x200		\b, Creative ADPCM
33649>0	leshort		0x202		\b, Creative FastSpeech8
33650>0	leshort		0x203		\b, Creative FastSpeech10
33651>0	leshort		0x220		\b, Quarterdeck
33652>0	leshort		0x300		\b, FM Towns Snd
33653>0	leshort		0x400		\b, BTV Digital
33654>0	leshort		0x680		\b, VME VMPCM
33655>0	leshort		0x1000		\b, OLIGSM
33656>0	leshort		0x1001		\b, OLIADPCM
33657>0	leshort		0x1002		\b, OLICELP
33658>0	leshort		0x1003		\b, OLISBC
33659>0	leshort		0x1004		\b, OLIOPR
33660>0	leshort		0x1100		\b, LH Codec
33661>0	leshort		0x1400		\b, Norris
33662>0	leshort		0x1401		\b, ISIAudio
33663>0	leshort		0x1500		\b, Soundspace Music Compression
33664>0	leshort		0x2000		\b, AC3 DVM
33665>0	leshort		0x2001		\b, DTS
33666>2	leshort		=1		\b, mono
33667>2	leshort		=2		\b, stereo
33668>2	leshort		>2
33669>>2	leshort		<128	\b, %d channels
33670>4	lelong		>0
33671>>4	lelong		<1000000	%d Hz
33672
33673# try to find "fmt "
336740   name    riff-walk
33675>0  string  fmt\x20
33676>>4 lelong  >15
33677>>>8 use    riff-wave
33678>0  string  LIST
33679>>&(4.l+4)  use riff-walk
33680>0  string  DISP
33681>>&(4.l+4)  use riff-walk
33682>0  string  bext
33683>>&(4.l+4)  use riff-walk
33684>0  string  Fake
33685>>&(4.l+4)  use riff-walk
33686>0  string  fact
33687>>&(4.l+4)  use riff-walk
33688>0  string  VP8
33689>>11		byte		0x9d
33690>>>12		byte		0x01
33691>>>>13		byte		0x2a	\b, VP8 encoding
33692>>>>>14		leshort&0x3fff	x	\b, %d
33693>>>>>16		leshort&0x3fff	x	\bx%d, Scaling:
33694>>>>>14		leshort&0xc000	0x0000	\b [none]
33695>>>>>14		leshort&0xc000	0x1000	\b [5/4]
33696>>>>>14		leshort&0xc000	0x2000	\b [5/3]
33697>>>>>14		leshort&0xc000	0x3000	\b [2]
33698>>>>>14		leshort&0xc000	0x0000	\bx[none]
33699>>>>>14		leshort&0xc000	0x1000	\bx[5/4]
33700>>>>>14		leshort&0xc000	0x2000	\bx[5/3]
33701>>>>>14		leshort&0xc000	0x3000	\bx[2]
33702>>>>>15		byte&0x80	=0x00	\b, YUV color
33703>>>>>15		byte&0x80	=0x80	\b, bad color specification
33704>>>>>15		byte&0x40	=0x40	\b, no clamping required
33705>>>>>15		byte&0x40	=0x00	\b, decoders should clamp
33706#>0  string  x		we got %s
33707#>>&(4.l+4)  use riff-walk
33708
33709# RecorderGear TR500 call recorder digits (BCD)
337100	name	tr500-call-recorder-digits
33711>0	byte&0xF0	0x00	\b0
33712>0	byte&0xF0	0x10	\b1
33713>0	byte&0xF0	0x20	\b2
33714>0	byte&0xF0	0x30	\b3
33715>0	byte&0xF0	0x40	\b4
33716>0	byte&0xF0	0x50	\b5
33717>0	byte&0xF0	0x60	\b6
33718>0	byte&0xF0	0x70	\b7
33719>0	byte&0xF0	0x80	\b8
33720>0	byte&0xF0	0x90	\b9
33721>0	byte&0xF0	0xb0	\b*
33722>0	byte&0xF0	0xc0	\b#
33723>0	byte&0x0F	0	\b0
33724>0	byte&0x0F	1	\b1
33725>0	byte&0x0F	2	\b2
33726>0	byte&0x0F	3	\b3
33727>0	byte&0x0F	4	\b4
33728>0	byte&0x0F	5	\b5
33729>0	byte&0x0F	6	\b6
33730>0	byte&0x0F	7	\b7
33731>0	byte&0x0F	8	\b8
33732>0	byte&0x0F	9	\b9
33733>0	byte&0x0F	0xb	\b*
33734>0	byte&0x0F	0xc	\b#
33735
33736# TR500 call recorder extended header
33737# From: David Korth <gerbilsoft@gerbilsoft.com>
33738# Contains dialed/incoming phone number and timestamp.
33739# TODO: Verify byte 15.
337400	name	tr500-call-recorder-header
33741>15	byte	2	(outgoing call:
33742>15	byte	4	(incoming call:
33743>1	byte	0xFF	\bno number
33744>1	byte	!0xFF
33745>>1	use	tr500-call-recorder-digits
33746>>2	byte	!0xFF
33747>>>2	use	tr500-call-recorder-digits
33748>>3	byte	!0xFF
33749>>>3	use	tr500-call-recorder-digits
33750>>4	byte	!0xFF
33751>>>4	use	tr500-call-recorder-digits
33752>>5	byte	!0xFF
33753>>>5	use	tr500-call-recorder-digits
33754>>6	byte	!0xFF
33755>>>6	use	tr500-call-recorder-digits
33756>>7	byte	!0xFF
33757>>>7	use	tr500-call-recorder-digits
33758>>8	byte	!0xFF
33759>>>8	use	tr500-call-recorder-digits
33760>9	byte	x	\b, 20%02x
33761>10	byte	x	\b/%02x
33762>11	byte	x	\b/%02x
33763>12	byte	x	%02x
33764>13	byte	x	\b:%02x
33765>14	byte	x	\b:%02x)
33766
33767# AVI section extended by Patrik Radman <patrik+file-magic@iki.fi>
33768#
337690	string		RIFF		RIFF (little-endian) data
33770# RIFF Palette format
33771# Update: Joerg Jenderek
33772# URL: https://en.wikipedia.org/wiki/Resource_Interchange_File_Format
33773# Reference: https://worms2d.info/Palette_file
33774# WAVE/AVI codec registry: https://www.iana.org/assignments/wave-avi-codec-registry/wave-avi-codec-registry.xml
33775>8	string		PAL\ 		\b, palette
33776!:mime	application/x-riff
33777# color palette by Microsoft Corporation
33778!:ext	pal
33779# file size =  chunk size + 8 in most cases
33780>>4	ulelong+8	x		\b, %u bytes
33781# Extended PAL Format
33782>>12	string		plth		\b, extended
33783# Simple PAL Format
33784>>12	string		data
33785# data chunk size = color entries * 4 + 4 + sometimes extra (4) appended bytes
33786>>>16	ulelong		x		\b, data size %u
33787# palVersion is always 0x0300
33788#>>>20	leshort		x		\b, version %#4.4x
33789# palNumEntries specifies the number of palette color entries
33790>>>22	uleshort	x		\b, %u entries
33791# after palPalEntry sized (number of color entries * 4 ) vector
33792>>>(22.s*4)	ubequad	x
33793# jump relative 22 ( 8 + 16) bytes forward points after end of file or to
33794# appended extra bytes like in http://safecolours.rigdenage.com/set(ms).zip/Protan(MS).pal
33795>>>>&16		ubelong	x		\b, extra bytes
33796>>>>>&-4	ubelong	>0		%#8.8x
33797# RIFF Device Independent Bitmap format
33798# URL: http://fileformats.archiveteam.org/wiki/RDIB
33799>8	string		RDIB		\b, device-independent bitmap
33800!:ext	rdi/dib
33801>>16	string		BM
33802>>>30	leshort		12		\b, OS/2 1.x format
33803>>>>34	leshort		x		\b, %d x
33804>>>>36	leshort		x		%d
33805>>>30	leshort		64		\b, OS/2 2.x format
33806>>>>34	leshort		x		\b, %d x
33807>>>>36	leshort		x		%d
33808>>>30	leshort		40		\b, Windows 3.x format
33809>>>>34	lelong		x		\b, %d x
33810>>>>38	lelong		x		%d x
33811>>>>44	leshort		x		%d
33812# RIFF MIDI format
33813# URL:	http://fileformats.archiveteam.org/wiki/RIFF_MIDI
33814>8	string		RMID		\b, MIDI
33815# http://extension.nirsoft.net/rmi
33816!:mime	audio/mid
33817#!:mime	audio/x-rmid
33818!:ext	rmi
33819# RIFF Multimedia Movie File format
33820# URL:	http://fileformats.archiveteam.org/wiki/RIFF_Multimedia_Movie
33821>8	string		RMMP		\b, multimedia movie
33822!:mime	video/x-mmm
33823!:ext	mmm
33824# RIFF wrapper for MP3
33825>8	string		RMP3		\b, MPEG Layer 3 audio
33826#!:mime	audio/x-rmp3
33827# Microsoft WAVE format (*.wav)
33828# URL:		http://fileformats.archiveteam.org/wiki/WAV
33829>8	string		WAVE		\b, WAVE audio
33830#!:mime	audio/vnd.wave
33831!:mime	audio/x-wav
33832# https://www.macdisk.com/macsigen.php
33833#!:apple	????WAVE
33834!:ext	wav/wave
33835>>12    string  >\0
33836>>>12   use     riff-walk
33837# TR500 call recorder extended header
33838>>16	ulelong		0x1E4
33839>>>20	leshort		0x11
33840>>>>256	byte		4
33841>>>>>256 use		tr500-call-recorder-header
33842# Update:	Joerg Jenderek
33843# lower case for Corel Draw version 8 Bidi
33844>8	string/c	cdr
33845# skip Corel CCX Clipart
33846>>8	string		!CDRXcont
33847# Corel Draw Picture
33848>>>0	use     corel-draw
33849# URL:		http://fileformats.archiveteam.org/wiki/CCX_(Corel)
33850# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/c/ccx-corel.trid.xml
33851>>8	string		=CDRXcont	\b, Corel Clipart
33852!:mime	application/x-corel-ccx
33853!:ext	ccx
33854# 3rd chunk data {Corel\040Binary\040Meta\040File}
33855#>>>20	string		x		\b, 3rd '%-s'
33856>>>4	ulelong+8	x		\b, %u bytes
33857# From:		Joerg Jenderek
33858# URL:		https://en.wikipedia.org/wiki/CorelDRAW
33859# Reference:	http://fileformats.archiveteam.org/wiki/CorelDRAW
33860# Picture templates created by newer software start with RIFF type CDT
33861>8	string		CDT
33862>>0	use		corel-draw
33863# Picture templates with version 4.4
33864>8	string		CDST
33865>>0	use		corel-draw
33866# pattern created by newer software start with RIFF type PAT
33867>8	string		PAT
33868>>0	use		corel-draw
33869# From:		Joerg Jenderek
33870# URL:		https://en.wikipedia.org/wiki/Corel_Designer
33871# Reference:	http://fileformats.archiveteam.org/wiki/Corel_Designer
33872>8	string		DES
33873>>8	string		!DESC
33874>>>0	use		corel-des
33875# Corel Draw templates with version 12.5 or Corel Designer illustration 12
33876>>8	string		=DESC
33877# MORE TESTS NEEDED HERE!
33878#>>>0	use		corel-des
33879#>>>0	use		corel-draw
33880>8	string		NUNDROOT	\b, Steinberg CuBase
33881# From:		Joerg Jenderek
33882# URL:		http://fileformats.archiveteam.org/wiki/MIDI_Instrument_Definition_File
33883# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/i/idf.trid.xml
33884#		ftp://curscott.servebeer.com/Download/Apps/_Microsoft/
33885#  		Visual%20Studio%206.0%20Professional%20MSDN/
33886#		SAMPLES/VC98/SDK/GRAPHICS/AUDIO/IDFEDIT/GLOBALS.H
33887# Note:		called "MIDI Instrument Definition File" by TrID
33888>8	string		IDF\ LIST	\b, MIDI Instrument Definition File
33889!:mime	audio/x-idf
33890!:ext	idf
33891# 3rd chunk size like: 254 284 286 670
33892#>>0x10	ulelong		x		\b, 3th SIZE %u
33893# for debugging purpose display next chunk like: MMAPhdr
33894#>>0x14	string		x		\b, 4th "%-8.8s"
33895#>>0x1C	ulelong		x		\b, 4th SIZE 0x%x
33896# probably MIDI instrument name like: "Universal-MIDI-Instrument" "instrument name" "General MIDI"
33897>>0x30	string		x		"%s"
33898# look for inst TAG
33899>>0x31	search/256	inst		by
33900# probably manufacture name like: "Unspecified Company" "NVidia Corporation"
33901>>>&0x24	string	x		"%s"
33902# AVI == Audio Video Interleave
33903# Reference:	http://fileformats.archiveteam.org/wiki/AVI
33904>8	string		AVI\040		\b, AVI
33905# https://reposcope.com/mimetype/video/x-msvideo
33906!:mime	video/x-msvideo
33907# https://www.iana.org/assignments/wave-avi-codec-registry/wave-avi-codec-registry.xml
33908#!:mime	video/vnd.avi
33909!:ext	avi/divx
33910>>12    string          LIST
33911>>>20   string          hdrlavih
33912>>>>&36 lelong          x               \b, %u x
33913>>>>&40 lelong          x               %u,
33914>>>>&4  lelong          >1000000        <1 fps,
33915>>>>&4  lelong          1000000         1.00 fps,
33916>>>>&4  lelong          500000          2.00 fps,
33917>>>>&4  lelong          333333          3.00 fps,
33918>>>>&4  lelong          250000          4.00 fps,
33919>>>>&4  lelong          200000          5.00 fps,
33920>>>>&4  lelong          166667          6.00 fps,
33921>>>>&4  lelong          142857          7.00 fps,
33922>>>>&4  lelong          125000          8.00 fps,
33923>>>>&4  lelong          111111          9.00 fps,
33924>>>>&4  lelong          100000          10.00 fps,
33925# ]9.9,10.1[
33926>>>>&4  lelong          <101010
33927>>>>>&-4        lelong  >99010
33928>>>>>>&-4       lelong  !100000         ~10 fps,
33929>>>>&4  lelong          83333           12.00 fps,
33930# ]11.9,12.1[
33931>>>>&4  lelong          <84034
33932>>>>>&-4        lelong  >82645
33933>>>>>>&-4       lelong  !83333          ~12 fps,
33934>>>>&4  lelong          66667           15.00 fps,
33935# ]14.9,15.1[
33936>>>>&4  lelong          <67114
33937>>>>>&-4        lelong  >66225
33938>>>>>>&-4       lelong  !66667          ~15 fps,
33939>>>>&4  lelong          50000           20.00 fps,
33940>>>>&4  lelong          41708           23.98 fps,
33941>>>>&4  lelong          41667           24.00 fps,
33942# ]23.9,24.1[
33943>>>>&4  lelong          <41841
33944>>>>>&-4        lelong  >41494
33945>>>>>>&-4       lelong  !41708
33946>>>>>>>&-4      lelong  !41667          ~24 fps,
33947>>>>&4  lelong          40000           25.00 fps,
33948# ]24.9,25.1[
33949>>>>&4  lelong          <40161
33950>>>>>&-4        lelong  >39841
33951>>>>>>&-4       lelong  !40000          ~25 fps,
33952>>>>&4  lelong          33367           29.97 fps,
33953>>>>&4  lelong          33333           30.00 fps,
33954# ]29.9,30.1[
33955>>>>&4  lelong          <33445
33956>>>>>&-4        lelong  >33223
33957>>>>>>&-4       lelong  !33367
33958>>>>>>>&-4      lelong  !33333          ~30 fps,
33959>>>>&4  lelong          <32224          >30 fps,
33960##>>>>&4  lelong          x               (%lu)
33961##>>>>&20 lelong          x               %lu frames,
33962# Note: The tests below assume that the AVI has 1 or 2 streams,
33963#       "vids" optionally followed by "auds".
33964#       (Should cover 99.9% of all AVIs.)
33965# assuming avih length = 56
33966>>>88   string  LIST
33967>>>>96  string  strlstrh
33968>>>>>108        string  vids    video:
33969>>>>>>&0        lelong  0               uncompressed
33970# skip past vids strh
33971>>>>>>(104.l+108)       string  strf
33972>>>>>>>(104.l+132)      lelong          1       RLE 8bpp
33973>>>>>>>(104.l+132)      string/c        anim    Intel RDX
33974>>>>>>>(104.l+132)      string/c        aur2    AuraVision Aura 2
33975>>>>>>>(104.l+132)      string/c        aura    AuraVision Aura
33976>>>>>>>(104.l+132)      string/c        bt20    Brooktree MediaStream
33977>>>>>>>(104.l+132)      string/c        btcv    Brooktree Composite Video
33978>>>>>>>(104.l+132)      string/c        cc12    Intel YUV12
33979>>>>>>>(104.l+132)      string/c        cdvc    Canopus DV
33980>>>>>>>(104.l+132)      string/c        cham    Winnov Caviara Cham
33981>>>>>>>(104.l+132)      string/c        cljr    Proprietary YUV 4 pixels
33982>>>>>>>(104.l+132)      string/c        cmyk    Common Data Format in Printing
33983>>>>>>>(104.l+132)      string/c        cpla    Weitek 4:2:0 YUV Planar
33984>>>>>>>(104.l+132)      string/c        cvid    Cinepak
33985>>>>>>>(104.l+132)      string/c        cwlt    Microsoft Color WLT DIB
33986>>>>>>>(104.l+132)      string/c        cyuv    Creative Labs YUV
33987>>>>>>>(104.l+132)      string/c        d261    H.261
33988>>>>>>>(104.l+132)      string/c        d263    H.263
33989>>>>>>>(104.l+132)      string/c        duck    TrueMotion 1.0
33990>>>>>>>(104.l+132)      string/c        dve2    DVE-2 Videoconferencing
33991>>>>>>>(104.l+132)      string/c        fljp    Field Encoded Motion JPEG
33992>>>>>>>(104.l+132)      string/c        fvf1    Fractal Video Frame
33993>>>>>>>(104.l+132)      string/c        gwlt    Microsoft Greyscale WLT DIB
33994>>>>>>>(104.l+132)      string/c        h260    H.260
33995>>>>>>>(104.l+132)      string/c        h261    H.261
33996>>>>>>>(104.l+132)      string/c        h262    H.262
33997>>>>>>>(104.l+132)      string/c        h263    H.263
33998>>>>>>>(104.l+132)      string/c        h264    H.264
33999>>>>>>>(104.l+132)      string/c        h265    H.265
34000>>>>>>>(104.l+132)      string/c        h266    H.266
34001>>>>>>>(104.l+132)      string/c        h267    H.267
34002>>>>>>>(104.l+132)      string/c        h268    H.268
34003>>>>>>>(104.l+132)      string/c        h269    H.269
34004>>>>>>>(104.l+132)      string/c        i263    Intel I.263
34005>>>>>>>(104.l+132)      string/c        i420    Intel Indeo 4
34006>>>>>>>(104.l+132)      string/c        ian     Intel RDX
34007>>>>>>>(104.l+132)      string/c        iclb    CellB Videoconferencing Codec
34008>>>>>>>(104.l+132)      string/c        ilvc    Intel Layered Video
34009>>>>>>>(104.l+132)      string/c        ilvr    ITU-T H.263+
34010>>>>>>>(104.l+132)      string/c        iraw    Intel YUV Uncompressed
34011>>>>>>>(104.l+132)      string/c        iv30    Intel Indeo 3
34012>>>>>>>(104.l+132)      string/c        iv31    Intel Indeo 3.1
34013>>>>>>>(104.l+132)      string/c        iv32    Intel Indeo 3.2
34014>>>>>>>(104.l+132)      string/c        iv33    Intel Indeo 3.3
34015>>>>>>>(104.l+132)      string/c        iv34    Intel Indeo 3.4
34016>>>>>>>(104.l+132)      string/c        iv35    Intel Indeo 3.5
34017>>>>>>>(104.l+132)      string/c        iv36    Intel Indeo 3.6
34018>>>>>>>(104.l+132)      string/c        iv37    Intel Indeo 3.7
34019>>>>>>>(104.l+132)      string/c        iv38    Intel Indeo 3.8
34020>>>>>>>(104.l+132)      string/c        iv39    Intel Indeo 3.9
34021>>>>>>>(104.l+132)      string/c        iv40    Intel Indeo 4.0
34022>>>>>>>(104.l+132)      string/c        iv41    Intel Indeo 4.1
34023>>>>>>>(104.l+132)      string/c        iv42    Intel Indeo 4.2
34024>>>>>>>(104.l+132)      string/c        iv43    Intel Indeo 4.3
34025>>>>>>>(104.l+132)      string/c        iv44    Intel Indeo 4.4
34026>>>>>>>(104.l+132)      string/c        iv45    Intel Indeo 4.5
34027>>>>>>>(104.l+132)      string/c        iv46    Intel Indeo 4.6
34028>>>>>>>(104.l+132)      string/c        iv47    Intel Indeo 4.7
34029>>>>>>>(104.l+132)      string/c        iv48    Intel Indeo 4.8
34030>>>>>>>(104.l+132)      string/c        iv49    Intel Indeo 4.9
34031>>>>>>>(104.l+132)      string/c        iv50    Intel Indeo 5.0
34032>>>>>>>(104.l+132)      string/c        mpeg    MPEG 1 Video Frame
34033>>>>>>>(104.l+132)      string/c        mjpg    Motion JPEG
34034>>>>>>>(104.l+132)      string/c        mp42    Microsoft MPEG-4 v2
34035>>>>>>>(104.l+132)      string/c        mp43    Microsoft MPEG-4 v3
34036>>>>>>>(104.l+132)      string/c        mrca    MR Codec
34037>>>>>>>(104.l+132)      string/c        mrle    Run Length Encoding
34038>>>>>>>(104.l+132)      string/c        msvc    Microsoft Video 1
34039>>>>>>>(104.l+132)      string/c        phmo    Photomotion
34040>>>>>>>(104.l+132)      string/c        qpeq    QPEG 1.1 Format Video
34041>>>>>>>(104.l+132)      string/c        rgbt    RGBT
34042>>>>>>>(104.l+132)      string/c        rle4    Run Length Encoded 4
34043>>>>>>>(104.l+132)      string/c        rle8    Run Length Encoded 8
34044>>>>>>>(104.l+132)      string/c        rt21    Intel Indeo 2.1
34045>>>>>>>(104.l+132)      string/c        rvx     Intel RDX
34046>>>>>>>(104.l+132)      string/c        sdcc    Sun Digital Camera Codec
34047>>>>>>>(104.l+132)      string/c        sfmc    Crystal Net SFM Codec
34048>>>>>>>(104.l+132)      string/c        smsc    SMSC
34049>>>>>>>(104.l+132)      string/c        smsd    SMSD
34050>>>>>>>(104.l+132)      string/c        splc    Splash Studios ACM Audio Codec
34051>>>>>>>(104.l+132)      string/c        sqz2    Microsoft VXtreme Video Codec
34052>>>>>>>(104.l+132)      string/c        sv10    Sorenson Video R1
34053>>>>>>>(104.l+132)      string/c        tlms    TeraLogic Motion Intraframe Codec A
34054>>>>>>>(104.l+132)      string/c        tlst    TeraLogic Motion Intraframe Codec B
34055>>>>>>>(104.l+132)      string/c        tm20    TrueMotion 2.0
34056>>>>>>>(104.l+132)      string/c        tmic    TeraLogic Motion Intraframe Codec 2
34057>>>>>>>(104.l+132)      string/c        tmot    TrueMotion Video Compression
34058>>>>>>>(104.l+132)      string/c        tr20    TrueMotion RT 2.0
34059>>>>>>>(104.l+132)      string/c        ulti    Ultimotion
34060>>>>>>>(104.l+132)      string/c        uyvy    UYVY 4:2:2 byte ordering
34061>>>>>>>(104.l+132)      string/c        v422    24-bit YUV 4:2:2 format
34062>>>>>>>(104.l+132)      string/c        v655    16-bit YUV 4:2:2 format
34063>>>>>>>(104.l+132)      string/c        vcr1    ATI VCR 1.0
34064>>>>>>>(104.l+132)      string/c        vcr2    ATI VCR 2.0
34065>>>>>>>(104.l+132)      string/c        vcr3    ATI VCR 3.0
34066>>>>>>>(104.l+132)      string/c        vcr4    ATI VCR 4.0
34067>>>>>>>(104.l+132)      string/c        vcr5    ATI VCR 5.0
34068>>>>>>>(104.l+132)      string/c        vcr6    ATI VCR 6.0
34069>>>>>>>(104.l+132)      string/c        vcr7    ATI VCR 7.0
34070>>>>>>>(104.l+132)      string/c        vcr8    ATI VCR 8.0
34071>>>>>>>(104.l+132)      string/c        vcr9    ATI VCR 9.0
34072>>>>>>>(104.l+132)      string/c        vdct    Video Maker Pro DIB
34073>>>>>>>(104.l+132)      string/c        vids    YUV 4:2:2 CCIR 601 for V422
34074>>>>>>>(104.l+132)      string/c        vivo    Vivo H.263
34075>>>>>>>(104.l+132)      string/c        vixl    VIXL
34076>>>>>>>(104.l+132)      string/c        vlv1    VLCAP.DRV
34077>>>>>>>(104.l+132)      string/c        wbvc    W9960
34078>>>>>>>(104.l+132)      string/c        x263    mmioFOURCC('X','2','6','3')
34079>>>>>>>(104.l+132)      string/c        xlv0    XL Video Decoder
34080>>>>>>>(104.l+132)      string/c        y211    YUV 2:1:1 Packed
34081>>>>>>>(104.l+132)      string/c        y411    YUV 4:1:1 Packed
34082>>>>>>>(104.l+132)      string/c        y41b    YUV 4:1:1 Planar
34083>>>>>>>(104.l+132)      string/c        y41p    PC1 4:1:1
34084>>>>>>>(104.l+132)      string/c        y41t    PC1 4:1:1 with transparency
34085>>>>>>>(104.l+132)      string/c        y42b    YUV 4:2:2 Planar
34086>>>>>>>(104.l+132)      string/c        y42t    PC1 4:2:2 with transparency
34087>>>>>>>(104.l+132)      string/c        yc12    Intel YUV12 Codec
34088>>>>>>>(104.l+132)      string/c        yuv8    Winnov Caviar YUV8
34089>>>>>>>(104.l+132)      string/c        yuv9    YUV9
34090>>>>>>>(104.l+132)      string/c        yuy2    YUY2 4:2:2 byte ordering packed
34091>>>>>>>(104.l+132)      string/c        yuyv    BI_YUYV, Canopus
34092>>>>>>>(104.l+132)      string/c        fmp4    FFMpeg MPEG-4
34093>>>>>>>(104.l+132)      string/c        div3    DivX 3
34094>>>>>>>>112             string/c        div3    Low-Motion
34095>>>>>>>>112             string/c        div4    Fast-Motion
34096>>>>>>>(104.l+132)      string/c        divx    DivX 4
34097>>>>>>>(104.l+132)      string/c        dx50    DivX 5
34098>>>>>>>(104.l+132)      string/c        xvid    XviD
34099>>>>>>>(104.l+132)	string/c	h264	H.264
34100>>>>>>>(104.l+132)      string/c        wmv3    Windows Media Video 9
34101>>>>>>>(104.l+132)      string/c        h264    X.264 or H.264
34102>>>>>>>(104.l+132)      lelong  0
34103##>>>>>>>(104.l+132)      string  x       (%.4s)
34104# skip past first (video) LIST
34105>>>>(92.l+96)   string  LIST
34106>>>>>(92.l+104) string  strlstrh
34107>>>>>>(92.l+116)        string          auds    \b, audio:
34108# auds strh length = 56:
34109>>>>>>>(92.l+172)       string          strf
34110>>>>>>>>(92.l+180)      leshort 0x0001  uncompressed PCM
34111>>>>>>>>(92.l+180)      leshort 0x0002  ADPCM
34112>>>>>>>>(92.l+180)      leshort 0x0006  aLaw
34113>>>>>>>>(92.l+180)      leshort 0x0007  uLaw
34114>>>>>>>>(92.l+180)      leshort 0x0050  MPEG-1 Layer 1 or 2
34115>>>>>>>>(92.l+180)      leshort 0x0055  MPEG-1 Layer 3
34116>>>>>>>>(92.l+180)      leshort 0x2000  Dolby AC3
34117>>>>>>>>(92.l+180)      leshort 0x0161  DivX
34118##>>>>>>>>(92.l+180)      leshort x       (%#.4x)
34119>>>>>>>>(92.l+182)      leshort 1       (mono,
34120>>>>>>>>(92.l+182)      leshort 2       (stereo,
34121>>>>>>>>(92.l+182)      leshort >2      (%d channels,
34122>>>>>>>>(92.l+184)      lelong  x       %d Hz)
34123# auds strh length = 64:
34124>>>>>>>(92.l+180)       string          strf
34125>>>>>>>>(92.l+188)      leshort 0x0001  uncompressed PCM
34126>>>>>>>>(92.l+188)      leshort 0x0002  ADPCM
34127>>>>>>>>(92.l+188)      leshort 0x0055  MPEG-1 Layer 3
34128>>>>>>>>(92.l+188)      leshort 0x2000  Dolby AC3
34129>>>>>>>>(92.l+188)      leshort 0x0161  DivX
34130##>>>>>>>>(92.l+188)      leshort x       (%#.4x)
34131>>>>>>>>(92.l+190)      leshort 1       (mono,
34132>>>>>>>>(92.l+190)      leshort 2       (stereo,
34133>>>>>>>>(92.l+190)      leshort >2      (%d channels,
34134>>>>>>>>(92.l+192)      lelong  x       %d Hz)
34135# From:		Joerg Jenderek
34136# URL:		http://fileformats.archiveteam.org/wiki/VDR_(VirtualDub)
34137# Reference:	http://sourceforge.net/projects/virtualdub/files/virtualdub-win/
34138#		1.10.4.35491/VirtualDub-1.10.4-src.7z/src/vdremote/Main.cpp
34139# VirtualDub link handler
34140>8	string		VDRM		\b, VirtualDub link
34141!:mime	video/x-vdr
34142!:ext	vdr
34143>>12	string		PATH		\b, PATH
34144# remote-path to video file
34145>>16	pstring/l	x		%s
34146# Animated Cursor format
34147# Update:	Joerg Jenderek
34148# URL:		http://fileformats.archiveteam.org/wiki/Windows_Animated_Cursor
34149# Reference:	https://www.gdgsoft.com/anituner/help/aniformat.htm
34150>8	string		ACON		\b, animated cursor
34151!:mime	application/x-navi-animation
34152# http://extension.nirsoft.net/ani
34153#!:mime	image/ani
34154!:ext	ani
34155# INAM tag followed by length of title
34156>>24	string		INAM
34157>>>28	pstring/l	x		"%s"
34158# IART tag followed by length of author
34159>>>(28.l+32)	ubelong	0x49415254
34160>>>>&0	pstring/l	x		%s
34161# SoundFont 2 <mpruett@sgi.com>
34162# URL:	http://fileformats.archiveteam.org/wiki/SoundFont_2.0
34163>8	string		sfbk		\b, SoundFont/Bank
34164!:mime	audio/x-sfbk
34165!:ext	sf2
34166# MPEG-1 wrapped in a RIFF, apparently
34167# URL:	http://file.fyicenter.com/17_Video_.DAT_File_Extension_for_VCD_Files.html
34168>8      string          CDXA            \b, wrapped MPEG-1 (CDXA)
34169!:mime	video/x-cdxa
34170!:ext	mpg/dat
34171# URL:	http://fileformats.archiveteam.org/wiki/4X_IMA_ADPCM
34172>8	string		4XMV		\b, 4X Movie file
34173!:mime	video/x-4xmv
34174!:ext	4xm/4xa
34175# AMV-type AVI file: https://wiki.multimedia.cx/index.php?title=AMV
34176>8	string		AMV\040		\b, AMV
34177# http://fileformats.archiveteam.org/wiki/MTV_Video_(.AMV)
34178!:mime	video/x-amv
34179!:ext	amv
34180#!:ext	amv/mtv
34181# URL:	http://fileformats.archiveteam.org/wiki/WebP
34182>8      string          WEBP            \b, Web/P image
34183!:mime	image/webp
34184!:ext	webp
34185>>12	use		riff-walk
34186# From:		Joerg Jenderek
34187# URL:		http://fileformats.archiveteam.org/wiki/RIFF_MIDS
34188>8      string          MIDS            \b, MIDI Stream
34189!:mime	audio/x-mids
34190!:ext	mds
34191# From:		Joerg Jenderek
34192# URL:		http://mark0.net/soft-trid-e.html
34193# Reference:	http://fileformats.archiveteam.org/wiki/Trd_(TRID)
34194>8      string          TRID            \b, TrID defs package
34195!:mime	application/x-trid-trd
34196!:ext	trd
34197# From:		Joerg Jenderek
34198# URL:		https://en.wikipedia.org/wiki/CorelDRAW
34199# Reference:	http://fileformats.archiveteam.org/wiki/CorelDRAW
34200# Note:		Since version 3 CorelDraw Pictures are RIFF based
34201# but data chunks remain proprietary.
34202# Since version 14 til 15 packed as "content/riffData.cdr" and
34203# since 16 "content/root.dat" in ZIP container
34204# TODO:		distinguish templates with version 12.5 from Designer illustration 12
34205#	display information of RIFF based Corel Draw pictures, templates and patterns
342060	name   	corel-draw
34207# display second chunk for debugging
34208#>8	string		x		\b, [8]=%.8s
34209>0	string		x		\b, Corel Draw
34210#!:mime	image/x-coreldraw
34211!:mime	application/vnd.corel-draw
34212# used by newer pictures templates
34213>>8	string		CDT
34214# used by templates with newer versions since 16
34215>>>12	string		=fver		Picture template (root.dat)
34216!:ext	dat
34217# used by templates with older versions with vrsn tag
34218>>>12	string		!fver
34219# used by templates with older versions 14-15
34220>>>>11	string		>E		Picture template (riffData.cdr)
34221!:ext	cdr
34222# used by templates with older versions 11-13
34223>>>>11	string		<F		Picture template
34224!:ext	cdt/cdrt
34225# used by older templates with version 4.4
34226>>8	string		CDST		Picture template
34227!:ext	cdt
34228# used by templates with version 12.5
34229>>8	string		DESC		Picture template
34230!:ext	cdt
34231# used by newer patterns with version 22
34232>>8	string		PAT		Pattern
34233!:ext	dat
34234# remaining older templates, patterns, drawings
34235>>8	default		x
34236# pattern with old version 4.y
34237>>>26	ulelong		=0x0000206C	Pattern
34238!:ext	pat
34239# pattern with newer versions
34240>>>26	ulelong		=0x00000D2C	Pattern
34241!:ext	pat
34242# remaining older templates or pictures
34243>>>26	default		x
34244# used by older versions 5 - 15
34245>>>>12	string		=vrsn
34246# 4th chunk size unequal 282Ch only found for CDR
34247>>>>>26	ulelong		!0x0000282c	Picture
34248!:ext	cdr
34249>>>>>26	default		x		Picture or template
34250!:ext	cdr/cdt
34251# used by newer versions since 16
34252>>>>12	string		=fver		Picture (root.dat)
34253!:ext	dat
34254# version marked by 1 ASCII char: space~3, ... , F~15,  ... , N~22, ... R~22 template
34255>11	string		x		\b, version
34256>11	string		>\040		'%-.1s'
34257>0	use		corel-version
34258>4	ulelong+8	x		\b, %u bytes
34259#
34260#	display numeric version of RIFF based Corel after 3rd RIFF tag
342610	name   	corel-version
34262# for debugging purpose; vrsn for short content; fver for 16 byte size
34263#>12	string		x		\b, TAG "%-4.4s"
34264# 1st data chunk length 2 implies short content version
34265>16	ulelong		2
34266# vrsn chunk short content interpreted by MajorVersion * 100 + MinorVersion
34267>>20	uleshort/100	x		%u
34268>>20	uleshort%100	>0		\b.%u
34269# for debugging purpose display next chunk like: DISP LIST
34270#>>22	string		x		\b, 4th "%-4.4s"
34271#>>26	ulelong		x		\b, 4th SIZE %#x
34272# for debugging purpose display 5th chunk like: LIST DISP ccmm osfp
34273#>>(26.l+30)	string	x		\b, 5th "%-4.4s"
34274# 1st data chunk length 10h implies 16 byte content with version info
34275>16	ulelong		0x10
34276>>34	ubyte		x		%u
34277>>>33	ubyte		>0		\b.%u
34278#	display information of RIFF based Corel Design formats
342790	name   	corel-des
34280# display second chunk for debugging
34281#>8	string		x		\b, [8]=%.8s
34282>12	string		x		\b, Corel DESIGNER
34283!:mime	image/x-corel-des
34284#!:mime	application/x-vnd.corel.designer.document
34285# used by Corel Designer with newer versions since 16
34286>12	string		=fver		graphics (root.dat)
34287!:ext	dat
34288# used by Corel Designer templates with older versions with vrsn tag
34289>12	string		!fver
34290# used by Corel Designer with versions 14-15
34291>>11	string		>D		graphics (riffData.cdr)
34292!:ext	cdr
34293# used by Corel Designer with versions 10-12
34294>>11	string		<E		graphics
34295!:ext	des
34296# version indicated by last ASCII char of second chunk tag
34297>11	string		x		\b, version '%-.1s'
34298# but vrsn short content is not always version indicator
34299# exceptions: 'A'~11.4 'B'~12 'C'~12.5
34300>11	string		>D
34301>>0	use		corel-version
34302# for debugging purpose display next chunk like: DISP LIST
34303#>>22	string		x		\b, 4th "%-4.4s"
34304#>>26	ulelong		x		\b, 4th SIZE %#x
34305# for debugging purpose display 5th chunk like: LIST osfp
34306#>>(26.l+30)	string	x		\b, 5th "%-4.4s"
34307>4	ulelong+8	x		\b, %u bytes
34308
34309#
34310# XXX - some of the below may only appear in little-endian form.
34311#
34312# Also "MV93" appears to be for one form of Macromedia Director
34313# files, and "GDMF" appears to be another multimedia format.
34314#
343150	string		RIFX		RIFF (big-endian) data
34316# RIFF Palette format
34317>8	string		PAL		\b, palette
34318>>16	beshort		x		\b, version %d
34319>>18	beshort		x		\b, %d entries
34320# RIFF Device Independent Bitmap format
34321>8	string		RDIB		\b, device-independent bitmap
34322>>16	string		BM
34323>>>30	beshort		12		\b, OS/2 1.x format
34324>>>>34	beshort		x		\b, %d x
34325>>>>36	beshort		x		%d
34326>>>30	beshort		64		\b, OS/2 2.x format
34327>>>>34	beshort		x		\b, %d x
34328>>>>36	beshort		x		%d
34329>>>30	beshort		40		\b, Windows 3.x format
34330>>>>34	belong		x		\b, %d x
34331>>>>38	belong		x		%d x
34332>>>>44	beshort		x		%d
34333# RIFF MIDI format
34334>8	string		RMID		\b, MIDI
34335# RIFF Multimedia Movie File format
34336>8	string		RMMP		\b, multimedia movie
34337# Microsoft WAVE format (*.wav)
34338>8	string		WAVE		\b, WAVE audio
34339>>20	leshort		1		\b, Microsoft PCM
34340>>>34	leshort		>0		\b, %d bit
34341>>22	beshort		=1		\b, mono
34342>>22	beshort		=2		\b, stereo
34343>>22	beshort		>2		\b, %d channels
34344>>24	belong		>0		%d Hz
34345# Corel Draw Picture big endian not tested by real examples
34346#>8	string		CDRA		\b, Corel Draw Picture
34347#>8	string		CDR6		\b, Corel Draw Picture, version 6
34348>8	string		CDR
34349>>0	use     \^corel-draw
34350
34351# AVI == Audio Video Interleave
34352>8	string		AVI\040		\b, AVI
34353# Animated Cursor format
34354>8	string		ACON		\b, animated cursor
34355# Notation Interchange File Format (big-endian only)
34356>8	string		NIFF		\b, Notation Interchange File Format
34357# SoundFont 2 <mpruett@sgi.com>
34358>8	string		sfbk		SoundFont/Bank
34359
34360#------------------------------------------------------------------------------
34361# Sony Wave64
34362# see http://www.vcs.de/fileadmin/user_upload/MBS/PDF/Whitepaper/Informations_about_Sony_Wave64.pdf
34363# 128 bit RIFF-GUID { 66666972-912E-11CF-A5D6-28DB04C10000 } in little-endian
343640	string	riff\x2E\x91\xCF\x11\xA5\xD6\x28\xDB\x04\xC1\x00\x00		Sony Wave64 RIFF data
34365# 128 bit + total file size (64 bits) so 24 bytes
34366# then WAVE-GUID { 65766177-ACF3-11D3-8CD1-00C04F8EDB8A }
34367>24	string		wave\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A		\b, WAVE 64 audio
34368!:mime	audio/x-w64
34369# FMT-GUID { 20746D66-ACF3-11D3-8CD1-00C04F8EDB8A }
34370>>40	search/256	fmt\x20\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A		\b
34371>>>&10	leshort		=1		\b, mono
34372>>>&10	leshort		=2		\b, stereo
34373>>>&10	leshort		>2		\b, %d channels
34374>>>&12	lelong		>0		%d Hz
34375
34376#------------------------------------------------------------------------------
34377# MBWF/RF64
34378# see EBU TECH 3306 https://tech.ebu.ch/docs/tech/tech3306-2009.pdf
343790	string	RF64\xff\xff\xff\xffWAVEds64		MBWF/RF64 audio
34380!:mime	audio/x-wav
34381>40	search/256	fmt\x20		\b
34382>>&6	leshort		=1		\b, mono
34383>>&6	leshort		=2		\b, stereo
34384>>&6	leshort		>2		\b, %d channels
34385>>&8	lelong		>0		%d Hz
34386#------------------------------------------------------------------------------
34387# $File: ringdove,v 1.1 2022/08/16 12:04:30 christos Exp $
34388# ringdove:  file(1) magic for RingdoveEDA data files
34389
34390# librnd and global
343910	regex/128l	ha:rnd-menu-v[0-9]+[\ \t\r\n]*[{]	librnd menu system (lihata)
343920	regex/128l	ha:rnd-menu-patch-v[0-9]+[\ \t\r\n]*[{]	librnd menu patch (lihata)
343930	regex/128l	ha:coraleda-project-v[0-9]+[\ \t\r\n]*[{]	CoralEDA/Ringdove project file (lihata)
343940	regex/128l	ha:ringdove-project-v[0-9]+[\ \t\r\n]*[{]	Ringdove project file (lihata)
34395
34396# pcb-rnd
343970	regex/128l	ha:pcb-rnd-board-v[0-9]+[\ \t\r\n]*[{]	pcb-rnd board file (lihata)
343980	regex/128l	li:pcb-rnd-subcircuit-v[0-9]+[\ \t\r\n]*[{]	pcb-rnd subcircuit/footprint file (lihata)
343990	regex/128l	ha:pcb-rnd-buffer-v[0-9]+[\ \t\r\n]*[{]	pcb-rnd paste buffer content (lihata)
344000	regex/128l	li:pcb-rnd-conf-v[0-9]+[\ \t\r\n]*[{]	pcb-rnd configuration (lihata)
344010	regex/128l	ha:pcb-rnd-drc-query-v[0-9]+[\ \t\r\n]*[{]	pcb-rnd drc query string (lihata)
344020	regex/128l	li:pcb-rnd-font-v[0-9]+[\ \t\r\n]*[{]	pcb-rnd vector font (lihata)
344030	regex/128l	ha:pcb-rnd-log-v[0-9]+[\ \t\r\n]*[{]	pcb-rnd message log dump (lihata)
344040	regex/128l	ha:pcb-rnd-padstack-v[0-9]+[\ \t\r\n]*[{]	pcb-rnd padstack (lihata)
344050	regex/128l	li:pcb-rnd-view-list-v[0-9]+[\ \t\r\n]*[{]	pcb-rnd view list (lihata)
344060	regex/128l	li:view-list-v[0-9]+[\ \t\r\n]*[{]	pcb-rnd view list (lihata)
344070	search	Netlist(Freeze)	pcb-rnd or gEDA/PCB netlist forward annotation action script
34408
34409# sch-rnd (cschem data model)
344100	regex/128l	li:cschem-buffer-v[0-9]+[\ \t\r\n]*[{]	sch-rnd/cschem buffer content (lihata)
344110	regex/128l	li:sch-rnd-conf-v[0-9]+[\ \t\r\n]*[{]	sch-rnd configuration (lihata)
344120	regex/128l	ha:std_devmap.v[0-9]+[\ \t\r\n]*[{]	sch-rnd devmap (device mapping; lihata)
344130	regex/128l	li:cschem-group-v[0-9]+[\ \t\r\n]*[{]	sch-rnd/cschem group or symbol (lihata)
344140	regex/128l	ha:cschem-sheet-v[0-9]+[\ \t\r\n]*[{]	sch-rnd/cschem schematic sheet (lihata)
34415
34416# tEDAx (modular format)
344170	regex/1l	tEDAx[\ \t\r\n]v	tEDAx (Trivial EDA eXchange)
34418>0	regex	begin\ symbol\ v	with schematic symbol
34419>0	regex	begin\ board\ v	with Printed Circuit Board
34420>0	regex	begin\ route_req\ v	with PCB routing request
34421>0	regex	begin\ route_res\ v	with PCB routing result
34422>0	regex	begin\ camv_layer\ v	with camv-rnd exported layer
34423>0	regex	begin\ netlist\ v	with netlist
34424>0	regex	begin\ backann\ v	with Ringdove EDA back annotation
34425>0	regex	begin\ footprint\ v	with PCB footprint
34426>0	regex	begin\ drc\ v	with PCB DRC script
34427>0	regex	begin\ drc_query_rule\ v	with pcb-rnd drc_query rules
34428>0	regex	begin\ drc_query_def\ v	with pcb-rnd drc_query value/config definitions
34429>0	regex	begin\ etest\ v	with PCB electric test
34430
34431
34432#------------------------------------------------------------------------------
34433# $File: rpi,v 1.3 2022/04/02 14:39:34 christos Exp $
34434# rpi:  file(1) magic for Raspberry Pi images
34435-44		lelong	0
34436>4		lelong	0
34437>>8		lelong	1
34438>>12		lelong	4
34439>>>16		string	283x
34440>>>>20		lelong	1
34441>>>>>24		lelong	4
34442>>>>>>28	string	DTOK
34443>>>>>>>32	lelong	44
34444>>>>>>>>36	lelong	4
34445>>>>>>>>>40	string	RPTL		Raspberry PI kernel image
34446
34447-56		lelong	0
34448>4		lelong	0
34449>>8		lelong	1
34450>>12		lelong	4
34451>>>16		string	283x
34452>>>>20		lelong	1
34453>>>>>24		lelong	4
34454>>>>>>28	string	DTOK
34455>>>>>>>32	lelong	1
34456>>>>>>>>36	lelong	4
34457>>>>>>>>>40	string	DDTK8
34458>>>>>>>>>>48	lelong	4
34459>>>>>>>>>>>52	string	RPTL		Raspberry PI kernel image
34460
34461# From: 	Joerg Jenderek
34462# URL:		https://www.raspberrypi.com/documentation/computers/raspberry-pi.html
34463#		#raspberry-pi-4-boot-eeprom
34464# Reference:	https://github.com/raspberrypi/rpi-eeprom/blob/master/rpi-eeprom-config
34465# Note:		start with same magic as for BIOS (ia32) ROM Extension handled by ./intel
34466# masked with MAGIC_MASK and then compared with MAGIC
344670	belong&0xFFffF00F	0x55aaF00F	Raspberry PI EEPROM
34468#!:mime	application/octet-stream
34469!:mime	application/x-raspberry-eeprom
34470# like: pieeprom-2020-09-03.bin
34471!:ext	bin
34472# a 32 bit offset to the next section like: 000184d4 000184c8 00018534 ... 0000bb84 0000bbd4 0000bbd4
34473>4	ubelong			x		\b, offset %8.8x
34474#>(4.L)	ubelong			x		NEXT=%8.8x
34475# self.length
34476>8	ubelong			!0		\b, length %x
34477# self.filename
34478>12	string			>0		\b, "%s"
34479# length is zero
34480>8	ubelong			=0
34481# if length is zero then 2nd section magic here can be zero; this means sections parsing done
34482>>8	ubelong			!0		\b, 2nd MAGIC=%8.8x
34483
34484#------------------------------------------------------------------------------
34485# $File: rpm,v 1.12 2013/01/11 16:45:23 christos Exp $
34486#
34487# RPM: file(1) magic for Red Hat Packages   Erik Troan (ewt@redhat.com)
34488#
344890	belong		0xedabeedb	RPM
34490!:mime	application/x-rpm
34491>4	byte		x		v%d
34492>5	byte		x		\b.%d
34493>6	beshort		1		src
34494>6	beshort		0		bin
34495>>8	beshort		1		i386/x86_64
34496>>8	beshort		2		Alpha/Sparc64
34497>>8	beshort		3		Sparc
34498>>8	beshort		4		MIPS
34499>>8	beshort		5		PowerPC
34500>>8	beshort		6		68000
34501>>8	beshort		7		SGI
34502>>8	beshort		8		RS6000
34503>>8	beshort		9		IA64
34504>>8	beshort		10		Sparc64
34505>>8	beshort		11		MIPSel
34506>>8	beshort		12		ARM
34507>>8	beshort		13		MiNT
34508>>8	beshort		14		S/390
34509>>8	beshort		15		S/390x
34510>>8	beshort		16		PowerPC64
34511>>8	beshort		17		SuperH
34512>>8	beshort		18		Xtensa
34513>>8	beshort		255		noarch
34514>>10	string		x		%s
34515
34516#delta RPM    Daniel Novotny (dnovotny@redhat.com)
345170	string		drpm		Delta RPM
34518!:mime  application/x-rpm
34519>12	string 	x	%s
34520>>8	beshort		11		MIPSel
34521>>8	beshort		12		ARM
34522>>8	beshort		13		MiNT
34523>>8	beshort		14		S/390
34524>>8	beshort		15		S/390x
34525>>8	beshort		16		PowerPC64
34526>>8	beshort		17		SuperH
34527>>8	beshort		18		Xtensa
34528>>10	string		x		%s
34529
34530#------------------------------------------------------------------------------
34531# $File: rpmsg,v 1.1 2019/04/19 00:40:47 christos Exp $
34532# rpmsg: file(1) magic for restricted-permission messages (or "rights-protected" messages)
34533# see https://en.wikipedia.org/wiki/Rpmsg
34534
345350	string	\x76\xe8\x04\x60\xc4\x11\xe3\x86	rpmsg Restricted Permission Message
34536
34537#------------------------------------------------------------------------------
34538# $File: rst,v 1.3 2020/04/27 01:50:36 christos Exp $
34539# rst: ReStructuredText http://docutils.sourceforge.net/rst.html
345400	search/256	\=\=
34541!:strength + 30
34542>&0	regex/256	\^[\=]+$
34543>>&0	search/512	:Author:	ReStructuredText file
34544>>&0	default		x
34545>>>&0	regex/512	\^\\.\\.[A-Za-z]	ReStructuredText file
34546!:ext	rst
34547
34548#------------------------------------------------------------------------------
34549# $File: rtf,v 1.9 2020/12/12 20:01:47 christos Exp $
34550# rtf:	file(1) magic for Rich Text Format (RTF)
34551#
34552# Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk
34553# Update:	Joerg Jenderek
34554# URL:		https://en.wikipedia.org/wiki/Rich_Text_Format
34555# Reference:	http://www.snake.net/software/RTF/RTF-Spec-1.7.rtf
34556#		http://www.kleinlercher.at/tools/Windows_Protocols/Word2007RTFSpec9.pdf
345570	string		{\\rtf
34558# skip DROID fmt-355-signature-id-522.rtf by looking for valid version
34559>5	ubyte		!0xAB
34560# skip also \ in DROID fmt-50-signature-id-158.rtf by looking for valid version
34561>>5	ubyte		!0x5C		Rich Text Format data
34562!:mime	text/rtf
34563!:apple	????RTF
34564!:ext	rtf
34565>>>0	use		rtf-info
34566#	display information like version, language and code page of RTF
345670	name		rtf-info
34568# 1 mostly, 2 for newer Pocket Word documents, space for test like fdo78502.rtf, { for some urtf
34569>5	ubyte		!0x7b		\b, version %c
34570# The word for character set must precede any text or most other control words
34571>6	string		\\mac		\b, Apple Macintosh
34572>6	string		\\pc
34573# control word \pca
34574>>9	ubyte		=0x61		\b, IBM PS/2, code page 850
34575>>9	ubyte		!0x61		\b, IBM PC, code page 437
34576# unknown character set or ANSI later after control words like
34577# \adeflang1025 \info \title \author \category \manager
34578# "Burow, Steffanie - Im Tal des Schneeleoparden.rtf"
34579#>6	search/105	\\ansi		\b, ANSI
34580>6	search/502	\\ansi		\b, ANSI
34581>6	default		x		\b, unknown character set
34582# look for explicit codepage keyword
34583# "Burow, Steffanie - Im Tal des Schneeleoparden.rtf"
34584#>5	search/110	\\ansicpg
34585>5	search/500	\\ansicpg
34586# skip unknown or buggy codepage string 0 like in fdo78502.rtf
34587>>&0	ubyte		!0x30		\b, code page
34588# codepage string: 437~United States IBM, ..., 1252~WesternEuropean, ..., 57011~Punjabi
34589>>>&-1		string	x		%-.3s
34590# skip space or \ and display possible 4th digit of code page string
34591>>>&2		ubyte	>0x2F
34592>>>>&-1		ubyte	<0x3A		\b%c
34593# possible 5th digit of code page string
34594>>>>>&0		ubyte	>0x2F
34595>>>>>>&-1	ubyte	<0x3A		\b%c
34596# look again at version byte to use default clause
34597>5	ubyte		x
34598# Default language ID for South Asian/Middle Eastern text
34599# language ID: 1025, ..., 1065~Persian, ..., 2057~English_UnitedKingdom, ..., 58380~French_NorthAfrica
34600# Readme-0.72-Persian.rtf
34601#>6	search/1	\\adeflang	\b, default middle east language ID
34602>>6	search/497	\\adeflang	\b, default middle east language ID
34603# https://docs.microsoft.com/en-us/openspecs/office_standards/ms-oe376/6c085406-a698-4e12-9d4d-c3b0ee3dbc4a
34604>>>&0	string		x		%.4s
34605# skip \ and NL and show possible 5th digit of language string
34606>>>&4	ubyte		>0x2F
34607>>>>&-1	ubyte		<0x3A		\b%c
34608# else look for default language to be used when the \plain control word is encountered
34609>>6	default		x
34610# "Burow, Steffanie - Im Tal des Schneeleoparden.rtf"
34611#>>>6	search/127	\\deflang
34612>>>6	search/505	\\deflang
34613>>>>&0	string		>0		\b, default language ID %-.4s
34614# possible 5th digit of language string
34615>>>>&4		ubyte	>0x2F
34616>>>>>&-1	ubyte	<0x3A		\b%c
34617
34618# Reference:	http://latex2rtf.sourceforge.net/rtfspec_63.html
34619# Note:		no real world example found
346200	string		{\\urtf		Rich Text Format unicoded data
34621!:mime	text/rtf
34622#!:apple	????RTF
34623!:ext	rtf
34624>1	use		rtf-info
34625
34626# URL:		https://en.wikipedia.org/wiki/Microsoft_Word
34627# Reference:	http://fileformats.archiveteam.org/wiki/Microsoft_Word
34628# Note:	called by TrID "Pocket Word document"
34629#	by PlanMaker "Pocket Word-Handheld PC" for pwd
34630#	by PlanMaker "Pocket Word-Pocket PC" for psw
346310	string		{\\pwd		Pocket Word document or template
34632# by SoftMaker Office	http://extension.nirsoft.net/pwd
34633#!:mime	application/msword
34634# https://reposcope.com/mimetype/application/x-pocket-word
34635!:mime	application/x-pocket-word
34636# PWD for Handheld PC variant and PSW for Pocket PC variant
34637# PWT for template
34638!:ext	pwd/psw/pwt
34639>0	use		rtf-info
34640
34641
34642#------------------------------------------------------------------------------
34643# $File: ruby,v 1.10 2019/07/21 09:40:17 christos Exp $
34644# ruby:  file(1) magic for Ruby scripting language
34645# URL:  https://www.ruby-lang.org/
34646# From: Reuben Thomas <rrt@sc3d.org>
34647
34648# Ruby scripts
346490	search/1/w	#!\ /usr/bin/ruby				Ruby script text executable
34650!:strength + 15
34651!:mime text/x-ruby
346520	search/1/w	#!\ /usr/local/bin/ruby	Ruby script text executable
34653!:strength + 15
34654!:mime text/x-ruby
346550	search/1	#!/usr/bin/env\ ruby				Ruby script text executable
34656!:strength + 15
34657!:mime text/x-ruby
346580	search/1	#!\ /usr/bin/env\ ruby			Ruby script text executable
34659!:strength + 15
34660!:mime text/x-ruby
34661
34662# What looks like ruby, but does not have a shebang
34663# (modules and such)
34664# From: Lubomir Rintel <lkundrak@v3.sk>
346650	search/8192	require
34666>0	regex		\^[[:space:]]*require[[:space:]]'[A-Za-z_/.]+'
34667>>0	regex		def\ [a-z]|\ do$
34668>>>&0	regex		\^[[:space:]]*end([[:space:]]+[;#].*)?$		Ruby script text
34669!:strength + 30
34670!:mime	text/x-ruby
346710	regex		\^[[:space:]]*(class|module)[[:space:]][A-Z]
34672>0	regex		(modul|includ)e\ [A-Z]|def\ [a-z]
34673>>&0	regex		\^[[:space:]]*end([[:space:]]+[;#].*)?$		Ruby script text
34674!:strength + 30
34675!:mime	text/x-ruby
34676# Classes with no modules or defs, beats simple ASCII
346770	regex		\^[[:space:]]*(class|module)[[:space:]][A-Z]
34678>&0	regex	\^[[:space:]]*end([[:space:]]+[;#if].*)?$		Ruby script text
34679!:strength + 10
34680!:mime	text/x-ruby
34681# Looks for function definition to balance python magic
34682# def name (args)
34683# end
346840	search/8192	def\
34685>0	regex		\^[[:space:]]*def\ [a-z]|def\ [[:alpha:]]+::[a-z]
34686>>&0	regex		\^[[:space:]]*end([[:space:]]+[;#].*)?$		Ruby script text
34687!:strength + 10
34688!:mime	text/x-ruby
34689
346900	search/8192	require
34691>0	regex		\^[[:space:]]*require[[:space:]]'[A-Za-z_/.]+'	Ruby script text
34692!:mime	text/x-ruby
346930	search/8192	include
34694>0 regex 	\^[[:space:]]*include\ ([A-Z]+[a-z]*(::))+	Ruby script text
34695!:mime	text/x-ruby
34696
34697#------------------------------------------------------------------------------
34698# $File: sc,v 1.6 2009/09/19 16:28:12 christos Exp $
34699# sc:  file(1) magic for "sc" spreadsheet
34700#
3470138	string		Spreadsheet	sc spreadsheet file
34702!:mime	application/x-sc
34703
34704#------------------------------------------------------------------------------
34705# $File: sccs,v 1.8 2020/06/20 21:32:52 christos Exp $
34706# sccs:  file(1) magic for SCCS archives
34707#
34708# SCCS v4 archive structure:
34709# \001h01207
34710# \001s 00276/00000/00000
34711# \001d D 1.1 87/09/23 08:09:20 ian 1 0
34712# \001c date and time created 87/09/23 08:09:20 by ian
34713# \001e
34714# \001u
34715# \001U
34716# ... etc.
34717# Now '\001h' happens to be the same as the 3B20's a.out magic number (0550).
34718# *Sigh*. And these both came from various parts of the USG.
34719# Maybe we should just switch everybody from SCCS to RCS!
34720# Further, you can't just say '\001h0', because the five-digit number
34721# is a checksum that could (presumably) have any leading digit,
34722# Fortunately we have regular expression matching:
347230	string		\001h
34724>2	regex		[0-9][0-9][0-9][0-9][0-9]$
34725>>8	string		\001s\040 		SCCS v4 archive data
34726>2	string		V6,sum=			SCCS v6 archive data
34727
34728#------------------------------------------------------------------------------
34729# $File: scientific,v 1.13 2019/04/19 00:42:27 christos Exp $
34730# scientific:  file(1) magic for scientific formats
34731#
34732# From: Joe Krahn <krahn@niehs.nih.gov>
34733
34734########################################################
34735# CCP4 data and plot files:
347360	string		MTZ\040		MTZ reflection file
34737
3473892	string		PLOT%%84	Plot84 plotting file
34739>52	byte		1		, Little-endian
34740>55	byte		1		, Big-endian
34741
34742########################################################
34743# Electron density MAP/MASK formats
34744
347450	string		EZD_MAP	NEWEZD Electron Density Map
34746109	string		MAP\040(  Old EZD Electron Density Map
34747
347480	string/c	:-)\040Origin	BRIX Electron Density Map
34749>170	string		>0	, Sigma:%.12s
34750#>4	string		>0	%.178s
34751#>4	addr		x	%.178s
34752
347537	string		18\040!NTITLE	XPLOR ASCII Electron Density Map
347549	string		\040!NTITLE\012\040REMARK	CNS ASCII electron density map
34755
34756208	string		MAP\040	CCP4 Electron Density Map
34757# Assumes same stamp for float and double (normal case)
34758>212	byte		17	\b, Big-endian
34759>212	byte		34	\b, VAX format
34760>212	byte		68	\b, Little-endian
34761>212	byte		85	\b, Convex native
34762
34763############################################################
34764# X-Ray Area Detector images
347650	string	R-AXIS4\ \ \ 	R-Axis Area Detector Image:
34766>796	lelong	<20		Little-endian, IP #%d,
34767>>768	lelong	>0		Size=%dx
34768>>772	lelong	>0		\b%d
34769>796	belong	<20		Big-endian, IP #%d,
34770>>768	belong	>0		Size=%dx
34771>>772	belong	>0		\b%d
34772
347730	string	RAXIS\ \ \ \ \ 	R-Axis Area Detector Image, Win32:
34774>796	lelong	<20		Little-endian, IP #%d,
34775>>768	lelong	>0		Size=%dx
34776>>772	lelong	>0		\b%d
34777>796	belong	<20		Big-endian, IP #%d,
34778>>768	belong	>0		Size=%dx
34779>>772	belong	>0		\b%d
34780
34781
347821028	string	MMX\000\000\000\000\000\000\000\000\000\000\000\000\000	MAR Area Detector Image,
34783>1072	ulong	>1		Compressed(%d),
34784>1100	ulong	>1		%d headers,
34785>1104	ulong	>0		%d x
34786>1108	ulong	>0		%d,
34787>1120	ulong	>0		%d bits/pixel
34788
34789# Type: GEDCOM genealogical (family history) data
34790# From: Giuseppe Bilotta
347910       search/1/c	0\ HEAD         GEDCOM genealogy text
34792>&0     search		1\ GEDC
34793>>&0    search		2\ VERS         version
34794>>>&1   string		>\0		%s
34795# From: Phil Endecott <phil05@chezphil.org>
347960	string	\000\060\000\040\000\110\000\105\000\101\000\104		GEDCOM data
347970	string	\060\000\040\000\110\000\105\000\101\000\104\000		GEDCOM data
347980	string	\376\377\000\060\000\040\000\110\000\105\000\101\000\104	GEDCOM data
347990	string	\377\376\060\000\040\000\110\000\105\000\101\000\104\000	GEDCOM data
34800
34801# PDB: Protein Data Bank files
34802# Adam Buchbinder <adam.buchbinder@gmail.com>
34803#
34804# https://www.wwpdb.org/documentation/format32/sect2.html
34805# https://www.ch.ic.ac.uk/chemime/
34806#
34807# The PDB file format is fixed-field, 80 columns. From the spec:
34808#
34809# COLS        DATA
34810#  1 -  6      "HEADER"
34811#  11 - 50     String(40)
34812#  51 - 59     Date
34813#  63 - 66     IDcode
34814#
34815# Thus, positions 7-10, 60-62 and 67-80 are spaces. The Date must be in the
34816# format DD-MMM-YY, e.g., 01-JAN-70, and the IDcode consists of numbers and
34817# uppercase letters. However, examples have been seen without the date string,
34818# e.g., the example on the chemime site.
348190	string	HEADER\ \ \ \040
34820>&0	regex/1l	\^.{40}
34821>>&0	regex/1l	[0-9]{2}-[A-Z]{3}-[0-9]{2}\ {3}
34822>>>&0	regex/1ls	[A-Z0-9]{4}.{14}$
34823>>>>&0	regex/1l	[A-Z0-9]{4}	Protein Data Bank data, ID Code %s
34824!:mime	chemical/x-pdb
34825>>>>0	regex/1l	[0-9]{2}-[A-Z]{3}-[0-9]{2}	\b, %s
34826
34827# Type:	GDSII Stream file
348280	belong	0x00060002	GDSII Stream file
34829>4	byte	0x00
34830>>5	byte	x		version %d.0
34831>4	byte	>0x00		version %d
34832>>5	byte	x		\b.%d
34833
34834# Type: LXT (interLaced eXtensible Trace)
34835# chrysn <chrysn@fsfe.org>
348360	beshort	0x0138	interLaced eXtensible Trace (LXT) file
34837>2	beshort	>0	(Version %u)
34838
34839#------------------------------------------------------------------------------
34840# $File: securitycerts,v 1.4 2009/09/19 16:28:12 christos Exp $
348410	search/1		-----BEGIN\ CERTIFICATE------	RFC1421 Security Certificate text
348420	search/1		-----BEGIN\ NEW\ CERTIFICATE	RFC1421 Security Certificate Signing Request text
348430	belong	0xedfeedfe	Sun 'jks' Java Keystore File data
34844
348450	string \0volume_key	volume_key escrow packet
34846# Type:	SE Linux policy modules *.pp reference policy
34847#	for Fedora 5 to 9, RHEL5, and Debian Etch and Lenny.
34848# URL:	https://doc.coker.com.au/computers/selinux-magic
34849# From:	Russell Coker <russell@coker.com.au>
34850
348510		lelong	0xf97cff8f	SE Linux modular policy
34852>4		lelong	x		version %d,
34853>8		lelong	x		%d sections,
34854>>(12.l)	lelong	0xf97cff8d
34855>>>(12.l+27)	lelong	x		mod version %d,
34856>>>(12.l+31)	lelong	0		Not MLS,
34857>>>(12.l+31)	lelong	1		MLS,
34858>>>(12.l+23)	lelong	2
34859>>>>(12.l+47)	string	>\0		module name %s
34860>>>(12.l+23)	lelong	1		base
34861
348621	string	policy_module(	SE Linux policy module source
348632	string	policy_module(	SE Linux policy module source
34864
348650	string	##\ <summary>	SE Linux policy interface source
34866
34867#0	search	gen_context(	SE Linux policy file contexts
34868
34869#0	search	gen_sens(	SE Linux policy MLS constraints source
34870
34871#------------------------------------------------------------------------------
34872# $File: sendmail,v 1.11 2019/04/19 00:42:27 christos Exp $
34873# sendmail:  file(1) magic for sendmail config files
34874#
34875# XXX - byte order?
34876#
34877# Update: Joerg Jenderek
34878# GRR: this test is too general as it catches also
34879# READ.ME.FIRST.AWP Sendmail frozen configuration
34880# - version ====|====|====|====|====|====|====|====|====|====|====|====|===
34881# Email_23_f217153422.ts Sendmail frozen configuration
34882# - version \330jK\354
348830	byte	046
34884# https://www.sendmail.com/sm/open_source/docs/older_release_notes/
34885# freezed configuration file (dbm format?) created from sendmal.cf with -bz
34886# by older sendmail. til version 8.6 support for frozen configuration files is removed
34887# valid version numbers look like "7.14.4" and should be similar to output of commands
34888# "sendmail -d0 -bt < /dev/null |grep -i Version" or "egrep '^DZ' /etc/sendmail.cf"
34889>16	regex/s	=^[0-78][0-9.]{4}	Sendmail frozen configuration
34890# normally only /etc/sendmail.fc or /var/adm/sendmail/sendmail.fc
34891!:ext fc
34892>>16	string	>\0			- version %s
348930	short	0x271c
34894# look for valid version number
34895>16	regex/s	=^[0-78][0-9.]{4}	Sendmail frozen configuration
34896!:ext fc
34897>>16	string	>\0			- version %s
34898
34899#------------------------------------------------------------------------------
34900# sendmail:  file(1) magic for sendmail m4(1) files
34901#
34902# From Hendrik Scholz <hendrik@scholz.net>
34903# i.e. files in /usr/share/sendmail/cf/
34904#
349050   string  divert(-1)\n    sendmail m4 text file
34906
34907
34908#------------------------------------------------------------------------------
34909# $File: sequent,v 1.14 2019/04/19 00:42:27 christos Exp $
34910# sequent:  file(1) magic for Sequent machines
34911#
34912# Sequent information updated by Don Dwiggins <atsun!dwiggins>.
34913# For Sequent's multiprocessor systems (incomplete).
349140	lelong	0x00ea        	BALANCE NS32000 .o
34915>16	lelong	>0		not stripped
34916>124	lelong	>0		version %d
349170	lelong	0x10ea        	BALANCE NS32000 executable (0 @ 0)
34918>16	lelong  >0            	not stripped
34919>124	lelong	>0		version %d
349200	lelong	0x20ea        	BALANCE NS32000 executable (invalid @ 0)
34921>16	lelong  >0            	not stripped
34922>124	lelong	>0		version %d
349230	lelong	0x30ea        	BALANCE NS32000 standalone executable
34924>16	lelong  >0          	not stripped
34925>124	lelong	>0		version %d
34926#
34927# Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>.
34928# Symmetry magic nums will not be reached if DOS COM comes before them;
34929# byte 0xeb is matched before these get a chance.
349300	leshort	0x12eb		SYMMETRY i386 .o
34931>16	lelong	>0		not stripped
34932>124	lelong	>0		version %d
349330	leshort	0x22eb		SYMMETRY i386 executable (0 @ 0)
34934>16	lelong	>0		not stripped
34935>124	lelong	>0		version %d
349360	leshort	0x32eb		SYMMETRY i386 executable (invalid @ 0)
34937>16	lelong	>0		not stripped
34938>124	lelong	>0		version %d
34939# https://en.wikipedia.org/wiki/Sequent_Computer_Systems
34940# below test line conflicts with MS-DOS 2.11 floppies and Acronis loader
34941#0	leshort	0x42eb		SYMMETRY i386 standalone executable
349420	leshort	0x42eb
34943# skip unlike negative version
34944>124	lelong	>-1
34945# assuming version 28867614 is very low probable
34946>>124	lelong	!28867614	SYMMETRY i386 standalone executable
34947>>>16	lelong	>0		not stripped
34948>>>124	lelong	>0		version %d
34949
34950#------------------------------------------------------------------------------
34951# $File: sereal,v 1.3 2015/02/05 19:14:45 christos Exp $
34952# sereal: file(1) magic the Sereal binary serialization format
34953#
34954# From: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
34955#
34956# See the specification of the format at
34957# https://github.com/Sereal/Sereal/blob/master/sereal_spec.pod#document-header-format
34958#
34959# I'd have liked to do the byte&0xF0 matching against 0, 1, 2 ... by
34960# doing (byte&0xF0)>>4 here, but unfortunately that's not
34961# supported. So when we print out a message about an unknown format
34962# we'll print out e.g. 0x30 instead of the more human-readable
34963# 0x30>>4.
34964#
34965# See https://github.com/Sereal/Sereal/commit/35372ae01d in the
34966# Sereal.git repository for test Sereal data.
349670	name		sereal
34968>4	byte&0x0F	x		(version %d,
34969>4	byte&0xF0	0x00		uncompressed)
34970>4	byte&0xF0	0x10		compressed with non-incremental Snappy)
34971>4	byte&0xF0	0x20		compressed with incremental Snappy)
34972>4	byte&0xF0	>0x20		unknown subformat, flag: %d>>4)
34973
349740	string/b	\=srl		Sereal data packet
34975!:mime application/sereal
34976>&0	use		sereal
349770	string/b	\=\xF3rl	Sereal data packet
34978!:mime application/sereal
34979>&0	use		sereal
349800	string/b	\=\xC3\xB3rl	Sereal data packet, UTF-8 encoded
34981!:mime application/sereal
34982>&0	use		sereal
34983
34984
34985#------------------------------------------------------------------------------
34986# $File: sgi,v 1.24 2021/09/13 13:23:53 christos Exp $
34987# sgi:  file(1) magic for Silicon Graphics operating systems and applications
34988#
34989# Executable images are handled either in aout (for old-style a.out
34990# files for 68K; they are indistinguishable from other big-endian 32-bit
34991# a.out files) or in mips (for MIPS ECOFF and Ucode files)
34992#
34993
34994# kbd file definitions
349950	string	kbd!map		kbd map file
34996>8	byte	>0		Ver %d:
34997>10	short	>0		with %d table(s)
34998
349990	beshort	0x8765		disk quotas file
35000
350010	beshort	0x0506		IRIS Showcase file
35002>2	byte	0x49		-
35003>3	byte	x		- version %d
350040	beshort	0x0226		IRIS Showcase template
35005>2	byte	0x63		-
35006>3	byte	x		- version %d
350070	belong	0x5343464d	IRIS Showcase file
35008>4	byte	x		- version %d
350090	belong	0x5443464d	IRIS Showcase template
35010>4	byte	x		- version %d
350110	belong	0xdeadbabe	IRIX Parallel Arena
35012>8	belong	>0		- version %d
35013
35014# core files
35015#
35016# 32bit core file
350170	belong	0xdeadadb0	IRIX core dump
35018>4	belong	1		of
35019>16	string	>\0		'%s'
35020# 64bit core file
350210	belong	0xdeadad40	IRIX 64-bit core dump
35022>4	belong	1		of
35023>16	string	>\0		'%s'
35024# N32bit core file
350250       belong	0xbabec0bb	IRIX N32 core dump
35026>4      belong	1               of
35027>16     string	>\0             '%s'
35028# New style crash dump file
350290	string	\x43\x72\x73\x68\x44\x75\x6d\x70	IRIX vmcore dump of
35030>36	string	>\0					'%s'
35031
35032# Trusted IRIX info
350330	string	SGIAUDIT	SGI Audit file
35034>8	byte	x		- version %d
35035>9	byte	x		\b.%d
35036#
350370	string	WNGZWZSC	Wingz compiled script
350380	string	WNGZWZSS	Wingz spreadsheet
350390	string	WNGZWZHP	Wingz help file
35040#
350410	string	#Inventor\040V	IRIS Inventor 1.0 file
350420	string	#Inventor\040V2	Open Inventor 2.0 file
35043# GLF is OpenGL stream encoding
350440	string	glfHeadMagic();		GLF_TEXT
350454	belong	0x7d000000		GLF_BINARY_LSB_FIRST
35046!:strength -30
350474	belong	0x0000007d		GLF_BINARY_MSB_FIRST
35048!:strength -30
35049# GLS is OpenGL stream encoding; GLS is the successor of GLF
350500	string	glsBeginGLS(		GLS_TEXT
350514	belong	0x10000000		GLS_BINARY_LSB_FIRST
35052!:strength -30
350534	belong	0x00000010		GLS_BINARY_MSB_FIRST
35054!:strength -30
35055
35056# Performance Co-Pilot file types
350570	string	PmNs				PCP compiled namespace (V.0)
350580	string	PmN				PCP compiled namespace
35059>3	string	>\0				(V.%1.1s)
350603	belong	0x84500526			PCP archive
35061>7	byte	x				(V.%d)
35062>20	belong	-2				temporal index
35063>20	belong	-1				metadata
35064>20	belong	0				log volume #0
35065>20	belong	>0				log volume #%d
35066>24	string	>\0				host: %s
350673	belong	0x28500526			PCP archive
35068>7	byte	x				(V.%d)
35069>24	belong	-2				temporal index
35070>24	belong	-1				metadata
35071>24	belong	0				log volume #0
35072>24	belong	>0				log volume #%d
35073>36	string	>\0				host: %s
350740	string	PCPFolio			PCP
35075>9	string	Version:			Archive Folio
35076>18	string	>\0				(V.%s)
350770	string	#pmchart			PCP pmchart view
35078>9	string	Version
35079>17	string	>\0				(V%-3.3s)
350800	string	#kmchart			PCP pmchart view
35081>9	string	Version
35082>17	string	>\0				(V.%s)
350830	string	pmview				PCP pmview config
35084>7	string	Version
35085>15	string	>\0				(V%-3.3s)
350860	string	#pmlogger			PCP pmlogger config
35087>10	string	Version
35088>18	string	>\0				(V%1.1s)
350890	string	#pmdahotproc			PCP pmdahotproc config
35090>13	string	Version
35091>21	string	>\0				(V%-3.3s)
350920	string	PcPh				PCP Help
35093>4	string	1				Index
35094>4	string	2				Text
35095>5	string	>\0				(V.%1.1s)
350960	string	#pmieconf-rules			PCP pmieconf rules
35097>16	string	>\0				(V.%1.1s)
350983	string	pmieconf-pmie			PCP pmie config
35099>17	string	>\0				(V.%1.1s)
351000	string	#pmlogconf-setup		PCP pmlogconf config
35101>17	string	>\0				(V.%1.1s)
351021	string	pmlogconf			PCP pmlogger config
35103>11	string	>\0				(V.%1.1s)
351040	string	MMV				PCP memory mapped values
35105>4	long	x				(V.%d)
35106
35107# SpeedShop data files
351080	lelong	0x13130303			SpeedShop data file
35109
35110# mdbm files
351110	lelong	0x01023962			mdbm file, version 0 (obsolete)
351120	string	mdbm				mdbm file,
35113>5	byte	x				version %d,
35114>6	byte	x				2^%d pages,
35115>7	byte	x				pagesize 2^%d,
35116>17	byte	x				hash %d,
35117>11	byte	x				dataformat %d
35118
35119# Alias Maya files
351200	string/t	//Maya\040ASCII	Alias Maya Ascii File,
35121>13	string	>\0	version %s
351228	string	MAYAFOR4	Alias Maya Binary File,
35123>32	string	>\0	version %s scene
351248	string	MayaFOR4	Alias Maya Binary File,
35125>32	string	>\0	version %s scene
351268	string	CIMG		Alias Maya Image File
351278	string	DEEP		Alias Maya Image File
35128
35129#------------------------------------------------------------------------------
35130# $File: sgml,v 1.46 2022/08/16 11:16:39 christos Exp $
35131# Type:	SVG Vectorial Graphics
35132# From:	Noel Torres <tecnico@ejerciciosresueltos.com>
351330	string/bt	\<?xml\ version=
35134>14	regex		['"\ \t]*[0-9.]+['"\ \t]*
35135>>19	search/4096	\<svg			SVG Scalable Vector Graphics image
35136!:strength +50
35137!:mime	image/svg+xml
35138!:ext   svg
35139>>19	search/4096	\<gnc-v2		GnuCash file
35140!:mime	application/x-gnucash
351410	string/bt	\<svg			SVG Scalable Vector Graphics image
35142!:mime	image/svg+xml
35143!:ext   svg
35144
35145# Sitemap file
351460	string/t		\<?xml\ version=
35147>14	regex		['"\ \t]*[0-9.]+['"\ \t]*
35148>>19	search/4096	\<urlset		XML Sitemap document text
35149!:mime	application/xml-sitemap
35150
35151# OpenStreetMap XML (.osm)
35152# https://wiki.openstreetmap.org/wiki/OSM_XML
35153# From: Markus Heidelberg <markus.heidelberg@web.de>
351540	string		\<?xml\ version=
35155>14	regex		['"\ \t]*[0-9.]+['"\ \t]*
35156>>19	search/4096	\<osm			OpenStreetMap XML data
35157
35158# xhtml
351590	string/t		\<?xml\ version="
35160>19	search/4096/cWbt	\<!doctype\ html	XHTML document text
35161>>15	string		>\0	(version %.3s)
35162!:mime	text/html
351630	string/t		\<?xml\ version='
35164>19	search/4096/cWbt	\<!doctype\ html	XHTML document text
35165>>15	string		>\0	(version %.3s)
35166!:mime	text/html
351670	string/t		\<?xml\ version="
35168>19	search/4096/cWbt	\<html	broken XHTML document text
35169>>15	string		>\0	(version %.3s)
35170!:mime	text/html
35171
35172#------------------------------------------------------------------------------
35173# sgml:  file(1) magic for Standard Generalized Markup Language
35174# HyperText Markup Language (HTML) is an SGML document type,
35175# from Daniel Quinlan (quinlan@yggdrasil.com)
35176# adapted to string extensions by Anthon van der Neut <anthon@mnt.org)
351770	search/4096/cWt	\<!doctype\ html	HTML document text
35178!:mime	text/html
35179!:strength + 5
35180
35181# SVG document
35182# https://www.w3.org/TR/SVG/single-page.html
351830	search/4096/cWbt	\<!doctype\ svg	SVG XML document
35184!:mime  image/svg+xml
35185!:strength + 15
35186
351870	search/4096/cwt	\<head\>		HTML document text
35188!:mime	text/html
35189!:strength + 15
351900	search/4096/cWt	\<head\ 		HTML document text
35191!:mime	text/html
35192!:strength + 15
351930	search/4096/cwt	\<title\>		HTML document text
35194!:mime	text/html
35195!:strength + 15
351960	search/4096/cWt	\<title\ 		HTML document text
35197!:mime	text/html
35198!:strength + 15
351990	search/4096/cwt	\<html\>		HTML document text
35200!:mime	text/html
35201!:strength + 15
352020	search/4096/cWt	\<html\ 		HTML document text
35203!:mime	text/html
35204!:strength + 15
352050	search/4096/cwt	\<script\> 		HTML document text
35206!:mime	text/html
35207!:strength + 15
352080	search/4096/cWt	\<script\ 		HTML document text
35209!:mime	text/html
35210!:strength + 15
352110	search/4096/cwt	\<style\> 		HTML document text
35212!:mime	text/html
35213!:strength + 15
352140	search/4096/cWt	\<style\  		HTML document text
35215!:mime	text/html
35216!:strength + 15
352170	search/4096/cwt	\<table\>		HTML document text
35218!:mime	text/html
35219!:strength + 15
352200	search/4096/cWt	\<table\ 		HTML document text
35221!:mime	text/html
35222!:strength + 15
35223
352240	search/4096/cwt	\<a\ href=		HTML document text
35225!:mime	text/html
35226!:strength + 15
35227
35228# Extensible markup language (XML), a subset of SGML
35229# from Marc Prud'hommeaux (marc@apocalypse.org)
352300	search/1/cwt	\<?xml			XML document text
35231!:mime	text/xml
35232!:strength + 15
352330	string/t		\<?xml\ version\ "	XML
35234!:mime	text/xml
35235!:strength + 15
352360	string/t		\<?xml\ version="	XML
35237!:mime	text/xml
35238!:strength + 15
35239>15	string/t	>\0			%.3s document text
35240>>23	search/1	\<xsl:stylesheet	(XSL stylesheet)
35241>>24	search/1	\<xsl:stylesheet	(XSL stylesheet)
352420	string/t	\<?xml\ version='	XML
35243!:mime	text/xml
35244!:strength + 15
35245>15	string/t	>\0			%.3s document text
35246>>23	search/1	\<xsl:stylesheet	(XSL stylesheet)
35247>>24	search/1	\<xsl:stylesheet	(XSL stylesheet)
352480	search/1/wt	\<?XML			broken XML document text
35249!:mime	text/xml
35250!:strength - 10
35251
35252
35253# SGML, mostly from rph@sq
352540	search/4096/cwt	\<!doctype		exported SGML document text
352550	search/4096/cwt	\<!subdoc		exported SGML subdocument text
352560	search/4096/cwt	\<!--			exported SGML document text
35257!:strength - 10
35258
35259# Web browser cookie files
35260# (Mozilla, Galeon, Netscape 4, Konqueror..)
35261# Ulf Harnhammar <ulfh@update.uu.se>
352620	search/1	#\ HTTP\ Cookie\ File	Web browser cookie text
352630	search/1	#\ Netscape\ HTTP\ Cookie\ File	Netscape cookie text
352640	search/1	#\ KDE\ Cookie\ File	Konqueror cookie text
35265
35266# XML-based format representing braille pages in a digital format.
35267#
35268# Specification:
35269# http://files.pef-format.org/specifications/pef-2008-1/pef-specification.html
35270#
35271# Simon Aittamaa <simon.aittamaa@gmail.com>
352720	string		\<?xml\ version=
35273>14	regex		['"\ \t]*[0-9.]+['"\ \t]*
35274>>19    search/4096	\<pef           Portable Embosser Format
35275!:mime  application/x-pef+xml
35276
35277# https://www.qgis.org/en/site/
352780	string		\<!DOCTYPE\040qgis	QGIS XML document
35279
35280#------------------------------------------------------------------------
35281# $File: sharc,v 1.8 2017/03/17 21:35:28 christos Exp $
35282# file(1) magic for sharc files
35283#
35284# SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by
35285# FutureGroove Music (dsp@futuregroove.de)
35286
35287#------------------------------------------------------------------------
35288#0	string			Draw		RiscOS Drawfile
35289#0	string			PACK		RiscOS PackdDir archive
35290
35291#------------------------------------------------------------------------
35292# SHARC DSP stuff (based on the FGM SHARC DSP SDK)
35293
35294#0	string			=!		Assembler source
35295#0	string			Analog		ADi asm listing file
352960	string			.SYSTEM		SHARC architecture file
352970	string			.system		SHARC architecture file
35298
352990	leshort			0x521C		SHARC COFF binary
35300>2	leshort			>1		, %d sections
35301>>12	lelong			>0		, not stripped
35302
35303#------------------------------------------------------------------------------
35304# $File: sinclair,v 1.7 2021/04/27 20:35:51 christos Exp $
35305# sinclair:  file(1) sinclair QL
35306
35307# additions to /etc/magic by Thomas M. Ott (ThMO)
35308
35309# Sinclair QL floppy disk formats (ThMO)
353100	string	=QL5		QL disk dump data,
35311>3	string	=A		720 KB,
35312>3	string	=B		1.44 MB,
35313>3	string	=C		3.2 MB,
35314>4	string	>\0		label:%.10s
35315
35316# Sinclair QL OS dump (ThMO)
353170		belong	=0x30000
35318>49124		belong	<47104
35319>>49128		belong	<47104
35320>>>49132	belong	<47104
35321>>>>49136	belong	<47104	QL OS dump data,
35322>>>>>49148	string	>\0	type %.3s,
35323>>>>>49142	string	>\0	version %.4s
35324
35325# Sinclair QL firmware executables (ThMO)
353260	string	NqNqNq`\004	QL firmware executable (BCPL)
35327
35328# Sinclair QL libraries (was ThMO)
353290	beshort	0xFB01		QDOS object
35330>2	pstring	x		'%s'
35331
35332# Sinclair QL executables (was ThMO)
353334	belong	0x4AFB		QDOS executable
35334>9	pstring	x		'%s'
353356	beshort	0x4AFB		QDOS executable
35336>9	pstring	x		'%s'
35337
35338# Sinclair QL ROM (ThMO)
353390	belong	=0x4AFB0001	QL plugin-ROM data,
35340>9	pstring	=\0		un-named
35341>9	pstring	>\0		named: %s
35342# Type: SiSU Markup Language
35343# URL:  http://www.sisudoc.org/
35344# From: Ralph Amissah <ralph.amissah@gmail.com>
35345
353460	regex	\^%?[\ \t]*SiSU[\ \t]+insert	SiSU text insert
35347>5	regex	[0-9.]+				%s
35348
353490	regex	\^%[\ \t]+SiSU[\ \t]+master	SiSU text master
35350>5	regex	[0-9.]+				%s
35351
353520	regex	\^%?[\ \t]*SiSU[\ \t]+text	SiSU text
35353>5	regex	[0-9.]+				%s
35354
353550	regex	\^%?[\ \t]*SiSU[\ \t][0-9.]+	SiSU text
35356>5	regex	[0-9.]+				%s
35357
353580	regex	\^%*[\ \t]*sisu-[0-9.]+		SiSU text
35359>5	regex	[0-9.]+				%s
35360
35361#------------------------------------------------------------------------------
35362# $File: sketch,v 1.5 2017/03/17 21:35:28 christos Exp $
35363# Sketch Drawings: http://sketch.sourceforge.net/
35364# From: Edwin Mons <e@ik.nu>
353650	search/1	##Sketch	Sketch document text
35366
35367#-----------------------------------------------
35368# $File: smalltalk,v 1.5 2009/09/19 16:28:12 christos Exp $
35369# GNU Smalltalk image, starting at version 1.6.2
35370# From: catull_us@yahoo.com
35371#
353720	string	GSTIm\0\0	GNU SmallTalk
35373# little-endian
35374>7	byte&1	=0		LE image version
35375>>10	byte	x		%d.
35376>>9	byte	x		\b%d.
35377>>8	byte	x		\b%d
35378#>>12	lelong	x		, data: %ld
35379#>>16	lelong	x		, table: %ld
35380#>>20	lelong	x		, memory: %ld
35381# big-endian
35382>7	byte&1	=1		BE image version
35383>>8	byte	x		%d.
35384>>9	byte	x		\b%d.
35385>>10	byte	x		\b%d
35386#>>12	belong	x		, data: %ld
35387#>>16	belong	x		, table: %ld
35388#>>20	belong	x		, memory: %ld
35389
35390
35391
35392#------------------------------------------------------------------------------
35393# $File: smile,v 1.1 2011/08/17 17:37:18 christos Exp $
35394# smile:  file(1) magic for Smile serialization
35395#
35396# The Smile serialization format uses a 4-byte header:
35397#
35398#   Constant byte #0: 0x3A (ASCII ':')
35399#   Constant byte #1: 0x29 (ASCII ')')
35400#   Constant byte #2: 0x0A (ASCII linefeed, '\n')
35401#   Variable byte #3, consisting of bits:
35402#     Bits 4-7 (4 MSB): 4-bit version number
35403#     Bits 3: Reserved
35404#     Bit 2 (mask 0x04): Whether raw binary (unescaped 8-bit) values may be present in content
35405#     Bit 1 (mask 0x02): Whether shared String value checking was enabled during encoding, default false
35406#     Bit 0 (mask 0x01): Whether shared property name checking was enabled during encoding, default true
35407#
35408# Reference: http://wiki.fasterxml.com/SmileFormatSpec
35409# Created by: Pierre-Alexandre Meyer <pierre@mouraf.org>
35410
35411# Detection
354120	string		:)\n	Smile binary data
35413
35414# Versioning
35415>3	byte&0xF0	x		version %d:
35416
35417# Properties
35418>3	byte&0x04	0x04		binary raw,
35419>3	byte&0x04	0x00		binary encoded,
35420>3	byte&0x02	0x02		shared String values enabled,
35421>3	byte&0x02	0x00		shared String values disabled,
35422>3	byte&0x01	0x01		shared field names enabled
35423>3	byte&0x01	0x00		shared field names disabled
35424
35425
35426#------------------------------------------------------------------------------
35427# $File: sniffer,v 1.32 2022/07/30 16:46:56 christos Exp $
35428# sniffer:  file(1) magic for packet capture files
35429#
35430# From: guy@alum.mit.edu (Guy Harris)
35431#
35432
35433#
35434# Microsoft Network Monitor 1.x capture files.
35435#
354360	string		RTSS		NetMon capture file
35437>5	byte		x		- version %d
35438>4	byte		x		\b.%d
35439>6	leshort		0		(Unknown)
35440>6	leshort		1		(Ethernet)
35441>6	leshort		2		(Token Ring)
35442>6	leshort		3		(FDDI)
35443>6	leshort		4		(ATM)
35444>6	leshort		>4		(type %d)
35445
35446#
35447# Microsoft Network Monitor 2.x capture files.
35448#
354490	string		GMBU		NetMon capture file
35450>5	byte		x		- version %d
35451>4	byte		x		\b.%d
35452>6	leshort		0		(Unknown)
35453>6	leshort		1		(Ethernet)
35454>6	leshort		2		(Token Ring)
35455>6	leshort		3		(FDDI)
35456>6	leshort		4		(ATM)
35457>6	leshort		5		(IP-over-IEEE 1394)
35458>6	leshort		6		(802.11)
35459>6	leshort		7		(Raw IP)
35460>6	leshort		8		(Raw IP)
35461>6	leshort		9		(Raw IP)
35462>6	leshort		>9		(type %d)
35463
35464#
35465# Network General Sniffer capture files.
35466# Sorry, make that "Network Associates Sniffer capture files."
35467# Sorry, make that "Network General old DOS Sniffer capture files."
35468#
354690	string		TRSNIFF\040data\040\040\040\040\032	Sniffer capture file
35470>33	byte		2		(compressed)
35471>23	leshort		x		- version %d
35472>25	leshort		x		\b.%d
35473>32	byte		0		(Token Ring)
35474>32	byte		1		(Ethernet)
35475>32	byte		2		(ARCNET)
35476>32	byte		3		(StarLAN)
35477>32	byte		4		(PC Network broadband)
35478>32	byte		5		(LocalTalk)
35479>32	byte		6		(Znet)
35480>32	byte		7		(Internetwork Analyzer)
35481>32	byte		9		(FDDI)
35482>32	byte		10		(ATM)
35483
35484#
35485# Cinco Networks NetXRay capture files.
35486# Sorry, make that "Network General Sniffer Basic capture files."
35487# Sorry, make that "Network Associates Sniffer Basic capture files."
35488# Sorry, make that "Network Associates Sniffer Basic, and Windows
35489# Sniffer Pro", capture files."
35490# Sorry, make that "Network General Sniffer capture files."
35491# Sorry, make that "NetScout Sniffer capture files."
35492#
354930	string		XCP\0		NetXRay capture file
35494>4	string		>\0		- version %s
35495>44	leshort		0		(Ethernet)
35496>44	leshort		1		(Token Ring)
35497>44	leshort		2		(FDDI)
35498>44	leshort		3		(WAN)
35499>44	leshort		8		(ATM)
35500>44	leshort		9		(802.11)
35501
35502#
35503# "libpcap" capture files.
35504# https://www.tcpdump.org/manpages/pcap-savefile.5.html
35505# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
35506# the main program that uses that format, but there are other programs
35507# that use "libpcap", or that use the same capture file format.)
35508#
355090	name		pcap-be
35510>4	beshort		x		- version %d
35511>6	beshort		x		\b.%d
35512# clear that continuation level match
35513>20	clear		x
35514>20	belong&0x03FFFFFF		0		(No link-layer encapsulation
35515>20	belong&0x03FFFFFF		1		(Ethernet
35516>20	belong&0x03FFFFFF		2		(3Mb Ethernet
35517>20	belong&0x03FFFFFF		3		(AX.25
35518>20	belong&0x03FFFFFF		4		(ProNET
35519>20	belong&0x03FFFFFF		5		(CHAOS
35520>20	belong&0x03FFFFFF		6		(Token Ring
35521>20	belong&0x03FFFFFF		7		(BSD ARCNET
35522>20	belong&0x03FFFFFF		8		(SLIP
35523>20	belong&0x03FFFFFF		9		(PPP
35524>20	belong&0x03FFFFFF		10		(FDDI
35525>20	belong&0x03FFFFFF		11		(RFC 1483 ATM
35526>20	belong&0x03FFFFFF		12		(Raw IP
35527>20	belong&0x03FFFFFF		13		(BSD/OS SLIP
35528>20	belong&0x03FFFFFF		14		(BSD/OS PPP
35529>20	belong&0x03FFFFFF		19		(Linux ATM Classical IP
35530>20	belong&0x03FFFFFF		50		(PPP or Cisco HDLC
35531>20	belong&0x03FFFFFF		51		(PPP-over-Ethernet
35532>20	belong&0x03FFFFFF		99		(Symantec Enterprise Firewall
35533>20	belong&0x03FFFFFF		100		(RFC 1483 ATM
35534>20	belong&0x03FFFFFF		101		(Raw IP
35535>20	belong&0x03FFFFFF		102		(BSD/OS SLIP
35536>20	belong&0x03FFFFFF		103		(BSD/OS PPP
35537>20	belong&0x03FFFFFF		104		(BSD/OS Cisco HDLC
35538>20	belong&0x03FFFFFF		105		(802.11
35539>20	belong&0x03FFFFFF		106		(Linux Classical IP over ATM
35540>20	belong&0x03FFFFFF		107		(Frame Relay
35541>20	belong&0x03FFFFFF		108		(OpenBSD loopback
35542>20	belong&0x03FFFFFF		109		(OpenBSD IPsec encrypted
35543>20	belong&0x03FFFFFF		112		(Cisco HDLC
35544>20	belong&0x03FFFFFF		113		(Linux cooked v1
35545>20	belong&0x03FFFFFF		114		(LocalTalk
35546>20	belong&0x03FFFFFF		117		(OpenBSD PFLOG
35547>20	belong&0x03FFFFFF		119		(802.11 with Prism header
35548>20	belong&0x03FFFFFF		122		(RFC 2625 IP over Fibre Channel
35549>20	belong&0x03FFFFFF		123		(SunATM
35550>20	belong&0x03FFFFFF		127		(802.11 with radiotap header
35551>20	belong&0x03FFFFFF		129		(Linux ARCNET
35552>20	belong&0x03FFFFFF		130		(Juniper Multi-Link PPP
35553>20	belong&0x03FFFFFF		131		(Juniper Multi-Link Frame Relay
35554>20	belong&0x03FFFFFF		132		(Juniper Encryption Services PIC
35555>20	belong&0x03FFFFFF		133		(Juniper GGSN PIC
35556>20	belong&0x03FFFFFF		134		(Juniper FRF.16 Frame Relay
35557>20	belong&0x03FFFFFF		135		(Juniper ATM2 PIC
35558>20	belong&0x03FFFFFF		136		(Juniper Advanced Services PIC
35559>20	belong&0x03FFFFFF		137		(Juniper ATM1 PIC
35560>20	belong&0x03FFFFFF		138		(Apple IP over IEEE 1394
35561>20	belong&0x03FFFFFF		139		(SS7 MTP2 with pseudo-header
35562>20	belong&0x03FFFFFF		140		(SS7 MTP2
35563>20	belong&0x03FFFFFF		141		(SS7 MTP3
35564>20	belong&0x03FFFFFF		142		(SS7 SCCP
35565>20	belong&0x03FFFFFF		143		(DOCSIS
35566>20	belong&0x03FFFFFF		144		(Linux IrDA
35567>20	belong&0x03FFFFFF		147		(Private use 0
35568>20	belong&0x03FFFFFF		148		(Private use 1
35569>20	belong&0x03FFFFFF		149		(Private use 2
35570>20	belong&0x03FFFFFF		150		(Private use 3
35571>20	belong&0x03FFFFFF		151		(Private use 4
35572>20	belong&0x03FFFFFF		152		(Private use 5
35573>20	belong&0x03FFFFFF		153		(Private use 6
35574>20	belong&0x03FFFFFF		154		(Private use 7
35575>20	belong&0x03FFFFFF		155		(Private use 8
35576>20	belong&0x03FFFFFF		156		(Private use 9
35577>20	belong&0x03FFFFFF		157		(Private use 10
35578>20	belong&0x03FFFFFF		158		(Private use 11
35579>20	belong&0x03FFFFFF		159		(Private use 12
35580>20	belong&0x03FFFFFF		160		(Private use 13
35581>20	belong&0x03FFFFFF		161		(Private use 14
35582>20	belong&0x03FFFFFF		162		(Private use 15
35583>20	belong&0x03FFFFFF		163		(802.11 with AVS header
35584>20	belong&0x03FFFFFF		164		(Juniper Passive Monitor PIC
35585>20	belong&0x03FFFFFF		165		(BACnet MS/TP
35586>20	belong&0x03FFFFFF		166		(PPPD
35587>20	belong&0x03FFFFFF		167		(Juniper PPPoE
35588>20	belong&0x03FFFFFF		168		(Juniper PPPoE/ATM
35589>20	belong&0x03FFFFFF		169		(GPRS LLC
35590>20	belong&0x03FFFFFF		170		(GPF-T
35591>20	belong&0x03FFFFFF		171		(GPF-F
35592>20	belong&0x03FFFFFF		174		(Juniper PIC Peer
35593>20	belong&0x03FFFFFF		175		(Ethernet with Endace ERF header
35594>20	belong&0x03FFFFFF		176		(Packet-over-SONET with Endace ERF header
35595>20	belong&0x03FFFFFF		177		(Linux LAPD
35596>20	belong&0x03FFFFFF		178		(Juniper Ethernet
35597>20	belong&0x03FFFFFF		179		(Juniper PPP
35598>20	belong&0x03FFFFFF		180		(Juniper Frame Relay
35599>20	belong&0x03FFFFFF		181		(Juniper C-HDLC
35600>20	belong&0x03FFFFFF		182		(FRF.16 Frame Relay
35601>20	belong&0x03FFFFFF		183		(Juniper Voice PIC
35602>20	belong&0x03FFFFFF		184		(Arinc 429
35603>20	belong&0x03FFFFFF		185		(Arinc 653 Interpartition Communication
35604>20	belong&0x03FFFFFF		186		(USB with FreeBSD header
35605>20	belong&0x03FFFFFF		187		(Bluetooth HCI H4
35606>20	belong&0x03FFFFFF		188		(802.16 MAC Common Part Sublayer
35607>20	belong&0x03FFFFFF		189		(Linux USB
35608>20	belong&0x03FFFFFF		190		(Controller Area Network (CAN) v. 2.0B
35609>20	belong&0x03FFFFFF		191		(802.15.4 with Linux padding
35610>20	belong&0x03FFFFFF		192		(PPI
35611>20	belong&0x03FFFFFF		193		(802.16 MAC Common Part Sublayer plus radiotap header
35612>20	belong&0x03FFFFFF		194		(Juniper Integrated Service Module
35613>20	belong&0x03FFFFFF		195		(802.15.4 with FCS
35614>20	belong&0x03FFFFFF		196		(SITA
35615>20	belong&0x03FFFFFF		197		(Endace ERF
35616>20	belong&0x03FFFFFF		198		(Ethernet with u10 Networks pseudo-header
35617>20	belong&0x03FFFFFF		199		(IPMB
35618>20	belong&0x03FFFFFF		200		(Juniper Secure Tunnel
35619>20	belong&0x03FFFFFF		201		(Bluetooth HCI H4 with pseudo-header
35620>20	belong&0x03FFFFFF		202		(AX.25 with KISS header
35621>20	belong&0x03FFFFFF		203		(LAPD
35622>20	belong&0x03FFFFFF		204		(PPP with direction pseudo-header
35623>20	belong&0x03FFFFFF		205		(Cisco HDLC with direction pseudo-header
35624>20	belong&0x03FFFFFF		206		(Frame Relay with direction pseudo-header
35625>20	belong&0x03FFFFFF		209		(Linux IPMB
35626>20	belong&0x03FFFFFF		215		(802.15.4 with non-ASK PHY header
35627>20	belong&0x03FFFFFF		216		(Linux evdev events
35628>20	belong&0x03FFFFFF		219		(MPLS with label as link-layer header
35629>20	belong&0x03FFFFFF		220		(Memory-mapped Linux USB
35630>20	belong&0x03FFFFFF		221		(DECT
35631>20	belong&0x03FFFFFF		222		(AOS Space Data Link protocol
35632>20	belong&0x03FFFFFF		223		(Wireless HART
35633>20	belong&0x03FFFFFF		224		(Fibre Channel FC-2
35634>20	belong&0x03FFFFFF		225		(Fibre Channel FC-2 with frame delimiters
35635>20	belong&0x03FFFFFF		226		(Solaris IPNET
35636>20	belong&0x03FFFFFF		227		(SocketCAN
35637>20	belong&0x03FFFFFF		228		(Raw IPv4
35638>20	belong&0x03FFFFFF		229		(Raw IPv6
35639>20	belong&0x03FFFFFF		230		(802.15.4 without FCS
35640>20	belong&0x03FFFFFF		231		(D-Bus messages
35641>20	belong&0x03FFFFFF		232		(Juniper Virtual Server
35642>20	belong&0x03FFFFFF		233		(Juniper SRX E2E
35643>20	belong&0x03FFFFFF		234		(Juniper Fibre Channel
35644>20	belong&0x03FFFFFF		235		(DVB-CI
35645>20	belong&0x03FFFFFF		236		(MUX27010
35646>20	belong&0x03FFFFFF		237		(STANAG 5066 D_PDUs
35647>20	belong&0x03FFFFFF		238		(Juniper ATM CEMIC
35648>20	belong&0x03FFFFFF		239		(Linux netfilter log messages
35649>20	belong&0x03FFFFFF		240		(Hilscher netAnalyzer
35650>20	belong&0x03FFFFFF		241		(Hilscher netAnalyzer with delimiters
35651>20	belong&0x03FFFFFF		242		(IP-over-Infiniband
35652>20	belong&0x03FFFFFF		243		(MPEG-2 Transport Stream packets
35653>20	belong&0x03FFFFFF		244		(ng4t ng40
35654>20	belong&0x03FFFFFF		245		(NFC LLCP
35655>20	belong&0x03FFFFFF		246		(Packet filter state syncing
35656>20	belong&0x03FFFFFF		247		(InfiniBand
35657>20	belong&0x03FFFFFF		248		(SCTP
35658>20	belong&0x03FFFFFF		249		(USB with USBPcap header
35659>20	belong&0x03FFFFFF		250		(Schweitzer Engineering Laboratories RTAC packets
35660>20	belong&0x03FFFFFF		251		(Bluetooth Low Energy air interface
35661>20	belong&0x03FFFFFF		252		(Wireshark Upper PDU export
35662>20	belong&0x03FFFFFF		253		(Linux netlink
35663>20	belong&0x03FFFFFF		254		(Bluetooth Linux Monitor
35664>20	belong&0x03FFFFFF		255		(Bluetooth Basic Rate/Enhanced Data Rate baseband packets
35665>20	belong&0x03FFFFFF		256		(Bluetooth Low Energy air interface with pseudo-header
35666>20	belong&0x03FFFFFF		257		(PROFIBUS data link layer
35667>20	belong&0x03FFFFFF		258		(Apple DLT_PKTAP
35668>20	belong&0x03FFFFFF		259		(Ethernet with 802.3 Clause 65 EPON preamble
35669>20	belong&0x03FFFFFF		260		(IPMI trace packets
35670>20	belong&0x03FFFFFF		261		(Z-Wave RF profile R1 and R2 packets
35671>20	belong&0x03FFFFFF		262		(Z-Wave RF profile R3 packets
35672>20	belong&0x03FFFFFF		263		(WattStopper Digital Lighting Mngmt/Legrand Nitoo Open Proto
35673>20	belong&0x03FFFFFF		264		(ISO 14443 messages
35674>20	belong&0x03FFFFFF		265		(IEC 62106 Radio Data System groups
35675>20	belong&0x03FFFFFF		266		(USB with Darwin header
35676>20	belong&0x03FFFFFF		267		(OpenBSD DLT_OPENFLOW
35677>20	belong&0x03FFFFFF		268		(IBM SDLC frames
35678>20	belong&0x03FFFFFF		269		(TI LLN sniffer frames
35679>20	belong&0x03FFFFFF		271		(Linux vsock
35680>20	belong&0x03FFFFFF		272		(Nordic Semiconductor Bluetooth LE sniffer frames
35681>20	belong&0x03FFFFFF		273		(Excentis XRA-31 DOCSIS 3.1 RF sniffer frames
35682>20	belong&0x03FFFFFF		274		(802.3br mPackets
35683>20	belong&0x03FFFFFF		275		(DisplayPort AUX channel monitoring data
35684>20	belong&0x03FFFFFF		276		(Linux cooked v2
35685>20	belong&0x03FFFFFF		278		(OpenVizsla USB
35686>20	belong&0x03FFFFFF		279		(Elektrobit High Speed Capture and Replay (EBHSCR)
35687>20	belong&0x03FFFFFF		281		(Broadcom tag
35688>20	belong&0x03FFFFFF		282		(Broadcom tag (prepended)
35689>20	belong&0x03FFFFFF		283		(802.15.4 with TAP
35690>20	belong&0x03FFFFFF		284		(Marvell DSA
35691>20	belong&0x03FFFFFF		285		(Marvell EDSA
35692>20	belong&0x03FFFFFF		286		(ELEE lawful intercept
35693>20	belong&0x03FFFFFF		287		(Z-Wave serial
35694>20	belong&0x03FFFFFF		288		(USB 2.0
35695>20	belong&0x03FFFFFF		289		(ATSC ALP
35696>20	belong&0x03FFFFFF		290		(Event Tracing for Windows
35697>20	belong&0x03FFFFFF		291		(Hilscher netANALYZER NG pseudo-footer
35698>20	belong&0x03FFFFFF		292		(ZBOSS NCP protocol with pseudo-header
35699>20	belong&0x03FFFFFF		293		(Low-Speed USB 2.0/1.1/1.0
35700>20	belong&0x03FFFFFF		294		(Full-Speed USB 2.0/1.1/1.0
35701>20	belong&0x03FFFFFF		295		(High-Speed USB 2.0
35702# print default match
35703>20	default		x
35704>>20	belong		x		(linktype#%u
35705>16	belong		x		\b, capture length %u)
35706
35707# packets time stamps in seconds and microseconds.
357080	ubelong		0xa1b2c3d4	pcap capture file, microseconds ts (big-endian)
35709!:mime	application/vnd.tcpdump.pcap
35710>0	use	pcap-be
357110	ulelong		0xa1b2c3d4	pcap capture file, microsecond ts (little-endian)
35712!:mime	application/vnd.tcpdump.pcap
35713>0	use	\^pcap-be
35714
35715# packets time stamps in seconds and nanoseconds.
357160	ubelong		0xa1b23c4d	pcap capture file, nanosecond ts (big-endian)
35717!:mime	application/vnd.tcpdump.pcap
35718>0	use	pcap-be
357190	ulelong		0xa1b23c4d	pcap capture file, nanosecond ts (little-endian)
35720!:mime	application/vnd.tcpdump.pcap
35721>0	use	\^pcap-be
35722
35723#
35724# "libpcap"-with-Alexey-Kuznetsov's-patches capture files.
35725#
357260	ubelong		0xa1b2cd34	pcap capture file, microsecond ts, extensions (big-endian)
35727>0	use	pcap-be
357280	ulelong		0xa1b2cd34	pcap capture file, microsecond ts, extensions (little-endian)
35729>0	use	\^pcap-be
35730
35731#
35732# "pcapng" capture files.
35733# https://github.com/pcapng/pcapng
35734# Pcapng files can contain multiple sections. Printing the endianness,
35735# snaplen, or other information from the first SHB may be misleading.
35736#
357370	ubelong		0x0a0d0d0a
35738>8	ubelong		0x1a2b3c4d	pcapng capture file
35739>>12	beshort		x		- version %d
35740>>14	beshort		x		\b.%d
357410	ulelong		0x0a0d0d0a
35742>8	ulelong		0x1a2b3c4d	pcapng capture file
35743>>12	leshort		x		- version %d
35744>>14	leshort		x		\b.%d
35745
35746#
35747# AIX "iptrace" capture files.
35748#
357490	string		iptrace\0401.0	AIX iptrace capture file
357500	string		iptrace\0402.0	AIX iptrace capture file
35751
35752#
35753# Novell LANalyzer capture files.
35754#
357550	leshort		0x1001		Novell LANalyzer capture file
357560	leshort		0x1007		Novell LANalyzer capture file
35757
35758#
35759# HP-UX "nettl" capture files.
35760#
357610	string		\x54\x52\x00\x64\x00	HP/UX nettl capture file
35762
35763#
35764# RADCOM WAN/LAN Analyzer capture files.
35765#
357660	string		\x42\xd2\x00\x34\x12\x66\x22\x88	RADCOM WAN/LAN Analyzer capture file
35767
35768#
35769# NetStumbler log files.  Not really packets, per se, but about as
35770# close as you can get.  These are log files from NetStumbler, a
35771# Windows program, that scans for 802.11b networks.
35772#
357730	string		NetS		NetStumbler log file
35774>8	lelong		x		\b, %d stations found
35775
35776#
35777# *Peek tagged capture files.
35778#
357790	string		\177ver		EtherPeek/AiroPeek/OmniPeek capture file
35780
35781#
35782# Visual Networks traffic capture files.
35783#
357840	string		\x05VNF		Visual Networks traffic capture file
35785
35786#
35787# Network Instruments Observer capture files.
35788#
357890	string		ObserverPktBuffe	Network Instruments Observer capture file
35790
35791#
35792# Files from Accellent Group's 5View products.
35793#
35794# URL:		http://www.infovista.com
35795# Reference:	http://mark0.net/download/triddefs_xml.7z
35796#		defs/0/5vw.trid.xml
35797#		https://2.na.dl.wireshark.org/src/wireshark-3.6.2.tar.xz
35798#		wireshark-3.6.2/wiretap/5views.c
35799# Update:	Joerg Jenderek
35800# Note:		called "5View capture" by TrID and
35801#		"Wireshark capture file" on Windows or
35802#		"Packet Capture (Accellent/InfoVista 5view)" by shared MIME-info database
35803#		verified/falsified by `wireshark *.5vw`
358040	string		\xaa\xaa\xaa\xaa
35805# skip misidentified boot/x86_64/loader/kroete.dat on Suse LEAP DVD
35806# by check for valid record version
35807>8	ulelong		=0x00010000
35808>>0	use	5view-le
358090	name	5view-le
35810# t_5VW_Info_Header.Signature = CST_5VW_INFO_HEADER_KEY = 0xAAAAAAAAU
35811>0	ulelong		x			5View capture file
35812# https://reposcope.com/mimetype/application/x-5view
35813!:mime	application/x-5view
35814!:ext	5vw
35815# size of header in bytes (included signature and reserved fields); probably always 20h
35816>4	ulelong		!0x00000020		\b, header size %#x
35817# version of header record; apparently always CST_5VW_INFO_RECORD_VERSION=0x00010000U
35818>8	ulelong		!0x00010000		\b, record version %#x
35819# DataSize; total size of data without header like: 18h
35820>12	ulelong		x			\b, record size %#x
35821# filetype; type of the capture file like: 18001000h
35822>16	ulelong		x			\b, file type %#8.8x
35823# Reserved[3]; reserved for future use; apparently zero
35824>20	quad		!0			\b, Reserved %#llx
35825# look for record header key CST_5VW_RECORDS_HEADER_KEY of structure t_5VW_TimeStamped_Header
35826>0x20	search/0xB8/b	\xEE\xEE\x33\x33	\b; record
35827# HeaderSize; actual size of this header in bytes like: 32 24h
35828>>&0	uleshort	x			size %#x
35829# HeaderType; exact type of this header; probably always 0x4000
35830>>&2	uleshort	!0x4000			\b, header type %#x
35831# RecType; type of record like: 80000000h
35832>>&4	ulelong		x			\b, record type %#x
35833# RecSubType; subtype of record like: 0
35834>>&8	ulelong		!0			\b, subtype %#x
35835# RecSize; Size of one record like: 5Ch
35836>>&12	ulelong		x			\b, RecSize %#x
35837# RecNb; Number of records like: 1
35838>>&16	ulelong		>1			\b, %#x records
35839# Timestamp Utc
35840#>>&20	ulelong		x			\b, RAW TIME %#8.8x
35841>>&20	date		x			\b, Time-stamp %s
35842
35843#------------------------------------------------------------------------------
35844# $File: softquad,v 1.13 2009/09/19 16:28:12 christos Exp $
35845# softquad:  file(1) magic for SoftQuad Publishing Software
35846#
35847# Author/Editor and RulesBuilder
35848#
35849# XXX - byte order?
35850#
358510	string		\<!SQ\ DTD>	Compiled SGML rules file
35852>9	string		>\0		 Type %s
358530	string		\<!SQ\ A/E>	A/E SGML Document binary
35854>9	string		>\0		 Type %s
358550	string		\<!SQ\ STS>	A/E SGML binary styles file
35856>9	string		>\0		 Type %s
358570	short		0xc0de		Compiled PSI (v1) data
358580	short		0xc0da		Compiled PSI (v2) data
35859>3	string		>\0		(%s)
35860# Binary sqtroff font/desc files...
358610	short		0125252		SoftQuad DESC or font file binary
35862>2	short		>0		- version %d
35863# Bitmaps...
358640	search/1	SQ\ BITMAP1	SoftQuad Raster Format text
35865#0	string		SQ\ BITMAP2	SoftQuad Raster Format data
35866# sqtroff intermediate language (replacement for ditroff int. lang.)
358670	string		X\ 		SoftQuad troff Context intermediate
35868>2	string		495		for AT&T 495 laser printer
35869>2	string		hp		for Hewlett-Packard LaserJet
35870>2	string		impr		for IMAGEN imPRESS
35871>2	string		ps		for PostScript
35872
35873# From: Michael Piefel <piefel@debian.org>
35874# sqtroff intermediate language (replacement for ditroff int. lang.)
358750	string		X\ 495		SoftQuad troff Context intermediate for AT&T 495 laser printer
358760	string		X\ hp		SoftQuad troff Context intermediate for HP LaserJet
358770	string		X\ impr		SoftQuad troff Context intermediate for IMAGEN imPRESS
358780	string		X\ ps		SoftQuad troff Context intermediate for PostScript
35879
35880#------------------------------------------------------------------------------
35881# $File: sosi,v 1.2 2021/02/23 00:51:10 christos Exp $
35882# SOSI
35883# Summary: Systematic Organization of Spatial Information
35884# Long description: Norwegian text based map format
35885# File extension: .sos
35886# Full name:    Petter Reinholdtsen (pere@hungry.com)
35887# Reference: https://en.wikipedia.org/wiki/SOSI
35888#
35889# Example SOSI files available from
35890# https://trac.osgeo.org/gdal/ticket/3638
35891# https://nedlasting.geonorge.no/geonorge/Basisdata/N50Kartdata/SOSI/
35892# https://nedlasting.geonorge.no/geonorge/Samferdsel/Elveg/SOSI/
35893#
35894# Start with optional comments (from "!" to the next line end)
35895# followed by ".HODE" and end with "\n.SLUTT" followed by an optional
35896# separator (any number of " ", "\t", "\n" or "\r"), might have BOM at
35897# the start and following ".HODE" near the start there is "..OMR=C3=85DE"
35898# (either UTF-8, ISO-8859-1 or some 7 bit Norwegian charset based on
35899# ASCII) , "..TRANSPAR", "..TEGNSETT " followed by the charset and a
35900# separator, as well as "..SOSI-VERSJON " followed by the format
35901# version and a separator.
35902#
35903# FIXME figure out how to accept any of [space], [tab], [newline] and
35904# [carriage return] as separators, not only line end.
35905
35906# Not searching for full "OMR=C3=85DE" to match also for non-UTF-8
35907# character sets
359080	search	..OMR
35909>0	search	..TRANSPAR
35910>>0       search  .HODE           SOSI map data
35911>>>&0      search  ..SOSI-VERSJON
35912>>>>&1	string	x		\b, version %s
35913# FIXME could not figure out way to make a match for .SLUTT at the end required
35914#>-7      string  \n.SLUTT	slutt
35915#>-8      string  \n.SLUTT\n	slutt-nl
35916#>-9      string  \n.SLUTT\r\n	slutt-crnl2
35917!:mime text/vnd.sosi
35918!:ext sos
35919
35920#------------------------------------------------------------------------------
35921# $File: spec,v 1.4 2009/09/19 16:28:12 christos Exp $
35922# spec:  file(1) magic for SPEC raw results (*.raw, *.rsf)
35923#
35924# Cloyce D. Spradling <cloyce@headgear.org>
35925
359260	string	spec			SPEC
35927>4	string	.cpu			CPU
35928>>8	string	<:			\b%.4s
35929>>12	string	.			raw result text
35930
3593117	string	version=SPECjbb		SPECjbb
35932>32	string	<:			\b%.4s
35933>>37	string	<:			v%.4s raw result text
35934
359350	string	BEGIN\040SPECWEB	SPECweb
35936>13	string	<:			\b%.2s
35937>>15	string	_SSL			\b_SSL
35938>>>20	string	<:			v%.4s raw result text
35939>>16	string	<:			v%.4s raw result text
35940
35941#------------------------------------------------------------------------------
35942# $File: spectrum,v 1.9 2021/04/26 15:56:00 christos Exp $
35943# spectrum:  file(1) magic for Spectrum emulator files.
35944#
35945# John Elliott <jce@seasip.demon.co.uk>
35946
35947#
35948# Spectrum +3DOS header
35949#
359500       string          PLUS3DOS\032    Spectrum +3 data
35951>15     byte            0               - BASIC program
35952>15     byte            1               - number array
35953>15     byte            2               - character array
35954>15     byte            3               - memory block
35955>>16    belong          0x001B0040      (screen)
35956>15     byte            4               - Tasword document
35957>15     string          TAPEFILE        - ZXT tapefile
35958#
35959# Tape file. This assumes the .TAP starts with a Spectrum-format header,
35960# which nearly all will.
35961#
35962# Update: Sanity-check string contents to be printable.
35963#  -Adam Buchbinder <adam.buchbinder@gmail.com>
35964#
359650       string          \023\000\000
35966>4      string          >\0
35967>>4     string          <\177           Spectrum .TAP data "%-10.10s"
35968>>>3    byte            0               - BASIC program
35969>>>3    byte            1               - number array
35970>>>3    byte            2               - character array
35971>>>3    byte            3               - memory block
35972>>>>14  belong          0x001B0040      (screen)
35973
35974# The following three blocks are from pak21-spectrum@srcf.ucam.org
35975# TZX tape images
359760      string          ZXTape!\x1a     Spectrum .TZX data
35977>8     byte            x               version %d
35978>9     byte            x               \b.%d
35979
35980# RZX input recording files
359810      string          RZX!            Spectrum .RZX data
35982>4     byte            x               version %d
35983>5     byte            x               \b.%d
35984
35985# Floppy disk images
359860      string          MV\ -\ CPCEMU\ Disk-Fil Amstrad/Spectrum .DSK data
359870      string          MV\ -\ CPC\ format\ Dis Amstrad/Spectrum DU54 .DSK data
359880      string          EXTENDED\ CPC\ DSK\ Fil Amstrad/Spectrum Extended .DSK data
359890      string          SINCLAIR        Spectrum .SCL Betadisk image
35990
35991# Hard disk images
359920      string          RS-IDE\x1a      Spectrum .HDF hard disk image
35993>7     byte            x               \b, version %#02x
35994
35995# SZX snapshots (fuse and spectaculator)
35996# Martin M. S. Pedersen <martin@linux.com>
35997# http://www.spectaculator.com/docs/zx-state/header.shtml
35998#
359990      string		ZXST	       zx-state snapshot
36000>4     byte		x	       version %d
36001>5     byte		x	       \b.%d
36002>>6    byte		0	       16k ZX Spectrum
36003>>6    byte		1	       48k ZX Spectrum/ZX Spectrum+
36004>>6    byte		2	       ZX Spectrum 128
36005>>6    byte		3	       ZX Spectrum +2
36006>>6    byte		4	       ZX Spectrum +2A/+2B
36007>>6    byte		5	       ZX Spectrum +3
36008>>6    byte		6	       ZX Spectrum +3e
36009>>6    byte		7	       Pentagon 128
36010>>6    byte		8	       Timex Sinclair TC2048
36011>>6    byte		9	       Timex Sinclair TC2068
36012>>6    byte	       10	       Scorpion ZS-256
36013>>6    byte	       11	       ZX Spectrum SE
36014>>6    byte	       12	       Timex Sinclair TS2068
36015>>6    byte	       13	       Pentagon 512
36016>>6    byte	       14	       Pentagon 1024
36017>>6    byte	       15	       48k ZX Spectrum (NTSC)
36018>>6    byte	       16	       ZX Spectrum 12Ke
36019>>>7   byte		1	       (alternate timings)
36020
36021#------------------------------------------------------------------------------
36022# $File: sql,v 1.24 2022/07/17 15:32:48 christos Exp $
36023# sql:  file(1) magic for SQL files
36024#
36025# From: "Marty Leisner" <mleisner@eng.mc.xerox.com>
36026# Recognize some MySQL files.
36027# Elan Ruusamae <glen@delfi.ee>, added MariaDB signatures
36028# from https://bazaar.launchpad.net/~maria-captains/maria/5.5/view/head:/support-files/magic
36029#
360300	beshort			0xfe01		MySQL table definition file
36031>2	byte			x		Version %d
36032>3	byte			0		\b, type UNKNOWN
36033>3	byte			1		\b, type DIAM_ISAM
36034>3	byte			2		\b, type HASH
36035>3	byte			3		\b, type MISAM
36036>3	byte			4		\b, type PISAM
36037>3	byte			5		\b, type RMS_ISAM
36038>3	byte			6		\b, type HEAP
36039>3	byte			7		\b, type ISAM
36040>3	byte			8		\b, type MRG_ISAM
36041>3	byte			9		\b, type MYISAM
36042>3	byte			10		\b, type MRG_MYISAM
36043>3	byte			11		\b, type BERKELEY_DB
36044>3	byte			12		\b, type INNODB
36045>3	byte			13		\b, type GEMINI
36046>3	byte			14		\b, type NDBCLUSTER
36047>3	byte			15		\b, type EXAMPLE_DB
36048>3	byte			16		\b, type CSV_DB
36049>3	byte			17		\b, type FEDERATED_DB
36050>3	byte			18		\b, type BLACKHOLE_DB
36051>3	byte			19		\b, type PARTITION_DB
36052>3	byte			20		\b, type BINLOG
36053>3	byte			21		\b, type SOLID
36054>3	byte			22		\b, type PBXT
36055>3	byte			23		\b, type TABLE_FUNCTION
36056>3	byte			24		\b, type MEMCACHE
36057>3	byte			25		\b, type FALCON
36058>3	byte			26		\b, type MARIA
36059>3	byte			27		\b, type PERFORMANCE_SCHEMA
36060>3	byte			127		\b, type DEFAULT
36061>0x0033	ulong			x		\b, MySQL version %d
360620	belong&0xffffff00	0xfefe0500	MySQL ISAM index file
36063>3	byte			x		Version %d
360640	belong&0xffffff00	0xfefe0600	MySQL ISAM compressed data file
36065>3	byte			x		Version %d
360660	belong&0xffffff00	0xfefe0700	MySQL MyISAM index file
36067>3	byte			x		Version %d
36068>14	beshort			x		\b, %d key parts
36069>16	beshort			x		\b, %d unique key parts
36070>18	byte			x		\b, %d keys
36071>28	bequad			x		\b, %lld records
36072>36	bequad			x		\b, %lld deleted records
360730	belong&0xffffff00	0xfefe0800	MySQL MyISAM compressed data file
36074>3	byte			x		Version %d
360750	belong&0xffffff00	0xfefe0900	MySQL Maria index file
36076>3	byte			x		Version %d
360770	belong&0xffffff00	0xfefe0a00	MySQL Maria compressed data file
36078>3	byte			x		Version %d
360790	belong&0xffffff00	0xfefe0c00
36080>4	string			MACF		MySQL Maria control file
36081>>3	byte			x		Version %d
360820	string			\376bin	MySQL replication log,
36083>9	long			x		server id %d
36084>8	byte			1
36085>>13	long			69		\b, MySQL V3.2.3
36086>>>19	string			x		\b, server version %s
36087>>13	long			75		\b, MySQL V4.0.2-V4.1
36088>>>25	string			x		\b, server version %s
36089>8	byte			15		MySQL V5+,
36090>>25	string			x		server version %s
36091>4	string			MARIALOG	MySQL Maria transaction log file
36092>>3	byte			x		Version %d
36093
36094#------------------------------------------------------------------------------
36095# iRiver H Series database file
36096# From Ken Guest <ken@linux.ie>
36097# As observed from iRivNavi.iDB and unencoded firmware
36098#
360990   string		iRivDB	iRiver Database file
36100>11  string	>\0	Version %s
36101>39  string		iHP-100	[H Series]
36102
36103#------------------------------------------------------------------------------
36104# SQLite database files
36105# Ken Guest <ken@linux.ie>, Ty Sarna, Zack Weinberg
36106#
36107# Version 1 used GDBM internally; its files cannot be distinguished
36108# from other GDBM files.
36109#
36110# Version 2 used this format:
361110	string	**\ This\ file\ contains\ an\ SQLite  SQLite 2.x database
36112
36113# URL:		https://en.wikipedia.org/wiki/SQLite
36114# Reference:	https://www.sqlite.org/fileformat.html
36115# Update:	Joerg Jenderek
36116# Version 3 of SQLite allows applications to embed their own "user version"
36117# number in the database at offset 60.  Later, SQLite added an "application id"
36118# at offset 68 that is preferred over "user version" for indicating the
36119# associated application.
36120#
361210   string  SQLite\ format\ 3
36122# skip DROID fmt-729-signature-id-1053.sqlite by checking for valid page size
36123>16 ubeshort >0                 SQLite 3.x
36124# deprecated
36125#!:mime	application/x-sqlite3
36126!:mime	application/vnd.sqlite3
36127# seldom found extension sqlite3 like in SyncData.sqlite3
36128# db
36129# db3 like: AddrBook.db3 cgipcrvp.db3
36130# https://www.maplesoft.com/support/help/Maple/view.aspx?path=worksheet%2freference%2fhelpdatabase
36131# help is used for newer Maple help database
36132# SQLite database weewx.sdb used by weather software weewx
36133# https://www.weewx.com/docs/usersguide.htm
36134# Avira Antivir use extension "dbe" like in avevtdb.dbe, avguard_tchk.dbe
36135# Unfortunately extension sqlite also used for other databases starting with string
36136# "TTCONTAINER" like in tracks.sqlite contentconsumer.sqlite contentproducerrepository.sqlite
36137# and with string "ZV-zlib" in like extra.sqlite
36138>>68 belong !0x5CDE09EF	database
36139!:ext sqlite/sqlite3/db/db3/dbe/sdb/help
36140>>68 belong =0x5CDE09EF  database
36141# maple is used for Maple Workbook
36142!:ext maple
36143>>60 belong =0x5f4d544e  (Monotone source repository)
36144# if no known user version then check for Application IDs with default clause
36145>>60 belong !0x5f4d544e
36146# The "Application ID" set by PRAGMA application_id
36147>>>68 belong =0x0f055112 (Fossil checkout)
36148>>>68 belong =0x0f055113 (Fossil global configuration)
36149>>>68 belong =0x0f055111 (Fossil repository)
36150>>>68 belong =0x42654462 (Bentley Systems BeSQLite Database)
36151>>>68 belong =0x42654c6e (Bentley Systems Localization File)
36152>>>68 belong =0x47504b47 (OGC GeoPackage file)
36153#	https://www.sqlite.org/src/artifact?ci=trunk&filename=magic.txt
36154>>>68 belong =0x47503130 (OGC GeoPackage version 1.0 file)
36155>>>68 belong =0x45737269 (Esri Spatially-Enabled Database)
36156>>>68 belong =0x4d504258 (MBTiles tileset)
36157#	https://www.maplesoft.com/support/help/errors/view.aspx?path=Formats/Maple
36158>>>68 belong =0x5CDE09EF (Maple Workbook)
36159# unknown application ID
36160>>>68 default x
36161>>>>68 belong !0         \b, application id %u
36162# The "user version" as read and set by the user_version pragma like:
36163# 1 2 4 5 7 9 10 25 36 43 53 400 416 131073 131074 131075
36164>>60 belong !0          \b, user version %d
36165# SQLITE_VERSION_NUMBER like: 0 3008011 3016002 3007014 3017000 3022000 3028000 3031001
36166>>96 belong  x           \b, last written using SQLite version %d
36167# database page size in bytes; a power of two between 512 and 32768, or 1 for 65536
36168# like: 512 1024 often 4096 32768
36169>>16 ubeshort !4096      \b, page size %u
36170# File format write version. 1 for legacy; 2 for WAL; 0 for corruptDB.sqlite
36171>>18 ubyte   !1          \b, writer version %u
36172# File format read version. 1 for legacy; 2 for WAL; 4 for corruptDB.sqlite
36173>>19 ubyte   !1          \b, read version %u
36174# Bytes of unused "reserved" space at the end of each page. Usually 0
36175>>20 ubyte   !0          \b, unused bytes %u
36176# maximum embedded payload fraction. Must be 64; 1 for corruptDB.sqlite
36177>>21 ubyte   !64         \b, maximum payload %u
36178# Minimum embedded payload fraction. Must be 32; 1 for corruptDB.sqlite
36179>>22 ubyte   !32         \b, minimum payload %u
36180# Leaf payload fraction. Must be 32; 0 for corruptDB.sqlite
36181>>23 ubyte   !32         \b, leaf payload %u
36182# file change counter
36183>>24 ubelong x           \b, file counter %u
36184# Size of the database file in pages
36185>>28 ubelong x           \b, database pages %u
36186# page number of the first freelist trunk page like: 0 2 3 4 5 9
36187# 10 13 14 15 16 17 18 19 23 36 39 46 50 136 190 217 307 505 516 561 883 1659
36188>>32 ubelong !0          \b, 1st free page %u
36189# total number of freelist pages
36190>>36 ubelong !0          \b, free pages %u
36191# The schema cookie like: 2 3 4 6 7 9 A D E F 13 14 1C 25 2A 2F 33 44 4B 53 5A 5F 62 86 87 8F 91 A8
36192>>40 ubelong x           \b, cookie %#x
36193# the schema format number. Supported formats are 1 2 3 and often 4
36194# 3328 for corruptDB.sqlite and 0 for 512 byte storage.sqlite (TorBrowser Firefox Thunderbird)
36195>>44 ubelong x           \b, schema %u
36196# Suggested cache size  like: 0 2000
36197>>48 ubelong !0          \b, cache page size %u
36198# The page number of the largest root b-tree page when in auto-vacuum or incremental-vacuum modes, or zero otherwise.
36199>>52 ubelong !0          \b, largest root page %u
36200# The database text encoding; a value of 1 means UTF-8; 2 means UTF-16le; 3 means UTF-16be
36201#>>56 ubelong x           \b, encoding %u
36202>>56 ubelong x
36203>>>56 ubelong =1         \b, UTF-8
36204>>>56 ubelong =2         \b, UTF-16 little endian
36205>>>56 ubelong =3         \b, UTF-16 big endian
36206# 0 for corruptDB.sqlite and for storage.sqlite with database pages 1 (TorBrowser Firefox Thunderbird)
36207# https://mozilla.github.io/firefox-browser-architecture/text/0010-firefox-data-stores.html
36208>>>56 default x
36209>>>>56 ubelong x         \b, unknown %#x encoding
36210# True (non-zero) for incremental-vacuum mode; false (zero) otherwiseqy
36211>>64 ubelong !0           \b, vacuum mode %u
36212# Reserved for expansion. Must be zero
36213>>72 uquad !0             \b, reserved %#llx
36214# The version-valid-for number like:
36215# 1 2 3 4 C F 68h 95h 266h A99h 3DCDh B7CEh
36216>>92 ubelong x            \b, version-valid-for %u
36217
36218# SQLite Write-Ahead Log from SQLite version >= 3.7.0
36219# https://www.sqlite.org/fileformat.html#walformat
362200	belong&0xfffffffe	0x377f0682	SQLite Write-Ahead Log,
36221!:ext sqlite-wal/db-wal
36222>4	belong	x	version %d
36223
36224# SQLite Rollback Journal
36225# https://www.sqlite.org/fileformat.html#rollbackjournal
362260	string	\xd9\xd5\x05\xf9\x20\xa1\x63\xd7	SQLite Rollback Journal
36227
36228# Panasonic channel list database svl.bin or svl.db added by Joerg Jenderek
36229# https://github.com/PredatH0r/ChanSort
362300	string		PSDB\0			Panasonic channel list DataBase
36231!:ext db/bin
36232#!:mime	application/x-db-svl-panasonic
36233>126	string		SQLite\ format\ 3
36234#!:mime	application/x-panasonic-sqlite3
36235>>&-15	indirect	x			\b; contains
36236
36237# H2 Database from https://www.h2database.com/
362380	string		--\ H2\ 0.5/B\ --\ \n	H2 Database file
36239
36240# DuckDB database file from https://duckdb.org
362418	string	DUCK    DuckDB database file
36242>12	lequad	x	\b, version %lld
36243#>20	lequad	x	\b, flags %#llx
36244#>28	lequad	x	\b, flags %#llx
36245# Type:	OpenSSH key files
36246# From:	Nicolas Collignon <tsointsoin@gmail.com>
36247
362480	string	SSH\ PRIVATE\ KEY	OpenSSH RSA1 private key,
36249>28	string	>\0			version %s
362500	string	-----BEGIN\ OPENSSH\ PRIVATE\ KEY-----	OpenSSH private key
36251
362520	string	ssh-dss\ 		OpenSSH DSA public key
362530	string	ssh-rsa\ 		OpenSSH RSA public key
362540	string	ecdsa-sha2-nistp256	OpenSSH ECDSA public key
362550	string	ecdsa-sha2-nistp384	OpenSSH ECDSA public key
362560	string	ecdsa-sha2-nistp521	OpenSSH ECDSA public key
362570	string	ssh-ed25519		OpenSSH ED25519 public key
36258
362590	string	SSHKRL\n\0
36260>8	ubelong	1		OpenSSH key/certificate revocation list, format %u
36261>>12	ubequad	x		\b, version %llx
36262>>>20	beqdate	x		\b, generated %s
36263
36264# From:		Joerg Jenderek
36265# URL:		https://en.wikipedia.org/wiki/PuTTY
36266# Reference:	https://the.earth.li/~sgtatham/putty/latest/putty-0.73.tar.gz
36267#		/sshpubk.c
362680	string		PuTTY-User-Key-File-	PuTTY Private Key File
36269#!:mime	text/plain
36270# https://github.com/github/putty/blob/master/windows/installer.wxs
36271!:mime	application/x-putty-private-key
36272!:ext	ppk
36273# version 1 or 2
36274>20	string		x			\b, version %.1s
36275# name of the algorithm like: ssh-dss ssh-rsa ecdsa-sha2-nistp256 ssh-ed25519
36276>23	string		x			\b, algorithm %s
36277# next line says "Encryption: " plus an encryption type like aes256-cbc or none
36278>32	search/13	Encryption:\040		\b, Encryption
36279>>&0	string		x			%s
36280# next line says "Comment: " plus the comment string
36281>>>&0	search/3	Comment:\040
36282>>>>&0	string		x			"%s"
36283
36284
36285#------------------------------------------------------------------------------
36286# $File: ssl,v 1.5 2017/12/29 04:00:07 christos Exp $
36287# ssl:  file(1) magic for SSL file formats
36288
36289# Type: OpenSSL certificates/key files
36290# From: Nicolas Collignon <tsointsoin@gmail.com>
36291
362920	string	-----BEGIN\040CERTIFICATE-----	PEM certificate
362930	string	-----BEGIN\040CERTIFICATE\040REQ	PEM certificate request
362940	string	-----BEGIN\040RSA\040PRIVATE	PEM RSA private key
362950	string	-----BEGIN\040DSA\040PRIVATE	PEM DSA private key
362960	string	-----BEGIN\040EC\040PRIVATE	PEM EC private key
362970	string	-----BEGIN\040ECDSA\040PRIVATE	PEM ECDSA private key
36298
36299# From Luc Gommans
36300# OpenSSL enc file (recognized by a magic string preceding the password's salt)
363010	string	Salted__	openssl enc'd data with salted password
36302# Using the -a or -base64 option, OpenSSL will base64-encode the data.
363030	string U2FsdGVkX1	openssl enc'd data with salted password, base64 encoded
36304
36305#------------------------------------------------------------------------------
36306# $File: statistics,v 1.3 2022/03/24 15:48:58 christos Exp $
36307# statistics:  file(1) magic for statistics related software
36308#
36309
36310# From Remy Rampin
36311
36312# Stata is a statistical software tool that was created in 1985. While I
36313# don't personally use it, data files in its native (proprietary) format
36314# are common (.dta files).
36315#
36316# Because they are so common, especially in statistical and social
36317# sciences, Stata files and SPSS files can be opened by a lot of modern
36318# software, for example Python's pandas package provides built-in
36319# support for them (read_stata() and read_spss()).
36320#
36321# I noticed that the magic database includes an entry for SPSS files but
36322# not Stata files. Stata files for Stata 13 and newer (formats 117, 118,
36323# and 119) always begin with the string "<stata_dta><header>" as per
36324# https://www.stata.com/help.cgi?dta#definition
36325#
36326# The format version number always follows, for example:
36327#    <stata_dta><header><release>117</release>
36328#    <stata_dta><header><release>118</release>
36329#
36330# Therefore the following line would do the trick:
36331#    0       string  <stata_dta><header>     Stata Data File
36332#
36333# (I'm sure the version number could be captured as well but I did not
36334# manage this without a regex)
36335#
36336# Unfortunately the previous formats (created by Stata before 13, which
36337# was released 2013) are harder to recognize. Format 115 starts with the
36338# four bytes 0x73010100 or 0x73020100, format 114 with 0x72010100 or
36339# 0x72020100, format 113 with 0x71010101 or 0x71020101.
36340#
36341# For additional reference, the Library of Congress website has an entry
36342# for the Stata Data File Format 118:
36343# https://www.loc.gov/preservation/digital/formats/fdd/fdd000471.shtml
36344#
36345# Example of those files can be found on Zenodo:
36346# https://zenodo.org/search?page=1&size=20&q=&file_type=dta
363470	string	\<stata_dta\>\<header\>\<release\>	Stata Data File
36348>&0	regex	[0-9]+					(Release %s)
36349
36350#------------------------------------------------------------------------------
36351# $File: subtitle,v 1.2 2022/09/07 11:29:09 christos Exp $
36352# subtitle:  file(1) magic for subtitles files
36353
36354# EBU-STL
36355# https://tech.ebu.ch/docs/tech/tech3264.pdf
363563	string	STL		EBU-STL subtitles
36357>6	regex	=^[0-9][0-9]	\b, rate %s
36358>>8	string	.01		\b, v1
36359!:mime	application/x-ebu-stl
36360>>>16	regex	=^[^\ ]{0,32}	\b, title "%s"
36361>>>>224 regex	=^[0-9]{2}	\b, created %-.2s
36362>>>>>&0 regex	=^[0-9]{2}	\b-%-.2s
36363>>>>>>&0 regex	=^[0-9]{2}	\b-%-.2s
36364!:ext	stl
36365
36366# SubRip (srt) subtitles
363670	regex/20	=^1[\r\n]+0[01]:[0-9]{2}:[0-9]{2},[0-9]{3}\040-->	 SubRip
36368!:mime	application/x-subrip
36369!:ext	srt
36370
36371# WebVTT subtitles
36372# https://www.w3.org/TR/webvtt1/
363730	string/t	WEBVTT
36374>&0	regex/255	=[0-9]{2}:[0-9]{2}\\.[0-9]{3}\040-->	WebVTT subtitles
36375!:mime	text/vtt
36376!:ext	vtt
36377
36378# XML TTML subtitles
36379# https://www.w3.org/TR/ttml2/
363800	string/t	\<?xml
36381>20	search/400	\020xmlns=
36382>>&0 regex ['"]http://www.w3.org/ns/ttml    TTML subtitles
36383!:mime	application/ttml+xml
36384# Augment strength to beat plain XML
36385!:strength * 3
36386!:ext	ttml
36387
36388#------------------------------------------------------------------------------
36389# $File: sun,v 1.28 2019/04/19 00:42:27 christos Exp $
36390# sun:  file(1) magic for Sun machines
36391#
36392# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x
36393# releases.  (5.x uses ELF.)  Entries for executables without an
36394# architecture type, used before the 68020-based Sun-3's came out,
36395# are in aout, as they're indistinguishable from other big-endian
36396# 32-bit a.out files.
36397#
363980	belong&077777777	0600413		a.out SunOS SPARC demand paged
36399>0	byte		&0x80
36400>>20	belong		<4096		shared library
36401>>20	belong		=4096		dynamically linked executable
36402>>20	belong		>4096		dynamically linked executable
36403>0	byte		^0x80		executable
36404>16	belong		>0		not stripped
36405
364060	belong&077777777	0600410		a.out SunOS SPARC pure
36407>0	byte		&0x80		dynamically linked executable
36408>0	byte		^0x80		executable
36409>16	belong		>0		not stripped
36410
364110	belong&077777777	0600407		a.out SunOS SPARC
36412>0	byte		&0x80		dynamically linked executable
36413>0	byte		^0x80		executable
36414>16	belong		>0		not stripped
36415
364160	belong&077777777	0400413		a.out SunOS mc68020 demand paged
36417>0	byte		&0x80
36418>>20	belong		<4096		shared library
36419>>20	belong		=4096		dynamically linked executable
36420>>20	belong		>4096		dynamically linked executable
36421>0	byte		^0x80		executable
36422>16	belong		>0		not stripped
36423
364240	belong&077777777	0400410		a.out SunOS mc68020 pure
36425>0	byte		&0x80		dynamically linked executable
36426>0	byte		^0x80		executable
36427>16	belong		>0		not stripped
36428
364290	belong&077777777	0400407		a.out SunOS mc68020
36430>0	byte		&0x80		dynamically linked executable
36431>0	byte		^0x80		executable
36432>16	belong		>0		not stripped
36433
364340	belong&077777777	0200413		a.out SunOS mc68010 demand paged
36435>0	byte		&0x80
36436>>20	belong		<4096		shared library
36437>>20	belong		=4096		dynamically linked executable
36438>>20	belong		>4096		dynamically linked executable
36439>0	byte		^0x80		executable
36440>16	belong		>0		not stripped
36441
364420	belong&077777777	0200410		a.out SunOS mc68010 pure
36443>0	byte		&0x80		dynamically linked executable
36444>0	byte		^0x80		executable
36445>16	belong		>0		not stripped
36446
364470	belong&077777777	0200407		a.out SunOS mc68010
36448>0	byte		&0x80		dynamically linked executable
36449>0	byte		^0x80		executable
36450>16	belong		>0		not stripped
36451
36452#
36453# Core files.  "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC
36454# binary executed in compatibility mode under SunOS 5.x".
36455#
364560	belong		0x080456	SunOS core file
36457>4	belong		432		(SPARC)
36458>>132	string		>\0		from '%s'
36459>>116	belong		=3		(quit)
36460>>116	belong		=4		(illegal instruction)
36461>>116	belong		=5		(trace trap)
36462>>116	belong		=6		(abort)
36463>>116	belong		=7		(emulator trap)
36464>>116	belong		=8		(arithmetic exception)
36465>>116	belong		=9		(kill)
36466>>116	belong		=10		(bus error)
36467>>116	belong		=11		(segmentation violation)
36468>>116	belong		=12		(bad argument to system call)
36469>>116	belong		=29		(resource lost)
36470>>120	belong		x		(T=%dK,
36471>>124	belong		x		D=%dK,
36472>>128	belong		x		S=%dK)
36473>4	belong		826		(68K)
36474>>128	string		>\0		from '%s'
36475>4	belong		456		(SPARC 4.x BCP)
36476>>152	string		>\0		from '%s'
36477# Sun SunPC
364780	long		0xfa33c08e	SunPC 4.0 Hard Disk
364790	string		#SUNPC_CONFIG	SunPC 4.0 Properties Values
36480# Sun snoop (see RFC 1761, which describes the capture file format,
36481# RFC 3827, which describes some additional datalink types, and
36482# https://www.iana.org/assignments/snoop-datalink-types/snoop-datalink-types.xml,
36483# which is the IANA registry of Snoop datalink types)
36484#
364850	string		snoop		Snoop capture file
36486>8	belong		>0		- version %d
36487>12	belong		0		(IEEE 802.3)
36488>12	belong		1		(IEEE 802.4)
36489>12	belong		2		(IEEE 802.5)
36490>12	belong		3		(IEEE 802.6)
36491>12	belong		4		(Ethernet)
36492>12	belong		5		(HDLC)
36493>12	belong		6		(Character synchronous)
36494>12	belong		7		(IBM channel-to-channel adapter)
36495>12	belong		8		(FDDI)
36496>12	belong		9		(Other)
36497>12	belong		10		(type %d)
36498>12	belong		11		(type %d)
36499>12	belong		12		(type %d)
36500>12	belong		13		(type %d)
36501>12	belong		14		(type %d)
36502>12	belong		15		(type %d)
36503>12	belong		16		(Fibre Channel)
36504>12	belong		17		(ATM)
36505>12	belong		18		(ATM Classical IP)
36506>12	belong		19		(type %d)
36507>12	belong		20		(type %d)
36508>12	belong		21		(type %d)
36509>12	belong		22		(type %d)
36510>12	belong		23		(type %d)
36511>12	belong		24		(type %d)
36512>12	belong		25		(type %d)
36513>12	belong		26		(IP over Infiniband)
36514>12	belong		>26		(type %d)
36515
36516#---------------------------------------------------------------------------
36517# The following entries have been tested by Duncan Laurie <duncan@sun.com> (a
36518# lead Sun/Cobalt developer) who agrees that they are good and worthy of
36519# inclusion.
36520
36521# Boot ROM images for Sun/Cobalt Linux server appliances
365220       string  Cobalt\ Networks\ Inc.\nFirmware\ v     Paged COBALT boot rom
36523>38     string x        V%.4s
36524
36525# New format for Sun/Cobalt boot ROMs is annoying, it stores the version code
36526# at the very end where file(1) can't get it.
365270       string CRfs     COBALT boot rom data (Flat boot rom or file system)
36528
36529#------------------------------------------------------------------------------
36530# $File: sylk,v 1.1 2020/04/05 22:18:34 christos Exp $
36531# sylk:  file(1) magic for SYLK text files
36532
36533# From:	Joerg Jenderek
36534# URL:	https://en.wikipedia.org/wiki/SYmbolic_LinK_%28SYLK%29
36535#	http://fileformats.archiveteam.org/wiki/SYLK
36536# Note:	called by TrID "SYLK - SYmbolic LinK data",
36537#	by DROID "Microsoft Symbolic Link (SYLK) File"
36538#	by FreeDesktop.org "spreadsheet interchange document"
365390	string		ID;P
36540# skip short DROID x-fmt-106-signature-id-603.slk
36541>7	ubyte		>0		spreadsheet interchange document
36542# https://reposcope.com/mimetype/text/spreadsheet
36543#!:mime	text/spreadsheet
36544# https://reposcope.com/mimetype/application/x-sylk	by Gnumeric
36545!:mime	application/x-sylk
36546!:ext	slk/sylk
36547>>4	ubyte		>037		\b, created by
36548# Gnumeric, pmw~PlanMaker, CALCOOO32~LibreOffice OpenOffice, SCALC3~StarOffice
36549# MP~Multiplan, XL~Excel WXL~Excel Windows
36550>>>4	string		Gnumeric	Gnumeric
36551>>>4	string		pmw		PlanMaker
36552>>>4	string		CALCOOO32	Libre/OpenOffice Calc
36553>>>4	string		SCALC3		StarOffice Calc
36554>>>4	string		XL		Excel
36555# Excel, version probably running on Windows
36556>>>4	string		WXL		Excel
36557# not tested
36558>>>4	string		MP		Multiplan
36559# unknown spreadsheet software
36560>>>4	default		x
36561>>>>4	string		x		%s
36562
36563
36564
36565#------------------------------------------------------------------------------
36566# msx:  file(1) magic for the SymbOS operating system
36567# http://www.symbos.de
36568# Fabio R. Schmidlin <frs@pop.com.br>
36569
36570# SymbOS EXE file
365710x30	string		SymExe		SymbOS executable
36572>0x36	ubyte		x		v%c
36573>0x37	ubyte		x		\b.%c
36574>0xF	string		x		\b, name: %s
36575
36576# SymbOS DOX document
365770	string		INFOq\0		SymbOS DOX document
36578
36579# Symbos driver
365800	string		SMD1		SymbOS driver
36581>19	byte		x		\b, name: %c
36582>20	byte		x		\b%c
36583>21	byte		x		\b%c
36584>22	byte		x		\b%c
36585>23	byte		x		\b%c
36586>24	byte		x		\b%c
36587>25	byte		x		\b%c
36588>26	byte		x		\b%c
36589>27	byte		x		\b%c
36590>28	byte		x		\b%c
36591>29	byte		x		\b%c
36592>30	byte		x		\b%c
36593>31	byte		x		\b%c
36594
36595# Symbos video
365960	string		SymVid		SymbOS video
36597>6	ubyte		x		v%c
36598>7	ubyte		x		\b.%c
36599
36600# Soundtrakker 128 ST2 music
366010	byte		0
36602>0xC	string		\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x40\x00	Soundtrakker 128 ST2 music,
36603>>1	string		x		name: %s
36604
36605
36606
36607#------------------------------------------------------------------------
36608# $File: sysex,v 1.11 2022/01/17 17:16:51 christos Exp $
36609# sysex: file(1) magic for MIDI sysex files
36610#
36611# GRR: original 1 byte test at offset was too general as it catches also many FATs of DOS filesystems
36612# where real SYStem EXclusive messages at offset 1 are limited to seven bits
36613# https://en.wikipedia.org/wiki/MIDI
36614# test for StartSysEx byte and upper unsed bit of vendor ID
366150	ubeshort&0xFF80		0xF000
36616# MIDI System Exclusive (SysEx) messages (strength=50) after Microsoft Visual C library (strength=70)
36617#!:strength +0
36618# skip Microsoft Visual C library with page size 16 misidentifed as ADA and
36619# page size 32 misidentifed as Inventronics by looking for terminating End Of eXclusive byte (EOX)
36620>2		search/12	\xF7
36621>>0	use	midi-sysex
36622#	display information about MIDI System Exclusive (SysEx) messages
366230	name		midi-sysex
36624# https://fileinfo.com/extension/syx
36625>1	ubyte			x		MIDI audio System Exclusive (SysEx) message -
36626# Note: file (version 5.41) labeled the above entry as "SysEx File"
36627#!:mime	application/octet-stream
36628!:mime	audio/x-syx
36629# https://onsongapp.com/docs/features/formats/sysex
36630!:ext	syx/sysex
36631# https://www.midi.org/specifications-old/item/manufacturer-id-numbers
36632# https://raw.githubusercontent.com/insolace/MIDI-Sysex-MFG-IDs/master/Sysex%20ID%20Tables/MIDI%20Sysex%20MFG%20IDs.csv
36633# SysEx manufacturer ID; originally one byte, but now 0 is used as an escapement to reach the next two
36634# North American Group
36635#>1	byte			0x01		Sequential
36636>1	byte			0x01		Sequential Circuits
36637>1	byte			0x02		IDP
36638#>1	byte			0x03		OctavePlateau
36639>1	byte			0x03		Voyetra Turtle Beach
36640>1	byte			0x04		Moog
36641#>1	byte			0x05		Passport
36642>1	byte			0x05		Passport Designs
36643#>1	byte			0x06		Lexicon
36644>1	byte			0x06		Lexicon Inc.
36645>1	byte			0x07		Kurzweil/Future Retro
36646>>3	byte			0x77		777
36647>>4	byte			0x00		Bank
36648>>4	byte			0x01		Song
36649>>5	byte			0x0f		16
36650>>5	byte			0x0e		15
36651>>5	byte			0x0d		14
36652>>5	byte			0x0c		13
36653>>5	byte			0x0b		12
36654>>5	byte			0x0a		11
36655>>5	byte			0x09		10
36656>>5	byte			0x08		9
36657>>5	byte			0x07		8
36658>>5	byte			0x06		7
36659>>5	byte			0x05		6
36660>>5	byte			0x04		5
36661>>5	byte			0x03		4
36662>>5	byte			0x02		3
36663>>5	byte			0x01		2
36664>>5	byte			0x00		1
36665>>5	byte			0x10		(ALL)
36666>>2	byte			x			\b, Channel %d
36667>1	byte			0x08		Fender
36668#>1	byte			0x09		Gulbransen
36669>1	byte			0x09		MIDI9
36670#>1	byte			0x0a		AKG
36671>1	byte			0x0a		AKG Acoustics
36672>1	byte			0x0b		Voyce
36673>1	byte			0x0c		Waveframe
36674# not ADA programming language
36675#>1	byte			0x0d		ADA
36676>1	byte			0x0d		ADA Signal Processors Inc.
36677#>1	byte			0x0e		Garfield
36678>1	byte			0x0e		Garfield Electronics
36679>1	byte			0x0f		Ensoniq
36680>1	byte			0x10		Oberheim
36681>>2	byte			0x06		Matrix 6 series
36682>>3	byte			0x0A		Dump (All)
36683>>3	byte			0x01		Dump (Bank)
36684>>4 belong			0x0002040E		Matrix 1000
36685>>>11 byte			<2			User bank %d
36686>>>11 byte			>1			Preset bank %d
36687>1	byte			0x11		Apple
36688>1	byte			0x12		GreyMatter
36689>1	byte			0x14		PalmTree
36690>1	byte			0x15		JLCooper
36691>1	byte			0x16		Lowrey
36692>1	byte			0x17		AdamsSmith
36693>1	byte			0x18		E-mu
36694#>1	byte			0x19		Harmony
36695>1	byte			0x19		Harmony Systems
36696>1	byte			0x1a		ART
36697>1	byte			0x1b		Baldwin
36698>1	byte			0x1c		Eventide
36699>1	byte			0x1d		Inventronics
36700>1	byte			0x1f		Clarity
36701
36702# European Group
36703#>1	byte			0x21		SIEL
36704>1	byte			0x21		Proel Labs (SIEL)
36705>1	byte			0x22		Synthaxe
36706>1	byte			0x24		Hohner
36707>1	byte			0x25		Twister
36708#>1	byte			0x26		Solton
36709>1	byte			0x26		Ketron s.r.l.
36710>1	byte			0x27		Jellinghaus
36711>1	byte			0x28		Southworth
36712>1	byte			0x29		PPG
36713>1	byte			0x2a		JEN
36714#>1	byte			0x2b		SSL
36715>1	byte			0x2b		Solid State Logic Organ Systems
36716#>1	byte			0x2c		AudioVertrieb
36717>1	byte			0x2c		Audio Veritrieb-P. Struven
36718
36719>1	byte			0x2f		ELKA
36720>>3	byte			0x09		EK-44
36721
36722>1	byte			0x30		Dynacord
36723#>1	byte			0x31		Jomox
36724>1	byte			0x31		Viscount International Spa
36725>1	byte			0x33		Clavia
36726>1	byte			0x39		Soundcraft
36727# Some Waldorf info from http://Stromeko.Synth.net/Downloads#WaldorfDocs
36728>1	byte			0x3e		Waldorf
36729>>2	byte			0x00		microWave
36730>>2	byte			0x0E		microwave2 / XT
36731>>2	byte			0x0F		Q / Q+
36732>>3	byte			=0			(default id)
36733>>3 byte			>0			(
36734>>>3 byte			<0x7F		\bdevice %d)
36735>>>3 byte			=0x7F		\bbroadcast id)
36736>>3	byte			0x7f		Microwave I
36737>>>4	byte			0x00		SNDR (Sound Request)
36738>>>4	byte			0x10		SNDD (Sound Dump)
36739>>>4	byte			0x20		SNDP (Sound Parameter Change)
36740>>>4	byte			0x30		SNDQ (Sound Parameter Inquiry)
36741>>>4	byte			0x70		BOOT (Sound Reserved)
36742>>>4	byte			0x01		MULR (Multi Request)
36743>>>4	byte			0x11		MULD (Multi Dump)
36744>>>4	byte			0x21		MULP (Multi Parameter Change)
36745>>>4	byte			0x31		MULQ (Multi Parameter Inquiry)
36746>>>4	byte			0x71		OS (Multi Reserved)
36747>>>4	byte			0x02		DRMR (Drum Map Request)
36748>>>4	byte			0x12		DRMD (Drum Map Dump)
36749>>>4	byte			0x22		DRMP (Drum Map Parameter Change)
36750>>>4	byte			0x32		DRMQ (Drum Map Parameter Inquiry)
36751>>>4	byte			0x72		BIN (Drum Map Reserved)
36752>>>4	byte			0x03		PATR (Sequencer Pattern Request)
36753>>>4	byte			0x13		PATD (Sequencer Pattern Dump)
36754>>>4	byte			0x23		PATP (Sequencer Pattern Parameter Change)
36755>>>4	byte			0x33		PATQ (Sequencer Pattern Parameter Inquiry)
36756>>>4	byte			0x73		AFM (Sequencer Pattern Reserved)
36757>>>4	byte			0x04		GLBR (Global Parameter Request)
36758>>>4	byte			0x14		GLBD (Global Parameter Dump)
36759>>>4	byte			0x24		GLBP (Global Parameter Parameter Change)
36760>>>4	byte			0x34		GLBQ (Global Parameter Parameter Inquiry)
36761>>>4	byte			0x07		MODR (Mode Parameter Request)
36762>>>4	byte			0x17		MODD (Mode Parameter Dump)
36763>>>4	byte			0x27		MODP (Mode Parameter Parameter Change)
36764>>>4	byte			0x37		MODQ (Mode Parameter Parameter Inquiry)
36765>>2	byte			0x10		microQ
36766>>>4	byte			0x00		SNDR (Sound Request)
36767>>>4	byte			0x10		SNDD (Sound Dump)
36768>>>4	byte			0x20		SNDP (Sound Parameter Change)
36769>>>4	byte			0x30		SNDQ (Sound Parameter Inquiry)
36770>>>4	byte			0x70		(Sound Reserved)
36771>>>4	byte			0x01		MULR (Multi Request)
36772>>>4	byte			0x11		MULD (Multi Dump)
36773>>>4	byte			0x21		MULP (Multi Parameter Change)
36774>>>4	byte			0x31		MULQ (Multi Parameter Inquiry)
36775>>>4	byte			0x71		OS (Multi Reserved)
36776>>>4	byte			0x02		DRMR (Drum Map Request)
36777>>>4	byte			0x12		DRMD (Drum Map Dump)
36778>>>4	byte			0x22		DRMP (Drum Map Parameter Change)
36779>>>4	byte			0x32		DRMQ (Drum Map Parameter Inquiry)
36780>>>4	byte			0x72		BIN (Drum Map Reserved)
36781>>>4	byte			0x04		GLBR (Global Parameter Request)
36782>>>4	byte			0x14		GLBD (Global Parameter Dump)
36783>>>4	byte			0x24		GLBP (Global Parameter Parameter Change)
36784>>>4	byte			0x34		GLBQ (Global Parameter Parameter Inquiry)
36785>>2	byte			0x11		rackAttack
36786>>>4	byte			0x00		SNDR (Sound Parameter Request)
36787>>>4	byte			0x10		SNDD (Sound Parameter Dump)
36788>>>4	byte			0x20		SNDP (Sound Parameter Parameter Change)
36789>>>4	byte			0x30		SNDQ (Sound Parameter Parameter Inquiry)
36790>>>4	byte			0x01		PRGR (Program Parameter Request)
36791>>>4	byte			0x11		PRGD (Program Parameter Dump)
36792>>>4	byte			0x21		PRGP (Program Parameter Parameter Change)
36793>>>4	byte			0x31		PRGQ (Program Parameter Parameter Inquiry)
36794>>>4	byte			0x71		OS (Program Parameter Reserved)
36795>>>4	byte			0x03		PATR (Pattern Parameter Request)
36796>>>4	byte			0x13		PATD (Pattern Parameter Dump)
36797>>>4	byte			0x23		PATP (Pattern Parameter Parameter Change)
36798>>>4	byte			0x33		PATQ (Pattern Parameter Parameter Inquiry)
36799>>>4	byte			0x04		GLBR (Global Parameter Request)
36800>>>4	byte			0x14		GLBD (Global Parameter Dump)
36801>>>4	byte			0x24		GLBP (Global Parameter Parameter Change)
36802>>>4	byte			0x34		GLBQ (Global Parameter Parameter Inquiry)
36803>>>4	byte			0x05		EFXR (FX Parameter Request)
36804>>>4	byte			0x15		EFXD (FX Parameter Dump)
36805>>>4	byte			0x25		EFXP (FX Parameter Parameter Change)
36806>>>4	byte			0x35		EFXQ (FX Parameter Parameter Inquiry)
36807>>>4	byte			0x07		MODR (Mode Command Request)
36808>>>4	byte			0x17		MODD (Mode Command Dump)
36809>>>4	byte			0x27		MODP (Mode Command Parameter Change)
36810>>>4	byte			0x37		MODQ (Mode Command Parameter Inquiry)
36811>>2	byte			0x03		Wave
36812>>>4	byte			0x00		SBPR (Soundprogram)
36813>>>4	byte			0x01		SAPR (Performance)
36814>>>4	byte			0x02		SWAVE (Wave)
36815>>>4	byte			0x03		SWTBL (Wave control table)
36816>>>4	byte			0x04		SVT (Velocity Curve)
36817>>>4	byte			0x05		STT (Tuning Table)
36818>>>4	byte			0x06		SGLB (Global Parameters)
36819>>>4	byte			0x07		SARRMAP (Performance Program Change Map)
36820>>>4	byte			0x08		SBPRMAP (Sound Program Change Map)
36821>>>4	byte			0x09		SBPRPAR (Sound Parameter)
36822>>>4	byte			0x0A		SARRPAR (Performance Parameter)
36823>>>4	byte			0x0B		SINSPAR (Instrument/External Parameter)
36824>>>4	byte			0x0F		SBULK (Bulk Switch on/off)
36825
36826# Japanese Group
36827>1	byte			0x40		Kawai
36828>>3	byte			0x20		K1
36829>>3	byte			0x22		K4
36830
36831>1	byte			0x41		Roland
36832>>3	byte			0x14		D-50
36833>>3	byte			0x2b		U-220
36834>>3	byte			0x02		TR-707
36835
36836>1	byte			0x42		Korg
36837>>3	byte			0x19		M1
36838
36839>1	byte			0x43		Yamaha
36840>1	byte			0x44		Casio
36841>1	byte			0x46		Kamiya
36842>1	byte			0x47		Akai
36843#>1	byte			0x48		Victor
36844>1	byte			0x48		Victor Company of Japan. Ltd.
36845>1	byte			0x49		Mesosha
36846>1	byte			0x4b		Fujitsu
36847>1	byte			0x4c		Sony
36848>1	byte			0x4e		Teac
36849>1	byte			0x50		Matsushita
36850>1	byte			0x51		Fostex
36851#>1	byte			0x52		Zoom
36852>1	byte			0x52		Zoom Corporation
36853>1	byte			0x54		Matsushita
36854>1	byte			0x57		Acoustic tech. lab.
36855# https://www.midi.org/techspecs/manid.php
36856>1	belong&0xffffff00	0x00007400	Ta Horng
36857>1	belong&0xffffff00	0x00007500	e-Tek
36858>1	belong&0xffffff00	0x00007600	E-Voice
36859>1	belong&0xffffff00	0x00007700	Midisoft
36860>1	belong&0xffffff00	0x00007800	Q-Sound
36861>1	belong&0xffffff00	0x00007900	Westrex
36862>1	belong&0xffffff00	0x00007a00	Nvidia*
36863>1	belong&0xffffff00	0x00007b00	ESS
36864>1	belong&0xffffff00	0x00007c00	Mediatrix
36865>1	belong&0xffffff00	0x00007d00	Brooktree
36866>1	belong&0xffffff00	0x00007e00	Otari
36867>1	belong&0xffffff00	0x00007f00	Key Electronics
36868>1	belong&0xffffff00	0x00010000	Shure
36869>1	belong&0xffffff00	0x00010100	AuraSound
36870>1	belong&0xffffff00	0x00010200	Crystal
36871>1	belong&0xffffff00	0x00010300	Rockwell
36872>1	belong&0xffffff00	0x00010400	Silicon Graphics
36873>1	belong&0xffffff00	0x00010500	Midiman
36874>1	belong&0xffffff00	0x00010600	PreSonus
36875>1	belong&0xffffff00	0x00010800	Topaz
36876>1	belong&0xffffff00	0x00010900	Cast Lightning
36877>1	belong&0xffffff00	0x00010a00	Microsoft
36878>1	belong&0xffffff00	0x00010b00	Sonic Foundry
36879>1	belong&0xffffff00	0x00010c00	Line 6
36880>1	belong&0xffffff00	0x00010d00	Beatnik Inc.
36881>1	belong&0xffffff00	0x00010e00	Van Koerving
36882>1	belong&0xffffff00	0x00010f00	Altech Systems
36883>1	belong&0xffffff00	0x00011000	S & S Research
36884>1	belong&0xffffff00	0x00011100	VLSI Technology
36885>1	belong&0xffffff00	0x00011200	Chromatic
36886>1	belong&0xffffff00	0x00011300	Sapphire
36887>1	belong&0xffffff00	0x00011400	IDRC
36888>1	belong&0xffffff00	0x00011500	Justonic Tuning
36889>1	belong&0xffffff00	0x00011600	TorComp
36890>1	belong&0xffffff00	0x00011700	Newtek Inc.
36891>1	belong&0xffffff00	0x00011800	Sound Sculpture
36892>1	belong&0xffffff00	0x00011900	Walker Technical
36893>1	belong&0xffffff00	0x00011a00	Digital Harmony
36894>1	belong&0xffffff00	0x00011b00	InVision
36895>1	belong&0xffffff00	0x00011c00	T-Square
36896>1	belong&0xffffff00	0x00011d00	Nemesys
36897>1	belong&0xffffff00	0x00011e00	DBX
36898>1	belong&0xffffff00	0x00011f00	Syndyne
36899>1	belong&0xffffff00	0x00012000	Bitheadz
36900>1	belong&0xffffff00	0x00012100	Cakewalk
36901>1	belong&0xffffff00	0x00012200	Staccato
36902>1	belong&0xffffff00	0x00012300	National Semicon.
36903>1	belong&0xffffff00	0x00012400	Boom Theory
36904>1	belong&0xffffff00	0x00012500	Virtual DSP Corp
36905>1	belong&0xffffff00	0x00012600	Antares
36906>1	belong&0xffffff00	0x00012700	Angel Software
36907>1	belong&0xffffff00	0x00012800	St Louis Music
36908>1	belong&0xffffff00	0x00012900	Lyrrus dba G-VOX
36909>1	belong&0xffffff00	0x00012a00	Ashley Audio
36910>1	belong&0xffffff00	0x00012b00	Vari-Lite
36911>1	belong&0xffffff00	0x00012c00	Summit Audio
36912>1	belong&0xffffff00	0x00012d00	Aureal Semicon.
36913>1	belong&0xffffff00	0x00012e00	SeaSound
36914>1	belong&0xffffff00	0x00012f00	U.S. Robotics
36915>1	belong&0xffffff00	0x00013000	Aurisis
36916>1	belong&0xffffff00	0x00013100	Nearfield Multimedia
36917>1	belong&0xffffff00	0x00013200	FM7 Inc.
36918>1	belong&0xffffff00	0x00013300	Swivel Systems
36919>1	belong&0xffffff00	0x00013400	Hyperactive
36920>1	belong&0xffffff00	0x00013500	MidiLite
36921>1	belong&0xffffff00	0x00013600	Radical
36922>1	belong&0xffffff00	0x00013700	Roger Linn
36923>1	belong&0xffffff00	0x00013800	Helicon
36924>1	belong&0xffffff00	0x00013900	Event
36925>1	belong&0xffffff00	0x00013a00	Sonic Network
36926>1	belong&0xffffff00	0x00013b00	Realtime Music
36927>1	belong&0xffffff00	0x00013c00	Apogee Digital
36928
36929>1	belong&0xffffff00	0x00202b00	Medeli Electronics
36930>1	belong&0xffffff00	0x00202c00	Charlie Lab
36931>1	belong&0xffffff00	0x00202d00	Blue Chip Music
36932>1	belong&0xffffff00	0x00202e00	BEE OH Corp
36933>1	belong&0xffffff00	0x00202f00	LG Semicon America
36934>1	belong&0xffffff00	0x00203000	TESI
36935>1	belong&0xffffff00	0x00203100	EMAGIC
36936>1	belong&0xffffff00	0x00203200	Behringer
36937>1	belong&0xffffff00	0x00203300	Access Music
36938>1	belong&0xffffff00	0x00203400	Synoptic
36939>1	belong&0xffffff00	0x00203500	Hanmesoft Corp
36940>1	belong&0xffffff00	0x00203600	Terratec
36941>1	belong&0xffffff00	0x00203700	Proel SpA
36942>1	belong&0xffffff00	0x00203800	IBK MIDI
36943>1	belong&0xffffff00	0x00203900	IRCAM
36944>1	belong&0xffffff00	0x00203a00	Propellerhead Software
36945>1	belong&0xffffff00	0x00203b00	Red Sound Systems
36946>1	belong&0xffffff00	0x00203c00	Electron ESI AB
36947>1	belong&0xffffff00	0x00203d00	Sintefex Audio
36948>1	belong&0xffffff00	0x00203e00	Music and More
36949>1	belong&0xffffff00	0x00203f00	Amsaro
36950>1	belong&0xffffff00	0x00204000	CDS Advanced Technology
36951>1	belong&0xffffff00	0x00204100	Touched by Sound
36952>1	belong&0xffffff00	0x00204200	DSP Arts
36953>1	belong&0xffffff00	0x00204300	Phil Rees Music
36954>1	belong&0xffffff00	0x00204400	Stamer Musikanlagen GmbH
36955>1	belong&0xffffff00	0x00204500	Soundart
36956>1	belong&0xffffff00	0x00204600	C-Mexx Software
36957>1	belong&0xffffff00	0x00204700	Klavis Tech.
36958>1	belong&0xffffff00	0x00204800	Noteheads AB
36959
36960# Update:	Joerg Jenderek; January 2022
36961>1	byte			0x00		ID EXTENSIONS
36962>1	byte			0x13		Digidesign Inc.
36963>1	byte			0x1e		Key Concepts
36964>1	byte			0x20		Passac
36965>1	byte			0x23		Stepp
36966>1	byte			0x2d		Neve
36967>1	byte			0x2e		Soundtracs Ltd.
36968>1	byte			0x32		Drawmer
36969>1	byte			0x34		Audio Architecture
36970>1	byte			0x35		Generalmusic Corp SpA
36971>1	byte			0x36		Cheetah Marketing
36972>1	byte			0x37		C.T.M.
36973>1	byte			0x38		Simmons UK
36974>1	byte			0x3a		Steinberg
36975>1	byte			0x3b		Wersi GmbH
36976>1	byte			0x3c		AVAB Niethammer AB
36977>1	byte			0x3d		Digigram
36978>1	byte			0x3f		Quasimidi
36979#
36980>1	byte			0x40		Kawai Musical Instruments MFG. CO. Ltd
36981#>1	byte			0x45		foo
36982#>1	byte			0x4a		foo
36983#>1	byte			0x4d		foo
36984#>1	byte			0x4f		foo
36985#>1	byte			0x53		foo
36986>1	byte			0x55		Suzuki Musical Instruments MFG. Co. Ltd.
36987>1	byte			0x56		Fuji Sound Corporation Ltd.
36988#>1	byte			0x58		foo
36989>1	byte			0x59		Faith. Inc.
36990>1	byte			0x5a		Internet Corporation
36991#>1	byte			0x5b		foo
36992>1	byte			0x5c		Seekers Co. Ltd.
36993#>1	byte			0x5d		foo
36994#>1	byte			0x5e		foo
36995>1	byte			0x5f		SD Card Association
36996# Reserved for other uses for 60H to 7FH
36997# URL:		https://www.philscomputerlab.com/roland-midi-emulator-project-20.html
36998# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/s/syx--midiemu.trid.xml
36999# Note:         called by TrID "MIDI Emulator Project SysEx preset command"
37000>1	byte			0x66		MIDI Emulator
37001# https://electronicmusic.fandom.com/wiki/List_of_MIDI_Manufacturer_IDs
37002# Educational, prototyping, test, private use and experimentation
37003>1	byte			0x7D		PROTOTYPING
37004# universal non-real-time (sample dump, tuning table, etc.)
37005>1	byte			0x7E		UNIVERSAL
37006# universal real time (MIDI time code, MIDI Machine control, etc.)
37007>1	byte			0x7F		universal real time
37008# display information about End Of eXclusive byte (EOX=F7)
37009#>2	ubyte			0xF7		\b, at 2 EOX
37010#>3	ubyte			0xF7		\b, at 3 EOX
37011# https://tttapa.github.io/Control-Surface-doc/new-input/Doxygen/d2/d93/SysEx-Send-Receive_8ino-example.html
37012>4	ubyte			0xF7		\b, at 4 EOX
37013# http://www.1manband.nl/tutorials2/sysex.htm
37014>5	ubyte			0xF7		\b, at 5 EOX
37015# http://www.somascape.org/midi/tech/mfile.html#sysex
37016>6	ubyte			0xF7		\b, at 6 EOX
37017#
37018>7	ubyte			0xF7		\b, at 7 EOX
37019# https://webmidijs.org/forum/discussion/34/how-to-send-or-receive-system-exclusive-messages
37020>8	ubyte			0xF7		\b, at 8 EOX
37021#
37022>9	ubyte			0xF7		\b, at 9 EOX
37023# https://www.chd-el.cz/wp-content/uploads/845010_syxcom.pdf
37024>10	ubyte			0xF7		\b, at 10 EOX
37025# https://stackoverflow.com/questions/52906076/handling-midi-the-input-of-multiple-system-exclusive-messages-in-vb
37026>11	ubyte			0xF7		\b, at 11 EOX
37027# https://www.2writers.com/eddie/TutSysEx.htm
37028>12	ubyte			0xF7		\b, at 12 EOX
37029>13	ubyte			0xF7		\b, at 13 EOX
37030# http://www.chromakinetics.com/handsonic/rolSysEx.htm
37031>14	ubyte			0xF7		\b, at 14 EOX
37032#>15	ubyte			0xF7		\b, at 15 EOX
37033
370340	string			T707		Roland TR-707 Data
37035#------------------------------------------------------------------------------
37036# file:  file(1) magic for Tcl scripting language
37037# URL:  https://www.tcl.tk/
37038# From: gustaf neumann
37039
37040# Tcl scripts
370410	search/1/w	#!\ /usr/bin/tcl	Tcl script text executable
37042!:mime	text/x-tcl
370430	search/1/w	#!\ /usr/local/bin/tcl	Tcl script text executable
37044!:mime	text/x-tcl
370450	search/1	#!/usr/bin/env\ tcl	Tcl script text executable
37046!:mime	text/x-tcl
370470	search/1	#!\ /usr/bin/env\ tcl	Tcl script text executable
37048!:mime	text/x-tcl
370490	search/1/w	#!\ /usr/bin/wish	Tcl/Tk script text executable
37050!:mime	text/x-tcl
370510	search/1/w	#!\ /usr/local/bin/wish	Tcl/Tk script text executable
37052!:mime	text/x-tcl
370530	search/1	#!/usr/bin/env\ wish	Tcl/Tk script text executable
37054!:mime	text/x-tcl
370550	search/1	#!\ /usr/bin/env\ wish	Tcl/Tk script text executable
37056!:mime	text/x-tcl
37057
37058# check the first line
370590	search/1	package\ req
37060>0	regex		\^package[\ \t]+req	Tcl script
37061# not 'p', check other lines
370620	search/1	!p
37063>0	regex		\^package[\ \t]+req	Tcl script
37064
37065#------------------------------------------------------------------------------
37066# $File: teapot,v 1.4 2009/09/19 16:28:12 christos Exp $
37067# teapot:  file(1) magic for "teapot" spreadsheet
37068#
370690       string          #!teapot\012xdr      teapot work sheet (XDR format)
37070
37071#------------------------------------------------------------------------------
37072# $File: terminfo,v 1.12 2021/02/23 00:51:10 christos Exp $
37073# terminfo:  file(1) magic for terminfo
37074#
37075# URL: https://invisible-island.net/ncurses/man/term.5.html
37076# URL: https://invisible-island.net/ncurses/man/scr_dump.5.html
37077#
37078# Workaround for Targa image type by Joerg Jenderek
37079# GRR: line below too general as it catches also
37080# Targa image type 1 with 26 long identification field
37081# and HELP.DSK
370820	string		\032\001
37083# 5th character of terminal name list, but not Targa image pixel size (15 16 24 32)
37084>16	ubyte		>32
37085# namelist, if more than 1 separated by "|" like "st|stterm| simpleterm 0.4.1"
37086>>12	regex		\^[a-zA-Z0-9][a-zA-Z0-9.][^|]*	Compiled terminfo entry "%-s"
37087!:mime	application/x-terminfo
37088# no extension
37089#!:ext
37090#
37091#------------------------------------------------------------------------------
37092# The following was added for ncurses6 development:
37093#------------------------------------------------------------------------------
37094#
370950	string		\036\002
37096# imitate the legacy compiled-format, to get the entry-name printed
37097>16	ubyte		>32
37098# namelist, if more than 1 separated by "|" like "st|stterm| simpleterm 0. 4.1"
37099>>12	regex		\^[a-zA-Z0-9][a-zA-Z0-9.][^|]*	Compiled 32-bit terminfo entry "%-s"
37100!:mime	application/x-terminfo2
37101#
37102# While the compiled terminfo uses little-endian format regardless of
37103# platform, SystemV screen dumps do not.  They came later, and that detail was
37104# overlooked.
37105#
37106# AIX and HPUX use the SVr4 big-endian format
37107# Solaris uses the SVr3 formats (sparc and x86 differ endian-ness)
371080	beshort		0433 		SVr2 curses screen image, big-endian
371090	beshort		0434		SVr3 curses screen image, big-endian
371100	beshort		0435		SVr4 curses screen image, big-endian
37111#
371120	leshort		0433		SVr2 curses screen image, little-endian
371130	leshort		0434		SVr3 curses screen image, little-endian
371140	leshort		0435		SVr4 curses screen image, little-endian
37115#
37116# Rather than SVr4, Solaris "xcurses" writes this header:
371170	regex		\^MAX=[0-9]+,[0-9]+$
37118>1	regex		\^BEG=[0-9]+,[0-9]+$
37119>2	regex		\^SCROLL=[0-9]+,[0-9]+$
37120>3	regex		\^VMIN=[0-9]+$
37121>4	regex		\^VTIME=[0-9]+$
37122>5	regex		\^FLAGS=0x[[:xdigit:]]+$
37123>6	regex		\^FG=[0-9],[0-9]+$
37124>7	regex		\^BG=[0-9]+,[0-9]+,	Solaris xcurses screen image
37125#
37126# ncurses5 (and before) did not use a magic number, making screen dumps "data".
37127# ncurses6 (2015) uses this format, ignoring byte-order
371280	string	\210\210\210\210ncurses	ncurses6 screen image
37129#
37130# PDCurses added this in 2005
371310	string		PDC\001		PDCurses screen image
37132
37133#------------------------------------------------------------------------------
37134# $File: tex,v 1.21 2019/04/19 00:42:27 christos Exp $
37135# tex:  file(1) magic for TeX files
37136#
37137# XXX - needs byte-endian stuff (big-endian and little-endian DVI?)
37138#
37139# From <conklin@talisman.kaleida.com>
37140
37141# Although we may know the offset of certain text fields in TeX DVI
37142# and font files, we can't use them reliably because they are not
37143# zero terminated. [but we do anyway, christos]
371440	string		\367\002	TeX DVI file
37145!:mime	application/x-dvi
37146>16	string		>\0		(%s)
371470	string		\367\203	TeX generic font data
371480	string		\367\131	TeX packed font data
37149>3	string		>\0		(%s)
371500	string		\367\312	TeX virtual font data
371510	search/1	This\ is\ TeX,	TeX transcript text
371520	search/1	This\ is\ METAFONT,	METAFONT transcript text
37153
37154# There is no way to detect TeX Font Metric (*.tfm) files without
37155# breaking them apart and reading the data.  The following patterns
37156# match most *.tfm files generated by METAFONT or afm2tfm.
371572	string		\000\021	TeX font metric data
37158!:mime	application/x-tex-tfm
37159>33	string		>\0		(%s)
371602	string		\000\022	TeX font metric data
37161!:mime	application/x-tex-tfm
37162>33	string		>\0		(%s)
37163
37164# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com)
371650	search/1	\\input\ texinfo	Texinfo source text
37166!:mime	text/x-texinfo
371670	search/1	This\ is\ Info\ file	GNU Info text
37168!:mime	text/x-info
37169
37170# TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com)
371710	search/4096	\\input		TeX document text
37172!:mime	text/x-tex
37173!:strength + 15
371740	search/4096	\\begin		LaTeX document text
37175!:mime	text/x-tex
37176!:strength + 15
371770	search/4096	\\section	LaTeX document text
37178!:mime	text/x-tex
37179!:strength + 18
371800	search/4096	\\setlength	LaTeX document text
37181!:mime	text/x-tex
37182!:strength + 15
371830	search/4096	\\documentstyle	LaTeX document text
37184!:mime	text/x-tex
37185!:strength + 18
371860	search/4096	\\chapter	LaTeX document text
37187!:mime	text/x-tex
37188!:strength + 18
371890	search/4096	\\documentclass	LaTeX 2e document text
37190!:mime	text/x-tex
37191!:strength + 15
371920	search/4096	\\relax		LaTeX auxiliary file
37193!:mime	text/x-tex
37194!:strength + 15
371950	search/4096	\\contentsline	LaTeX table of contents
37196!:mime	text/x-tex
37197!:strength + 15
371980	search/4096	%\ -*-latex-*-	LaTeX document text
37199!:mime	text/x-tex
37200
37201# Tex document, from Hendrik Scholz <hendrik@scholz.net>
372020   	search/1	\\ifx		TeX document text
37203
37204# Index and glossary files
372050	search/4096	\\indexentry	LaTeX raw index file
372060	search/4096	\\begin{theindex}	LaTeX sorted index
372070	search/4096	\\glossaryentry	LaTeX raw glossary
372080	search/4096	\\begin{theglossary}	LaTeX sorted glossary
372090	search/4096	This\ is\ makeindex	Makeindex log file
37210
37211# End of TeX
37212
37213#------------------------------------------------------------------------------
37214# file(1) magic for BibTex text files
37215# From Hendrik Scholz <hendrik@scholz.net>
37216
372170	search/1/c	@article{	BibTeX text file
372180	search/1/c	@book{		BibTeX text file
372190	search/1/c	@inbook{	BibTeX text file
372200	search/1/c	@incollection{	BibTeX text file
372210	search/1/c	@inproceedings{	BibTeX text file
372220	search/1/c	@manual{	BibTeX text file
372230	search/1/c	@misc{		BibTeX text file
372240	search/1/c	@preamble{	BibTeX text file
372250	search/1/c	@phdthesis{	BibTeX text file
372260	search/1/c	@techreport{	BibTeX text file
372270	search/1/c	@unpublished{	BibTeX text file
37228
3722973	search/1	%%%\ \ 		BibTeX-file{ BibTex text file (with full header)
37230
3723173	search/1	%%%\ \ @BibTeX-style-file{   BibTeX style text file (with full header)
37232
372330	search/1	%\ BibTeX\ standard\ bibliography\ 	BibTeX standard bibliography style text file
37234
372350	search/1	%\ BibTeX\ `	BibTeX custom bibliography style text file
37236
372370	search/1	@c\ @mapfile{	TeX font aliases text file
37238
372390	string		#LyX		LyX document text
37240
37241# ConTeXt documents
37242#	https://wiki.contextgarden.net/
372430	search/4096	\\setupcolors[		ConTeXt document text
37244!:strength + 15
372450	search/4096	\\definecolor[		ConTeXt document text
37246!:strength + 15
372470	search/4096	\\setupinteraction[	ConTeXt document text
37248!:strength + 15
372490	search/4096	\\useURL[		ConTeXt document text
37250!:strength + 15
372510	search/4096	\\setuppapersize[	ConTeXt document text
37252!:strength + 15
372530	search/4096	\\setuplayout[		ConTeXt document text
37254!:strength + 15
372550	search/4096	\\setupfooter[		ConTeXt document text
37256!:strength + 15
372570	search/4096	\\setupfootertexts[	ConTeXt document text
37258!:strength + 15
372590	search/4096	\\setuppagenumbering[	ConTeXt document text
37260!:strength + 15
372610	search/4096	\\setupbodyfont[	ConTeXt document text
37262!:strength + 15
372630	search/4096	\\setuphead[		ConTeXt document text
37264!:strength + 15
372650	search/4096	\\setupitemize[		ConTeXt document text
37266!:strength + 15
372670	search/4096	\\setupwhitespace[	ConTeXt document text
37268!:strength + 15
372690	search/4096	\\setupindenting[	ConTeXt document text
37270!:strength + 15
37271
37272#------------------------------------------------------------------------------
37273# $File: tgif,v 1.7 2010/09/20 19:03:46 rrt Exp $
37274# file(1) magic for tgif(1) files
37275# From Hendrik Scholz <hendrik@scholz.net>
372760	string	%TGIF\ 			Tgif file version
37277>6	string	x			%s
37278
37279#------------------------------------------------------------------------------
37280# $File: ti-8x,v 1.8 2020/02/12 22:13:01 christos Exp $
37281# ti-8x: file(1) magic for the TI-8x and TI-9x Graphing Calculators.
37282#
37283# From: Ryan McGuire (rmcguire@freenet.columbus.oh.us).
37284#
37285# Update: Romain Lievin (roms@lpg.ticalc.org).
37286#
37287# NOTE: This list is not complete.
37288# Files for the TI-80 and TI-81 are pretty rare. I'm not going to put the
37289# program/group magic numbers in here because I cannot find any.
372900		string		**TI80**	TI-80 Graphing Calculator File.
372910		string		**TI81**	TI-81 Graphing Calculator File.
37292#
37293# Magic Numbers for the TI-73
37294#
372950		string		**TI73**	TI-73 Graphing Calculator
37296>0x00003B	byte		0x00		(real number)
37297>0x00003B	byte		0x01		(list)
37298>0x00003B	byte		0x02		(matrix)
37299>0x00003B	byte		0x03		(equation)
37300>0x00003B	byte		0x04		(string)
37301>0x00003B	byte		0x05		(program)
37302>0x00003B	byte		0x06		(assembly program)
37303>0x00003B	byte		0x07		(picture)
37304>0x00003B	byte		0x08		(gdb)
37305>0x00003B	byte		0x0C		(complex number)
37306>0x00003B	byte		0x0F		(window settings)
37307>0x00003B	byte		0x10		(zoom)
37308>0x00003B	byte		0x11		(table setup)
37309>0x00003B	byte		0x13		(backup)
37310
37311# Magic Numbers for the TI-82
37312#
373130		string		**TI82**	TI-82 Graphing Calculator
37314>0x00003B	byte		0x00		(real)
37315>0x00003B	byte		0x01		(list)
37316>0x00003B	byte		0x02		(matrix)
37317>0x00003B	byte		0x03		(Y-variable)
37318>0x00003B	byte		0x05		(program)
37319>0x00003B	byte		0x06		(protected prgm)
37320>0x00003B	byte		0x07		(picture)
37321>0x00003B	byte		0x08		(gdb)
37322>0x00003B	byte		0x0B		(window settings)
37323>0x00003B	byte		0x0C		(window settings)
37324>0x00003B	byte		0x0D		(table setup)
37325>0x00003B	byte		0x0E		(screenshot)
37326>0x00003B	byte		0x0F		(backup)
37327#
37328# Magic Numbers for the TI-83
37329#
373300		string		**TI83**	TI-83 Graphing Calculator
37331>0x00003B	byte		0x00		(real)
37332>0x00003B	byte		0x01		(list)
37333>0x00003B	byte		0x02		(matrix)
37334>0x00003B	byte		0x03		(Y-variable)
37335>0x00003B	byte		0x04		(string)
37336>0x00003B	byte		0x05		(program)
37337>0x00003B	byte		0x06		(protected prgm)
37338>0x00003B	byte		0x07		(picture)
37339>0x00003B	byte		0x08		(gdb)
37340>0x00003B	byte		0x0B		(window settings)
37341>0x00003B	byte		0x0C		(window settings)
37342>0x00003B	byte		0x0D		(table setup)
37343>0x00003B	byte		0x0E		(screenshot)
37344>0x00003B	byte		0x13		(backup)
37345#
37346# Magic Numbers for the TI-83+
37347#
373480		string		**TI83F*	TI-83+ Graphing Calculator
37349>0x00003B	byte		0x00		(real number)
37350>0x00003B	byte		0x01		(list)
37351>0x00003B	byte		0x02		(matrix)
37352>0x00003B	byte		0x03		(equation)
37353>0x00003B	byte		0x04		(string)
37354>0x00003B	byte		0x05		(program)
37355>0x00003B	byte		0x06		(assembly program)
37356>0x00003B	byte		0x07		(picture)
37357>0x00003B	byte		0x08		(gdb)
37358>0x00003B	byte		0x0C		(complex number)
37359>0x00003B	byte		0x0F		(window settings)
37360>0x00003B	byte		0x10		(zoom)
37361>0x00003B	byte		0x11		(table setup)
37362>0x00003B	byte		0x13		(backup)
37363>0x00003B	byte		0x15		(application variable)
37364>0x00003B	byte		0x17		(group of variable)
37365
37366#
37367# Magic Numbers for the TI-85
37368#
373690		string		**TI85**	TI-85 Graphing Calculator
37370>0x00003B	byte		0x00		(real number)
37371>0x00003B	byte		0x01		(complex number)
37372>0x00003B	byte		0x02		(real vector)
37373>0x00003B	byte		0x03		(complex vector)
37374>0x00003B	byte		0x04		(real list)
37375>0x00003B	byte		0x05		(complex list)
37376>0x00003B	byte		0x06		(real matrix)
37377>0x00003B	byte		0x07		(complex matrix)
37378>0x00003B	byte		0x08		(real constant)
37379>0x00003B	byte		0x09		(complex constant)
37380>0x00003B	byte		0x0A		(equation)
37381>0x00003B	byte		0x0C		(string)
37382>0x00003B	byte		0x0D		(function GDB)
37383>0x00003B	byte		0x0E		(polar GDB)
37384>0x00003B	byte		0x0F		(parametric GDB)
37385>0x00003B	byte		0x10		(diffeq GDB)
37386>0x00003B	byte		0x11		(picture)
37387>0x00003B	byte		0x12		(program)
37388>0x00003B	byte		0x13		(range)
37389>0x00003B	byte		0x17		(window settings)
37390>0x00003B	byte		0x18		(window settings)
37391>0x00003B	byte		0x19		(window settings)
37392>0x00003B	byte		0x1A		(window settings)
37393>0x00003B	byte		0x1B		(zoom)
37394>0x00003B	byte		0x1D		(backup)
37395>0x00003B	byte		0x1E		(unknown)
37396>0x00003B	byte		0x2A		(equation)
37397>0x000032	string		ZS4		- ZShell Version 4 File.
37398>0x000032	string		ZS3		- ZShell Version 3 File.
37399#
37400# Magic Numbers for the TI-86
37401#
374020		string		**TI86**	TI-86 Graphing Calculator
37403>0x00003B	byte		0x00		(real number)
37404>0x00003B	byte		0x01		(complex number)
37405>0x00003B	byte		0x02		(real vector)
37406>0x00003B	byte		0x03		(complex vector)
37407>0x00003B	byte		0x04		(real list)
37408>0x00003B	byte		0x05		(complex list)
37409>0x00003B	byte		0x06		(real matrix)
37410>0x00003B	byte		0x07		(complex matrix)
37411>0x00003B	byte		0x08		(real constant)
37412>0x00003B	byte		0x09		(complex constant)
37413>0x00003B	byte		0x0A		(equation)
37414>0x00003B	byte		0x0C		(string)
37415>0x00003B	byte		0x0D		(function GDB)
37416>0x00003B	byte		0x0E		(polar GDB)
37417>0x00003B	byte		0x0F		(parametric GDB)
37418>0x00003B	byte		0x10		(diffeq GDB)
37419>0x00003B	byte		0x11		(picture)
37420>0x00003B	byte		0x12		(program)
37421>0x00003B	byte		0x13		(range)
37422>0x00003B	byte		0x17		(window settings)
37423>0x00003B	byte		0x18		(window settings)
37424>0x00003B	byte		0x19		(window settings)
37425>0x00003B	byte		0x1A		(window settings)
37426>0x00003B	byte		0x1B		(zoom)
37427>0x00003B	byte		0x1D		(backup)
37428>0x00003B	byte		0x1E		(unknown)
37429>0x00003B	byte		0x2A		(equation)
37430#
37431# Magic Numbers for the TI-89
37432#
374330		string		**TI89**	TI-89 Graphing Calculator
37434>0x000048	byte		0x00		(expression)
37435>0x000048	byte		0x04		(list)
37436>0x000048	byte		0x06		(matrix)
37437>0x000048	byte		0x0A		(data)
37438>0x000048	byte		0x0B		(text)
37439>0x000048	byte		0x0C		(string)
37440>0x000048	byte		0x0D		(graphic data base)
37441>0x000048	byte		0x0E		(figure)
37442>0x000048	byte		0x10		(picture)
37443>0x000048	byte		0x12		(program)
37444>0x000048	byte		0x13		(function)
37445>0x000048	byte		0x14		(macro)
37446>0x000048	byte		0x1C		(zipped)
37447>0x000048	byte		0x21		(assembler)
37448#
37449# Magic Numbers for the TI-92
37450#
374510		string		**TI92**	TI-92 Graphing Calculator
37452>0x000048	byte		0x00		(expression)
37453>0x000048	byte		0x04		(list)
37454>0x000048	byte		0x06		(matrix)
37455>0x000048	byte		0x0A		(data)
37456>0x000048	byte		0x0B		(text)
37457>0x000048	byte		0x0C		(string)
37458>0x000048	byte		0x0D		(graphic data base)
37459>0x000048	byte		0x0E		(figure)
37460>0x000048	byte		0x10		(picture)
37461>0x000048	byte		0x12		(program)
37462>0x000048	byte		0x13		(function)
37463>0x000048	byte		0x14		(macro)
37464>0x000048	byte		0x1D		(backup)
37465#
37466# Magic Numbers for the TI-92+/V200
37467#
374680		string		**TI92P*	TI-92+/V200 Graphing Calculator
37469>0x000048	byte		0x00		(expression)
37470>0x000048	byte		0x04		(list)
37471>0x000048	byte		0x06		(matrix)
37472>0x000048	byte		0x0A		(data)
37473>0x000048	byte		0x0B		(text)
37474>0x000048	byte		0x0C		(string)
37475>0x000048	byte		0x0D		(graphic data base)
37476>0x000048	byte		0x0E		(figure)
37477>0x000048	byte		0x10		(picture)
37478>0x000048	byte		0x12		(program)
37479>0x000048	byte		0x13		(function)
37480>0x000048	byte		0x14		(macro)
37481>0x000048	byte		0x1C		(zipped)
37482>0x000048	byte		0x21		(assembler)
37483#
37484# Magic Numbers for the TI-73/83+/89/92+/V200 FLASH upgrades
37485#
37486#0x0000016	string		Advanced	TI-XX Graphing Calculator (FLASH)
374870		string		**TIFL**	TI-XX Graphing Calculator (FLASH)
37488>8		byte		>0		- Revision %d
37489>>9 		byte		x		\b.%d,
37490>12		byte		>0		Revision date %02x
37491>>13		byte		x		\b/%02x
37492>>14		beshort		x		\b/%04x,
37493>17		string		>/0		name: '%s',
37494>48		byte		0x74		device: TI-73,
37495>48		byte		0x73		device: TI-83+,
37496>48		byte		0x98		device: TI-89,
37497>48		byte		0x88		device: TI-92+,
37498>49		byte		0x23		type: OS upgrade,
37499>49		byte		0x24		type: application,
37500>49		byte		0x25		type: certificate,
37501>49		byte		0x3e		type: license,
37502>74		lelong		>0		size: %d bytes
37503
37504# VTi & TiEmu skins (TI Graphing Calculators).
37505# From: Romain Lievin (roms@lpg.ticalc.org).
37506# Magic Numbers for the VTi skins
375070               string          VTI		Virtual TI skin
37508>3		string		v		- Version
37509>>4		byte		>0		\b %c
37510>>6		byte		x		\b.%c
37511# Magic Numbers for the TiEmu skins
375120		string		TiEmu		TiEmu skin
37513>6              string          v               - Version
37514>>7             byte            >0              \b %c
37515>>9             byte            x               \b.%c
37516>>10		byte		x		\b%c
37517
37518#------------------------------------------------------------------------------
37519# $File: timezone,v 1.13 2021/07/21 17:57:20 christos Exp $
37520# timezone:  file(1) magic for timezone data
37521#
37522# from Daniel Quinlan (quinlan@yggdrasil.com)
37523# this should work on Linux, SunOS, and maybe others
37524# Added new official magic number for recent versions of the Olson code
375250	name	timezone
37526>4	byte	0	\b, old version
37527>4	byte	>0	\b, version %c
37528>20	belong	0	\b, no gmt time flags
37529>20	belong	1	\b, 1 gmt time flag
37530>20	belong	>1	\b, %d gmt time flags
37531>24	belong	0	\b, no std time flags
37532>24	belong	1	\b, 1 std time flag
37533>24	belong	>1	\b, %d std time flags
37534>28	belong	0	\b, no leap seconds
37535>28	belong	1	\b, 1 leap second
37536>28	belong  >1	\b, %d leap seconds
37537>32	belong	0	\b, no transition times
37538>32	belong	1	\b, 1 transition time
37539>32	belong  >1	\b, %d transition times
37540>36	belong	0	\b, no local time types
37541>36	belong	1	\b, 1 local time type
37542>36	belong	>1	\b, %d local time types
37543>40	belong	0	\b, no abbreviation chars
37544>40	belong	1	\b, 1 abbreviation char
37545>40	belong	>1	\b, %d abbreviation chars
37546
375470	string	TZif	timezone data
37548>51	string	TZif	\b(slim)
37549>>51	use timezone
37550>51	default x	\b(fat)
37551>>0	use timezone
37552
375530	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0	old timezone data
375540	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0	old timezone data
375550	string  \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0	old timezone data
375560	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0	old timezone data
375570	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0	old timezone data
375580	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0	old timezone data
37559
37560#------------------------------------------------------------------------------
37561# $File: tplink,v 1.7 2021/04/26 15:56:00 christos Exp $
37562# tplink: File magic for openwrt firmware files
37563
37564# URL: https://wiki.openwrt.org/doc/techref/header
37565# Reference: https://git.openwrt.org/?p=openwrt.git;a=blob;f=tools/firmware-utils/src/mktplinkfw.c
37566# From: Joerg Jenderek
37567# check for valid header version 1 or 2
375680		ulelong		<3
37569>0		ulelong		!0
37570# test for header padding with nulls
37571>>0x100		long		0
37572# skip Norton Commander Cleanup Utility NCCLEAN.INI by looking for valid vendor
37573>>>4		ubelong		>0x1F000000
37574# skip user.dbt by looking for positive hardware id
37575>>>>0x40	ubeshort	>0
37576>>>>>0		use		firmware-tplink
37577
375780		name		firmware-tplink
37579>0		ubyte		x		firmware
37580!:mime application/x-tplink-bin
37581!:ext	bin
37582# hardware id like 10430001 07410001 09410004 09410006
37583>0x40		ubeshort	x		%x
37584>0x42		ubeshort	x		v%x
37585# hardware revision like 1
37586>0x44		ubelong		!1		(revision %u)
37587# vendor_name[24] like OpenWrt or TP-LINK Technologies
37588>4		string		x		%.24s
37589# fw_version[36] like r49389 or ver. 1.0
37590>0x1c		string		x		%.36s
37591# header version 1 or 2
37592>0		ubyte		!1		V%X
37593# ver_hi.ver_mid.ver_lo
37594>0x98		long		!0		\b, version
37595>>0x98		ubeshort	x		%u
37596>>0x9A		ubeshort	x		\b.%u
37597>>0x9C		ubeshort	x		\b.%u
37598# region code 0~universal 1~US
37599>0x48		ubelong		x
37600#>>0x48		ubelong		0		(universal)
37601>>0x48		ubelong		1		(US)
37602>>0x48		ubelong		>1		(region %u)
37603# total length of the firmware. not always true
37604>0x7C		ubelong		x		\b, %u bytes or less
37605# unknown 1
37606>0x48		ubelong		!0		\b, UNKNOWN1 %#x
37607# md5sum1[16]
37608#>0x4c		ubequad		x		\b, MD5 %llx
37609#>>0x54		ubequad		x		\b%llx
37610# unknown 2
37611>0x5c		ubelong		!0		\b, UNKNOWN2 %#x
37612# md5sum2[16]
37613#>0x60		ubequad		!0		\b, 2nd MD5 %llx
37614#>>0x68		ubequad		x		\b%llx
37615# unknown 3
37616>0x70		ubelong		!0		\b, UNKNOWN3 %#x
37617# kernel load address
37618#>0x74		ubelong		x		\b, %#x load
37619# kernel entry point
37620#>0x78		ubelong		x		\b, %#x entry
37621# kernel data offset. 200h means direct after header
37622>0x80		ubelong		x		\b, at %#x
37623# kernel data length and 1 space
37624>0x84		ubelong		x		%u bytes
37625# look for kernel type (gzip compressed vmlinux.bin by ./compress)
37626>(0x80.L)	indirect	x
37627# root file system data offset
37628# WRONG in 5.35 with above indirect expression
37629>0x88		ubelong		x		\b, at %#x
37630# rootfs data length and 1 space
37631>0x8C		ubelong		x		%u bytes
37632# in 5.32 only true for offset ~< FILE_BYTES_MAX=9 MB defined in ../../src/file.h
37633>(0x88.L)	indirect	x
37634# 'qshs' for wr940nv1_en_3_13_7_up(111228).bin
37635#>(0x88.L)	string		x		\b, file system '%.4s'
37636#>(0x88.L)	ubequad		x		\b, file system %#llx
37637# bootloader data offset
37638>0x90		ubelong		!0		\b, at %#x
37639# bootloader data length only reasonable if bootloader offset not null
37640>>0x94		ubelong		!0		%u bytes
37641# pad[354] should be 354 null bytes.
37642#>0x9E		ubequad		!0		\b, padding %#llx
37643# But at 0x120 18 non null bytes in examples like
37644# wr940nv4_eu_3_16_9_up_boot(160620).bin
37645# wr940nv6_us_3_18_1_up_boot(171030).bin
37646#>0x120		ubequad		!0		\b, other padding %#llx
37647
37648#------------------------------------------------------------------------------
37649# $File: troff,v 1.13 2020/05/30 23:12:34 christos Exp $
37650# troff:  file(1) magic for *roff
37651#
37652# updated by Daniel Quinlan (quinlan@yggdrasil.com)
37653
37654# troff input
376550	search/1	.\\"		troff or preprocessor input text
37656!:mime	text/troff
376570	search/1	'\\"		troff or preprocessor input text
37658!:mime	text/troff
376590	search/1	'.\\"		troff or preprocessor input text
37660!:mime	text/troff
376610	search/1	\\"		troff or preprocessor input text
37662!:mime	text/troff
37663#0	search/1	'''		troff or preprocessor input text
37664#!:mime	text/troff
376650	regex/20l	\^\\.[A-Za-z][A-Za-z0-9][\ \t]	troff or preprocessor input text
37666!:mime	text/troff
376670	regex/20l	\^\\.[A-Za-z][A-Za-z0-9]$	troff or preprocessor input text
37668!:mime	text/troff
37669
37670# ditroff intermediate output text
376710	search/1	x\ T		ditroff output text
37672>4	search/1	cat		for the C/A/T phototypesetter
37673>4	search/1	ps		for PostScript
37674>4	search/1	dvi		for DVI
37675>4	search/1	ascii		for ASCII
37676>4	search/1	lj4		for LaserJet 4
37677>4	search/1	latin1		for ISO 8859-1 (Latin 1)
37678>4	search/1	X75		for xditview at 75dpi
37679>>7	search/1	-12		(12pt)
37680>4	search/1	X100		for xditview at 100dpi
37681>>8	search/1	-12		(12pt)
37682
37683# output data formats
376840	string		\100\357	very old (C/A/T) troff output data
37685
37686#------------------------------------------------------------------------------
37687# $File: tuxedo,v 1.4 2009/09/19 16:28:13 christos Exp $
37688# tuxedo:	file(1) magic for BEA TUXEDO data files
37689#
37690# from Ian Springer <ispringer@hotmail.com>
37691#
376920	string		\0\0\1\236\0\0\0\0\0\0\0\0\0\0\0\0	BEA TUXEDO DES mask data
37693
37694#------------------------------------------------------------------------------
37695# $File: typeset,v 1.8 2009/09/19 16:28:13 christos Exp $
37696# typeset:  file(1) magic for other typesetting
37697#
376980	string		Interpress/Xerox	Xerox InterPress data
37699>16	string		/			(version
37700>>17	string		>\0			%s)
37701
37702#------------------------------------------------------------------------------
37703# $File: uf2,v 1.3 2021/04/28 01:00:31 christos Exp $
37704# uf2:  file(1) magic for UF2 firmware image files
37705#
37706# https://github.com/microsoft/uf2
37707#
37708# Created by Blake Ramsdell <blaker@gmail.com>
37709
377100	string	UF2\n		UF2 firmware image
37711!:ext uf2
37712# This is for checking the other magic numbers, do we want to do that?
37713#>4	lelong	0x9E5D5157	howdy
37714#>>508	lelong	0x0AB16F30	doody
37715>8	lelong	&0x0001		\b, not main flash
37716>8	lelong	&0x1000		\b, file container
37717>8	lelong	&0x2000		\b, family
37718
37719# To update the UF2 family data, use this fine command
37720#
37721# families=`curl \
37722# https://raw.githubusercontent.com/microsoft/uf2/master/utils/uf2families.json \
37723# | jq -r '.[] | ">>28\tlelong\t\(.id)\t\(.description)"' | sort -n -k 3` && \
37724# perl -0777 -i -pe \
37725# "s/(### BEGIN UF2 FAMILIES\\n).*(\\n### END UF2 FAMILIES)/\$1$families\$2/s" \
37726# uf2
37727
37728### BEGIN UF2 FAMILIES
37729>>28	lelong	0x00ff6919	ST STM32L4xx
37730>>28	lelong	0x04240bdf	ST STM32L5xx
37731>>28	lelong	0x16573617	Microchip (Atmel) ATmega32
37732>>28	lelong	0x1851780a	Microchip (Atmel) SAML21
37733>>28	lelong	0x1b57745f	Nordic NRF52
37734>>28	lelong	0x1c5f21b0	ESP32
37735>>28	lelong	0x1e1f432d	ST STM32L1xx
37736>>28	lelong	0x202e3a91	ST STM32L0xx
37737>>28	lelong	0x21460ff0	ST STM32WLxx
37738>>28	lelong	0x2abc77ec	NXP LPC55xx
37739>>28	lelong	0x300f5633	ST STM32G0xx
37740>>28	lelong	0x31d228c6	GD32F350
37741>>28	lelong	0x4c71240a	ST STM32G4xx
37742>>28	lelong	0x4fb2d5bd	NXP i.MX RT10XX
37743>>28	lelong	0x53b80f00	ST STM32F7xx
37744>>28	lelong	0x55114460	Microchip (Atmel) SAMD51
37745>>28	lelong	0x57755a57	ST STM32F401
37746>>28	lelong	0x5a18069b	Cypress FX2
37747>>28	lelong	0x5d1a0a2e	ST STM32F2xx
37748>>28	lelong	0x5ee21072	ST STM32F103
37749>>28	lelong	0x647824b6	ST STM32F0xx
37750>>28	lelong	0x68ed2b88	Microchip (Atmel) SAMD21
37751>>28	lelong	0x6b846188	ST STM32F3xx
37752>>28	lelong	0x6d0922fa	ST STM32F407
37753>>28	lelong	0x6db66082	ST STM32H7xx
37754>>28	lelong	0x70d16653	ST STM32WBxx
37755>>28	lelong	0x7eab61ed	ESP8266
37756>>28	lelong	0x7f83e793	NXP KL32L2x
37757>>28	lelong	0x8fb060fe	ST STM32F407VG
37758>>28	lelong	0xada52840	Nordic NRF52840
37759>>28	lelong	0xbfdd4eee	ESP32-S2
37760>>28	lelong	0xc47e5767	ESP32-S3
37761>>28	lelong	0xd42ba06c	ESP32-C3
37762>>28	lelong	0xe48bff56	Raspberry Pi RP2040
37763### END UF2 FAMILIES
37764
37765>>28	default	x
37766>>>28	lelong	x		%#08x
37767>8	lelong&0x2000	0	\b, file size
37768>>28	lelong	x		%#08x
37769>8	lelong	&0x4000		\b, MD5 checksum present
37770>8	lelong	&0x8000		\b, extension tags present
37771>12	lelong	x 		\b, address %#08x
37772>24	lelong	x		\b, %u total blocks
37773
37774#------------------------------------------------------------------------------
37775# $File: unicode,v 1.7 2019/02/19 20:34:42 christos Exp $
37776# Unicode:  BOM prefixed text files - Adrian Havill <havill@turbolinux.co.jp>
37777# These types are recognised in file_ascmagic so these encodings can be
37778# treated by text patterns.  Missing types are already dealt with internally.
37779#
377800	string	+/v8			Unicode text, UTF-7
377810	string	+/v9			Unicode text, UTF-7
377820	string	+/v+			Unicode text, UTF-7
377830	string	+/v/			Unicode text, UTF-7
377840	string	\335\163\146\163	Unicode text, UTF-8-EBCDIC
377850	string	\000\000\376\377	Unicode text, UTF-32, big-endian
377860	string	\377\376\000\000	Unicode text, UTF-32, little-endian
377870	string	\016\376\377		Unicode text, SCSU (Standard Compression Scheme for Unicode)
37788
37789#------------------------------------------------------------------------------
37790# $File: unisig,v 1.1 2020/04/09 19:05:44 christos Exp $
37791# unisig:  file(1) magic for files carrying a uniform signature (Unisig)
37792# From: Lassi Kortela, John Cowan
37793# URL:	https://github.com/unisig
37794#
377950	string	\xDC\xDC\x0D\x0A\x1A\x0A\x00	Unisig:
37796>7	ubyte	=0				UUID
37797>>8	guid	x				%s
37798>7	ubyte	>0				URI
37799>>7	pstring x				%s
37800
37801#------------------------------------------------------------------------------
37802# $File: unknown,v 1.8 2013/01/09 22:37:24 christos Exp $
37803# unknown:  file(1) magic for unknown machines
37804#
37805# 0x107 is 0407, 0x108 is 0410, and 0x109 is 0411; those are all PDP-11
37806# (executable, pure, and split I&D, respectively), but the PDP-11 version
37807# doesn't have the "version %ld", which may be a bogus COFFism (I don't
37808# think there was ever COFF for the PDP-11).
37809#
37810# 0x10B is 0413; that's VAX demand-paged, but this is a short, not a
37811# long, as it would be on a VAX.  In any case, that could collide with
37812# VAX demand-paged files, as the magic number is little-endian on those
37813# binaries, so the first 16 bits of the file would contain 0x10B.
37814#
37815# Therefore, those entries are commented out.
37816#
37817# 0x10C is 0414 and 0x10E is 0416; those *are* unknown.
37818#
37819#0	short		0x107		unknown machine executable
37820#>8	short		>0		not stripped
37821#>15	byte		>0		- version %ld
37822#0	short		0x108		unknown pure executable
37823#>8	short		>0		not stripped
37824#>15	byte		>0		- version %ld
37825#0	short		0x109		PDP-11 separate I&D
37826#>8	short		>0		not stripped
37827#>15	byte		>0		- version %ld
37828#0	short		0x10b		unknown pure executable
37829#>8	short		>0		not stripped
37830#>15	byte		>0		- version %ld
378310	long		0x10c		unknown demand paged pure executable
37832>16	long		>0		not stripped
378330	long		0x10e		unknown readable demand paged pure executable
37834
37835#------------------------------------------------------------------------------
37836# $File: usd,v 1.2 2020/05/21 22:17:00 christos Exp $
37837#
37838# From Christian Schmidbauer
37839#
37840# https://github.com/PixarAnimationStudios/USD
37841
37842# USD crate file
37843# https://github.com/PixarAnimationStudios/USD/blob/ebac0a8b6703f4fa1c27115f1f013bb9819662f4/pxr/usd/usd/crateFile.h#L441-L450
378440	string		PXR-USDC	USD crate
37845>8	byte		x		\b, version %x.
37846>9	byte		x		\b%x.
37847>10	byte		x		\b%x
37848!:ext	usd
37849
37850# USD ASCII file
378510	string		#usda\040	USD ASCII
37852>6	string		x		\b, version %s
37853!:mime	text/plain
37854!:ext	usd
37855
37856#------------------------------------------------------------------------------
37857# $File: uterus,v 1.3 2014/04/30 21:41:02 christos Exp $
37858# file(1) magic for uterus files
37859# http://freecode.com/projects/uterus
37860#
378610	string		UTE+	uterus file
37862>4	string		v	\b, version
37863>5	byte		x	%c
37864>6	string		.	\b.
37865>7	byte		x	\b%c
37866>8	string		\<\>	\b, big-endian
37867>>16	belong		>0	\b, slut size %u
37868>8	string		\>\<	\b, litte-endian
37869>>16	lelong		>0	\b, slut size %u
37870>10	byte		&8	\b, compressed
37871
37872#------------------------------------------------------------------------------
37873# $File: uuencode,v 1.9 2021/11/13 17:48:10 christos Exp $
37874# uuencode:  file(1) magic for ASCII-encoded files
37875#
37876
37877# The first line of xxencoded files is identical to that in uuencoded files,
37878# but the first character in most subsequent lines is 'h' instead of 'M'.
37879# (xxencoding uses lowercase letters in place of most of uuencode's
37880# punctuation and survives BITNET gateways better.)
378810		regex/1024	\^begin\040[0-7]{3}\040
37882>&0		regex/256	[\012\015]+M[\040-\140]{60}[\012\015]+				uuencoded text
37883>&0		regex/256	[\012\015]+h[0-9A-Za-z\053\055]{60}[\012\015]+		xxencoded text
37884>&0		default		x													uuencoded or xxencoded text
37885>&0		string		>\0													\b, file name "%s"
37886
37887# btoa(1) is an alternative to uuencode that requires less space.
378880	search/1	xbtoa\ Begin	btoa'd text
37889
37890# ship(1) is another, much cooler alternative to uuencode.
37891# Greg Roelofs, newt@uchicago.edu
378920	search/1	$\012ship	ship'd binary text
37893
37894# bencode(8) is used to encode compressed news batches (Bnews/Cnews only?)
37895# Greg Roelofs, newt@uchicago.edu
378960	search/1	Decode\ the\ following\ with\ bdeco	bencoded News text
37897
37898# GRR: handle BASE64
37899
37900#------------------------------------------------------------------------------
37901# $File: vacuum-cleaner,v 1.1 2015/11/14 13:38:35 christos Exp $
37902# vacuum cleaner magic by Thomas M. Ott (ThMO)
37903#
37904# navigation map for LG robot vacuum cleaner models VR62xx, VR64xx, VR63xx
37905# file: MAPDATAyyyymmddhhmmss_xxxxxx_cc.blk
37906# -> yyyymmdd: year, month, day of cleaning
37907# -> hhmmss: hour, minute, second of cleaning
37908# -> xxxxxx: 6 digits
37909# -> cc: cleaning runs counter
37910# size: 136044 bytes
37911#
37912# struct maphdr {
37913#     int32_t  map_cnt;	     /*  0: single map */
37914#     int32_t  min_ceil;     /*  4: 100 mm == 10 cm == min. ceil */
37915#     int32_t  max_ceil;     /*  8: 10000 mm == 100 m == max. ceil */
37916#     int32_t  max_climb;    /* 12: 50 mm = 5 cm == max. height to climb */
37917#     int32_t  unknown;	     /* 16: 50000 ??? */
37918#     int32_t  cell_bytes;   /* 20: # of bytes for cells per block */
37919#     int32_t  block_max;    /* 24: 1000 == max. # of blocks */
37920#     int32_t  route_max;    /* 28: 1000 == max. # of routes */
37921#     int32_t  used_blocks;  /* 32: 5/45/33/... == # of block entries used! */
37922#     int32_t  cell_dim;     /* 36: 10 == cell dimension */
37923#     int32_t  clock_tick;   /* 40: 100 == clock ticks */
37924# #if	0
37925#     struct {		     /* 44: 1000 blocks for 10x10 cells */
37926#         int32_t  yoffset;
37927#         int32_t  xoffset;
37928#         int32_t  posxy;
37929#         int32_t  timecode;
37930#       }      blocks[ 1000];
37931#     char     cells[ 1000* 100]; /* 16044: 1000 10x10 cells */
37932#     int16_t  routes[ 1000* 10]; /* 116044: 1000 10-routes */
37933# #endif
37934#   };
37935
379360                lelong =1
37937>4               lelong =100
37938>>8              lelong =10000
37939>>>12            lelong =50
37940>>>>16           lelong =50000
37941>>>>>20          lelong =100
37942>>>>>>24         lelong =1000
37943>>>>>>>28        lelong =1000
37944>>>>>>>>36       lelong =10
37945>>>>>>>>>40      lelong =100
37946>>>>>>>>>>32     lelong x       LG robot VR6[234]xx %dm^2 navigation
37947>>>>>>>>>>136040 lelong =-1     reuse map data
37948>>>>>>>>>>136040 lelong =0      map data
37949>>>>>>>>>>136040 lelong >0      spurious map data
37950>>>>>>>>>>136040 lelong <-1     spurious map data
37951
37952
37953
37954#------------------------------------------------------------------------------
37955# $File: varied.out,v 1.23 2014/04/30 21:41:02 christos Exp $
37956# varied.out:  file(1) magic for various USG systems
37957#
37958#	Herewith many of the object file formats used by USG systems.
37959#	Most have been moved to files for a particular processor,
37960#	and deleted if they duplicate other entries.
37961#
379620	short		0610		Perkin-Elmer executable
37963# AMD 29K
379640	beshort		0572		amd 29k coff noprebar executable
379650	beshort		01572		amd 29k coff prebar executable
379660	beshort		0160007		amd 29k coff archive
37967# Cray
379686	beshort		0407		unicos (cray) executable
37969# Ultrix 4.3
37970596	string		\130\337\377\377	Ultrix core file
37971>600	string		>\0		from '%s'
37972# BeOS and MAcOS PEF executables
37973# From: hplus@zilker.net (Jon Watte)
379740	string		Joy!peffpwpc	header for PowerPC PEF executable
37975#
37976# ava assembler/linker Uros Platise <uros.platise@ijs.si>
379770       string          avaobj  AVR assembler object code
37978>7      string          >\0     version '%s'
37979# gnu gmon magic From: Eugen Dedu <dedu@ese-metz.fr>
379800	string		gmon		GNU prof performance data
37981>4	long		x		- version %d
37982# From: Dave Pearson <davep@davep.org>
37983# Harbour <URL:http://harbour-project.org/> HRB files.
379840	string		\xc0HRB		Harbour HRB file
37985>4	leshort		x		version %d
37986# Harbour HBV files
379870	string		\xc0HBV		Harbour variable dump file
37988>4	leshort		x		version %d
37989
37990# From: Alex Beregszaszi <alex@fsn.hu>
37991# 0	string		exec 		BugOS executable
37992# 0	string		pack		BugOS archive
37993
37994# From: Jason Spence <jspence@lightconsulting.com>
37995# Generated by the "examples" in STM's ST40 devkit, and derived code.
379960	lelong		0x13a9f17e	ST40 component image format
37997>4	string		>\0		\b, name '%s'
37998
37999#------------------------------------------------------------------------------
38000# $File: varied.script,v 1.13 2019/10/11 14:35:29 christos Exp $
38001# varied.script:  file(1) magic for various interpreter scripts
38002
380030	string/t		#!\ /			a
38004>3	string		>\0			%s script text executable
38005!:strength / 2
38006
380070	string/b		#!\ /			a
38008>3	string		>\0			%s script executable (binary data)
38009!:strength / 2
38010
380110	string/t		#!\t/			a
38012>3	string		>\0			%s script text executable
38013!:strength / 2
38014
380150	string/b		#!\t/			a
38016>3	string		>\0			%s script executable (binary data)
38017!:strength / 2
38018
380190	string/t		#!/			a
38020>2	string		>\0			%s script text executable
38021!:strength / 2
38022
380230	string/b		#!/			a
38024>2	string		>\0			%s script executable (binary data)
38025!:strength / 2
38026
380270	string/t		#!\ 			script text executable
38028>3	string		>\0			for %s
38029!:strength / 2
38030
380310	string/b		#!\ 			script executable
38032>3	string		>\0			for %s (binary data)
38033!:strength / 2
38034
38035# using env
380360	string/t	#!/usr/bin/env		a
38037>15	string/t	>\0			%s script text executable
38038!:strength / 10
38039
380400	string/b	#!/usr/bin/env		a
38041>15	string/b	>\0			%s script executable (binary data)
38042!:strength / 10
38043
380440	string/t	#!\ /usr/bin/env	a
38045>16	string/t	>\0			%s script text executable
38046!:strength / 10
38047
380480	string/b	#!\ /usr/bin/env	a
38049>16	string/b	>\0			%s script executable (binary data)
38050!:strength / 10
38051
38052# From: arno <arenevier@fdn.fr>
38053# mozilla xpconnect typelib
38054# see https://www.mozilla.org/scriptable/typelib_file.html
380550	string 		XPCOM\nTypeLib\r\n\032		XPConnect Typelib
38056>0x10  byte        x       version %d
38057>>0x11 byte        x      \b.%d
38058
38059#------------------------------------------------------------------------------
38060# $File: vax,v 1.10 2019/10/04 18:07:46 christos Exp $
38061# vax:  file(1) magic for VAX executable/object and APL workspace
38062#
380630	lelong		0101557		VAX single precision APL workspace
380640	lelong		0101556		VAX double precision APL workspace
38065
38066#
38067# VAX a.out (BSD; others collide with 386 and other 32-bit little-endian
38068# executables, and are handled in aout)
38069#
380700	lelong		0420		a.out VAX demand paged (first page unmapped) pure executable
38071>16	lelong		>0		not stripped
38072
38073#
38074# VAX COFF
38075#
38076# The `versions' were commented out, but have been un-commented out.
38077# (Was the problem just one of endianness?)
38078#
380790	leshort		0570
38080>2	uleshort	<100		VAX COFF executable, sections %d
38081>>4	ledate		x		\b, created %s
38082>>12	lelong		>0		\b, not stripped
38083>>22	leshort		>0		\b, version %d
38084
380850	leshort		0575
38086>2	uleshort	<100		VAX COFF pure executable, sections %d
38087>>4	ledate		x		\b, created %s
38088>>12	lelong		>0		\b, not stripped
38089>>22	leshort		>0		\b, version %d
38090
38091#------------------------------------------------------------------------------
38092# $File: vicar,v 1.4 2009/09/19 16:28:13 christos Exp $
38093# vicar:  file(1) magic for VICAR files.
38094#
38095# From: Ossama Othman <othman@astrosun.tn.cornell.edu
38096# VICAR is JPL's in-house spacecraft image processing program
38097# VICAR image
380980	string	LBLSIZE=	VICAR image data
38099>32	string	BYTE		\b, 8 bits  = VAX byte
38100>32	string	HALF		\b, 16 bits = VAX word     = Fortran INTEGER*2
38101>32	string	FULL		\b, 32 bits = VAX longword = Fortran INTEGER*4
38102>32	string	REAL		\b, 32 bits = VAX longword = Fortran REAL*4
38103>32	string	DOUB		\b, 64 bits = VAX quadword = Fortran REAL*8
38104>32	string	COMPLEX		\b, 64 bits = VAX quadword = Fortran COMPLEX*8
38105# VICAR label file
3810643	string	SFDU_LABEL	VICAR label file
38107
38108#------------------------------------------------------------------------------
38109# $File: virtual,v 1.17 2022/08/23 08:00:54 christos Exp $
38110# From: James Nobis <quel@quelrod.net>
38111# Microsoft hard disk images for:
38112# Virtual Server
38113# Virtual PC
38114# VirtualBox
38115# URL: http://fileformats.archiveteam.org/wiki/VHD_(Virtual_Hard_Disk)
38116# Reference: https://download.microsoft.com/download/f/f/e/ffef50a5-07dd-4cf8-aaa3-442c0673a029/
38117# Virtual%20Hard%20Disk%20Format%20Spec_10_18_06.doc
381180	string	conectix	Microsoft Disk Image, Virtual Server or Virtual PC
38119# alternative shorter names
38120#0	string	conectix	Microsoft Virtual Hard Disk image
38121#0	string	conectix	Microsoft Virtual HD image
38122!:mime	application/x-virtualbox-vhd
38123!:ext   vhd
38124# Features is a bit field used to indicate specific feature support
38125#>8	ubelong		!0x00000002	\b, Features %#x
38126# Reserved. This bit must always be set to 1.
38127#>8	ubelong		&0x00000002	\b, Reserved %#x
38128# File Format Version for the current specification 0x00010000
38129#>12	ubelong		!0x00010000	\b, Version %#8.8x
38130# Data Offset only found 0x200
38131#>16	ubequad		!0x200		\b, Data Offset %#llx
38132#>16	ubequad		x		\b, at %#llx
38133# Dynamic Disk Header cookie like cxsparse
38134#>(16.Q)	string		x		"%-.8s"
38135# This field contains a Unicode string (UTF-16) of the parent hard disk filename
38136#>(16.Q+64)	ubequad	x		\b, parent name %#llx
38137# Creator Application
38138# vpc~Microsoft Virtual PC, vs~Microsoft Virtual Server, vbox~VirtualBox, d2v~disk2vhd
38139>28	string		x		\b, Creator %-4.4s
38140# Creator Version: 0x00010000~Virtual Server 2004, 0x00050000~Virtual PC 2004
38141# holds the major/minor version of the application that created the image
38142>32	ubeshort	x		%x
38143>34	ubeshort	x		\b.%x
38144#>32	ubelong		x		\b, Version %#8.8x
38145# Creator Host OS: 0x5769326B~Windows (Wi2k), 0x4D616320~Macintosh (Mac)
38146>36	ubelong		x		(
38147>>36	ubelong		0x5769326B	\bW2k
38148>>36	ubelong		0x4D616320	\bMac
38149>>36	default		x		\b0x
38150>>>36	ubelong		x		\b%8.8x
38151# creation Time in seconds since 1 Jan 2000 UTC~946684800 sec. since Unix Epoch
38152>24	bedate+946684800	x	\b) %s
38153# Original Size
38154#>40	ubequad		x		\b, o.-Size %#llx
38155# Current Size is same as original size, but change when disk is expanded
38156#>48	ubequad		x		\b, Size %#llx
38157>48	ubequad		x		\b, %llu bytes
38158# Disk Geometry: cylinder, heads, and sectors/track for hard disk
38159#>56	ubeshort	x		\b, Cylinder %#x
38160>56	ubeshort	x		\b, CHS %u
38161# Heads
38162#>58	ubyte		x		\b, Heads %#x
38163>58	ubyte		x		\b/%u
38164# Sectors per track
38165#>59	ubyte		x		\b, Sectors %#x
38166>59	ubyte		x		\b/%u
38167# Disk Type: 3~Dynamic hard disk
38168>60	ubelong		!0x3		\b, type %#x
38169# Checksum
38170#>64	ubelong		x		\b, cksum %#x
38171# universally unique identifier (UUID) to associate a parent with its differencing image
38172#>68	ubequad		x		\b, id %#16.16llx
38173#>76	ubequad		x		\b-%16.16llx
38174# Saved State: 1~Saved State
38175>84	ubyte		!0		\b, State %#x
38176# Reserved 427 bytes with nils
38177#>85	ubequad	!0			\b, Reserved %#16.16llx
38178
38179# From: Joerg Jenderek
38180# URL: https://msdn.microsoft.com/en-us/library/mt740058.aspx
38181# Reference: https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/
38182# MS-VHDX/[MS-VHDX].pdf
38183# Note: extends the VHD format with new capabilities, such as a 16TB maximum size
38184# TODO:	find and display values like virtual size, disk size, cluster_size, etc
38185#	display id in GUID format
38186#
38187# VHDX_FILE_IDENTIFIER signature 0x656C696678646876
381880	string			vhdxfile
38189# VHDX_HEADER signature. 1 header is stored at offset 64KB and the other at 128KB
38190>0x10000	string		head		Microsoft Disk Image eXtended
38191#>0x20000	string			head	\b, 2nd header
38192#!:mime	application/x-virtualbox-vhdx
38193!:ext	vhdx
38194# Creator[256] like "QEMU v3.0.0", "Microsoft Windows 6.3.9600.18512"
38195>>8		lestring16		x	\b, by %.256s
38196# The Checksum field is a CRC-32C hash over the entire 4 KB structure
38197#>>0x10004	ulelong			x	\b, CRC %#x
38198# SequenceNumber
38199>>0x10008	ulequad			x	\b, sequence %#llx
38200# FileWriteGuid
38201#>>0x10010	ubequad			x	\b, file id %#llx
38202#>>>0x10018	ubequad			x	\b-%llx
38203# DataWriteGuid
38204#>>0x10020	ubequad			x	\b, data id %#llx
38205#>>>0x10028	ubequad			x	\b-%llx
38206# LogGuid. If this field is zero, then the log is empty or has no valid entries
38207>>0x10030	ubequad			>0	\b, log id %#llx
38208>>>0x10038	ubequad			x	\b-%llx
38209# LogVersion. If not 0 there is a log to replay
38210>>0x10040	uleshort		>0	\b, LogVersion %#x
38211# Version. This field must be set to 1
38212>>0x10042	uleshort		!1	\b, Version %#x
38213# LogLength must be multiples of 1 MB
38214>>0x10044	ulelong/1048576		>1	\b, LogLength %u MB
38215# LogOffset (normally 0x100000 when log direct after header); multiples of 1 MB
38216>>0x10048	ulequad			!0x100000 \b, LogOffset %#llx
38217# Log Entry Signature must be 0x65676F6C~loge
38218>>(0x10048.q)	ulelong			!0x65676F6C \b, NO Log Signature
38219>>(0x10048.q)	ulelong			=0x65676F6C	\b; LOG
38220# Log Entry Checksum
38221#>>>(0x10048.q+4)	ulelong		x	\b, Log CRC %#x
38222# Log Entry Length must be a multiple of 4 KB
38223>>>(0x10048.q+8)	ulelong/1024	>4	\b, EntryLength %u KB
38224# Log Entry Tail must be a multiple of 4 KB
38225#>>>(0x10048.q+12)	ulelong		x	\b, Tail %#x
38226# Log Entry SequenceNumber
38227#>>>(0x10048.q+16)	ulequad		x	\b, # %#llx
38228# Log Entry DescriptorCount may be zero. only 4 bytes in other docs instead 8
38229#>>>(0x10048.q+24)	ulelong		x	\b, DescriptorCount %#llx
38230# Log Entry Reserved must be set to 0
38231>>>(0x10048.q+28)	ulelong		!0	\b, Reserved %#x
38232# Log Entry LogGuid
38233#>>>(0x10048.q+32)	ubequad		x	\b, Log id %#llx
38234#>>>(0x10048.q+40)	ubequad		x	\b-%llx
38235# Log Entry FlushedFileOffset should VHDX size when entry is written.
38236#>>>(0x10048.q+48)	ulequad		x	\b, FlushedFileOffset %llu
38237# Log Entry LastFileOffset
38238#>>>(0x10048.q+56)	ulequad		x	\b, LastFileOffset %llu
38239# filling
38240#>>>(0x10048.q+64)	ulequad		>0	\b, filling %llx
38241# Reserved[4016]
38242#>>0x10050	ulequad			>0	\b, Reserved %#llx
38243# VHDX_REGION_TABLE_HEADER Signature 0x69676572~regi at offset 192 KB and 256 KB
38244>0x30000	ulelong			!0x69676572 \b, 1st region INVALID
38245>0x30000	ulelong			=0x69676572 \b; region
38246# region Checksum. CRC-32C hash over the entire 64-KB table
38247#>>0x30004	ulelong			x	\b, CRC %#x
38248# The EntryCount specifies number of valid entries; Found 2; This must be =< 2047.
38249>>0x30008	ulelong			x	\b, %u entries
38250# reserved must be zero
38251#>>0x3000C	ulelong			!0	\b, RESERVED %#x
38252# Region Table Entry starts with identifier for the object. often BAT id
38253>>0x30010	use			vhdx-id
38254# FileOffset
38255>>0x30020	ulequad		x		\b, at %#llx
38256# Length. Specifies the length of the object within the file
38257#>>0x30028	ulelong		x		\b, Length %#x
38258# 1 means region entry is required. if region not recognized, then REFUSE to load VHDX
38259>>0x3002C	ulelong		x		\b, Required %u
38260# 2nd region entry often metadata id
38261>>0x30030	use			vhdx-id
38262# 2nd entry FileOffset
38263>>0x30040	ulequad		x		\b, at %#llx
38264# 1 means region entry is required. if region not recognized, then REFUSE to load VHDX
38265>>0x3004C	ulelong		x		\b, Required %u
38266# 2nd region
38267>>0x40000	ulelong		!0x69676572	\b, 2nd region INVALID
38268# check in vhdx images for known id and show names instead hexadecimal
382690	name		vhdx-id
38270# https://www.windowstricks.in/online-windows-guid-converter
38271# 2DC27766-F623-4200-9D64-115E9BFD4A08		BAT GUID
38272# 6677C22D23F600429D64115E9BFD4A08		BAT ID
38273>0	ubequad		=0x6677C22D23F60042
38274>>8	ubequad		=0x9D64115E9BFD4A08	\b, id BAT
38275# no BAT id
38276>>8	default		x
38277>>>0	use		vhdx-id-hex
38278# 8B7CA206-4790-4B9A-B8FE-575F050F886E		Metadata region GUID
38279# 06A27C8B90479A4BB8FE575F050F886E		Metadata region ID
38280>0	ubequad		=0x06A27C8B90479A4B
38281>>8	ubequad		=0xB8FE575F050F886E	\b, id Metadata
38282# no Metadata id
38283>>8	default		x
38284>>>0	use		vhdx-id-hex
38285# 2FA54224-CD1B-4876-B211-5DBED83BF4B8		Virtual Disk Size GUID
38286# 2442A52F1BCD7648B2115DBED83BF4B8		Virtual Disk Size ID
38287# value "virtual size" can be verified by command `qemu-img info `
38288>0	ubequad		=0x2442A52F1BCD7648
38289>>8	ubequad		=0xB2115DBED83BF4B8	\b, id vsize
38290# no Virtual Disk Size ID
38291>>8	default		x
38292>>>0	use		vhdx-id-hex
38293# other ids
38294>0	default		x
38295>>0	use		vhdx-id-hex
38296# in vhdx images show id as hexadecimal
382970	name		vhdx-id-hex
38298>0	ubequad		x			\b, ID %#16.16llx
38299>8	ubequad		x			\b-%16.16llx
38300#
38301# libvirt
38302# From: Philipp Hahn <hahn@univention.de>
383030	string	LibvirtQemudSave	Libvirt QEMU Suspend Image
38304>0x10	lelong	x	\b, version %u
38305>0x14	lelong	x	\b, XML length %u
38306>0x18	lelong	1	\b, running
38307>0x1c	lelong	1	\b, compressed
38308
383090	string	LibvirtQemudPart	Libvirt QEMU partial Suspend Image
38310# From: Alex Beregszaszi <alex@fsn.hu>
383110	string/b	COWD		VMWare3
38312>4	byte	3		disk image
38313>>32	lelong	x		(%d/
38314>>36	lelong	x		\b%d/
38315>>40	lelong	x		\b%d)
38316>4	byte	2		undoable disk image
38317>>32	string	>\0		(%s)
38318
383190	string/b	VMDK		 VMware4 disk image
383200	string/b	KDMV		 VMware4 disk image
38321
38322#--------------------------------------------------------------------
38323# Qemu Emulator Images
38324# Lines written by Friedrich Schwittay (f.schwittay@yousable.de)
38325# Updated by Adam Buchbinder (adam.buchbinder@gmail.com)
38326# Made by reading sources, reading documentation, and doing trial and error
38327# on existing QCOW files
383280	string/b	QFI\xFB	QEMU QCOW Image
38329!:mime	application/x-qemu-disk
38330
38331# Uncomment the following line to display Magic (only used for debugging
38332# this magic number)
38333#>0	string/b	x	, Magic: %s
38334
38335# There are currently 2 Versions: "1" and "2".
38336# https://www.gnome.org/~markmc/qcow-image-format-version-1.html
38337>4	belong		x	(v%d)
38338
38339# Using the existence of the Backing File Offset to determine whether
38340# to read Backing File Information
38341>>12	belong	 >0	 \b, has backing file (
38342# Note that this isn't a null-terminated string; the length is actually
38343# (16.L). Assuming a null-terminated string happens to work usually, but it
38344# may spew junk until it reaches a \0 in some cases.
38345>>>(12.L)	 string >\0	\bpath %s
38346
38347# Modification time of the Backing File
38348# Really useful if you want to know if your backing
38349# file is still usable together with this image
38350>>>>20	bedate >0	\b, mtime %s)
38351>>>>20	default x	\b)
38352
38353# Size is stored in bytes in a big-endian u64.
38354>>24	bequad	x	 \b, %lld bytes
38355
38356# 1 for AES encryption, 0 for none.
38357>>36	belong	1	\b, AES-encrypted
38358
38359# https://www.gnome.org/~markmc/qcow-image-format.html
38360>4	belong	2	(v2)
38361# Using the existence of the Backing File Offset to determine whether
38362# to read Backing File Information
38363>>8	bequad  >0	 \b, has backing file
38364# Note that this isn't a null-terminated string; the length is actually
38365# (16.L). Assuming a null-terminated string happens to work usually, but it
38366# may spew junk until it reaches a \0 in some cases. Also, since there's no
38367# .Q modifier, we just use the bottom four bytes as an offset. Note that if
38368# the file is over 4G, and the backing file path is stored after the first 4G,
38369# the wrong filename will be printed. (This should be (8.Q), when that syntax
38370# is introduced.)
38371>>>(12.L)	 string >\0	(path %s)
38372>>24	bequad	x	\b, %lld bytes
38373>>32	belong	1	\b, AES-encrypted
38374
38375>4	belong	3	(v3)
38376# Using the existence of the Backing File Offset to determine whether
38377# to read Backing File Information
38378>>8	bequad  >0	 \b, has backing file
38379# Note that this isn't a null-terminated string; the length is actually
38380# (16.L). Assuming a null-terminated string happens to work usually, but it
38381# may spew junk until it reaches a \0 in some cases. Also, since there's no
38382# .Q modifier, we just use the bottom four bytes as an offset. Note that if
38383# the file is over 4G, and the backing file path is stored after the first 4G,
38384# the wrong filename will be printed. (This should be (8.Q), when that syntax
38385# is introduced.)
38386>>>(12.L)	 string >\0	(path %s)
38387>>24	bequad	x	\b, %lld bytes
38388>>32	belong	1	\b, AES-encrypted
38389
38390>4	default x	(unknown version)
38391
383920	string/b	QEVM		QEMU suspend to disk image
38393
38394# QEMU QED Image
38395# https://wiki.qemu.org/Features/QED/Specification
383960	string/b	QED\0		QEMU QED Image
38397
38398# VDI Image
38399# Sun xVM VirtualBox Disk Image
38400# From: Richard W.M. Jones <rich@annexia.org>
38401# VirtualBox Disk Image
384020x40	ulelong		0xbeda107f	VirtualBox Disk Image
38403>0x44	uleshort	>0		\b, major %u
38404>0x46	uleshort	>0		\b, minor %u
38405>0	string		>\0		(%s)
38406>368	lequad		x		 \b, %lld bytes
38407
384080	string/b	Bochs\ Virtual\ HD\ Image	Bochs disk image,
38409>32	string	x				type %s,
38410>48	string	x				subtype %s
38411
384120	lelong	0x02468ace			Bochs Sparse disk image
38413
38414
38415#------------------------------------------------------------------------------
38416# $File: virtutech,v 1.4 2009/09/19 16:28:13 christos Exp $
38417# Virtutech Compressed Random Access File Format
38418#
38419# From <gustav@virtutech.com>
384200      string          \211\277\036\203        Virtutech CRAFF
38421>4     belong          x               v%d
38422>20    belong          0               uncompressed
38423>20    belong          1               bzipp2ed
38424>20    belong          2               gzipped
38425>24    belong          0               not clean
38426
38427#------------------------------------------------------------------------------
38428# $File: visx,v 1.5 2009/09/19 16:28:13 christos Exp $
38429# visx:  file(1) magic for Visx format files
38430#
384310	short		0x5555		VISX image file
38432>2	byte		0		(zero)
38433>2	byte		1		(unsigned char)
38434>2	byte		2		(short integer)
38435>2	byte		3		(float 32)
38436>2	byte		4		(float 64)
38437>2	byte		5		(signed char)
38438>2	byte		6		(bit-plane)
38439>2	byte		7		(classes)
38440>2	byte		8		(statistics)
38441>2	byte		10		(ascii text)
38442>2	byte		15		(image segments)
38443>2	byte		100		(image set)
38444>2	byte		101		(unsigned char vector)
38445>2	byte		102		(short integer vector)
38446>2	byte		103		(float 32 vector)
38447>2	byte		104		(float 64 vector)
38448>2	byte		105		(signed char vector)
38449>2	byte		106		(bit plane vector)
38450>2	byte		121		(feature vector)
38451>2	byte		122		(feature vector library)
38452>2	byte		124		(chain code)
38453>2	byte		126		(bit vector)
38454>2	byte		130		(graph)
38455>2	byte		131		(adjacency graph)
38456>2	byte		132		(adjacency graph library)
38457>2	string		.VISIX		(ascii text)
38458
38459#------------------------------------------------------------------------------
38460# $File: vms,v 1.10 2017/03/17 21:35:28 christos Exp $
38461# vms:  file(1) magic for VMS executables (experimental)
38462#
38463# VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu)
38464
38465# GRR 950122:  I'm just guessing on these, based on inspection of the headers
38466# of three executables each for Alpha and VAX architectures.  The VAX files
38467# all had headers similar to this:
38468#
38469#   00000  b0 00 30 00 44 00 60 00  00 00 00 00 30 32 30 35  ..0.D.`.....0205
38470#   00010  01 01 00 00 ff ff ff ff  ff ff ff ff 00 00 00 00  ................
38471#
384720	string	\xb0\0\x30\0	VMS VAX executable
38473>44032	string	PK\003\004	\b, Info-ZIP SFX archive v5.12 w/decryption
38474#
38475# The AXP files all looked like this, except that the byte at offset 0x22
38476# was 06 in some of them and 07 in others:
38477#
38478#   00000  03 00 00 00 00 00 00 00  ec 02 00 00 10 01 00 00  ................
38479#   00010  68 00 00 00 98 00 00 00  b8 00 00 00 00 00 00 00  h...............
38480#   00020  00 00 07 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
38481#   00030  00 00 00 00 01 00 00 00  00 00 00 00 00 00 00 00  ................
38482#   00040  00 00 00 00 ff ff ff ff  ff ff ff ff 02 00 00 00  ................
38483#
38484# GRR this test is still too general as it catches example adressen.dbt
384850	belong	0x03000000
38486>8	ubelong	0xec020000	VMS Alpha executable
38487>>75264	string	PK\003\004	\b, Info-ZIP SFX archive v5.12 w/decryption
38488
38489#------------------------------------------------------------------------------
38490# $File: vmware,v 1.8 2017/03/17 21:35:28 christos Exp $
38491# VMware specific files (deducted from version 1.1 and log file entries)
38492# Anthon van der Neut (anthon@mnt.org)
384930	belong	0x4d52564e	VMware nvram
38494
38495#------------------------------------------------------------------------------
38496# $File: vorbis,v 1.26 2020/08/22 18:30:55 christos Exp $
38497# vorbis:  file(1) magic for Ogg/Vorbis files
38498#
38499# From Felix von Leitner <leitner@fefe.de>
38500# Extended by Beni Cherniavsky <cben@crosswinds.net>
38501# Further extended by Greg Wooledge <greg@wooledge.org>
38502#
38503# Most (everything but the number of channels and bitrate) is commented
38504# out with `##' as it's not interesting to the average user.  The most
38505# probable things advanced users would want to uncomment are probably
38506# the number of comments and the encoder version.
38507#
38508# FIXME: The first match has been made a search, so that it can skip
38509# over prepended ID3 tags. This will work for MIME type detection, but
38510# won't work for detecting other properties of the file (they all need
38511# to be made relative to the search). In any case, if the file has ID3
38512# tags, the ID3 information will be printed, not the Ogg information,
38513# so until that's fixed, this doesn't matter.
38514# FIXME[2]: Disable the above for now, since search assumes text mode.
38515#
38516# --- Ogg Framing ---
38517#0		search/1000	OggS		Ogg data
385180		string	OggS		Ogg data
38519>4		byte		!0		UNKNOWN REVISION %u
38520##>4		byte		0		revision 0
38521>4		byte		0
38522##>>14		lelong		x		(Serial %lX)
38523# non-Vorbis content: FLAC (Free Lossless Audio Codec, http://flac.sourceforge.net)
38524>>28		string		\x7fFLAC	\b, FLAC audio
38525# non-Vorbis content: Theora
38526!:mime		audio/ogg
38527>>28		string		\x80theora	\b, Theora video
38528!:mime		video/ogg
38529# non-Vorbis content: Kate
38530>>28		string		\x80kate\0\0\0\0	\b, Kate (Karaoke and Text)
38531!:mime		application/ogg
38532>>>37		ubyte		x		v%u
38533>>>38		ubyte		x		\b.%u,
38534>>>40		byte		0		utf8 encoding,
38535>>>40		byte		!0		unknown character encoding,
38536>>>60		string		>\0		language %s,
38537>>>60		string		\0		no language set,
38538>>>76		string		>\0		category %s
38539>>>76		string		\0		no category set
38540# non-Vorbis content: Skeleton
38541>>28		string		fishead\0	\b, Skeleton
38542!:mime		video/ogg
38543>>>36		leshort		x		v%u
38544>>>40		leshort		x		\b.%u
38545# non-Vorbis content: Speex
38546>>28		string		Speex\ \ \ 	\b, Speex audio
38547!:mime		audio/ogg
38548# non-Vorbis content: OGM
38549>>28		string		\x01video\0\0\0	\b, OGM video
38550!:mime		video/ogg
38551>>>37		string/c	div3		(DivX 3)
38552>>>37		string/c	divx		(DivX 4)
38553>>>37		string/c	dx50		(DivX 5)
38554>>>37		string/c	xvid		(XviD)
38555# --- First vorbis packet - general header ---
38556>>28		string		\x01vorbis	\b, Vorbis audio,
38557!:mime		audio/ogg
38558>>>35		lelong		!0		UNKNOWN VERSION %u,
38559##>>>35		lelong		0		version 0,
38560>>>35		lelong		0
38561>>>>39		ubyte		1		mono,
38562>>>>39		ubyte		2		stereo,
38563>>>>39		ubyte		>2		%u channels,
38564>>>>40		lelong		x		%u Hz
38565# Minimal, nominal and maximal bitrates specified when encoding
38566>>>>48		string		<\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff	\b,
38567# The above tests if at least one of these is specified:
38568>>>>>52		lelong		!-1
38569# Vorbis RC2 has a bug which puts -1000 in the min/max bitrate fields
38570# instead of -1.
38571# Vorbis 1.0 uses 0 instead of -1.
38572>>>>>>52	lelong		!0
38573>>>>>>>52	lelong		!-1000
38574>>>>>>>>52	lelong		x		<%u
38575>>>>>48		lelong		!-1
38576>>>>>>48	lelong		x		~%u
38577>>>>>44		lelong		!-1
38578>>>>>>44	lelong		!-1000
38579>>>>>>>44	lelong		!0
38580>>>>>>>>44	lelong		x		>%u
38581>>>>>48		string		<\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff	bps
38582# -- Second vorbis header packet - the comments
38583# A kludge to read the vendor string.  It's a counted string, not a
38584# zero-terminated one, so file(1) can't read it in a generic way.
38585# libVorbis is the only one existing currently, so I detect specifically
38586# it.  The interesting value is the cvs date (8 digits decimal).
38587# Post-RC1 Ogg files have the second header packet (and thus the version)
38588# in a different place, so we must use an indirect offset.
38589>>>(84.b+85)		string		\x03vorbis
38590>>>>(84.b+96)		string/c	Xiphophorus\ libVorbis\ I	\b, created by: Xiphophorus libVorbis I
38591>>>>>(84.b+120)		string		>00000000
38592# Map to beta version numbers:
38593>>>>>>(84.b+120)	string		<20000508	(<beta1, prepublic)
38594>>>>>>(84.b+120)	string		20000508	(1.0 beta 1 or beta 2)
38595>>>>>>(84.b+120)	string		>20000508
38596>>>>>>>(84.b+120)	string		<20001031	(beta2-3)
38597>>>>>>(84.b+120)	string		20001031	(1.0 beta 3)
38598>>>>>>(84.b+120)	string		>20001031
38599>>>>>>>(84.b+120)	string		<20010225	(beta3-4)
38600>>>>>>(84.b+120)	string		20010225	(1.0 beta 4)
38601>>>>>>(84.b+120)	string		>20010225
38602>>>>>>>(84.b+120)	string		<20010615	(beta4-RC1)
38603>>>>>>(84.b+120)	string		20010615	(1.0 RC1)
38604>>>>>>(84.b+120)	string		20010813	(1.0 RC2)
38605>>>>>>(84.b+120)	string		20010816	(RC2 - Garf tuned v1)
38606>>>>>>(84.b+120)	string		20011014	(RC2 - Garf tuned v2)
38607>>>>>>(84.b+120)	string		20011217	(1.0 RC3)
38608>>>>>>(84.b+120)	string		20011231	(1.0 RC3)
38609# Some pre-1.0 CVS snapshots still had "Xiphphorus"...
38610>>>>>>(84.b+120)	string		>20011231	(pre-1.0 CVS)
38611# For the 1.0 release, Xiphophorus is replaced by Xiph.Org
38612>>>>(84.b+96)		string/c	Xiph.Org\ libVorbis\ I	\b, created by: Xiph.Org libVorbis I
38613>>>>>(84.b+117)		string		>00000000
38614>>>>>>(84.b+117)	string		<20020717	(pre-1.0 CVS)
38615>>>>>>(84.b+117)	string		20020717	(1.0)
38616>>>>>>(84.b+117)	string		20030909	(1.0.1)
38617>>>>>>(84.b+117)	string		20040629	(1.1.0 RC1)
38618>>>>>>(84.b+117)	string		20050304	(1.1.2)
38619>>>>>>(84.b+117)	string		20070622	(1.2.0)
38620>>>>>>(84.b+117)	string		20090624	(1.2.2)
38621>>>>>>(84.b+117)	string		20090709	(1.2.3)
38622>>>>>>(84.b+117)	string		20100325	(1.3.1)
38623>>>>>>(84.b+117)	string		20101101	(1.3.2)
38624>>>>>>(84.b+117)	string		20120203	(1.3.3)
38625>>>>>>(84.b+117)	string		20140122	(1.3.4)
38626>>>>>>(84.b+117)	string		20150105	(1.3.5)
38627
38628# non-Vorbis content: Opus https://tools.ietf.org/html/rfc7845#section-5
38629>>28		string		OpusHead	\b, Opus audio,
38630!:mime		audio/ogg
38631>>>36		ubyte		>0x0F		UNKNOWN VERSION %u,
38632>>>36		ubyte&0x0F	!0		version 0.%u,
38633>>>>46		ubyte		>1
38634>>>>>46		ubyte		!255		unknown channel mapping family %u,
38635>>>>>37		ubyte		x		%u channels
38636>>>>46		ubyte		0
38637>>>>>37		ubyte		1		mono
38638>>>>>37		ubyte		2		stereo
38639>>>>46		ubyte		1
38640>>>>>37		ubyte		1		mono
38641>>>>>37		ubyte		2		stereo
38642>>>>>37		ubyte		3		linear surround
38643>>>>>37		ubyte		4		quadraphonic
38644>>>>>37		ubyte		5		5.0 surround
38645>>>>>37		ubyte		6		5.1 surround
38646>>>>>37		ubyte		7		6.1 surround
38647>>>>>37		ubyte		8		7.1 surround
38648>>>>40		lelong		!0		\b, %u Hz (Input Sample Rate)
38649#------------------------------------------------------------------------------
38650# $File: vxl,v 1.4 2009/09/19 16:28:13 christos Exp $
38651# VXL: file(1) magic for VXL binary IO data files
38652#
38653# from Ian Scott <scottim@sf.net>
38654#
38655# VXL is a collection of C++ libraries for Computer Vision.
38656# See the vsl chapter in the VXL Book for more info
38657# http://www.isbe.man.ac.uk/public_vxl_doc/books/vxl/book.html
38658# http:/vxl.sf.net
38659
386602	lelong	0x472b2c4e	VXL data file,
38661>0	leshort	>0		schema version no %d
38662
38663#------------------------------------------------------------------------------
38664# $File: warc,v 1.4 2019/04/19 00:42:27 christos Exp $
38665# warc:  file(1) magic for WARC files
38666
386670	string	WARC/	WARC Archive
38668>5	string	x	version %.4s
38669!:mime application/warc
38670
38671#------------------------------------------------------------------------------
38672# Arc File Format from Internet Archive
38673# see https://www.archive.org/web/researcher/ArcFileFormat.php
386740      string          filedesc://     Internet Archive File
38675!:mime application/x-ia-arc
38676>11    search/256      \x0A    \b
38677>>&0   ubyte   >0      \b version %c
38678
38679#------------------------------------------------------------------------------
38680# weak:  file(1) magic for very weak magic entries, disabled by default
38681#
38682# These entries are so weak that they might interfere identification of
38683# other formats. Example include:
38684# - Only identify for 1 or 2 bytes
38685# - Match against very wide range of values
38686# - Match against generic word in some spoken languages (e.g. English)
38687
38688# Summary: Computer Graphics Metafile
38689# Extension: .cgm
38690#0	beshort&0xffe0	0x0020		binary Computer Graphics Metafile
38691#0	beshort		0x3020		character Computer Graphics Metafile
38692
38693#0	string		=!!		Bennet Yee's "face" format
38694
38695#------------------------------------------------------------------------------
38696# $File: web,v 1.1 2020/05/17 19:14:28 christos Exp $
38697
38698# http://www.rdfhdt.org/
38699# From Christoph Biedl
38700# http://www.rdfhdt.org/hdt-internals/
38701# https://github.com/rdfhdt/hdt-cpp
38702
387030	string	$HDT\x01 HDT file (binary compressed indexed RDF triples) type 1
38704!:mime application/vnd.hdt
38705!:ext hdt
38706#------------------------------------------------------------------------------
38707# $File: webassembly,v 1.4 2022/08/16 11:16:39 christos Exp $
38708# webassembly:  file(1) magic for WebAssembly modules
38709#
38710# WebAssembly is a virtual architecture developed by a W3C Community
38711# Group at https://webassembly.org/. The file extension is .wasm, and
38712# the MIME type is application/wasm.
38713#
38714# https://webassembly.org/docs/binary-encoding/ is the main
38715# document describing the binary format.
38716# From: Pip Cet <pipcet@gmail.com> and Joel Martin
38717
387180	string	\0asm	WebAssembly (wasm) binary module
38719>4	lelong	=1	version %#x (MVP)
38720!:mime  application/wasm
38721!:ext   wasm
38722>4	lelong	>1	version %#x
38723
38724#------------------------------------------------------------------------------
38725# $File: windows,v 1.46 2022/07/02 17:46:09 christos Exp $
38726# windows:  file(1) magic for Microsoft Windows
38727#
38728# This file is mainly reserved for files where programs
38729# using them are run almost always on MS Windows 3.x or
38730# above, or files only used exclusively in Windows OS,
38731# where there is no better category to allocate for.
38732# For example, even though WinZIP almost run on Windows
38733# only, it is better to treat them as "archive" instead.
38734# For format usable in DOS, such as generic executable
38735# format, please specify under "msdos" file.
38736#
38737
38738
38739# Summary: Outlook Express DBX file
38740# Created by: Christophe Monniez
38741# Update:	Joerg Jenderek
38742# URL:		http://fileformats.archiveteam.org/wiki/Outlook_Express_Database
38743# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/d/dbx.trid.xml
38744#		https://sourceforge.net/projects/ol2mbox/files/LibDBX/
38745#		v1.0.4/libdbx_1.0.4.tar.gz/FILE-FORMAT
38746# Note:		called "Outlook Express Database" by TrID and DROID via PUID fmt/838 fmt/839
38747#		and partly verified by `undbx --verbosity 4 Posteingang.dbx`
387480	string	\xCF\xAD\x12\xFE
38749# skip DROID fmt-838-signature-id-1193.dbx fmt-839-signature-id-1194.dbx by check for valid file size
38750>0x7C	ulelong	>0			MS Outlook Express DBX file
38751#!:mime		application/octet-stream
38752#!:mime		application/vnd.ms-outlook
38753!:mime		application/x-ms-dbx
38754!:ext	dbx
38755>>4	byte	=0xC5			\b, message database
38756>>4	byte	=0xC6			\b, folder database
38757>>4	byte	=0xC7			\b, account information
38758>>4	byte	=0x30			\b, offline database
38759# version like: 5.2 5.5 (typical)
38760>>20	ulequad	!0x0000000500000005	\b, version
38761# major version
38762>>>24	ulelong	x			%u
38763# minor version
38764>>>20	ulelong	x			\b.%u
38765# CLSID: 6F74FDC5-E366-11d1-9A4E-00C04FA309D4~Message 6F74FDC6-E366-11D1-9A4E-00C04FA309D4~Folder
38766# 26FE9D30-1A8F-11D2-AABF-006097D474C4~offline
38767#>>4	guid	x			\b, CLSID %s
38768# file size; total size of file; sometimes real size a little bit higher
38769>>0x7C	ulelong	x			\b, ~ %u bytes
38770# highest Email ID; the next email will have a number one higher than this
38771>>0x5c	ulelong	x			\b, highest ID %#x
38772# item count; number of items stored in this DBX file
38773>>0xC4	ulelong	x			\b, %u item
38774# plural s
38775>>0xC4	ulelong	!1			\bs
38776# index pointer; file offset pointing to a page of Data Indexes
38777>>0xE4	ulelong	>0			\b, index pointer %#x
38778
38779# From:		Joerg Jenderek
38780# URL:		http://fileformats.archiveteam.org/wiki/Nickfile
38781#		https://www.nirsoft.net/utils/outlook_nk2_edit.html
38782# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/n/nk2.trid.xml
38783#		https://github.com/libyal/libnk2/blob/main/documentation
38784#		Nickfile%20(NK2)%20format.asciidoc
38785# Note:		called "Outlook Nickfile" by TrID & TestDisk and
38786#		"Outlook Nickname File" by Microsoft Outlook and
38787#		"Outlook AutoComplete File" by Nirsoft NK2Edit
38788#		partly verfied by NK2Edit Raw Text Edit Mode
387890	ubelong		0x0DF0ADBA	MS Outlook Nickfile
38790#!:mime		application/octet-stream
38791#!:mime		application/vnd.ms-outlook
38792!:mime		application/x-ms-nickfile
38793!:ext	nk2/dat/bak
38794# nick is used by "older" Outlook; dat is used by "newer" Outlook (probably 2010 - 2016); bak is used for backup
38795#!:ext	nick/nk2/dat/bak
38796# Unknown; probably a version indicator like: 0000000Ah 0000000Ch
38797>4	ulelong		x		\b, probably version %u
38798# Unknown2; probably a version indicator like: 1 0
38799>8	ulelong		x		\b.%u
38800# number of rows (nickname or alias items) in file
38801>12	ulelong		x		\b, %u items
38802# number of item entries/columns/properties value like: 17h
38803>16	ulelong		x		\b, %u entries
38804# value type/property tag: 001Fh~4 bytes for data size of UTF-16 LE string
38805>20	uleshort	x		\b, value type %#4.4x
38806# entry type/property identifier: 6001h~PR_DOTSTUFF_STATE/PR_NICK_NAME_W
38807>22	uleshort	x		\b, entry type %#4.4x
38808# Reserved like: 0013FD90h
38809#>24	ulelong		x		\b, reserved %#8.8x
38810# value data array/Irrelevant Union like: 0000000004E31A80h
38811#>28	ulequad		x		\b, data %#16.16llx
38812# UTF-16
38813>20	uleshort	=0x001F
38814# unicode string bytes like: 2Ch
38815>>36	ulelong		x		\b, %u bytes
38816# unicode string value PT_UNICODE like: janesmith@contoso.org
38817>>40	lestring16	x		"%s"
38818
38819# Summary: Windows crash dump
38820# Extension: .dmp
38821# Created by: Andreas Schuster (https://computer.forensikblog.de/)
38822# Reference (1): https://computer.forensikblog.de/en/2008/02/64bit_magic.html
38823# Modified by (1): Abel Cheung (Avoid match with first 4 bytes only)
388240	string		PAGE
38825>4	string		DUMP		MS Windows 32bit crash dump
38826>>0x05c	byte            0		\b, no PAE
38827>>0x05c	byte            1		\b, PAE
38828>>0xf88	lelong		1		\b, full dump
38829>>0xf88	lelong		2		\b, kernel dump
38830>>0xf88	lelong		3		\b, small dump
38831>>0x068	lelong		x		\b, %d pages
38832>4	string		DU64		MS Windows 64bit crash dump
38833>>0xf98	lelong		1		\b, full dump
38834>>0xf98	lelong		2		\b, kernel dump
38835>>0xf98	lelong		3		\b, small dump
38836>>0x090	lequad		x		\b, %lld pages
38837
38838
38839# Summary: Vista Event Log
38840# Extension: .evtx
38841# Created by: Andreas Schuster (https://computer.forensikblog.de/)
38842# Reference (1): https://computer.forensikblog.de/en/2007/05/some_magic.html
388430	string		ElfFile\0	MS Windows Vista Event Log
38844>0x2a	leshort		x		\b, %d chunks
38845>>0x10	lelong		x		\b (no. %d in use)
38846>0x18	lelong		>1		\b, next record no. %d
38847>0x18	lelong		=1		\b, empty
38848>0x78	lelong		&1		\b, DIRTY
38849>0x78	lelong		&2		\b, FULL
38850
38851# Summary: Windows System Deployment Image
38852# Created by: Joerg Jenderek
38853# URL: http://en.wikipedia.org/wiki/System_Deployment_Image
38854# Reference: http://skolk.livejournal.com/1320.html
388550	string			$SDI
38856>4	string			0001		System Deployment Image
38857!:mime	application/x-ms-sdi
38858#!:mime	application/octet-stream
38859# \Boot\boot.sdi
38860!:ext	sdi
38861# MDBtype: 0~Unspecified 1~RAM 2~ROM
38862>>8	ulequad			!0		\b, MDBtype %#llx
38863# BootCodeOffset
38864>>16	ulequad			!0		\b, BootCodeOffset %#llx
38865# BootCodeSize
38866>>24	ulequad			!0		\b, BootCodeSize %#llx
38867# VendorID
38868>>32	ulequad			!0		\b, VendorID %#llx
38869# DeviceID
38870>>40	ulequad			!0		\b, DeviceID %#llx
38871# DeviceModel
38872>>48	ulequad			!0		\b, DeviceModel %#llx
38873>>>56	ulequad			!0		\b%llx
38874# DeviceRole
38875>>64	ulequad			!0		\b, DeviceRole %#llx
38876# Reserved1; reserved fields and gaps between BLOBs are padded with \0
38877#>>72	ulequad			!0		\b, Reserved1 %#llx
38878# RuntimeGUID
38879>>80	ulequad			!0		\b, RuntimeGUID %#llx
38880>>>88	ulequad			!0		\b%llx
38881# RuntimeOEMrev
38882>>96	ulequad			!0		\b, RuntimeOEMrev %#llx
38883# Reserved2
38884#>>104	ulequad			!0		\b, Reserved2 %#llx
38885# BLOB alignment value in pages, as specified in sdimgr /pack: 1~4K 2~8k
38886>>112	ulequad			!0		\b, PageAlignment %llu
38887# Reserved3[48]
38888#>>120	ulequad			!0		\b, Reserved3 %#llx
38889# SDI checksum 39h
38890>>0x1f8	ulequad			x		\b, checksum %#llx
38891# BLOBtype[8] \0-padded: PART, WIM , BOOT, LOAD, DISK
38892>>0x400	string			>\0		\b, type %-3.8s
38893# 0~non-filesystem 7~NTFS 6~BIGFAT
38894>>>0x420	ulequad		!0		(%#llx)
38895# ATTRibutes
38896>>>0x408	ulequad		!0		%#llx attributes
38897# Offset
38898>>>0x410	ulequad		x		at %#llx
38899# print 1 space after size and then handles NTFS boot sector by ./filesystems
38900>>>0x418	ulequad		>0		%llu bytes
38901>>>>(0x410.l)	indirect	x
38902# 2nd BLOB: WIM
38903>>0x440		string		>\0		\b, type %-3.8s
38904>>>0x428	ulequad		!0		(%#llx)
38905# ATTRibutes
38906>>>0x448	ulequad		!0		%#llx attributes
38907# Offset
38908>>>0x450	ulequad		x		at %#llx
38909>>>0x458	ulequad		>0		%llu bytes
38910>>>>(0x450.l)	indirect	x
38911# 3rd BLOB
38912>>0x480		string		>\0		\b, type %-3.8s
38913
38914# Summary:	Windows boot status log BOOTSTAT.DAT
38915# From:		Joerg Jenderek
38916# Reference:	https://www.geoffchappell.com/notes/windows/boot/bsd.htm
38917# Note:		mainly refers to older Windows Vista, sometimes
38918#		BOOTSTAT.DAT only contains nulls or invalid data
38919# checking for valid version below 5
389200		ulelong		<5
38921# skip many ISO images by checking for valid 64 KiB file size
38922>8		ulelong		=0x00010000
38923>>0		use		bootstat-dat
38924# display information of BOOTSTAT.DAT
389250	name		bootstat-dat
38926>0		ulelong		x		Windows boot log
38927#!:mime	application/octet-stream
38928!:mime	application/x-ms-dat
38929# BOOTSTAT.DAT in BOOT subdirectory
38930!:ext	dat
38931# apparently a version number: 2 for older like Vista, 3, 4 Windows 10
38932>0		ulelong		>2		\b, version %u
38933# apparently the size of the header: often 10h in older Windows, 14h, 18h
38934>4		ulelong		!0x10		\b, header size %#x
38935#>4		ulelong		!0x10		\b, header size %u
38936# apparently the size of the file: always 0x00010000~64KiB
38937# the file is acceptable to BOOTMGR only if it is exactly 64 KiB
38938>8		ulelong		!0x00010000	\b, file size %#x
38939# size of valid data, in bytes: C8h 50h 172h 5D5Ch
38940>0xc		ulelong		x		\b, %#x valid bytes
38941# skip header and jump to first bootstat entry and display information
38942>(0x4.l-1)	ubyte		x
38943>>&0		use		bootstat-entry
38944# jump to first entry again because pointer are bad after "use"
38945>(0x4.l-1)	ubyte		x
38946# by 1st entry size jump to 2nd entry and display information
38947>>&(&0x18.l-1)	ubyte		x
38948>>>&0		use		bootstat-entry
38949# jump to possible 3rd boot entry and display information
38950# >(0x4.l-1)	ubyte		x
38951# >>&(&0x18.l-1)	ubyte		x
38952# >>>&(&0x18.l-1)	ubyte		x
38953# >>>>&0		use		bootstat-entry
38954#	display BOOTSTAT.DAT entry
389550	name		bootstat-entry
38956#>0x00		ubequad		x		\b, ENTRY %16.16llx
38957# size of entry, in bytes: 40h(init) 78h(launced) 9Ch
38958#>0x18		ulelong		x		\b; entry size %u
38959>0x18		ulelong		x		\b; entry size %#x
38960# time stamp, in seconds
38961>0x00		ulelong		x		\b, %#x seconds
38962# always zero, significance unknown
38963>0x04		ulelong		!0		\b, not null %u
38964# GUID of event source; but empty if event source is BOOTMGR
38965>0x08		ubequad		!0		\b, GUID %#16.16llx
38966>>0x10		ubequad		x		\b%16.16llx
38967# severity code: 1~informational 3~errors
38968>0x1C		ulelong		!1		\b, severity %#x
38969# apparently a version number: 2
38970>0x20		ulelong		!2		\b, version %u
38971# event identifier 1~log file initialised 11h~boot application launched
38972#>0x24		ulelong		x		\b, event %#x
38973>0x24		ulelong		!1
38974>>0x24		ulelong		!0x11		\b, event %#x
38975# entry data; size depends on event identifier
38976#>0x28		ubequad		x		\b, data %#16.16llx
38977>0x24		ulelong		=0x1		\b, Init
38978# always 0, significance unknown
38979>>0x34		uleshort	!0		\b, not null %u
38980# always 7, significance unknown
38981>>0x36		uleshort	!7		\b, not seven %u
38982# year
38983>>0x28		uleshort	x		%u
38984# month
38985>>0x2A		uleshort	x		\b-%u
38986# day
38987>>0x2C		uleshort	x		\b-%u
38988# hour
38989>>0x2E		uleshort	x		%u
38990# minute
38991>>0x30		uleshort	x		\b:%u
38992# second
38993>>0x32		uleshort	x		\b:%u
38994# boot application launched
38995>0x24		ulelong		=0x11		\b, launched
38996# type of start: 0 normally, 1 or 2 maybe in a recovery sequence
38997>>0x38		uleshort	!0		\b, type %u
38998# pathname of boot application, as null-terminated Unicode string; typically
38999# \Windows\system32\winload.exe \Windows\system32\winload.efi
39000>>0x3C		lestring16	x		%s
39001
39002# Summary:	Windows Error Report text files
39003# URL:		https://en.wikipedia.org/wiki/Windows_Error_Reporting
39004# Reference:	https://www.nirsoft.net/utils/app_crash_view.html
39005# Created by:	Joerg Jenderek
39006# Note:		in directories	%ProgramData%\Microsoft\Windows\WER\{ReportArchive,ReportQueue}
39007#				%LOCALAPPDATA%\Microsoft\Windows\WER\{ReportArchive,ReportQueue}
390080	lestring16	Version=
39009>22	lestring16	EventType	Windows Error Report
39010!:mime	text/plain
39011# Report.wer
39012!:ext	wer
39013
39014# Summary: Windows 3.1 group files
39015# Extension: .grp
39016# Created by: unknown
390170	string		\120\115\103\103	MS Windows 3.1 group files
39018
39019
39020# Summary: Old format help files
39021# URL: https://en.wikipedia.org/wiki/WinHelp
39022# Reference: https://www.oocities.org/mwinterhoff/helpfile.htm
39023# Update: Joerg Jenderek
39024# Created by: Dirk Jagdmann <doj@cubic.org>
39025#
39026# check and then display version and date inside MS Windows HeLP file fragment
390270	name				help-ver-date
39028# look for Magic of SYSTEMHEADER
39029>0	leshort		0x036C
39030# version Major		1 for right file fragment
39031>>4	leshort		1		Windows
39032# print non empty string above to avoid error message
39033# Warning: Current entry does not yet have a description for adding a MIME type
39034!:mime	application/winhelp
39035!:ext	hlp
39036# version Minor of help file format is hint for windows version
39037>>>2	leshort		0x0F		3.x
39038>>>2	leshort		0x15		3.0
39039>>>2	leshort		0x21		3.1
39040>>>2	leshort		0x27		x.y
39041>>>2	leshort		0x33		95
39042>>>2	default		x		y.z
39043>>>>2	leshort		x		%#x
39044# to complete message string like "MS Windows 3.x help file"
39045>>>2	leshort		x		help
39046# GenDate often older than file creation date
39047>>>6	ldate		x		\b, %s
39048#
39049# Magic for HeLP files
390500	lelong		0x00035f3f
39051# ./windows (version 5.25) labeled the entry as "MS Windows 3.x help file"
39052# file header magic 0x293B at DirectoryStart+9
39053>(4.l+9)	uleshort	0x293B		MS
39054# look for @VERSION	bmf.. like IBMAVW.ANN
39055>>0xD4		string	=\x62\x6D\x66\x01\x00	Windows help annotation
39056!:mime	application/x-winhelp
39057!:ext	ann
39058>>0xD4		string	!\x62\x6D\x66\x01\x00
39059# "GID Help index" by TrID
39060>>>(4.l+0x65)	string	=|Pete			Windows help Global Index
39061!:mime	application/x-winhelp
39062!:ext	gid
39063# HeLP Bookmark or
39064# "Windows HELP File" by TrID
39065>>>(4.l+0x65)		string		!|Pete
39066# maybe there exist a cleaner way to detect HeLP fragments
39067# brute search for Magic 0x036C with matching Major maximal 7 iterations
39068# discapp.hlp
39069>>>>16			search/0x49AF/s	\x6c\x03
39070>>>>>&0			use 		help-ver-date
39071>>>>>&4			leshort		!1
39072# putty.hlp
39073>>>>>>&0		search/0x69AF/s	\x6c\x03
39074>>>>>>>&0		use 		help-ver-date
39075>>>>>>>&4		leshort		!1
39076>>>>>>>>&0		search/0x49AF/s	\x6c\x03
39077>>>>>>>>>&0		use 		help-ver-date
39078>>>>>>>>>&4		leshort		!1
39079>>>>>>>>>>&0		search/0x49AF/s	\x6c\x03
39080>>>>>>>>>>>&0		use 		help-ver-date
39081>>>>>>>>>>>&4		leshort		!1
39082>>>>>>>>>>>>&0		search/0x49AF/s	\x6c\x03
39083>>>>>>>>>>>>>&0		use 		help-ver-date
39084>>>>>>>>>>>>>&4		leshort		!1
39085>>>>>>>>>>>>>>&0	search/0x49AF/s	\x6c\x03
39086>>>>>>>>>>>>>>>&0	use 		help-ver-date
39087>>>>>>>>>>>>>>>&4	leshort		!1
39088>>>>>>>>>>>>>>>>&0	search/0x49AF/s	\x6c\x03
39089# GCC.HLP is detected after 7 iterations
39090>>>>>>>>>>>>>>>>>&0	use 		help-ver-date
39091# this only happens if bigger hlp file is detected after used search iterations
39092>>>>>>>>>>>>>>>>>&4	leshort		!1		Windows y.z help
39093!:mime	application/winhelp
39094!:ext	hlp
39095# repeat search again or following default line does not work
39096>>>>16			search/0x49AF/s	\x6c\x03
39097# remaining files should be HeLP Bookmark WinHlp32.BMK (XP 32-bit) or WinHlp32 (Windows 8.1 64-bit)
39098>>>>16	default				x	Windows help Bookmark
39099!:mime	application/x-winhelp
39100!:ext	bmk
39101## FirstFreeBlock normally FFFFFFFFh 10h for *ANN
39102##>>8	lelong			x		\b, FirstFreeBlock %#8.8x
39103# EntireFileSize
39104>>12	lelong			x		\b, %d bytes
39105## ReservedSpace normally 042Fh AFh for *.ANN
39106#>>(4.l)	lelong		x		\b, ReservedSpace %#8.8x
39107## UsedSpace normally 0426h A6h for *.ANN
39108#>>(4.l+4)	lelong		x		\b, UsedSpace %#8.8x
39109## FileFlags normally 04...
39110#>>(4.l+5)	lelong		x		\b, FileFlags %#8.8x
39111## file header magic 0x293B
39112#>>(4.l+9)	uleshort	x		\b, file header magic %#4.4x
39113## file header Flags		0x0402
39114#>>(4.l+11)	uleshort	x		\b, file header Flags %#4.4x
39115## file header PageSize	0400h 80h for *.ANN
39116#>>(4.l+13)	uleshort	x		\b, PageSize %#4.4x
39117## Structure[16]		z4
39118#>>(4.l+15)	string		>\0		\b, Structure_"%-.16s"
39119## MustBeZero			0
39120#>>(4.l+31)	uleshort	x		\b, MustBeZero %#4.4x
39121## PageSplits
39122#>>(4.l+33)	uleshort	x		\b, PageSplits %#4.4x
39123## RootPage
39124#>>(4.l+35)	uleshort	x		\b, RootPage %#4.4x
39125## MustBeNegOne			0xffff
39126#>>(4.l+37)	uleshort	x		\b, MustBeNegOne %#4.4x
39127## TotalPages			1
39128#>>(4.l+39)	uleshort	x		\b, TotalPages %#4.4x
39129## NLevels			0x0001
39130#>>(4.l+41)	uleshort	x		\b, NLevels %#4.4x
39131## TotalBtreeEntries
39132#>>(4.l+43)	ulelong		x		\b, TotalBtreeEntries %#8.8x
39133## pages of the B+ tree
39134#>>(4.l+47)	ubequad		x		\b, PageStart %#16.16llx
39135
39136# start with colon or semicolon for comment line like Back2Life.cnt
391370		regex		\^(:|;)
39138# look for first keyword Base
39139>0		search/45	:Base
39140>>&0				use 		cnt-name
39141# only solution to search again from beginning , because relative offsets changes when use is called
39142>0		search/45	:Base
39143>0		default		x
39144# look for other keyword Title like in putty.cnt
39145>>0		search/45	:Title
39146>>>&0				use 		cnt-name
39147#
39148# display mime type and name of Windows help Content source
391490	name				cnt-name
39150# skip space at beginning
39151>0     string		\040
39152# name without extension and greater character or name with hlp extension
39153>>1	regex/c		\^([^\xd>]*|.*\\.hlp)	MS Windows help file Content, based "%s"
39154!:mime	text/plain
39155!:apple	????TEXT
39156!:ext	cnt
39157#
39158# Windows creates a full text search from hlp file, if the user clicks the "Find" tab and enables keyword indexing
391590	string		tfMR			MS Windows help Full Text Search index
39160!:mime application/x-winhelp-fts
39161!:ext	fts
39162>16	string		>\0			for "%s"
39163
39164# Summary: Hyper terminal
39165# Extension: .ht
39166# Created by: unknown
391670	string		HyperTerminal\040
39168>15	string		1.0\ --\ HyperTerminal\ data\ file	MS Windows HyperTerminal profile
39169
39170# https://ithreats.files.wordpress.com/2009/05/\040
39171# lnk_the_windows_shortcut_file_format.pdf
39172# Summary: Windows shortcut
39173# Extension: .lnk
39174# Created by: unknown
39175# 'L' + GUUID
391760	string		\114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106	MS Windows shortcut
39177!:mime	application/x-ms-shortcut
39178!:ext	lnk
39179>20	lelong&1	1	\b, Item id list present
39180>20	lelong&2	2	\b, Points to a file or directory
39181>20	lelong&4	4	\b, Has Description string
39182>20	lelong&8	8	\b, Has Relative path
39183>20	lelong&16	16	\b, Has Working directory
39184>20	lelong&32	32	\b, Has command line arguments
39185>20	lelong&64	64	\b, Icon
39186>>56	lelong		x	\b number=%d
39187>24	lelong&1	1	\b, Read-Only
39188>24	lelong&2	2	\b, Hidden
39189>24	lelong&4	4	\b, System
39190>24	lelong&8	8	\b, Volume Label
39191>24	lelong&16	16	\b, Directory
39192>24	lelong&32	32	\b, Archive
39193>24	lelong&64	64	\b, Encrypted
39194>24	lelong&128	128	\b, Normal
39195>24	lelong&256	256	\b, Temporary
39196>24	lelong&512	512	\b, Sparse
39197>24	lelong&1024	1024	\b, Reparse point
39198>24	lelong&2048	2048	\b, Compressed
39199>24	lelong&4096	4096	\b, Offline
39200>28	leqwdate	x	\b, ctime=%s
39201>36	leqwdate	x	\b, mtime=%s
39202>44	leqwdate	x	\b, atime=%s
39203>52	lelong		x	\b, length=%u, window=
39204>60	lelong&1	1	\bhide
39205>60	lelong&2	2	\bnormal
39206>60	lelong&4	4	\bshowminimized
39207>60	lelong&8	8	\bshowmaximized
39208>60	lelong&16	16	\bshownoactivate
39209>60	lelong&32	32	\bminimize
39210>60	lelong&64	64	\bshowminnoactive
39211>60	lelong&128	128	\bshowna
39212>60	lelong&256	256	\brestore
39213>60	lelong&512	512	\bshowdefault
39214#>20	lelong&1	0
39215#>>20	lelong&2	2
39216#>>>(72.l-64)	pstring/h	x	\b [%s]
39217#>20	lelong&1	1
39218#>>20	lelong&2	2
39219#>>>(72.s)	leshort	x
39220#>>>&75	pstring/h	x	\b [%s]
39221
39222# Summary: Outlook Personal Folders
39223# Created by: unknown
39224# Update:	Joerg Jenderek
39225# URL:		http://fileformats.archiveteam.org/wiki/Personal_Folder_File
39226#		https://en.wikipedia.org/wiki/Personal_Storage_Table
39227# Reference:	https://interoperability.blob.core.windows.net/files/MS-PST/%5bMS-PST%5d.pdf
39228#		http://mark0.net/download/triddefs_xml.7z/defs/p/pab.trid.xml
39229# dwMagic !BDN
392300	lelong		0x4E444221
39231# skip DROID x-fmt-75-signature-id-472.pab x-fmt-248-signature-id-260.pst x-fmt-249-signature-id-261.pst
39232# by check for existance of bPlatformCreate value
39233>14	ubyte	x		Microsoft Outlook
39234#!:mime		application/octet-stream
39235# NOT official registered !
39236!:mime		application/vnd.ms-outlook
39237# dwCRCPartial; 32-bit cyclic redundancy check (CRC) value of followin 471 bytes; zero for 64-bit
39238#>>4	ulelong		!0			\b, CRC %#x
39239# wMagicClient; AB (4142h) is used for PAB files; SM (534Dh) is used for PST files; SO (534Fh) is used for OST files
39240#>>8	leshort		x			\b, wMagicClient=%#x
39241# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/p/pab.trid.xml
39242# Note:		called "Microsoft Personal Address Book" by TrID and
39243#		"Microsoft Outlook Personal Address Book" by DROID via x-fmt/75
39244>>8	leshort		0x4142			Personal Address Book
39245#!:mime	application/x-ms-pab
39246!:ext	pab
39247# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/p/pst.trid.xml
39248#		http://mark0.net/download/triddefs_xml.7z/defs/p/pst-unicode.trid.xml
39249# Note:		called "Microsoft OutLook Personal Folder" by TrID and
39250#		by DROID via x-fmt/248 for ANSI and via x-fmt/249 for Unicode
39251#>>8	leshort		0x4D53			\b, PST~
39252# called "Microsoft Outlook email folder" in ./windows version 1.37 and older
39253>>8	leshort		0x4D53			Personal Storage
39254#!:mime	application/x-ms-pst
39255!:ext	pst
39256# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/o/ost.trid.xml
39257# Note:		called "Outlook Exchange Offline Storage" by TrID
39258>>8	leshort		0x4F53			Offline Storage
39259#!:mime	application/x-ms-ost
39260!:ext	ost
39261# wVer; file format version. 14 or 15 if the file is ANSI; > 21 or 23(=17h) if Unicode; 37 for written by Outlook with WIP
39262>>10	uleshort	x			(
39263# probably NO intermediate versions exist
39264>>10	leshort		<0x10			\b<=2002, ANSI,
39265>>10	leshort		>0x14			\b>=2003, Unicode,
39266>>10	uleshort	x			version %u)
39267# wVerClient; client file format version like: 19 22
39268#>>12	uleshort	x			\b, wVerClient=%u
39269# bPlatformCreate; This value MUST be set to 1 but also found 2
39270>>14	ubyte		>1			\b, bPlatformCreate=%u
39271# bPlatformAccess; This value MUST be set to 1 but also found 2
39272>>15	ubyte		>1			\b, bPlatformAccess=%u
39273# dwReserved1; SHOULD ignore and NOT modify this value; SHOULD initialize to zero
39274>>16	ulelong		!0			\b, dwReserved1=%#x
39275# dwReserved2; SHOULD ignore and NOT modify this value; SHOULD initialize to zero
39276>>20	ulelong		!0			\b, dwReserved2=%#x
39277# ANSI 32-bit variant Outlook 1997-2002
39278>>10	uleshort	<16
39279# bidNextB; next BlockID (ANSI 4 bytes)
39280#>>>24		ulelong	!0			\b, bidNextB=%#x
39281# bidNextP; Next available back BlockID pointer
39282#>>>28		ulelong	!0			\b, bidNextP=%#x
39283# dwUnique; value monotonically increased when modifying PST; so CRC is changing
39284>>>32		ulelong	!0			\b, dwUnique=%#x
39285# rgnid[128]; A fixed array of 32 NodeIDs, each corresponding to one of the 32 possible NID_TYPEs
39286#>>>36		ubequad	x			\b, rgnid=%#llx...
39287# dwReserved; Implementations SHOULD ignore this value and SHOULD NOT modify it; Initialized zero
39288>>>164		ulelong	!0			\b, dwReserved=%#x
39289# ibFileEof; the size of the PST file, in bytes (ANSI 4 bytes)
39290>>>168		ulelong	x			\b, %u bytes
39291# ibAMapLast; offset to the last AMap page
39292#>>>172		ulelong	x			\b, ibAMapLast=%#x
39293# bSentinel; MUST be set to 0x80
39294>>>460		ubyte	!0x80			\b, bSentinel=%#x
39295# bCryptMethod: 0~No encryption 1~encryption with permutation 2~encryption with cyclic 16~encryption with Windows Information Protection (WIP)
39296>>>461		ubyte	>0			\b, bCryptMethod=%u
39297# UNICODE 64-bit variant Outlook 2003-2007
39298>>10	uleshort >20
39299# bidUnused; Unused 8 bytes padding (Unicode only); sometimes like: 0x0000000100000004
39300>>>24		ulequad	!0x0000000100000004	\b, bidUnused=%#16.16llx
39301# dwUnique; value monotonically increased when modifying PST; so CRC is changing
39302>>>40		ulelong	!0			\b, dwUnique=%#x
39303# rgnid[] (128 bytes): A fixed array of 32 NIDs, each corresponding to one of the 32 possible
39304#>>>44		ubequad	x			\b, rgnid=%#llx...
39305# ibFileEof; the size of the PST file, in bytes (Unicode 8 bytes)
39306>>>184		ulequad	x			\b, %llu bytes
39307# bSentinel; MUST be set to 0x80
39308>>>512		ubyte	!0x80			\b, bSentinel=%#x
39309# bCryptMethod; Encryption type like: 0 1 2 16
39310>>>513		ubyte	>0			\b, bCryptMethod=%u
39311# dwCRC; 32-bit CRC of the of the previous 516 bytes
39312>>>524		ulelong		x		\b, CRC32 %#x
39313
39314
39315# Summary: Windows help cache
39316# Created by: unknown
393170	string		\164\146\115\122\012\000\000\000\001\000\000\000	MS Windows help cache
39318
39319
39320# Summary: IE cache file
39321# Created by: Christophe Monniez
393220	string	Client\ UrlCache\ MMF 	Internet Explorer cache file
39323>20	string	>\0			version %s
39324
39325
39326# Summary: Registry files
39327# Created by: unknown
39328# Modified by (1): Joerg Jenderek
393290	string		regf		MS Windows registry file, NT/2000 or above
393300	string		CREG		MS Windows 95/98/ME registry file
393310	string		SHCC3		MS Windows 3.1 registry file
39332
39333
39334# Summary: Windows Registry text
39335# URL: https://en.wikipedia.org/wiki/Windows_Registry#.REG_files
39336# Reference: http://fileformats.archiveteam.org/wiki/Windows_Registry
39337# Submitted by: Abel Cheung <abelcheung@gmail.com>
39338# Update: Joerg Jenderek
39339#		Windows 3-9X variant
393400	string		REGEDIT
39341# skip ASCII text like "REGEDITor.txt" but match
39342# L1WMAP.REG with only 1 CRNL or org.gnome.gnumeric.reg with 2 NL
39343>7	search/3	\n			Windows Registry text
39344!:mime	text/x-ms-regedit
39345!:ext	reg
39346#		Windows 9X variant
39347>>0	string		REGEDIT4		(Win95 or above)
39348#		Windows 2K ANSI variant
393490	string		Windows\ Registry\ Editor\
39350>&0	string		Version\ 5.00\r\n\r\n	Windows Registry text (Win2K or above)
39351!:mime	text/x-ms-regedit
39352!:ext	reg
39353#		Windows 2K UTF-16 variant
393542	lestring16	Windows\ Registry\ Editor\
39355>0x32	lestring16	Version\ 5.00\r\n\r\n	Windows Registry little-endian text (Win2K or above)
39356# relative offset not working
39357#>&0	lestring16	Version\ 5.00\r\n\r\n	Windows Registry little-endian text (Win2K or above)
39358!:mime	text/x-ms-regedit
39359!:ext	reg
39360#		WINE variant
39361# URL: https://en.wikipedia.org/wiki/Wine_(software)
39362# Reference: https://www.winehq.org/pipermail/wine-cvs/2005-October/018763.html
39363# Note:	WINE use text based registry (system.reg,user.reg,userdef.reg)
39364#	instead binary hiv structure like Windows
393650	string	WINE\ REGISTRY\ Version\ 	WINE registry text
39366# version 2
39367>&0	string	x				\b, version %s
39368!:mime	text/x-wine-extension-reg
39369!:ext	reg
39370
39371# Windows *.INF *.INI files updated by Joerg Jenderek at Apr 2013, Feb 2018
39372# empty ,comment , section
39373# PR/383: remove unicode BOM because it is not portable across regex impls
39374#0	regex/s		\\`(\\r\\n|;|[[])
39375# empty line CRLF
393760	ubeshort	0x0D0A
39377>0	use		ini-file
39378# comment line starting with semicolon
393790	string		;
39380# look for phrase of Windows policy ADMinistrative template (with starting remark)
39381# like: WINDOW_95_CD/TOOLS/RESKIT/netadmin/poledit/conf.adm
39382>1	search/3548	END\040CATEGORY
39383# ADM with remark (by adm-rem.trid.xml) already done by generic ASCII variant
39384# if no Windows policy ADMinistrative template then Windows INItialization
39385>1	default		x
39386>>0	use		ini-file
39387# section line starting with left bracket
393880	string		[
39389>0	use		ini-file
39390# check and then display Windows INItialization configuration
393910	name		ini-file
39392# look for left bracket in section line
39393>0	search/8192	[
39394# https://en.wikipedia.org/wiki/Autorun.inf
39395# https://msdn.microsoft.com/en-us/library/windows/desktop/cc144200.aspx
39396# space after right bracket
39397# or AutoRun.Amd64 for 64 bit systems
39398# or only NL separator
39399>>&0	regex/c		\^autorun
39400# but sometimes total commander directory tree file "treeinfo.wc" with lines like
39401# [AUTORUN]
39402# [boot]
39403>>>&0	string		=]\r\n[					Total commander directory treeinfo.wc
39404!:mime text/plain
39405!:ext	wc
39406# From: Pal Tamas <folti@balabit.hu>
39407# Autorun File
39408>>>&0	string		!]\r\n[					Microsoft Windows Autorun file
39409!:mime application/x-setupscript
39410!:ext	inf
39411# https://msdn.microsoft.com/en-us/library/windows/hardware/ff549520(v=vs.85).aspx
39412# version strings ASCII coded case-independent for Windows setup information script file
39413>>&0	regex/c		\^(version|strings)]				Windows setup INFormation
39414!:mime	application/x-setupscript
39415#!:mime application/x-wine-extension-inf
39416!:ext	inf
39417# NETCRC.INF OEMCPL.INF
39418>>&0	regex/c		\^(WinsockCRCList|OEMCPL)]			Windows setup INFormation
39419!:mime	application/x-setupscript
39420!:ext	inf
39421# http://www.winfaq.de/faq_html/Content/tip2500/onlinefaq.php?h=tip2653.htm
39422# https://msdn.microsoft.com/en-us/library/windows/desktop/cc144102.aspx
39423# .ShellClassInfo DeleteOnCopy LocalizedFileNames ASCII coded case-independent
39424>>&0	regex/1024c	\^(\\.ShellClassInfo|DeleteOnCopy|LocalizedFileNames)]	Windows desktop.ini
39425!:mime application/x-wine-extension-ini
39426#!:mime text/plain
39427# https://support.microsoft.com/kb/84709/
39428>>&0	regex/c		\^don't\ load]					Windows CONTROL.INI
39429!:mime application/x-wine-extension-ini
39430!:ext	ini
39431>>&0	regex/c		\^(ndishlp\\$|protman\\$|NETBEUI\\$)]		Windows PROTOCOL.INI
39432!:mime application/x-wine-extension-ini
39433!:ext	ini
39434# https://technet.microsoft.com/en-us/library/cc722567.aspx
39435# http://www.winfaq.de/faq_html/Content/tip0000/onlinefaq.php?h=tip0137.htm
39436>>&0	regex/c		\^(windows|Compatibility|embedding)]		Windows WIN.INI
39437!:mime application/x-wine-extension-ini
39438!:ext	ini
39439# https://en.wikipedia.org/wiki/SYSTEM.INI
39440>>&0	regex/c		\^(boot|386enh|drivers)]			Windows SYSTEM.INI
39441!:mime application/x-wine-extension-ini
39442!:ext	ini
39443# http://www.mdgx.com/newtip6.htm
39444>>&0	regex/c		\^SafeList]					Windows IOS.INI
39445!:mime application/x-wine-extension-ini
39446!:ext	ini
39447# https://en.wikipedia.org/wiki/NTLDR	Windows Boot Loader information
39448>>&0	regex/c		\^boot\x20loader]				Windows boot.ini
39449!:mime application/x-wine-extension-ini
39450!:ext	ini
39451# https://en.wikipedia.org/wiki/CONFIG.SYS
39452>>&0	regex/c		\^menu]						MS-DOS CONFIG.SYS
39453# @CONFIG.UI configuration file of previous DOS version saved by Caldera OPENDOS INSTALL.EXE
39454# CONFIG.PSS saved version of file CONFIG.SYS created by %WINDIR%\SYSTEM\MSCONFIG.EXE
39455# CONFIG.TSH renamed file CONFIG.SYS.BAT by %WINDIR%\SYSTEM\MSCONFIG.EXE
39456# dos and w40 used in dual booting scene
39457!:ext	sys/dos/w40
39458# https://support.microsoft.com/kb/118579/
39459>>&0	regex/c		\^Paths]\r\n					MS-DOS MSDOS.SYS
39460!:ext	sys/dos
39461# http://chmspec.nongnu.org/latest/INI.html#HHP
39462>>&0	regex/c		\^options]\r\n					Microsoft HTML Help Project
39463!:mime text/plain
39464!:ext	hhp
39465# From:		Joerg Jenderek
39466# URL:		https://documentation.basis.com/BASISHelp/WebHelp/b3odbc/ODBC_Driver/obdcdriv_character_translation.htm
39467# Reference:	https://www.garykessler.net/library/file_sigs.html
39468#		http://mark0.net/download/triddefs_xml.7z/defs/c/cpx.trid.xml
39469# Note:		stored in directory %WINDIR%\SysWOW64 or %WINDIR%\system
39470#		second word often Latin but sometimes Cyrillic like in 12510866.CPX
39471>>&0	regex/c		\^Windows\ (Latin|Cyrillic)			Windows codepage translator
39472#!:mime	text/plain
39473!:mime	text/x-ms-cpx
39474# like: 12510866.CPX
39475!:ext	cpx
39476# From:		Joerg Jenderek
39477# URL:		https://en.wikipedia.org/wiki/InstallShield
39478# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/l/lid-is.trid.xml
39479# Note:		contain also 3 keywords like: count Default key0
39480>>&0	regex/c		\^Languages]					InstallShield Language Identifier
39481#!:mime	text/plain
39482!:mime	text/x-installshield-lid
39483# like: SETUP.LID
39484!:ext	lid
39485# From:		Joerg Jenderek
39486# URL:		https://www.file-extensions.org/tag-file-extension
39487# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/t/taginfo.trid.xml
39488# Note:		contain also keywords like: Application Category Company Misc Version
39489>>&0	regex/c		\^TagInfo]					TagInfo
39490#!:mime	text/plain
39491#!:mime	text/prs.lines.tag
39492!:mime	text/x-ms-tag
39493# like: DATA.TAG
39494!:ext	tag
39495# unknown keyword after opening bracket
39496>>&0	default				x
39497#>>>&0	string/c			x	UNKNOWN [%s
39498# look for left bracket of second section
39499>>>&0	search/8192			[
39500# version Strings FileIdentification
39501>>>>&0	string/c			version				Windows setup INFormation
39502!:mime application/x-setupscript
39503!:ext	inf
39504# https://en.wikipedia.org/wiki/Initialization_file	Windows Initialization File or other
39505>>>>&0	default				x
39506>>>>>&0	ubyte				x
39507# characters, digits, underscore and white space followed by right bracket
39508# terminated by CR implies section line to skip BOOTLOG.TXT DETLOG.TXT
39509>>>>>>&-1	regex/T			\^([A-Za-z0-9_\(\)\ ]+)\]\r	Generic INItialization configuration [%-.40s
39510# NETDEF.INF multiarc.ini
39511#!:mime	application/x-setupscript
39512!:mime	application/x-wine-extension-ini
39513#!:mime	text/plain
39514!:ext	ini/inf
39515# UTF-16 BOM
395160	ubeshort		=0xFFFE
39517# look for phrase of Windows policy ADMinistrative template (UTF-16 by adm-uni.trid.xml)
39518# like: wuau.adm
39519>2	search/0x384A	E\0N\0D\0\040\0C\0A\0T\0E\0G\0O\0R\0Y\0
39520>>0	use		windows-adm
39521# if no Windows policy ADMinistrative template then Windows INFormation
39522>2	default		x
39523# UTF-16 BOM followed by CR~0D00 , comment~semicolon~3B00 , section~bracket~5B00
39524>>0	ubelong&0xFFff89FF	=0xFFFE0900
39525# look for left bracket in section line
39526>>>2	search/8192		[
39527# keyword without 1st letter which is maybe up-/down-case
39528>>>>&3	lestring16		ersion]			Windows setup INFormation
39529!:mime	application/x-setupscript
39530# like: hdaudio.inf iscsi.inf spaceport.inf tpm.inf usbhub3.inf UVncVirtualDisplay.inf
39531!:ext	inf
39532>>>>&3	lestring16		trings]			Windows setup INFormation
39533!:mime	application/x-setupscript
39534# like: arduino_gemma.inf iis.inf MSM8960.inf
39535!:ext	inf
39536>>>>&3	lestring16		ourceDisksNames]	Windows setup INFormation
39537!:mime	application/x-setupscript
39538# like: atiixpag.inf mdmnokia.inf netefe32.inf rdpbus.inf
39539!:ext	inf
39540# netnwcli.inf start with ;---[ NetNWCli.INX ]
39541>>>>&3	default			x
39542# look for NL followed by left bracket
39543>>>>>&0	search/8192		\x0A\x00\x5b
39544# like: defltwk.inf netvwifibus.inf WSDPrint.inf
39545>>>>>>&3 lestring16		ersion]			Windows setup INFormation
39546!:mime	application/x-setupscript
39547!:ext	inf
39548
39549# Summary:	Windows Policy ADMinistrative template
39550# From:		Joerg Jenderek
39551# URL:		https://en.wikipedia.org/wiki/Administrative_Template
39552# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/a/adm.trid.xml
39553# Note:		typically stored in directory like: %WINDIR%\system32\GroupPolicy\ADM
39554# worst case ASCII variant starting with remark line like: inetset.adm
395550	search/0x4E	CLASS\040
39556>&0	string		MACHINE
39557>>0	use		windows-adm
39558>&0	string		USER
39559>>0	use		windows-adm
39560# display information about Windows policy ADMinistrative template
395610	name		windows-adm	Windows Policy Administrative Template
39562!:mime	text/x-ms-adm
39563!:ext	adm
39564# UTF-16 BOM implies UTF-16 encoded ADM (by adm-uni.trid.xml)
39565>0	ubeshort		=0xFFFE
39566>>2	lestring16		x		\b, 1st line "%s"
39567# look for UTF-16 encoded CarriageReturn LineFeed
39568>>>2	search/0x3A		\r\0\n\0
39569>>>>&0	lestring16		x		\b, 2nd line "%s"
39570# no UTF-16 BOM implies "ASCII" encoded ADM (by adm.trid.xml)
39571>0	ubeshort		!0xFFFE
39572>>0		string		x		\b, 1st line "%s"
39573#>>>&0		ubequad		x		\b, 2ND %16.16llx
39574# 2nd line empty
39575>>>&2		beshort		=0x0D0A
39576>>>>&0		beshort		!0x0D0A		\b, 3th line
39577>>>>>&-2	string		x		"%s"
39578# 2nd line with content
39579>>>&2		beshort		!0x0D0A		\b, 2nd line
39580>>>>&-2		string		x		"%s"
39581
39582# Windows Precompiled INF files *.PNF added by Joerg Jenderek at Mar 2013 of _PNF_HEADER inf.h
39583# http://read.pudn.com/downloads3/sourcecode/windows/248345/win2k/private/windows/setup/setupapi/inf.h__.htm
39584# URL:		http://fileformats.archiveteam.org/wiki/INF_(Windows)
39585# Reference:	http://en.verysource.com/code/10350344_1/inf.h.html
39586# Note:		stored in %Windir%\Inf %Windir%\System32\DriverStore\FileRepository
39587# check for valid major and minor versions: 101h - 303h
395880		leshort&0xFcFc	=0x0000
39589# GRR: line above (strength 50) is too general as it catches also "PDP-11 UNIX/RT ldp" ./pdp
39590>0		leshort&0x0303	!0x0000
39591# test for valid InfStyles: 1 2
39592>>2		uleshort	>0
39593>>>2		uleshort	<3
39594# look for colon in WinDirPath after PNF header
39595#>>>>0x59	search/18	:
39596>>>>0	use	PreCompiledInf
395970	name	PreCompiledInf
39598>0		uleshort	x	Windows Precompiled iNF
39599!:mime	application/x-pnf
39600!:ext	pnf
39601# major version 1 for older Windows like XP and 3 since about Windows Vista
39602# 101h~98-XP; 301h~Windows Vista-7 ; 302h~Windows 10 14393; 303h~Windows 10 18362
39603>1		ubyte		x		\b, version %u
39604>0		ubyte		x		\b.%u
39605>0		uleshort	=0x0101		(Windows
39606>>4	ulelong&0x00000001	!0x00000001	98)
39607>>4	ulelong&0x00000001	=0x00000001	XP)
39608>0		uleshort	=0x0301		(Windows Vista-8.1)
39609>0		uleshort	=0x0302		(Windows 10 older)
39610>0		uleshort	=0x0303		(Windows 10)
39611# 1 ,2 (windows 98 SE)
39612>2		uleshort	!2		\b, InfStyle %u
39613#	PNF_FLAG_IS_UNICODE		0x00000001
39614#	PNF_FLAG_HAS_STRINGS		0x00000002
39615#	PNF_FLAG_SRCPATH_IS_URL		0x00000004
39616#	PNF_FLAG_HAS_VOLATILE_DIRIDS	0x00000008
39617#	PNF_FLAG_INF_VERIFIED		0x00000010
39618#	PNF_FLAG_INF_DIGITALLY_SIGNED	0x00000020
39619#	UNKNOWN8			0x00000080
39620#	UNKNOWN				0x00000100
39621#	UNKNOWN1			0x01000000
39622#	UNKNOWN2			0x02000000
39623>4	ulelong&0x03000180	>0		\b, flags
39624>>4	ulelong			x		%#x
39625>4	ulelong&0x00000001	0x00000001	\b, unicoded
39626>4	ulelong&0x00000002	0x00000002	\b, has strings
39627>4	ulelong&0x00000004	0x00000004	\b, src URL
39628>4	ulelong&0x00000008	0x00000008	\b, volatile dir ids
39629>4	ulelong&0x00000010	0x00000010	\b, verified
39630>4	ulelong&0x00000020	0x00000020	\b, digitally signed
39631# >4	ulelong&0x00000080	0x00000080	\b, UNKNOWN8
39632# >4	ulelong&0x00000100	0x00000100	\b, UNKNOWN
39633# >4	ulelong&0x01000000	0x01000000	\b, UNKNOWN1
39634# >4	ulelong&0x02000000	0x02000000	\b, UNKNOWN2
39635#>8		ulelong		x		\b, InfSubstValueListOffset %#x
39636# many 0, 1 lmouusb.PNF, 2 linkfx10.PNF , f webfdr16.PNF
39637# , 6 bth.PNF, 9 usbport.PNF, d netnwifi.PNF, 10h nettcpip.PNF
39638#>12		uleshort	x		\b, InfSubstValueCount %#x
39639# only < 9 found: 8 hcw85b64.PNF
39640#>14		uleshort	x		\b, InfVersionDatumCount %#x
39641# only found values lower 0x0000ffff ??
39642#>16		ulelong		x		\b, InfVersionDataSize %#x
39643# only found positive values lower 0x00ffFFff for InfVersionDataOffset
39644>20		ulelong		x		\b, at %#x
39645>4	ulelong&0x00000001	=0x00000001
39646# case independent: CatalogFile Class DriverVer layoutfile LayoutFile SetupClass signature Signature
39647>>(20.l)	lestring16	x		"%s"
39648>4	ulelong&0x00000001	!0x00000001
39649>>(20.l)	string		x		"%s"
39650# FILETIME is number of 100-nanosecond intervals since 1 January 1601
39651#>24		ulequad		x		\b, InfVersionLastWriteTime %16.16llx
39652#>24		foodate-0xbar	x		\b, InfVersionLastWriteTime %s
39653# for Windows 98, XP
39654>0		uleshort	<0x0102
39655# only found values lower 0x00ffFFff
39656# often 70 but also 78h for corelist.PNF
39657# >>32		ulelong		x		\b, StringTableBlockOffset %#x
39658# >>36		ulelong		x		\b, StringTableBlockSize %#x
39659# >>40		ulelong		x		\b, InfSectionCount %#x
39660# >>44		ulelong		x		\b, InfSectionBlockOffset %#x
39661# >>48		ulelong		x		\b, InfSectionBlockSize %#x
39662# >>52		ulelong		x		\b, InfLineBlockOffset %#x
39663# >>56		ulelong		x		\b, InfLineBlockSize %#x
39664# >>60		ulelong		x		\b, InfValueBlockOffset %#x
39665# >>64		ulelong		x		\b, InfValueBlockSize %#x
39666# WinDirPathOffset
39667# like 58h, which means direct after PNF header
39668#>>68		ulelong		x		\b, at %#x
39669>>68		ulelong		x
39670>>>4	ulelong&0x00000001	=0x00000001
39671#>>>>(68.l)	ubequad		=0x43003a005c005700
39672# normally unicoded C:\Windows
39673#>>>>>(68.l)	lestring16	x		\b, WinDirPath "%s"
39674>>>>(68.l)	ubequad		!0x43003a005c005700
39675>>>>>(68.l)	lestring16	x		\b, WinDirPath "%s"
39676>>>4	ulelong&0x00000001	!0x00000001
39677# normally ASCII C:\WINDOWS
39678#>>>>(68.l)	string		=C:\\WINDOWS	\b, WinDirPath "%s"
39679>>>>(68.l)	string		!C:\\WINDOWS
39680>>>>>(68.l)	string		x		\b, WinDirPath "%s"
39681# found OsLoaderPathOffset values often 0 , once 70h corelist.PNF, once 68h ASCII machine.PNF
39682>>>72		ulelong		>0		\b,
39683>>>>4	ulelong&0x00000001	=0x00000001
39684>>>>>(72.l)	lestring16	x		OsLoaderPath "%s"
39685>>>>4	ulelong&0x00000001	!0x00000001
39686# seldom C:\ instead empty
39687>>>>>(72.l)	string		x		OsLoaderPath "%s"
39688# 1fdh
39689#>>>76		uleshort	x		\b, StringTableHashBucketCount %#x
39690# only 407h found
39691>>>78		uleshort	!0x409		\b, LanguageID %x
39692#>>>78		uleshort	=0x409		\b, LanguageID %x
39693# InfSourcePathOffset often 0
39694>>>80		ulelong		>0		\b, at %#x
39695>>>>4	ulelong&0x00000001	=0x00000001
39696>>>>>(80.l)	lestring16	x		SourcePath "%s"
39697>>>>4	ulelong&0x00000001	!0x00000001
39698>>>>>(80.l)	string		>\0		SourcePath "%s"
39699# OriginalInfNameOffset often 0
39700>>>84		ulelong		>0		\b, at %#x
39701>>>>4	ulelong&0x00000001	=0x00000001
39702>>>>>(84.l)	lestring16	x		InfName "%s"
39703>>>>4	ulelong&0x00000001	!0x00000001
39704>>>>>(84.l)	string		>\0		InfName "%s"
39705
39706# for newer Windows like Vista, 7 , 8.1 , 10
39707>0		uleshort	>0x0101
39708>>80	ulelong			x		\b, at %#x WinDirPath
39709>>>4	ulelong&0x00000001	0x00000001
39710# normally unicoded C:\Windows
39711#>>>>(80.l)	ubequad		=0x43003a005c005700
39712#>>>>>(80.l)	lestring16	x		"%s"
39713>>>>(80.l)	ubequad		!0x43003a005c005700
39714>>>>>(80.l)	lestring16	x		"%s"
39715# language id: 0 407h~german 409h~English_US
39716>>90		uleshort	!0x409		\b, LanguageID %x
39717#>>90		uleshort	=0x409		\b, LanguageID %x
39718>>92	ulelong			>0		\b, at %#x
39719>>>4	ulelong&0x00000001	0x00000001
39720# language string like: de-DE en-US
39721>>>>(92.l)	lestring16	x		language %s
39722
39723# Summary: backup file created with utility like NTBACKUP.EXE shipped with Windows NT/2K/XP/2003
39724# Extension: .bkf
39725# Created by: Joerg Jenderek
39726# URL: https://en.wikipedia.org/wiki/NTBackup
39727# Reference: http://laytongraphics.com/mtf/MTF_100a.PDF
39728# Descriptor BloCK name of Microsoft Tape Format
397290	string			TAPE
39730# Format Logical Address is zero
39731>20	ulequad			0
39732# Reserved for MBC is zero
39733>>28	uleshort		0
39734# Control Block ID is zero
39735>>>36	ulelong			0
39736# BIT4-BIT15, BIT18-BIT31 of block attributes are unused
39737>>>>4	ulelong&0xFFfcFFe0	0		Windows NTbackup archive
39738#!:mime application/x-ntbackup
39739!:ext bkf
39740# OS ID
39741>>>>>10	ubyte			1		\b NetWare
39742>>>>>10	ubyte			13		\b NetWare SMS
39743>>>>>10	ubyte			14		\b NT
39744>>>>>10	ubyte			24		\b 3
39745>>>>>10	ubyte			25		\b OS/2
39746>>>>>10	ubyte			26		\b 95
39747>>>>>10	ubyte			27		\b Macintosh
39748>>>>>10	ubyte			28		\b UNIX
39749# OS Version (2)
39750#>>>>>11	ubyte			x		OS V=%x
39751# MTF_CONTINUATION	Media Sequence Number > 1
39752#>>>>>4	ulelong&0x00000001	!0		\b, continued
39753# MTF_COMPRESSION
39754>>>>>4	ulelong&0x00000004	!0		\b, compressed
39755# MTF_EOS_AT_EOM	End Of Medium was hit during end of set processing
39756>>>>>4	ulelong&0x00000008	!0		\b, End Of Medium hit
39757>>>>>4	ulelong&0x00020000	0
39758# MTF_SET_MAP_EXISTS	A Media Based Catalog Set Map may exist on tape
39759>>>>>>4	ulelong&0x00010000	!0		\b, with catalog
39760# MTF_FDD_ALLOWED	However File/Directory Detail can only exist if a Set Map is also present
39761>>>>>4	ulelong&0x00020000	!0		\b, with file catalog
39762# Offset To First Event 238h,240h,28Ch
39763#>>>>>8	uleshort		x		\b, event offset %4.4x
39764# Displayable Size (20e0230h 20e024ch 20e0224h)
39765#>>>>>8	ulequad			x		dis. size %16.16llx
39766# Media Family ID (455288C4h 4570BD1Ah 45708F2Fh 4570BBF5h)
39767#>>>>>52	ulelong			x		family ID %8.8x
39768# TAPE Attributes (3)
39769#>>>>>56	ulelong			x		TAPE %8.8x
39770# Media Sequence Number
39771>>>>>60	uleshort		>1		\b, sequence %u
39772# Password Encryption Algorithm (3)
39773>>>>>62	uleshort		>0		\b, %#x encrypted
39774# Soft Filemark Block Size * 512 (2)
39775#>>>>>64	uleshort		=2		\b, soft size %u*512
39776>>>>>64	uleshort		!2		\b, soft size %u*512
39777# Media Based Catalog Type (1,2)
39778#>>>>>66	uleshort		x		\b, catalog type %4.4x
39779# size of Media Name (66,68,6Eh)
39780>>>>>68	uleshort		>0
39781# offset of Media Name (5Eh)
39782>>>>>>70	uleshort	>0
39783# 0~, 1~ANSI, 2~UNICODE
39784>>>>>>>48	ubyte		1
39785# size terminated ansi coded string normally followed by "MTF Media Label"
39786>>>>>>>>(70.s)	string		>\0		\b, name: %s
39787>>>>>>>48	ubyte		2
39788# Not null, but size terminated unicoded string
39789>>>>>>>>(70.s)	lestring16	x		\b, name: %s
39790# size of Media Label (104h)
39791>>>>>72	uleshort		>0
39792# offset of Media Label (C4h,C6h,CCh)
39793>>>>>74		uleshort	>0
39794>>>>>>48	ubyte		1
39795#Tag|Version|Vendor|Vendor ID|Creation Time Stamp|Cartridge Label|Side|Media ID|Media Domain ID|Vendor Specific fields
39796>>>>>>>(74.s)	string		>\0		\b, label: %s
39797>>>>>>48	ubyte		2
39798>>>>>>>(74.s)	lestring16	x		\b, label: %s
39799# size of password name (0,1Ch)
39800#>>>>>76	uleshort		>0		\b, password size %4.4x
39801# Software Vendor ID (CBEh)
39802>>>>>86	uleshort		x		\b, software (%#x)
39803# size of Software Name (6Eh)
39804>>>>>80	uleshort		>0
39805# offset of Software Name (1C8h,1CAh,1D0h)
39806>>>>>>82	uleshort	>0
39807# 1~ANSI, 2~UNICODE
39808>>>>>>>48	ubyte		1
39809>>>>>>>>(82.s)	string		>\0		\b: %s
39810>>>>>>>48	ubyte		2
39811# size terminated unicoded coded string normally followed by "SPAD"
39812>>>>>>>>(82.s)	lestring16	x		\b: %s
39813# Format Logical Block Size (512,1024)
39814#>>>>>84	uleshort		=1024		\b, block size %u
39815>>>>>84	uleshort		!1024		\b, block size %u
39816# Media Date of MTF_DATE_TIME type with 5 bytes
39817#>>>>>>88	ubequad			x		DATE %16.16llx
39818# MTF Major Version (1)
39819#>>>>>>93	ubyte		x		\b, MFT version %x
39820#
39821
39822# URL: https://en.wikipedia.org/wiki/PaintShop_Pro
39823# Reference: https://www.cryer.co.uk/file-types/p/pal.htm
39824# Created by: Joerg Jenderek
39825# Note: there exist other color palette formats also with .pal extension
398260	string	JASC-PAL\r\n	PaintShop Pro color palette
39827#!:mime	text/plain
39828# PspPalette extension is used by newer (probably 8) PaintShopPro versions
39829!:ext	pal/PspPalette
39830# 2nd line contains palette file version. For example "0100"
39831>10	string	!0100		\b, version %.4s
39832# third line contains the number of colours: 16 256 ...
39833>16	string	x		\b, %.3s colors
39834
39835# URL: https://en.wikipedia.org/wiki/Innosetup
39836# Reference: https://github.com/jrsoftware/issrc/blob/master/Projects/Undo.pas
39837# Created by: Joerg Jenderek
39838# Note:	created by like "InnoSetup self-extracting archive" inside ./msdos
39839# TrID labeles the entry as "Inno Setup Uninstall Log"
39840#	TUninstallLogID
398410	string	Inno\ Setup\ Uninstall\ Log\ (b)	InnoSetup Log
39842!:mime	application/x-innosetup
39843# unins000.dat, unins001.dat, ...
39844!:ext	dat
39845# " 64-bit" variant
39846>0x1c	string		>\0				\b%.7s
39847# AppName[0x80] like "Minimal SYStem", ClamWin Free Antivirus , ...
39848>0xc0	string		x				%s
39849# AppId[0x80] is similar to AppName or
39850# GUID like {4BB0DCDC-BC24-49EC-8937-72956C33A470} start with left brace
39851>0x40	ubyte		0x7b
39852>>0x40	string		x				%-.38s
39853# do not know how this log version correlates to program version
39854>0x140	ulelong		x				\b, version %#x
39855# NumRecs
39856#>0x144	ulelong		x				\b, %#4.4x records
39857# EndOffset means files size
39858>0x148	ulelong		x				\b, %u bytes
39859# Flags 5 25h 35h
39860#>0x14c	ulelong		x				\b, flags %8.8x
39861# Reserved: array[0..26] of Longint
39862# the non Unicode HighestSupportedVersion may never become greater than or equal to 1000
39863>0x140	ulelong		<1000
39864# hostname
39865>>0x1d6	pstring		x				\b, %s
39866# user name
39867>>>&0	pstring		x				\b\%s
39868# directory like C:\Program Files (x86)\GnuWin32
39869>>>>&0	pstring		x				\b, "%s"
39870# version 1000 or higher implies unicode
39871>0x140	ulelong		>999
39872# hostname
39873>>0x1db	lestring16	x				\b, %-.9s
39874# utf string variant with prepending fe??ffFFff
39875>>0x1db	search/43	\xFF\xFF\xFF
39876# user name
39877>>>&0	lestring16	x				\b\%-.9s
39878>>>&0	search/43	\xFF\xFF\xFF
39879# directory like C:\Program Files\GIMP 2
39880>>>>&0	lestring16	x				\b, %-.42s
39881
39882# URL:      https://jrsoftware.org/ishelp/index.php?topic=setup_signeduninstaller
39883# Reference:https://github.com/jrsoftware/issrc/blob/main/Projects/Struct.pas
39884# From:     Joerg Jenderek
398850	string	Inno\ Setup\ Messages\ (
39886# null padded til 0x40 boundary
39887>0x38	quad		0				InnoSetup messages
39888!:mime	application/x-innosetup-msg
39889# unins000.msg, unins001.msg, ...
39890!:ext	msg
39891# version like 5.1.1 5.1.11 5.5.0 5.5.3 6.0.0
39892>>0x15	string		x				\b, version %.5s
39893# look for 6th char of version string or terminating right parentheses
39894>>>0x1a	ubyte		!0x29				\b%c
39895# NumMessages
39896>>0x40	ulelong		x				\b, %u messages
39897# TotalSize: Cardinal;
39898#>>0x44	ulelong		x				\b, TotalSize %u
39899# NotTotalSize: Cardinal;
39900#>>0x48	ulelong		x				\b, NotTotalSize %u
39901# CRCMessages: Longint;
39902#>>0x4C	ulelong		x				\b, CRC %#x
39903>>0x40	ulelong		x
39904# (u) after version means unicoded messages
39905>>>0x1c	search/2	(u)				(UTF-16),
39906>>>>0x50 lestring16	x				%s
39907# ASCII coded message
39908>>>0x1c	default		x				(ASCII),
39909>>>>0x50 string		x				%s
39910
39911# Windows Imaging (WIM) Image
39912# Update: Joerg Jenderek at Mar 2019, 2021
39913# URL: https://en.wikipedia.org/wiki/Windows_Imaging_Format
39914#      http://fileformats.archiveteam.org/wiki/Windows_Imaging_Format
39915# Reference: https://download.microsoft.com/download/f/e/f/
39916# fefdc36e-392d-4678-9e4e-771ffa2692ab/Windows%20Imaging%20File%20Format.rtf
39917# Note: verified by like `7z t boot.wim` `wiminfo install.esd --header`
399180	string		MSWIM\000\000\000
39919>0	use		wim-archive
39920# https://wimlib.net/man1/wimoptimize.html
399210	string		WLPWM\000\000\000
39922>0	use		wim-archive
399230	name		wim-archive
39924# _WIMHEADER_V1_PACKED ImageTag[8]
39925>0	string		x			Windows imaging
39926!:mime	application/x-ms-wim
39927# TO avoid in file version 5.36 error like
39928# Magdir/windows, 760: Warning: Current entry does not yet have a description
39929# file: could not find any valid magic files! (No error)
39930# split WIM
39931>16	ulelong		&0x00000008		(SWM
39932!:ext	swm
39933# usPartNumber; 1, unless the file was split into multiple parts
39934>>40	uleshort	x			\b %u
39935# usTotalParts; The total number of WIM file parts in a spanned set
39936>>42	uleshort	x			\b of %u) image
39937# non split WIM
39938>16	ulelong		^0x00000008
39939# https://wimlib.net/man1/wimmount.html
39940# solid WIMs; version 3584; usually contain LZMS-compressed and the .esd extension
39941>>12	ulelong		3584			(ESD) image
39942!:ext	esd
39943>>12	ulelong		!3584			(
39944# look for archive member RunTime.xml like in Microsoft.Windows.Cosa.Desktop.Client.ppkg
39945>>>156	search/68233/s		RunTime.xml	\bWindows provisioning package)
39946!:ext	ppkg
39947# if is is not a Windows provisioning package, then it is a WIM
39948>>>156	default			x		\bWIM) image
39949# second disk image part created by Microsoft's RecoveryDrive.exe has name Reconstruct.WIM2
39950!:ext	wim/wim2
39951>0	string/b	WLPWM\000\000\000	\b, wimlib pipable format
39952# cbSize size of the WIM header in bytes like 208
39953#>8	ulelong		x			\b, headersize %u
39954# dwVersion version of the WIM file 00010d00h~1.13 00000e00h~0.14
39955>14	uleshort	x			v%u
39956>13	ubyte		x			\b.%u
39957# dwImageCount; The number of images contained in the WIM file
39958>44	ulelong		>1			\b, %u images
39959# dwBootIndex
39960# 1-based index of the bootable image of the WIM, or 0 if no image is bootable
39961>0x78	ulelong		>0			\b, bootable no. %u
39962# dwFlags
39963#>16	ulelong		x			\b, flags %#8.8x
39964#define FLAG_HEADER_COMPRESSION		0x00000002
39965#define FLAG_HEADER_READONLY            0x00000004
39966#define FLAG_HEADER_SPANNED		0x00000008
39967#define FLAG_HEADER_RESOURCE_ONLY       0x00000010
39968#define FLAG_HEADER_METADATA_ONLY       0x00000020
39969#define FLAG_HEADER_WRITE_IN_PROGRESS   0x00000040
39970#define FLAG_HEADER_RP_FIX		0x00000080 reparse point fixup
39971#define FLAG_HEADER_COMPRESS_RESERVED   0x00010000
39972#define FLAG_HEADER_COMPRESS_XPRESS     0x00020000
39973#define FLAG_HEADER_COMPRESS_LZX	0x00040000
39974#define FLAG_HEADER_COMPRESS_LZMS	0x00080000
39975#define FLAG_HEADER_COMPRESS_XPRESS2    0x00100000 wimlib-1.13.0\include\wimlib\header.h
39976# XPRESS, with small chunk size
39977>16	ulelong		&0x00100000		\b, XPRESS2
39978>16	ulelong		&0x00080000		\b, LZMS
39979>16	ulelong		&0x00040000		\b, LZX
39980>16	ulelong		&0x00020000		\b, XPRESS
39981>16	ulelong		&0x00000002		compressed
39982>16	ulelong		&0x00000004		\b, read only
39983>16	ulelong		&0x00000010		\b, resource only
39984>16	ulelong		&0x00000020		\b, metadata only
39985>16	ulelong		&0x00000080		\b, reparse point fixup
39986#>16	ulelong		&0x00010000		\b, RESERVED
39987# dwCompressionSize; Uncompressed chunk size for resources or 0 if uncompressed
39988#>20	ulelong		>0			\b, chunk size %u bytes
39989# gWIMGuid
39990#>24	ubequad		x			\b, GUID %#16.16llx
39991#>>32	ubequad		x			\b%16.16llx
39992# rhOffsetTable; the location of the resource lookup table
39993# wim_reshdr_disk[24]= u8 size_in_wim[7] + u8 flags + le64 offset_in_wim + le64 uncompressed_size
39994#>48	ubequad		x			\b, rhOffsetTable %#16.16llx
39995# rhXmlData; the location of the XML data
39996#>0x50	ulelong		x			\b, at %#8.8x
39997# NOT WORKING \xff\xfe<\0W\0I\0M\0
39998#>(0x50.l)	ubequad	x			\b, xml=%16.16llx
39999# rhBootMetadata; the location of the metadata resource
40000#>0x60	ubequad		x			\b, rhBootMetadata %#16.16llx
40001# rhIntegrity; the location of integrity table used to verify files
40002#>0x7c	ubequad		x			\b, rhIntegrity %#16.16llx
40003# Unused[60]
40004#>148	ubequad		!0			\b,unused %#16.16llx
40005#
40006
40007# From:		Joerg Jenderek
40008# URL:		https://en.wikipedia.org/wiki/Windows_Easy_Transfer
40009# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/m/mig.trid.xml
40010# Note:		called "Windows Easy Transfer migration data" by TrID,
40011#		"Migration Store" or "EasyTransfer file" by Microsoft
400120		string		1giM	Windows Easy Transfer migration data
40013#!:mime		application/octet-stream
40014!:mime		application/x-ms-mig
40015!:ext		mig
40016>0x18		string		=MRTS	without password
40017# data offset with 1 space at end
40018>>0x1c		ulelong+0x38	x	\b, at %#x
40019# look for zlib compressed data by ./compress
40020>>(0x1c.l+0x38)	ubyte		x
40021>>>&-1	indirect	x
40022# in password protected examples MRTS comes some bytes further
40023>0x18		string		!MRTS	with password
40024# look for first MRTS tag
40025>0x18		search/29/b	MRTS
40026# probably first file name length like 178, ...
40027#>>&0		ulelong		x	\b, 1st length %u
40028# URL like File\C:\Users\nutzer\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini
40029>>&20		lestring16	x	\b, 1st %-s
40030
40031# Microsoft SYLK
40032# https://en.wikipedia.org/wiki/SYmbolic_LinK_(SYLK)
40033# https://outflank.nl/upload/sylksum.txt
400340	string	ID;P	Microsoft SYLK program
40035>4	string	>0	\b, created by %s
40036!:ext	slk/sylk
40037
40038# Summary:	Windows Performance Monitor Alert
40039# From:		Joerg Jenderek
40040# URL:		https://en.wikipedia.org/wiki/Performance_Monitor
40041# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/p/pma.trid.xml
40042# Note:		called "Windows Performance Monitor Alert" by TrID
400430	ubelong			=0xDC058340
40044>4	ubyte			=0		Windows Performance Monitor Alert
40045#!:mime		application/octet-stream
40046# https://www.thoughtco.com/mime-types-by-content-type-3469108
40047# https://filext.com/file-extension/PAM
40048!:mime		application/x-perfmon
40049#!:mime		application/x-ms-pma
40050!:ext		pma
40051# metric type like: "BrowserMetrics" "CrashpadMetrics" "SetupMetrics"
40052>>80	string			x		\b, "%s"
40053
40054# From:		Joerg Jenderek
40055# URL:		https://en.wikipedia.org/wiki/InstallShield
40056# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/i/ins.trid.xml
40057# Note:		contain also keywords like: BATCH_INSTALL ISVERSION LOGHANDLE SRCDIR SRCDISK WINDIR WINSYSDISK
400580	ubelong	0xB8C90C00	InstallShield Script
40059#!:mime	application/octet-stream
40060!:mime	application/x-installshield-ins
40061# like test.ins Setup.ins
40062!:ext	ins
40063# UNKNOWN like: 160034121de07e00 1600341260befe00 16003412e0783700
40064# 5000010021083f00 50000100b0335600 50000100cbfdf800 50000100dfbc4700
40065#>4	ubequad		x		\b, at 4 %#16.16llx
40066# copyright text like:	"Stirling Technologies, Inc.  (c) 1990-1994"
40067#			"InstallSHIELD Software Coporation  (c) 1990-1997"
40068>13	pstring/h	x		"%s"
40069# look for specific ASCII variable names
40070>1	search/0x121/s	SRCDIR	\b, variable names:
40071# 1st like: SRCDIR
40072>>&-4		leshort		x	#%u
40073>>&-2		pstring/h	x	%s
40074# 2nd like: SRCDISK
40075>>>&0		leshort		x	#%u
40076>>>&2		pstring/h	x	%s
40077# 3rd like: TARGETDISK
40078>>>>&0		leshort		x	#%u
40079>>>>&2		pstring/h	x	%s
40080# 4th like: TARGETDIR
40081#>>>>>&0		leshort		x	#%u
40082#>>>>>&2		pstring/h	x	%s
40083# 5th like: WINDIR
40084#>>>>>>&0	leshort		x	#%u
40085#>>>>>>&2	pstring/h	x	%s
40086# 6th like: WINDISK
40087#>>>>>>>&0	leshort		x	#%u
40088#>>>>>>>&2	pstring/h	x	%s
40089# 7th like: WINSYSDIR
40090#>>>>>>>>&0	leshort		x	#%u
40091#>>>>>>>>&2	pstring/h	x	%s
40092# ... LOGHANDLE
40093>0		ubelong		x	...
40094#
40095
40096#------------------------------------------------------------------------------
40097# $File: wireless,v 1.2 2009/09/19 16:28:13 christos Exp $
40098# wireless-regdb:        file(1) magic for CRDA wireless-regdb file format
40099#
401000	string	RGDB	CRDA wireless regulatory database file
40101>4	belong	19	(Version 1)
40102
40103#------------------------------------------------------------------------------
40104# $File: wordprocessors,v 1.31 2022/08/31 08:00:53 christos Exp $
40105# wordprocessors:  file(1) magic fo word processors.
40106#
40107####### PWP file format used on Smith Corona Personal Word Processors:
401082	string	\040\040\040\040\040\040\040\040\040\040\040ML4D\040'92	Smith Corona PWP
40109>24	byte	2	\b, single spaced
40110>24	byte	3	\b, 1.5 spaced
40111>24	byte	4	\b, double spaced
40112>25	byte	0x42	\b, letter
40113>25	byte	0x54	\b, legal
40114>26	byte	0x46	\b, A4
40115
40116# URL:	http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
40117# reference:	http://mark0.net/download/triddefs_xml.7z
40118#		/defs/w/wps-works-dos.trid.xml
40119# From:	Joerg Jenderek
40120# Note:	older non OLE 2 Compound based versions
401210	ubeshort	=0x01FE
40122>112	ubeshort	=0x0100		Microsoft Works 1-3 (DOS) or 2 (Windows) document
40123# title like THE GREAT KHAN GAME
40124>>0x100	string		x		%s
40125!:mime	application/vnd-ms-works
40126#!:mime	application/x-msworks
40127# https://www.macdisk.com/macsigen.php
40128!:apple	????AWWP
40129!:ext	wps
40130
40131# Corel/WordPerfect
40132# URL:		https://en.wikipedia.org/wiki/WordPerfect
40133# Reference:	https://github.com/OneWingedShark/WordPerfect/blob/master/doc/SDK_Help/FileFormats/WPFF_DocumentStructure.htm
40134#		http://mark0.net/download/triddefs_xml.7z/defs/w/wp-generic.trid.xml
401350	string	\xffWPC
40136# WordPerfect
40137>8	byte	1
40138# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/w/wpm-macro.trid.xml
40139# Note:		there exist other macro variants
40140>>9	byte	1	WordPerfect macro
40141#!:mime		application/octet-stream
40142!:mime		application/x-wordperfect-wpm
40143# like: ALTD.WPM ENDFOOT.WPM FOOTEND.WPM LABELS.WPM REVEALTX.WPM
40144!:ext		wpm
40145# Note:		used in WordPerfect 5.1; there exist other FIL variants
40146>>9	byte	2	WordPerfect help file
40147#!:mime		application/octet-stream
40148!:mime		application/x-wordperfect-help
40149# like: WPHELP.FIL
40150!:ext		fil
40151# pointer to document area like: 10h
40152>>>4		ulelong	!0x10	\b, at %#x document area
40153>>9	byte	3	WordPerfect keyboard file
40154#!:mime		application/octet-stream
40155!:mime		application/x-wordperfect-keyboard
40156!:ext		wpk
40157# no document area, so point to end of file; so this is file size like: 23381 2978 32835 3355 3775 919
40158>>>4		ulelong	x	\b, %u bytes
40159>>9	byte	4	WordPerfect VAX keyboard definition
40160#!:mime	application/octet-stream
40161!:mime	application/x-wordperfect-keyboard
40162#!:ext	foo
40163# URL:		http://fileformats.archiveteam.org/wiki/WordPerfect
40164# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/w/wpd-doc-gen.trid.xml
40165>>9	byte	10	WordPerfect document
40166# https://www.iana.org/assignments/media-types/application/vnd.wordperfect
40167!:mime		application/vnd.wordperfect
40168#!:apple		????WPC2
40169# TODO: distinguish different suffix
40170!:ext		wpd/wpt/wkb/icr/tut/sty/tst/crs
40171>>9	byte	11	WordPerfect dictionary
40172>>9	byte	12	WordPerfect thesaurus
40173>>9	byte	13	WordPerfect block
40174>>9	byte	14	WordPerfect rectangular block
40175>>9	byte	15	WordPerfect column block
40176>>9	byte	16	WordPerfect printer data
40177#!:mime		application/octet-stream
40178!:mime		application/x-wordperfect-prs
40179# like: STANDARD.PRS WORKBOOK.PRS
40180!:ext		prs
40181# like: "Standard Printer" "Workbook Printer"
40182>>>0x64		pstring/B	>A	"%s"
40183#>>9	byte	18	WordPerfect Prefix information file
40184# printer resource .ALL
40185>>9	byte	19	WordPerfect printer data
40186#!:mime		application/octet-stream
40187!:mime		application/x-wordperfect-all
40188!:ext		all
40189# display Resource
40190>>9	byte	20	WordPerfect driver resource data
40191#!:mime		application/octet-stream
40192!:mime		application/x-wordperfect-drs
40193# like: WPSMALL.DRS
40194!:ext		drs
40195# pointer to index area with string "smalldrs" like: 46h
40196>>>4		uleshort	!0x46	\b, at %#x index area
40197>>9	byte	21	WordPerfect Overlay file
40198#!:mime		application/octet-stream
40199!:mime		application/x-wordperfect-fil
40200# like: WP.FIL
40201!:ext		fil
40202# URL:		http://fileformats.archiveteam.org/wiki/WordPerfect_Graphics
40203# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-wpg.trid.xml
40204# Note:		called "WordPerfect Graphics bitmap" by TrID and
40205#		"WordPerfect Graphics Metafile" by DROID via x-fmt/395 fmt/1042
40206#		"WPG (Word Perfect Graphics)" by ImageMagick `identify -verbose BUTTRFLY.WPG`
40207>>9	byte	22	WordPerfect graphic image
40208# TODO: skip DROID x-fmt-395-signature-id-132.wpg by check for existing document area
40209#>>>4		ulelong	>15	WordPerfect_graphic_OK
40210#!:mime		application/octet-stream
40211# http://extension.nirsoft.net/wpg
40212!:mime		image/x-wordperfect-graphics
40213# https://reposcope.com/mimetype/application/x-wpg
40214#!:mime		application/x-wpg
40215# like: BUTTRFLY.WPG STAR-5.WPG input.wpg WORDPFCT.WPG
40216!:ext		wpg
40217# pointer to document area like: 10h 1Ah
40218>>>4		ulelong		!0x1A	\b, at %#x document area
40219>>9	byte	23	WordPerfect hyphenation code
40220>>9	byte	24	WordPerfect hyphenation data
40221>>9	byte	25	WordPerfect macro resource data
40222#!:mime		application/octet-stream
40223!:mime		application/x-wordperfect-mrs
40224# like: WP.MRS
40225!:ext		mrs
40226>>9	byte	27	WordPerfect hyphenation lex
40227>>9	byte	29	WordPerfect wordlist
40228>>9	byte	30	WordPerfect equation resource data
40229#!:mime		application/octet-stream
40230!:mime		application/x-wordperfect-qrs
40231# like: WQ.QRS wpDE.qrs wpen.qrs
40232!:ext		qrs
40233# jump to document area with some marker and equation
40234>>>(4.l)	ubyte	x
40235# equation like: "Fraction:  x OVER y"
40236>>>>&1		string	>A	(...%-.19s...)
40237# pointer to document area like: 17C4h
40238>>>4		ulelong	x	\b, at %#x document area
40239#>>9	byte	31	reserved
40240#>>9	byte	32	WordPerfect VAX .SET
40241>>9	byte	33	WordPerfect spell rules
40242>>9	byte	34	WordPerfect dictionary rules
40243#>>9	byte	35	reserved
40244# video resource device driver
40245# Note:		 filetype 26 for VRS and filetype 36 for WPD apparently is wrong
40246>>9	byte	36	WordPerfect Video Resource
40247#!:mime		application/octet-stream
40248!:mime		application/x-wordperfect-vrs
40249# like: STANDARD.VRS
40250!:ext		vrs
40251# like: "IBM CGA (& compatibles)"
40252>>>0x20		string	>A	"%.23s"
40253>>9	byte	39	WordPerfect spell rules (Microlytics)
40254#>>9	byte	40	reserved
40255>>9	byte	41	WordPerfect Install options
40256#!:mime		application/octet-stream
40257!:mime		application/x-wordperfect-ins
40258# like: WP51.INS
40259!:ext		ins
40260# probably default directory name like: "C:\WP51\"
40261>>>0x12		string	>A	"%.8s"
40262# maybe mouse driver for WP5.1
40263>>9	byte	42	WordPerfect Resource
40264#!:mime		application/octet-stream
40265!:mime		application/x-wordperfect-irs
40266# like: STANDARD.IRS
40267!:ext		irs
40268# like: "Mouse Driver (MOUSE.COM)"
40269>>>0x28		string	>A	"%.24s"
40270>>9	byte	43	WordPerfect settings file
40271# maybe Macintosh WP2.0 document
40272>>9	byte	44	WordPerfect 3.5 document
40273!:mime		application/vnd.wordperfect
40274!:apple		????WPD3
40275# like: WP3.wpd
40276!:ext		wpd
40277>>9	byte	45	WordPerfect 4.2 document
40278# External spell code module (WP5.1)
40279#>>9	byte	46	WordPerfect external spell
40280# external spell dictionary .LEX
40281#>>9	byte	47	WordPerfect external spell dictionary
40282# Macintosh SOFT graphics file (SOFT (Sequential Object Format)
40283#>>9	byte	48	WordPerfect SOFT graphics
40284#>>9	byte	49	reserved
40285#>>9	byte	50	reserved
40286# WPWin 5.1 Application Resource Library added for WPWin 5.1
40287#>>9	byte	51	WordPerfect application resource library
40288>>9	byte	69	WordPerfect dialog file
40289# From:		Joerg Jenderek
40290# Note:		found in sub directory WritingTools inside WordPerfect 2021 program directory
40291>>9	byte	70	WordPerfect Writing Tools
40292#!:mime	application/octet-stream
40293!:mime	application/x-wordperfect-cbt
40294# like: Wt13cbede.cbt Wt13cbeit.cbt Wt13cbefr.cbt WT21cbede.cbt Wt13cbeEN.CBD WT21cbeEN.CBD
40295!:ext	cbd/cbt
40296>>9	byte	76	WordPerfect button bar
40297>>9	default x
40298>>>9	byte	x	Corel WordPerfect: Unknown filetype %d
40299# Corel Shell
40300>8	byte	2
40301>>9	byte	1	Corel shell macro
40302>>9	byte	10	Corel shell definition
40303>>9	default x
40304>>>9	byte	x	Corel Shell: Unknown filetype %d
40305# Corel Notebook
40306>8	byte	3
40307>>9	byte	1	Corel Notebook macro
40308>>9	byte	2	Corel Notebook help file
40309>>9	byte	3	Corel Notebook keyboard file
40310>>9	byte	10	Corel Notebook definition
40311>>9	default	x
40312>>>9	byte	x	Corel Notebook: Unknown filetype %d
40313# Corel Calculator
40314>8	byte	4
40315>>9	byte	2	Corel Calculator help file
40316>>9	default	x
40317>>>9	byte	x	Corel Calculator: Unknown filetype %d
40318# Corel File Manager
40319>8	byte	5
40320>>9	default	x
40321>>>9	byte	x	Corel File Manager: Unknown filetype %d
40322# Corel Calendar
40323>8	byte	6
40324>>9	byte 	2	Corel Calendar help file
40325>>9	byte 	10	Corel Calendar data file
40326>>9	default	x
40327>>>9	byte	x	Corel Calendar: Unknown filetype %d
40328# Corel Program Editor/Ed Editor
40329>8	byte	7
40330>>9	byte	1	Corel Editor macro
40331>>9	byte	2	Corel Editor help file
40332>>9	byte	3	Corel Editor keyboard file
40333>>9	byte	25	Corel Editor macro resource file
40334>>9	default	x
40335>>>9	byte	x	Corel Program Editor/Ed Editor: Unknown filetype %d
40336# Corel Macro Editor
40337>8	byte	8
40338>>9	byte 	1	Corel Macro editor macro
40339>>9	byte 	2	Corel Macro editor help file
40340>>9	byte	3	Corel Macro editor keyboard file
40341>>9	default	x
40342>>>9	byte	x	Corel Macro Editor: Unknown filetype %d
40343# Corel Plan Perfect
40344>8	byte	9
40345>>9	default	x
40346>>>9	byte	x	Corel Plan Perfect: Unknown filetype %d
40347# Corel DataPerfect
40348>8	byte	10
40349# CHECK: Don't these belong into product 9?
40350>>9	byte	1	Corel PlanPerfect macro
40351>>9	byte	2	Corel PlanPerfect help file
40352>>9	byte	3	Corel PlanPerfect keyboard file
40353>>9	byte	10	Corel PlanPerfect worksheet
40354>>9	byte	15	Corel PlanPerfect printer definition
40355>>9	byte	18	Corel PlanPerfect graphic definition
40356>>9	byte	19	Corel PlanPerfect data
40357>>9	byte	20	Corel PlanPerfect temporary printer
40358>>9	byte	25	Corel PlanPerfect macro resource data
40359>>9	default	x
40360>>>9	byte	x	Corel DataPerfect: Unknown filetype %d
40361# Corel Mail
40362>8	byte	11
40363>>9	byte	2	Corel Mail help file
40364>>9	byte	5	Corel Mail distribution list
40365>>9	byte	10	Corel Mail out box
40366>>9	byte	11	Corel Mail in box
40367>>9	byte	20	Corel Mail users archived mailbox
40368>>9	byte	21	Corel Mail archived message database
40369>>9	byte	22	Corel Mail archived attachments
40370>>9	default	x
40371>>>9	byte	x	Corel Mail: Unknown filetype %d
40372# Corel Printer
40373>8	byte	12
40374>>9	byte	11	Corel Printer temporary file
40375>>9	default	x
40376>>>9	byte	x	Corel Printer: Unknown filetype %d
40377# Corel Scheduler
40378>8	byte	13
40379>>9	byte	2	Corel Scheduler help file
40380>>9	byte	10	Corel Scheduler in file
40381>>9	byte	11	Corel Scheduler out file
40382>>9	default	x
40383>>>9	byte	x	Corel Scheduler: Unknown filetype %d
40384# Corel WordPerfect Office
40385>8	byte	14
40386>>9	byte	10	Corel GroupWise settings file
40387>>9	byte	17	Corel GroupWise directory services
40388>>9	byte	43	Corel GroupWise settings file
40389>>9	default	x
40390>>>9	byte	x	Corel WordPerfect Office: Unknown filetype %d
40391# Corel DrawPerfect
40392>8	byte	15
40393>>9	default	x
40394>>>9	byte	x	Corel DrawPerfect: Unknown filetype %d
40395# Corel LetterPerfect
40396>8	byte	16
40397>>9	default	x
40398>>>9	byte	x	Corel LetterPerfect: Unknown filetype %d
40399# Corel Terminal
40400>8	byte	17
40401>>9	byte	10	Corel Terminal resource data
40402>>9	byte	11	Corel Terminal resource data
40403>>9	byte	43	Corel Terminal resource data
40404>>9	default	x
40405>>>9	byte	x	Corel Terminal: Unknown filetype %d
40406# Corel loadable file
40407>8	byte	18
40408>>9	byte	10	Corel loadable file
40409>>9	byte	11	Corel GUI loadable text
40410>>9	byte	12	Corel graphics resource data
40411>>9	byte	13	Corel printer settings file
40412>>9	byte	14	Corel port definition file
40413>>9	byte	15	Corel print queue parameters
40414>>9	byte	16	Corel compressed file
40415>>9	default	x
40416>>>9	byte	x	Corel loadable file: Unknown filetype %d
40417>>15	byte	0	\b, optimized for Intel
40418>>15	byte	1	\b, optimized for Non-Intel
40419# Network service
40420>8	byte	20
40421>>9	byte	10	Corel Network service msg file
40422>>9	byte	11	Corel Network service msg file
40423>>9	byte	12	Corel Async gateway login msg
40424>>9	byte	14	Corel GroupWise message file
40425>>9	default	x
40426>>>9	byte	x	Corel Network service: Unknown filetype %d
40427# GroupWise
40428>8	byte	31
40429>>9	byte	20	GroupWise admin domain database
40430>>9	byte	21	GroupWise admin host database
40431>>9	byte	23	GroupWise admin remote host database
40432>>9	byte	24	GroupWise admin ADS deferment data file
40433>>9	default	x
40434>>>9	byte	x	GroupWise: Unknown filetype %d
40435# Corel Writing Tools WT*.*
40436# From:		Joerg Jenderek
40437# URL:		https://support.corel.com/hc/en-us/articles/215876258-Writing-Tools-Spell-Check-Dictionary-does-not-work-in-WordPerfect-X5
40438#		http://wordperfect.helpmax.net/en/editing-and-formatting-documents/using-the-writing-tools/working-with-user-word-lists/
40439# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/u/uwl-wp.trid.xml
40440>8	byte	32
40441>>9	byte	10	Corel Writing Tools User Word List
40442#!:mime	application/octet-stream
40443!:mime	application/x-wordperfect-wordlist
40444# personal user word list UWL under user directory like: WTDE.UWL WTUS.UWL WT21DE.UWL WT21US.UWL WT13DE.UWL ...
40445# and "template" SAV/HWL variant under program directory like: wt13en.hwl Wt13de.sav Wt13it.sav wt13ru.sav WT21us.sav Wtcz.sav ...
40446!:ext	uwl/hwl/sav
40447# jump to document area with some marker and word list
40448>>>(4.l)	ubyte	x
40449# look for beginning of word list starting mostly with letter a as UTF-16 like: Wt13es.sav
40450# but not found in russian wt13ru.sav
40451>>>>&0	search/91/sb	a\0
40452# word list starting like: "acsesory\022accessory.\001\026acomodate\026accommodate4\001"
40453>>>>>&0		lestring16	x	(...%-.33s...)
40454# pointer to document area like: 200h
40455>>>4	ulelong	!0x200	\b, at %#x document area
40456# file size, not including pad characters at EOF
40457>>>0x14	uleshort x	\b, %u bytes
40458# IntelliTAG
40459>8	byte	33
40460>>9	byte	10	IntelliTAG (SGML) compiled DTD
40461>>9	default	x
40462>>>9	byte	x	IntelliTAG: Unknown filetype %d
40463# Summary:	Corel WordPerfect WritingTools advise part
40464# From:		Joerg Jenderek
40465# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/a/adv-wp.trid.xml
40466>8	byte	34
40467>>9	byte	11	Corel WordPerfect dictionary advise
40468#!:mime	application/octet-stream
40469!:mime	application/x-wordperfect-adv
40470#!:mime	application/vnd.wordperfect.adv
40471# like: WT21de.adv Wt13de.adv Wt13es.adv Wt13fr.adv wt13us.adv
40472!:ext	adv
40473# advise text part often start with tag like: 580A
40474#>>>(16.s)	ubequad	x	ADVISE PART %#llx
40475# part of advise text like: "This is too informal for most writing."
40476>>>(16.s+16)	string	x	(...%-.33s...)
40477# everything else
40478>8	default x
40479>>8	byte	x	Unknown Corel/Wordperfect product %d,
40480>>>9	byte	x	file type %d
40481>10	byte	0	\b, v5.
40482>10	byte	!0	\b, v%d.
40483>11	byte	x	\b%d
40484
40485# Hangul (Korean) Word Processor File
404860	string	HWP\ Document\ File	Hangul (Korean) Word Processor File 3.0
40487
40488# CosmicBook, from Benoit Rouits
404890       string  CSBK    Ted Neslson's CosmicBook hypertext file
40490
404912       string  EYWR    AmigaWriter file
40492
40493# chi:  file(1) magic for ChiWriter files
404940       string          \\1cw\          ChiWriter file
40495>5      string          >\0             version %s
404960       string          \\1cw           ChiWriter file
40497
40498# Quark Express from https://www.garykessler.net/library/file_sigs.html
404992	string	IIXPR3			Intel Quark Express Document (English)
405002	string	IIXPRa			Intel Quark Express Document (Korean)
405012	string	MMXPR3			Motorola Quark Express Document (English)
40502!:mime	application/x-quark-xpress-3
405032	string	MMXPRa			Motorola Quark Express Document (Korean)
40504
40505# From:		Joerg Jenderek
40506# URL:		http://fileformats.archiveteam.org/wiki/PageMaker
40507#		https://en.wikipedia.org/wiki/Adobe_PageMaker
40508# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/p
40509#		pm4-pagemaker.trid.xml
40510#		pm5-pagemaker.trid.xml
40511# Note:		since version 6 in 1995 called Adobe PageMaker and
40512#		embedded in Compound Document handled by ./ole2compounddocs
40513#		mainly tested little endian variant
405144	ubelong		=0x0000FF99
40515>0	use		PageMaker
40516# big endian variant
405174	ubelong		=0x000099FF
40518>0	use		\^PageMaker
40519#	display information of Aldus/Adobe PageMaker document/publication
405200	name		PageMaker
40521>110	uleshort	<0x0600			Aldus
40522>110	uleshort	>0x05FF			Adobe
40523>110	uleshort	x			PageMaker
40524# "MP" marker for newer version 4 and above according to TrID
40525#>108	string		x			\b, MARKER "%.2s"
40526# http://www.nationalarchives.gov.uk/pronom/fmt/876
40527!:mime		application/vnd.pagemaker
40528#!:mime		application/x-pagemaker
40529# different file name extensions are used depending on version
40530# older version like 3
40531>110	uleshort/256	=0			document
40532# https://www.macdisk.com/macsigen.php
40533!:apple	ALB3ALD3
40534# PT3 for template and no example for PageMaker document/publiction with PM3 extension
40535!:ext	pm3/pt3
40536>110	uleshort/256	=4			document
40537!:apple	ALD4ALB4
40538# no example for PT4 template
40539!:ext	pm4/pt4
40540>110	uleshort/256	=5			document
40541!:apple	ALD5ALB5
40542# no example for PT5 template
40543!:ext	pm5/pt5
40544>110	uleshort	=0x0600			document
40545!:apple	ALD6ALB6
40546# PT6 for template
40547!:ext	pm6/pt6
40548# HOWTO to distinguish version 7 from 6.5 ?
40549>110	uleshort	=0x0632			document
40550!:apple	AD65AB65
40551# no example for T65 template
40552!:ext	p65/t65/pmd/pmt
40553# version 7 with PMT extension for template
40554#!:ext	pmd/pmt
40555#!:apple	????PUBF
40556# endian marker FF 99 for little endian
40557>6	ubyte	=0xFF			\b, little-endian
40558>6	ubyte	=0x99			\b, big-endian
40559# newer numeric version like: 4 5 6 6.50
40560#>110	uleshort	x			\b, VERSION=%#x
40561>110	uleshort	>0x03FF
40562>>110	uleshort/256	x			\b, version %u
40563>>110	uleshort%256	>0			\b.%u
40564# older version like 3
40565>110	uleshort	<0x0400			\b, maybe version 3
40566
40567# adobe indesign (document, whatever...) from querkan
405680	belong	0x0606edf5		Adobe InDesign
40569>16	string	DOCUMENT		Document
40570
40571#------------------------------------------------------------------------------
40572# ichitaro456: file(1) magic for Just System Word Processor Ichitaro
40573#
40574# Contributor kenzo-:
40575# Reversed-engineered JS Ichitaro magic numbers
40576#
40577
405780	string		DOC
40579>43	byte		0x14	Just System Word Processor Ichitaro v4
40580!:mime	application/x-ichitaro4
40581>144	string	JDASH		application/x-ichitaro4
40582
405830	string		DOC
40584>43	byte		0x15	Just System Word Processor Ichitaro v5
40585!:mime	application/x-ichitaro5
40586
405870	string		DOC
40588>43	byte		0x16	Just System Word Processor Ichitaro v6
40589!:mime	application/x-ichitaro6
40590
40591# Type: Freemind mindmap documents
40592# From: Jamie Thompson <debian-bugs@jamie-thompson.co.uk>
405930	string/w	\<map\ version	Freemind document
40594!:mime	application/x-freemind
40595
40596# Type: Freeplane mindmap documents
40597# From: Felix Natter <fnatter@gmx.net>
405980       string/w        \<map\ version="freeplane  Freeplane document
40599!:mime  application/x-freeplane
40600
40601# Type:        Scribus
40602# From:        Werner Fink <werner@suse.de>
406030	string	\<SCRIBUSUTF8\ Version		Scribus Document
406040	string	\<SCRIBUSUTF8NEW\ Version	Scribus Document
40605!:mime	application/x-scribus
40606
40607# help files .hlp compiled from html and used by gfxboot added by Joerg Jenderek
40608# markups page=0x04,label=0x12, followed by strings like "opt" or "main" and title=0x14
406090	ulelong&0x8080FFFF	0x00001204	gfxboot compiled html help file
40610
40611# From:		Joerg Jenderek
40612# URL:		https://en.wikipedia.org/wiki/StarOffice
40613# Reference:	http://mark0.net/download/triddefs_xml.7z
40614#		/defs/t/thm-staroffice.trid.xml
40615# Note:		used in Star-, Open- and Libre-Office
40616# named as soffice.StarConfigFile.6 or OpenOffice.org configuration by others
406170		ubeshort	0x0400
40618# non nil gap
40619#>(2.s+8)	ubequad		x		\b, gap %#16.16llx
40620# test for null value in gap after theme name maybe unreliable
40621#>(2.s+9)	ubyte		0		\b, 0-byte
40622# look for keyword GALRESRV near the end
40623# "C:\Program Files (x86)\StarOffice6.0\share\gallery\sg27.thm" Navigation, 238 objects
40624#>0		search/8415	GALRESRV	\b, GALRESRV found
40625# "neues thema6.thm" MorePictures, 315 objects
40626#>0		search/19299	GALRESRV	\b, GALRESRV FOUND
40627#>2		uleshort	x		\b, name length %u
40628# skip file2147.chk by check for positive name length like for sg16.thm "3D"
40629>2		uleshort	>0
40630# skip dBase printer form T6.PRF with misidentified gallery
40631# name :\DBASE\IV\T6.txts by check for 1st object name or RESRV keyword
40632# https://www.clicketyclick.dk/databases/xbase/xbase/dbase_ex.zip
40633# template/t6/with_data/T6.PRF
40634# by first char of object name or RESRV part of keyword GALRESRV
40635>>(2.s+13)	ubyte		>0x1F		StarOffice Gallery theme
40636!:mime		application/x-stargallery-thm
40637# thm is also used for JPEG thumbnail images
40638!:ext		thm
40639# gallery name often 1 word like: 3D sounds Diagrams Flussdiagramme Fotos
40640# or like private://gallery/hidden/imgppt "Cisco - WAN - LAN"
40641>>>2		pstring/h	x		%s
40642# number of objects
40643>>>(2.s+4)	ulelong		x		\b, %u object
40644# plural s
40645>>>(2.s+4)	ulelong		!1		\bs
40646# if available then display first object name
40647>>>(2.s+4)	ulelong		>0
40648# partial file name, URL or internal name like "dd2*" of 1st object or RESRV
40649>>>>(2.s+11)	pstring/h	x		\b, 1st %s
40650
40651# From:	Joerg Jenderek
40652# URL:	http://fileformats.archiveteam.org/wiki/StarOffice_Gallery
40653# Note:	used in Star-, Open- and Libre-Office and found in directories like
40654#	%APPDATA%\Roaming\LibreOffice\4\user\gallery
40655#	$HOME/.config/libreoffice/4/user/gallery
406560	string		SGA3	StarOffice Gallery thumbnails
40657# Unknown like 0x04000?0001000142
40658#>4	ubequad		x	\b, UNKNOWN %#16.16llx
40659#!:mime	application/x-sdg
40660!:mime	application/x-stargallery-sdg
40661!:ext	sdg
40662# display image magic for debugging purpose like 'BM'
40663# looking like PC bitmap, Windows 3.x format with unknown compression
40664#>11	string		x	\b, image magic '%-.2s'
40665# inspect 1st GALLERY thumbnail magic by ./images with 1 space at end
40666#>11	indirect	x	\b; contains
40667
40668
40669#------------------------------------------------------------------------------
40670# $File: wsdl,v 1.6 2021/04/26 15:56:00 christos Exp $
40671# wsdl: PHP WSDL Cache, https://www.php.net/manual/en/book.soap.php
40672# Cache format extracted from source:
40673# https://svn.php.net/viewvc/php/php-src/trunk/ext/soap/php_sdl.c?revision=HEAD&view=markup
40674# Requires file >= 5.05
40675# By Elan Ruusamae <glen@delfi.ee>, Patryk Zawadzki <patrys@pld-linux.org>, 2010-2011
406760		string		wsdl		PHP WSDL cache,
40677>4		byte		x		version %#02x
40678>6		ledate		x		\b, created %s
40679
40680# uri
40681>10		lelong		<0x7fffffff
40682>>10		pstring/l	x		\b, uri: "%s"
40683
40684# source
40685>>>&0		lelong		<0x7fffffff
40686>>>>&-4		pstring/l	x		\b, source: "%s"
40687
40688# target_ns
40689>>>>>&0		lelong		<0x7fffffff
40690>>>>>>&-4	pstring/l	x		\b, target_ns: "%s"
40691#------------------------------------------------------------------------------
40692# x68000:  file(1) magic for the Sharp Home Computer
40693# v1.0
40694# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
40695
40696# Yanagisawa PIC picture
406970	string		PIC
40698>3	search/0x200	\x1A
40699>>&0	search/0x200	\x0
40700>>>&0	ubyte		0		Yanagisawa PIC image file,
40701>>>>&0	ubyte&15	0		model: X68000,
40702>>>>&0	ubyte&15	1		model: PC-88VA,
40703>>>>&0	ubyte&15	2		model: FM-TOWNS,
40704>>>>&0	ubyte&15	3		model: MAC,
40705>>>>&0	ubyte&15	15		model: Generic,
40706>>>>&3	ubeshort	x		%dx
40707>>>>&5	ubeshort	x		\b%d,
40708>>>>&1	ubeshort	4		colors: 16
40709>>>>&1	ubeshort	8		colors: 256
40710>>>>&1	ubeshort	12		colors: 4096
40711>>>>&1	ubeshort	15		colors: 32768
40712>>>>&1	ubeshort	16		colors: 65536
40713>>>>&1	ubeshort	>16		colors: %d-bit
40714
40715
40716
40717#------------------------------------------------------------------------------
40718# $File: xdelta,v 1.5 2011/08/08 09:01:05 christos Exp $
40719# file(1) magic(5) data for xdelta  Josh MacDonald <jmacd@CS.Berkeley.EDU>
40720#
407210	string	%XDELTA%	XDelta binary patch file 0.14
407220	string	%XDZ000%	XDelta binary patch file 0.18
407230	string	%XDZ001%	XDelta binary patch file 0.20
407240	string	%XDZ002%	XDelta binary patch file 1.0
407250	string	%XDZ003%	XDelta binary patch file 1.0.4
407260	string	%XDZ004%	XDelta binary patch file 1.1
40727
407280	string \xD6\xC3\xC4\x00	VCDIFF binary diff
40729
40730#------------------------------------------------------------------------------
40731# $File: xenix,v 1.14 2021/04/26 15:56:00 christos Exp $
40732# xenix:  file(1) magic for Microsoft Xenix
40733#
40734# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small
40735# model" lifted from "magic.xenix", with comment "derived empirically;
40736# treat as folklore until proven"
40737#
40738# "small model", "large model", "huge model" stuff lifted from XXX
40739#
40740# XXX - "x.out" collides with PDP-11 archives
40741#
407420	string		core		core file (Xenix)
40743# URL: http://www.polarhome.com/service/man/?qf=86rel&tf=2&of=Xenix
40744#      http://fileformats.archiveteam.org/wiki/OMF
40745# Reference: http://www.azillionmonkeys.com/qed/Omfg.pdf
40746# Update: Joerg Jenderek
40747# recordtype~TranslatorHEADerRecord
407480	byte		0x80
40749# GRR: line above is too general as it catches also Extensible storage engine DataBase,
40750# all lif files like forth.lif hpcc88.lif lex90b.lif ( See ./lif)
40751# and all compressed DEGAS low-res bitmaps like: MUNCHIE.PC1 PIDER1.PC1
40752# skip examples like GENA.SND Switch.Snd by looking for record length maximal 1024-3
40753>1	uleshort	<1022
40754# skip examples like GAME.PICTURE Strange.Pic by looking for positive record length
40755>>1	uleshort	>0
40756# skip examples like Xtable.Data FRACTAL.GEN SHR.VIEW by looking for positive string length
40757>>>3	ubyte		>0
40758# skip examples like OMBRE.6 with "UUUUUU" name by looking for valid high second record type
40759>>>>(1.s+3)	ubyte	>0x6D	8086 relocatable (Microsoft)
40760#!:mime	application/octet-stream
40761!:mime	application/x-object
40762!:ext	obj/o/a
40763# T-module name often source name like "hello.c" or "jmppm32.asm" in JMPPM32.OBJ or
40764# "kbhit" in KBHITS.OBJ or "CAUSEWAY_KERNAL" in CWAPI.OBJ
40765>>>>>3	pstring		x		\b, "%s"
40766# data length probably lower 256 according to TrID obj_omf.trid.xml
40767>>>>>1	uleshort	x		\b, 1st record data length %u
40768# checksum
40769#>>>>>(3.b+4)	ubyte	x		\b, checksum %#2.2x
40770# second recordtype: 96h~LNAMES 88h~COMENT 8CH~EXTDEF
40771>>>>>(1.s+3)	ubyte	x		\b, 2nd record type %#x
40772>>>>>(1.s+4)	uleshort x		\b, 2nd record data length %u
407730	leshort		0xff65		x.out
40774>2	string		__.SYMDEF	 randomized
40775>0	byte		x		archive
407760	leshort		0x206		Microsoft a.out
40777>8	leshort		1		Middle model
40778>0x1e	leshort		&0x10		overlay
40779>0x1e	leshort		&0x2		separate
40780>0x1e	leshort		&0x4		pure
40781>0x1e	leshort		&0x800		segmented
40782>0x1e	leshort		&0x400		standalone
40783>0x1e	leshort		&0x8		fixed-stack
40784>0x1c	byte		&0x80		byte-swapped
40785>0x1c	byte		&0x40		word-swapped
40786>0x10	lelong		>0		not-stripped
40787>0x1e	leshort		^0xc000		pre-SysV
40788>0x1e	leshort		&0x4000		V2.3
40789>0x1e	leshort		&0x8000		V3.0
40790>0x1c	byte		&0x4		86
40791>0x1c	byte		&0xb		186
40792>0x1c	byte		&0x9		286
40793>0x1c	byte		&0xa		386
40794>0x1f	byte		<0x040		small model
40795>0x1f	byte		=0x048		large model
40796>0x1f	byte		=0x049		huge model
40797>0x1e	leshort		&0x1		executable
40798>0x1e	leshort		^0x1		object file
40799>0x1e	leshort		&0x40		Large Text
40800>0x1e	leshort		&0x20		Large Data
40801>0x1e	leshort		&0x120		Huge Objects Enabled
40802>0x10	lelong		>0		not stripped
40803
408040	leshort		0x140		old Microsoft 8086 x.out
40805>0x3	byte		&0x4		separate
40806>0x3	byte		&0x2		pure
40807>0	byte		&0x1		executable
40808>0	byte		^0x1		relocatable
40809>0x14	lelong		>0		not stripped
40810
408110	lelong		0x206		b.out
40812>0x1e	leshort		&0x10		overlay
40813>0x1e	leshort		&0x2		separate
40814>0x1e	leshort		&0x4		pure
40815>0x1e	leshort		&0x800		segmented
40816>0x1e	leshort		&0x400		standalone
40817>0x1e	leshort		&0x1		executable
40818>0x1e	leshort		^0x1		object file
40819>0x1e	leshort		&0x4000		V2.3
40820>0x1e	leshort		&0x8000		V3.0
40821>0x1c	byte		&0x4		86
40822>0x1c	byte		&0xb		186
40823>0x1c	byte		&0x9		286
40824>0x1c	byte		&0x29		286
40825>0x1c	byte		&0xa		386
40826>0x1e	leshort		&0x4		Large Text
40827>0x1e	leshort		&0x2		Large Data
40828>0x1e	leshort		&0x102		Huge Objects Enabled
40829
408300	leshort		0x580		XENIX 8086 relocatable or 80286 small model
40831
40832#------------------------------------------------------------------------------
40833# $File: xilinx,v 1.9 2021/04/26 15:56:00 christos Exp $
40834# This is Aaron's attempt at a MAGIC file for Xilinx .bit files.
40835# Xilinx-Magic@RevRagnarok.com
40836# Got the info from FPGA-FAQ 0026
40837#
40838# Rewritten to use pstring/H instead of hardcoded lengths by O. Freyermuth,
40839# fixes at least reading of bitfiles from Spartan 2, 3, 6.
40840# http://www.fpga-faq.com/FAQ_Pages/0026_Tell_me_about_bit_files.htm
40841#
40842# First there is the sync header and its length
408430	beshort 0x0009
40844>2 	belong	=0x0ff00ff0
40845>>&0	belong  =0x0ff00ff0
40846>>>&0	byte    =0x00
40847>>>&1   beshort =0x0001
40848>>>&3	string	a	Xilinx BIT data
40849# Next is a Pascal-style string with the NCD name. We want to capture that.
40850>>>>&0	   pstring/H	x	- from %s
40851# And then 'b'
40852>>>>>&1    string b
40853# Then the model / part number:
40854>>>>>>&0   pstring/H    x       - for %s
40855# Then 'c'
40856>>>>>>>&1 string c
40857# Then the build-date
40858>>>>>>>>&0 pstring/H    x       - built %s
40859# Then 'd'
40860>>>>>>>>>&1   string d
40861# Then the build-time
40862>>>>>>>>>>&0  pstring/H x        \b(%s)
40863# Then 'e'
40864>>>>>>>>>>>&1  string e
40865# And length of data
40866>>>>>>>>>>>>&0 belong x          - data length %#x
40867
40868# Raw bitstream files
408690      long    0xffffffff
40870>&0    belong  0xaa995566      Xilinx RAW bitstream (.BIN)
40871
40872#------------------------------------------------------------------------------
40873# $File: xo65,v 1.5 2022/07/17 15:36:20 christos Exp $
40874# https://cc65.github.io/doc/sim65.html
40875# xo65 object files
40876# From: "Ullrich von Bassewitz" <uz@cc65.org>
40877#
408780	string		\x55\x7A\x6E\x61	xo65 object,
40879>4	leshort		x			version %d,
40880>6	leshort&0x0001 =0x0001			with debug info
40881>6	leshort&0x0001 =0x0000			no debug info
40882
40883# xo65 library files
408840	string		\x6E\x61\x55\x7A	xo65 library,
40885>4	leshort		x			version %d
40886
40887# o65 object files
408880	string		\x01\x00\x6F\x36\x35	o65
40889>6	leshort&0x1000	=0x0000			executable,
40890>6	leshort&0x1000	=0x1000			object,
40891>5	byte		x			version %d,
40892>6	leshort&0x8000	=0x8000			65816,
40893>6	leshort&0x8000	=0x0000			6502,
40894>6	leshort&0x2000	=0x2000			32 bit,
40895>6	leshort&0x2000	=0x0000			16 bit,
40896>6	leshort&0x4000	=0x4000			page reloc,
40897>6	leshort&0x4000	=0x0000			byte reloc,
40898>6	leshort&0x0003	=0x0000			alignment 1
40899>6	leshort&0x0003	=0x0001			alignment 2
40900>6	leshort&0x0003	=0x0002			alignment 4
40901>6	leshort&0x0003	=0x0003			alignment 256
40902
40903# sim65 executable files
409040	string		\x73\x69\x6d\x36\x35	sim65 executable,
40905>5	byte		x			version %d,
40906>6	leshort&0x0000	=0x0000			6502
40907>6	leshort&0x0001	=0x0001			65C02
40908
40909#------------------------------------------------------------------------------
40910# $File: xwindows,v 1.13 2022/03/24 15:48:58 christos Exp $
40911# xwindows:  file(1) magic for various X/Window system file formats.
40912
40913# Compiled X Keymap
40914# XKM (compiled X keymap) files (including version and byte ordering)
409151	string	mkx				Compiled XKB Keymap: lsb,
40916>0	byte	>0				version %d
40917>0	byte	=0				obsolete
409180	string	xkm				Compiled XKB Keymap: msb,
40919>3	byte	>0				version %d
40920>3	byte	=0				obsolete
40921
40922# xfsdump archive
409230	string	xFSdump0			xfsdump archive
40924>8	belong	x	(version %d)
40925
40926# Jaleo XFS files
409270	long	395726				Jaleo XFS file
40928>4	long	x				- version %d
40929>8	long	x				- [%d -
40930>20	long	x				\b%dx
40931>24	long	x				\b%dx
40932>28	long	1008				\bYUV422]
40933>28	long	1000				\bRGB24]
40934
40935# Xcursor data
40936# X11 mouse cursor format defined in libXcursor, see
40937# https://www.x.org/archive/X11R6.8.1/doc/Xcursor.3.html
40938# https://cgit.freedesktop.org/xorg/lib/libXcursor/tree/include/X11/Xcursor/Xcursor.h
409390	string		Xcur		Xcursor data
40940!:mime	image/x-xcursor
40941>10	leshort		x		version %d
40942>>8	leshort		x		\b.%d
40943
40944# X bitmap https://en.wikipedia.org/wiki/X_BitMap
409450	search/2048	#define\040
40946>&0	regex		[a-zA-Z0-9]+_width\040	xbm image
40947>>&0	regex		[0-9]+			(%sx
40948>>>&0	string		\n#define\040
40949>>>>&0	regex		[a-zA-Z0-9]+_height\040
40950>>>>>&0	regex		[0-9]+			\b%s)
40951
40952
40953#------------------------------------------------------------------------------
40954# $File: yara,v 1.4 2021/04/26 15:56:00 christos Exp $
40955# yara:  file(1) magic for https://virustotal.github.io/yara/
40956#
40957
409580	string	YARA
40959>4	lelong	>2047
40960>8	byte	<20	YARA 3.x compiled rule set
40961# version
40962>>8	clear	x
40963>>8	byte	6	created with version 3.3.0
40964>>8	byte	8	created with version 3.4.0
40965>>8	byte	11	created with version 3.5.0
40966>>8	default	x
40967>>>8	byte	x	development version %#02x
40968#------------------------------------------------------------------------------
40969# zfs:	file(1) magic for ZFS dumps
40970#
40971# From <rea-fbsd@codelabs.ru>
40972# ZFS dump header has the following structure (as per zfs_ioctl.h
40973# in FreeBSD with drr_type is set to DRR_BEGIN)
40974#
40975#   enum {
40976#	DRR_BEGIN, DRR_OBJECT, DRR_FREEOBJECTS,
40977#	DRR_WRITE, DRR_FREE, DRR_END,
40978#   } drr_type;
40979#   uint32_t drr_pad;
40980#   uint64_t drr_magic;
40981#   uint64_t drr_version;
40982#   uint64_t drr_creation_time;
40983#   dmu_objset_type_t drr_type;
40984#   uint32_t drr_pad;
40985#   uint64_t drr_toguid;
40986#   uint64_t drr_fromguid;
40987#   char drr_toname[MAXNAMELEN];
40988#
40989# Backup magic is 0x00000002f5bacbac (quad word)
40990# The drr_type is defined as
40991#   typedef enum dmu_objset_type {
40992#	  DMU_OST_NONE,
40993#	  DMU_OST_META,
40994#	  DMU_OST_ZFS,
40995#	  DMU_OST_ZVOL,
40996#	  DMU_OST_OTHER,		  /* For testing only! */
40997#	  DMU_OST_ANY,			  /* Be careful! */
40998#	  DMU_OST_NUMTYPES
40999#  } dmu_objset_type_t;
41000#
41001# Almost all uint64_t fields are printed as the 32-bit ones (with high
41002# 32 bits zeroed), because there is no simple way to print them as the
41003# full 64-bit values.
41004
41005# Big-endian values
410068	string	\000\000\000\002\365\272\313\254 ZFS snapshot (big-endian machine),
41007>20	belong	x	version %u,
41008>32	belong	0	type: NONE,
41009>32	belong	1	type: META,
41010>32	belong	2	type: ZFS,
41011>32	belong	3	type: ZVOL,
41012>32	belong	4	type: OTHER,
41013>32	belong	5	type: ANY,
41014>32	belong	>5	type: UNKNOWN (%u),
41015>40	byte	x	destination GUID: %02X
41016>41	byte	x	%02X
41017>42	byte	x	%02X
41018>43	byte	x	%02X
41019>44	byte	x	%02X
41020>45	byte	x	%02X
41021>46	byte	x	%02X
41022>47	byte	x	%02X,
41023>48	ulong	>0
41024>>52	ulong	>0
41025>>>48	byte	x	source GUID: %02X
41026>>>49	byte	x	%02X
41027>>>50	byte	x	%02X
41028>>>51	byte	x	%02X
41029>>>52	byte	x	%02X
41030>>>53	byte	x	%02X
41031>>>54	byte	x	%02X
41032>>>55	byte	x	%02X,
41033>56	string	>\0	name: '%s'
41034
41035# Little-endian values
410368	string	\254\313\272\365\002\000\000\000	ZFS snapshot (little-endian machine),
41037>16	lelong	x	version %u,
41038>32	lelong	0	type: NONE,
41039>32	lelong	1	type: META,
41040>32	lelong	2	type: ZFS,
41041>32	lelong	3	type: ZVOL,
41042>32	lelong	4	type: OTHER,
41043>32	lelong	5	type: ANY,
41044>32	lelong	>5	type: UNKNOWN (%u),
41045>47	byte	x	destination GUID: %02X
41046>46	byte	x	%02X
41047>45	byte	x	%02X
41048>44	byte	x	%02X
41049>43	byte	x	%02X
41050>42	byte	x	%02X
41051>41	byte	x	%02X
41052>40	byte	x	%02X,
41053>48	ulong	>0
41054>>52	ulong	>0
41055>>>55	byte	x	source GUID: %02X
41056>>>54	byte	x	%02X
41057>>>53	byte	x	%02X
41058>>>52	byte	x	%02X
41059>>>51	byte	x	%02X
41060>>>50	byte	x	%02X
41061>>>49	byte	x	%02X
41062>>>48	byte	x	%02X,
41063>56	string	>\0	name: '%s'
41064
41065#------------------------------------------------------------------------------
41066# $File: zilog,v 1.7 2009/09/19 16:28:13 christos Exp $
41067# zilog:  file(1) magic for Zilog Z8000.
41068#
41069# Was it big-endian or little-endian?  My Product Specification doesn't
41070# say.
41071#
410720	long		0xe807		object file (z8000 a.out)
410730	long		0xe808		pure object file (z8000 a.out)
410740	long		0xe809		separate object file (z8000 a.out)
410750	long		0xe805		overlay object file (z8000 a.out)
41076#------------------------------------------------------------------------------
41077# $File: zip,v 1.8 2021/10/24 15:53:56 christos Exp $
41078# zip:  file(1) magic for zip files; this is not use
41079# Note the version of magic in archive is currently stronger, this is
41080# just an example until negative offsets are supported better
41081# Note:	All fields unless otherwise noted are unsigned!
41082
41083# Zip Central Directory record
410840	name		zipcd
41085>0	string		PK\001\002	Zip archive data
41086!:mime	application/zip
41087# no "made by" in local file header with PK\3\4 magic
41088>>4	leshort		x		\b, made by
41089>>4	use		zipversion
41090>>4	use		ziphost
41091# inside ./archive 1.151 called "at least" zipversion "to extract"
41092>>6	leshort		x		\b, extract using at least
41093>>6	use		zipversion
41094# This is DOS date like: ledate 21:00:48 19 Dec 2001 != DOS 00:00 1 Jan 2010 ~ 0000213C
41095>>12	ulelong		x		\b, last modified
41096>>14	lemsdosdate	x		\b, last modified %s
41097>>12	lemsdostime	x		%s
41098# uncompressed size of 1st entry; FFffFFff means real value stored in ZIP64 record
41099>>24	ulelong		!0xFFffFFff	\b, uncompressed size %u
41100# inside ./archive 1.151 called "compression method="zipcompression
41101>>10	leshort		x		\b, method=
41102>>10	use		zipcompression
41103
41104# URL:		https://en.wikipedia.org/wiki/Zip_(file_format)
41105# reference:	https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT (Version: 6.3.9)
41106# Zip known compressions
411070	name		zipcompression
41108>0	leshort		0		\bstore
41109>0	leshort		1		\bShrinking
41110>0	leshort		6		\bImploding
41111>0	leshort		7		\bTokenizing
41112>0	leshort		8		\bdeflate
41113>0	leshort		9		\bdeflate64
41114>0	leshort		10		\bLibrary imploding
41115#>0	leshort		11 		\bReserved by PKWARE
41116>0	leshort		12		\bbzip2
41117#>0	leshort		13 		\bReserved by PKWARE
41118>0	leshort		14		\blzma
41119#>0	leshort		15 		\bReserved by PKWARE
41120>0	leshort		16		\bCMPSC (IBM z/OS)
41121#>0	leshort		17 		\bReserved by PKWARE
41122>0	leshort		18		\bIBM TERSE
41123>0	leshort		19		\bIBM LZ77 (z/Architecture)
41124>0	leshort		20		\bZstd (deprecated)
41125>0	leshort		93		\bZstd
41126>0	leshort		94		\bMP3
41127>0	leshort		95		\bxz
41128>0	leshort		96		\bJpeg
41129>0	leshort		97		\bWavPack
41130>0	leshort		98		\bPPMd
41131>0	leshort		99		\bAES Encrypted
41132>0	default		x
41133>>0	leshort		x		\b[%#x]
41134
41135# Zip known versions
411360	name		zipversion
41137# The lower byte indicates the ZIP version of this file. The value/10 indicates
41138# the major version number, and the value mod 10 is the minor version number.
41139>0	ubyte/10	x		v%u
41140>0	ubyte%10	x		\b.%u
41141# >0	leshort		0x09		v0.9
41142# >0	leshort		0x0a		v1.0
41143# >0	leshort		0x0b		v1.1
41144# >0	leshort		0x14		v2.0
41145# >0	leshort		0x15		v2.1
41146# >0	leshort		0x19		v2.5
41147# >0	leshort		0x1b		v2.7
41148# >0	leshort		0x2d		v4.5
41149# >0	leshort		0x2e		v4.6
41150# >0	leshort		0x32		v5.0
41151# >0	leshort		0x33		v5.1
41152# >0	leshort		0x34		v5.2
41153# >0	leshort		0x3d		v6.1
41154# >0	leshort		0x3e		v6.2
41155# >0	leshort		0x3f		v6.3
41156# >0	default		x
41157# >>0	leshort		x		v?[%#x]
41158
41159#	display compatible host system name of ZIP archive
411600	name		ziphost
41161# The upper byte indicates the compatibility of the file attribute information.
41162# If the file is compatible with MS-DOS (v 2.04g) then this value will be zero.
41163#>1	ubyte		0		DOS
41164>1	ubyte		1 		Amiga
41165>1	ubyte		2		OpenVMS
41166>1	ubyte		3		UNIX
41167>1	ubyte		4		VM/CMS
41168>1	ubyte		6		OS/2
41169>1	ubyte		7		Macintosh
41170>1	ubyte		11		MVS
41171>1	ubyte		13		Acorn Risc
41172>1	ubyte		16		BeOS
41173>1	ubyte		17		Tandem
41174# 9 untested
41175>1	ubyte		5		Atari ST
41176>1	ubyte		8		Z-System
41177>1	ubyte		9		CP/M
41178>1	ubyte		10		Windows NTFS
41179>1	ubyte		12		VSE
41180>1	ubyte		14		VFAT
41181>1	ubyte		15		alternate MVS
41182>1	ubyte		18		OS/400
41183>1	ubyte		19		OS X
41184# unused
41185#>1	ubyte		>19		unused %#x
41186
41187# Zip End Of Central Directory record
41188# GRR: wrong for ZIP with comment archive
41189-22	string		PK\005\006
41190#>4	uleshort	!0xFFff		\b, %u disks
41191#>6	uleshort	!0xFFff		\b, central directory disk %u
41192#>8	uleshort	!0xFFff		\b, %u central directories on this disk
41193#>10	uleshort	!0xFFff		\b, %u central directories
41194#>12	ulelong		!0xFFffFFff	\b, %u central directory bytes
41195# offset of central directory
41196#>16	ulelong		x		\b, central directory offset %#x
41197>(16.l)	use		zipcd
41198# archive comment length n
41199#>>20	uleshort	>0		\b, comment length %u
41200# archive comment
41201>>20	pstring/l	>0		\b, %s
41202
41203#------------------------------------------------------------------------------
41204# $File: zyxel,v 1.6 2009/09/19 16:28:13 christos Exp $
41205# zyxel:  file(1) magic for ZyXEL modems
41206#
41207# From <rob@pe1chl.ampr.org>
41208# These are the /etc/magic entries to decode datafiles as used for the
41209# ZyXEL U-1496E DATA/FAX/VOICE modems.  (This header conforms to a
41210# ZyXEL-defined standard)
41211
412120	string		ZyXEL\002	ZyXEL voice data
41213>10	byte		0		- CELP encoding
41214>10	byte&0x0B	1		- ADPCM2 encoding
41215>10	byte&0x0B	2		- ADPCM3 encoding
41216>10	byte&0x0B	3		- ADPCM4 encoding
41217>10	byte&0x0B	8		- New ADPCM3 encoding
41218>10	byte&0x04	4		with resync
41219