1 2#------------------------------------------------------------------------------ 3# $File: acorn,v 1.5 2009/09/19 16:28:07 christos Exp $ 4# acorn: file(1) magic for files found on Acorn systems 5# 6 7# RISC OS Chunk File Format 8# From RISC OS Programmer's Reference Manual, Appendix D 9# We guess the file type from the type of the first chunk. 100 lelong 0xc3cbc6c5 RISC OS Chunk data 11>12 string OBJ_ \b, AOF object 12>12 string LIB_ \b, ALF library 13 14# RISC OS AIF, contains "SWI OS_Exit" at offset 16. 1516 lelong 0xef000011 RISC OS AIF executable 16 17# RISC OS Draw files 18# From RISC OS Programmer's Reference Manual, Appendix E 190 string Draw RISC OS Draw file data 20 21# RISC OS new format font files 22# From RISC OS Programmer's Reference Manual, Appendix E 230 string FONT\0 RISC OS outline font data, 24>5 byte x version %d 250 string FONT\1 RISC OS 1bpp font data, 26>5 byte x version %d 270 string FONT\4 RISC OS 4bpp font data 28>5 byte x version %d 29 30# RISC OS Music files 31# From RISC OS Programmer's Reference Manual, Appendix E 320 string Maestro\r RISC OS music file 33>8 byte x version %d 34 35>8 byte x type %d 36 37# Digital Symphony data files 38# From: Bernard Jungen (bern8817@euphonynet.be) 390 string \x02\x01\x13\x13\x13\x01\x0d\x10 Digital Symphony sound sample (RISC OS), 40>8 byte x version %d, 41>9 pstring x named "%s", 42>(9.b+19) byte =0 8-bit logarithmic 43>(9.b+19) byte =1 LZW-compressed linear 44>(9.b+19) byte =2 8-bit linear signed 45>(9.b+19) byte =3 16-bit linear signed 46>(9.b+19) byte =4 SigmaDelta-compressed linear 47>(9.b+19) byte =5 SigmaDelta-compressed logarithmic 48>(9.b+19) byte >5 unknown format 49 500 string \x02\x01\x13\x13\x14\x12\x01\x0b Digital Symphony song (RISC OS), 51>8 byte x version %d, 52>9 byte =1 1 voice, 53>9 byte !1 %d voices, 54>10 leshort =1 1 track, 55>10 leshort !1 %d tracks, 56>12 leshort =1 1 pattern 57>12 leshort !1 %d patterns 58 590 string \x02\x01\x13\x13\x10\x14\x12\x0e 60>9 byte =0 Digital Symphony sequence (RISC OS), 61>>8 byte x version %d, 62>>10 byte =1 1 line, 63>>10 byte !1 %d lines, 64>>11 leshort =1 1 position 65>>11 leshort !1 %d positions 66>9 byte =1 Digital Symphony pattern data (RISC OS), 67>>8 byte x version %d, 68>>10 leshort =1 1 pattern 69>>10 leshort !1 %d patterns 70 71#------------------------------------------------------------------------------ 72# $File: adi,v 1.4 2009/09/19 16:28:07 christos Exp $ 73# adi: file(1) magic for ADi's objects 74# From Gregory McGarry <g.mcgarry@ieee.org> 75# 760 leshort 0x521c COFF DSP21k 77>18 lelong &02 executable, 78>18 lelong ^02 79>>18 lelong &01 static object, 80>>18 lelong ^01 relocatable object, 81>18 lelong &010 stripped 82>18 lelong ^010 not stripped 83 84#------------------------------------------------------------------------------ 85# $File: adventure,v 1.10 2009/09/19 16:28:07 christos Exp $ 86# adventure: file(1) magic for Adventure game files 87# 88# from Allen Garvin <earendil@faeryland.tamu-commerce.edu> 89# Edited by Dave Chapeskie <dchapes@ddm.on.ca> Jun 28, 1998 90# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002 91# 92# ALAN 93# I assume there are other, lower versions, but these are the only ones I 94# saw in the archive. 950 beshort 0x0206 ALAN game data 96>2 byte <10 version 2.6%d 97 98 99# Infocom (see z-machine) 100#------------------------------------------------------------------------------ 101# Z-machine: file(1) magic for Z-machine binaries. 102# 103# Updated by Adam Buchbinder <adam.buchbinder@gmail.com> 104# 105# The first byte is the Z-machine revision; it is always between 1 and 8. We 106# had false matches (for instance, inbig5.ocp from the Omega TeX extension as 107# well as an occasional MP3 file), so we sanity-check the version number. 108# 109# It might be possible to sanity-check the release number as well, as it seems 110# (at least in classic Infocom games) to always be a relatively small number, 111# always under 150 or so, but as this isn't rigorous, we'll wait on that until 112# it becomes clear that it's needed. 113# 1140 ubyte >0 115>0 ubyte <9 116>>16 belong&0xfe00f0f0 0x3030 Infocom game data 117>>>0 ubyte x (Z-machine %d, 118>>>>2 ubeshort x Release %d / 119>>>>18 string >\0 Serial %.6s) 120 121#------------------------------------------------------------------------------ 122# Glulx: file(1) magic for Glulx binaries. 123# 124# I haven't checked for false matches yet. 125# 1260 string Glul Glulx game data 127>4 beshort x (Version %d 128>>6 byte x \b.%d 129>>8 byte x \b.%d) 130>36 string Info Compiled by Inform 131 132 133 134# For Quetzal and blorb magic see iff 135 136 137# TADS (Text Adventure Development System) 138# All files are machine-independent (games compile to byte-code) and are tagged 139# with a version string of the form "V2.<digit>.<digit>\0" (but TADS 3 is 140# on the way). 141# Game files start with "TADS2 bin\n\r\032\0" then the compiler version. 1420 string TADS2\ bin TADS 143>9 belong !0x0A0D1A00 game data, CORRUPTED 144>9 belong 0x0A0D1A00 145>>13 string >\0 %s game data 146# Resource files start with "TADS2 rsc\n\r\032\0" then the compiler version. 1470 string TADS2\ rsc TADS 148>9 belong !0x0A0D1A00 resource data, CORRUPTED 149>9 belong 0x0A0D1A00 150>>13 string >\0 %s resource data 151# Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian 152# 2-byte length N, the N-char name of the game file *without* a NUL (darn!), 153# "TADS2 save\n\r\032\0" and the interpreter version. 1540 string TADS2\ save/g TADS 155>12 belong !0x0A0D1A00 saved game data, CORRUPTED 156>12 belong 0x0A0D1A00 157>>(16.s+32) string >\0 %s saved game data 158# Other saved game files start with "TADS2 save\n\r\032\0" and the interpreter 159# version. 1600 string TADS2\ save TADS 161>10 belong !0x0A0D1A00 saved game data, CORRUPTED 162>10 belong 0x0A0D1A00 163>>14 string >\0 %s saved game data 164 165# Danny Milosavljevic <danny.milo@gmx.net> 166# this are adrift (adventure game standard) game files, extension .taf 167# depending on version magic continues with 0x93453E6139FA (V 4.0) 168# 0x9445376139FA (V 3.90) 169# 0x9445366139FA (V 3.80) 170# this is from source (http://www.adrift.org.uk/) and I have some taf 171# files, and checked them. 172#0 belong 0x3C423FC9 173#>4 belong 0x6A87C2CF Adrift game file 174#!:mime application/x-adrift 175 176#------------------------------------------------------------------------------ 177# $File: allegro,v 1.4 2009/09/19 16:28:07 christos Exp $ 178# allegro: file(1) magic for Allegro datafiles 179# Toby Deshane <hac@shoelace.digivill.net> 180# 1810 belong 0x736C6821 Allegro datafile (packed) 1820 belong 0x736C682E Allegro datafile (not packed/autodetect) 1830 belong 0x736C682B Allegro datafile (appended exe data) 184 185#------------------------------------------------------------------------------ 186# $File: alliant,v 1.7 2009/09/19 16:28:07 christos Exp $ 187# alliant: file(1) magic for Alliant FX series a.out files 188# 189# If the FX series is the one that had a processor with a 68K-derived 190# instruction set, the "short" should probably become "beshort" and the 191# "long" should probably become "belong". 192# If it's the i860-based one, they should probably become either the 193# big-endian or little-endian versions, depending on the mode they ran 194# the 860 in.... 195# 1960 short 0420 0420 Alliant virtual executable 197>2 short &0x0020 common library 198>16 long >0 not stripped 1990 short 0421 0421 Alliant compact executable 200>2 short &0x0020 common library 201>16 long >0 not stripped 202 203#------------------------------------------------------------------------------ 204# $File: alpha,v 1.7 2009/09/19 16:28:07 christos Exp $ 205# alpha architecture description 206# 207 2080 leshort 0603 COFF format alpha 209>22 leshort&030000 !020000 executable 210>24 leshort 0410 pure 211>24 leshort 0413 paged 212>22 leshort&020000 !0 dynamically linked 213>16 lelong !0 not stripped 214>16 lelong 0 stripped 215>22 leshort&030000 020000 shared library 216>24 leshort 0407 object 217>27 byte x - version %d 218>26 byte x .%d 219>28 byte x -%d 220 221# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk> 222# 223# The actual magic number is just "Core", followed by a 2-byte version 224# number; however, treating any file that begins with "Core" as a Digital 225# UNIX core dump file may produce too many false hits, so we include one 226# byte of the version number as well; DU 5.0 appears only to be up to 227# version 2. 228# 2290 string Core\001 Alpha COFF format core dump (Digital UNIX) 230>24 string >\0 \b, from '%s' 2310 string Core\002 Alpha COFF format core dump (Digital UNIX) 232>24 string >\0 \b, from '%s' 233 234 235#------------------------------------------------------------------------------ 236# $File: amanda,v 1.5 2009/09/19 16:28:07 christos Exp $ 237# amanda: file(1) magic for amanda file format 238# 2390 string AMANDA:\ AMANDA 240>8 string TAPESTART\ DATE tape header file, 241>>23 string X 242>>>25 string >\ Unused %s 243>>23 string >\ DATE %s 244>8 string FILE\ dump file, 245>>13 string >\ DATE %s 246 247#------------------------------------------------------------------------------ 248# $File: amigaos,v 1.14 2009/09/19 16:28:07 christos Exp $ 249# amigaos: file(1) magic for AmigaOS binary formats: 250 251# 252# From ignatios@cs.uni-bonn.de (Ignatios Souvatzis) 253# 2540 belong 0x000003fa AmigaOS shared library 2550 belong 0x000003f3 AmigaOS loadseg()ble executable/binary 2560 belong 0x000003e7 AmigaOS object/library data 257# 2580 beshort 0xe310 Amiga Workbench 259>2 beshort 1 260>>48 byte 1 disk icon 261>>48 byte 2 drawer icon 262>>48 byte 3 tool icon 263>>48 byte 4 project icon 264>>48 byte 5 garbage icon 265>>48 byte 6 device icon 266>>48 byte 7 kickstart icon 267>>48 byte 8 workbench application icon 268>2 beshort >1 icon, vers. %d 269# 270# various sound formats from the Amiga 271# G=F6tz Waschk <waschk@informatik.uni-rostock.de> 272# 2730 string FC14 Future Composer 1.4 Module sound file 2740 string SMOD Future Composer 1.3 Module sound file 2750 string AON4artofnoise Art Of Noise Module sound file 2761 string MUGICIAN/SOFTEYES Mugician Module sound file 27758 string SIDMON\ II\ -\ THE Sidmon 2.0 Module sound file 2780 string Synth4.0 Synthesis Module sound file 2790 string ARP. The Holy Noise Module sound file 2800 string BeEp\0 JamCracker Module sound file 2810 string COSO\0 Hippel-COSO Module sound file 282# Too simple (short, pure ASCII, deep), MPi 283#26 string V.3 Brian Postma's Soundmon Module sound file v3 284#26 string BPSM Brian Postma's Soundmon Module sound file v3 285#26 string V.2 Brian Postma's Soundmon Module sound file v2 286 287# The following are from: "Stefan A. Haubenthal" <polluks@web.de> 2880 beshort 0x0f00 AmigaOS bitmap font 2890 beshort 0x0f03 AmigaOS outline font 2900 belong 0x80001001 AmigaOS outline tag 2910 string ##\ version catalog translation 2920 string EMOD\0 Amiga E module 2938 string ECXM\0 ECX module 2940 string/c @database AmigaGuide file 295 296# Amiga disk types 297# 2980 string RDSK Rigid Disk Block 299>160 string x on %.24s 3000 string DOS\0 Amiga DOS disk 3010 string DOS\1 Amiga FFS disk 3020 string DOS\2 Amiga Inter DOS disk 3030 string DOS\3 Amiga Inter FFS disk 3040 string DOS\4 Amiga Fastdir DOS disk 3050 string DOS\5 Amiga Fastdir FFS disk 3060 string KICK Kickstart disk 307 308# From: Alex Beregszaszi <alex@fsn.hu> 3090 string LZX LZX compressed archive (Amiga) 310 311 312#------------------------------------------------------------------------------ 313# $File: animation,v 1.39 2009/09/27 19:02:12 christos Exp $ 314# animation: file(1) magic for animation/movie formats 315# 316# animation formats 317# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8) 318# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com) 319 320# SGI and Apple formats 3210 string MOVI Silicon Graphics movie file 322!:mime video/x-sgi-movie 3234 string moov Apple QuickTime 324!:mime video/quicktime 325>12 string mvhd \b movie (fast start) 326>12 string mdra \b URL 327>12 string cmov \b movie (fast start, compressed header) 328>12 string rmra \b multiple URLs 3294 string mdat Apple QuickTime movie (unoptimized) 330!:mime video/quicktime 331#4 string wide Apple QuickTime movie (unoptimized) 332#!:mime video/quicktime 333#4 string skip Apple QuickTime movie (modified) 334#!:mime video/quicktime 335#4 string free Apple QuickTime movie (modified) 336#!:mime video/quicktime 3374 string idsc Apple QuickTime image (fast start) 338!:mime image/x-quicktime 339#4 string idat Apple QuickTime image (unoptimized) 340#!:mime image/x-quicktime 3414 string pckg Apple QuickTime compressed archive 342!:mime application/x-quicktime-player 3434 string/W jP JPEG 2000 image 344!:mime image/jp2 3454 string ftyp ISO Media 346>8 string isom \b, MPEG v4 system, version 1 347!:mime video/mp4 348>8 string iso2 \b, MPEG v4 system, part 12 revision 349>8 string mp41 \b, MPEG v4 system, version 1 350!:mime video/mp4 351>8 string mp42 \b, MPEG v4 system, version 2 352!:mime video/mp4 353>8 string mp7t \b, MPEG v4 system, MPEG v7 XML 354>8 string mp7b \b, MPEG v4 system, MPEG v7 binary XML 355>8 string/W jp2 \b, JPEG 2000 356!:mime image/jp2 357>8 string 3gp \b, MPEG v4 system, 3GPP 358!:mime video/3gpp 359>>11 byte 4 \b v4 (H.263/AMR GSM 6.10) 360>>11 byte 5 \b v5 (H.263/AMR GSM 6.10) 361>>11 byte 6 \b v6 (ITU H.264/AMR GSM 6.10) 362>8 string mmp4 \b, MPEG v4 system, 3GPP Mobile 363!:mime video/mp4 364>8 string avc1 \b, MPEG v4 system, 3GPP JVT AVC 365!:mime video/3gpp 366>8 string/W M4A \b, MPEG v4 system, iTunes AAC-LC 367!:mime audio/mp4 368>8 string/W M4V \b, MPEG v4 system, iTunes AVC-LC 369!:mime video/mp4 370>8 string/W M4P \b, MPEG v4 system, iTunes AES encrypted 371>8 string/W M4B \b, MPEG v4 system, iTunes bookmarked 372>8 string/W qt \b, Apple QuickTime movie 373!:mime video/quicktime 374 375# MPEG sequences 376# Scans for all common MPEG header start codes 3770 belong 0x00000001 378>4 byte&0x1F 0x07 JVT NAL sequence, H.264 video 379>>5 byte 66 \b, baseline 380>>5 byte 77 \b, main 381>>5 byte 88 \b, extended 382>>7 byte x \b @ L %u 3830 belong&0xFFFFFF00 0x00000100 384>3 byte 0xBA MPEG sequence 385!:mime video/mpeg 386>>4 byte &0x40 \b, v2, program multiplex 387>>4 byte ^0x40 \b, v1, system multiplex 388>3 byte 0xBB MPEG sequence, v1/2, multiplex (missing pack header) 389>3 byte&0x1F 0x07 MPEG sequence, H.264 video 390>>4 byte 66 \b, baseline 391>>4 byte 77 \b, main 392>>4 byte 88 \b, extended 393>>6 byte x \b @ L %u 394>3 byte 0xB0 MPEG sequence, v4 395!:mime video/mpeg4-generic 396>>5 belong 0x000001B5 397>>>9 byte &0x80 398>>>>10 byte&0xF0 16 \b, video 399>>>>10 byte&0xF0 32 \b, still texture 400>>>>10 byte&0xF0 48 \b, mesh 401>>>>10 byte&0xF0 64 \b, face 402>>>9 byte&0xF8 8 \b, video 403>>>9 byte&0xF8 16 \b, still texture 404>>>9 byte&0xF8 24 \b, mesh 405>>>9 byte&0xF8 32 \b, face 406>>4 byte 1 \b, simple @ L1 407>>4 byte 2 \b, simple @ L2 408>>4 byte 3 \b, simple @ L3 409>>4 byte 4 \b, simple @ L0 410>>4 byte 17 \b, simple scalable @ L1 411>>4 byte 18 \b, simple scalable @ L2 412>>4 byte 33 \b, core @ L1 413>>4 byte 34 \b, core @ L2 414>>4 byte 50 \b, main @ L2 415>>4 byte 51 \b, main @ L3 416>>4 byte 53 \b, main @ L4 417>>4 byte 66 \b, n-bit @ L2 418>>4 byte 81 \b, scalable texture @ L1 419>>4 byte 97 \b, simple face animation @ L1 420>>4 byte 98 \b, simple face animation @ L2 421>>4 byte 99 \b, simple face basic animation @ L1 422>>4 byte 100 \b, simple face basic animation @ L2 423>>4 byte 113 \b, basic animation text @ L1 424>>4 byte 114 \b, basic animation text @ L2 425>>4 byte 129 \b, hybrid @ L1 426>>4 byte 130 \b, hybrid @ L2 427>>4 byte 145 \b, advanced RT simple @ L! 428>>4 byte 146 \b, advanced RT simple @ L2 429>>4 byte 147 \b, advanced RT simple @ L3 430>>4 byte 148 \b, advanced RT simple @ L4 431>>4 byte 161 \b, core scalable @ L1 432>>4 byte 162 \b, core scalable @ L2 433>>4 byte 163 \b, core scalable @ L3 434>>4 byte 177 \b, advanced coding efficiency @ L1 435>>4 byte 178 \b, advanced coding efficiency @ L2 436>>4 byte 179 \b, advanced coding efficiency @ L3 437>>4 byte 180 \b, advanced coding efficiency @ L4 438>>4 byte 193 \b, advanced core @ L1 439>>4 byte 194 \b, advanced core @ L2 440>>4 byte 209 \b, advanced scalable texture @ L1 441>>4 byte 210 \b, advanced scalable texture @ L2 442>>4 byte 211 \b, advanced scalable texture @ L3 443>>4 byte 225 \b, simple studio @ L1 444>>4 byte 226 \b, simple studio @ L2 445>>4 byte 227 \b, simple studio @ L3 446>>4 byte 228 \b, simple studio @ L4 447>>4 byte 229 \b, core studio @ L1 448>>4 byte 230 \b, core studio @ L2 449>>4 byte 231 \b, core studio @ L3 450>>4 byte 232 \b, core studio @ L4 451>>4 byte 240 \b, advanced simple @ L0 452>>4 byte 241 \b, advanced simple @ L1 453>>4 byte 242 \b, advanced simple @ L2 454>>4 byte 243 \b, advanced simple @ L3 455>>4 byte 244 \b, advanced simple @ L4 456>>4 byte 245 \b, advanced simple @ L5 457>>4 byte 247 \b, advanced simple @ L3b 458>>4 byte 248 \b, FGS @ L0 459>>4 byte 249 \b, FGS @ L1 460>>4 byte 250 \b, FGS @ L2 461>>4 byte 251 \b, FGS @ L3 462>>4 byte 252 \b, FGS @ L4 463>>4 byte 253 \b, FGS @ L5 464>3 byte 0xB5 MPEG sequence, v4 465>>4 byte &0x80 466>>>5 byte&0xF0 16 \b, video (missing profile header) 467>>>5 byte&0xF0 32 \b, still texture (missing profile header) 468>>>5 byte&0xF0 48 \b, mesh (missing profile header) 469>>>5 byte&0xF0 64 \b, face (missing profile header) 470>>4 byte&0xF8 8 \b, video (missing profile header) 471>>4 byte&0xF8 16 \b, still texture (missing profile header) 472>>4 byte&0xF8 24 \b, mesh (missing profile header) 473>>4 byte&0xF8 32 \b, face (missing profile header) 474>3 byte 0xB3 MPEG sequence 475>>12 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video 476>>12 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video 477>>12 belong 0x000001B5 \b, v2, 478>>>16 byte&0x0F 1 \b HP 479>>>16 byte&0x0F 2 \b Spt 480>>>16 byte&0x0F 3 \b SNR 481>>>16 byte&0x0F 4 \b MP 482>>>16 byte&0x0F 5 \b SP 483>>>17 byte&0xF0 64 \b@HL 484>>>17 byte&0xF0 96 \b@H-14 485>>>17 byte&0xF0 128 \b@ML 486>>>17 byte&0xF0 160 \b@LL 487>>>17 byte &0x08 \b progressive 488>>>17 byte ^0x08 \b interlaced 489>>>17 byte&0x06 2 \b Y'CbCr 4:2:0 video 490>>>17 byte&0x06 4 \b Y'CbCr 4:2:2 video 491>>>17 byte&0x06 6 \b Y'CbCr 4:4:4 video 492>>11 byte &0x02 493>>>75 byte &0x01 494>>>>140 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video 495>>>>140 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video 496>>>>140 belong 0x000001B5 \b, v2, 497>>>>>144 byte&0x0F 1 \b HP 498>>>>>144 byte&0x0F 2 \b Spt 499>>>>>144 byte&0x0F 3 \b SNR 500>>>>>144 byte&0x0F 4 \b MP 501>>>>>144 byte&0x0F 5 \b SP 502>>>>>145 byte&0xF0 64 \b@HL 503>>>>>145 byte&0xF0 96 \b@H-14 504>>>>>145 byte&0xF0 128 \b@ML 505>>>>>145 byte&0xF0 160 \b@LL 506>>>>>145 byte &0x08 \b progressive 507>>>>>145 byte ^0x08 \b interlaced 508>>>>>145 byte&0x06 2 \b Y'CbCr 4:2:0 video 509>>>>>145 byte&0x06 4 \b Y'CbCr 4:2:2 video 510>>>>>145 byte&0x06 6 \b Y'CbCr 4:4:4 video 511>>76 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video 512>>76 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video 513>>76 belong 0x000001B5 \b, v2, 514>>>80 byte&0x0F 1 \b HP 515>>>80 byte&0x0F 2 \b Spt 516>>>80 byte&0x0F 3 \b SNR 517>>>80 byte&0x0F 4 \b MP 518>>>80 byte&0x0F 5 \b SP 519>>>81 byte&0xF0 64 \b@HL 520>>>81 byte&0xF0 96 \b@H-14 521>>>81 byte&0xF0 128 \b@ML 522>>>81 byte&0xF0 160 \b@LL 523>>>81 byte &0x08 \b progressive 524>>>81 byte ^0x08 \b interlaced 525>>>81 byte&0x06 2 \b Y'CbCr 4:2:0 video 526>>>81 byte&0x06 4 \b Y'CbCr 4:2:2 video 527>>>81 byte&0x06 6 \b Y'CbCr 4:4:4 video 528>>4 belong&0xFFFFFF00 0x78043800 \b, HD-TV 1920P 529>>>7 byte&0xF0 0x10 \b, 16:9 530>>4 belong&0xFFFFFF00 0x50002D00 \b, SD-TV 1280I 531>>>7 byte&0xF0 0x10 \b, 16:9 532>>4 belong&0xFFFFFF00 0x30024000 \b, PAL Capture 533>>>7 byte&0xF0 0x10 \b, 4:3 534>>4 beshort&0xFFF0 0x2C00 \b, 4CIF 535>>>5 beshort&0x0FFF 0x01E0 \b NTSC 536>>>5 beshort&0x0FFF 0x0240 \b PAL 537>>>7 byte&0xF0 0x20 \b, 4:3 538>>>7 byte&0xF0 0x30 \b, 16:9 539>>>7 byte&0xF0 0x40 \b, 11:5 540>>>7 byte&0xF0 0x80 \b, PAL 4:3 541>>>7 byte&0xF0 0xC0 \b, NTSC 4:3 542>>4 belong&0xFFFFFF00 0x2801E000 \b, LD-TV 640P 543>>>7 byte&0xF0 0x10 \b, 4:3 544>>4 belong&0xFFFFFF00 0x1400F000 \b, 320x240 545>>>7 byte&0xF0 0x10 \b, 4:3 546>>4 belong&0xFFFFFF00 0x0F00A000 \b, 240x160 547>>>7 byte&0xF0 0x10 \b, 4:3 548>>4 belong&0xFFFFFF00 0x0A007800 \b, 160x120 549>>>7 byte&0xF0 0x10 \b, 4:3 550>>4 beshort&0xFFF0 0x1600 \b, CIF 551>>>5 beshort&0x0FFF 0x00F0 \b NTSC 552>>>5 beshort&0x0FFF 0x0120 \b PAL 553>>>7 byte&0xF0 0x20 \b, 4:3 554>>>7 byte&0xF0 0x30 \b, 16:9 555>>>7 byte&0xF0 0x40 \b, 11:5 556>>>7 byte&0xF0 0x80 \b, PAL 4:3 557>>>7 byte&0xF0 0xC0 \b, NTSC 4:3 558>>>5 beshort&0x0FFF 0x0240 \b PAL 625 559>>>>7 byte&0xF0 0x20 \b, 4:3 560>>>>7 byte&0xF0 0x30 \b, 16:9 561>>>>7 byte&0xF0 0x40 \b, 11:5 562>>4 beshort&0xFFF0 0x2D00 \b, CCIR/ITU 563>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525 564>>>5 beshort&0x0FFF 0x0240 \b PAL 625 565>>>7 byte&0xF0 0x20 \b, 4:3 566>>>7 byte&0xF0 0x30 \b, 16:9 567>>>7 byte&0xF0 0x40 \b, 11:5 568>>4 beshort&0xFFF0 0x1E00 \b, SVCD 569>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525 570>>>5 beshort&0x0FFF 0x0240 \b PAL 625 571>>>7 byte&0xF0 0x20 \b, 4:3 572>>>7 byte&0xF0 0x30 \b, 16:9 573>>>7 byte&0xF0 0x40 \b, 11:5 574>>7 byte&0x0F 1 \b, 23.976 fps 575>>7 byte&0x0F 2 \b, 24 fps 576>>7 byte&0x0F 3 \b, 25 fps 577>>7 byte&0x0F 4 \b, 29.97 fps 578>>7 byte&0x0F 5 \b, 30 fps 579>>7 byte&0x0F 6 \b, 50 fps 580>>7 byte&0x0F 7 \b, 59.94 fps 581>>7 byte&0x0F 8 \b, 60 fps 582>>11 byte &0x04 \b, Constrained 583 584# MPEG ADTS Audio (*.mpx/mxa/aac) 585# from dreesen@math.fu-berlin.de 586# modified to fully support MPEG ADTS 587 588# MP3, M1A 589# modified by Joerg Jenderek 590# GRR the original test are too common for many DOS files 591# so don't accept as MP3 until we've tested the rate 5920 beshort&0xFFFE 0xFFFA 593# rates 594>2 byte&0xF0 0x10 MPEG ADTS, layer III, v1, 32 kbps 595!:mime audio/mpeg 596>2 byte&0xF0 0x20 MPEG ADTS, layer III, v1, 40 kbps 597!:mime audio/mpeg 598>2 byte&0xF0 0x30 MPEG ADTS, layer III, v1, 48 kbps 599!:mime audio/mpeg 600>2 byte&0xF0 0x40 MPEG ADTS, layer III, v1, 56 kbps 601!:mime audio/mpeg 602>2 byte&0xF0 0x50 MPEG ADTS, layer III, v1, 64 kbps 603!:mime audio/mpeg 604>2 byte&0xF0 0x60 MPEG ADTS, layer III, v1, 80 kbps 605!:mime audio/mpeg 606>2 byte&0xF0 0x70 MPEG ADTS, layer III, v1, 96 kbps 607!:mime audio/mpeg 608>2 byte&0xF0 0x80 MPEG ADTS, layer III, v1, 112 kbps 609!:mime audio/mpeg 610>2 byte&0xF0 0x90 MPEG ADTS, layer III, v1, 128 kbps 611!:mime audio/mpeg 612>2 byte&0xF0 0xA0 MPEG ADTS, layer III, v1, 160 kbps 613!:mime audio/mpeg 614>2 byte&0xF0 0xB0 MPEG ADTS, layer III, v1, 192 kbps 615!:mime audio/mpeg 616>2 byte&0xF0 0xC0 MPEG ADTS, layer III, v1, 224 kbps 617!:mime audio/mpeg 618>2 byte&0xF0 0xD0 MPEG ADTS, layer III, v1, 256 kbps 619!:mime audio/mpeg 620>2 byte&0xF0 0xE0 MPEG ADTS, layer III, v1, 320 kbps 621!:mime audio/mpeg 622# timing 623>2 byte&0x0C 0x00 \b, 44.1 kHz 624>2 byte&0x0C 0x04 \b, 48 kHz 625>2 byte&0x0C 0x08 \b, 32 kHz 626# channels/options 627>3 byte&0xC0 0x00 \b, Stereo 628>3 byte&0xC0 0x40 \b, JntStereo 629>3 byte&0xC0 0x80 \b, 2x Monaural 630>3 byte&0xC0 0xC0 \b, Monaural 631#>1 byte ^0x01 \b, Data Verify 632#>2 byte &0x02 \b, Packet Pad 633#>2 byte &0x01 \b, Custom Flag 634#>3 byte &0x08 \b, Copyrighted 635#>3 byte &0x04 \b, Original Source 636#>3 byte&0x03 1 \b, NR: 50/15 ms 637#>3 byte&0x03 3 \b, NR: CCIT J.17 638 639# MP2, M1A 6400 beshort&0xFFFE 0xFFFC MPEG ADTS, layer II, v1 641!:mime audio/mpeg 642# rates 643>2 byte&0xF0 0x10 \b, 32 kbps 644>2 byte&0xF0 0x20 \b, 48 kbps 645>2 byte&0xF0 0x30 \b, 56 kbps 646>2 byte&0xF0 0x40 \b, 64 kbps 647>2 byte&0xF0 0x50 \b, 80 kbps 648>2 byte&0xF0 0x60 \b, 96 kbps 649>2 byte&0xF0 0x70 \b, 112 kbps 650>2 byte&0xF0 0x80 \b, 128 kbps 651>2 byte&0xF0 0x90 \b, 160 kbps 652>2 byte&0xF0 0xA0 \b, 192 kbps 653>2 byte&0xF0 0xB0 \b, 224 kbps 654>2 byte&0xF0 0xC0 \b, 256 kbps 655>2 byte&0xF0 0xD0 \b, 320 kbps 656>2 byte&0xF0 0xE0 \b, 384 kbps 657# timing 658>2 byte&0x0C 0x00 \b, 44.1 kHz 659>2 byte&0x0C 0x04 \b, 48 kHz 660>2 byte&0x0C 0x08 \b, 32 kHz 661# channels/options 662>3 byte&0xC0 0x00 \b, Stereo 663>3 byte&0xC0 0x40 \b, JntStereo 664>3 byte&0xC0 0x80 \b, 2x Monaural 665>3 byte&0xC0 0xC0 \b, Monaural 666#>1 byte ^0x01 \b, Data Verify 667#>2 byte &0x02 \b, Packet Pad 668#>2 byte &0x01 \b, Custom Flag 669#>3 byte &0x08 \b, Copyrighted 670#>3 byte &0x04 \b, Original Source 671#>3 byte&0x03 1 \b, NR: 50/15 ms 672#>3 byte&0x03 3 \b, NR: CCIT J.17 673 674# MPA, M1A 675# updated by Joerg Jenderek 676# GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448 677# GRR this test is still too general as it catches a BOM of UTF-16 files (0xFFFE) 678# FIXME: Almost all little endian UTF-16 text with BOM are clobbered by these entries 679#0 beshort&0xFFFE 0xFFFE 680#>2 ubyte&0xF0 >0x0F 681#>>2 ubyte&0xF0 <0xE1 MPEG ADTS, layer I, v1 682## rate 683#>>>2 byte&0xF0 0x10 \b, 32 kbps 684#>>>2 byte&0xF0 0x20 \b, 64 kbps 685#>>>2 byte&0xF0 0x30 \b, 96 kbps 686#>>>2 byte&0xF0 0x40 \b, 128 kbps 687#>>>2 byte&0xF0 0x50 \b, 160 kbps 688#>>>2 byte&0xF0 0x60 \b, 192 kbps 689#>>>2 byte&0xF0 0x70 \b, 224 kbps 690#>>>2 byte&0xF0 0x80 \b, 256 kbps 691#>>>2 byte&0xF0 0x90 \b, 288 kbps 692#>>>2 byte&0xF0 0xA0 \b, 320 kbps 693#>>>2 byte&0xF0 0xB0 \b, 352 kbps 694#>>>2 byte&0xF0 0xC0 \b, 384 kbps 695#>>>2 byte&0xF0 0xD0 \b, 416 kbps 696#>>>2 byte&0xF0 0xE0 \b, 448 kbps 697## timing 698#>>>2 byte&0x0C 0x00 \b, 44.1 kHz 699#>>>2 byte&0x0C 0x04 \b, 48 kHz 700#>>>2 byte&0x0C 0x08 \b, 32 kHz 701## channels/options 702#>>>3 byte&0xC0 0x00 \b, Stereo 703#>>>3 byte&0xC0 0x40 \b, JntStereo 704#>>>3 byte&0xC0 0x80 \b, 2x Monaural 705#>>>3 byte&0xC0 0xC0 \b, Monaural 706##>1 byte ^0x01 \b, Data Verify 707##>2 byte &0x02 \b, Packet Pad 708##>2 byte &0x01 \b, Custom Flag 709##>3 byte &0x08 \b, Copyrighted 710##>3 byte &0x04 \b, Original Source 711##>3 byte&0x03 1 \b, NR: 50/15 ms 712##>3 byte&0x03 3 \b, NR: CCIT J.17 713 714# MP3, M2A 7150 beshort&0xFFFE 0xFFF2 MPEG ADTS, layer III, v2 716!:mime audio/mpeg 717# rate 718>2 byte&0xF0 0x10 \b, 8 kbps 719>2 byte&0xF0 0x20 \b, 16 kbps 720>2 byte&0xF0 0x30 \b, 24 kbps 721>2 byte&0xF0 0x40 \b, 32 kbps 722>2 byte&0xF0 0x50 \b, 40 kbps 723>2 byte&0xF0 0x60 \b, 48 kbps 724>2 byte&0xF0 0x70 \b, 56 kbps 725>2 byte&0xF0 0x80 \b, 64 kbps 726>2 byte&0xF0 0x90 \b, 80 kbps 727>2 byte&0xF0 0xA0 \b, 96 kbps 728>2 byte&0xF0 0xB0 \b, 112 kbps 729>2 byte&0xF0 0xC0 \b, 128 kbps 730>2 byte&0xF0 0xD0 \b, 144 kbps 731>2 byte&0xF0 0xE0 \b, 160 kbps 732# timing 733>2 byte&0x0C 0x00 \b, 22.05 kHz 734>2 byte&0x0C 0x04 \b, 24 kHz 735>2 byte&0x0C 0x08 \b, 16 kHz 736# channels/options 737>3 byte&0xC0 0x00 \b, Stereo 738>3 byte&0xC0 0x40 \b, JntStereo 739>3 byte&0xC0 0x80 \b, 2x Monaural 740>3 byte&0xC0 0xC0 \b, Monaural 741#>1 byte ^0x01 \b, Data Verify 742#>2 byte &0x02 \b, Packet Pad 743#>2 byte &0x01 \b, Custom Flag 744#>3 byte &0x08 \b, Copyrighted 745#>3 byte &0x04 \b, Original Source 746#>3 byte&0x03 1 \b, NR: 50/15 ms 747#>3 byte&0x03 3 \b, NR: CCIT J.17 748 749# MP2, M2A 7500 beshort&0xFFFE 0xFFF4 MPEG ADTS, layer II, v2 751# rate 752>2 byte&0xF0 0x10 \b, 8 kbps 753>2 byte&0xF0 0x20 \b, 16 kbps 754>2 byte&0xF0 0x30 \b, 24 kbps 755>2 byte&0xF0 0x40 \b, 32 kbps 756>2 byte&0xF0 0x50 \b, 40 kbps 757>2 byte&0xF0 0x60 \b, 48 kbps 758>2 byte&0xF0 0x70 \b, 56 kbps 759>2 byte&0xF0 0x80 \b, 64 kbps 760>2 byte&0xF0 0x90 \b, 80 kbps 761>2 byte&0xF0 0xA0 \b, 96 kbps 762>2 byte&0xF0 0xB0 \b, 112 kbps 763>2 byte&0xF0 0xC0 \b, 128 kbps 764>2 byte&0xF0 0xD0 \b, 144 kbps 765>2 byte&0xF0 0xE0 \b, 160 kbps 766# timing 767>2 byte&0x0C 0x00 \b, 22.05 kHz 768>2 byte&0x0C 0x04 \b, 24 kHz 769>2 byte&0x0C 0x08 \b, 16 kHz 770# channels/options 771>3 byte&0xC0 0x00 \b, Stereo 772>3 byte&0xC0 0x40 \b, JntStereo 773>3 byte&0xC0 0x80 \b, 2x Monaural 774>3 byte&0xC0 0xC0 \b, Monaural 775#>1 byte ^0x01 \b, Data Verify 776#>2 byte &0x02 \b, Packet Pad 777#>2 byte &0x01 \b, Custom Flag 778#>3 byte &0x08 \b, Copyrighted 779#>3 byte &0x04 \b, Original Source 780#>3 byte&0x03 1 \b, NR: 50/15 ms 781#>3 byte&0x03 3 \b, NR: CCIT J.17 782 783# MPA, M2A 7840 beshort&0xFFFE 0xFFF6 MPEG ADTS, layer I, v2 785!:mime audio/mpeg 786# rate 787>2 byte&0xF0 0x10 \b, 32 kbps 788>2 byte&0xF0 0x20 \b, 48 kbps 789>2 byte&0xF0 0x30 \b, 56 kbps 790>2 byte&0xF0 0x40 \b, 64 kbps 791>2 byte&0xF0 0x50 \b, 80 kbps 792>2 byte&0xF0 0x60 \b, 96 kbps 793>2 byte&0xF0 0x70 \b, 112 kbps 794>2 byte&0xF0 0x80 \b, 128 kbps 795>2 byte&0xF0 0x90 \b, 144 kbps 796>2 byte&0xF0 0xA0 \b, 160 kbps 797>2 byte&0xF0 0xB0 \b, 176 kbps 798>2 byte&0xF0 0xC0 \b, 192 kbps 799>2 byte&0xF0 0xD0 \b, 224 kbps 800>2 byte&0xF0 0xE0 \b, 256 kbps 801# timing 802>2 byte&0x0C 0x00 \b, 22.05 kHz 803>2 byte&0x0C 0x04 \b, 24 kHz 804>2 byte&0x0C 0x08 \b, 16 kHz 805# channels/options 806>3 byte&0xC0 0x00 \b, Stereo 807>3 byte&0xC0 0x40 \b, JntStereo 808>3 byte&0xC0 0x80 \b, 2x Monaural 809>3 byte&0xC0 0xC0 \b, Monaural 810#>1 byte ^0x01 \b, Data Verify 811#>2 byte &0x02 \b, Packet Pad 812#>2 byte &0x01 \b, Custom Flag 813#>3 byte &0x08 \b, Copyrighted 814#>3 byte &0x04 \b, Original Source 815#>3 byte&0x03 1 \b, NR: 50/15 ms 816#>3 byte&0x03 3 \b, NR: CCIT J.17 817 818# MP3, M25A 8190 beshort&0xFFFE 0xFFE2 MPEG ADTS, layer III, v2.5 820!:mime audio/mpeg 821# rate 822>2 byte&0xF0 0x10 \b, 8 kbps 823>2 byte&0xF0 0x20 \b, 16 kbps 824>2 byte&0xF0 0x30 \b, 24 kbps 825>2 byte&0xF0 0x40 \b, 32 kbps 826>2 byte&0xF0 0x50 \b, 40 kbps 827>2 byte&0xF0 0x60 \b, 48 kbps 828>2 byte&0xF0 0x70 \b, 56 kbps 829>2 byte&0xF0 0x80 \b, 64 kbps 830>2 byte&0xF0 0x90 \b, 80 kbps 831>2 byte&0xF0 0xA0 \b, 96 kbps 832>2 byte&0xF0 0xB0 \b, 112 kbps 833>2 byte&0xF0 0xC0 \b, 128 kbps 834>2 byte&0xF0 0xD0 \b, 144 kbps 835>2 byte&0xF0 0xE0 \b, 160 kbps 836# timing 837>2 byte&0x0C 0x00 \b, 11.025 kHz 838>2 byte&0x0C 0x04 \b, 12 kHz 839>2 byte&0x0C 0x08 \b, 8 kHz 840# channels/options 841>3 byte&0xC0 0x00 \b, Stereo 842>3 byte&0xC0 0x40 \b, JntStereo 843>3 byte&0xC0 0x80 \b, 2x Monaural 844>3 byte&0xC0 0xC0 \b, Monaural 845#>1 byte ^0x01 \b, Data Verify 846#>2 byte &0x02 \b, Packet Pad 847#>2 byte &0x01 \b, Custom Flag 848#>3 byte &0x08 \b, Copyrighted 849#>3 byte &0x04 \b, Original Source 850#>3 byte&0x03 1 \b, NR: 50/15 ms 851#>3 byte&0x03 3 \b, NR: CCIT J.17 852 853# AAC (aka MPEG-2 NBC audio) and MPEG-4 audio 854 855# Stored AAC streams (instead of the MP4 format) 8560 string ADIF MPEG ADIF, AAC 857!:mime audio/x-hx-aac-adif 858>4 byte &0x80 859>>13 byte &0x10 \b, VBR 860>>13 byte ^0x10 \b, CBR 861>>16 byte&0x1E 0x02 \b, single stream 862>>16 byte&0x1E 0x04 \b, 2 streams 863>>16 byte&0x1E 0x06 \b, 3 streams 864>>16 byte &0x08 \b, 4 or more streams 865>>16 byte &0x10 \b, 8 or more streams 866>>4 byte &0x80 \b, Copyrighted 867>>13 byte &0x40 \b, Original Source 868>>13 byte &0x20 \b, Home Flag 869>4 byte ^0x80 870>>4 byte &0x10 \b, VBR 871>>4 byte ^0x10 \b, CBR 872>>7 byte&0x1E 0x02 \b, single stream 873>>7 byte&0x1E 0x04 \b, 2 streams 874>>7 byte&0x1E 0x06 \b, 3 streams 875>>7 byte &0x08 \b, 4 or more streams 876>>7 byte &0x10 \b, 8 or more streams 877>>4 byte &0x40 \b, Original Stream(s) 878>>4 byte &0x20 \b, Home Source 879 880# Live or stored single AAC stream (used with MPEG-2 systems) 8810 beshort&0xFFF6 0xFFF0 MPEG ADTS, AAC 882!:mime audio/x-hx-aac-adts 883>1 byte &0x08 \b, v2 884>1 byte ^0x08 \b, v4 885# profile 886>>2 byte &0xC0 \b LTP 887>2 byte&0xc0 0x00 \b Main 888>2 byte&0xc0 0x40 \b LC 889>2 byte&0xc0 0x80 \b SSR 890# timing 891>2 byte&0x3c 0x00 \b, 96 kHz 892>2 byte&0x3c 0x04 \b, 88.2 kHz 893>2 byte&0x3c 0x08 \b, 64 kHz 894>2 byte&0x3c 0x0c \b, 48 kHz 895>2 byte&0x3c 0x10 \b, 44.1 kHz 896>2 byte&0x3c 0x14 \b, 32 kHz 897>2 byte&0x3c 0x18 \b, 24 kHz 898>2 byte&0x3c 0x1c \b, 22.05 kHz 899>2 byte&0x3c 0x20 \b, 16 kHz 900>2 byte&0x3c 0x24 \b, 12 kHz 901>2 byte&0x3c 0x28 \b, 11.025 kHz 902>2 byte&0x3c 0x2c \b, 8 kHz 903# channels 904>2 beshort&0x01c0 0x0040 \b, monaural 905>2 beshort&0x01c0 0x0080 \b, stereo 906>2 beshort&0x01c0 0x00c0 \b, stereo + center 907>2 beshort&0x01c0 0x0100 \b, stereo+center+LFE 908>2 beshort&0x01c0 0x0140 \b, surround 909>2 beshort&0x01c0 0x0180 \b, surround + LFE 910>2 beshort &0x01C0 \b, surround + side 911#>1 byte ^0x01 \b, Data Verify 912#>2 byte &0x02 \b, Custom Flag 913#>3 byte &0x20 \b, Original Stream 914#>3 byte &0x10 \b, Home Source 915#>3 byte &0x08 \b, Copyrighted 916 917# Live MPEG-4 audio streams (instead of RTP FlexMux) 9180 beshort&0xFFE0 0x56E0 MPEG-4 LOAS 919!:mime audio/x-mp4a-latm 920#>1 beshort&0x1FFF x \b, %u byte packet 921>3 byte&0xE0 0x40 922>>4 byte&0x3C 0x04 \b, single stream 923>>4 byte&0x3C 0x08 \b, 2 streams 924>>4 byte&0x3C 0x0C \b, 3 streams 925>>4 byte &0x08 \b, 4 or more streams 926>>4 byte &0x20 \b, 8 or more streams 927>3 byte&0xC0 0 928>>4 byte&0x78 0x08 \b, single stream 929>>4 byte&0x78 0x10 \b, 2 streams 930>>4 byte&0x78 0x18 \b, 3 streams 931>>4 byte &0x20 \b, 4 or more streams 932>>4 byte &0x40 \b, 8 or more streams 933# This magic isn't strong enough (matches plausible ISO-8859-1 text) 934#0 beshort 0x4DE1 MPEG-4 LO-EP audio stream 935#!:mime audio/x-mp4a-latm 936 937# Summary: FLI animation format 938# Created by: Daniel Quinlan <quinlan@yggdrasil.com> 939# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection) 9404 leshort 0xAF11 941# standard FLI always has 320x200 resolution and 8 bit color 942>8 leshort 320 943>>10 leshort 200 944>>>12 leshort 8 FLI animation, 320x200x8 945!:mime video/x-fli 946>>>>6 leshort x \b, %d frames 947# frame speed is multiple of 1/70s 948>>>>16 leshort x \b, %d/70s per frame 949 950# Summary: FLC animation format 951# Created by: Daniel Quinlan <quinlan@yggdrasil.com> 952# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection) 9534 leshort 0xAF12 954# standard FLC always use 8 bit color 955>12 leshort 8 FLC animation 956!:mime video/x-flc 957>>8 leshort x \b, %d 958>>10 leshort x \bx%dx8 959>>6 uleshort x \b, %d frames 960>>16 uleshort x \b, %dms per frame 961 962# DL animation format 963# XXX - collision with most `mips' magic 964# 965# I couldn't find a real magic number for these, however, this 966# -appears- to work. Note that it might catch other files, too, so be 967# careful! 968# 969# Note that title and author appear in the two 20-byte chunks 970# at decimal offsets 2 and 22, respectively, but they are XOR'ed with 971# 255 (hex FF)! The DL format is really bad. 972# 973#0 byte 1 DL version 1, medium format (160x100, 4 images/screen) 974#!:mime video/x-unknown 975#>42 byte x - %d screens, 976#>43 byte x %d commands 977#0 byte 2 DL version 2 978#!:mime video/x-unknown 979#>1 byte 1 - large format (320x200,1 image/screen), 980#>1 byte 2 - medium format (160x100,4 images/screen), 981#>1 byte >2 - unknown format, 982#>42 byte x %d screens, 983#>43 byte x %d commands 984# Based on empirical evidence, DL version 3 have several nulls following the 985# \003. Most of them start with non-null values at hex offset 0x34 or so. 986#0 string \3\0\0\0\0\0\0\0\0\0\0\0 DL version 3 987 988# iso 13818 transport stream 989# 990# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1) 991# (the following is a little bit restrictive and works fine for a stream 992# that starts with PAT properly. it won't work for stream data, that is 993# cut from an input device data right in the middle, but this shouldn't 994# disturb) 995# syncbyte 8 bit 0x47 996# error_ind 1 bit - 997# payload_start 1 bit 1 998# priority 1 bit - 999# PID 13 bit 0x0000 1000# scrambling 2 bit - 1001# adaptfld_ctrl 2 bit 1 or 3 1002# conti_count 4 bit 0 10030 belong&0xFF5FFF1F 0x47400010 MPEG transport stream data 1004>188 byte !0x47 CORRUPTED 1005 1006# DIF digital video file format <mpruett@sgi.com> 10070 belong&0xffffff00 0x1f070000 DIF 1008>4 byte &0x01 (DVCPRO) movie file 1009>4 byte ^0x01 (DV) movie file 1010>3 byte &0x80 (PAL) 1011>3 byte ^0x80 (NTSC) 1012 1013# Microsoft Advanced Streaming Format (ASF) <mpruett@sgi.com> 10140 belong 0x3026b275 Microsoft ASF 1015!:mime video/x-ms-asf 1016 1017# MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/> 10180 string \x8aMNG MNG video data, 1019!:mime video/x-mng 1020>4 belong !0x0d0a1a0a CORRUPTED, 1021>4 belong 0x0d0a1a0a 1022>>16 belong x %ld x 1023>>20 belong x %ld 1024 1025# JNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/> 10260 string \x8bJNG JNG video data, 1027!:mime video/x-jng 1028>4 belong !0x0d0a1a0a CORRUPTED, 1029>4 belong 0x0d0a1a0a 1030>>16 belong x %ld x 1031>>20 belong x %ld 1032 1033# Vivo video (Wolfram Kleff) 10343 string \x0D\x0AVersion:Vivo Vivo video data 1035 1036# VRML (Virtual Reality Modelling Language) 10370 string/w #VRML\ V1.0\ ascii VRML 1 file 1038!:mime model/vrml 10390 string/w #VRML\ V2.0\ utf8 ISO/IEC 14772 VRML 97 file 1040!:mime model/vrml 1041 1042# X3D (Extensible 3D) [http://www.web3d.org/specifications/x3d-3.0.dtd] 1043# From Michel Briand <michelbriand@free.fr> 10440 string \<?xml\ version=" 1045!:strength +1 1046>20 search/1000/cw \<!DOCTYPE\ X3D X3D (Extensible 3D) model xml text 1047!:mime model/x3d 1048 1049#--------------------------------------------------------------------------- 1050# HVQM4: compressed movie format designed by Hudson for Nintendo GameCube 1051# From Mark Sheppard <msheppard@climax.co.uk>, 2002-10-03 1052# 10530 string HVQM4 %s 1054>6 string >\0 v%s 1055>0 byte x GameCube movie, 1056>0x34 ubeshort x %d x 1057>0x36 ubeshort x %d, 1058>0x26 ubeshort x %dµs, 1059>0x42 ubeshort 0 no audio 1060>0x42 ubeshort >0 %dHz audio 1061 1062# From: "Stefan A. Haubenthal" <polluks@web.de> 10630 string DVDVIDEO-VTS Video title set, 1064>0x21 byte x v%x 10650 string DVDVIDEO-VMG Video manager, 1066>0x21 byte x v%x 1067 1068# From: Behan Webster <behanw@websterwood.com> 1069# NuppelVideo used by Mythtv (*.nuv) 1070# Note: there are two identical stanzas here differing only in the 1071# initial string matched. It used to be done with a regex, but we're 1072# trying to get rid of those. 10730 string NuppelVideo MythTV NuppelVideo 1074>12 string x v%s 1075>20 lelong x (%d 1076>24 lelong x \bx%d), 1077>36 string P \bprogressive, 1078>36 string I \binterlaced, 1079>40 ledouble x \baspect:%.2f, 1080>48 ledouble x \bfps:%.2f 10810 string MythTV MythTV NuppelVideo 1082>12 string x v%s 1083>20 lelong x (%d 1084>24 lelong x \bx%d), 1085>36 string P \bprogressive, 1086>36 string I \binterlaced, 1087>40 ledouble x \baspect:%.2f, 1088>48 ledouble x \bfps:%.2f 1089 1090# MPEG file 1091# MPEG sequences 1092# FIXME: This section is from the old magic.mime file and needs integrating with the rest 10930 belong 0x000001BA 1094>4 byte &0x40 1095!:mime video/mp2p 1096>4 byte ^0x40 1097!:mime video/mpeg 10980 belong 0x000001BB 1099!:mime video/mpeg 11000 belong 0x000001B0 1101!:mime video/mp4v-es 11020 belong 0x000001B5 1103!:mime video/mp4v-es 11040 belong 0x000001B3 1105!:mime video/mpv 11060 belong&0xFF5FFF1F 0x47400010 1107!:mime video/mp2t 11080 belong 0x00000001 1109>4 byte&0x1F 0x07 1110!:mime video/h264 1111 1112# Type: Bink Video 1113# URL: http://wiki.multimedia.cx/index.php?title=3DBink_Container 1114# From: <hoehle@users.sourceforge.net> 2008-07-18 11150 string BIK Bink Video 1116>3 regex =[a-z] rev.%s 1117#>4 ulelong x size %d 1118>20 ulelong x \b, %d 1119>24 ulelong x \bx%d 1120>8 ulelong x \b, %d frames 1121>32 ulelong x at rate %d/ 1122>28 ulelong >1 \b%d 1123>40 ulelong =0 \b, no audio 1124>40 ulelong !0 \b, %d audio track 1125>>40 ulelong !1 \bs 1126# follow properties of the first audio track only 1127>>48 uleshort x %dHz 1128>>51 byte&0x20 0 mono 1129>>51 byte&0x20 !0 stereo 1130#>>51 byte&0x10 0 FFT 1131#>>51 byte&0x10 !0 DCT 1132 1133# Type: NUT Container 1134# URL: http://wiki.multimedia.cx/index.php?title=NUT 1135# From: Adam Buchbinder <adam.buchbinder@gmail.com> 11360 string nut/multimedia\ container\0 NUT multimedia container 1137 1138#------------------------------------------------------------------------------ 1139# $File: apl,v 1.6 2009/09/19 16:28:07 christos Exp $ 1140# apl: file(1) magic for APL (see also "pdp" and "vax" for other APL 1141# workspaces) 1142# 11430 long 0100554 APL workspace (Ken's original?) 1144 1145#------------------------------------------------------------------------------ 1146# $File: apple,v 1.23 2009/09/19 16:28:08 christos Exp $ 1147# apple: file(1) magic for Apple file formats 1148# 11490 search/1 FiLeStArTfIlEsTaRt binscii (apple ][) text 11500 string \x0aGL Binary II (apple ][) data 11510 string \x76\xff Squeezed (apple ][) data 11520 string NuFile NuFile archive (apple ][) data 11530 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data 11540 belong 0x00051600 AppleSingle encoded Macintosh file 11550 belong 0x00051607 AppleDouble encoded Macintosh file 1156 1157# Type: Apple Emulator 2IMG format 1158# From: Radek Vokal <rvokal@redhat.com> 11590 string 2IMG Apple ][ 2IMG Disk Image 1160>4 string XGS! \b, XGS 1161>4 string CTKG \b, Catakig 1162>4 string ShIm \b, Sheppy's ImageMaker 1163>4 string WOOF \b, Sweet 16 1164>4 string B2TR \b, Bernie ][ the Rescue 1165>4 string !nfc \b, ASIMOV2 1166>4 string x \b, Unknown Format 1167>0xc byte 00 \b, DOS 3.3 sector order 1168>>0x10 byte 00 \b, Volume 254 1169>>0x10 byte&0x7f x \b, Volume %u 1170>0xc byte 01 \b, ProDOS sector order 1171>>0x14 short x \b, %u Blocks 1172>0xc byte 02 \b, NIB data 1173 1174# magic for Newton PDA package formats 1175# from Ruda Moura <ruda@helllabs.org> 11760 string package0 Newton package, NOS 1.x, 1177>12 belong &0x80000000 AutoRemove, 1178>12 belong &0x40000000 CopyProtect, 1179>12 belong &0x10000000 NoCompression, 1180>12 belong &0x04000000 Relocation, 1181>12 belong &0x02000000 UseFasterCompression, 1182>16 belong x version %d 1183 11840 string package1 Newton package, NOS 2.x, 1185>12 belong &0x80000000 AutoRemove, 1186>12 belong &0x40000000 CopyProtect, 1187>12 belong &0x10000000 NoCompression, 1188>12 belong &0x04000000 Relocation, 1189>12 belong &0x02000000 UseFasterCompression, 1190>16 belong x version %d 1191 11920 string package4 Newton package, 1193>8 byte 8 NOS 1.x, 1194>8 byte 9 NOS 2.x, 1195>12 belong &0x80000000 AutoRemove, 1196>12 belong &0x40000000 CopyProtect, 1197>12 belong &0x10000000 NoCompression, 1198 1199# The following entries for the Apple II are for files that have 1200# been transferred as raw binary data from an Apple, without having 1201# been encapsulated by any of the above archivers. 1202# 1203# In general, Apple II formats are hard to identify because Apple DOS 1204# and especially Apple ProDOS have strong typing in the file system and 1205# therefore programmers never felt much need to include type information 1206# in the files themselves. 1207# 1208# Eric Fischer <enf@pobox.com> 1209 1210# AppleWorks word processor: 1211# 1212# This matches the standard tab stops for an AppleWorks file, but if 1213# a file has a tab stop set in the first four columns this will fail. 1214# 1215# The "O" is really the magic number, but that's so common that it's 1216# necessary to check the tab stops that follow it to avoid false positives. 1217 12184 string O==== AppleWorks word processor data 1219>85 byte&0x01 >0 \b, zoomed 1220>90 byte&0x01 >0 \b, paginated 1221>92 byte&0x01 >0 \b, with mail merge 1222#>91 byte x \b, left margin %d 1223 1224# AppleWorks database: 1225# 1226# This isn't really a magic number, but it's the closest thing to one 1227# that I could find. The 1 and 2 really mean "order in which you defined 1228# categories" and "left to right, top to bottom," respectively; the D and R 1229# mean that the cursor should move either down or right when you press Return. 1230 1231#30 string \x01D AppleWorks database data 1232#30 string \x02D AppleWorks database data 1233#30 string \x01R AppleWorks database data 1234#30 string \x02R AppleWorks database data 1235 1236# AppleWorks spreadsheet: 1237# 1238# Likewise, this isn't really meant as a magic number. The R or C means 1239# row- or column-order recalculation; the A or M means automatic or manual 1240# recalculation. 1241 1242#131 string RA AppleWorks spreadsheet data 1243#131 string RM AppleWorks spreadsheet data 1244#131 string CA AppleWorks spreadsheet data 1245#131 string CM AppleWorks spreadsheet data 1246 1247# Applesoft BASIC: 1248# 1249# This is incredibly sloppy, but will be true if the program was 1250# written at its usual memory location of 2048 and its first line 1251# number is less than 256. Yuck. 1252 12530 belong&0xff00ff 0x80000 Applesoft BASIC program data 1254#>2 leshort x \b, first line number %d 1255 1256# ORCA/EZ assembler: 1257# 1258# This will not identify ORCA/M source files, since those have 1259# some sort of date code instead of the two zero bytes at 6 and 7 1260# XXX Conflicts with ELF 1261#4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data 1262#>5 byte x \b, build number %d 1263 1264# Broderbund Fantavision 1265# 1266# I don't know what these values really mean, but they seem to recur. 1267# Will they cause too many conflicts? 1268 1269# Probably :-) 1270#2 belong&0xFF00FF 0x040008 Fantavision movie data 1271 1272# Some attempts at images. 1273# 1274# These are actually just bit-for-bit dumps of the frame buffer, so 1275# there's really no reasonably way to distinguish them except for their 1276# address (if preserved) -- 8192 or 16384 -- and their length -- 8192 1277# or, occasionally, 8184. 1278# 1279# Nevertheless this will manage to catch a lot of images that happen 1280# to have a solid-colored line at the bottom of the screen. 1281 1282# GRR: Magic too weak 1283#8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background 1284#8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background 1285#8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background 1286#8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background 1287#8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background 1288 1289# Beagle Bros. Apple Mechanic fonts 1290 12910 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font 1292 1293# Apple Universal Disk Image Format (UDIF) - dmg files. 1294# From Johan Gade. 1295# These entries are disabled for now until we fix the following issues. 1296# 1297# Note there might be some problems with the "VAX COFF executable" 1298# entry. Note this entry should be placed before the mac filesystem section, 1299# particularly the "Apple Partition data" entry. 1300# 1301# The intended meaning of these tests is, that the file is only of the 1302# specified type if both of the lines are correct - i.e. if the first 1303# line matches and the second doesn't then it is not of that type. 1304# 1305#0 long 0x7801730d 1306#>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO) 1307# 1308# Note that this entry is recognized correctly by the "Apple Partition 1309# data" entry - however since this entry is more specific - this 1310# information seems to be more useful. 1311#0 long 0x45520200 1312#>0x410 string disk\ image UDIF read/write image (UDRW) 1313 1314# From: Toby Peterson <toby@apple.com> 13150 string bplist00 Apple binary property list 1316 1317# Apple binary property list (bplist) 1318# Assumes version bytes are hex. 1319# Provides content hints for version 0 files. Assumes that the root 1320# object is the first object (true for CoreFoundation implementation). 1321# From: David Remahl <dremahl@apple.com> 13220 string bplist 1323>6 byte x \bCoreFoundation binary property list data, version 0x%c 1324>>7 byte x \b%c 1325>6 string 00 \b 1326>>8 byte&0xF0 0x00 \b 1327>>>8 byte&0x0F 0x00 \b, root type: null 1328>>>8 byte&0x0F 0x08 \b, root type: false boolean 1329>>>8 byte&0x0F 0x09 \b, root type: true boolean 1330>>8 byte&0xF0 0x10 \b, root type: integer 1331>>8 byte&0xF0 0x20 \b, root type: real 1332>>8 byte&0xF0 0x30 \b, root type: date 1333>>8 byte&0xF0 0x40 \b, root type: data 1334>>8 byte&0xF0 0x50 \b, root type: ascii string 1335>>8 byte&0xF0 0x60 \b, root type: unicode string 1336>>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT) 1337>>8 byte&0xF0 0xa0 \b, root type: array 1338>>8 byte&0xF0 0xd0 \b, root type: dictionary 1339 1340# Apple/NeXT typedstream data 1341# Serialization format used by NeXT and Apple for various 1342# purposes in YellowStep/Cocoa, including some nib files. 1343# From: David Remahl <dremahl@apple.com> 13442 string typedstream NeXT/Apple typedstream data, big endian 1345>0 byte x \b, version %hhd 1346>0 byte <5 \b 1347>>13 byte 0x81 \b 1348>>>14 ubeshort x \b, system %hd 13492 string streamtyped NeXT/Apple typedstream data, little endian 1350>0 byte x \b, version %hhd 1351>0 byte <5 \b 1352>>13 byte 0x81 \b 1353>>>14 uleshort x \b, system %hd 1354 1355#------------------------------------------------------------------------------ 1356# CAF: Apple CoreAudio File Format 1357# 1358# Container format for high-end audio purposes. 1359# From: David Remahl <dremahl@apple.com> 1360# 13610 string caff CoreAudio Format audio file 1362>4 beshort <10 version %d 1363>6 beshort x 1364 1365 1366#------------------------------------------------------------------------------ 1367# Keychain database files 13680 string kych Mac OS X Keychain File 1369 1370#------------------------------------------------------------------------------ 1371# Code Signing related file types 13720 belong 0xfade0c00 Mac OS X Code Requirement 1373>8 belong 1 (opExpr) 1374>4 belong x - %d bytes 1375 13760 belong 0xfade0c01 Mac OS X Code Requirement Set 1377>8 belong >1 containing %d items 1378>4 belong x - %d bytes 1379 13800 belong 0xfade0c02 Mac OS X Code Directory 1381>8 belong x version %x 1382>12 belong >0 flags 0x%x 1383>4 belong x - %d bytes 1384 13850 belong 0xfade0cc0 Mac OS X Detached Code Signature (non-executable) 1386>4 belong x - %d bytes 1387 13880 belong 0xfade0cc1 Mac OS X Detached Code Signature 1389>8 belong >1 (%d elements) 1390>4 belong x - %d bytes 1391 1392# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 1393# .vdi 13944 string innotek\ VirtualBox\ Disk\ Image %s 1395 1396#------------------------------------------------------------------------------ 1397# $File: applix,v 1.5 2009/09/19 16:28:08 christos Exp $ 1398# applix: file(1) magic for Applixware 1399# From: Peter Soos <sp@osb.hu> 1400# 14010 string *BEGIN Applixware 1402>7 string WORDS Words Document 1403>7 string GRAPHICS Graphic 1404>7 string RASTER Bitmap 1405>7 string SPREADSHEETS Spreadsheet 1406>7 string MACRO Macro 1407>7 string BUILDER Builder Object 1408 1409#------------------------------------------------------------------------------ 1410# $File: archive,v 1.55 2009/12/04 15:00:47 christos Exp $ 1411# archive: file(1) magic for archive formats (see also "msdos" for self- 1412# extracting compressed archives) 1413# 1414# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc. 1415# pre-POSIX "tar" archives are handled in the C code. 1416 1417# POSIX tar archives 1418257 string ustar\0 POSIX tar archive 1419!:mime application/x-tar # encoding: posix 1420257 string ustar\040\040\0 GNU tar archive 1421!:mime application/x-tar # encoding: gnu 1422 1423# cpio archives 1424# 1425# Yes, the top two "cpio archive" formats *are* supposed to just be "short". 1426# The idea is to indicate archives produced on machines with the same 1427# byte order as the machine running "file" with "cpio archive", and 1428# to indicate archives produced on machines with the opposite byte order 1429# from the machine running "file" with "byte-swapped cpio archive". 1430# 1431# The SVR4 "cpio(4)" hints that there are additional formats, but they 1432# are defined as "short"s; I think all the new formats are 1433# character-header formats and thus are strings, not numbers. 14340 short 070707 cpio archive 1435!:mime application/x-cpio 14360 short 0143561 byte-swapped cpio archive 1437!:mime application/x-cpio # encoding: swapped 14380 string 070707 ASCII cpio archive (pre-SVR4 or odc) 14390 string 070701 ASCII cpio archive (SVR4 with no CRC) 14400 string 070702 ASCII cpio archive (SVR4 with CRC) 1441 1442# Debian package (needs to go before regular portable archives) 1443# 14440 string =!<arch>\ndebian 1445!:mime application/x-debian-package 1446>8 string debian-split part of multipart Debian package 1447>8 string debian-binary Debian binary package 1448>8 string !debian 1449>68 string >\0 (format %s) 1450# These next two lines do not work, because a bzip2 Debian archive 1451# still uses gzip for the control.tar (first in the archive). Only 1452# data.tar varies, and the location of its filename varies too. 1453# file/libmagic does not current have support for ascii-string based 1454# (offsets) as of 2005-09-15. 1455#>81 string bz2 \b, uses bzip2 compression 1456#>84 string gz \b, uses gzip compression 1457#>136 ledate x created: %s 1458 1459# other archives 14600 long 0177555 very old archive 14610 short 0177555 very old PDP-11 archive 14620 long 0177545 old archive 14630 short 0177545 old PDP-11 archive 14640 long 0100554 apl workspace 14650 string =<ar> archive 1466!:mime application/x-archive 1467 1468# MIPS archive (needs to go before regular portable archives) 1469# 14700 string =!<arch>\n__________E MIPS archive 1471>20 string U with MIPS Ucode members 1472>21 string L with MIPSEL members 1473>21 string B with MIPSEB members 1474>19 string L and an EL hash table 1475>19 string B and an EB hash table 1476>22 string X -- out of date 1477 14780 search/1 -h- Software Tools format archive text 1479 1480# 1481# XXX - why are there multiple <ar> thingies? Note that 0x213c6172 is 1482# "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have: 1483# 1484# 0 string =!<arch> current ar archive 1485# 0 long 0x213c6172 archive file 1486# 1487# and for SVR1 archives, we have: 1488# 1489# 0 string \<ar> System V Release 1 ar archive 1490# 0 string =<ar> archive 1491# 1492# XXX - did Aegis really store shared libraries, breakpointed modules, 1493# and absolute code program modules in the same format as new-style 1494# "ar" archives? 1495# 14960 string =!<arch> current ar archive 1497!:mime application/x-archive 1498>8 string __.SYMDEF random library 1499>0 belong =65538 - pre SR9.5 1500>0 belong =65539 - post SR9.5 1501>0 beshort 2 - object archive 1502>0 beshort 3 - shared library module 1503>0 beshort 4 - debug break-pointed module 1504>0 beshort 5 - absolute code program module 15050 string \<ar> System V Release 1 ar archive 15060 string =<ar> archive 1507# 1508# XXX - from "vax", which appears to collect a bunch of byte-swapped 1509# thingies, to help you recognize VAX files on big-endian machines; 1510# with "leshort", "lelong", and "string", that's no longer necessary.... 1511# 15120 belong 0x65ff0000 VAX 3.0 archive 15130 belong 0x3c61723e VAX 5.0 archive 1514# 15150 long 0x213c6172 archive file 15160 lelong 0177555 very old VAX archive 15170 leshort 0177555 very old PDP-11 archive 1518# 1519# XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus 1520# be a random library (it said 0xff65 rather than 0177545). 1521# 15220 lelong 0177545 old VAX archive 1523>8 string __.SYMDEF random library 15240 leshort 0177545 old PDP-11 archive 1525>8 string __.SYMDEF random library 1526# 1527# From "pdp" (but why a 4-byte quantity?) 1528# 15290 lelong 0x39bed PDP-11 old archive 15300 lelong 0x39bee PDP-11 4.0 archive 1531 1532# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com) 1533# 1534# The first byte is the magic (0x1a), byte 2 is the compression type for 1535# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS 1536# filename of the first file (null terminated). Since some types collide 1537# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%), 1538# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo. 15390 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW 1540!:mime application/x-arc 15410 lelong&0x8080ffff 0x0000091a ARC archive data, squashed 1542!:mime application/x-arc 15430 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed 1544!:mime application/x-arc 15450 lelong&0x8080ffff 0x0000031a ARC archive data, packed 1546!:mime application/x-arc 15470 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed 1548!:mime application/x-arc 15490 lelong&0x8080ffff 0x0000061a ARC archive data, crunched 1550!:mime application/x-arc 1551# [JW] stuff taken from idarc, obviously ARC successors: 15520 lelong&0x8080ffff 0x00000a1a PAK archive data 1553!:mime application/x-arc 15540 lelong&0x8080ffff 0x0000141a ARC+ archive data 1555!:mime application/x-arc 15560 lelong&0x8080ffff 0x0000481a HYP archive data 1557!:mime application/x-arc 1558 1559# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk) 1560# I can't create either SPARK or ArcFS archives so I have not tested this stuff 1561# [GRR: the original entries collide with ARC, above; replaced with combined 1562# version (not tested)] 1563#0 byte 0x1a RISC OS archive (spark format) 15640 string \032archive RISC OS archive (ArcFS format) 15650 string Archive\000 RISC OS archive (ArcFS format) 1566 1567# All these were taken from idarc, many could not be verified. Unfortunately, 1568# there were many low-quality sigs, i.e. easy to trigger false positives. 1569# Please notify me of any real-world fishy/ambiguous signatures and I'll try 1570# to get my hands on the actual archiver and see if I find something better. [JW] 1571# probably many can be enhanced by finding some 0-byte or control char near the start 1572 1573# idarc calls this Crush/Uncompressed... *shrug* 15740 string CRUSH Crush archive data 1575# Squeeze It (.sqz) 15760 string HLSQZ Squeeze It archive data 1577# SQWEZ 15780 string SQWEZ SQWEZ archive data 1579# HPack (.hpk) 15800 string HPAK HPack archive data 1581# HAP 15820 string \x91\x33HF HAP archive data 1583# MD/MDCD 15840 string MDmd MDCD archive data 1585# LIM 15860 string LIM\x1a LIM archive data 1587# SAR 15883 string LH5 SAR archive data 1589# BSArc/BS2 15900 string \212\3SB \0 BSArc/BS2 archive data 1591# MAR 15922 string =-ah MAR archive data 1593# ACB 15940 belong&0x00f800ff 0x00800000 ACB archive data 1595# CPZ 1596# TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data 1597# JRC 15980 string JRchive JRC archive data 1599# Quantum 16000 string DS\0 Quantum archive data 1601# ReSOF 16020 string PK\3\6 ReSOF archive data 1603# QuArk 16040 string 7\4 QuArk archive data 1605# YAC 160614 string YC YAC archive data 1607# X1 16080 string X1 X1 archive data 16090 string XhDr X1 archive data 1610# CDC Codec (.dqt) 16110 belong&0xffffe000 0x76ff2000 CDC Codec archive data 1612# AMGC 16130 string \xad6" AMGC archive data 1614# NuLIB 16150 string NõFélå NuLIB archive data 1616# PakLeo 16170 string LEOLZW PAKLeo archive data 1618# ChArc 16190 string SChF ChArc archive data 1620# PSA 16210 string PSA PSA archive data 1622# CrossePAC 16230 string DSIGDCC CrossePAC archive data 1624# Freeze 16250 string \x1f\x9f\x4a\x10\x0a Freeze archive data 1626# KBoom 16270 string ¨MP¨ KBoom archive data 1628# NSQ, must go after CDC Codec 16290 string \x76\xff NSQ archive data 1630# DPA 16310 string Dirk\ Paehl DPA archive data 1632# BA 1633# TODO: idarc says "bytes 0-2 == bytes 3-5" 1634# TTComp 16350 string \0\6 TTComp archive data 1636# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation? 16370 string ESP ESP archive data 1638# ZPack 16390 string \1ZPK\1 ZPack archive data 1640# Sky 16410 string \xbc\x40 Sky archive data 1642# UFA 16430 string UFA UFA archive data 1644# Dry 16450 string =-H2O DRY archive data 1646# FoxSQZ 16470 string FOXSQZ FoxSQZ archive data 1648# AR7 16490 string ,AR7 AR7 archive data 1650# PPMZ 16510 string PPMZ PPMZ archive data 1652# MS Compress 16534 string \x88\xf0\x27 MS Compress archive data 1654# updated by Joerg Jenderek 1655>9 string \0 1656>>0 string KWAJ 1657>>>7 string \321\003 MS Compress archive data 1658>>>>14 ulong >0 \b, original size: %ld bytes 1659>>>>18 ubyte >0x65 1660>>>>>18 string x \b, was %.8s 1661>>>>>(10.b-4) string x \b.%.3s 1662# MP3 (archiver, not lossy audio compression) 16630 string MP3\x1a MP3-Archiver archive data 1664# ZET 16650 string OZÝ ZET archive data 1666# TSComp 16670 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data 1668# ARQ 16690 string gW\4\1 ARQ archive data 1670# Squash 16713 string OctSqu Squash archive data 1672# Terse 16730 string \5\1\1\0 Terse archive data 1674# PUCrunch 16750 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data 1676# UHarc 16770 string UHA UHarc archive data 1678# ABComp 16790 string \2AB ABComp archive data 16800 string \3AB2 ABComp archive data 1681# CMP 16820 string CO\0 CMP archive data 1683# Splint 16840 string \x93\xb9\x06 Splint archive data 1685# InstallShield 16860 string \x13\x5d\x65\x8c InstallShield Z archive Data 1687# Gather 16881 string GTH Gather archive data 1689# BOA 16900 string BOA BOA archive data 1691# RAX 16920 string ULEB\xa RAX archive data 1693# Xtreme 16940 string ULEB\0 Xtreme archive data 1695# Pack Magic 16960 string @â\1\0 Pack Magic archive data 1697# BTS 16980 belong&0xfeffffff 0x1a034465 BTS archive data 1699# ELI 5750 17000 string Ora\ ELI 5750 archive data 1701# QFC 17020 string \x1aFC\x1a QFC archive data 17030 string \x1aQF\x1a QFC archive data 1704# PRO-PACK 17050 string RNC PRO-PACK archive data 1706# 777 17070 string 777 777 archive data 1708# LZS221 17090 string sTaC LZS221 archive data 1710# HPA 17110 string HPA HPA archive data 1712# Arhangel 17130 string LG Arhangel archive data 1714# EXP1, uses bzip2 17150 string 0123456789012345BZh EXP1 archive data 1716# IMP 17170 string IMP\xa IMP archive data 1718# NRV 17190 string \x00\x9E\x6E\x72\x76\xFF NRV archive data 1720# Squish 17210 string \x73\xb2\x90\xf4 Squish archive data 1722# Par 17230 string PHILIPP Par archive data 17240 string PAR Par archive data 1725# HIT 17260 string UB HIT archive data 1727# SBX 17280 belong&0xfffff000 0x53423000 SBX archive data 1729# NaShrink 17300 string NSK NaShrink archive data 1731# SAPCAR 17320 string #\ CAR\ archive\ header SAPCAR archive data 17330 string CAR\ 2.00RG SAPCAR archive data 1734# Disintegrator 17350 string DST Disintegrator archive data 1736# ASD 17370 string ASD ASD archive data 1738# InstallShield CAB 17390 string ISc( InstallShield CAB 1740# TOP4 17410 string T4\x1a TOP4 archive data 1742# BatComp left out: sig looks like COM executable 1743# so TODO: get real 4dos batcomp file and find sig 1744# BlakHole 17450 string BH\5\7 BlakHole archive data 1746# BIX 17470 string BIX0 BIX archive data 1748# ChiefLZA 17490 string ChfLZ ChiefLZA archive data 1750# Blink 17510 string Blink Blink archive data 1752# Logitech Compress 17530 string \xda\xfa Logitech Compress archive data 1754# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE) 17551 string (C)\ STEPANYUK ARS-Sfx archive data 1756# AKT/AKT32 17570 string AKT32 AKT32 archive data 17580 string AKT AKT archive data 1759# NPack 17600 string MSTSM NPack archive data 1761# PFT 17620 string \0\x50\0\x14 PFT archive data 1763# SemOne 17640 string SEM SemOne archive data 1765# PPMD 17660 string \x8f\xaf\xac\x84 PPMD archive data 1767# FIZ 17680 string FIZ FIZ archive data 1769# MSXiE 17700 belong&0xfffff0f0 0x4d530000 MSXiE archive data 1771# DeepFreezer 17720 belong&0xfffffff0 0x797a3030 DeepFreezer archive data 1773# DC 17740 string =<DC- DC archive data 1775# TPac 17760 string \4TPAC\3 TPac archive data 1777# Ai 17780 string Ai\1\1\0 Ai archive data 17790 string Ai\1\0\0 Ai archive data 1780# Ai32 17810 string Ai\2\0 Ai32 archive data 17820 string Ai\2\1 Ai32 archive data 1783# SBC 17840 string SBC SBC archive data 1785# Ybs 17860 string YBS Ybs archive data 1787# DitPack 17880 string \x9e\0\0 DitPack archive data 1789# DMS 17900 string DMS! DMS archive data 1791# EPC 17920 string \x8f\xaf\xac\x8c EPC archive data 1793# VSARC 17940 string VS\x1a VSARC archive data 1795# PDZ 17960 string PDZ PDZ archive data 1797# ReDuq 17980 string rdqx ReDuq archive data 1799# GCA 18000 string GCAX GCA archive data 1801# PPMN 18020 string pN PPMN archive data 1803# WinImage 18043 string WINIMAGE WinImage archive data 1805# Compressia 18060 string CMP0CMP Compressia archive data 1807# UHBC 18080 string UHB UHBC archive data 1809# WinHKI 18100 string \x61\x5C\x04\x05 WinHKI archive data 1811# WWPack data file 18120 string WWP WWPack archive data 1813# BSN (BSA, PTS-DOS) 18140 string \xffBSG BSN archive data 18151 string \xffBSG BSN archive data 18163 string \xffBSG BSN archive data 18171 string \0\xae\2 BSN archive data 18181 string \0\xae\3 BSN archive data 18191 string \0\xae\7 BSN archive data 1820# AIN 18210 string \x33\x18 AIN archive data 18220 string \x33\x17 AIN archive data 1823# XPA32 18240 string xpa\0\1 XPA32 archive data 1825# SZip (TODO: doesn't catch all versions) 18260 string SZ\x0a\4 SZip archive data 1827# XPack DiskImage 18280 string jm XPack DiskImage archive data 1829# XPack Data 18300 string xpa XPack archive data 1831# XPack Single Data 18320 string Í\ jm XPack single archive data 1833 1834# TODO: missing due to unknown magic/magic at end of file: 1835#DWC 1836#ARG 1837#ZAR 1838#PC/3270 1839#InstallIt 1840#RKive 1841#RK 1842#XPack Diskimage 1843 1844# These were inspired by idarc, but actually verified 1845# Dzip archiver (.dz) 18460 string DZ Dzip archive data 1847>2 byte x \b, version %i 1848>3 byte x \b.%i 1849# ZZip archiver (.zz) 18500 string ZZ\ \0\0 ZZip archive data 18510 string ZZ0 ZZip archive data 1852# PAQ archiver (.paq) 18530 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data 18540 string PAQ PAQ archive data 1855>3 byte&0xf0 0x30 1856>>3 byte x (v%c) 1857# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP) 18580xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data 18590 string JARCS JAR (ARJ Software, Inc.) archive data 1860 1861# ARJ archiver (jason@jarthur.Claremont.EDU) 18620 leshort 0xea60 ARJ archive data 1863!:mime application/x-arj 1864>5 byte x \b, v%d, 1865>8 byte &0x04 multi-volume, 1866>8 byte &0x10 slash-switched, 1867>8 byte &0x20 backup, 1868>34 string x original name: %s, 1869>7 byte 0 os: MS-DOS 1870>7 byte 1 os: PRIMOS 1871>7 byte 2 os: Unix 1872>7 byte 3 os: Amiga 1873>7 byte 4 os: Macintosh 1874>7 byte 5 os: OS/2 1875>7 byte 6 os: Apple ][ GS 1876>7 byte 7 os: Atari ST 1877>7 byte 8 os: NeXT 1878>7 byte 9 os: VAX/VMS 1879>3 byte >0 %d] 1880# [JW] idarc says this is also possible 18812 leshort 0xea60 ARJ archive data 1882 1883# HA archiver (Greg Roelofs, newt@uchicago.edu) 1884# This is a really bad format. A file containing HAWAII will match this... 1885#0 string HA HA archive data, 1886#>2 leshort =1 1 file, 1887#>2 leshort >1 %u files, 1888#>4 byte&0x0f =0 first is type CPY 1889#>4 byte&0x0f =1 first is type ASC 1890#>4 byte&0x0f =2 first is type HSC 1891#>4 byte&0x0f =0x0e first is type DIR 1892#>4 byte&0x0f =0x0f first is type SPECIAL 1893# suggestion: at least identify small archives (<1024 files) 18940 belong&0xffff00fc 0x48410000 HA archive data 1895>2 leshort =1 1 file, 1896>2 leshort >1 %u files, 1897>4 byte&0x0f =0 first is type CPY 1898>4 byte&0x0f =1 first is type ASC 1899>4 byte&0x0f =2 first is type HSC 1900>4 byte&0x0f =0x0e first is type DIR 1901>4 byte&0x0f =0x0f first is type SPECIAL 1902 1903# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz) 19040 string HPAK HPACK archive data 1905 1906# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net 19070 string \351,\001JAM\ JAM archive, 1908>7 string >\0 version %.4s 1909>0x26 byte =0x27 - 1910>>0x2b string >\0 label %.11s, 1911>>0x27 lelong x serial %08x, 1912>>0x36 string >\0 fstype %.8s 1913 1914# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu) 19152 string -lh0- LHarc 1.x/ARX archive data [lh0] 1916!:mime application/x-lharc 19172 string -lh1- LHarc 1.x/ARX archive data [lh1] 1918!:mime application/x-lharc 19192 string -lz4- LHarc 1.x archive data [lz4] 1920!:mime application/x-lharc 19212 string -lz5- LHarc 1.x archive data [lz5] 1922!:mime application/x-lharc 1923# [never seen any but the last; -lh4- reported in comp.compression:] 19242 string -lzs- LHa/LZS archive data [lzs] 1925!:mime application/x-lha 19262 string -lh\40- LHa 2.x? archive data [lh ] 1927!:mime application/x-lha 19282 string -lhd- LHa 2.x? archive data [lhd] 1929!:mime application/x-lha 19302 string -lh2- LHa 2.x? archive data [lh2] 1931!:mime application/x-lha 19322 string -lh3- LHa 2.x? archive data [lh3] 1933!:mime application/x-lha 19342 string -lh4- LHa (2.x) archive data [lh4] 1935!:mime application/x-lha 19362 string -lh5- LHa (2.x) archive data [lh5] 1937!:mime application/x-lha 19382 string -lh6- LHa (2.x) archive data [lh6] 1939!:mime application/x-lha 19402 string -lh7- LHa (2.x)/LHark archive data [lh7] 1941!:mime application/x-lha 1942>20 byte x - header level %d 1943# taken from idarc [JW] 19442 string -lZ PUT archive data 19452 string -lz LZS archive data 19462 string -sw1- Swag archive data 1947 1948# RAR archiver (Greg Roelofs, newt@uchicago.edu) 19490 string Rar! RAR archive data, 1950!:mime application/x-rar 1951>44 byte x v%0x, 1952>10 byte >0 flags: 1953>>10 byte &0x01 Archive volume, 1954>>10 byte &0x02 Commented, 1955>>10 byte &0x04 Locked, 1956>>10 byte &0x08 Solid, 1957>>10 byte &0x20 Authenticated, 1958>35 byte 0 os: MS-DOS 1959>35 byte 1 os: OS/2 1960>35 byte 2 os: Win32 1961>35 byte 3 os: Unix 1962# some old version? idarc says: 19630 string RE\x7e\x5e RAR archive data 1964 1965# SQUISH archiver (Greg Roelofs, newt@uchicago.edu) 19660 string SQSH squished archive data (Acorn RISCOS) 1967 1968# UC2 archiver (Greg Roelofs, newt@uchicago.edu) 1969# [JW] see exe section for self-extracting version 19700 string UC2\x1a UC2 archive data 1971 1972# PKZIP multi-volume archive 19730 string PK\x07\x08PK\x03\x04 Zip multi-volume archive data, at least PKZIP v2.50 to extract 1974!:mime application/zip 1975 1976# ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 19770 string PK\003\004 1978>30 ubelong !0x6d696d65 1979>>4 byte 0x00 Zip archive data 1980!:mime application/zip 1981>>4 byte 0x09 Zip archive data, at least v0.9 to extract 1982!:mime application/zip 1983>>4 byte 0x0a Zip archive data, at least v1.0 to extract 1984!:mime application/zip 1985>>4 byte 0x0b Zip archive data, at least v1.1 to extract 1986!:mime application/zip 1987>>0x161 string WINZIP Zip archive data, WinZIP self-extracting 1988!:mime application/zip 1989>>4 byte 0x14 Zip archive data, at least v2.0 to extract 1990!:mime application/zip 1991 1992# OpenOffice.org / KOffice / StarOffice documents 1993# Listed here because they ARE zip files 1994# 1995# From: Abel Cheung <abel@oaka.org> 1996>30 string mimetype 1997 1998# KOffice (1.2 or above) formats 1999>>50 string vnd.kde. KOffice (>=1.2) 2000>>>58 string karbon Karbon document 2001>>>58 string kchart KChart document 2002>>>58 string kformula KFormula document 2003>>>58 string kivio Kivio document 2004>>>58 string kontour Kontour document 2005>>>58 string kpresenter KPresenter document 2006>>>58 string kspread KSpread document 2007>>>58 string kword KWord document 2008 2009# OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) 2010>>50 string vnd.sun.xml. OpenOffice.org 1.x 2011>>>62 string writer Writer 2012>>>>68 byte !0x2e document 2013>>>>68 string .template template 2014>>>>68 string .global global document 2015>>>62 string calc Calc 2016>>>>66 byte !0x2e spreadsheet 2017>>>>66 string .template template 2018>>>62 string draw Draw 2019>>>>66 byte !0x2e document 2020>>>>66 string .template template 2021>>>62 string impress Impress 2022>>>>69 byte !0x2e presentation 2023>>>>69 string .template template 2024>>>62 string math Math document 2025>>>62 string base Database file 2026 2027# OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) 2028# http://lists.oasis-open.org/archives/office/200505/msg00006.html 2029>>50 string vnd.oasis.opendocument. OpenDocument 2030>>>73 string text 2031>>>>77 byte !0x2d Text 2032!:mime application/vnd.oasis.opendocument.text 2033>>>>77 string -template Text Template 2034!:mime application/vnd.oasis.opendocument.text-template 2035>>>>77 string -web HTML Document Template 2036!:mime application/vnd.oasis.opendocument.text-web 2037>>>>77 string -master Master Document 2038!:mime application/vnd.oasis.opendocument.text-master 2039>>>73 string graphics 2040>>>>81 byte !0x2d Drawing 2041!:mime application/vnd.oasis.opendocument.graphics 2042>>>>81 string -template Template 2043!:mime application/vnd.oasis.opendocument.graphics-template 2044>>>73 string presentation 2045>>>>85 byte !0x2d Presentation 2046!:mime application/vnd.oasis.opendocument.presentation 2047>>>>85 string -template Template 2048!:mime application/vnd.oasis.opendocument.presentation-template 2049>>>73 string spreadsheet 2050>>>>84 byte !0x2d Spreadsheet 2051!:mime application/vnd.oasis.opendocument.spreadsheet 2052>>>>84 string -template Template 2053!:mime application/vnd.oasis.opendocument.spreadsheet-template 2054>>>73 string chart 2055>>>>78 byte !0x2d Chart 2056!:mime application/vnd.oasis.opendocument.chart 2057>>>>78 string -template Template 2058!:mime application/vnd.oasis.opendocument.chart-template 2059>>>73 string formula 2060>>>>80 byte !0x2d Formula 2061!:mime application/vnd.oasis.opendocument.formula 2062>>>>80 string -template Template 2063!:mime application/vnd.oasis.opendocument.formula-template 2064>>>73 string database Database 2065!:mime application/vnd.oasis.opendocument.database 2066>>>73 string image 2067>>>>78 byte !0x2d Image 2068!:mime application/vnd.oasis.opendocument.image 2069>>>>78 string -template Template 2070!:mime application/vnd.oasis.opendocument.image-template 2071 2072# Zoo archiver 207320 lelong 0xfdc4a7dc Zoo archive data 2074!:mime application/x-zoo 2075>4 byte >48 \b, v%c. 2076>>6 byte >47 \b%c 2077>>>7 byte >47 \b%c 2078>32 byte >0 \b, modify: v%d 2079>>33 byte x \b.%d+ 2080>42 lelong 0xfdc4a7dc \b, 2081>>70 byte >0 extract: v%d 2082>>>71 byte x \b.%d+ 2083 2084# Shell archives 208510 string #\ This\ is\ a\ shell\ archive shell archive text 2086!:mime application/octet-stream 2087 2088# 2089# LBR. NB: May conflict with the questionable 2090# "binary Computer Graphics Metafile" format. 2091# 20920 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data 2093# 2094# PMA (CP/M derivative of LHA) 2095# 20962 string -pm0- PMarc archive data [pm0] 20972 string -pm1- PMarc archive data [pm1] 20982 string -pm2- PMarc archive data [pm2] 20992 string -pms- PMarc SFX archive (CP/M, DOS) 21005 string -pc1- PopCom compressed executable (CP/M) 2101 2102# From Rafael Laboissiere <rafael@laboissiere.net> 2103# The Project Revision Control System (see 2104# http://prcs.sourceforge.net) generates a packaged project 2105# file which is recognized by the following entry: 21060 leshort 0xeb81 PRCS packaged project 2107 2108# Microsoft cabinets 2109# by David Necas (Yeti) <yeti@physics.muni.cz> 2110#0 string MSCF\0\0\0\0 Microsoft cabinet file data, 2111#>25 byte x v%d 2112#>24 byte x \b.%d 2113# MPi: All CABs have version 1.3, so this is pointless. 2114# Better magic in debian-additions. 2115 2116# GTKtalog catalogs 2117# by David Necas (Yeti) <yeti@physics.muni.cz> 21184 string gtktalog\ GTKtalog catalog data, 2119>13 string 3 version 3 2120>>14 beshort 0x677a (gzipped) 2121>>14 beshort !0x677a (not gzipped) 2122>13 string >3 version %s 2123 2124############################################################################ 2125# Parity archive reconstruction file, the 'par' file format now used on Usenet. 21260 string PAR\0 PARity archive data 2127>48 leshort =0 - Index file 2128>48 leshort >0 - file number %d 2129 2130# Felix von Leitner <felix-file@fefe.de> 21310 string d8:announce BitTorrent file 2132!:mime application/x-bittorrent 2133 2134# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi> 21350 beshort 0x0e0f Atari MSA archive data 2136>2 beshort x \b, %d sectors per track 2137>4 beshort 0 \b, 1 sided 2138>4 beshort 1 \b, 2 sided 2139>6 beshort x \b, starting track: %d 2140>8 beshort x \b, ending track: %d 2141 2142# Alternate ZIP string (amc@arwen.cs.berkeley.edu) 21430 string PK00PK\003\004 Zip archive data 2144 2145# ACE archive (from http://www.wotsit.org/download.asp?f=ace) 2146# by Stefan `Sec` Zehl <sec@42.org> 21477 string **ACE** ACE archive data 2148>15 byte >0 version %d 2149>16 byte =0x00 \b, from MS-DOS 2150>16 byte =0x01 \b, from OS/2 2151>16 byte =0x02 \b, from Win/32 2152>16 byte =0x03 \b, from Unix 2153>16 byte =0x04 \b, from MacOS 2154>16 byte =0x05 \b, from WinNT 2155>16 byte =0x06 \b, from Primos 2156>16 byte =0x07 \b, from AppleGS 2157>16 byte =0x08 \b, from Atari 2158>16 byte =0x09 \b, from Vax/VMS 2159>16 byte =0x0A \b, from Amiga 2160>16 byte =0x0B \b, from Next 2161>14 byte x \b, version %d to extract 2162>5 leshort &0x0080 \b, multiple volumes, 2163>>17 byte x \b (part %d), 2164>5 leshort &0x0002 \b, contains comment 2165>5 leshort &0x0200 \b, sfx 2166>5 leshort &0x0400 \b, small dictionary 2167>5 leshort &0x0800 \b, multi-volume 2168>5 leshort &0x1000 \b, contains AV-String 2169>>30 string \x16*UNREGISTERED\x20VERSION* (unregistered) 2170>5 leshort &0x2000 \b, with recovery record 2171>5 leshort &0x4000 \b, locked 2172>5 leshort &0x8000 \b, solid 2173# Date in MS-DOS format (whatever that is) 2174#>18 lelong x Created on 2175 2176# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann 2177# <doj@cubic.org> 21780x1A string sfArk sfArk compressed Soundfont 2179>0x15 string 2 2180>>0x1 string >\0 Version %s 2181>>0x2A string >\0 : %s 2182 2183# DR-DOS 7.03 Packed File *.??_ 21840 string Packed\ File\ Personal NetWare Packed File 2185>12 string x \b, was "%.12s" 2186 2187# EET archive 2188# From: Tilman Sauerbeck <tilman@code-monkey.de> 21890 belong 0x1ee7ff00 EET archive 2190!:mime application/x-eet 2191 2192# rzip archives 21930 string RZIP rzip compressed data 2194>4 byte x - version %d 2195>5 byte x \b.%d 2196>6 belong x (%d bytes) 2197 2198# From: "Robert Dale" <robdale@gmail.com> 21990 belong 123 dar archive, 2200>4 belong x label "%.8x 2201>>8 belong x %.8x 2202>>>12 beshort x %.4x" 2203>14 byte 0x54 end slice 2204>14 beshort 0x4e4e multi-part 2205>14 beshort 0x4e53 multi-part, with -S 2206 2207# Symbian installation files 2208# http://www.thouky.co.uk/software/psifs/sis.html 2209# http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf 22108 lelong 0x10000419 Symbian installation file 2211!:mime application/vnd.symbian.install 2212>4 lelong 0x1000006D (EPOC release 3/4/5) 2213>4 lelong 0x10003A12 (EPOC release 6) 22140 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x) 2215!:mime x-epoc/x-sisx-app 2216 2217# From "Nelson A. de Oliveira" <naoliv@gmail.com> 22180 string MPQ\032 MoPaQ (MPQ) archive 2219 2220# From: Dirk Jagdmann <doj@cubic.org> 2221# xar archive format: http://code.google.com/p/xar/ 22220 string xar! xar archive 2223>6 beshort x - version %ld 2224 2225# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 2226# .kgb 22270 string KGB_arch KGB Archiver file 2228>10 string x with compression level %.1s 2229 2230# xar (eXtensible ARchiver) archive 2231# From: "David Remahl" <dremahl@apple.com> 22320 string xar! xar archive 2233#>4 beshort x header size %d 2234>6 beshort x version %d, 2235#>8 quad x compressed TOC: %d, 2236#>16 quad x uncompressed TOC: %d, 2237>24 belong 0 no checksum 2238>24 belong 1 SHA-1 checksum 2239>24 belong 2 MD5 checksum 2240 2241# Type: Parity Archive 2242# From: Daniel van Eeden <daniel_e@dds.nl> 22430 string PAR2 Parity Archive Volume Set 2244 2245# Bacula volume format. (Volumes always start with a block header.) 2246# URL: http://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html 2247# From: Adam Buchbinder <adam.buchbinder@gmail.com> 224812 string BB02 Bacula volume 2249>20 bedate x \b, started %s 2250 2251#------------------------------------------------------------------------------ 2252# $File: asterix,v 1.5 2009/09/19 16:28:08 christos Exp $ 2253# asterix: file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character 2254# strings as "long" - we assume they're just strings: 2255# From: guy@netapp.com (Guy Harris) 2256# 22570 string *STA Aster*x 2258>7 string WORD Words Document 2259>7 string GRAP Graphic 2260>7 string SPRE Spreadsheet 2261>7 string MACR Macro 22620 string 2278 Aster*x Version 2 2263>29 byte 0x36 Words Document 2264>29 byte 0x35 Graphic 2265>29 byte 0x32 Spreadsheet 2266>29 byte 0x38 Macro 2267 2268 2269#------------------------------------------------------------------------------ 2270# $File: att3b,v 1.8 2009/09/19 16:28:08 christos Exp $ 2271# att3b: file(1) magic for AT&T 3B machines 2272# 2273# The `versions' should be un-commented if they work for you. 2274# (Was the problem just one of endianness?) 2275# 2276# 3B20 2277# 2278# The 3B20 conflicts with SCCS. 2279#0 beshort 0550 3b20 COFF executable 2280#>12 belong >0 not stripped 2281#>22 beshort >0 - version %ld 2282#0 beshort 0551 3b20 COFF executable (TV) 2283#>12 belong >0 not stripped 2284#>22 beshort >0 - version %ld 2285# 2286# WE32K 2287# 22880 beshort 0560 WE32000 COFF 2289>18 beshort ^00000020 object 2290>18 beshort &00000020 executable 2291>12 belong >0 not stripped 2292>18 beshort ^00010000 N/A on 3b2/300 w/paging 2293>18 beshort &00020000 32100 required 2294>18 beshort &00040000 and MAU hardware required 2295>20 beshort 0407 (impure) 2296>20 beshort 0410 (pure) 2297>20 beshort 0413 (demand paged) 2298>20 beshort 0443 (target shared library) 2299>22 beshort >0 - version %ld 23000 beshort 0561 WE32000 COFF executable (TV) 2301>12 belong >0 not stripped 2302#>18 beshort &00020000 - 32100 required 2303#>18 beshort &00040000 and MAU hardware required 2304#>22 beshort >0 - version %ld 2305# 2306# core file for 3b2 23070 string \000\004\036\212\200 3b2 core file 2308>364 string >\0 of '%s' 2309 2310#------------------------------------------------------------------------------ 2311# $File: audio,v 1.59 2009/11/04 17:27:37 christos Exp $ 2312# audio: file(1) magic for sound formats (see also "iff") 2313# 2314# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com), 2315# and others 2316# 2317 2318# Sun/NeXT audio data 23190 string .snd Sun/NeXT audio data: 2320>12 belong 1 8-bit ISDN mu-law, 2321!:mime audio/basic 2322>12 belong 2 8-bit linear PCM [REF-PCM], 2323!:mime audio/basic 2324>12 belong 3 16-bit linear PCM, 2325!:mime audio/basic 2326>12 belong 4 24-bit linear PCM, 2327!:mime audio/basic 2328>12 belong 5 32-bit linear PCM, 2329!:mime audio/basic 2330>12 belong 6 32-bit IEEE floating point, 2331!:mime audio/basic 2332>12 belong 7 64-bit IEEE floating point, 2333!:mime audio/basic 2334>12 belong 8 Fragmented sample data, 2335>12 belong 10 DSP program, 2336>12 belong 11 8-bit fixed point, 2337>12 belong 12 16-bit fixed point, 2338>12 belong 13 24-bit fixed point, 2339>12 belong 14 32-bit fixed point, 2340>12 belong 18 16-bit linear with emphasis, 2341>12 belong 19 16-bit linear compressed, 2342>12 belong 20 16-bit linear with emphasis and compression, 2343>12 belong 21 Music kit DSP commands, 2344>12 belong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.), 2345!:mime audio/x-adpcm 2346>12 belong 24 compressed (8-bit CCITT G.722 ADPCM) 2347>12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), 2348>12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), 2349>12 belong 27 8-bit A-law (CCITT G.711), 2350>20 belong 1 mono, 2351>20 belong 2 stereo, 2352>20 belong 4 quad, 2353>16 belong >0 %d Hz 2354 2355# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format 2356# that uses little-endian encoding and has a different magic number 23570 lelong 0x0064732E DEC audio data: 2358>12 lelong 1 8-bit ISDN mu-law, 2359!:mime audio/x-dec-basic 2360>12 lelong 2 8-bit linear PCM [REF-PCM], 2361!:mime audio/x-dec-basic 2362>12 lelong 3 16-bit linear PCM, 2363!:mime audio/x-dec-basic 2364>12 lelong 4 24-bit linear PCM, 2365!:mime audio/x-dec-basic 2366>12 lelong 5 32-bit linear PCM, 2367!:mime audio/x-dec-basic 2368>12 lelong 6 32-bit IEEE floating point, 2369!:mime audio/x-dec-basic 2370>12 lelong 7 64-bit IEEE floating point, 2371!:mime audio/x-dec-basic 2372>12 belong 8 Fragmented sample data, 2373>12 belong 10 DSP program, 2374>12 belong 11 8-bit fixed point, 2375>12 belong 12 16-bit fixed point, 2376>12 belong 13 24-bit fixed point, 2377>12 belong 14 32-bit fixed point, 2378>12 belong 18 16-bit linear with emphasis, 2379>12 belong 19 16-bit linear compressed, 2380>12 belong 20 16-bit linear with emphasis and compression, 2381>12 belong 21 Music kit DSP commands, 2382>12 lelong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.), 2383!:mime audio/x-dec-basic 2384>12 belong 24 compressed (8-bit CCITT G.722 ADPCM) 2385>12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), 2386>12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), 2387>12 belong 27 8-bit A-law (CCITT G.711), 2388>20 lelong 1 mono, 2389>20 lelong 2 stereo, 2390>20 lelong 4 quad, 2391>16 lelong >0 %d Hz 2392 2393# Creative Labs AUDIO stuff 23940 string MThd Standard MIDI data 2395!:mime audio/midi 2396>8 beshort x (format %d) 2397>10 beshort x using %d track 2398>10 beshort >1 \bs 2399>12 beshort&0x7fff x at 1/%d 2400>12 beshort&0x8000 >0 SMPTE 2401 24020 string CTMF Creative Music (CMF) data 2403!:mime audio/x-unknown 24040 string SBI SoundBlaster instrument data 2405!:mime audio/x-unknown 24060 string Creative\ Voice\ File Creative Labs voice data 2407!:mime audio/x-unknown 2408# is this next line right? it came this way... 2409>19 byte 0x1A 2410>23 byte >0 - version %d 2411>22 byte >0 \b.%d 2412 2413# first entry is also the string "NTRK" 24140 belong 0x4e54524b MultiTrack sound data 2415>4 belong x - version %ld 2416 2417# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED 2418# [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi] 24190 string EMOD Extended MOD sound data, 2420>4 byte&0xf0 x version %d 2421>4 byte&0x0f x \b.%d, 2422>45 byte x %d instruments 2423>83 byte 0 (module) 2424>83 byte 1 (song) 2425 2426# Real Audio (Magic .ra\0375) 24270 belong 0x2e7261fd RealAudio sound file 2428!:mime audio/x-pn-realaudio 24290 string .RMF\0\0\0 RealMedia file 2430!:mime application/vnd.rn-realmedia 2431#video/x-pn-realvideo 2432#video/vnd.rn-realvideo 2433#application/vnd.rn-realmedia 2434# sigh, there are many mimes for that but the above are the most common. 2435 2436# MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net] 2437# Oct 31, 1995 2438# fixed by <doj@cubic.org> 2003-06-24 2439# Too short... 2440#0 string MTM MultiTracker Module sound file 2441#0 string if Composer 669 Module sound data 2442#0 string JN Composer 669 Module sound data (extended format) 24430 string MAS_U ULT(imate) Module sound data 2444 2445#0 string FAR Module sound data 2446#>4 string >\15 Title: "%s" 2447 24480x2c string SCRM ScreamTracker III Module sound data 2449>0 string >\0 Title: "%s" 2450 2451# Gravis UltraSound patches 2452# From <ache@nagual.ru> 2453 24540 string GF1PATCH110\0ID#000002\0 GUS patch 24550 string GF1PATCH100\0ID#000002\0 Old GUS patch 2456 2457# mime types according to http://www.geocities.com/nevilo/mod.htm: 2458# audio/it .it 2459# audio/x-zipped-it .itz 2460# audio/xm fasttracker modules 2461# audio/x-s3m screamtracker modules 2462# audio/s3m screamtracker modules 2463# audio/x-zipped-mod mdz 2464# audio/mod mod 2465# audio/x-mod All modules (mod, s3m, 669, mtm, med, xm, it, mdz, stm, itz, xmz, s3z) 2466 2467# 2468# Taken from loader code from mikmod version 2.14 2469# by Steve McIntyre (stevem@chiark.greenend.org.uk) 2470# <doj@cubic.org> added title printing on 2003-06-24 24710 string MAS_UTrack_V00 2472>14 string >/0 ultratracker V1.%.1s module sound data 2473!:mime audio/x-mod 2474#audio/x-tracker-module 2475 24760 string UN05 MikMod UNI format module sound data 2477 24780 string Extended\ Module: Fasttracker II module sound data 2479!:mime audio/x-mod 2480#audio/x-tracker-module 2481>17 string >\0 Title: "%s" 2482 248321 string/c =!SCREAM! Screamtracker 2 module sound data 2484!:mime audio/x-mod 2485#audio/x-screamtracker-module 248621 string BMOD2STM Screamtracker 2 module sound data 2487!:mime audio/x-mod 2488#audio/x-screamtracker-module 24891080 string M.K. 4-channel Protracker module sound data 2490!:mime audio/x-mod 2491#audio/x-protracker-module 2492>0 string >\0 Title: "%s" 24931080 string M!K! 4-channel Protracker module sound data 2494!:mime audio/x-mod 2495#audio/x-protracker-module 2496>0 string >\0 Title: "%s" 24971080 string FLT4 4-channel Startracker module sound data 2498!:mime audio/x-mod 2499#audio/x-startracker-module 2500>0 string >\0 Title: "%s" 25011080 string FLT8 8-channel Startracker module sound data 2502!:mime audio/x-mod 2503#audio/x-startracker-module 2504>0 string >\0 Title: "%s" 25051080 string 4CHN 4-channel Fasttracker module sound data 2506!:mime audio/x-mod 2507#audio/x-fasttracker-module 2508>0 string >\0 Title: "%s" 25091080 string 6CHN 6-channel Fasttracker module sound data 2510!:mime audio/x-mod 2511#audio/x-fasttracker-module 2512>0 string >\0 Title: "%s" 25131080 string 8CHN 8-channel Fasttracker module sound data 2514!:mime audio/x-mod 2515#audio/x-fasttracker-module 2516>0 string >\0 Title: "%s" 25171080 string CD81 8-channel Octalyser module sound data 2518!:mime audio/x-mod 2519#audio/x-octalysertracker-module 2520>0 string >\0 Title: "%s" 25211080 string OKTA 8-channel Octalyzer module sound data 2522!:mime audio/x-mod 2523#audio/x-octalysertracker-module 2524>0 string >\0 Title: "%s" 2525# Not good enough. 2526#1082 string CH 2527#>1080 string >/0 %.2s-channel Fasttracker "oktalyzer" module sound data 25281080 string 16CN 16-channel Taketracker module sound data 2529!:mime audio/x-mod 2530#audio/x-taketracker-module 2531>0 string >\0 Title: "%s" 25321080 string 32CN 32-channel Taketracker module sound data 2533!:mime audio/x-mod 2534#audio/x-taketracker-module 2535>0 string >\0 Title: "%s" 2536 2537# TOC sound files -Trevor Johnson <trevor@jpj.net> 2538# 25390 string TOC TOC sound file 2540 2541# sidfiles <pooka@iki.fi> 2542# added name,author,(c) and new RSID type by <doj@cubic.org> 2003-06-24 25430 string SIDPLAY\ INFOFILE Sidplay info file 2544 25450 string PSID PlaySID v2.2+ (AMIGA) sidtune 2546>4 beshort >0 w/ header v%d, 2547>14 beshort =1 single song, 2548>14 beshort >1 %d songs, 2549>16 beshort >0 default song: %d 2550>0x16 string >\0 name: "%s" 2551>0x36 string >\0 author: "%s" 2552>0x56 string >\0 copyright: "%s" 2553 25540 string RSID RSID sidtune PlaySID compatible 2555>4 beshort >0 w/ header v%d, 2556>14 beshort =1 single song, 2557>14 beshort >1 %d songs, 2558>16 beshort >0 default song: %d 2559>0x16 string >\0 name: "%s" 2560>0x36 string >\0 author: "%s" 2561>0x56 string >\0 copyright: "%s" 2562 2563# IRCAM <mpruett@sgi.com> 2564# VAX and MIPS files are little-endian; Sun and NeXT are big-endian 25650 belong 0x64a30100 IRCAM file (VAX) 25660 belong 0x64a30200 IRCAM file (Sun) 25670 belong 0x64a30300 IRCAM file (MIPS little-endian) 25680 belong 0x64a30400 IRCAM file (NeXT) 2569 2570# NIST SPHERE <mpruett@sgi.com> 25710 string NIST_1A\n\ \ \ 1024\n NIST SPHERE file 2572 2573# Sample Vision <mpruett@sgi.com> 25740 string SOUND\ SAMPLE\ DATA\ Sample Vision file 2575 2576# Audio Visual Research <tonigonenstein@users.sourceforge.net> 25770 string 2BIT Audio Visual Research file, 2578>12 beshort =0 mono, 2579>12 beshort =-1 stereo, 2580>14 beshort x %d bits 2581>16 beshort =0 unsigned, 2582>16 beshort =-1 signed, 2583>22 belong&0x00ffffff x %d Hz, 2584>18 beshort =0 no loop, 2585>18 beshort =-1 loop, 2586>21 ubyte <128 note %d, 2587>22 byte =0 replay 5.485 KHz 2588>22 byte =1 replay 8.084 KHz 2589>22 byte =2 replay 10.971 KHz 2590>22 byte =3 replay 16.168 KHz 2591>22 byte =4 replay 21.942 KHz 2592>22 byte =5 replay 32.336 KHz 2593>22 byte =6 replay 43.885 KHz 2594>22 byte =7 replay 47.261 KHz 2595 2596# SGI SoundTrack <mpruett@sgi.com> 25970 string _SGI_SoundTrack SGI SoundTrack project file 2598# ID3 version 2 tags <waschk@informatik.uni-rostock.de> 25990 string ID3 Audio file with ID3 version 2 2600>3 byte x \b.%d 2601>4 byte x \b.%d 2602>>5 byte &0x80 \b, unsynchronized frames 2603>>5 byte &0x40 \b, extended header 2604>>5 byte &0x20 \b, experimental 2605>>5 byte &0x10 \b, footer present 2606>(6.I) indirect x \b, contains: 2607 2608# NSF (NES sound file) magic 26090 string NESM\x1a NES Sound File 2610>14 string >\0 ("%s" by 2611>46 string >\0 %s, copyright 2612>78 string >\0 %s), 2613>5 byte x version %d, 2614>6 byte x %d tracks, 2615>122 byte&0x2 =1 dual PAL/NTSC 2616>122 byte&0x1 =1 PAL 2617>122 byte&0x1 =0 NTSC 2618 2619# Type: SNES SPC700 sound files 2620# From: Josh Triplett <josh@freedesktop.org> 26210 string SNES-SPC700\ Sound\ File\ Data\ v SNES SPC700 sound file 2622>&0 string 0.30 \b, version %s 2623>>0x23 byte 0x1B \b, without ID666 tag 2624>>0x23 byte 0x1A \b, with ID666 tag 2625>>>0x2E string >\0 \b, song "%.32s" 2626>>>0x4E string >\0 \b, game "%.32s" 2627 2628# Impulse tracker module (audio/x-it) 26290 string IMPM Impulse Tracker module sound data - 2630!:mime audio/x-mod 2631>4 string >\0 "%s" 2632>40 leshort !0 compatible w/ITv%x 2633>42 leshort !0 created w/ITv%x 2634 2635# Imago Orpheus module (audio/x-imf) 263660 string IM10 Imago Orpheus module sound data - 2637>0 string >\0 "%s" 2638 2639# From <collver1@attbi.com> 2640# These are the /etc/magic entries to decode modules, instruments, and 2641# samples in Impulse Tracker's native format. 2642 26430 string IMPS Impulse Tracker Sample 2644>18 byte &2 16 bit 2645>18 byte ^2 8 bit 2646>18 byte &4 stereo 2647>18 byte ^4 mono 26480 string IMPI Impulse Tracker Instrument 2649>28 leshort !0 ITv%x 2650>30 byte !0 %d samples 2651 2652# Yamaha TX Wave: file(1) magic for Yamaha TX Wave audio files 2653# From <collver1@attbi.com> 26540 string LM8953 Yamaha TX Wave 2655>22 byte 0x49 looped 2656>22 byte 0xC9 non-looped 2657>23 byte 1 33kHz 2658>23 byte 2 50kHz 2659>23 byte 3 16kHz 2660 2661# scream tracker: file(1) magic for Scream Tracker sample files 2662# 2663# From <collver1@attbi.com> 266476 string SCRS Scream Tracker Sample 2665>0 byte 1 sample 2666>0 byte 2 adlib melody 2667>0 byte >2 adlib drum 2668>31 byte &2 stereo 2669>31 byte ^2 mono 2670>31 byte &4 16bit little endian 2671>31 byte ^4 8bit 2672>30 byte 0 unpacked 2673>30 byte 1 packed 2674 2675# audio 2676# From: Cory Dikkers <cdikkers@swbell.net> 26770 string MMD0 MED music file, version 0 26780 string MMD1 OctaMED Pro music file, version 1 26790 string MMD3 OctaMED Soundstudio music file, version 3 26800 string OctaMEDCmpr OctaMED Soundstudio compressed file 26810 string MED MED_Song 26820 string SymM Symphonie SymMOD music file 2683# 26840 string THX AHX version 2685>3 byte =0 1 module data 2686>3 byte =1 2 module data 2687# 26880 string OKTASONG Oktalyzer module data 2689# 26900 string DIGI\ Booster\ module\0 %s 2691>20 byte >0 %c 2692>>21 byte >0 \b%c 2693>>>22 byte >0 \b%c 2694>>>>23 byte >0 \b%c 2695>610 string >\0 \b, "%s" 2696# 26970 string DBM0 DIGI Booster Pro Module 2698>4 byte >0 V%X. 2699>>5 byte x \b%02X 2700>16 string >\0 \b, "%s" 2701# 27020 string FTMN FaceTheMusic module 2703>16 string >\0d \b, "%s" 2704 2705# From: <doj@cubic.org> 2003-06-24 27060 string AMShdr\32 Velvet Studio AMS Module v2.2 27070 string Extreme Extreme Tracker AMS Module v1.3 27080 string DDMF Xtracker DMF Module 2709>4 byte x v%i 2710>0xD string >\0 Title: "%s" 2711>0x2B string >\0 Composer: "%s" 27120 string DSM\32 Dynamic Studio Module DSM 27130 string SONG DigiTrekker DTM Module 27140 string DMDL DigiTrakker MDL Module 27150 string PSM\32 Protracker Studio PSM Module 271644 string PTMF Poly Tracker PTM Module 2717>0 string >\32 Title: "%s" 27180 string MT20 MadTracker 2.0 Module MT2 27190 string RAD\40by\40REALiTY!! RAD Adlib Tracker Module RAD 27200 string RTMM RTM Module 27210x426 string MaDoKaN96 XMS Adlib Module 2722>0 string >\0 Composer: "%s" 27230 string AMF AMF Module 2724>4 string >\0 Title: "%s" 27250 string MODINFO1 Open Cubic Player Module Inforation MDZ 27260 string Extended\40Instrument: Fast Tracker II Instrument 2727 2728# From: Takeshi Hamasaki <hma@syd.odn.ne.jp> 2729# NOA Nancy Codec file 27300 string \210NOA\015\012\032 NOA Nancy Codec Movie file 2731# Yamaha SMAF format 27320 string MMMD Yamaha SMAF file 2733# Sharp Jisaku Melody format for PDC 27340 string \001Sharp\040JisakuMelody SHARP Cell-Phone ringing Melody 2735>20 string Ver01.00 Ver. 1.00 2736>>32 byte x , %d tracks 2737 2738# Free lossless audio codec <http://flac.sourceforge.net> 2739# From: Przemyslaw Augustyniak <silvathraec@rpg.pl> 27400 string fLaC FLAC audio bitstream data 2741!:mime audio/x-flac 2742>4 byte&0x7f >0 \b, unknown version 2743>4 byte&0x7f 0 \b 2744# some common bits/sample values 2745>>20 beshort&0x1f0 0x030 \b, 4 bit 2746>>20 beshort&0x1f0 0x050 \b, 6 bit 2747>>20 beshort&0x1f0 0x070 \b, 8 bit 2748>>20 beshort&0x1f0 0x0b0 \b, 12 bit 2749>>20 beshort&0x1f0 0x0f0 \b, 16 bit 2750>>20 beshort&0x1f0 0x170 \b, 24 bit 2751>>20 byte&0xe 0x0 \b, mono 2752>>20 byte&0xe 0x2 \b, stereo 2753>>20 byte&0xe 0x4 \b, 3 channels 2754>>20 byte&0xe 0x6 \b, 4 channels 2755>>20 byte&0xe 0x8 \b, 5 channels 2756>>20 byte&0xe 0xa \b, 6 channels 2757>>20 byte&0xe 0xc \b, 7 channels 2758>>20 byte&0xe 0xe \b, 8 channels 2759# some common sample rates 2760>>17 belong&0xfffff0 0x0ac440 \b, 44.1 kHz 2761>>17 belong&0xfffff0 0x0bb800 \b, 48 kHz 2762>>17 belong&0xfffff0 0x07d000 \b, 32 kHz 2763>>17 belong&0xfffff0 0x056220 \b, 22.05 kHz 2764>>17 belong&0xfffff0 0x05dc00 \b, 24 kHz 2765>>17 belong&0xfffff0 0x03e800 \b, 16 kHz 2766>>17 belong&0xfffff0 0x02b110 \b, 11.025 kHz 2767>>17 belong&0xfffff0 0x02ee00 \b, 12 kHz 2768>>17 belong&0xfffff0 0x01f400 \b, 8 kHz 2769>>17 belong&0xfffff0 0x177000 \b, 96 kHz 2770>>17 belong&0xfffff0 0x0fa000 \b, 64 kHz 2771>>21 byte&0xf >0 \b, >4G samples 2772>>21 byte&0xf 0 \b 2773>>>22 belong >0 \b, %u samples 2774>>>22 belong 0 \b, length unknown 2775 2776# (ISDN) VBOX voice message file (Wolfram Kleff) 27770 string VBOX VBOX voice message data 2778 2779# ReBorn Song Files (.rbs) 2780# David J. Singer <doc@deadvirgins.org.uk> 27818 string RB40 RBS Song file 2782>29 string ReBorn created by ReBorn 2783>37 string Propellerhead created by ReBirth 2784 2785# Synthesizer Generator and Kimwitu share their file format 27860 string A#S#C#S#S#L#V#3 Synthesizer Generator or Kimwitu data 2787# Kimwitu++ uses a slightly different magic 27880 string A#S#C#S#S#L#HUB Kimwitu++ data 2789 2790# From "Simon Hosie 27910 string TFMX-SONG TFMX module sound data 2792 2793# Monkey's Audio compressed audio format (.ape) 2794# From danny.milo@gmx.net (Danny Milosavljevic) 2795# New version from Abel Cheung <abel (@) oaka.org> 27960 string MAC\040 Monkey's Audio compressed format 2797>4 uleshort >0x0F8B version %d 2798>>(0x08.l) uleshort =1000 with fast compression 2799>>(0x08.l) uleshort =2000 with normal compression 2800>>(0x08.l) uleshort =3000 with high compression 2801>>(0x08.l) uleshort =4000 with extra high compression 2802>>(0x08.l) uleshort =5000 with insane compression 2803>>(0x08.l+18) uleshort =1 \b, mono 2804>>(0x08.l+18) uleshort =2 \b, stereo 2805>>(0x08.l+20) ulelong x \b, sample rate %d 2806>4 uleshort <0x0F8C version %d 2807>>6 uleshort =1000 with fast compression 2808>>6 uleshort =2000 with normal compression 2809>>6 uleshort =3000 with high compression 2810>>6 uleshort =4000 with extra high compression 2811>>6 uleshort =5000 with insane compression 2812>>10 uleshort =1 \b, mono 2813>>10 uleshort =2 \b, stereo 2814>>12 ulelong x \b, sample rate %d 2815 2816# adlib sound files 2817# From Gürkan Sengün <gurkan@linuks.mine.nu>, http://www.linuks.mine.nu 28180 string RAWADATA RdosPlay RAW 2819 28201068 string RoR AMUSIC Adlib Tracker 2821 28220 string JCH EdLib 2823 28240 string mpu401tr MPU-401 Trakker 2825 28260 string SAdT Surprise! Adlib Tracker 2827>4 byte x Version %d 2828 28290 string XAD! eXotic ADlib 2830 28310 string ofTAZ! eXtra Simple Music 2832 2833# Spectrum 128 tunes (.ay files). 2834# From: Emanuel Haupt <ehaupt@critical.ch> 28350 string ZXAYEMUL Spectrum 128 tune 2836 28370 string \0BONK BONK, 2838#>5 byte x version %d 2839>14 byte x %d channel(s), 2840>15 byte =1 lossless, 2841>15 byte =0 lossy, 2842>16 byte x mid-side 2843 2844384 string LockStream LockStream Embedded file (mostly MP3 on old Nokia phones) 2845 2846# format VQF (proprietary codec for sound) 2847# some infos on the header file available at : 2848# http://www.twinvq.org/english/technology_format.html 28490 string TWIN97012000 VQF data 2850>27 short 0 \b, Mono 2851>27 short 1 \b, Stereo 2852>31 short >0 \b, %d kbit/s 2853>35 short >0 \b, %d kHz 2854 2855# Nelson A. de Oliveira (naoliv@gmail.com) 2856# .eqf 28570 string Winamp\ EQ\ library\ file %s 2858# it will match only versions like v<digit>.<digit> 2859# Since I saw only eqf files with version v1.1 I think that it's OK 2860>23 string x \b%.4s 2861# .preset 28620 string [Equalizer\ preset] XMMS equalizer preset 2863# .m3u 28640 search/1 #EXTM3U M3U playlist text 2865# .pls 28660 search/1 [playlist] PLS playlist text 2867# licq.conf 28681 string [licq] LICQ configuration file 2869 2870# Atari ST audio files by Dirk Jagdmann <doj@cubic.org> 28710 string ICE! SNDH Atari ST music 28720 string SC68\ Music-file\ /\ (c)\ (BeN)jami sc68 Atari ST music 2873 2874# musepak support From: "Jiri Pejchal" <jiri.pejchal@gmail.com> 28750 string MP+ Musepack audio 2876>3 byte 255 \b, SV pre8 2877>3 byte&0xF 0x6 \b, SV 6 2878>3 byte&0xF 0x8 \b, SV 8 2879>3 byte&0xF 0x7 \b, SV 7 2880>>3 byte&0xF0 0x0 \b.0 2881>>3 byte&0xF0 0x10 \b.1 2882>>3 byte&0xF0 240 \b.15 2883>>10 byte&0xF0 0x0 \b, no profile 2884>>10 byte&0xF0 0x10 \b, profile 'Unstable/Experimental' 2885>>10 byte&0xF0 0x50 \b, quality 0 2886>>10 byte&0xF0 0x60 \b, quality 1 2887>>10 byte&0xF0 0x70 \b, quality 2 (Telephone) 2888>>10 byte&0xF0 0x80 \b, quality 3 (Thumb) 2889>>10 byte&0xF0 0x90 \b, quality 4 (Radio) 2890>>10 byte&0xF0 0xA0 \b, quality 5 (Standard) 2891>>10 byte&0xF0 0xB0 \b, quality 6 (Xtreme) 2892>>10 byte&0xF0 0xC0 \b, quality 7 (Insane) 2893>>10 byte&0xF0 0xD0 \b, quality 8 (BrainDead) 2894>>10 byte&0xF0 0xE0 \b, quality 9 2895>>10 byte&0xF0 0xF0 \b, quality 10 2896>>27 byte 0x0 \b, Buschmann 1.7.0-9, Klemm 0.90-1.05 2897>>27 byte 102 \b, Beta 1.02 2898>>27 byte 104 \b, Beta 1.04 2899>>27 byte 105 \b, Alpha 1.05 2900>>27 byte 106 \b, Beta 1.06 2901>>27 byte 110 \b, Release 1.1 2902>>27 byte 111 \b, Alpha 1.11 2903>>27 byte 112 \b, Beta 1.12 2904>>27 byte 113 \b, Alpha 1.13 2905>>27 byte 114 \b, Beta 1.14 2906>>27 byte 115 \b, Alpha 1.15 2907 2908# IMY 2909# from http://filext.com/detaillist.php?extdetail=IMY 2910# http://cellphones.about.com/od/cellularfaqs/f/rf_imelody.htm 2911# http://download.ncl.ie/doc/api/ie/ncl/media/music/IMelody.html 2912# http://www.wx800.com/msg/download/irda/iMelody.pdf 29130 string BEGIN:IMELODY iMelody Ringtone Format 2914 2915# From: "Mateus Caruccio" <mateus@caruccio.com> 2916# guitar pro v3,4,5 from http://filext.com/file-extension/gp3 29170 string \030FICHIER\ GUITAR\ PRO\ v3. Guitar Pro Ver. 3 Tablature 2918 2919# From: "Leslie P. Polzer" <leslie.polzer@gmx.net> 292060 string SONG SoundFX Module sound file 2921 2922# Type: Adaptive Multi-Rate Codec 2923# URL: http://filext.com/detaillist.php?extdetail=AMR 2924# From: Russell Coker <russell@coker.com.au> 29250 string #!AMR Adaptive Multi-Rate Codec (GSM telephony) 2926 2927# Type: SuperCollider 3 Synth Definition File Format 2928# From: Mario Lang <mlang@debian.org> 29290 string SCgf SuperCollider3 Synth Definition file, 2930>4 belong x version %d 2931 2932#---------------------------------------------------------------- 2933# $File: basis,v 1.4 2009/09/19 16:28:08 christos Exp $ 2934# basis: file(1) magic for BBx/Pro5-files 2935# Oliver Dammer <dammer@olida.de> 2005/11/07 2936# http://www.basis.com business-basic-files. 2937# 29380 string \074\074bbx\076\076 BBx 2939>7 string \000 indexed file 2940>7 string \001 serial file 2941>7 string \002 keyed file 2942>>13 short 0 (sort) 2943>7 string \004 program 2944>>18 byte x (LEVEL %d) 2945>>>23 string >\000 psaved 2946>7 string \006 mkeyed file 2947>>13 short 0 (sort) 2948>>8 string \000 (mkey) 2949 2950#------------------------------------------------------------------------------ 2951# $File: bflt,v 1.4 2009/09/19 16:28:08 christos Exp $ 2952# bFLT: file(1) magic for BFLT uclinux binary files 2953# 2954# From Philippe De Muyter <phdm@macqel.be> 2955# 29560 string bFLT BFLT executable 2957>4 belong x - version %ld 2958>4 belong 4 2959>>36 belong&0x1 0x1 ram 2960>>36 belong&0x2 0x2 gotpic 2961>>36 belong&0x4 0x4 gzip 2962>>36 belong&0x8 0x8 gzdata 2963# Berkeley Lab Checkpoint Restart (BLCR) checkpoint context files 2964# http://ftg.lbl.gov/checkpoint 29650 string C\0\0\0R\0\0\0 BLCR 2966>16 lelong 1 x86 2967>16 lelong 3 alpha 2968>16 lelong 5 x86-64 2969>16 lelong 7 ARM 2970>8 lelong x context data (little endian, version %d) 2971# Uncomment the following only of your "file" program supports "search" 2972#>0 search/1024 VMA\06 for kernel 2973#>>&1 byte x %d. 2974#>>&2 byte x %d. 2975#>>&3 byte x %d 29760 string \0\0\0C\0\0\0R BLCR 2977>16 belong 2 SPARC 2978>16 belong 4 ppc 2979>16 belong 6 ppc64 2980>16 belong 7 ARMEB 2981>16 belong 8 SPARC64 2982>8 belong x context data (big endian, version %d) 2983# Uncomment the following only of your "file" program supports "search" 2984#>0 search/1024 VMA\06 for kernel 2985#>>&1 byte x %d. 2986#>>&2 byte x %d. 2987#>>&3 byte x %d 2988 2989#------------------------------------------------------------------------------ 2990# $File: blender,v 1.5 2009/09/19 16:28:08 christos Exp $ 2991# blender: file(1) magic for Blender 3D related files 2992# 2993# Native format rule v1.2. For questions use the developers list 2994# http://lists.blender.org/mailman/listinfo/bf-committers 2995# GLOB chunk was moved near start and provides subversion info since 2.42 2996 29970 string =BLENDER Blender3D, 2998>7 string =_ saved as 32-bits 2999>>8 string =v little endian 3000>>>9 byte x with version %c. 3001>>>10 byte x \b%c 3002>>>11 byte x \b%c 3003>>>0x40 string =GLOB \b. 3004>>>>0x58 leshort x \b%.4d 3005>>8 string =V big endian 3006>>>9 byte x with version %c. 3007>>>10 byte x \b%c 3008>>>11 byte x \b%c 3009>>>0x40 string =GLOB \b. 3010>>>>0x58 beshort x \b%.4d 3011>7 string =- saved as 64-bits 3012>>8 string =v little endian 3013>>9 byte x with version %c. 3014>>10 byte x \b%c 3015>>11 byte x \b%c 3016>>0x44 string =GLOB \b. 3017>>>0x60 leshort x \b%.4d 3018>>8 string =V big endian 3019>>>9 byte x with version %c. 3020>>>10 byte x \b%c 3021>>>11 byte x \b%c 3022>>>0x44 string =GLOB \b. 3023>>>>0x60 beshort x \b%.4d 3024 3025# Scripts that run in the embeded Python interpreter 30260 string #!BPY Blender3D BPython script 3027 3028#------------------------------------------------------------------------------ 3029# $File: blit,v 1.8 2009/09/19 16:28:08 christos Exp $ 3030# blit: file(1) magic for 68K Blit stuff as seen from 680x0 machine 3031# 3032# Note that this 0407 conflicts with several other a.out formats... 3033# 3034# XXX - should this be redone with "be" and "le", so that it works on 3035# little-endian machines as well? If so, what's the deal with 3036# "VAX-order" and "VAX-order2"? 3037# 3038#0 long 0407 68K Blit (standalone) executable 3039#0 short 0407 VAX-order2 68K Blit (standalone) executable 30400 short 03401 VAX-order 68K Blit (standalone) executable 30410 long 0406 68k Blit mpx/mux executable 30420 short 0406 VAX-order2 68k Blit mpx/mux executable 30430 short 03001 VAX-order 68k Blit mpx/mux executable 3044# Need more values for WE32 DMD executables. 3045# Note that 0520 is the same as COFF 3046#0 short 0520 tty630 layers executable 3047 3048#------------------------------------------------------------------------------ 3049# $File: bout,v 1.5 2009/09/19 16:28:08 christos Exp $ 3050# i80960 b.out objects and archives 3051# 30520 long 0x10d i960 b.out relocatable object 3053>16 long >0 not stripped 3054# 3055# b.out archive (hp-rt on i960) 30560 string =!<bout> b.out archive 3057>8 string __.SYMDEF random library 3058 3059#------------------------------------------------------------------------------ 3060# $File: bsdi,v 1.5 2009/09/19 16:28:08 christos Exp $ 3061# bsdi: file(1) magic for BSD/OS (from BSDI) objects 3062# 3063 30640 lelong 0314 386 compact demand paged pure executable 3065>16 lelong >0 not stripped 3066>32 byte 0x6a (uses shared libs) 3067 30680 lelong 0407 386 executable 3069>16 lelong >0 not stripped 3070>32 byte 0x6a (uses shared libs) 3071 30720 lelong 0410 386 pure executable 3073>16 lelong >0 not stripped 3074>32 byte 0x6a (uses shared libs) 3075 30760 lelong 0413 386 demand paged pure executable 3077>16 lelong >0 not stripped 3078>32 byte 0x6a (uses shared libs) 3079 3080# same as in SunOS 4.x, except for static shared libraries 30810 belong&077777777 0600413 sparc demand paged 3082>0 byte &0x80 3083>>20 belong <4096 shared library 3084>>20 belong =4096 dynamically linked executable 3085>>20 belong >4096 dynamically linked executable 3086>0 byte ^0x80 executable 3087>16 belong >0 not stripped 3088>36 belong 0xb4100001 (uses shared libs) 3089 30900 belong&077777777 0600410 sparc pure 3091>0 byte &0x80 dynamically linked executable 3092>0 byte ^0x80 executable 3093>16 belong >0 not stripped 3094>36 belong 0xb4100001 (uses shared libs) 3095 30960 belong&077777777 0600407 sparc 3097>0 byte &0x80 dynamically linked executable 3098>0 byte ^0x80 executable 3099>16 belong >0 not stripped 3100>36 belong 0xb4100001 (uses shared libs) 3101# Chiasmus is a encryption standard developed by the German Federal 3102# Office for Information Security (Bundesamt fuer Sicherheit in der 3103# Informationstechnik). 3104 3105# Extension: .xia 31060 string XIA1 Chiasmus encrypted data 3107 3108# Extension: .xis 31090 string XIS Chiasmus key 3110 3111#------------------------------------------------------------------------------ 3112# $File: btsnoop,v 1.5 2009/09/19 16:28:08 christos Exp $ 3113# BTSnoop: file(1) magic for BTSnoop files 3114# 3115# From <marcel@holtmann.org> 31160 string btsnoop\0 BTSnoop 3117>8 belong x version %d, 3118>12 belong 1001 Unencapsulated HCI 3119>12 belong 1002 HCI UART (H4) 3120>12 belong 1003 HCI BCSP 3121>12 belong 1004 HCI Serial (H5) 3122>>12 belong x type %d 3123 3124#------------------------------------------------------------------------------ 3125# $File: c64,v 1.5 2009/09/19 16:28:08 christos Exp $ 3126# c64: file(1) magic for various commodore 64 related files 3127# 3128# From: Dirk Jagdmann <doj@cubic.org> 3129 31300x16500 belong 0x12014100 D64 Image 31310x16500 belong 0x12014180 D71 Image 31320x61800 belong 0x28034400 D81 Image 31330 string C64\40CARTRIDGE CCS C64 Emultar Cartridge Image 31340 belong 0x43154164 X64 Image 3135 31360 string GCR-1541 GCR Image 3137>8 byte x version: %i 3138>9 byte x tracks: %i 3139 31409 string PSUR ARC archive (c64) 31412 string -LH1- LHA archive (c64) 3142 31430 string C64File PC64 Emulator file 3144>8 string >\0 "%s" 31450 string C64Image PC64 Freezer Image 3146 31470 beshort 0x38CD C64 PCLink Image 31480 string CBM\144\0\0 Power 64 C64 Emulator Snapshot 3149 31500 belong 0xFF424CFF WRAptor packer (c64) 3151 31520 string C64S\x20tape\x20file T64 tape Image 3153>32 leshort x Version:0x%x 3154>36 leshort !0 Entries:%i 3155>40 string x Name:%.24s 3156 31570 string C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image 3158>32 leshort x Version:0x%x 3159>36 leshort !0 Entries:%i 3160>40 string x Name:%.24s 3161 31620 string C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image 3163>32 leshort x Version:0x%x 3164>36 leshort !0 Entries:%i 3165>40 string x Name:%.24s 3166 3167#------------------------------------------------------------------------------ 3168# $File: cad,v 1.9 2009/09/19 16:28:08 christos Exp $ 3169# autocad: file(1) magic for cad files 3170# 3171 3172# AutoCAD DWG versions R13/R14 (www.autodesk.com) 3173# Written December 01, 2003 by Lester Hightower 3174# Based on the DWG File Format Specifications at http://www.opendwg.org/ 31750 string \101\103\061\060\061 AutoCAD 3176>5 string \062\000\000\000\000 DWG ver. R13 3177>5 string \064\000\000\000\000 DWG ver. R14 3178 3179# Microstation DGN/CIT Files (www.bentley.com) 3180# Last updated July 29, 2005 by Lester Hightower 3181# DGN is the default file extension of Microstation/Intergraph CAD files. 3182# CIT is the proprietary raster format (similar to TIFF) used to attach 3183# raster underlays to Microstation DGN (vector) drawings. 3184# 3185# http://www.wotsit.org/search.asp 3186# http://filext.com/detaillist.php?extdetail=DGN 3187# http://filext.com/detaillist.php?extdetail=CIT 3188# 3189# http://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2 3190# 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928 3191# http://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682 3192# 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F 31930 string \010\011\376 Microstation 3194>3 string \002 3195>>30 string \026\105 DGNFile 3196>>30 string \034\105 DGNFile 3197>>30 string \073\107 DGNFile 3198>>30 string \073\110 DGNFile 3199>>30 string \106\107 DGNFile 3200>>30 string \110\103 DGNFile 3201>>30 string \120\104 DGNFile 3202>>30 string \172\104 DGNFile 3203>>30 string \172\105 DGNFile 3204>>30 string \172\106 DGNFile 3205>>30 string \234\106 DGNFile 3206>>30 string \273\105 DGNFile 3207>>30 string \306\106 DGNFile 3208>>30 string \310\104 DGNFile 3209>>30 string \341\104 DGNFile 3210>>30 string \372\103 DGNFile 3211>>30 string \372\104 DGNFile 3212>>30 string \372\106 DGNFile 3213>>30 string \376\103 DGNFile 3214>4 string \030\000\000 CITFile 3215>4 string \030\000\003 CITFile 3216 3217# AutoCad, from Nahuel Greco 3218# AutoCAD DWG versions R12/R13/R14 (www.autodesk.com) 32190 string AC1012 AutoCad (release 12) 32200 string AC1013 AutoCad (release 13) 32210 string AC1014 AutoCad (release 14) 3222 3223# CAD: file(1) magic for computer aided design files 3224# Phillip Griffith <phillip dot griffith at gmail dot com> 3225# AutoCAD magic taken from the Open Design Alliance's OpenDWG specifications. 3226# 32270 belong 0x08051700 Bentley/Intergraph MicroStation DGN cell library 32280 belong 0x0809fe02 Bentley/Intergraph MicroStation DGN vector CAD 32290 belong 0xc809fe02 Bentley/Intergraph MicroStation DGN vector CAD 32300 beshort 0x0809 Bentley/Intergraph MicroStation 3231>0x02 byte 0xfe 3232>>0x04 beshort 0x1800 CIT raster CAD 32330 string AC1012 AutoDesk AutoCAD R13 32340 string AC1014 AutoDesk AutoCAD R14 32350 string AC1015 AutoDesk AutoCAD R2000 3236 3237#------------------------------------------------------------------------------ 3238# $File: cafebabe,v 1.8 2009/09/19 16:28:08 christos Exp $ 3239# Cafe Babes unite! 3240# 3241# Since Java bytecode and Mach-O fat-files have the same magic number, the test 3242# must be performed in the same "magic" sequence to get both right. The long 3243# at offset 4 in a mach-O fat file tells the number of architectures; the short at 3244# offset 4 in a Java bytecode file is the JVM minor version and the 3245# short at offset 6 is the JVM major version. Since there are only 3246# only 18 labeled Mach-O architectures at current, and the first released 3247# Java class format was version 43.0, we can safely choose any number 3248# between 18 and 39 to test the number of architectures against 3249# (and use as a hack). Let's not use 18, because the Mach-O people 3250# might add another one or two as time goes by... 3251# 32520 belong 0xcafebabe 3253!:mime application/x-java-applet 3254>4 belong >30 compiled Java class data, 3255>>6 beshort x version %d. 3256>>4 beshort x \b%d 3257# Which is which? 3258#>>4 belong 0x032d (Java 1.0) 3259#>>4 belong 0x032d (Java 1.1) 3260>>4 belong 0x002e (Java 1.2) 3261>>4 belong 0x002f (Java 1.3) 3262>>4 belong 0x0030 (Java 1.4) 3263>>4 belong 0x0031 (Java 1.5) 3264>>4 belong 0x0032 (Java 1.6) 3265 3266 32670 belong 0xcafebabe 3268>4 belong 1 Mach-O fat file with 1 architecture 3269>4 belong >1 3270>>4 belong <20 Mach-O fat file with %ld architectures 3271 32720 belong 0xcafed00d JAR compressed with pack200, 3273>>5 byte x version %d. 3274>>4 byte x \b%d 3275!:mime application/x-java-pack200 3276 3277#------------------------------------------------------------------------------ 3278# $File: cddb,v 1.4 2009/09/19 16:28:08 christos Exp $ 3279# CDDB: file(1) magic for CDDB(tm) format CD text data files 3280# 3281# From <steve@gracenote.com> 3282# 3283# This is the /etc/magic entry to decode datafiles as used by 3284# CDDB-enabled CD player applications. 3285# 3286 32870 search/1/w #\040xmcd CDDB(tm) format CD text data 3288 3289#------------------------------------------------------------------------------ 3290# $File: chord,v 1.4 2009/09/19 16:28:08 christos Exp $ 3291# chord: file(1) magic for Chord music sheet typesetting utility input files 3292# 3293# From Philippe De Muyter <phdm@macqel.be> 3294# File format is actually free, but many distributed files begin with `{title' 3295# 32960 string {title Chord text file 3297 3298# Type: PowerTab file format 3299# URL: http://www.power-tab.net/ 3300# From: Jelmer Vernooij <jelmer@samba.org> 33010 string ptab\003\000 Power-Tab v3 Tablature File 33020 string ptab\004\000 Power-Tab v4 Tablature File 3303 3304#------------------------------------------------------------------------------ 3305# $File: cisco,v 1.4 2009/09/19 16:28:08 christos Exp $ 3306# cisco: file(1) magic for cisco Systems routers 3307# 3308# Most cisco file-formats are covered by the generic elf code 3309# 3310# Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha. 33110 belong&0xffffff00 0x85011400 cisco IOS microcode 3312>7 string >\0 for '%s' 33130 belong&0xffffff00 0x8501cb00 cisco IOS experimental microcode 3314>7 string >\0 for '%s' 3315 3316#------------------------------------------------------------------------------ 3317# $File: citrus,v 1.4 2009/09/19 16:28:08 christos Exp $ 3318# citrus locale declaration 3319# 3320 33210 string RuneCT Citrus locale declaration for LC_CTYPE 3322 3323 3324#------------------------------------------------------------------------------ 3325# $File: c-lang,v 1.14 2009/09/19 16:28:08 christos Exp $ 3326# c-lang: file(1) magic for C programs (or REXX) 3327# 3328 3329# XPM icons (Greg Roelofs, newt@uchicago.edu) 3330# if you uncomment "/*" for C/REXX below, also uncomment this entry 3331#0 string /*\ XPM\ */ X pixmap image data 3332#!:mime image/x-xpmi 3333 3334# 3DS (3d Studio files) Conflicts with diff output 0x3d '=' 3335#16 beshort 0x3d3d image/x-3ds 3336 3337# this first will upset you if you're a PL/1 shop... 3338# in which case rm it; ascmagic will catch real C programs 3339#0 search/1 /* C or REXX program text 3340#0 search/1 // C++ program text 3341 3342# From: Mikhail Teterin <mi@aldan.algebra.com> 33430 string cscope cscope reference data 3344>7 string x version %.2s 3345# We skip the path here, because it is often long (so file will 3346# truncate it) and mostly redundant. 3347# The inverted index functionality was added some time betwen 3348# versions 11 and 15, so look for -q if version is above 14: 3349>7 string >14 3350>>10 search/100 \ -q\ with inverted index 3351>10 search/100 \ -c\ text (non-compressed) 3352 3353#------------------------------------------------------------------------------ 3354# $File: clarion,v 1.4 2009/09/19 16:28:08 christos Exp $ 3355# clarion: file(1) magic for # Clarion Personal/Professional Developer 3356# (v2 and above) 3357# From: Julien Blache <jb@jblache.org> 3358 3359# Database files 3360# signature 33610 leshort 0x3343 Clarion Developer (v2 and above) data file 3362# attributes 3363>2 leshort &0x0001 \b, locked 3364>2 leshort &0x0004 \b, encrypted 3365>2 leshort &0x0008 \b, memo file exists 3366>2 leshort &0x0010 \b, compressed 3367>2 leshort &0x0040 \b, read only 3368# number of records 3369>5 lelong x \b, %ld records 3370 3371# Memo files 33720 leshort 0x334d Clarion Developer (v2 and above) memo data 3373 3374# Key/Index files 3375# No magic? :( 3376 3377# Help files 33780 leshort 0x49e0 Clarion Developer (v2 and above) help data 3379 3380#------------------------------------------------------------------------------ 3381# $File: claris,v 1.5 2009/09/19 16:28:08 christos Exp $ 3382# claris: file(1) magic for claris 3383# "H. Nanosecond" <aldomel@ix.netcom.com> 3384# Claris Works a word processor, etc. 3385# Version 3.0 3386 3387# .pct claris works clip art files 3388#0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 3389#* 3390#0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000 3391#null to byte 1000 octal 3392514 string \377\377\377\377\000 Claris clip art? 3393>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 yes. 3394514 string \377\377\377\377\001 Claris clip art? 3395>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 yes. 3396 3397# Claris works files 3398# .cwk 33990 string \002\000\210\003\102\117\102\117\000\001\206 Claris works document 3400# .plt 34010 string \020\341\000\000\010\010 Claris Works pallete files .plt 3402 3403# .msp a dictionary file I am not sure about this I have only one .msp file 34040 string \002\271\262\000\040\002\000\164 Claris works dictionary 3405 3406# .usp are user dictionary bits 3407# I am not sure about a magic header: 3408#0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151 3409# soh S p f 8 U D sp ^ S cr nl p o d i 3410#0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043 3411# a t r i s t sp ^ S cr nl d i v sp # 3412 3413# .mth Thesaurus 3414# starts with \0 but no magic header 3415 3416# .chy Hyphenation file 3417# I am not sure: 000 210 034 000 000 3418 3419# other claris files 3420#./windows/claris/useng.ndx: data 3421#./windows/claris/xtndtran.l32: data 3422#./windows/claris/xtndtran.lst: data 3423#./windows/claris/clworks.lbl: data 3424#./windows/claris/clworks.prf: data 3425#./windows/claris/userd.spl: data 3426 3427#------------------------------------------------------------------------------ 3428# $File: clipper,v 1.6 2009/09/19 16:28:08 christos Exp $ 3429# clipper: file(1) magic for Intergraph (formerly Fairchild) Clipper. 3430# 3431# XXX - what byte order does the Clipper use? 3432# 3433# XXX - what's the "!" stuff: 3434# 3435# >18 short !074000,000000 C1 R1 3436# >18 short !074000,004000 C2 R1 3437# >18 short !074000,010000 C3 R1 3438# >18 short !074000,074000 TEST 3439# 3440# I shall assume it's ANDing the field with the first value and 3441# comparing it with the second, and rewrite it as: 3442# 3443# >18 short&074000 000000 C1 R1 3444# >18 short&074000 004000 C2 R1 3445# >18 short&074000 010000 C3 R1 3446# >18 short&074000 074000 TEST 3447# 3448# as SVR3.1's "file" doesn't support anything of the "!074000,000000" 3449# sort, nor does SunOS 4.x, so either it's something Intergraph added 3450# in CLIX, or something AT&T added in SVR3.2 or later, or something 3451# somebody else thought was a good idea; it's not documented in the 3452# man page for this version of "magic", nor does it appear to be 3453# implemented (at least not after I blew off the bogus code to turn 3454# old-style "&"s into new-style "&"s, which just didn't work at all). 3455# 34560 short 0575 CLIPPER COFF executable (VAX #) 3457>20 short 0407 (impure) 3458>20 short 0410 (5.2 compatible) 3459>20 short 0411 (pure) 3460>20 short 0413 (demand paged) 3461>20 short 0443 (target shared library) 3462>12 long >0 not stripped 3463>22 short >0 - version %ld 34640 short 0577 CLIPPER COFF executable 3465>18 short&074000 000000 C1 R1 3466>18 short&074000 004000 C2 R1 3467>18 short&074000 010000 C3 R1 3468>18 short&074000 074000 TEST 3469>20 short 0407 (impure) 3470>20 short 0410 (pure) 3471>20 short 0411 (separate I&D) 3472>20 short 0413 (paged) 3473>20 short 0443 (target shared library) 3474>12 long >0 not stripped 3475>22 short >0 - version %ld 3476>48 long&01 01 alignment trap enabled 3477>52 byte 1 -Ctnc 3478>52 byte 2 -Ctsw 3479>52 byte 3 -Ctpw 3480>52 byte 4 -Ctcb 3481>53 byte 1 -Cdnc 3482>53 byte 2 -Cdsw 3483>53 byte 3 -Cdpw 3484>53 byte 4 -Cdcb 3485>54 byte 1 -Csnc 3486>54 byte 2 -Cssw 3487>54 byte 3 -Cspw 3488>54 byte 4 -Cscb 34894 string pipe CLIPPER instruction trace 34904 string prof CLIPPER instruction profile 3491 3492#------------------------------------------------------------------------------ 3493# $File: commands,v 1.36 2010/01/24 18:41:11 christos Exp $ 3494# commands: file(1) magic for various shells and interpreters 3495# 3496#0 string : shell archive or script for antique kernel text 34970 string/w #!\ /bin/sh POSIX shell script text executable 3498!:mime text/x-shellscript 34990 string/w #!\ /bin/csh C shell script text executable 3500!:mime text/x-shellscript 3501# korn shell magic, sent by George Wu, gwu@clyde.att.com 35020 string/w #!\ /bin/ksh Korn shell script text executable 3503!:mime text/x-shellscript 35040 string/w #!\ /bin/tcsh Tenex C shell script text executable 3505!:mime text/x-shellscript 35060 string/w #!\ /usr/bin/tcsh Tenex C shell script text executable 3507!:mime text/x-shellscript 35080 string/w #!\ /usr/local/tcsh Tenex C shell script text executable 3509!:mime text/x-shellscript 35100 string/w #!\ /usr/local/bin/tcsh Tenex C shell script text executable 3511!:mime text/x-shellscript 3512 3513# 3514# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson) 35150 string/w #!\ /bin/zsh Paul Falstad's zsh script text executable 3516!:mime text/x-shellscript 35170 string/w #!\ /usr/bin/zsh Paul Falstad's zsh script text executable 3518!:mime text/x-shellscript 35190 string/w #!\ /usr/local/bin/zsh Paul Falstad's zsh script text executable 3520!:mime text/x-shellscript 35210 string/w #!\ /usr/local/bin/ash Neil Brown's ash script text executable 3522!:mime text/x-shellscript 35230 string/w #!\ /usr/local/bin/ae Neil Brown's ae script text executable 3524!:mime text/x-shellscript 35250 string/w #!\ /bin/nawk new awk script text executable 3526!:mime text/x-nawk 35270 string/w #!\ /usr/bin/nawk new awk script text executable 3528!:mime text/x-nawk 35290 string/w #!\ /usr/local/bin/nawk new awk script text executable 3530!:mime text/x-nawk 35310 string/w #!\ /bin/gawk GNU awk script text executable 3532!:mime text/x-gawk 35330 string/w #!\ /usr/bin/gawk GNU awk script text executable 3534!:mime text/x-gawk 35350 string/w #!\ /usr/local/bin/gawk GNU awk script text executable 3536!:mime text/x-gawk 3537# 35380 string/w #!\ /bin/awk awk script text executable 3539!:mime text/x-awk 35400 string/w #!\ /usr/bin/awk awk script text executable 3541!:mime text/x-awk 3542# update to distinguish from *.vcf files 3543# this is broken because postscript has /EBEGIN{ for example. 3544#0 search/Ww BEGIN { awk script text 35450 regex =^\\s*BEGIN\\s*[{] awk script text 3546 3547# AT&T Bell Labs' Plan 9 shell 35480 string/w #!\ /bin/rc Plan 9 rc shell script text executable 3549 3550# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de) 35510 string/w #!\ /bin/bash Bourne-Again shell script text executable 3552!:mime text/x-shellscript 35530 string/w #!\ /usr/bin/bash Bourne-Again shell script text executable 3554!:mime text/x-shellscript 35550 string/w #!\ /usr/local/bash Bourne-Again shell script text executable 3556!:mime text/x-shellscript 35570 string/w #!\ /usr/local/bin/bash Bourne-Again shell script text executable 3558!:mime text/x-shellscript 3559 3560# using env 35610 string #!/usr/bin/env a 3562>15 string >\0 %s script text executable 35630 string #!\ /usr/bin/env a 3564>16 string >\0 %s script text executable 3565 3566# PHP scripts 3567# Ulf Harnhammar <ulfh@update.uu.se> 35680 search/1/c =<?php PHP script text 3569!:mime text/x-php 35700 search/1 =<?\n PHP script text 3571!:mime text/x-php 35720 search/1 =<?\r PHP script text 3573!:mime text/x-php 35740 search/1/w #!\ /usr/local/bin/php PHP script text executable 3575!:mime text/x-php 35760 search/1/w #!\ /usr/bin/php PHP script text executable 3577!:mime text/x-php 3578 35790 string Zend\x00 PHP script Zend Optimizer data 3580 35810 string $! DCL command file 3582 3583# Type: Pdmenu 3584# URL: http://packages.debian.org/pdmenu 3585# From: Edward Betts <edward@debian.org> 35860 string #!/usr/bin/pdmenu Pdmenu configuration file text 3587 3588#---------------------------------------------------------------------------- 3589# $File: communications,v 1.5 2009/09/19 16:28:08 christos Exp $ 3590# communication 3591 3592# TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3. 3593# It is used for conformance testing of communication protocols. 3594# Added by W. Borgert <debacle@debian.org>. 35950 string $Suite TTCN Abstract Test Suite 3596>&1 string $SuiteId 3597>>&1 string >\n %s 3598>&2 string $SuiteId 3599>>&1 string >\n %s 3600>&3 string $SuiteId 3601>>&1 string >\n %s 3602 3603# MSC (message sequence charts) are a formal description technique, 3604# described in ITU-T Z.120, mainly used for communication protocols. 3605# Added by W. Borgert <debacle@debian.org>. 36060 string mscdocument Message Sequence Chart (document) 36070 string msc Message Sequence Chart (chart) 36080 string submsc Message Sequence Chart (subchart) 3609 3610#------------------------------------------------------------------------------ 3611# $File: compress,v 1.42 2009/09/19 16:28:08 christos Exp $ 3612# compress: file(1) magic for pure-compression formats (no archives) 3613# 3614# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc. 3615# 3616# Formats for various forms of compressed data 3617# Formats for "compress" proper have been moved into "compress.c", 3618# because it tries to uncompress it to figure out what's inside. 3619 3620# standard unix compress 36210 string \037\235 compress'd data 3622!:mime application/x-compress 3623!:apple LZIVZIVU 3624>2 byte&0x80 >0 block compressed 3625>2 byte&0x1f x %d bits 3626 3627# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver) 3628# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002 3629# * Original filename is only at offset 10 if "extra field" absent 3630# * Produce shorter output - notably, only report compression methods 3631# other than 8 ("deflate", the only method defined in RFC 1952). 36320 string \037\213 gzip compressed data 3633!:mime application/x-gzip 3634>2 byte <8 \b, reserved method 3635>2 byte >8 \b, unknown method 3636>3 byte &0x01 \b, ASCII 3637>3 byte &0x02 \b, has CRC 3638>3 byte &0x04 \b, extra field 3639>3 byte&0xC =0x08 3640>>10 string x \b, was "%s" 3641>3 byte &0x10 \b, has comment 3642>9 byte =0x00 \b, from FAT filesystem (MS-DOS, OS/2, NT) 3643>9 byte =0x01 \b, from Amiga 3644>9 byte =0x02 \b, from VMS 3645>9 byte =0x03 \b, from Unix 3646>9 byte =0x04 \b, from VM/CMS 3647>9 byte =0x05 \b, from Atari 3648>9 byte =0x06 \b, from HPFS filesystem (OS/2, NT) 3649>9 byte =0x07 \b, from MacOS 3650>9 byte =0x08 \b, from Z-System 3651>9 byte =0x09 \b, from CP/M 3652>9 byte =0x0A \b, from TOPS/20 3653>9 byte =0x0B \b, from NTFS filesystem (NT) 3654>9 byte =0x0C \b, from QDOS 3655>9 byte =0x0D \b, from Acorn RISCOS 3656>3 byte &0x10 \b, comment 3657>3 byte &0x20 \b, encrypted 3658>4 ledate >0 \b, last modified: %s 3659>8 byte 2 \b, max compression 3660>8 byte 4 \b, max speed 3661 3662# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis 36630 string \037\036 packed data 3664!:mime application/octet-stream 3665>2 belong >1 \b, %d characters originally 3666>2 belong =1 \b, %d character originally 3667# 3668# This magic number is byte-order-independent. 36690 short 0x1f1f old packed data 3670!:mime application/octet-stream 3671 3672# XXX - why *two* entries for "compacted data", one of which is 3673# byte-order independent, and one of which is byte-order dependent? 3674# 36750 short 0x1fff compacted data 3676!:mime application/octet-stream 3677# This string is valid for SunOS (BE) and a matching "short" is listed 3678# in the Ultrix (LE) magic file. 36790 string \377\037 compacted data 3680!:mime application/octet-stream 36810 short 0145405 huf output 3682!:mime application/octet-stream 3683 3684# bzip2 36850 string BZh bzip2 compressed data 3686!:mime application/x-bzip2 3687>3 byte >47 \b, block size = %c00k 3688 3689# lzip 36900 string LZIP lzip compressed data 3691!:mime application/x-lzip 3692>4 byte x \b, version: %d 3693 3694# squeeze and crunch 3695# Michael Haardt <michael@cantor.informatik.rwth-aachen.de> 36960 beshort 0x76FF squeezed data, 3697>4 string x original name %s 36980 beshort 0x76FE crunched data, 3699>2 string x original name %s 37000 beshort 0x76FD LZH compressed data, 3701>2 string x original name %s 3702 3703# Freeze 37040 string \037\237 frozen file 2.1 37050 string \037\236 frozen file 1.0 (or gzip 0.5) 3706 3707# SCO compress -H (LZH) 37080 string \037\240 SCO compress -H (LZH) data 3709 3710# European GSM 06.10 is a provisional standard for full-rate speech 3711# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse 3712# excitation/long term prediction) coding at 13 kbit/s. 3713# 3714# There's only a magic nibble (4 bits); that nibble repeats every 33 3715# bytes. This isn't suited for use, but maybe we can use it someday. 3716# 3717# This will cause very short GSM files to be declared as data and 3718# mismatches to be declared as data too! 3719#0 byte&0xF0 0xd0 data 3720#>33 byte&0xF0 0xd0 3721#>66 byte&0xF0 0xd0 3722#>99 byte&0xF0 0xd0 3723#>132 byte&0xF0 0xd0 GSM 06.10 compressed audio 3724 3725# bzip a block-sorting file compressor 3726# by Julian Seward <sewardj@cs.man.ac.uk> and others 3727# 3728#0 string BZ bzip compressed data 3729#>2 byte x \b, version: %c 3730#>3 string =1 \b, compression block size 100k 3731#>3 string =2 \b, compression block size 200k 3732#>3 string =3 \b, compression block size 300k 3733#>3 string =4 \b, compression block size 400k 3734#>3 string =5 \b, compression block size 500k 3735#>3 string =6 \b, compression block size 600k 3736#>3 string =7 \b, compression block size 700k 3737#>3 string =8 \b, compression block size 800k 3738#>3 string =9 \b, compression block size 900k 3739 3740# lzop from <markus.oberhumer@jk.uni-linz.ac.at> 37410 string \x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a lzop compressed data 3742>9 beshort <0x0940 3743>>9 byte&0xf0 =0x00 - version 0. 3744>>9 beshort&0x0fff x \b%03x, 3745>>13 byte 1 LZO1X-1, 3746>>13 byte 2 LZO1X-1(15), 3747>>13 byte 3 LZO1X-999, 3748## >>22 bedate >0 last modified: %s, 3749>>14 byte =0x00 os: MS-DOS 3750>>14 byte =0x01 os: Amiga 3751>>14 byte =0x02 os: VMS 3752>>14 byte =0x03 os: Unix 3753>>14 byte =0x05 os: Atari 3754>>14 byte =0x06 os: OS/2 3755>>14 byte =0x07 os: MacOS 3756>>14 byte =0x0A os: Tops/20 3757>>14 byte =0x0B os: WinNT 3758>>14 byte =0x0E os: Win32 3759>9 beshort >0x0939 3760>>9 byte&0xf0 =0x00 - version 0. 3761>>9 byte&0xf0 =0x10 - version 1. 3762>>9 byte&0xf0 =0x20 - version 2. 3763>>9 beshort&0x0fff x \b%03x, 3764>>15 byte 1 LZO1X-1, 3765>>15 byte 2 LZO1X-1(15), 3766>>15 byte 3 LZO1X-999, 3767## >>25 bedate >0 last modified: %s, 3768>>17 byte =0x00 os: MS-DOS 3769>>17 byte =0x01 os: Amiga 3770>>17 byte =0x02 os: VMS 3771>>17 byte =0x03 os: Unix 3772>>17 byte =0x05 os: Atari 3773>>17 byte =0x06 os: OS/2 3774>>17 byte =0x07 os: MacOS 3775>>17 byte =0x0A os: Tops/20 3776>>17 byte =0x0B os: WinNT 3777>>17 byte =0x0E os: Win32 3778 3779# 4.3BSD-Quasijarus Strong Compression 3780# http://minnie.tuhs.org/Quasijarus/compress.html 37810 string \037\241 Quasijarus strong compressed data 3782 3783# From: Cory Dikkers <cdikkers@swbell.net> 37840 string XPKF Amiga xpkf.library compressed data 37850 string PP11 Power Packer 1.1 compressed data 37860 string PP20 Power Packer 2.0 compressed data, 3787>4 belong 0x09090909 fast compression 3788>4 belong 0x090A0A0A mediocre compression 3789>4 belong 0x090A0B0B good compression 3790>4 belong 0x090A0C0C very good compression 3791>4 belong 0x090A0C0D best compression 3792 3793# 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at) 3794# http://www.7-zip.org or DOC/7zFormat.txt 3795# 37960 string 7z\274\257\047\034 7-zip archive data, 3797>6 byte x version %d 3798>7 byte x \b.%d 3799!:mime application/x-7z-compressed 3800 3801# Type: LZMA 38020 lelong 0x8000005d LZMA compressed data, 3803>5 lequad =0xffffffffffffffff streamed 3804>5 lequad !0xffffffffffffffff non-streamed, size %lld 3805 3806# http://tukaani.org/xz/xz-file-format.txt 38070 ustring \xFD7zXZ\x00 XZ compressed data 3808!:mime application/x-xz 3809 3810# AFX compressed files (Wolfram Kleff) 38112 string -afx- AFX compressed file data 3812 3813# Supplementary magic data for the file(1) command to support 3814# rzip(1). The format is described in magic(5). 3815# 3816# Copyright (C) 2003 by Andrew Tridgell. You may do whatever you want with 3817# this file. 3818# 38190 string RZIP rzip compressed data 3820>4 byte x - version %d 3821>5 byte x \b.%d 3822>6 belong x (%d bytes) 3823 3824# Type: XZ 3825# URL: http://tukaani.org/xz/ 38260 string \xfd\x37\x7a\x58\x5a\x00 XZ compressed data 3827!:mime application/x-xz 3828 3829# Type: DACT compressed files 38300 long 0x444354C3 DACT compressed data 3831>4 byte >-1 (version %i. 3832>5 byte >-1 %i. 3833>6 byte >-1 %i) 3834>7 long >0 , original size: %i bytes 3835>15 long >30 , block size: %i bytes 3836 3837#------------------------------------------------------------------------------ 3838# $File: console,v 1.16 2009/09/19 16:28:08 christos Exp $ 3839# Console game magic 3840# Toby Deshane <hac@shoelace.digivill.net> 3841# ines: file(1) magic for Marat's iNES Nintendo Entertainment System 3842# ROM dump format 3843 38440 string NES\032 iNES ROM dump, 3845>4 byte x %dx16k PRG 3846>5 byte x \b, %dx8k CHR 3847>6 byte&0x01 =0x1 \b, [Vert.] 3848>6 byte&0x01 =0x0 \b, [Horiz.] 3849>6 byte&0x02 =0x2 \b, [SRAM] 3850>6 byte&0x04 =0x4 \b, [Trainer] 3851>6 byte&0x04 =0x8 \b, [4-Scr] 3852 3853#------------------------------------------------------------------------------ 3854# gameboy: file(1) magic for the Nintendo (Color) Gameboy raw ROM format 3855# 38560x104 belong 0xCEED6666 Gameboy ROM: 3857>0x134 string >\0 "%.16s" 3858>0x146 byte 0x03 \b,[SGB] 3859>0x147 byte 0x00 \b, [ROM ONLY] 3860>0x147 byte 0x01 \b, [ROM+MBC1] 3861>0x147 byte 0x02 \b, [ROM+MBC1+RAM] 3862>0x147 byte 0x03 \b, [ROM+MBC1+RAM+BATT] 3863>0x147 byte 0x05 \b, [ROM+MBC2] 3864>0x147 byte 0x06 \b, [ROM+MBC2+BATTERY] 3865>0x147 byte 0x08 \b, [ROM+RAM] 3866>0x147 byte 0x09 \b, [ROM+RAM+BATTERY] 3867>0x147 byte 0x0B \b, [ROM+MMM01] 3868>0x147 byte 0x0C \b, [ROM+MMM01+SRAM] 3869>0x147 byte 0x0D \b, [ROM+MMM01+SRAM+BATT] 3870>0x147 byte 0x0F \b, [ROM+MBC3+TIMER+BATT] 3871>0x147 byte 0x10 \b, [ROM+MBC3+TIMER+RAM+BATT] 3872>0x147 byte 0x11 \b, [ROM+MBC3] 3873>0x147 byte 0x12 \b, [ROM+MBC3+RAM] 3874>0x147 byte 0x13 \b, [ROM+MBC3+RAM+BATT] 3875>0x147 byte 0x19 \b, [ROM+MBC5] 3876>0x147 byte 0x1A \b, [ROM+MBC5+RAM] 3877>0x147 byte 0x1B \b, [ROM+MBC5+RAM+BATT] 3878>0x147 byte 0x1C \b, [ROM+MBC5+RUMBLE] 3879>0x147 byte 0x1D \b, [ROM+MBC5+RUMBLE+SRAM] 3880>0x147 byte 0x1E \b, [ROM+MBC5+RUMBLE+SRAM+BATT] 3881>0x147 byte 0x1F \b, [Pocket Camera] 3882>0x147 byte 0xFD \b, [Bandai TAMA5] 3883>0x147 byte 0xFE \b, [Hudson HuC-3] 3884>0x147 byte 0xFF \b, [Hudson HuC-1] 3885 3886>0x148 byte 0 \b, ROM: 256Kbit 3887>0x148 byte 1 \b, ROM: 512Kbit 3888>0x148 byte 2 \b, ROM: 1Mbit 3889>0x148 byte 3 \b, ROM: 2Mbit 3890>0x148 byte 4 \b, ROM: 4Mbit 3891>0x148 byte 5 \b, ROM: 8Mbit 3892>0x148 byte 6 \b, ROM: 16Mbit 3893>0x148 byte 0x52 \b, ROM: 9Mbit 3894>0x148 byte 0x53 \b, ROM: 10Mbit 3895>0x148 byte 0x54 \b, ROM: 12Mbit 3896 3897>0x149 byte 1 \b, RAM: 16Kbit 3898>0x149 byte 2 \b, RAM: 64Kbit 3899>0x149 byte 3 \b, RAM: 128Kbit 3900>0x149 byte 4 \b, RAM: 1Mbit 3901 3902#>0x14e long x \b, CRC: %x 3903 3904#------------------------------------------------------------------------------ 3905# genesis: file(1) magic for the Sega MegaDrive/Genesis raw ROM format 3906# 39070x100 string SEGA Sega MegaDrive/Genesis raw ROM dump 3908>0x120 string >\0 Name: "%.16s" 3909>0x110 string >\0 %.16s 3910>0x1B0 string RA with SRAM 3911 3912#------------------------------------------------------------------------------ 3913# genesis: file(1) magic for the Super MegaDrive ROM dump format 3914# 39150x280 string EAGN Super MagicDrive ROM dump 3916>0 byte x %dx16k blocks 3917>2 byte 0 \b, last in series or standalone 3918>2 byte >0 \b, split ROM 3919>8 byte 0xAA 3920>9 byte 0xBB 3921 3922#------------------------------------------------------------------------------ 3923# genesis: file(1) alternate magic for the Super MegaDrive ROM dump format 3924# 39250x280 string EAMG Super MagicDrive ROM dump 3926>0 byte x %dx16k blocks 3927>2 byte x \b, last in series or standalone 3928>8 byte 0xAA 3929>9 byte 0xBB 3930 3931#------------------------------------------------------------------------------ 3932# smsgg: file(1) magic for Sega Master System and Game Gear ROM dumps 3933# 3934# Does not detect all images. Very preliminary guesswork. Need more data 3935# on format. 3936# 3937# FIXME: need a little more info...;P 3938# 3939#0 byte 0xF3 3940#>1 byte 0xED Sega Master System/Game Gear ROM dump 3941#>1 byte 0x31 Sega Master System/Game Gear ROM dump 3942#>1 byte 0xDB Sega Master System/Game Gear ROM dump 3943#>1 byte 0xAF Sega Master System/Game Gear ROM dump 3944#>1 byte 0xC3 Sega Master System/Game Gear ROM dump 3945 3946#------------------------------------------------------------------------------ 3947# dreamcast: file(1) uncertain magic for the Sega Dreamcast VMU image format 3948# 39490 belong 0x21068028 Sega Dreamcast VMU game image 39500 string LCDi Dream Animator file 3951 3952#------------------------------------------------------------------------------ 3953# v64: file(1) uncertain magic for the V64 format N64 ROM dumps 3954# 39550 belong 0x37804012 V64 Nintendo 64 ROM dump 3956 3957# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 3958# Nintendo .nds 3959192 string \044\377\256Qi\232 Nintendo DS Game ROM Image 3960# Nintendo .gba 39610 string \056\000\000\352$\377\256Qi Nintendo Game Boy Advance ROM Image 3962 3963#------------------------------------------------------------------------------ 3964# msx: file(1) magic for MSX game cartridge dumps 3965# Too simple - MPi 3966#0 beshort 0x4142 MSX game cartridge dump 3967 3968#------------------------------------------------------------------------------ 3969# Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) : 39700 string PS-X\ EXE Sony Playstation executable 3971# Area: 3972>113 string x (%s) 3973 3974#------------------------------------------------------------------------------ 3975# Microsoft Xbox executables .xbe (Esa Hyytiä <ehyytia@cc.hut.fi>) 39760 string XBEH XBE, Microsoft Xbox executable 3977# probabilistic checks whether signed or not 3978>0x0004 ulelong =0x0 3979>>&2 ulelong =0x0 3980>>>&2 ulelong =0x0 \b, not signed 3981>0x0004 ulelong >0 3982>>&2 ulelong >0 3983>>>&2 ulelong >0 \b, signed 3984# expect base address of 0x10000 3985>0x0104 ulelong =0x10000 3986>>(0x0118-0x0FF60) ulelong&0x80000007 0x80000007 \b, all regions 3987>>(0x0118-0x0FF60) ulelong&0x80000007 !0x80000007 3988>>>(0x0118-0x0FF60) ulelong >0 (regions: 3989>>>>(0x0118-0x0FF60) ulelong &0x00000001 NA 3990>>>>(0x0118-0x0FF60) ulelong &0x00000002 Japan 3991>>>>(0x0118-0x0FF60) ulelong &0x00000004 Rest_of_World 3992>>>>(0x0118-0x0FF60) ulelong &0x80000000 Manufacturer 3993>>>(0x0118-0x0FF60) ulelong >0 \b) 3994 3995# -------------------------------- 3996# Microsoft Xbox data file formats 39970 string XIP0 XIP, Microsoft Xbox data 39980 string XTF0 XTF, Microsoft Xbox data 3999 4000# Atari Lynx cartridge dump (EXE/BLL header) 4001# From: "Stefan A. Haubenthal" <polluks@web.de> 4002 40030 beshort 0x8008 Lynx cartridge, 4004>2 beshort x RAM start $%04x 4005>6 string BS93 4006 4007# Opera file system that is used on the 3DO console 4008# From: Serge van den Boom <svdb@stack.nl> 40090 string \x01ZZZZZ\x01 3DO "Opera" file system 4010 4011# From Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu 40120 string GBS Nintendo Gameboy Music/Audio Data 401312 string GameBoy\ Music\ Module Nintendo Gameboy Music Module 4014 4015# Playstations Patch Files from: From: Thomas Klausner <tk@giga.or.at> 40160 string PPF30 Playstation Patch File version 3.0 4017>5 byte 0 \b, PPF 1.0 patch 4018>5 byte 1 \b, PPF 2.0 patch 4019>5 byte 2 \b, PPF 3.0 patch 4020>>56 byte 0 \b, Imagetype BIN (any) 4021>>56 byte 1 \b, Imagetype GI (PrimoDVD) 4022>>57 byte 0 \b, Blockcheck disabled 4023>>57 byte 1 \b, Blockcheck enabled 4024>>58 byte 0 \b, Undo data not available 4025>>58 byte 1 \b, Undo data available 4026>6 string x \b, description: %s 4027 40280 string PPF20 Playstation Patch File version 2.0 4029>5 byte 0 \b, PPF 1.0 patch 4030>5 byte 1 \b, PPF 2.0 patch 4031>>56 lelong >0 \b, size of file to patch %d 4032>6 string x \b, description: %s 4033 40340 string PPF10 Playstation Patch File version 1.0 4035>5 byte 0 \b, Simple Encoding 4036>6 string x \b, description: %s 4037 4038# From: Daniel Dawson <ddawson@icehouse.net> 4039# SNES9x .smv "movie" file format. 40400 string SMV\x1A SNES9x input recording 4041>0x4 lelong x \b, version %d 4042# version 4 is latest so far 4043>0x4 lelong <5 4044>>0x8 ledate x \b, recorded at %s 4045>>0xc lelong >0 \b, rerecorded %d times 4046>>0x10 lelong x \b, %d frames long 4047>>0x14 byte >0 \b, data for controller(s): 4048>>>0x14 byte &0x1 #1 4049>>>0x14 byte &0x2 #2 4050>>>0x14 byte &0x4 #3 4051>>>0x14 byte &0x8 #4 4052>>>0x14 byte &0x10 #5 4053>>0x15 byte ^0x1 \b, begins from snapshot 4054>>0x15 byte &0x1 \b, begins from reset 4055>>0x15 byte ^0x2 \b, NTSC standard 4056>>0x15 byte &0x2 \b, PAL standard 4057>>0x17 byte &0x1 \b, settings: 4058# WIP1Timing not used as of version 4 4059>>>0x4 lelong <4 4060>>>>0x17 byte &0x2 WIP1Timing 4061>>>0x17 byte &0x4 Left+Right 4062>>>0x17 byte &0x8 VolumeEnvX 4063>>>0x17 byte &0x10 FakeMute 4064>>>0x17 byte &0x20 SyncSound 4065# New flag as of version 4 4066>>>0x4 lelong >3 4067>>>>0x17 byte &0x80 NoCPUShutdown 4068>>0x4 lelong <4 4069>>>0x18 lelong >0x23 4070>>>>0x20 leshort !0 4071>>>>>0x20 lestring16 x \b, metadata: "%s" 4072>>0x4 lelong >3 4073>>>0x24 byte >0 \b, port 1: 4074>>>>0x24 byte 1 joypad 4075>>>>0x24 byte 2 mouse 4076>>>>0x24 byte 3 SuperScope 4077>>>>0x24 byte 4 Justifier 4078>>>>0x24 byte 5 multitap 4079>>>0x24 byte >0 \b, port 2: 4080>>>>0x25 byte 1 joypad 4081>>>>0x25 byte 2 mouse 4082>>>>0x25 byte 3 SuperScope 4083>>>>0x25 byte 4 Justifier 4084>>>>0x25 byte 5 multitap 4085>>>0x18 lelong >0x43 4086>>>>0x40 leshort !0 4087>>>>>0x40 lestring16 x \b, metadata: "%s" 4088>>0x17 byte &0x40 \b, ROM: 4089>>>(0x18.l-26) lelong x CRC32 0x%08x 4090>>>(0x18.l-23) string x "%s" 4091 4092# Type: scummVM savegame files 4093# From: Sven Hartge <debian@ds9.argh.org> 40940 string SCVM ScummVM savegame 4095>12 string >\0 "%s" 4096 4097#------------------------------------------------------------------------------ 4098# $File: convex,v 1.7 2009/09/19 16:28:08 christos Exp $ 4099# convex: file(1) magic for Convex boxes 4100# 4101# Convexes are big-endian. 4102# 4103# /*\ 4104# * Below are the magic numbers and tests added for Convex. 4105# * Added at beginning, because they are expected to be used most. 4106# \*/ 41070 belong 0507 Convex old-style object 4108>16 belong >0 not stripped 41090 belong 0513 Convex old-style demand paged executable 4110>16 belong >0 not stripped 41110 belong 0515 Convex old-style pre-paged executable 4112>16 belong >0 not stripped 41130 belong 0517 Convex old-style pre-paged, non-swapped executable 4114>16 belong >0 not stripped 41150 belong 0x011257 Core file 4116# 4117# The following are a series of dump format magic numbers. Each one 4118# corresponds to a drastically different dump format. The first on is 4119# the original dump format on a 4.1 BSD or earlier file system. The 4120# second marks the change between the 4.1 file system and the 4.2 file 4121# system. The Third marks the changing of the block size from 1K 4122# to 2K to be compatible with an IDC file system. The fourth indicates 4123# a dump that is dependent on Convex Storage Manager, because data in 4124# secondary storage is not physically contained within the dump. 4125# The restore program uses these number to determine how the data is 4126# to be extracted. 4127# 412824 belong =60011 dump format, 4.1 BSD or earlier 412924 belong =60012 dump format, 4.2 or 4.3 BSD without IDC 413024 belong =60013 dump format, 4.2 or 4.3 BSD (IDC compatible) 413124 belong =60014 dump format, Convex Storage Manager by-reference dump 4132# 4133# what follows is a bunch of bit-mask checks on the flags field of the opthdr. 4134# If there is no `=' sign, assume just checking for whether the bit is set? 4135# 41360 belong 0601 Convex SOFF 4137>88 belong&0x000f0000 =0x00000000 c1 4138>88 belong &0x00010000 c2 4139>88 belong &0x00020000 c2mp 4140>88 belong &0x00040000 parallel 4141>88 belong &0x00080000 intrinsic 4142>88 belong &0x00000001 demand paged 4143>88 belong &0x00000002 pre-paged 4144>88 belong &0x00000004 non-swapped 4145>88 belong &0x00000008 POSIX 4146# 4147>84 belong &0x80000000 executable 4148>84 belong &0x40000000 object 4149>84 belong&0x20000000 =0 not stripped 4150>84 belong&0x18000000 =0x00000000 native fpmode 4151>84 belong&0x18000000 =0x10000000 ieee fpmode 4152>84 belong&0x18000000 =0x18000000 undefined fpmode 4153# 41540 belong 0605 Convex SOFF core 4155# 41560 belong 0607 Convex SOFF checkpoint 4157>88 belong&0x000f0000 =0x00000000 c1 4158>88 belong &0x00010000 c2 4159>88 belong &0x00020000 c2mp 4160>88 belong &0x00040000 parallel 4161>88 belong &0x00080000 intrinsic 4162>88 belong &0x00000008 POSIX 4163# 4164>84 belong&0x18000000 =0x00000000 native fpmode 4165>84 belong&0x18000000 =0x10000000 ieee fpmode 4166>84 belong&0x18000000 =0x18000000 undefined fpmode 4167 4168#------------------------------------------------------------------------------ 4169# $File: cracklib,v 1.7 2009/09/19 16:28:08 christos Exp $ 4170# cracklib: file (1) magic for cracklib v2.7 4171 41720 lelong 0x70775631 Cracklib password index, little endian 4173>4 long >0 (%i words) 4174>4 long 0 ("64-bit") 4175>>8 long >-1 (%i words) 41760 belong 0x70775631 Cracklib password index, big endian 4177>4 belong >-1 (%i words) 4178# really bellong 0x0000000070775631 41790 search/1 \0\0\0\0pwV1 Cracklib password index, big endian ("64-bit") 4180>12 belong >0 (%i words) 4181 4182# ---------------------------------------------------------------------------- 4183# $File: ctags,v 1.6 2009/09/19 16:28:08 christos Exp $ 4184# ctags: file (1) magic for Exuberant Ctags files 4185# From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de> 41860 search/1 =!_TAG Exuberant Ctags tag file text 4187 4188#------------------------------------------------------------------------------ 4189# $File: dact,v 1.4 2009/09/19 16:28:08 christos Exp $ 4190# dact: file(1) magic for DACT compressed files 4191# 41920 long 0x444354C3 DACT compressed data 4193>4 byte >-1 (version %i. 4194>5 byte >-1 $BS%i. 4195>6 byte >-1 $BS%i) 4196>7 long >0 $BS, original size: %i bytes 4197>15 long >30 $BS, block size: %i bytes 4198 4199#------------------------------------------------------------------------------ 4200# $File: database,v 1.24 2009/09/19 16:28:08 christos Exp $ 4201# database: file(1) magic for various databases 4202# 4203# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk) 4204# 4205# 4206# GDBM magic numbers 4207# Will be maintained as part of the GDBM distribution in the future. 4208# <downsj@teeny.org> 42090 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian 4210!:mime application/x-gdbm 42110 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian 4212!:mime application/x-gdbm 42130 string GDBM GNU dbm 2.x database 4214!:mime application/x-gdbm 4215# 4216# Berkeley DB 4217# 4218# Ian Darwin's file /etc/magic files: big/little-endian version. 4219# 4220# Hash 1.85/1.86 databases store metadata in network byte order. 4221# Btree 1.85/1.86 databases store the metadata in host byte order. 4222# Hash and Btree 2.X and later databases store the metadata in host byte order. 4223 42240 long 0x00061561 Berkeley DB 4225!:mime application/x-dbm 4226>8 belong 4321 4227>>4 belong >2 1.86 4228>>4 belong <3 1.85 4229>>4 belong >0 (Hash, version %d, native byte-order) 4230>8 belong 1234 4231>>4 belong >2 1.86 4232>>4 belong <3 1.85 4233>>4 belong >0 (Hash, version %d, little-endian) 4234 42350 belong 0x00061561 Berkeley DB 4236>8 belong 4321 4237>>4 belong >2 1.86 4238>>4 belong <3 1.85 4239>>4 belong >0 (Hash, version %d, big-endian) 4240>8 belong 1234 4241>>4 belong >2 1.86 4242>>4 belong <3 1.85 4243>>4 belong >0 (Hash, version %d, native byte-order) 4244 42450 long 0x00053162 Berkeley DB 1.85/1.86 4246>4 long >0 (Btree, version %d, native byte-order) 42470 belong 0x00053162 Berkeley DB 1.85/1.86 4248>4 belong >0 (Btree, version %d, big-endian) 42490 lelong 0x00053162 Berkeley DB 1.85/1.86 4250>4 lelong >0 (Btree, version %d, little-endian) 4251 425212 long 0x00061561 Berkeley DB 4253>16 long >0 (Hash, version %d, native byte-order) 425412 belong 0x00061561 Berkeley DB 4255>16 belong >0 (Hash, version %d, big-endian) 425612 lelong 0x00061561 Berkeley DB 4257>16 lelong >0 (Hash, version %d, little-endian) 4258 425912 long 0x00053162 Berkeley DB 4260>16 long >0 (Btree, version %d, native byte-order) 426112 belong 0x00053162 Berkeley DB 4262>16 belong >0 (Btree, version %d, big-endian) 426312 lelong 0x00053162 Berkeley DB 4264>16 lelong >0 (Btree, version %d, little-endian) 4265 426612 long 0x00042253 Berkeley DB 4267>16 long >0 (Queue, version %d, native byte-order) 426812 belong 0x00042253 Berkeley DB 4269>16 belong >0 (Queue, version %d, big-endian) 427012 lelong 0x00042253 Berkeley DB 4271>16 lelong >0 (Queue, version %d, little-endian) 4272 4273# From Max Bowsher. 427412 long 0x00040988 Berkeley DB 4275>16 long >0 (Log, version %d, native byte-order) 427612 belong 0x00040988 Berkeley DB 4277>16 belong >0 (Log, version %d, big-endian) 427812 lelong 0x00040988 Berkeley DB 4279>16 lelong >0 (Log, version %d, little-endian) 4280 4281# 4282# 4283# Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch> 42840 string RRD RRDTool DB 4285>4 string x version %s 4286#---------------------------------------------------------------------- 4287# ROOT: file(1) magic for ROOT databases 4288# 42890 string root\0 ROOT file 4290>4 belong x Version %d 4291>33 belong x (Compression: %d) 4292 4293# XXX: Weak magic. 4294# Alex Ott <ott@jet.msk.su> 4295## Paradox file formats 4296#2 leshort 0x0800 Paradox 4297#>0x39 byte 3 v. 3.0 4298#>0x39 byte 4 v. 3.5 4299#>0x39 byte 9 v. 4.x 4300#>0x39 byte 10 v. 5.x 4301#>0x39 byte 11 v. 5.x 4302#>0x39 byte 12 v. 7.x 4303#>>0x04 byte 0 indexed .DB data file 4304#>>0x04 byte 1 primary index .PX file 4305#>>0x04 byte 2 non-indexed .DB data file 4306#>>0x04 byte 3 non-incrementing secondary index .Xnn file 4307#>>0x04 byte 4 secondary index .Ynn file 4308#>>0x04 byte 5 incrementing secondary index .Xnn file 4309#>>0x04 byte 6 non-incrementing secondary index .XGn file 4310#>>0x04 byte 7 secondary index .YGn file 4311#>>>0x04 byte 8 incrementing secondary index .XGn file 4312 4313## XBase database files 4314#0 byte 0x02 4315#>8 leshort >0 4316#>>12 leshort 0 FoxBase 4317#!:mime application/x-dbf 4318#>>>0x04 lelong 0 (no records) 4319#>>>0x04 lelong >0 (%ld records) 4320# 4321#0 byte 0x03 4322#!:mime application/x-dbf 4323#>8 leshort >0 4324#>>12 leshort 0 FoxBase+, FoxPro, dBaseIII+, dBaseIV, no memo 4325#>>>0x04 lelong 0 (no records) 4326#>>>0x04 lelong >0 (%ld records) 4327# 4328#0 byte 0x04 4329#!:mime application/x-dbf 4330#>8 leshort >0 4331#>>12 leshort 0 dBASE IV no memo file 4332#>>>0x04 lelong 0 (no records) 4333#>>>0x04 lelong >0 (%ld records) 4334# 4335#0 byte 0x05 4336#!:mime application/x-dbf 4337#>8 leshort >0 4338#>>12 leshort 0 dBASE V no memo file 4339#>>>0x04 lelong 0 (no records) 4340#>>>0x04 lelong >0 (%ld records) 4341# 4342#0 byte 0x30 4343#!:mime application/x-dbf 4344#>8 leshort >0 4345#>>12 leshort 0 Visual FoxPro 4346#>>>0x04 lelong 0 (no records) 4347#>>>0x04 lelong >0 (%ld records) 4348# 4349#0 byte 0x43 4350#!:mime application/x-dbf 4351#>8 leshort >0 4352#>>12 leshort 0 FlagShip with memo var size 4353#>>>0x04 lelong 0 (no records) 4354#>>>0x04 lelong >0 (%ld records) 4355# 4356#0 byte 0x7b 4357#!:mime application/x-dbf 4358#>8 leshort >0 4359#>>12 leshort 0 dBASEIV with memo 4360#>>>0x04 lelong 0 (no records) 4361#>>>0x04 lelong >0 (%ld records) 4362# 4363#0 byte 0x83 4364#!:mime application/x-dbf 4365#>8 leshort >0 4366#>>12 leshort 0 FoxBase+, dBaseIII+ with memo 4367#>>>0x04 lelong 0 (no records) 4368#>>>0x04 lelong >0 (%ld records) 4369# 4370#0 byte 0x8b 4371#!:mime application/x-dbf 4372#>8 leshort >0 4373#>>12 leshort 0 dBaseIV with memo 4374#>>>0x04 lelong 0 (no records) 4375#>>>0x04 lelong >0 (%ld records) 4376# 4377#0 byte 0x8e 4378#!:mime application/x-dbf 4379#>8 leshort >0 4380#>>12 leshort 0 dBaseIV with SQL Table 4381#>>>0x04 lelong 0 (no records) 4382#>>>0x04 lelong >0 (%ld records) 4383# 4384#0 byte 0xb3 4385#!:mime application/x-dbf 4386#>8 leshort >0 4387#>>12 leshort 0 FlagShip with .dbt memo 4388#>>>0x04 lelong 0 (no records) 4389#>>>0x04 lelong >0 (%ld records) 4390# 4391#0 byte 0xf5 4392#!:mime application/x-dbf 4393#>8 leshort >0 4394#>>12 leshort 0 FoxPro with memo 4395#>>>0x04 lelong 0 (no records) 4396#>>>0x04 lelong >0 (%ld records) 4397# 4398#0 leshort 0x0006 DBase 3 index file 4399 4400# MS Access database 44014 string Standard\ Jet\ DB Microsoft Access Database 4402!:mime application/x-msaccess 4403 4404# TDB database from Samba et al - Martin Pool <mbp@samba.org> 44050 string TDB\ file TDB database 4406>32 lelong 0x2601196D version 6, little-endian 4407>>36 lelong x hash size %d bytes 4408 4409# SE Linux policy database 44100 lelong 0xf97cff8c SE Linux policy 4411>16 lelong x v%d 4412>20 lelong 1 MLS 4413>24 lelong x %d symbols 4414>28 lelong x %d ocons 4415 4416# ICE authority file data (Wolfram Kleff) 44172 string ICE ICE authority data 4418 4419# X11 Xauthority file (Wolfram Kleff) 442010 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 442111 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 442212 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 442313 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 442414 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 442515 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 442616 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 442717 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 442818 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 4429 4430# From: Maxime Henrion <mux@FreeBSD.org> 4431# PostgreSQL's custom dump format, Maxime Henrion <mux@FreeBSD.org> 44320 string PGDMP PostgreSQL custom database dump 4433>5 byte x - v%d 4434>6 byte x \b.%d 4435>5 beshort <0x101 \b-0 4436>5 beshort >0x100 4437>>7 byte x \b-%d 4438 4439# Type: Advanced Data Format (ADF) database 4440# URL: http://www.grc.nasa.gov/WWW/cgns/adf/ 4441# From: Nicolas Chauvat <nicolas.chauvat@logilab.fr> 44420 string @(#)ADF\ Database CGNS Advanced Data Format 4443 4444# Tokyo Cabinet magic data 4445# http://tokyocabinet.sourceforge.net/index.html 44460 string ToKyO\ CaBiNeT\n Tokyo Cabinet 4447>14 string x \b (%s) 4448>32 byte 0 \b, Hash 4449!:mime application/x-tokyocabinet-hash 4450>32 byte 1 \b, B+ tree 4451!:mime application/x-tokyocabinet-btree 4452>32 byte 2 \b, Fixed-length 4453!:mime application/x-tokyocabinet-fixed 4454>32 byte 3 \b, Table 4455!:mime application/x-tokyocabinet-table 4456>33 byte &1 \b, [open] 4457>33 byte &2 \b, [fatal] 4458>34 byte x \b, apow=%d 4459>35 byte x \b, fpow=%d 4460>36 byte &0x01 \b, [large] 4461>36 byte &0x02 \b, [deflate] 4462>36 byte &0x04 \b, [bzip] 4463>36 byte &0x08 \b, [tcbs] 4464>36 byte &0x10 \b, [excodec] 4465>40 lequad x \b, bnum=%lld 4466>48 lequad x \b, rnum=%lld 4467>56 lequad x \b, fsiz=%lld 4468 4469# Type: QDBM Quick Database Manager 4470# From: Benoit Sibaud <bsibaud@april.org> 44710 string \\[depot\\]\n\f Quick Database Manager, little endian 44720 string \\[DEPOT\\]\n\f Quick Database Manager, big endian 4473 4474# Type: TokyoCabinet database 4475# URL: http://tokyocabinet.sourceforge.net/ 4476# From: Benoit Sibaud <bsibaud@april.org> 44770 string ToKyO\ CaBiNeT\n TokyoCabinet database 4478>14 string x (version %s) 4479 4480#------------------------------------------------------------------------------ 4481# $File: diamond,v 1.7 2009/09/19 16:28:08 christos Exp $ 4482# diamond: file(1) magic for Diamond system 4483# 4484# ... diamond is a multi-media mail and electronic conferencing system.... 4485# 4486# XXX - I think it was either renamed Slate, or replaced by Slate.... 4487# 4488# The full deal is too long... 4489#0 string <list>\n<protocol\ bbn-multimedia-format> Diamond Multimedia Document 44900 string =<list>\n<protocol\ bbn-m Diamond Multimedia Document 4491 4492#------------------------------------------------------------------------------ 4493# $File: diff,v 1.10 2009/09/19 16:28:08 christos Exp $ 4494# diff: file(1) magic for diff(1) output 4495# 44960 search/1 diff\ diff output text 4497!:mime text/x-diff 44980 search/1 ***\ diff output text 4499!:mime text/x-diff 45000 search/1 Only\ in\ diff output text 4501!:mime text/x-diff 45020 search/1 Common\ subdirectories:\ diff output text 4503!:mime text/x-diff 4504 45050 search/1 Index: RCS/CVS diff output text 4506!:mime text/x-diff 4507 4508# bsdiff: file(1) magic for bsdiff(1) output 45090 string BSDIFF40 bsdiff(1) patch file 4510 4511#------------------------------------------------------------------------------ 4512# $File: digital,v 1.8 2009/09/19 16:28:08 christos Exp $ 4513# Digital UNIX - Info 4514# 45150 string =!<arch>\n________64E Alpha archive 4516>22 string X -- out of date 4517# 4518# Alpha COFF Based Executables 4519# The stripped stuff really needs to be an 8 byte (64 bit) compare, 4520# but this works 45210 leshort 0x183 COFF format alpha 4522>22 leshort&020000 &010000 sharable library, 4523>22 leshort&020000 ^010000 dynamically linked, 4524>24 leshort 0410 pure 4525>24 leshort 0413 demand paged 4526>8 lelong >0 executable or object module, not stripped 4527>8 lelong 0 4528>>12 lelong 0 executable or object module, stripped 4529>>12 lelong >0 executable or object module, not stripped 4530>27 byte >0 - version %d. 4531>26 byte >0 %d- 4532>28 leshort >0 %d 4533# 4534# The next is incomplete, we could tell more about this format, 4535# but its not worth it. 45360 leshort 0x188 Alpha compressed COFF 45370 leshort 0x18f Alpha u-code object 4538# 4539# 4540# Some other interesting Digital formats, 45410 string \377\377\177 ddis/ddif 45420 string \377\377\174 ddis/dots archive 45430 string \377\377\176 ddis/dtif table data 45440 string \033c\033 LN03 output 45450 long 04553207 X image 4546# 45470 string =!<PDF>!\n profiling data file 4548# 4549# Locale data tables (MIPS and Alpha). 4550# 45510 short 0x0501 locale data table 4552>6 short 0x24 for MIPS 4553>6 short 0x40 for Alpha 4554 4555#------------------------------------------------------------------------------ 4556# $File: dolby,v 1.5 2009/09/19 16:28:08 christos Exp $ 4557# ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at> 4558# from http://www.atsc.org/standards/a_52a.pdf 4559# corrections, additions, etc. are always welcome! 4560# 4561# syncword 45620 beshort 0x0b77 ATSC A/52 aka AC-3 aka Dolby Digital stream, 4563# fscod 4564>4 byte&0xc0 0x00 48 kHz, 4565>4 byte&0xc0 0x40 44.1 kHz, 4566>4 byte&0xc0 0x80 32 kHz, 4567# is this one used for 96 kHz? 4568>4 byte&0xc0 0xc0 reserved frequency, 4569# 4570>5 byte&7 = 0 \b, complete main (CM) 4571>5 byte&7 = 1 \b, music and effects (ME) 4572>5 byte&7 = 2 \b, visually impaired (VI) 4573>5 byte&7 = 3 \b, hearing impaired (HI) 4574>5 byte&7 = 4 \b, dialogue (D) 4575>5 byte&7 = 5 \b, commentary (C) 4576>5 byte&7 = 6 \b, emergency (E) 4577# acmod 4578>6 byte&0xe0 0x00 1+1 front, 4579>6 byte&0xe0 0x20 1 front/0 rear, 4580>6 byte&0xe0 0x40 2 front/0 rear, 4581>6 byte&0xe0 0x60 3 front/0 rear, 4582>6 byte&0xe0 0x80 2 front/1 rear, 4583>6 byte&0xe0 0xa0 3 front/1 rear, 4584>6 byte&0xe0 0xc0 2 front/2 rear, 4585>6 byte&0xe0 0xe0 3 front/2 rear, 4586# lfeon (these may be incorrect) 4587>7 byte&0x40 0x00 LFE off, 4588>7 byte&0x40 0x40 LFE on, 4589# 4590>4 byte&0x3e = 0x00 \b, 32 kbit/s 4591>4 byte&0x3e = 0x02 \b, 40 kbit/s 4592>4 byte&0x3e = 0x04 \b, 48 kbit/s 4593>4 byte&0x3e = 0x06 \b, 56 kbit/s 4594>4 byte&0x3e = 0x08 \b, 64 kbit/s 4595>4 byte&0x3e = 0x0a \b, 80 kbit/s 4596>4 byte&0x3e = 0x0c \b, 96 kbit/s 4597>4 byte&0x3e = 0x0e \b, 112 kbit/s 4598>4 byte&0x3e = 0x10 \b, 128 kbit/s 4599>4 byte&0x3e = 0x12 \b, 160 kbit/s 4600>4 byte&0x3e = 0x14 \b, 192 kbit/s 4601>4 byte&0x3e = 0x16 \b, 224 kbit/s 4602>4 byte&0x3e = 0x18 \b, 256 kbit/s 4603>4 byte&0x3e = 0x1a \b, 320 kbit/s 4604>4 byte&0x3e = 0x1c \b, 384 kbit/s 4605>4 byte&0x3e = 0x1e \b, 448 kbit/s 4606>4 byte&0x3e = 0x20 \b, 512 kbit/s 4607>4 byte&0x3e = 0x22 \b, 576 kbit/s 4608>4 byte&0x3e = 0x24 \b, 640 kbit/s 4609# dsurmod (these may be incorrect) 4610>6 beshort&0x0180 0x0000 Dolby Surround not indicated 4611>6 beshort&0x0180 0x0080 not Dolby Surround encoded 4612>6 beshort&0x0180 0x0100 Dolby Surround encoded 4613>6 beshort&0x0180 0x0180 reserved Dolby Surround mode 4614 4615#------------------------------------------------------------------------------ 4616# $File: dump,v 1.11 2009/09/19 16:28:09 christos Exp $ 4617# dump: file(1) magic for dump file format--for new and old dump filesystems 4618# 4619# We specify both byte orders in order to recognize byte-swapped dumps. 4620# 462124 belong 60012 new-fs dump file (big endian), 4622>4 bedate x Previous dump %s, 4623>8 bedate x This dump %s, 4624>12 belong >0 Volume %ld, 4625>692 belong 0 Level zero, type: 4626>692 belong >0 Level %d, type: 4627>0 belong 1 tape header, 4628>0 belong 2 beginning of file record, 4629>0 belong 3 map of inodes on tape, 4630>0 belong 4 continuation of file record, 4631>0 belong 5 end of volume, 4632>0 belong 6 map of inodes deleted, 4633>0 belong 7 end of medium (for floppy), 4634>676 string >\0 Label %s, 4635>696 string >\0 Filesystem %s, 4636>760 string >\0 Device %s, 4637>824 string >\0 Host %s, 4638>888 belong >0 Flags %x 4639 464024 belong 60011 old-fs dump file (big endian), 4641#>4 bedate x Previous dump %s, 4642#>8 bedate x This dump %s, 4643>12 belong >0 Volume %ld, 4644>692 belong 0 Level zero, type: 4645>692 belong >0 Level %d, type: 4646>0 belong 1 tape header, 4647>0 belong 2 beginning of file record, 4648>0 belong 3 map of inodes on tape, 4649>0 belong 4 continuation of file record, 4650>0 belong 5 end of volume, 4651>0 belong 6 map of inodes deleted, 4652>0 belong 7 end of medium (for floppy), 4653>676 string >\0 Label %s, 4654>696 string >\0 Filesystem %s, 4655>760 string >\0 Device %s, 4656>824 string >\0 Host %s, 4657>888 belong >0 Flags %x 4658 465924 lelong 60012 new-fs dump file (little endian), 4660>4 ledate x This dump %s, 4661>8 ledate x Previous dump %s, 4662>12 lelong >0 Volume %ld, 4663>692 lelong 0 Level zero, type: 4664>692 lelong >0 Level %d, type: 4665>0 lelong 1 tape header, 4666>0 lelong 2 beginning of file record, 4667>0 lelong 3 map of inodes on tape, 4668>0 lelong 4 continuation of file record, 4669>0 lelong 5 end of volume, 4670>0 lelong 6 map of inodes deleted, 4671>0 lelong 7 end of medium (for floppy), 4672>676 string >\0 Label %s, 4673>696 string >\0 Filesystem %s, 4674>760 string >\0 Device %s, 4675>824 string >\0 Host %s, 4676>888 lelong >0 Flags %x 4677 467824 lelong 60011 old-fs dump file (little endian), 4679#>4 ledate x Previous dump %s, 4680#>8 ledate x This dump %s, 4681>12 lelong >0 Volume %ld, 4682>692 lelong 0 Level zero, type: 4683>692 lelong >0 Level %d, type: 4684>0 lelong 1 tape header, 4685>0 lelong 2 beginning of file record, 4686>0 lelong 3 map of inodes on tape, 4687>0 lelong 4 continuation of file record, 4688>0 lelong 5 end of volume, 4689>0 lelong 6 map of inodes deleted, 4690>0 lelong 7 end of medium (for floppy), 4691>676 string >\0 Label %s, 4692>696 string >\0 Filesystem %s, 4693>760 string >\0 Device %s, 4694>824 string >\0 Host %s, 4695>888 lelong >0 Flags %x 4696 469718 leshort 60011 old-fs dump file (16-bit, assuming PDP-11 endianness), 4698>2 medate x Previous dump %s, 4699>6 medate x This dump %s, 4700>10 leshort >0 Volume %ld, 4701>0 leshort 1 tape header. 4702>0 leshort 2 beginning of file record. 4703>0 leshort 3 map of inodes on tape. 4704>0 leshort 4 continuation of file record. 4705>0 leshort 5 end of volume. 4706>0 leshort 6 map of inodes deleted. 4707>0 leshort 7 end of medium (for floppy). 4708 470924 belong 0x19540119 new-fs dump file (ufs2, big endian), 4710>896 beqdate x Previous dump %s, 4711>904 beqdate x This dump %s, 4712>12 belong >0 Volume %ld, 4713>692 belong 0 Level zero, type: 4714>692 belong >0 Level %d, type: 4715>0 belong 1 tape header, 4716>0 belong 2 beginning of file record, 4717>0 belong 3 map of inodes on tape, 4718>0 belong 4 continuation of file record, 4719>0 belong 5 end of volume, 4720>0 belong 6 map of inodes deleted, 4721>0 belong 7 end of medium (for floppy), 4722>676 string >\0 Label %s, 4723>696 string >\0 Filesystem %s, 4724>760 string >\0 Device %s, 4725>824 string >\0 Host %s, 4726>888 belong >0 Flags %x 4727 472824 lelong 0x19540119 new-fs dump file (ufs2, little endian), 4729>896 leqdate x This dump %s, 4730>904 leqdate x Previous dump %s, 4731>12 lelong >0 Volume %ld, 4732>692 lelong 0 Level zero, type: 4733>692 lelong >0 Level %d, type: 4734>0 lelong 1 tape header, 4735>0 lelong 2 beginning of file record, 4736>0 lelong 3 map of inodes on tape, 4737>0 lelong 4 continuation of file record, 4738>0 lelong 5 end of volume, 4739>0 lelong 6 map of inodes deleted, 4740>0 lelong 7 end of medium (for floppy), 4741>676 string >\0 Label %s, 4742>696 string >\0 Filesystem %s, 4743>760 string >\0 Device %s, 4744>824 string >\0 Host %s, 4745>888 lelong >0 Flags %x 4746 4747#------------------------------------------------------------------------------ 4748# $File: dyadic,v 1.4 2009/09/19 16:28:09 christos Exp $ 4749# Dyadic: file(1) magic for Dyalog APL. 4750# 47510 byte 0xaa 4752>1 byte <4 Dyalog APL 4753>>1 byte 0x00 incomplete workspace 4754>>1 byte 0x01 component file 4755>>1 byte 0x02 external variable 4756>>1 byte 0x03 workspace 4757>>2 byte x version %d 4758>>3 byte x .%d 4759 47600 beshort 0xaa03 Dyalog APL 4761>2 byte x workspace type %d 4762>3 byte x subtype %d 4763>7 byte&0x28 0x00 32-bit 4764>7 byte&0x28 0x20 64-bit 4765>7 byte&0x0c 0x00 classic 4766>7 byte&0x0c 0x04 unicode 4767>7 byte&0x88 0x00 big-endian 4768>7 byte&0x88 0x80 little-endian 4769 47700 byte 0xaa Dyalog APL 4771>1 byte 0x00 aplcore 4772>1 byte 0x01 component file 32-bit non-journaled non-checksummed 4773>1 byte 0x02 external variable exclusive 4774>1 byte 0x06 external variable shared 4775>1 byte 0x07 session 4776>1 byte 0x08 mapped file 32-bit 4777>1 byte 0x09 component file 64-bit non-journaled non-checksummed 4778>1 byte 0x0a mapped file 64-bit 4779>1 byte 0x0b component file 32-bit level 1 journaled non-checksummed 4780>1 byte 0x0c component file 64-bit level 1 journaled non-checksummed 4781>1 byte 0x0d component file 32-bit level 1 journaled checksummed 4782>1 byte 0x0e component file 64-bit level 1 journaled checksummed 4783>1 byte 0x0f component file 32-bit level 2 journaled checksummed 4784>1 byte 0x10 component file 64-bit level 2 journaled checksummed 4785>1 byte 0x11 component file 32-bit level 3 journaled checksummed 4786>1 byte 0x12 component file 64-bit level 3 journaled checksummed 4787>1 byte 0x13 component file 32-bit non-journaled checksummed 4788>1 byte 0x14 component file 64-bit non-journaled checksummed 4789>1 byte 0x80 DDB 4790 47910 short 0x6060 Dyalog APL transfer 4792 4793#------------------------------------------------------------------------------ 4794# $File: editors,v 1.8 2009/09/19 16:28:09 christos Exp $ 4795# T602 editor documents 4796# by David Necas <yeti@physics.muni.cz> 47970 string @CT\ T602 document data, 4798>4 string 0 Kamenicky 4799>4 string 1 CP 852 4800>4 string 2 KOI8-CS 4801>4 string >2 unknown encoding 4802 4803# Vi IMproved Encrypted file 4804# by David Necas <yeti@physics.muni.cz> 48050 string VimCrypt~ Vim encrypted file data 4806# Vi IMproved Swap file 4807# by Sven Wegener <swegener@gentoo.org> 48080 string b0VIM\ Vim swap file 4809>&0 string >\0 \b, version %s 4810 4811#------------------------------------------------------------------------------ 4812# $File: efi,v 1.4 2009/09/19 16:28:09 christos Exp $ 4813# efi: file(1) magic for Universal EFI binaries 4814 48150 lelong 0x0ef1fab9 4816>4 lelong 1 Universal EFI binary with 1 architecture 4817>>&0 lelong 7 \b, i386 4818>>&0 lelong 0x01000007 \b, x86_64 4819>4 lelong 2 Universal EFI binary with 2 architectures 4820>>&0 lelong 7 \b, i386 4821>>&0 lelong 0x01000007 \b, x86_64 4822>>&20 lelong 7 \b, i386 4823>>&20 lelong 0x01000007 \b, x86_64 4824>4 lelong >2 Universal EFI binary with %ld architectures 4825 4826#------------------------------------------------------------------------------ 4827# $File: elf,v 1.53 2009/09/19 16:28:09 christos Exp $ 4828# elf: file(1) magic for ELF executables 4829# 4830# We have to check the byte order flag to see what byte order all the 4831# other stuff in the header is in. 4832# 4833# What're the correct byte orders for the nCUBE and the Fujitsu VPP500? 4834# 4835# Created by: unknown 4836# Modified by (1): Daniel Quinlan <quinlan@yggdrasil.com> 4837# Modified by (2): Peter Tobias <tobias@server.et-inf.fho-emden.de> (core support) 4838# Modified by (3): Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> (fix of core support) 4839# Modified by (4): <gerardo.cacciari@gmail.com> (VMS Itanium) 4840# Modified by (5): Matthias Urlichs <smurf@debian.org> (Listing of many architectures) 48410 string \177ELF ELF 4842>4 byte 0 invalid class 4843>4 byte 1 32-bit 4844>4 byte 2 64-bit 4845>5 byte 0 invalid byte order 4846>5 byte 1 LSB 4847>>16 leshort 0 no file type, 4848!:strength *2 4849!:mime application/octet-stream 4850>>16 leshort 1 relocatable, 4851!:mime application/x-object 4852>>16 leshort 2 executable, 4853!:mime application/x-executable 4854>>16 leshort 3 shared object, 4855!:mime application/x-sharedlib 4856>>16 leshort 4 core file 4857!:mime application/x-coredump 4858# Core file detection is not reliable. 4859#>>>(0x38+0xcc) string >\0 of '%s' 4860#>>>(0x38+0x10) lelong >0 (signal %d), 4861>>16 leshort &0xff00 processor-specific, 4862>>18 leshort 0 no machine, 4863>>18 leshort 1 AT&T WE32100 - invalid byte order, 4864>>18 leshort 2 SPARC - invalid byte order, 4865>>18 leshort 3 Intel 80386, 4866>>18 leshort 4 Motorola 4867>>>36 lelong &0x01000000 68000 - invalid byte order, 4868>>>36 lelong &0x00810000 CPU32 - invalid byte order, 4869>>>36 lelong 0 68020 - invalid byte order, 4870>>18 leshort 5 Motorola 88000 - invalid byte order, 4871>>18 leshort 6 Intel 80486, 4872>>18 leshort 7 Intel 80860, 4873# The official e_machine number for MIPS is now #8, regardless of endianness. 4874# The second number (#10) will be deprecated later. For now, we still 4875# say something if #10 is encountered, but only gory details for #8. 4876>>18 leshort 8 MIPS, 4877>>>36 lelong &0x20 N32 4878>>18 leshort 10 MIPS, 4879>>>36 lelong &0x20 N32 4880>>18 leshort 8 4881# only for 32-bit 4882>>>4 byte 1 4883>>>>36 lelong&0xf0000000 0x00000000 MIPS-I 4884>>>>36 lelong&0xf0000000 0x10000000 MIPS-II 4885>>>>36 lelong&0xf0000000 0x20000000 MIPS-III 4886>>>>36 lelong&0xf0000000 0x30000000 MIPS-IV 4887>>>>36 lelong&0xf0000000 0x40000000 MIPS-V 4888>>>>36 lelong&0xf0000000 0x50000000 MIPS32 4889>>>>36 lelong&0xf0000000 0x60000000 MIPS64 4890>>>>36 lelong&0xf0000000 0x70000000 MIPS32 rel2 4891>>>>36 lelong&0xf0000000 0x80000000 MIPS64 rel2 4892# only for 64-bit 4893>>>4 byte 2 4894>>>>48 lelong&0xf0000000 0x00000000 MIPS-I 4895>>>>48 lelong&0xf0000000 0x10000000 MIPS-II 4896>>>>48 lelong&0xf0000000 0x20000000 MIPS-III 4897>>>>48 lelong&0xf0000000 0x30000000 MIPS-IV 4898>>>>48 lelong&0xf0000000 0x40000000 MIPS-V 4899>>>>48 lelong&0xf0000000 0x50000000 MIPS32 4900>>>>48 lelong&0xf0000000 0x60000000 MIPS64 4901>>>>48 lelong&0xf0000000 0x70000000 MIPS32 rel2 4902>>>>48 lelong&0xf0000000 0x80000000 MIPS64 rel2 4903>>18 leshort 9 Amdahl - invalid byte order, 4904>>18 leshort 10 MIPS (deprecated), 4905>>18 leshort 11 RS6000 - invalid byte order, 4906>>18 leshort 15 PA-RISC - invalid byte order, 4907>>>50 leshort 0x0214 2.0 4908>>>48 leshort &0x0008 (LP64), 4909>>18 leshort 16 nCUBE, 4910>>18 leshort 17 Fujitsu VPP500, 4911>>18 leshort 18 SPARC32PLUS - invalid byte order, 4912>>18 leshort 20 PowerPC, 4913>>18 leshort 22 IBM S/390, 4914>>18 leshort 36 NEC V800, 4915>>18 leshort 37 Fujitsu FR20, 4916>>18 leshort 38 TRW RH-32, 4917>>18 leshort 39 Motorola RCE, 4918>>18 leshort 40 ARM, 4919>>18 leshort 41 Alpha, 4920>>18 leshort 0xa390 IBM S/390 (obsolete), 4921>>18 leshort 42 Renesas SH, 4922>>18 leshort 43 SPARC V9 - invalid byte order, 4923>>18 leshort 44 Siemens Tricore Embedded Processor, 4924>>18 leshort 45 Argonaut RISC Core, Argonaut Technologies Inc., 4925>>18 leshort 46 Renesas H8/300, 4926>>18 leshort 47 Renesas H8/300H, 4927>>18 leshort 48 Renesas H8S, 4928>>18 leshort 49 Renesas H8/500, 4929>>18 leshort 50 IA-64, 4930>>18 leshort 51 Stanford MIPS-X, 4931>>18 leshort 52 Motorola Coldfire, 4932>>18 leshort 53 Motorola M68HC12, 4933>>18 leshort 54 Fujitsu MMA, 4934>>18 leshort 55 Siemens PCP, 4935>>18 leshort 56 Sony nCPU, 4936>>18 leshort 57 Denso NDR1, 4937>>18 leshort 58 Start*Core, 4938>>18 leshort 59 Toyota ME16, 4939>>18 leshort 60 ST100, 4940>>18 leshort 61 Tinyj emb., 4941>>18 leshort 62 x86-64, 4942>>18 leshort 63 Sony DSP, 4943>>18 leshort 66 FX66, 4944>>18 leshort 67 ST9+ 8/16 bit, 4945>>18 leshort 68 ST7 8 bit, 4946>>18 leshort 69 MC68HC16, 4947>>18 leshort 70 MC68HC11, 4948>>18 leshort 71 MC68HC08, 4949>>18 leshort 72 MC68HC05, 4950>>18 leshort 73 SGI SVx, 4951>>18 leshort 74 ST19 8 bit, 4952>>18 leshort 75 Digital VAX, 4953>>18 leshort 76 Axis cris, 4954>>18 leshort 77 Infineon 32-bit embedded, 4955>>18 leshort 78 Element 14 64-bit DSP, 4956>>18 leshort 79 LSI Logic 16-bit DSP, 4957>>18 leshort 80 MMIX, 4958>>18 leshort 81 Harvard machine-independent, 4959>>18 leshort 82 SiTera Prism, 4960>>18 leshort 83 Atmel AVR 8-bit, 4961>>18 leshort 84 Fujitsu FR30, 4962>>18 leshort 85 Mitsubishi D10V, 4963>>18 leshort 86 Mitsubishi D30V, 4964>>18 leshort 87 NEC v850, 4965>>18 leshort 88 Renesas M32R, 4966>>18 leshort 89 Matsushita MN10300, 4967>>18 leshort 90 Matsushita MN10200, 4968>>18 leshort 91 picoJava, 4969>>18 leshort 92 OpenRISC, 4970>>18 leshort 93 ARC Cores Tangent-A5, 4971>>18 leshort 94 Tensilica Xtensa, 4972>>18 leshort 97 NatSemi 32k, 4973>>18 leshort 106 Analog Devices Blackfin, 4974>>18 leshort 113 Altera Nios II, 4975>>18 leshort 0xae META, 4976>>18 leshort 0x3426 OpenRISC (obsolete), 4977>>18 leshort 0x8472 OpenRISC (obsolete), 4978>>18 leshort 0x9026 Alpha (unofficial), 4979>>20 lelong 0 invalid version 4980>>20 lelong 1 version 1 4981>>36 lelong 1 MathCoPro/FPU/MAU Required 4982>5 byte 2 MSB 4983>>16 beshort 0 no file type, 4984!:mime application/octet-stream 4985>>16 beshort 1 relocatable, 4986!:mime application/x-object 4987>>16 beshort 2 executable, 4988!:mime application/x-executable 4989>>16 beshort 3 shared object, 4990!:mime application/x-sharedlib 4991>>16 beshort 4 core file, 4992!:mime application/x-coredump 4993#>>>(0x38+0xcc) string >\0 of '%s' 4994#>>>(0x38+0x10) belong >0 (signal %d), 4995>>16 beshort &0xff00 processor-specific, 4996>>18 beshort 0 no machine, 4997>>18 beshort 1 AT&T WE32100, 4998>>18 beshort 2 SPARC, 4999>>18 beshort 3 Intel 80386 - invalid byte order, 5000>>18 beshort 4 Motorola 5001>>>36 belong &0x01000000 68000, 5002>>>36 belong &0x00810000 CPU32, 5003>>>36 belong 0 68020, 5004>>18 beshort 5 Motorola 88000, 5005>>18 beshort 6 Intel 80486 - invalid byte order, 5006>>18 beshort 7 Intel 80860, 5007# only for MIPS - see comment in little-endian section above. 5008>>18 beshort 8 MIPS, 5009>>>36 belong &0x20 N32 5010>>18 beshort 10 MIPS, 5011>>>36 belong &0x20 N32 5012>>18 beshort 8 5013# only for 32-bit 5014>>>4 byte 1 5015>>>>36 belong&0xf0000000 0x00000000 MIPS-I 5016>>>>36 belong&0xf0000000 0x10000000 MIPS-II 5017>>>>36 belong&0xf0000000 0x20000000 MIPS-III 5018>>>>36 belong&0xf0000000 0x30000000 MIPS-IV 5019>>>>36 belong&0xf0000000 0x40000000 MIPS-V 5020>>>>36 belong&0xf0000000 0x50000000 MIPS32 5021>>>>36 belong&0xf0000000 0x60000000 MIPS64 5022>>>>36 belong&0xf0000000 0x70000000 MIPS32 rel2 5023>>>>36 belong&0xf0000000 0x80000000 MIPS64 rel2 5024# only for 64-bit 5025>>>4 byte 2 5026>>>>48 belong&0xf0000000 0x00000000 MIPS-I 5027>>>>48 belong&0xf0000000 0x10000000 MIPS-II 5028>>>>48 belong&0xf0000000 0x20000000 MIPS-III 5029>>>>48 belong&0xf0000000 0x30000000 MIPS-IV 5030>>>>48 belong&0xf0000000 0x40000000 MIPS-V 5031>>>>48 belong&0xf0000000 0x50000000 MIPS32 5032>>>>48 belong&0xf0000000 0x60000000 MIPS64 5033>>>>48 belong&0xf0000000 0x70000000 MIPS32 rel2 5034>>>>48 belong&0xf0000000 0x80000000 MIPS64 rel2 5035>>18 beshort 9 Amdahl, 5036>>18 beshort 10 MIPS (deprecated), 5037>>18 beshort 11 RS6000, 5038>>18 beshort 15 PA-RISC 5039>>>50 beshort 0x0214 2.0 5040>>>48 beshort &0x0008 (LP64) 5041>>18 beshort 16 nCUBE, 5042>>18 beshort 17 Fujitsu VPP500, 5043>>18 beshort 18 SPARC32PLUS, 5044>>>36 belong&0xffff00 0x000100 V8+ Required, 5045>>>36 belong&0xffff00 0x000200 Sun UltraSPARC1 Extensions Required, 5046>>>36 belong&0xffff00 0x000400 HaL R1 Extensions Required, 5047>>>36 belong&0xffff00 0x000800 Sun UltraSPARC3 Extensions Required, 5048>>18 beshort 20 PowerPC or cisco 4500, 5049>>18 beshort 21 64-bit PowerPC or cisco 7500, 5050>>18 beshort 22 IBM S/390, 5051>>18 beshort 23 Cell SPU, 5052>>18 beshort 24 cisco SVIP, 5053>>18 beshort 25 cisco 7200, 5054>>18 beshort 36 NEC V800 or cisco 12000, 5055>>18 beshort 37 Fujitsu FR20, 5056>>18 beshort 38 TRW RH-32, 5057>>18 beshort 39 Motorola RCE, 5058>>18 beshort 40 ARM, 5059>>18 beshort 41 Alpha, 5060>>18 beshort 42 Renesas SH, 5061>>18 beshort 43 SPARC V9, 5062>>>48 belong&0xffff00 0x000200 Sun UltraSPARC1 Extensions Required, 5063>>>48 belong&0xffff00 0x000400 HaL R1 Extensions Required, 5064>>>48 belong&0xffff00 0x000800 Sun UltraSPARC3 Extensions Required, 5065>>>48 belong&0x3 0 total store ordering, 5066>>>48 belong&0x3 1 partial store ordering, 5067>>>48 belong&0x3 2 relaxed memory ordering, 5068>>18 beshort 44 Siemens Tricore Embedded Processor, 5069>>18 beshort 45 Argonaut RISC Core, Argonaut Technologies Inc., 5070>>18 beshort 46 Renesas H8/300, 5071>>18 beshort 47 Renesas H8/300H, 5072>>18 beshort 48 Renesas H8S, 5073>>18 beshort 49 Renesas H8/500, 5074>>18 beshort 50 IA-64, 5075>>18 beshort 51 Stanford MIPS-X, 5076>>18 beshort 52 Motorola Coldfire, 5077>>18 beshort 53 Motorola M68HC12, 5078>>18 beshort 73 Cray NV1, 5079>>18 beshort 75 Digital VAX, 5080>>18 beshort 88 Renesas M32R, 5081>>18 leshort 92 OpenRISC, 5082>>18 leshort 0x3426 OpenRISC (obsolete), 5083>>18 leshort 0x8472 OpenRISC (obsolete), 5084>>18 beshort 94 Tensilica Xtensa, 5085>>18 beshort 97 NatSemi 32k, 5086>>18 beshort 0x18ad AVR32 (unofficial), 5087>>18 beshort 0x9026 Alpha (unofficial), 5088>>18 beshort 0xa390 IBM S/390 (obsolete), 5089>>20 belong 0 invalid version 5090>>20 belong 1 version 1 5091>>36 belong 1 MathCoPro/FPU/MAU Required 5092# Up to now only 0, 1 and 2 are defined; I've seen a file with 0x83, it seemed 5093# like proper ELF, but extracting the string had bad results. 5094>4 byte <0x80 5095>>8 string >\0 (%s) 5096>8 string \0 5097>>7 byte 0 (SYSV) 5098>>7 byte 1 (HP-UX) 5099>>7 byte 2 (NetBSD) 5100>>7 byte 3 (GNU/Linux) 5101>>7 byte 4 (GNU/Hurd) 5102>>7 byte 5 (86Open) 5103>>7 byte 6 (Solaris) 5104>>7 byte 7 (Monterey) 5105>>7 byte 8 (IRIX) 5106>>7 byte 9 (FreeBSD) 5107>>7 byte 10 (Tru64) 5108>>7 byte 11 (Novell Modesto) 5109>>7 byte 12 (OpenBSD) 5110>8 string \2 5111>>7 byte 13 (OpenVMS) 5112>>7 byte 97 (ARM) 5113>>7 byte 255 (embedded) 5114 5115#------------------------------------------------------------------------------ 5116# $File: encore,v 1.6 2009/09/19 16:28:09 christos Exp $ 5117# encore: file(1) magic for Encore machines 5118# 5119# XXX - needs to have the byte order specified (NS32K was little-endian, 5120# dunno whether they run the 88K in little-endian mode or not). 5121# 51220 short 0x154 Encore 5123>20 short 0x107 executable 5124>20 short 0x108 pure executable 5125>20 short 0x10b demand-paged executable 5126>20 short 0x10f unsupported executable 5127>12 long >0 not stripped 5128>22 short >0 - version %ld 5129>22 short 0 - 5130#>4 date x stamp %s 51310 short 0x155 Encore unsupported executable 5132>12 long >0 not stripped 5133>22 short >0 - version %ld 5134>22 short 0 - 5135#>4 date x stamp %s 5136 5137#------------------------------------------------------------------------------ 5138# $File: epoc,v 1.7 2009/09/19 16:28:09 christos Exp $ 5139# EPOC : file(1) magic for EPOC documents [Psion Series 5/Osaris/Geofox 1] 5140# Stefan Praszalowicz <hpicollo@worldnet.fr> and Peter Breitenlohner <peb@mppmu.mpg.de> 5141# Useful information for improving this file can be found at: 5142# http://software.frodo.looijaard.name/psiconv/formats/Index.html 5143#------------------------------------------------------------------------------ 51440 lelong 0x10000037 Psion Series 5 5145>4 lelong 0x10000039 font file 5146>4 lelong 0x1000003A printer driver 5147>4 lelong 0x1000003B clipboard 5148>4 lelong 0x10000042 multi-bitmap image 5149!:mime image/x-epoc-mbm 5150>4 lelong 0x1000006A application information file 5151>4 lelong 0x1000006D 5152>>8 lelong 0x1000007D Sketch image 5153!:mime image/x-epoc-sketch 5154>>8 lelong 0x1000007E voice note 5155>>8 lelong 0x1000007F Word file 5156!:mime application/x-epoc-word 5157>>8 lelong 0x10000085 OPL program (TextEd) 5158!:mime application/x-epoc-opl 5159>>8 lelong 0x10000088 Sheet file 5160!:mime application/x-epoc-sheet 5161>>8 lelong 0x100001C4 EasyFax initialisation file 5162>4 lelong 0x10000073 OPO module 5163!:mime application/x-epoc-opo 5164>4 lelong 0x10000074 OPL application 5165!:mime application/x-epoc-app 5166>4 lelong 0x1000008A exported multi-bitmap image 5167 51680 lelong 0x10000041 Psion Series 5 ROM multi-bitmap image 5169 51700 lelong 0x10000050 Psion Series 5 5171>4 lelong 0x1000006D database 5172>4 lelong 0x100000E4 ini file 5173 51740 lelong 0x10000079 Psion Series 5 binary: 5175>4 lelong 0x00000000 DLL 5176>4 lelong 0x10000049 comms hardware library 5177>4 lelong 0x1000004A comms protocol library 5178>4 lelong 0x1000005D OPX 5179>4 lelong 0x1000006C application 5180>4 lelong 0x1000008D DLL 5181>4 lelong 0x100000AC logical device driver 5182>4 lelong 0x100000AD physical device driver 5183>4 lelong 0x100000E5 file transfer protocol 5184>4 lelong 0x100000E5 file transfer protocol 5185>4 lelong 0x10000140 printer definition 5186>4 lelong 0x10000141 printer definition 5187 51880 lelong 0x1000007A Psion Series 5 executable 5189 5190#------------------------------------------------------------------------------ 5191# $File: erlang,v 1.5 2009/09/19 16:28:09 christos Exp $ 5192# erlang: file(1) magic for Erlang JAM and BEAM files 5193# URL: http://www.erlang.org/faq/x779.html#AEN812 5194 5195# OTP R3-R4 51960 string \0177BEAM! Old Erlang BEAM file 5197>6 short >0 - version %d 5198 5199# OTP R5 and onwards 52000 string FOR1 5201>8 string BEAM Erlang BEAM file 5202 5203# 4.2 version may have a copyright notice! 52044 string Tue\ Jan\ 22\ 14:32:44\ MET\ 1991 Erlang JAM file - version 4.2 520579 string Tue\ Jan\ 22\ 14:32:44\ MET\ 1991 Erlang JAM file - version 4.2 5206 52074 string 1.0\ Fri\ Feb\ 3\ 09:55:56\ MET\ 1995 Erlang JAM file - version 4.3 5208 52090 bequad 0x0000000000ABCDEF Erlang DETS file 5210 5211#------------------------------------------------------------------------------ 5212# $File: esri,v 1.4 2009/09/19 16:28:09 christos Exp $ 5213# ESRI Shapefile format (.shp .shx .dbf=DBaseIII) 5214# Based on info from 5215# <URL:http://www.esri.com/library/whitepapers/pdfs/shapefile.pdf> 52160 belong 9994 ESRI Shapefile 5217>4 belong =0 5218>8 belong =0 5219>12 belong =0 5220>16 belong =0 5221>20 belong =0 5222>28 lelong x version %d 5223>24 belong x length %d 5224>32 lelong =0 type Null Shape 5225>32 lelong =1 type Point 5226>32 lelong =3 type PolyLine 5227>32 lelong =5 type Polygon 5228>32 lelong =8 type MultiPoint 5229>32 lelong =11 type PointZ 5230>32 lelong =13 type PolyLineZ 5231>32 lelong =15 type PolygonZ 5232>32 lelong =18 type MultiPointZ 5233>32 lelong =21 type PointM 5234>32 lelong =23 type PolyLineM 5235>32 lelong =25 type PolygonM 5236>32 lelong =28 type MultiPointM 5237>32 lelong =31 type MultiPatch 5238 5239#------------------------------------------------------------------------------ 5240# $File: fcs,v 1.4 2009/09/19 16:28:09 christos Exp $ 5241# fcs: file(1) magic for FCS (Flow Cytometry Standard) data files 5242# From Roger Leigh <roger@whinlatter.uklinux.net> 52430 string FCS1.0 Flow Cytometry Standard (FCS) data, version 1.0 52440 string FCS2.0 Flow Cytometry Standard (FCS) data, version 2.0 52450 string FCS3.0 Flow Cytometry Standard (FCS) data, version 3.0 5246 5247 5248#------------------------------------------------------------------------------ 5249# $File: filesystems,v 1.55 2010/01/16 17:45:12 chl Exp $ 5250# filesystems: file(1) magic for different filesystems 5251# 52520 string \366\366\366\366 PC formatted floppy with no filesystem 5253# Sun disk labels 5254# From /usr/include/sun/dklabel.h: 52550774 beshort 0xdabe 5256# modified by Joerg Jenderek, because original test 5257# succeeds for Cabinet archive dao360.dl_ with negative blocks 5258>0770 long >0 Sun disk label 5259>>0 string x '%s 5260>>>31 string >\0 \b%s 5261>>>>63 string >\0 \b%s 5262>>>>>95 string >\0 \b%s 5263>>0 string x \b' 5264>>0734 short >0 %d rpm, 5265>>0736 short >0 %d phys cys, 5266>>0740 short >0 %d alts/cyl, 5267>>0746 short >0 %d interleave, 5268>>0750 short >0 %d data cyls, 5269>>0752 short >0 %d alt cyls, 5270>>0754 short >0 %d heads/partition, 5271>>0756 short >0 %d sectors/track, 5272>>0764 long >0 start cyl %ld, 5273>>0770 long x %ld blocks 5274# Is there a boot block written 1 sector in? 5275>512 belong&077777777 0600407 \b, boot block present 5276# Joerg Jenderek: Smart Boot Manager backup file is 41 byte header + first sectors of disc 5277# (http://btmgr.sourceforge.net/docs/user-guide-3.html) 52780 string SBMBAKUP_ Smart Boot Manager backup file 5279>9 string x \b, version %-5.5s 5280>>14 string =_ 5281>>>15 string x %-.1s 5282>>>>16 string =_ \b. 5283>>>>>17 string x \b%-.1s 5284>>>>>>18 string =_ \b. 5285>>>>>>>19 string x \b%-.1s 5286>>>22 ubyte 0 5287>>>>21 ubyte x \b, from drive 0x%x 5288>>>22 ubyte >0 5289>>>>21 string x \b, from drive %s 5290 5291# Joerg Jenderek 5292# DOS Emulator image is 128 byte, null right padded header + harddisc image 52930 string DOSEMU\0 5294>0x27E leshort 0xAA55 5295#offset is 128 5296>>19 ubyte 128 5297>>>(19.b-1) ubyte 0x0 DOS Emulator image 5298>>>>7 ulelong >0 \b, %u heads 5299>>>>11 ulelong >0 \b, %d sectors/track 5300>>>>15 ulelong >0 \b, %d cylinders 5301 5302# updated by Joerg Jenderek at Sep 2007 5303# only for sector sizes with 512 or more Bytes 53040x1FE leshort 0xAA55 x86 boot sector 5305# to do also for sectors < than 512 Bytes and some other files, GRR 5306#30 search/481 \x55\xAA x86 boot sector 5307# not for BeOS floppy 1440k, MBRs 5308#(11.s-2) uleshort 0xAA55 x86 boot sector 5309>2 string OSBS \b, OS/BS MBR 5310# J\xf6rg Jenderek <joerg dot jenderek at web dot de> 5311>0x8C string Invalid\ partition\ table \b, MS-DOS MBR 5312# dr-dos with some upper-, lowercase variants 5313>0x9D string Invalid\ partition\ table$ 5314>>181 string No\ Operating\ System$ 5315>>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 5316>0x9D string Invalid\ partition\ table$ 5317>>181 string No\ operating\ system$ 5318>>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 5319>342 string Invalid\ partition\ table$ 5320>>366 string No\ operating\ system$ 5321>>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03 5322>295 string NEWLDR\0 5323>>302 string Bad\ PT\ $ 5324>>>310 string No\ OS\ $ 5325>>>>317 string OS\ load\ err$ 5326>>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r 5327>>>>>>358 string Press\ any\ key\ to\ continue.\n\r$ 5328>>>>>>>387 string Copyright\ (c)\ 1984,1998 5329>>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR) 5330>0x10F string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 4.10.1998, 4.10.2222 5331>>0x1B8 ubelong >0 \b, Serial 0x%-.4x 5332>0x8B string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 5.00 to 4.00.950 5333>271 string Invalid\ partition\ table\0 5334>>295 string Error\ loading\ operating\ system\0 5335>>>326 string Missing\ operating\ system\0 \b, mbr 5336# 5337>139 string Invalid\ partition\ table\0 5338>>163 string Error\ loading\ operating\ system\0 5339>>>194 string Missing\ operating\ system\0 \b, Microsoft Windows XP mbr 5340# http://www.heise.de/ct/05/09/006/ page 184 5341#HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices\DosDevices\?:=Serial4Bytes+8Bytes 5342>>>>0x1B8 ulelong >0 \b,Serial 0x%-.4x 5343>300 string Invalid\ partition\ table\0 5344>>324 string Error\ loading\ operating\ system\0 5345>>>355 string Missing\ operating\ system\0 \b, Microsoft Windows XP MBR 5346#??>>>389 string Invalid\ system\ disk 5347>>>>0x1B8 ulelong >0 \b, Serial 0x%-.4x 5348>300 string Ung\201ltige\ Partitionstabelle 5349#split string to avoid error: String too long 5350>>328 string Fehler\ beim\ Laden\ 5351>>>346 string des\ Betriebssystems 5352>>>>366 string Betriebssystem\ nicht\ vorhanden \b, Microsoft Windows XP MBR (german) 5353>>>>>0x1B8 ulelong >0 \b, Serial 0x%-.4x 5354#>0x145 string Default:\ F \b, FREE-DOS MBR 5355#>0x14B string Default:\ F \b, FREE-DOS 1.0 MBR 5356>0x145 search/7 Default:\ F \b, FREE-DOS MBR 5357#>>313 string F0\ .\ .\ . 5358#>>>322 string disk\ 1 5359#>>>>382 string FAT3 5360>64 string no\ active\ partition\ found 5361>>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR 5362# Ranish Partition Manager http://www.ranish.com/part/ 5363>387 search/4 \0\ Error!\r 5364>>378 search/7 Virus! 5365>>>397 search/4 Booting\ 5366>>>>408 search/4 HD1/\0 \b, Ranish MBR ( 5367>>>>>416 string Writing\ changes... \b2.37 5368>>>>>>438 ubyte x \b,0x%x dots 5369>>>>>>440 ubyte >0 \b,virus check 5370>>>>>>441 ubyte >0 \b,partition %c 5371#2.38,2.42,2.44 5372>>>>>416 string !Writing\ changes... \b 5373>>>>>>418 ubyte 1 \bvirus check, 5374>>>>>>419 ubyte x \b0x%x seconds 5375>>>>>>420 ubyte&0x0F >0 \b,partition 5376>>>>>>>420 ubyte&0x0F <5 \b %x 5377>>>>>>>420 ubyte&0x0F 0Xf \b ask 5378>>>>>420 ubyte x \b) 5379# 5380>271 string Operating\ system\ loading 5381>>296 string error\r \b, SYSLINUX MBR (2.10) 5382# http://www.acronis.de/ 5383>362 string MBR\ Error\ \0\r 5384>>376 string ress\ any\ key\ to\ 5385>>>392 string boot\ from\ floppy...\0 \b, Acronis MBR 5386# added by Joerg Jenderek 5387# http://www.visopsys.org/ 5388# http://partitionlogic.org.uk/ 5389>309 string No\ bootable\ partition\ found\r 5390>>339 string I/O\ Error\ reading\ boot\ sector\r \b, Visopsys MBR 5391>349 string No\ bootable\ partition\ found\r 5392>>379 string I/O\ Error\ reading\ boot\ sector\r \b, simple Visopsys MBR 5393# bootloader, bootmanager 5394>0x40 string SBML 5395# label with 11 characters of FAT 12 bit filesystem 5396>>43 string SMART\ BTMGR 5397>>>430 string SBMK\ Bad!\r \b, Smart Boot Manager 5398# OEM-ID not always "SBM" 5399#>>>>3 strings SBM 5400>>>>6 string >\0 \b, version %s 5401>382 string XOSLLOADXCF \b, eXtended Operating System Loader 5402>6 string LILO \b, LInux i386 boot LOader 5403>>120 string LILO \b, version 22.3.4 SuSe 5404>>172 string LILO \b, version 22.5.8 Debian 5405# updated by Joerg Jenderek at Oct 2008 5406# variables according to grub-0.97/stage1/stage1.S or 5407# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data 5408# usual values are marked with comments to get only informations of strange GRUB loaders 5409>342 search/60 \0Geom\0 5410#>0 ulelong x %x=0x009048EB , 0x2a9048EB 0 5411>>0x41 ubyte <2 5412>>>0x3E ubyte >2 \b; GRand Unified Bootloader 5413# 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90 5414>>>>0x3E ubyte x \b, stage1 version 0x%x 5415#If it is 0xFF, use a drive passed by BIOS 5416>>>>0x40 ubyte <0xFF \b, boot drive 0x%x 5417# in most case 0,1,0x2e for GRUB 0.5.95 5418>>>>0x41 ubyte >0 \b, LBA flag 0x%x 5419>>>>0x42 uleshort <0x8000 \b, stage2 address 0x%x 5420#>>>>0x42 uleshort =0x8000 \b, stage2 address 0x%x (usual) 5421>>>>0x42 uleshort >0x8000 \b, stage2 address 0x%x 5422#>>>>0x44 ulelong =1 \b, 1st sector stage2 0x%x (default) 5423>>>>0x44 ulelong >1 \b, 1st sector stage2 0x%x 5424>>>>0x48 uleshort <0x800 \b, stage2 segment 0x%x 5425#>>>>0x48 uleshort =0x800 \b, stage2 segment 0x%x (usual) 5426>>>>0x48 uleshort >0x800 \b, stage2 segment 0x%x 5427>>>>402 string Geom\0Hard\ Disk\0Read\0\ Error\0 5428>>>>>394 string stage1 \b, GRUB version 0.5.95 5429>>>>382 string Geom\0Hard\ Disk\0Read\0\ Error\0 5430>>>>>376 string GRUB\ \0 \b, GRUB version 0.93 or 1.94 5431>>>>383 string Geom\0Hard\ Disk\0Read\0\ Error\0 5432>>>>>377 string GRUB\ \0 \b, GRUB version 0.94 5433>>>>385 string Geom\0Hard\ Disk\0Read\0\ Error\0 5434>>>>>379 string GRUB\ \0 \b, GRUB version 0.95 or 0.96 5435>>>>391 string Geom\0Hard\ Disk\0Read\0\ Error\0 5436>>>>>385 string GRUB\ \0 \b, GRUB version 0.97 5437#unkown version 5438>>>343 string Geom\0Read\0\ Error\0 5439>>>>321 string Loading\ stage1.5 \b, GRUB version x.y 5440>>>380 string Geom\0Hard\ Disk\0Read\0\ Error\0 5441>>>>374 string GRUB\ \0 \b, GRUB version n.m 5442# http://syslinux.zytor.com/ 5443>478 string Boot\ failed\r 5444>>495 string LDLINUX\ SYS \b, SYSLINUX bootloader (1.62) 5445>480 string Boot\ failed\r 5446>>495 string LDLINUX\ SYS \b, SYSLINUX bootloader (2.06 or 2.11) 5447>484 string Boot\ error\r \b, SYSLINUX bootloader (3.11) 5448>395 string chksum\0\ ERROR!\0 \b, Gujin bootloader 5449# http://www.bcdwb.de/bcdw/index_e.htm 5450>3 string BCDL 5451>>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z) 5452# mbr partition table entries 5453# OEM-ID does not contain MicroSoft,NEWLDR,DOS,SYSLINUX,or MTOOLs 5454>3 string !MS 5455>>3 string !SYSLINUX 5456>>>3 string !MTOOL 5457>>>>3 string !NEWLDR 5458>>>>>5 string !DOS 5459# not FAT (32 bit) 5460>>>>>>82 string !FAT32 5461#not Linux kernel 5462>>>>>>>514 string !HdrS 5463#not BeOS 5464>>>>>>>>422 string !Be\ Boot\ Loader 5465# active flag 0 or 0x80 and type > 0 5466>>>>>>>>>446 ubyte <0x81 5467>>>>>>>>>>446 ubyte&0x7F 0 5468>>>>>>>>>>>450 ubyte >0 \b; partition 1: ID=0x%x 5469>>>>>>>>>>>>446 ubyte 0x80 \b, active 5470>>>>>>>>>>>>447 ubyte x \b, starthead %u 5471#>>>>>>>>>>>>448 ubyte x \b, start C_S: 0x%x 5472#>>>>>>>>>>>>448 ubeshort&1023 x \b, startcylinder? %d 5473>>>>>>>>>>>>454 ulelong x \b, startsector %u 5474>>>>>>>>>>>>458 ulelong x \b, %u sectors 5475# 5476>>>>>>>>>462 ubyte <0x81 5477>>>>>>>>>>462 ubyte&0x7F 0 5478>>>>>>>>>>>466 ubyte >0 \b; partition 2: ID=0x%x 5479>>>>>>>>>>>>462 ubyte 0x80 \b, active 5480>>>>>>>>>>>>463 ubyte x \b, starthead %u 5481#>>>>>>>>>>>>464 ubyte x \b, start C_S: 0x%x 5482#>>>>>>>>>>>>464 ubeshort&1023 x \b, startcylinder? %d 5483>>>>>>>>>>>>470 ulelong x \b, startsector %u 5484>>>>>>>>>>>>474 ulelong x \b, %u sectors 5485# 5486>>>>>>>>>478 ubyte <0x81 5487>>>>>>>>>>478 ubyte&0x7F 0 5488>>>>>>>>>>>482 ubyte >0 \b; partition 3: ID=0x%x 5489>>>>>>>>>>>>478 ubyte 0x80 \b, active 5490>>>>>>>>>>>>479 ubyte x \b, starthead %u 5491#>>>>>>>>>>>>480 ubyte x \b, start C_S: 0x%x 5492#>>>>>>>>>>>>481 ubyte x \b, start C2S: 0x%x 5493#>>>>>>>>>>>>480 ubeshort&1023 x \b, startcylinder? %d 5494>>>>>>>>>>>>486 ulelong x \b, startsector %u 5495>>>>>>>>>>>>490 ulelong x \b, %u sectors 5496# 5497>>>>>>>>>494 ubyte <0x81 5498>>>>>>>>>>494 ubyte&0x7F 0 5499>>>>>>>>>>>498 ubyte >0 \b; partition 4: ID=0x%x 5500>>>>>>>>>>>>494 ubyte 0x80 \b, active 5501>>>>>>>>>>>>495 ubyte x \b, starthead %u 5502#>>>>>>>>>>>>496 ubyte x \b, start C_S: 0x%x 5503#>>>>>>>>>>>>496 ubeshort&1023 x \b, startcylinder? %d 5504>>>>>>>>>>>>502 ulelong x \b, startsector %u 5505>>>>>>>>>>>>506 ulelong x \b, %u sectors 5506# mbr partition table entries end 5507# http://www.acronis.de/ 5508#FAT label=ACRONIS\ SZ 5509#OEM-ID=BOOTWIZ0 5510>442 string Non-system\ disk,\ 5511>>459 string press\ any\ key...\x7\0 \b, Acronis Startup Recovery Loader 5512# DOS names like F11.SYS are 8 right space padded bytes+3 bytes 5513>>>477 ubyte&0xDF >0 5514>>>>477 string x \b %-.3s 5515>>>>>480 ubyte&0xDF >0 5516>>>>>>480 string x \b%-.5s 5517>>>>485 ubyte&0xDF >0 5518>>>>>485 string x \b.%-.3s 5519# 5520>185 string FDBOOT\ Version\ 5521>>204 string \rNo\ Systemdisk.\ 5522>>>220 string Booting\ from\ harddisk.\n\r 5523>>>245 string Cannot\ load\ from\ harddisk.\n\r 5524>>>>273 string Insert\ Systemdisk\ 5525>>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader 5526>>>>>>200 string >\0 \b, version %-3s 5527>242 string Bootsector\ from\ C.H.\ Hochst\204 5528>>278 string No\ Systemdisk.\ 5529>>>293 string Booting\ from\ harddisk.\n\r 5530>>>441 string Cannot\ load\ from\ harddisk.\n\r 5531>>>>469 string Insert\ Systemdisk\ 5532>>>>>487 string and\ press\ any\ key.\n\r \b, WinImage harddisk Bootloader 5533>>>>>>209 string >\0 \b, version %-4.4s 5534>(1.b+2) ubyte 0xe 5535>>(1.b+3) ubyte 0x1f 5536>>>(1.b+4) ubyte 0xbe 5537>>>>(1.b+5) ubyte 0x77 5538>>>>(1.b+6) ubyte 0x7c 5539>>>>>(1.b+7) ubyte 0xac 5540>>>>>>(1.b+8) ubyte 0x22 5541>>>>>>>(1.b+9) ubyte 0xc0 5542>>>>>>>>(1.b+10) ubyte 0x74 5543>>>>>>>>>(1.b+11) ubyte 0xb 5544>>>>>>>>>>(1.b+12) ubyte 0x56 5545>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display 5546>214 string Please\ try\ to\ install\ FreeDOS\ \b, DOS Emulator boot message display 5547#>>244 string from\ dosemu-freedos-*-bin.tgz\r 5548#>>>170 string Sorry,\ could\ not\ load\ an\ 5549#>>>>195 string operating\ system.\r\n 5550# 5551>103 string This\ is\ not\ a\ bootable\ disk.\ 5552>>132 string Please\ insert\ a\ bootable\ 5553>>>157 string floppy\ and\r\n 5554>>>>169 string press\ any\ key\ to\ try\ again...\r \b, FREE-DOS message display 5555# 5556>66 string Solaris\ Boot\ Sector 5557>>99 string Incomplete\ MDBoot\ load. 5558>>>89 string Version \b, Sun Solaris Bootloader 5559>>>>97 byte x version %c 5560# 5561>408 string OS/2\ !!\ SYS01475\r\0 5562>>429 string OS/2\ !!\ SYS02025\r\0 5563>>>450 string OS/2\ !!\ SYS02027\r\0 5564>>>469 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp bootloader 5565# 5566>409 string OS/2\ !!\ SYS01475\r\0 5567>>430 string OS/2\ !!\ SYS02025\r\0 5568>>>451 string OS/2\ !!\ SYS02027\r\0 5569>>>470 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp Bootloader 5570>112 string This\ disk\ is\ not\ bootable\r 5571>>142 string If\ you\ wish\ to\ make\ it\ bootable 5572>>>176 string run\ the\ DOS\ program\ SYS\ 5573>>>200 string after\ the\r 5574>>>>216 string system\ has\ been\ loaded\r\n 5575>>>>>242 string Please\ insert\ a\ DOS\ diskette\ 5576>>>>>271 string into\r\n\ the\ drive\ and\ 5577>>>>>>292 string strike\ any\ key...\0 \b, IBM OS/2 Warp message display 5578# XP 5579>430 string NTLDR\ is\ missing\xFF\r\n 5580>>449 string Disk\ error\xFF\r\n 5581>>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader 5582# DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes 5583>>>>417 ubyte&0xDF >0 5584>>>>>417 string x %-.5s 5585>>>>>>422 ubyte&0xDF >0 5586>>>>>>>422 string x \b%-.3s 5587>>>>>425 ubyte&0xDF >0 5588>>>>>>425 string >\ \b.%-.3s 5589# 5590>>>>371 ubyte >0x20 5591>>>>>368 ubyte&0xDF >0 5592>>>>>>368 string x %-.5s 5593>>>>>>>373 ubyte&0xDF >0 5594>>>>>>>>373 string x \b%-.3s 5595>>>>>>376 ubyte&0xDF >0 5596>>>>>>>376 string x \b.%-.3s 5597# 5598>430 string NTLDR\ nicht\ gefunden\xFF\r\n 5599>>453 string Datentr\204gerfehler\xFF\r\n 5600>>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german) 5601>>>>417 ubyte&0xDF >0 5602>>>>>417 string x %-.5s 5603>>>>>>422 ubyte&0xDF >0 5604>>>>>>>422 string x \b%-.3s 5605>>>>>425 ubyte&0xDF >0 5606>>>>>>425 string >\ \b.%-.3s 5607# offset variant 5608>>>>379 string \0 5609>>>>>368 ubyte&0xDF >0 5610>>>>>>368 string x %-.5s 5611>>>>>>>373 ubyte&0xDF >0 5612>>>>>>>>373 string x \b%-.3s 5613# 5614>430 string NTLDR\ fehlt\xFF\r\n 5615>>444 string Datentr\204gerfehler\xFF\r\n 5616>>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german) 5617>>>>417 ubyte&0xDF >0 5618>>>>>417 string x %-.5s 5619>>>>>>422 ubyte&0xDF >0 5620>>>>>>>422 string x \b%-.3s 5621>>>>>425 ubyte&0xDF >0 5622>>>>>>425 string >\ \b.%-.3s 5623# variant 5624>>>>371 ubyte >0x20 5625>>>>>368 ubyte&0xDF >0 5626>>>>>>368 string x %-.5s 5627>>>>>>>373 ubyte&0xDF >0 5628>>>>>>>>373 string x \b%-.3s 5629>>>>>>376 ubyte&0xDF >0 5630>>>>>>>376 string x \b.%-.3s 5631# 5632>430 string NTLDR\ fehlt\xFF\r\n 5633>>444 string Medienfehler\xFF\r\n 5634>>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german) 5635>>>>371 ubyte >0x20 5636>>>>>368 ubyte&0xDF >0 5637>>>>>>368 string x %-.5s 5638>>>>>>>373 ubyte&0xDF >0 5639>>>>>>>>373 string x \b%-.3s 5640>>>>>>376 ubyte&0xDF >0 5641>>>>>>>376 string x \b.%-.3s 5642# variant 5643>>>>417 ubyte&0xDF >0 5644>>>>>417 string x %-.5s 5645>>>>>>422 ubyte&0xDF >0 5646>>>>>>>422 string x \b%-.3s 5647>>>>>425 ubyte&0xDF >0 5648>>>>>>425 string >\ \b.%-.3s 5649# 5650>430 string Datentr\204ger\ entfernen\xFF\r\n 5651>>454 string Medienfehler\xFF\r\n 5652>>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german) 5653>>>>379 string \0 5654>>>>>368 ubyte&0xDF >0 5655>>>>>>368 string x %-.5s 5656>>>>>>>373 ubyte&0xDF >0 5657>>>>>>>>373 string x \b%-.3s 5658>>>>>>376 ubyte&0xDF >0 5659>>>>>>>376 string x \b.%-.3s 5660# variant 5661>>>>417 ubyte&0xDF >0 5662>>>>>417 string x %-.5s 5663>>>>>>422 ubyte&0xDF >0 5664>>>>>>>422 string x \b%-.3s 5665>>>>>425 ubyte&0xDF >0 5666>>>>>>425 string >\ \b.%-.3s 5667# 5668 5669#>3 string NTFS\ \ \ \ 5670>389 string Fehler\ beim\ Lesen\ 5671>>407 string des\ Datentr\204gers 5672>>>426 string NTLDR\ fehlt 5673>>>>440 string NTLDR\ ist\ komprimiert 5674>>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german) 5675#>3 string NTFS\ \ \ \ 5676>313 string A\ disk\ read\ error\ occurred.\r 5677>>345 string A\ kernel\ file\ is\ missing\ 5678>>>370 string from\ the\ disk.\r 5679>>>>484 string NTLDR\ is\ compressed 5680>>>>>429 string Insert\ a\ system\ diskette\ 5681>>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS 5682# DOS loader variants different languages,offsets 5683>472 ubyte&0xDF >0 5684>>389 string Invalid\ system\ disk\xFF\r\n 5685>>>411 string Disk\ I/O\ error 5686>>>>428 string Replace\ the\ disk,\ and\ 5687>>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader 5688#IO.SYS 5689>>>>>>472 ubyte&0xDF >0 5690>>>>>>>472 string x \b %-.2s 5691>>>>>>>>474 ubyte&0xDF >0 5692>>>>>>>>>474 string x \b%-.5s 5693>>>>>>>>>>479 ubyte&0xDF >0 5694>>>>>>>>>>>479 string x \b%-.1s 5695>>>>>>>480 ubyte&0xDF >0 5696>>>>>>>>480 string x \b.%-.3s 5697#MSDOS.SYS 5698>>>>>>>483 ubyte&0xDF >0 \b+ 5699>>>>>>>>483 string x \b%-.5s 5700>>>>>>>>>488 ubyte&0xDF >0 5701>>>>>>>>>>488 string x \b%-.3s 5702>>>>>>>>491 ubyte&0xDF >0 5703>>>>>>>>>491 string x \b.%-.3s 5704# 5705>>390 string Invalid\ system\ disk\xFF\r\n 5706>>>412 string Disk\ I/O\ error\xFF\r\n 5707>>>>429 string Replace\ the\ disk,\ and\ 5708>>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader 5709>>388 string Ungueltiges\ System\ \xFF\r\n 5710>>>410 string E/A-Fehler\ \ \ \ \xFF\r\n 5711>>>>427 string Datentraeger\ wechseln\ und\ 5712>>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german) 5713#WINBOOT.SYS only not spaces (0xDF) 5714>>>>>>497 ubyte&0xDF >0 5715>>>>>>>497 string x %-.5s 5716>>>>>>>>502 ubyte&0xDF >0 5717>>>>>>>>>502 string x \b%-.1s 5718>>>>>>>>>>503 ubyte&0xDF >0 5719>>>>>>>>>>>503 string x \b%-.1s 5720>>>>>>>>>>>>504 ubyte&0xDF >0 5721>>>>>>>>>>>>>504 string x \b%-.1s 5722>>>>>>505 ubyte&0xDF >0 5723>>>>>>>505 string x \b.%-.3s 5724#IO.SYS 5725>>>>>>472 ubyte&0xDF >0 or 5726>>>>>>>472 string x \b %-.2s 5727>>>>>>>>474 ubyte&0xDF >0 5728>>>>>>>>>474 string x \b%-.5s 5729>>>>>>>>>>479 ubyte&0xDF >0 5730>>>>>>>>>>>479 string x \b%-.1s 5731>>>>>>>480 ubyte&0xDF >0 5732>>>>>>>>480 string x \b.%-.3s 5733#MSDOS.SYS 5734>>>>>>>483 ubyte&0xDF >0 \b+ 5735>>>>>>>>483 string x \b%-.5s 5736>>>>>>>>>488 ubyte&0xDF >0 5737>>>>>>>>>>488 string x \b%-.3s 5738>>>>>>>>491 ubyte&0xDF >0 5739>>>>>>>>>491 string x \b.%-.3s 5740# 5741>>390 string Ungueltiges\ System\ \xFF\r\n 5742>>>412 string E/A-Fehler\ \ \ \ \xFF\r\n 5743>>>>429 string Datentraeger\ wechseln\ und\ 5744>>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German) 5745#WINBOOT.SYS only not spaces (0xDF) 5746>>>>>>497 ubyte&0xDF >0 5747>>>>>>>497 string x %-.7s 5748>>>>>>>>504 ubyte&0xDF >0 5749>>>>>>>>>504 string x \b%-.1s 5750>>>>>>505 ubyte&0xDF >0 5751>>>>>>>505 string x \b.%-.3s 5752#IO.SYS 5753>>>>>>472 ubyte&0xDF >0 or 5754>>>>>>>472 string x \b %-.2s 5755>>>>>>>>474 ubyte&0xDF >0 5756>>>>>>>>>474 string x \b%-.6s 5757>>>>>>>480 ubyte&0xDF >0 5758>>>>>>>>480 string x \b.%-.3s 5759#MSDOS.SYS 5760>>>>>>>483 ubyte&0xDF >0 \b+ 5761>>>>>>>>483 string x \b%-.5s 5762>>>>>>>>>488 ubyte&0xDF >0 5763>>>>>>>>>>488 string x \b%-.3s 5764>>>>>>>>491 ubyte&0xDF >0 5765>>>>>>>>>491 string x \b.%-.3s 5766# 5767>>389 string Ungueltiges\ System\ \xFF\r\n 5768>>>411 string E/A-Fehler\ \ \ \ \xFF\r\n 5769>>>>428 string Datentraeger\ wechseln\ und\ 5770>>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN) 5771# DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes 5772>>>>>>472 string x %-.2s 5773>>>>>>>474 ubyte&0xDF >0 5774>>>>>>>>474 string x \b%-.5s 5775>>>>>>>>479 ubyte&0xDF >0 5776>>>>>>>>>479 string x \b%-.1s 5777>>>>>>480 ubyte&0xDF >0 5778>>>>>>>480 string x \b.%-.3s 5779>>>>>>483 ubyte&0xDF >0 \b+ 5780>>>>>>>483 string x \b%-.5s 5781>>>>>>>488 ubyte&0xDF >0 5782>>>>>>>>488 string x \b%-.2s 5783>>>>>>>>490 ubyte&0xDF >0 5784>>>>>>>>>490 string x \b%-.1s 5785>>>>>>>491 ubyte&0xDF >0 5786>>>>>>>>491 string x \b.%-.3s 5787>479 ubyte&0xDF >0 5788>>416 string Kein\ System\ oder\ 5789>>>433 string Laufwerksfehler 5790>>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german) 5791#IO.SYS 5792>>>>>479 string x \b %-.2s 5793>>>>>>481 ubyte&0xDF >0 5794>>>>>>>481 string x \b%-.6s 5795>>>>>487 ubyte&0xDF >0 5796>>>>>>487 string x \b.%-.3s 5797#MSDOS.SYS 5798>>>>>>490 ubyte&0xDF >0 \b+ 5799>>>>>>>490 string x \b%-.5s 5800>>>>>>>>495 ubyte&0xDF >0 5801>>>>>>>>>495 string x \b%-.3s 5802>>>>>>>498 ubyte&0xDF >0 5803>>>>>>>>498 string x \b.%-.3s 5804# 5805>376 search/41 Non-System\ disk\ or\ 5806>>395 search/41 disk\ error\r 5807>>>407 search/41 Replace\ and\ 5808>>>>419 search/41 press\ \b, 5809>>>>419 search/41 strike\ \b, old 5810>>>>426 search/41 any\ key\ when\ ready\r MS or PC-DOS bootloader 5811#449 Disk\ Boot\ failure\r MS 3.21 5812#466 Boot\ Failure\r MS 3.30 5813>>>>>468 search/18 \0 5814#IO.SYS,IBMBIO.COM 5815>>>>>>&0 string x \b %-.2s 5816>>>>>>>&-20 ubyte&0xDF >0 5817>>>>>>>>&-1 string x \b%-.4s 5818>>>>>>>>>&-16 ubyte&0xDF >0 5819>>>>>>>>>>&-1 string x \b%-.2s 5820>>>>>>&8 ubyte&0xDF >0 \b. 5821>>>>>>>&-1 string x \b%-.3s 5822#MSDOS.SYS,IBMDOS.COM 5823>>>>>>&11 ubyte&0xDF >0 \b+ 5824>>>>>>>&-1 string x \b%-.5s 5825>>>>>>>>&-6 ubyte&0xDF >0 5826>>>>>>>>>&-1 string x \b%-.1s 5827>>>>>>>>>>&-5 ubyte&0xDF >0 5828>>>>>>>>>>>&-1 string x \b%-.2s 5829>>>>>>>&7 ubyte&0xDF >0 \b. 5830>>>>>>>>&-1 string x \b%-.3s 5831>441 string Cannot\ load\ from\ harddisk.\n\r 5832>>469 string Insert\ Systemdisk\ 5833>>>487 string and\ press\ any\ key.\n\r \b, MS (2.11) DOS bootloader 5834#>43 string \224R-LOADER\ \ SYS =label 5835>54 string SYS 5836>>324 string VASKK 5837>>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS) 5838# 5839>98 string Press\ a\ key\ to\ retry\0\r 5840>>120 string Cannot\ find\ file\ \0\r 5841>>>139 string Disk\ read\ error\0\r 5842>>>>156 string Loading\ ...\0 \b, DR-DOS (3.41) Bootloader 5843#DRBIOS.SYS 5844>>>>>44 ubyte&0xDF >0 5845>>>>>>44 string x \b %-.6s 5846>>>>>>>50 ubyte&0xDF >0 5847>>>>>>>>50 string x \b%-.2s 5848>>>>>>52 ubyte&0xDF >0 5849>>>>>>>52 string x \b.%-.3s 5850# 5851>70 string IBMBIO\ \ COM 5852>>472 string Cannot\ load\ DOS!\ 5853>>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader 5854>>471 string Cannot\ load\ DOS\ 5855>>487 string press\ key\ to\ retry \b, Open-DOS Bootloader 5856#?? 5857>444 string KERNEL\ \ SYS 5858>>314 string BOOT\ error! \b, FREE-DOS Bootloader 5859>499 string KERNEL\ \ SYS 5860>>305 string BOOT\ err!\0 \b, Free-DOS Bootloader 5861>449 string KERNEL\ \ SYS 5862>>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader 5863# 5864>449 string Loading\ FreeDOS 5865>>0x1AF ulelong >0 \b, FREE-DOS 0.95,1.0 Bootloader 5866>>>497 ubyte&0xDF >0 5867>>>>497 string x \b %-.6s 5868>>>>>503 ubyte&0xDF >0 5869>>>>>>503 string x \b%-.1s 5870>>>>>>>504 ubyte&0xDF >0 5871>>>>>>>>504 string x \b%-.1s 5872>>>>505 ubyte&0xDF >0 5873>>>>>505 string x \b.%-.3s 5874# 5875>331 string Error!.0 \b, FREE-DOS 1.0 bootloader 5876# 5877>125 string Loading\ FreeDOS...\r 5878>>311 string BOOT\ error!\r \b, FREE-DOS bootloader 5879>>>441 ubyte&0xDF >0 5880>>>>441 string x \b %-.6s 5881>>>>>447 ubyte&0xDF >0 5882>>>>>>447 string x \b%-.1s 5883>>>>>>>448 ubyte&0xDF >0 5884>>>>>>>>448 string x \b%-.1s 5885>>>>449 ubyte&0xDF >0 5886>>>>>449 string x \b.%-.3s 5887>124 string FreeDOS\0 5888>>331 string \ err\0 \b, FREE-DOS BETa 0.9 Bootloader 5889# DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes 5890>>>497 ubyte&0xDF >0 5891>>>>497 string x \b %-.6s 5892>>>>>503 ubyte&0xDF >0 5893>>>>>>503 string x \b%-.1s 5894>>>>>>>504 ubyte&0xDF >0 5895>>>>>>>>504 string x \b%-.1s 5896>>>>505 ubyte&0xDF >0 5897>>>>>505 string x \b.%-.3s 5898>>333 string \ err\0 \b, FREE-DOS BEta 0.9 Bootloader 5899>>>497 ubyte&0xDF >0 5900>>>>497 string x \b %-.6s 5901>>>>>503 ubyte&0xDF >0 5902>>>>>>503 string x \b%-.1s 5903>>>>>>>504 ubyte&0xDF >0 5904>>>>>>>>504 string x \b%-.1s 5905>>>>505 ubyte&0xDF >0 5906>>>>>505 string x \b.%-.3s 5907>>334 string \ err\0 \b, FREE-DOS Beta 0.9 Bootloader 5908>>>497 ubyte&0xDF >0 5909>>>>497 string x \b %-.6s 5910>>>>>503 ubyte&0xDF >0 5911>>>>>>503 string x \b%-.1s 5912>>>>>>>504 ubyte&0xDF >0 5913>>>>>>>>504 string x \b%-.1s 5914>>>>505 ubyte&0xDF >0 5915>>>>>505 string x \b.%-.3s 5916>336 string Error!\ 5917>>343 string Hit\ a\ key\ to\ reboot. \b, FREE-DOS Beta 0.9sr1 Bootloader 5918>>>497 ubyte&0xDF >0 5919>>>>497 string x \b %-.6s 5920>>>>>503 ubyte&0xDF >0 5921>>>>>>503 string x \b%-.1s 5922>>>>>>>504 ubyte&0xDF >0 5923>>>>>>>>504 string x \b%-.1s 5924>>>>505 ubyte&0xDF >0 5925>>>>>505 string x \b.%-.3s 5926# added by Joerg Jenderek 5927# http://www.visopsys.org/ 5928# http://partitionlogic.org.uk/ 5929# OEM-ID=Visopsys 5930>478 ulelong 0 5931>>(1.b+326) string I/O\ Error\ reading\ 5932>>>(1.b+344) string Visopsys\ loader\r 5933>>>>(1.b+361) string Press\ any\ key\ to\ continue.\r \b, Visopsys loader 5934# http://alexfru.chat.ru/epm.html#bootprog 5935>494 ubyte >0x4D 5936>>495 string >E 5937>>>495 string <S 5938#OEM-ID is not reliable 5939>>>>3 string BootProg 5940# It just looks for a program file name at the root directory 5941# and loads corresponding file with following execution. 5942# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes 5943>>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader 5944>>>>>499 string x \b %-.1s 5945>>>>>>500 ubyte&0xDF >0 5946>>>>>>>500 string x \b%-.1s 5947>>>>>>>>501 ubyte&0xDF >0 5948>>>>>>>>>501 string x \b%-.1s 5949>>>>>>>>>>502 ubyte&0xDF >0 5950>>>>>>>>>>>502 string x \b%-.1s 5951>>>>>>>>>>>>503 ubyte&0xDF >0 5952>>>>>>>>>>>>>503 string x \b%-.1s 5953>>>>>>>>>>>>>>504 ubyte&0xDF >0 5954>>>>>>>>>>>>>>>504 string x \b%-.1s 5955>>>>>>>>>>>>>>>>505 ubyte&0xDF >0 5956>>>>>>>>>>>>>>>>>505 string x \b%-.1s 5957>>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0 5958>>>>>>>>>>>>>>>>>>>506 string x \b%-.1s 5959#name extension 5960>>>>>507 ubyte&0xDF >0 \b. 5961>>>>>>507 string x \b%-.1s 5962>>>>>>>508 ubyte&0xDF >0 5963>>>>>>>>508 string x \b%-.1s 5964>>>>>>>>>509 ubyte&0xDF >0 5965>>>>>>>>>>509 string x \b%-.1s 5966#If the boot sector fails to read any other sector, 5967#it prints a very short message ("RE") to the screen and hangs the computer. 5968#If the boot sector fails to find needed program in the root directory, 5969#it also hangs with another message ("NF"). 5970>>>>>492 string RENF \b, FAT (12 bit) 5971>>>>>495 string RENF \b, FAT (16 bit) 5972# http://alexfru.chat.ru/epm.html#bootprog 5973>494 ubyte >0x4D 5974>>495 string >E 5975>>>495 string <S 5976#OEM-ID is not reliable 5977>>>>3 string BootProg 5978# It just looks for a program file name at the root directory 5979# and loads corresponding file with following execution. 5980# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes 5981>>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader 5982>>>>>499 string x \b %-.1s 5983>>>>>>500 ubyte&0xDF >0 5984>>>>>>>500 string x \b%-.1s 5985>>>>>>>>501 ubyte&0xDF >0 5986>>>>>>>>>501 string x \b%-.1s 5987>>>>>>>>>>502 ubyte&0xDF >0 5988>>>>>>>>>>>502 string x \b%-.1s 5989>>>>>>>>>>>>503 ubyte&0xDF >0 5990>>>>>>>>>>>>>503 string x \b%-.1s 5991>>>>>>>>>>>>>>504 ubyte&0xDF >0 5992>>>>>>>>>>>>>>>504 string x \b%-.1s 5993>>>>>>>>>>>>>>>>505 ubyte&0xDF >0 5994>>>>>>>>>>>>>>>>>505 string x \b%-.1s 5995>>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0 5996>>>>>>>>>>>>>>>>>>>506 string x \b%-.1s 5997#name extension 5998>>>>>507 ubyte&0xDF >0 \b. 5999>>>>>>507 string x \b%-.1s 6000>>>>>>>508 ubyte&0xDF >0 6001>>>>>>>>508 string x \b%-.1s 6002>>>>>>>>>509 ubyte&0xDF >0 6003>>>>>>>>>>509 string x \b%-.1s 6004#If the boot sector fails to read any other sector, 6005#it prints a very short message ("RE") to the screen and hangs the computer. 6006#If the boot sector fails to find needed program in the root directory, 6007#it also hangs with another message ("NF"). 6008>>>>>492 string RENF \b, FAT (12 bit) 6009>>>>>495 string RENF \b, FAT (16 bit) 6010# x86 bootloader end 6011# updated by Joerg Jenderek at Sep 2007 6012>3 ubyte 0 6013#no active flag 6014>>446 ubyte 0 6015# partition 1 not empty 6016>>>450 ubyte >0 6017# partitions 3,4 empty 6018>>>>482 ubyte 0 6019>>>>>498 ubyte 0 6020# partition 2 ID=0,5,15 6021>>>>>>466 ubyte <0x10 6022>>>>>>>466 ubyte 0x05 \b, extended partition table 6023>>>>>>>466 ubyte 0x0F \b, extended partition table (LBA) 6024>>>>>>>466 ubyte 0x0 \b, extended partition table (last) 6025# JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90 6026# http://mirror.href.com/thestarman/asm/2bytejumps.htmm#FWD 6027# older drives may use Near JuMP instruction E9 xx xx 6028>0 lelong&0x009000EB 0x009000EB 6029>0 lelong&0x000000E9 0x000000E9 6030# minimal short forward jump found 03cx?? 6031# maximal short forward jump is 07fx 6032>1 ubyte <0xff \b, code offset 0x%x 6033# mtools-3.9.8/msdos.h 6034# usual values are marked with comments to get only informations of strange FAT systems 6035# valid sectorsize must be a power of 2 from 32 to 32768 6036>>11 uleshort&0x000f x 6037>>>11 uleshort <32769 6038>>>>11 uleshort >31 6039>>>>>21 ubyte&0xf0 0xF0 6040>>>>>>3 string >\0 \b, OEM-ID "%8.8s" 6041#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC 6042>>>>>>>8 string IHC \b cached by Windows 9M 6043>>>>>>11 uleshort >512 \b, Bytes/sector %u 6044#>>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual) 6045>>>>>>11 uleshort <512 \b, Bytes/sector %u 6046>>>>>>13 ubyte >1 \b, sectors/cluster %u 6047#>>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies) 6048>>>>>>14 uleshort >32 \b, reserved sectors %u 6049#>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32) 6050#>>>>>>14 uleshort >1 \b, reserved sectors %u 6051#>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16) 6052>>>>>>14 uleshort <1 \b, reserved sectors %u 6053>>>>>>16 ubyte >2 \b, FATs %u 6054#>>>>>>16 ubyte =2 \b, FATs %u (usual) 6055>>>>>>16 ubyte =1 \b, FAT %u 6056>>>>>>16 ubyte >0 6057>>>>>>17 uleshort >0 \b, root entries %u 6058#>>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32) 6059>>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB) 6060#>>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32) 6061>>>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x 6062#>>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy) 6063>>>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x 6064>>>>>>22 uleshort >0 \b, sectors/FAT %u 6065#>>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32) 6066>>>>>>26 ubyte >2 \b, heads %u 6067#>>>>>>26 ubyte =2 \b, heads %u (usual floppy) 6068>>>>>>26 ubyte =1 \b, heads %u 6069#skip for Digital Research DOS (version 3.41) 1440 kB Bootdisk 6070>>>>>>38 ubyte !0x70 6071>>>>>>>28 ulelong >0 \b, hidden sectors %u 6072#>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy) 6073>>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB) 6074#>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB) 6075# FAT<32 specific 6076>>>>>>82 string !FAT32 6077#>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk) 6078#>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy) 6079>>>>>>>36 ubyte !0x80 6080>>>>>>>>36 ubyte !0 \b, physical drive 0x%x 6081>>>>>>>37 ubyte >0 \b, reserved 0x%x 6082#>>>>>>>37 ubyte =0 \b, reserved 0x%x 6083>>>>>>>38 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x) 6084>>>>>>>38 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x) 6085>>>>>>>38 ubyte =0x29 6086>>>>>>>>39 ulelong x \b, serial number 0x%x 6087>>>>>>>>43 string <NO\ NAME \b, label: "%11.11s" 6088>>>>>>>>43 string >NO\ NAME \b, label: "%11.11s" 6089>>>>>>>>43 string =NO\ NAME \b, unlabeled 6090>>>>>>>54 string FAT \b, FAT 6091>>>>>>>>54 string FAT12 \b (12 bit) 6092>>>>>>>>54 string FAT16 \b (16 bit) 6093# FAT32 specific 6094>>>>>>82 string FAT32 \b, FAT (32 bit) 6095>>>>>>>36 ulelong x \b, sectors/FAT %u 6096>>>>>>>40 uleshort >0 \b, extension flags %u 6097#>>>>>>>40 uleshort =0 \b, extension flags %u 6098>>>>>>>42 uleshort >0 \b, fsVersion %u 6099#>>>>>>>42 uleshort =0 \b, fsVersion %u (usual) 6100>>>>>>>44 ulelong >2 \b, rootdir cluster %u 6101#>>>>>>>44 ulelong =2 \b, rootdir cluster %u 6102#>>>>>>>44 ulelong =1 \b, rootdir cluster %u 6103>>>>>>>48 uleshort >1 \b, infoSector %u 6104#>>>>>>>48 uleshort =1 \b, infoSector %u (usual) 6105>>>>>>>48 uleshort <1 \b, infoSector %u 6106>>>>>>>50 uleshort >6 \b, Backup boot sector %u 6107#>>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual) 6108>>>>>>>50 uleshort <6 \b, Backup boot sector %u 6109>>>>>>>54 ulelong >0 \b, reserved1 0x%x 6110>>>>>>>58 ulelong >0 \b, reserved2 0x%x 6111>>>>>>>62 ulelong >0 \b, reserved3 0x%x 6112# same structure as FAT1X 6113>>>>>>>64 ubyte >0x80 \b, physical drive 0x%x 6114#>>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk) 6115>>>>>>>64 ubyte&0x7F >0 \b, physical drive 0x%x 6116#>>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy) 6117>>>>>>>65 ubyte >0 \b, reserved 0x%x 6118>>>>>>>66 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x) 6119>>>>>>>66 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x) 6120>>>>>>>66 ubyte =0x29 6121>>>>>>>>67 ulelong x \b, serial number 0x%x 6122>>>>>>>>71 string <NO\ NAME \b, label: "%11.11s" 6123>>>>>>>71 string >NO\ NAME \b, label: "%11.11s" 6124>>>>>>>71 string =NO\ NAME \b, unlabeled 6125### FATs end 6126>0x200 lelong 0x82564557 \b, BSD disklabel 6127# FATX 61280 string FATX FATX filesystem data 6129 6130 6131# Minix filesystems - Juan Cespedes <cespedes@debian.org> 61320x410 leshort 0x137f 6133>0x402 beshort < 100 Minix filesystem, V1, %d zones 6134>0x1e string minix \b, bootable 61350x410 beshort 0x137f 6136>0x402 beshort < 100 Minix filesystem, V1 (big endian), %d zones 6137>0x1e string minix \b, bootable 61380x410 leshort 0x138f 6139>0x402 beshort < 100 Minix filesystem, V1, 30 char names, %d zones 6140>0x1e string minix \b, bootable 61410x410 beshort 0x138f 6142>0x402 beshort < 100 Minix filesystem, V1, 30 char names (big endian), %d zones 6143>0x1e string minix \b, bootable 61440x410 leshort 0x2468 6145>0x402 beshort < 100 Minix filesystem, V2, %d zones 6146>0x1e string minix \b, bootable 61470x410 beshort 0x2468 6148>0x402 beshort < 100 Minix filesystem, V2 (big endian), %d zones 6149>0x1e string minix \b, bootable 6150 61510x410 leshort 0x2478 6152>0x402 beshort < 100 Minix filesystem, V2, 30 char names, %d zones 6153>0x1e string minix \b, bootable 61540x410 leshort 0x2478 6155>0x402 beshort < 100 Minix filesystem, V2, 30 char names, %d zones 6156>0x1e string minix \b, bootable 61570x410 beshort 0x2478 6158>0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian), %d zones 6159>0x1e string minix \b, bootable 61600x410 leshort 0x4d5a 6161>0x402 beshort !0 Minix filesystem, V3, %d zones 6162>0x1e string minix \b, bootable 6163 6164# romfs filesystems - Juan Cespedes <cespedes@debian.org> 61650 string -rom1fs- romfs filesystem, version 1 6166>8 belong x %d bytes, 6167>16 string x named %s. 6168 6169# netboot image - Juan Cespedes <cespedes@debian.org> 61700 lelong 0x1b031336L Netboot image, 6171>4 lelong&0xFFFFFF00 0 6172>>4 lelong&0x100 0x000 mode 2 6173>>4 lelong&0x100 0x100 mode 3 6174>4 lelong&0xFFFFFF00 !0 unknown mode 6175 61760x18b string OS/2 OS/2 Boot Manager 6177 6178# updated by Joerg Jenderek at Oct 2008!! 6179# http://syslinux.zytor.com/iso.php 61800 ulelong 0x7c40eafa isolinux Loader 6181# http://syslinux.zytor.com/pxe.php 61820 ulelong 0x007c05ea pxelinux Loader 61830 ulelong 0x60669c66 pxelinux Loader 6184 6185# added by Joerg Jenderek 6186# In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or 6187# grub-1.94/kern/i386/pc/startup.S 6188# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data 6189# usual values are marked with comments to get only informations of strange GRUB loaders 61900x200 uleshort 0x70EA 6191# found only version 3.{1,2} 6192>0x206 ubeshort >0x0300 6193# GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00" 6194>>0x212 ubyte >0x29 6195>>>0x213 ubyte >0x29 6196# not iso9660_stage1_5 6197#>>>0 ulelong&0x00BE5652 0x00BE5652 6198>>>>0x213 ubyte >0x29 GRand Unified Bootloader 6199# config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2" 6200>>>>0x217 ubyte 0xFF stage1_5 6201>>>>0x217 ubyte <0xFF stage2 6202>>>>0x206 ubyte x \b version %u 6203>>>>0x207 ubyte x \b.%u 6204# module_size for 1.94 6205>>>>0x208 ulelong <0xffffff \b, installed partition %u 6206#>>>>0x208 ulelong =0xffffff \b, %u (default) 6207>>>>0x208 ulelong >0xffffff \b, installed partition %u 6208# GRUB 0.5.95 unofficial 6209>>>>0x20C ulelong&0x2E300000 0x2E300000 6210# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6211>>>>>0x20C ubyte x \b, identifier 0x%x 6212#>>>>>0x20D ubyte =0 \b, LBA flag 0x%x (default) 6213>>>>>0x20D ubyte >0 \b, LBA flag 0x%x 6214# GRUB version as string 6215>>>>>0x20E string >\0 \b, GRUB version %-s 6216# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default 6217>>>>>>0x215 ulong 0xffffffff 6218>>>>>>>0x219 string >\0 \b, configuration file %-s 6219>>>>>>0x215 ulong !0xffffffff 6220>>>>>>>0x215 string >\0 \b, configuration file %-s 6221# newer GRUB versions 6222>>>>0x20C ulelong&0x2E300000 !0x2E300000 6223##>>>>>0x20C ulelong =0 \b, saved entry %d (usual) 6224>>>>>0x20C ulelong >0 \b, saved entry %d 6225# for 1.94 contains kernel image size 6226# for 0.93,0.94,0.96,0.97 6227# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2 6228>>>>>0x210 ubyte x \b, identifier 0x%x 6229# The flag for LBA forcing is in most cases 0 6230#>>>>>0x211 ubyte =0 \b, LBA flag 0x%x (default) 6231>>>>>0x211 ubyte >0 \b, LBA flag 0x%x 6232# GRUB version as string 6233>>>>>0x212 string >\0 \b, GRUB version %-s 6234# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default 6235>>>>>0x217 ulong 0xffffffff 6236>>>>>>0x21b string >\0 \b, configuration file %-s 6237>>>>>0x217 ulong !0xffffffff 6238>>>>>>0x217 string >\0 \b, configuration file %-s 6239 62409564 lelong 0x00011954 Unix Fast File system [v1] (little-endian), 6241>8404 string x last mounted on %s, 6242#>9504 ledate x last checked at %s, 6243>8224 ledate x last written at %s, 6244>8401 byte x clean flag %d, 6245>8228 lelong x number of blocks %d, 6246>8232 lelong x number of data blocks %d, 6247>8236 lelong x number of cylinder groups %d, 6248>8240 lelong x block size %d, 6249>8244 lelong x fragment size %d, 6250>8252 lelong x minimum percentage of free blocks %d, 6251>8256 lelong x rotational delay %dms, 6252>8260 lelong x disk rotational speed %drps, 6253>8320 lelong 0 TIME optimization 6254>8320 lelong 1 SPACE optimization 6255 625642332 lelong 0x19540119 Unix Fast File system [v2] (little-endian) 6257>&-1164 string x last mounted on %s, 6258>&-696 string >\0 volume name %s, 6259>&-304 leqldate x last written at %s, 6260>&-1167 byte x clean flag %d, 6261>&-1168 byte x readonly flag %d, 6262>&-296 lequad x number of blocks %lld, 6263>&-288 lequad x number of data blocks %lld, 6264>&-1332 lelong x number of cylinder groups %d, 6265>&-1328 lelong x block size %d, 6266>&-1324 lelong x fragment size %d, 6267>&-180 lelong x average file size %d, 6268>&-176 lelong x average number of files in dir %d, 6269>&-272 lequad x pending blocks to free %lld, 6270>&-264 lelong x pending inodes to free %ld, 6271>&-664 lequad x system-wide uuid %0llx, 6272>&-1316 lelong x minimum percentage of free blocks %d, 6273>&-1248 lelong 0 TIME optimization 6274>&-1248 lelong 1 SPACE optimization 6275 627666908 lelong 0x19540119 Unix Fast File system [v2] (little-endian) 6277>&-1164 string x last mounted on %s, 6278>&-696 string >\0 volume name %s, 6279>&-304 leqldate x last written at %s, 6280>&-1167 byte x clean flag %d, 6281>&-1168 byte x readonly flag %d, 6282>&-296 lequad x number of blocks %lld, 6283>&-288 lequad x number of data blocks %lld, 6284>&-1332 lelong x number of cylinder groups %d, 6285>&-1328 lelong x block size %d, 6286>&-1324 lelong x fragment size %d, 6287>&-180 lelong x average file size %d, 6288>&-176 lelong x average number of files in dir %d, 6289>&-272 lequad x pending blocks to free %lld, 6290>&-264 lelong x pending inodes to free %ld, 6291>&-664 lequad x system-wide uuid %0llx, 6292>&-1316 lelong x minimum percentage of free blocks %d, 6293>&-1248 lelong 0 TIME optimization 6294>&-1248 lelong 1 SPACE optimization 6295 62969564 belong 0x00011954 Unix Fast File system [v1] (big-endian), 6297>7168 belong 0x4c41424c Apple UFS Volume 6298>>7186 string x named %s, 6299>>7176 belong x volume label version %d, 6300>>7180 bedate x created on %s, 6301>8404 string x last mounted on %s, 6302#>9504 bedate x last checked at %s, 6303>8224 bedate x last written at %s, 6304>8401 byte x clean flag %d, 6305>8228 belong x number of blocks %d, 6306>8232 belong x number of data blocks %d, 6307>8236 belong x number of cylinder groups %d, 6308>8240 belong x block size %d, 6309>8244 belong x fragment size %d, 6310>8252 belong x minimum percentage of free blocks %d, 6311>8256 belong x rotational delay %dms, 6312>8260 belong x disk rotational speed %drps, 6313>8320 belong 0 TIME optimization 6314>8320 belong 1 SPACE optimization 6315 631642332 belong 0x19540119 Unix Fast File system [v2] (big-endian) 6317>&-1164 string x last mounted on %s, 6318>&-696 string >\0 volume name %s, 6319>&-304 beqldate x last written at %s, 6320>&-1167 byte x clean flag %d, 6321>&-1168 byte x readonly flag %d, 6322>&-296 bequad x number of blocks %lld, 6323>&-288 bequad x number of data blocks %lld, 6324>&-1332 belong x number of cylinder groups %d, 6325>&-1328 belong x block size %d, 6326>&-1324 belong x fragment size %d, 6327>&-180 belong x average file size %d, 6328>&-176 belong x average number of files in dir %d, 6329>&-272 bequad x pending blocks to free %lld, 6330>&-264 belong x pending inodes to free %ld, 6331>&-664 bequad x system-wide uuid %0llx, 6332>&-1316 belong x minimum percentage of free blocks %d, 6333>&-1248 belong 0 TIME optimization 6334>&-1248 belong 1 SPACE optimization 6335 633666908 belong 0x19540119 Unix Fast File system [v2] (big-endian) 6337>&-1164 string x last mounted on %s, 6338>&-696 string >\0 volume name %s, 6339>&-304 beqldate x last written at %s, 6340>&-1167 byte x clean flag %d, 6341>&-1168 byte x readonly flag %d, 6342>&-296 bequad x number of blocks %lld, 6343>&-288 bequad x number of data blocks %lld, 6344>&-1332 belong x number of cylinder groups %d, 6345>&-1328 belong x block size %d, 6346>&-1324 belong x fragment size %d, 6347>&-180 belong x average file size %d, 6348>&-176 belong x average number of files in dir %d, 6349>&-272 bequad x pending blocks to free %lld, 6350>&-264 belong x pending inodes to free %ld, 6351>&-664 bequad x system-wide uuid %0llx, 6352>&-1316 belong x minimum percentage of free blocks %d, 6353>&-1248 belong 0 TIME optimization 6354>&-1248 belong 1 SPACE optimization 6355 6356# ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca> 6357# ext4 filesystem - Eric Sandeen <sandeen@sandeen.net> 6358# volume label and UUID Russell Coker 6359# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/ 63600x438 leshort 0xEF53 Linux 6361>0x44c lelong x rev %d 6362>0x43e leshort x \b.%d 6363# No journal? ext2 6364>0x45c lelong ^0x0000004 ext2 filesystem data 6365>>0x43a leshort ^0x0000001 (mounted or unclean) 6366# Has a journal? ext3 or ext4 6367>0x45c lelong &0x0000004 6368# and small INCOMPAT? 6369>>0x460 lelong <0x0000040 6370# and small RO_COMPAT? 6371>>>0x464 lelong <0x0000008 ext3 filesystem data 6372# else large RO_COMPAT? 6373>>>0x464 lelong >0x0000007 ext4 filesystem data 6374# else large INCOMPAT? 6375>>0x460 lelong >0x000003f ext4 filesystem data 6376>0x468 belong x \b, UUID=%08x 6377>0x46c beshort x \b-%04x 6378>0x46e beshort x \b-%04x 6379>0x470 beshort x \b-%04x 6380>0x472 belong x \b-%08x 6381>0x476 beshort x \b%04x 6382>0x478 string >0 \b, volume name "%s" 6383# General flags for any ext* fs 6384>0x460 lelong &0x0000004 (needs journal recovery) 6385>0x43a leshort &0x0000002 (errors) 6386# INCOMPAT flags 6387>0x460 lelong &0x0000001 (compressed) 6388#>0x460 lelong &0x0000002 (filetype) 6389#>0x460 lelong &0x0000010 (meta bg) 6390>0x460 lelong &0x0000040 (extents) 6391>0x460 lelong &0x0000080 (64bit) 6392#>0x460 lelong &0x0000100 (mmp) 6393#>0x460 lelong &0x0000200 (flex bg) 6394# RO_INCOMPAT flags 6395#>0x464 lelong &0x0000001 (sparse super) 6396>0x464 lelong &0x0000002 (large files) 6397>0x464 lelong &0x0000008 (huge files) 6398#>0x464 lelong &0x0000010 (gdt checksum) 6399#>0x464 lelong &0x0000020 (many subdirs) 6400#>0x463 lelong &0x0000040 (extra isize) 6401 6402# SGI disk labels - Nathan Scott <nathans@debian.org> 64030 belong 0x0BE5A941 SGI disk label (volume header) 6404 6405# SGI XFS filesystem - Nathan Scott <nathans@debian.org> 64060 belong 0x58465342 SGI XFS filesystem data 6407>0x4 belong x (blksz %d, 6408>0x68 beshort x inosz %d, 6409>0x64 beshort ^0x2004 v1 dirs) 6410>0x64 beshort &0x2004 v2 dirs) 6411 6412############################################################################ 6413# Minix-ST kernel floppy 64140x800 belong 0x46fc2700 Atari-ST Minix kernel image 6415>19 string \240\5\371\5\0\011\0\2\0 \b, 720k floppy 6416>19 string \320\2\370\5\0\011\0\1\0 \b, 360k floppy 6417 6418############################################################################ 6419# Hmmm, is this a better way of detecting _standard_ floppy images ? 642019 string \320\2\360\3\0\011\0\1\0 DOS floppy 360k 6421>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 642219 string \240\5\371\3\0\011\0\2\0 DOS floppy 720k 6423>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 642419 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k 6425>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 6426 642719 string \240\5\371\5\0\011\0\2\0 DOS floppy 720k, IBM 6428>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 642919 string \100\013\371\5\0\011\0\2\0 DOS floppy 1440k, mkdosfs 6430>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 6431 643219 string \320\2\370\5\0\011\0\1\0 Atari-ST floppy 360k 643319 string \240\5\371\5\0\011\0\2\0 Atari-ST floppy 720k 6434 6435# Valid media descriptor bytes for MS-DOS: 6436# 6437# Byte Capacity Media Size and Type 6438# ------------------------------------------------- 6439# 6440# F0 2.88 MB 3.5-inch, 2-sided, 36-sector 6441# F0 1.44 MB 3.5-inch, 2-sided, 18-sector 6442# F9 720K 3.5-inch, 2-sided, 9-sector 6443# F9 1.2 MB 5.25-inch, 2-sided, 15-sector 6444# FD 360K 5.25-inch, 2-sided, 9-sector 6445# FF 320K 5.25-inch, 2-sided, 8-sector 6446# FC 180K 5.25-inch, 1-sided, 9-sector 6447# FE 160K 5.25-inch, 1-sided, 8-sector 6448# FE 250K 8-inch, 1-sided, single-density 6449# FD 500K 8-inch, 2-sided, single-density 6450# FE 1.2 MB 8-inch, 2-sided, double-density 6451# F8 ----- Fixed disk 6452# 6453# FC xxxK Apricot 70x1x9 boot disk. 6454# 6455# Originally a bitmap: 6456# xxxxxxx0 Not two sided 6457# xxxxxxx1 Double sided 6458# xxxxxx0x Not 8 SPT 6459# xxxxxx1x 8 SPT 6460# xxxxx0xx Not Removable drive 6461# xxxxx1xx Removable drive 6462# 11111xxx Must be one. 6463# 6464# But now it's rather random: 6465# 111111xx Low density disk 6466# 00 SS, Not 8 SPT 6467# 01 DS, Not 8 SPT 6468# 10 SS, 8 SPT 6469# 11 DS, 8 SPT 6470# 6471# 11111001 Double density 3� floppy disk, high density 5� 6472# 11110000 High density 3� floppy disk 6473# 11111000 Hard disk any format 6474# 6475 6476# CDROM Filesystems 6477# Modified for UDF by gerardo.cacciari@gmail.com 647832769 string CD001 6479!:mime application/x-iso9660-image 6480>38913 string !NSR0 ISO 9660 CD-ROM filesystem data 6481>38913 string NSR0 UDF filesystem data 6482>>38917 string 1 (version 1.0) 6483>>38917 string 2 (version 1.5) 6484>>38917 string 3 (version 2.0) 6485>>38917 byte >0x33 (unknown version, ID 0x%X) 6486>>38917 byte <0x31 (unknown version, ID 0x%X) 6487# "application id" which appears to be used as a volume label 6488>32808 string >\0 '%s' 6489>34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable) 649037633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors) 6491!:mime application/x-iso9660-image 649232776 string CDROM High Sierra CD-ROM filesystem data 6493 6494# .cso files 64950 string CISO Compressed ISO CD image 6496 6497# cramfs filesystem - russell@coker.com.au 64980 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian 6499>4 lelong x size %lu 6500>8 lelong &1 version #2 6501>8 lelong &2 sorted_dirs 6502>8 lelong &4 hole_support 6503>32 lelong x CRC 0x%x, 6504>36 lelong x edition %lu, 6505>40 lelong x %lu blocks, 6506>44 lelong x %lu files 6507 65080 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian 6509>4 belong x size %lu 6510>8 belong &1 version #2 6511>8 belong &2 sorted_dirs 6512>8 belong &4 hole_support 6513>32 belong x CRC 0x%x, 6514>36 belong x edition %lu, 6515>40 belong x %lu blocks, 6516>44 belong x %lu files 6517 6518# reiserfs - russell@coker.com.au 65190x10034 string ReIsErFs ReiserFS V3.5 65200x10034 string ReIsEr2Fs ReiserFS V3.6 65210x10034 string ReIsEr3Fs ReiserFS V3.6.19 6522>0x1002c leshort x block size %d 6523>0x10032 leshort &2 (mounted or unclean) 6524>0x10000 lelong x num blocks %d 6525>0x10040 lelong 1 tea hash 6526>0x10040 lelong 2 yura hash 6527>0x10040 lelong 3 r5 hash 6528 6529# JFFS - russell@coker.com.au 65300 lelong 0x34383931 Linux Journalled Flash File system, little endian 65310 belong 0x34383931 Linux Journalled Flash File system, big endian 6532 6533# EST flat binary format (which isn't, but anyway) 6534# From: Mark Brown <broonie@sirena.org.uk> 65350 string ESTFBINR EST flat binary 6536 6537# Aculab VoIP firmware 6538# From: Mark Brown <broonie@sirena.org.uk> 65390 string VoIP\ Startup\ and Aculab VoIP firmware 6540>35 string x format %s 6541 6542# From: Mark Brown <broonie@sirena.org.uk> [old] 6543# From: Behan Webster <behanw@websterwood.com> 65440 belong 0x27051956 u-boot legacy uImage, 6545>32 string x %s, 6546>28 byte 0 Invalid os/ 6547>28 byte 1 OpenBSD/ 6548>28 byte 2 NetBSD/ 6549>28 byte 3 FreeBSD/ 6550>28 byte 4 4.4BSD/ 6551>28 byte 5 Linux/ 6552>28 byte 6 SVR4/ 6553>28 byte 7 Esix/ 6554>28 byte 8 Solaris/ 6555>28 byte 9 Irix/ 6556>28 byte 10 SCO/ 6557>28 byte 11 Dell/ 6558>28 byte 12 NCR/ 6559>28 byte 13 LynxOS/ 6560>28 byte 14 VxWorks/ 6561>28 byte 15 pSOS/ 6562>28 byte 16 QNX/ 6563>28 byte 17 Firmware/ 6564>28 byte 18 RTEMS/ 6565>28 byte 19 ARTOS/ 6566>28 byte 20 Unity OS/ 6567>28 byte 21 INTEGRITY/ 6568>29 byte 0 \bInvalid CPU, 6569>29 byte 1 \bAlpha, 6570>29 byte 2 \bARM, 6571>29 byte 3 \bIntel x86, 6572>29 byte 4 \bIA64, 6573>29 byte 5 \bMIPS, 6574>29 byte 6 \bMIPS 64-bit, 6575>29 byte 7 \bPowerPC, 6576>29 byte 8 \bIBM S390, 6577>29 byte 9 \bSuperH, 6578>29 byte 10 \bSparc, 6579>29 byte 11 \bSparc 64-bit, 6580>29 byte 12 \bM68K, 6581>29 byte 13 \bNios-32, 6582>29 byte 14 \bMicroBlaze, 6583>29 byte 15 \bNios-II, 6584>29 byte 16 \bBlackfin, 6585>29 byte 17 \bAVR32, 6586>29 byte 18 \bSTMicroelectronics ST200, 6587>30 byte 0 Invalid Image 6588>30 byte 1 Standalone Program 6589>30 byte 2 OS Kernel Image 6590>30 byte 3 RAMDisk Image 6591>30 byte 4 Multi-File Image 6592>30 byte 5 Firmware Image 6593>30 byte 6 Script File 6594>30 byte 7 Filesystem Image (any type) 6595>30 byte 8 Binary Flat Device Tree BLOB 6596>31 byte 0 (Not compressed), 6597>31 byte 1 (gzip), 6598>31 byte 2 (bzip2), 6599>31 byte 3 (lzma), 6600>12 belong x %d bytes, 6601>8 bedate x %s, 6602>16 belong x Load Address: 0x%08X, 6603>20 belong x Entry Point: 0x%08X, 6604>4 belong x Header CRC: 0x%08X, 6605>24 belong x Data CRC: 0x%08X 6606 6607# JFFS2 file system 66080 leshort 0x1984 Linux old jffs2 filesystem data little endian 66090 leshort 0x1985 Linux jffs2 filesystem data little endian 6610 6611# Squashfs 66120 string sqsh Squashfs filesystem, big endian, 6613>28 beshort x version %d. 6614>30 beshort x \b%d, 6615>28 beshort <3 6616>>8 belong x %d bytes, 6617>28 beshort >2 6618>>63 bequad x %lld bytes, 6619#>>67 belong x %d bytes, 6620>4 belong x %d inodes, 6621>28 beshort <2 6622>>32 beshort x blocksize: %d bytes, 6623>28 beshort >1 6624>>51 belong x blocksize: %d bytes, 6625>39 bedate x created: %s 66260 string hsqs Squashfs filesystem, little endian, 6627>28 leshort x version %d. 6628>30 leshort x \b%d, 6629>28 leshort <3 6630>>8 lelong x %d bytes, 6631>28 leshort >2 6632>>63 lequad x %lld bytes, 6633#>>63 lelong x %d bytes, 6634>4 lelong x %d inodes, 6635>28 leshort <2 6636>>32 leshort x blocksize: %d bytes, 6637>28 leshort >1 6638>>51 lelong x blocksize: %d bytes, 6639>39 ledate x created: %s 6640 66410 string td\000 floppy image data (TeleDisk) 6642 6643# AFS Dump Magic 6644# From: Ty Sarna <tsarna@sarna.org> 66450 string \x01\xb3\xa1\x13\x22 AFS Dump 6646>&0 belong x (v%d) 6647>>&0 byte 0x76 6648>>>&0 belong x Vol %d, 6649>>>>&0 byte 0x6e 6650>>>>>&0 string x %s 6651>>>>>>&1 byte 0x74 6652>>>>>>>&0 beshort 2 6653>>>>>>>>&4 bedate x on: %s 6654>>>>>>>>&0 bedate =0 full dump 6655>>>>>>>>&0 bedate !0 incremental since: %s 6656 6657#---------------------------------------------------------- 6658#delta ISO Daniel Novotny (dnovotny@redhat.com) 66590 string DISO Delta ISO data 6660>4 belong x version %d 6661 6662# VMS backup savesets - gerardo.cacciari@gmail.com 6663# 66644 string \x01\x00\x01\x00\x01\x00 6665>(0.s+16) string \x01\x01 6666>>&(&0.b+8) byte 0x42 OpenVMS backup saveset data 6667>>>40 lelong x (block size %d, 6668>>>49 string >\0 original name '%s', 6669>>>2 short 1024 VAX generated) 6670>>>2 short 2048 AXP generated) 6671>>>2 short 4096 I64 generated) 6672 6673# Summary: Oracle Clustered Filesystem 6674# Created by: Aaron Botsis <redhat@digitalmafia.org> 66758 string OracleCFS Oracle Clustered Filesystem, 6676>4 long x rev %d 6677>0 long x \b.%d, 6678>560 string x label: %.64s, 6679>136 string x mountpoint: %.128s 6680 6681# Summary: Oracle ASM tagged volume 6682# Created by: Aaron Botsis <redhat@digitalmafia.org> 668332 string ORCLDISK Oracle ASM Volume, 6684>40 string x Disk Name: %0.12s 668532 string ORCLCLRD Oracle ASM Volume (cleared), 6686>40 string x Disk Name: %0.12s 6687 6688# Oracle Clustered Filesystem - Aaron Botsis <redhat@digitalmafia.org> 66898 string OracleCFS Oracle Clustered Filesystem, 6690>4 long x rev %d 6691>0 long x \b.%d, 6692>560 string x label: %.64s, 6693>136 string x mountpoint: %.128s 6694 6695# Oracle ASM tagged volume - Aaron Botsis <redhat@digitalmafia.org> 669632 string ORCLDISK Oracle ASM Volume, 6697>40 string x Disk Name: %0.12s 669832 string ORCLCLRD Oracle ASM Volume (cleared), 6699>40 string x Disk Name: %0.12s 6700 6701# Compaq/HP RILOE floppy image 6702# From: Dirk Jagdmann <doj@cubic.org> 67030 string CPQRFBLO Compaq/HP RILOE floppy image 6704 6705#------------------------------------------------------------------------------ 6706# Files-11 On-Disk Structure (OpenVMS file system) - gerardo.cacciari@gmail.com 6707# These bits come from LBN 1 (home block) of ODS-2 and ODS-5 volumes, which is 6708# mapped to VBN 2 of [000000]INDEXF.SYS;1 6709# 67101008 string DECFILE11B Files-11 On-Disk Structure 6711>525 byte x Level %d 6712>525 byte x (ODS-%d OpenVMS file system), 6713>984 string x volume label is '%-12.12s' 6714 6715# From: Thomas Klausner <wiz@NetBSD.org> 6716# http://filext.com/file-extension/DAA 6717# describes the daa file format. The magic would be: 67180 string DAA\x0\x0\x0\x0\x0 PowerISO Direct-Access-Archive 6719 6720# From Albert Cahalan <acahalan@gmail.com> 6721# really le32 operation,destination,payloadsize (but quite predictable) 6722# 01 00 00 00 00 00 00 c0 00 02 00 00 67230 string \1\0\0\0\0\0\0\300\0\2\0\0 Marvell Libertas firmware 6724 6725# From Eric Sandeen 6726# GFS2 67270x10000 belong 0x01161970 GFS2 Filesystem 6728>0x10024 belong x (blocksize %d, 6729>0x10060 string >\0 lockproto %s) 6730 6731# BTRFS 67320x10040 string _BHRfS_M BTRFS Filesystem 6733>0x1012b string >\0 (label "%s", 6734>0x10090 lelong x sectorsize %d, 6735>0x10094 lelong x nodesize %d, 6736>0x10098 lelong x leafsize %d) 6737 6738 6739# dvdisaster's .ecc 6740# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 67410 string *dvdisaster* dvdisaster error correction file 6742 6743# xfs metadump image 6744# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog 6745# but can we do the << ? For now it's always 512 (0x200) anyway. 67460 string XFSM 6747>0x200 string XFSB XFS filesystem metadump image 6748 6749# Type: CROM filesystem 6750# From: Werner Fink <werner@suse.de> 67510 string CROMFS CROMFS 6752>6 string >\0 \b version %2.2s, 6753>8 ulequad >0 \b block data at %lld, 6754>16 ulequad >0 \b fblock table at %lld, 6755>24 ulequad >0 \b inode table at %lld, 6756>32 ulequad >0 \b root at %lld, 6757>40 ulelong >0 \b fblock size = %ld, 6758>44 ulelong >0 \b block size = %ld, 6759>48 ulequad >0 \b bytes = %lld 6760 6761# Type: xfs metadump image 6762# From: Daniel Novotny <dnovotny@redhat.com> 6763# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog 6764# but can we do the << ? For now it's always 512 (0x200) anyway. 67650 string XFSM 6766>0x200 string XFSB XFS filesystem metadump image 6767 6768# Type: delta ISO 6769# From: Daniel Novotny <dnovotny@redhat.com> 67700 string DISO Delta ISO data, 6771>4 belong x version %d 6772 6773# JFS2 (Journaling File System) image. (Old JFS1 has superblock at 0x1000.) 6774# See linux/fs/jfs/jfs_superblock.h for layout; see jfs_filsys.h for flags. 6775# From: Adam Buchbinder <adam.buchbinder@gmail.com> 67760x8000 string JFS1 6777# Because it's text-only magic, check a binary value (version) to be sure. 6778# Should always be 2, but mkfs.jfs writes it as 1. Needs to be 2 or 1 to be 6779# mountable. 6780>&0 lelong <3 JFS2 filesystem image 6781# Label is followed by a UUID; we have to limit string length to avoid 6782# appending the UUID in the case of a 16-byte label. 6783>>&144 regex [\x20-\x7E]{1,16} (label "%s") 6784>>&0 lequad x \b, %lld blocks 6785>>&8 lelong x \b, blocksize %d 6786>>&32 lelong&0x00000006 >0 (dirty) 6787>>&36 lelong >0 (compressed) 6788 6789#------------------------------------------------------------------------------ 6790# $File: flash,v 1.9 2009/11/08 01:30:01 christos Exp $ 6791# flash: file(1) magic for Macromedia Flash file format 6792# 6793# See 6794# 6795# http://www.macromedia.com/software/flash/open/ 6796# 67970 string FWS Macromedia Flash data, 6798>3 byte x version %d 6799!:mime application/x-shockwave-flash 68000 string CWS Macromedia Flash data (compressed), 6801!:mime application/x-shockwave-flash 6802>3 byte x version %d 6803# From: Cal Peake <cp@absolutedigital.net> 68040 string FLV Macromedia Flash Video 6805!:mime video/x-flv 6806 6807# 6808# Yosu Gomez 68090 string AGD2\xbe\xb8\xbb\xcd\x00 Macromedia Freehand 7 Document 68100 string AGD3\xbe\xb8\xbb\xcc\x00 Macromedia Freehand 8 Document 6811# From Dave Wilson 68120 string AGD4\xbe\xb8\xbb\xcb\x00 Macromedia Freehand 9 Document 6813 6814#------------------------------------------------------------------------------ 6815# $File: fonts,v 1.21 2009/12/06 23:17:52 rrt Exp $ 6816# fonts: file(1) magic for font data 6817# 68180 search/1 FONT ASCII vfont text 68190 short 0436 Berkeley vfont data 68200 short 017001 byte-swapped Berkeley vfont data 6821 6822# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com 68230 string %!PS-AdobeFont-1. PostScript Type 1 font text 6824>20 string >\0 (%s) 68256 string %!PS-AdobeFont-1. PostScript Type 1 font program data 68260 string %!FontType1 PostScript Type 1 font program data 68276 string %!FontType1 PostScript Type 1 font program data 68280 string %!PS-Adobe-3.0\ Resource-Font PostScript Type 1 font text 6829 6830# X11 font files in SNF (Server Natural Format) format 68310 belong 00000004 X11 SNF font data, MSB first 68320 lelong 00000004 X11 SNF font data, LSB first 6833 6834# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com) 68350 search/1 STARTFONT\ X11 BDF font text 6836 6837# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com) 6838# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides) 68390 string \001fcp X11 Portable Compiled Font data 6840>12 byte 0x02 \b, LSB first 6841>12 byte 0x0a \b, MSB first 68420 string D1.0\015 X11 Speedo font data 6843 6844#------------------------------------------------------------------------------ 6845# FIGlet fonts and controlfiles 6846# From figmagic supplied with Figlet version 2.2 6847# "David E. O'Brien" <obrien@FreeBSD.ORG> 68480 string flf FIGlet font 6849>3 string >2a version %-2.2s 68500 string flc FIGlet controlfile 6851>3 string >2a version %-2.2s 6852 6853# libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu) 6854# Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++ 68550 belong 0x14025919 libGrx font data, 6856>8 leshort x %dx 6857>10 leshort x \b%d 6858>40 string x %s 6859# Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu) 68600 belong 0xff464f4e DOS code page font data collection 68617 belong 0x00454741 DOS code page font data 68627 belong 0x00564944 DOS code page font data (from Linux?) 68634098 string DOSFONT DOSFONT2 encrypted font data 6864 6865# downloadable fonts for browser (prints type) anthon@mnt.org 68660 string PFR1 PFR1 font 6867>102 string >0 \b: %s 6868 6869# True Type fonts 68700 string \000\001\000\000\000 TrueType font data 6871!:mime application/x-font-ttf 6872 68730 string \007\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font 68740 string \012\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font 6875 6876# TrueType/OpenType font collections (.ttc) 6877# http://www.microsoft.com/typography/otspec/otff.htm 68780 string ttcf TrueType font collection data 6879>4 belong 0x00010000 \b, 1.0 6880>>8 belong >0 \b, %d fonts 6881>4 belong 0x00020000 \b, 2.0 6882>>8 belong >0 \b, %d fonts 6883# 0x44454947 = 'DSIG' 6884>>>16 belong 0x44534947 \b, digitally signed 6885 6886# Opentype font data from Avi Bercovich 68870 string OTTO OpenType font data 6888!:mime application/vnd.ms-opentype 6889 6890# Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu 68910 string SplineFontDB: Spline Font Database 6892!:mime application/vnd.font-fontforge-sfd 6893>14 string x version %s 6894 6895#------------------------------------------------------------------------------ 6896# $File: fortran,v 1.6 2009/09/19 16:28:09 christos Exp $ 6897# FORTRAN source 68980 regex/100 \^[Cc][\ \t] FORTRAN program 6899!:mime text/x-fortran 6900 6901#------------------------------------------------------------------------------ 6902# $File: frame,v 1.12 2009/09/19 16:28:09 christos Exp $ 6903# frame: file(1) magic for FrameMaker files 6904# 6905# This stuff came on a FrameMaker demo tape, most of which is 6906# copyright, but this file is "published" as witness the following: 6907# 6908# Note that this is the Framemaker Maker Interchange Format, not the 6909# Normal format which would be application/vnd.framemaker. 6910# 69110 string \<MakerFile FrameMaker document 6912!:mime application/x-mif 6913>11 string 5.5 (5.5 6914>11 string 5.0 (5.0 6915>11 string 4.0 (4.0 6916>11 string 3.0 (3.0 6917>11 string 2.0 (2.0 6918>11 string 1.0 (1.0 6919>14 byte x %c) 69200 string \<MIFFile FrameMaker MIF (ASCII) file 6921!:mime application/x-mif 6922>9 string 4.0 (4.0) 6923>9 string 3.0 (3.0) 6924>9 string 2.0 (2.0) 6925>9 string 1.0 (1.x) 69260 search/1 \<MakerDictionary FrameMaker Dictionary text 6927!:mime application/x-mif 6928>17 string 3.0 (3.0) 6929>17 string 2.0 (2.0) 6930>17 string 1.0 (1.x) 69310 string \<MakerScreenFont FrameMaker Font file 6932!:mime application/x-mif 6933>17 string 1.01 (%s) 69340 string \<MML FrameMaker MML file 6935!:mime application/x-mif 69360 string \<BookFile FrameMaker Book file 6937!:mime application/x-mif 6938>10 string 3.0 (3.0 6939>10 string 2.0 (2.0 6940>10 string 1.0 (1.0 6941>13 byte x %c) 6942# XXX - this book entry should be verified, if you find one, uncomment this 6943#0 string \<Book\ FrameMaker Book (ASCII) file 6944#!:mime application/x-mif 6945#>6 string 3.0 (3.0) 6946#>6 string 2.0 (2.0) 6947#>6 string 1.0 (1.0) 69480 string \<Maker Intermediate Print File FrameMaker IPL file 6949!:mime application/x-mif 6950 6951#------------------------------------------------------------------------------ 6952# $File: freebsd,v 1.7 2009/09/19 16:28:09 christos Exp $ 6953# freebsd: file(1) magic for FreeBSD objects 6954# 6955# All new-style FreeBSD magic numbers are in host byte order (i.e., 6956# little-endian on x86). 6957# 6958# XXX - this comes from the file "freebsd" in a recent FreeBSD version of 6959# "file"; it, and the NetBSD stuff in "netbsd", appear to use different 6960# schemes for distinguishing between executable images, shared libraries, 6961# and object files. 6962# 6963# FreeBSD says: 6964# 6965# Regardless of whether it's pure, demand-paged, or none of the 6966# above: 6967# 6968# if the entry point is < 4096, then it's a shared library if 6969# the "has run-time loader information" bit is set, and is 6970# position-independent if the "is position-independent" bit 6971# is set; 6972# 6973# if the entry point is >= 4096 (or >4095, same thing), then it's 6974# an executable, and is dynamically-linked if the "has run-time 6975# loader information" bit is set. 6976# 6977# On x86, NetBSD says: 6978# 6979# If it's neither pure nor demand-paged: 6980# 6981# if it has the "has run-time loader information" bit set, it's 6982# a dynamically-linked executable; 6983# 6984# if it doesn't have that bit set, then: 6985# 6986# if it has the "is position-independent" bit set, it's 6987# position-independent; 6988# 6989# if the entry point is non-zero, it's an executable, otherwise 6990# it's an object file. 6991# 6992# If it's pure: 6993# 6994# if it has the "has run-time loader information" bit set, it's 6995# a dynamically-linked executable, otherwise it's just an 6996# executable. 6997# 6998# If it's demand-paged: 6999# 7000# if it has the "has run-time loader information" bit set, 7001# then: 7002# 7003# if the entry point is < 4096, it's a shared library; 7004# 7005# if the entry point is = 4096 or > 4096 (i.e., >= 4096), 7006# it's a dynamically-linked executable); 7007# 7008# if it doesn't have the "has run-time loader information" bit 7009# set, then it's just an executable. 7010# 7011# (On non-x86, NetBSD does much the same thing, except that it uses 7012# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K 7013# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's 7014# had 8K pages; dunno about MIPS.) 7015# 7016# I suspect the two will differ only in perverse and uninteresting cases 7017# ("shared" libraries that aren't demand-paged and whose pages probably 7018# won't actually be shared, executables with entry points <4096). 7019# 7020# I leave it to those more familiar with FreeBSD and NetBSD to figure out 7021# what the right answer is (although using ">4095", FreeBSD-style, is 7022# probably better than separately checking for "=4096" and ">4096", 7023# NetBSD-style). (The old "netbsd" file analyzed FreeBSD demand paged 7024# executables using the NetBSD technique.) 7025# 70260 lelong&0377777777 041400407 FreeBSD/i386 7027>20 lelong <4096 7028>>3 byte&0xC0 &0x80 shared library 7029>>3 byte&0xC0 0x40 PIC object 7030>>3 byte&0xC0 0x00 object 7031>20 lelong >4095 7032>>3 byte&0x80 0x80 dynamically linked executable 7033>>3 byte&0x80 0x00 executable 7034>16 lelong >0 not stripped 7035 70360 lelong&0377777777 041400410 FreeBSD/i386 pure 7037>20 lelong <4096 7038>>3 byte&0xC0 &0x80 shared library 7039>>3 byte&0xC0 0x40 PIC object 7040>>3 byte&0xC0 0x00 object 7041>20 lelong >4095 7042>>3 byte&0x80 0x80 dynamically linked executable 7043>>3 byte&0x80 0x00 executable 7044>16 lelong >0 not stripped 7045 70460 lelong&0377777777 041400413 FreeBSD/i386 demand paged 7047>20 lelong <4096 7048>>3 byte&0xC0 &0x80 shared library 7049>>3 byte&0xC0 0x40 PIC object 7050>>3 byte&0xC0 0x00 object 7051>20 lelong >4095 7052>>3 byte&0x80 0x80 dynamically linked executable 7053>>3 byte&0x80 0x00 executable 7054>16 lelong >0 not stripped 7055 70560 lelong&0377777777 041400314 FreeBSD/i386 compact demand paged 7057>20 lelong <4096 7058>>3 byte&0xC0 &0x80 shared library 7059>>3 byte&0xC0 0x40 PIC object 7060>>3 byte&0xC0 0x00 object 7061>20 lelong >4095 7062>>3 byte&0x80 0x80 dynamically linked executable 7063>>3 byte&0x80 0x00 executable 7064>16 lelong >0 not stripped 7065 7066# XXX gross hack to identify core files 7067# cores start with a struct tss; we take advantage of the following: 7068# byte 7: highest byte of the kernel stack pointer, always 0xfe 7069# 8/9: kernel (ring 0) ss value, always 0x0010 7070# 10 - 27: ring 1 and 2 ss/esp, unused, thus always 0 7071# 28: low order byte of the current PTD entry, always 0 since the 7072# PTD is page-aligned 7073# 70747 string \357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 FreeBSD/i386 a.out core file 7075>1039 string >\0 from '%s' 7076 7077# /var/run/ld.so.hints 7078# What are you laughing about? 70790 lelong 011421044151 ld.so hints file (Little Endian 7080>4 lelong >0 \b, version %d) 7081>4 belong <1 \b) 70820 belong 011421044151 ld.so hints file (Big Endian 7083>4 belong >0 \b, version %d) 7084>4 belong <1 \b) 7085 7086# 7087# Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities 7088# 70890 string SCRSHOT_ scrshot(1) screenshot, 7090>8 byte x version %d, 7091>9 byte 2 %d bytes in header, 7092>>10 byte x %d chars wide by 7093>>11 byte x %d chars high 7094 7095#------------------------------------------------------------------------------ 7096# $File: fsav,v 1.11 2009/09/19 16:28:09 christos Exp $ 7097# fsav: file(1) magic for datafellows fsav virus definition files 7098# Anthon van der Neut (anthon@mnt.org) 7099 7100# ftp://ftp.f-prot.com/pub/{macrdef2.zip,nomacro.def} 71010 beshort 0x1575 fsav macro virus signatures 7102>8 leshort >0 (%d- 7103>11 byte >0 \b%02d- 7104>10 byte >0 \b%02d) 7105# ftp://ftp.f-prot.com/pub/sign.zip 7106#10 ubyte <12 7107#>9 ubyte <32 7108#>>8 ubyte 0x0a 7109#>>>12 ubyte 0x07 7110#>>>>11 uleshort >0 fsav DOS/Windows virus signatures (%d- 7111#>>>>10 byte 0 \b01- 7112#>>>>10 byte 1 \b02- 7113#>>>>10 byte 2 \b03- 7114#>>>>10 byte 3 \b04- 7115#>>>>10 byte 4 \b05- 7116#>>>>10 byte 5 \b06- 7117#>>>>10 byte 6 \b07- 7118#>>>>10 byte 7 \b08- 7119#>>>>10 byte 8 \b09- 7120#>>>>10 byte 9 \b10- 7121#>>>>10 byte 10 \b11- 7122#>>>>10 byte 11 \b12- 7123#>>>>9 ubyte >0 \b%02d) 7124# ftp://ftp.f-prot.com/pub/sign2.zip 7125#0 ubyte 0x62 7126#>1 ubyte 0xF5 7127#>>2 ubyte 0x1 7128#>>>3 ubyte 0x1 7129#>>>>4 ubyte 0x0e 7130#>>>>>13 ubyte >0 fsav virus signatures 7131#>>>>>>11 ubyte x size 0x%02x 7132#>>>>>>12 ubyte x \b%02x 7133#>>>>>>13 ubyte x \b%02x bytes 7134 7135# Joerg Jenderek: joerg dot jenderek at web dot de 7136# http://www.clamav.net/doc/latest/html/node45.html 7137# .cvd files start with a 512 bytes colon separated header 7138# ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime 7139# + gzipped tarball files 71400 string ClamAV-VDB: 7141>11 string >\0 Clam AntiVirus database %-.23s 7142>>34 string : 7143>>>35 string !: \b, version 7144>>>>35 string x \b%-.1s 7145>>>>>36 string !: 7146>>>>>>36 string x \b%-.1s 7147>>>>>>>37 string !: 7148>>>>>>>>37 string x \b%-.1s 7149>>>>>>>>>38 string !: 7150>>>>>>>>>>38 string x \b%-.1s 7151>512 string \037\213 \b, gzipped 7152>769 string ustar\0 \b, tarred 7153 7154# Type: Grisoft AVG AntiVirus 7155# From: David Newgas <david@newgas.net> 71560 string AVG7_ANTIVIRUS_VAULT_FILE AVG 7 Antivirus vault file data 7157 7158#------------------------------------------------------------------------------ 7159# $File: games,v 1.8 2009/09/19 16:28:09 christos Exp $ 7160# games: file(1) for games 7161 7162# Fabio Bonelli <fabiobonelli@libero.it> 7163# Quake II - III data files 71640 string IDP2 Quake II 3D Model file, 7165>20 long x %lu skin(s), 7166>8 long x (%lu x 7167>12 long x %lu), 7168>40 long x %lu frame(s), 7169>16 long x Frame size %lu bytes, 7170>24 long x %lu vertices/frame, 7171>28 long x %lu texture coordinates, 7172>32 long x %lu triangles/frame 7173 71740 string IBSP Quake 7175>4 long 0x26 II Map file (BSP) 7176>4 long 0x2E III Map file (BSP) 7177 71780 string IDS2 Quake II SP2 sprite file 7179 7180#--------------------------------------------------------------------------- 7181# Doom and Quake 7182# submitted by Nicolas Patrois 7183 71840 string \xcb\x1dBoom\xe6\xff\x03\x01 Boom or linuxdoom demo 7185# some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01 7186 718724 string LxD\ 203 Linuxdoom save 7188>0 string x , name=%s 7189>44 string x , world=%s 7190 7191# Quake 7192 71930 string PACK Quake I or II world or extension 7194>8 lelong >0 \b, %d entries 7195 7196#0 string -1\x0a Quake I demo 7197#>30 string x version %.4s 7198#>61 string x level %s 7199 7200#0 string 5\x0a Quake I save 7201 7202# The levels 7203 7204# Quake 1 7205 72060 string 5\x0aIntroduction Quake I save: start Introduction 72070 string 5\x0athe_Slipgate_Complex Quake I save: e1m1 The slipgate complex 72080 string 5\x0aCastle_of_the_Damned Quake I save: e1m2 Castle of the damned 72090 string 5\x0athe_Necropolis Quake I save: e1m3 The necropolis 72100 string 5\x0athe_Grisly_Grotto Quake I save: e1m4 The grisly grotto 72110 string 5\x0aZiggurat_Vertigo Quake I save: e1m8 Ziggurat vertigo (secret) 72120 string 5\x0aGloom_Keep Quake I save: e1m5 Gloom keep 72130 string 5\x0aThe_Door_To_Chthon Quake I save: e1m6 The door to Chthon 72140 string 5\x0aThe_House_of_Chthon Quake I save: e1m7 The house of Chthon 72150 string 5\x0athe_Installation Quake I save: e2m1 The installation 72160 string 5\x0athe_Ogre_Citadel Quake I save: e2m2 The ogre citadel 72170 string 5\x0athe_Crypt_of_Decay Quake I save: e2m3 The crypt of decay (dopefish lives!) 72180 string 5\x0aUnderearth Quake I save: e2m7 Underearth (secret) 72190 string 5\x0athe_Ebon_Fortress Quake I save: e2m4 The ebon fortress 72200 string 5\x0athe_Wizard's_Manse Quake I save: e2m5 The wizard's manse 72210 string 5\x0athe_Dismal_Oubliette Quake I save: e2m6 The dismal oubliette 72220 string 5\x0aTermination_Central Quake I save: e3m1 Termination central 72230 string 5\x0aVaults_of_Zin Quake I save: e3m2 Vaults of Zin 72240 string 5\x0athe_Tomb_of_Terror Quake I save: e3m3 The tomb of terror 72250 string 5\x0aSatan's_Dark_Delight Quake I save: e3m4 Satan's dark delight 72260 string 5\x0athe_Haunted_Halls Quake I save: e3m7 The haunted halls (secret) 72270 string 5\x0aWind_Tunnels Quake I save: e3m5 Wind tunnels 72280 string 5\x0aChambers_of_Torment Quake I save: e3m6 Chambers of torment 72290 string 5\x0athe_Sewage_System Quake I save: e4m1 The sewage system 72300 string 5\x0aThe_Tower_of_Despair Quake I save: e4m2 The tower of despair 72310 string 5\x0aThe_Elder_God_Shrine Quake I save: e4m3 The elder god shrine 72320 string 5\x0athe_Palace_of_Hate Quake I save: e4m4 The palace of hate 72330 string 5\x0aHell's_Atrium Quake I save: e4m5 Hell's atrium 72340 string 5\x0athe_Nameless_City Quake I save: e4m8 The nameless city (secret) 72350 string 5\x0aThe_Pain_Maze Quake I save: e4m6 The pain maze 72360 string 5\x0aAzure_Agony Quake I save: e4m7 Azure agony 72370 string 5\x0aShub-Niggurath's_Pit Quake I save: end Shub-Niggurath's pit 7238 7239# Quake DeathMatch levels 7240 72410 string 5\x0aPlace_of_Two_Deaths Quake I save: dm1 Place of two deaths 72420 string 5\x0aClaustrophobopolis Quake I save: dm2 Claustrophobopolis 72430 string 5\x0aThe_Abandoned_Base Quake I save: dm3 The abandoned base 72440 string 5\x0aThe_Bad_Place Quake I save: dm4 The bad place 72450 string 5\x0aThe_Cistern Quake I save: dm5 The cistern 72460 string 5\x0aThe_Dark_Zone Quake I save: dm6 The dark zone 7247 7248# Scourge of Armagon 7249 72500 string 5\x0aCommand_HQ Quake I save: start Command HQ 72510 string 5\x0aThe_Pumping_Station Quake I save: hip1m1 The pumping station 72520 string 5\x0aStorage_Facility Quake I save: hip1m2 Storage facility 72530 string 5\x0aMilitary_Complex Quake I save: hip1m5 Military complex (secret) 72540 string 5\x0athe_Lost_Mine Quake I save: hip1m3 The lost mine 72550 string 5\x0aResearch_Facility Quake I save: hip1m4 Research facility 72560 string 5\x0aAncient_Realms Quake I save: hip2m1 Ancient realms 72570 string 5\x0aThe_Gremlin's_Domain Quake I save: hip2m6 The gremlin's domain (secret) 72580 string 5\x0aThe_Black_Cathedral Quake I save: hip2m2 The black cathedral 72590 string 5\x0aThe_Catacombs Quake I save: hip2m3 The catacombs 72600 string 5\x0athe_Crypt__ Quake I save: hip2m4 The crypt 72610 string 5\x0aMortum's_Keep Quake I save: hip2m5 Mortum's keep 72620 string 5\x0aTur_Torment Quake I save: hip3m1 Tur torment 72630 string 5\x0aPandemonium Quake I save: hip3m2 Pandemonium 72640 string 5\x0aLimbo Quake I save: hip3m3 Limbo 72650 string 5\x0athe_Edge_of_Oblivion Quake I save: hipdm1 The edge of oblivion (secret) 72660 string 5\x0aThe_Gauntlet Quake I save: hip3m4 The gauntlet 72670 string 5\x0aArmagon's_Lair Quake I save: hipend Armagon's lair 7268 7269# Malice 7270 72710 string 5\x0aThe_Academy Quake I save: start The academy 72720 string 5\x0aThe_Lab Quake I save: d1 The lab 72730 string 5\x0aArea_33 Quake I save: d1b Area 33 72740 string 5\x0aSECRET_MISSIONS Quake I save: d3b Secret missions 72750 string 5\x0aThe_Hospital Quake I save: d10 The hospital (secret) 72760 string 5\x0aThe_Genetics_Lab Quake I save: d11 The genetics lab (secret) 72770 string 5\x0aBACK_2_MALICE Quake I save: d4b Back to Malice 72780 string 5\x0aArea44 Quake I save: d1c Area 44 72790 string 5\x0aTakahiro_Towers Quake I save: d2 Takahiro towers 72800 string 5\x0aA_Rat's_Life Quake I save: d3 A rat's life 72810 string 5\x0aInto_The_Flood Quake I save: d4 Into the flood 72820 string 5\x0aThe_Flood Quake I save: d5 The flood 72830 string 5\x0aNuclear_Plant Quake I save: d6 Nuclear plant 72840 string 5\x0aThe_Incinerator_Plant Quake I save: d7 The incinerator plant 72850 string 5\x0aThe_Foundry Quake I save: d7b The foundry 72860 string 5\x0aThe_Underwater_Base Quake I save: d8 The underwater base 72870 string 5\x0aTakahiro_Base Quake I save: d9 Takahiro base 72880 string 5\x0aTakahiro_Laboratories Quake I save: d12 Takahiro laboratories 72890 string 5\x0aStayin'_Alive Quake I save: d13 Stayin' alive 72900 string 5\x0aB.O.S.S._HQ Quake I save: d14 B.O.S.S. HQ 72910 string 5\x0aSHOWDOWN! Quake I save: d15 Showdown! 7292 7293# Malice DeathMatch levels 7294 72950 string 5\x0aThe_Seventh_Precinct Quake I save: ddm1 The seventh precinct 72960 string 5\x0aSub_Station Quake I save: ddm2 Sub station 72970 string 5\x0aCrazy_Eights! Quake I save: ddm3 Crazy eights! 72980 string 5\x0aEast_Side_Invertationa Quake I save: ddm4 East side invertationa 72990 string 5\x0aSlaughterhouse Quake I save: ddm5 Slaughterhouse 73000 string 5\x0aDOMINO Quake I save: ddm6 Domino 73010 string 5\x0aSANDRA'S_LADDER Quake I save: ddm7 Sandra's ladder 7302 7303 73040 string MComprHD MAME CHD compressed hard disk image, 7305>12 belong x version %lu 7306 7307# doom - submitted by Jon Dowland 7308 73090 string =IWAD doom main IWAD data 7310>4 lelong x containing %d lumps 73110 string =PWAD doom patch PWAD data 7312>4 lelong x containing %d lumps 7313 7314 7315# Summary: Warcraft 3 save 7316# Extension: .w3g 7317# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com> 73180 string Warcraft\ III\ recorded\ game %s 7319 7320 7321# Summary: Warcraft 3 map 7322# Extension: .w3m 7323# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com> 73240 string HM3W Warcraft III map file 7325 7326 7327# Summary: SGF Smart Game Format 7328# Extension: .sgf 7329# Reference: http://www.red-bean.com/sgf/ 7330# Created by: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar> 7331# Modified by (1): Abel Cheung (regex, more game format) 7332# FIXME: Some games don't have GM (game type) 73330 regex \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format 7334>2 search/0x200 GM[ 7335>>&0 string 1] (Go) 7336>>&0 string 2] (Othello) 7337>>&0 string 3] (chess) 7338>>&0 string 4] (Gomoku+Renju) 7339>>&0 string 5] (Nine Men's Morris) 7340>>&0 string 6] (Backgammon) 7341>>&0 string 7] (Chinese chess) 7342>>&0 string 8] (Shogi) 7343>>&0 string 9] (Lines of Action) 7344>>&0 string 10] (Ataxx) 7345>>&0 string 11] (Hex) 7346>>&0 string 12] (Jungle) 7347>>&0 string 13] (Neutron) 7348>>&0 string 14] (Philosopher's Football) 7349>>&0 string 15] (Quadrature) 7350>>&0 string 16] (Trax) 7351>>&0 string 17] (Tantrix) 7352>>&0 string 18] (Amazons) 7353>>&0 string 19] (Octi) 7354>>&0 string 20] (Gess) 7355>>&0 string 21] (Twixt) 7356>>&0 string 22] (Zertz) 7357>>&0 string 23] (Plateau) 7358>>&0 string 24] (Yinsh) 7359>>&0 string 25] (Punct) 7360>>&0 string 26] (Gobblet) 7361>>&0 string 27] (hive) 7362>>&0 string 28] (Exxit) 7363>>&0 string 29] (Hnefatal) 7364>>&0 string 30] (Kuba) 7365>>&0 string 31] (Tripples) 7366>>&0 string 32] (Chase) 7367>>&0 string 33] (Tumbling Down) 7368>>&0 string 34] (Sahara) 7369>>&0 string 35] (Byte) 7370>>&0 string 36] (Focus) 7371>>&0 string 37] (Dvonn) 7372>>&0 string 38] (Tamsk) 7373>>&0 string 39] (Gipf) 7374>>&0 string 40] (Kropki) 7375 7376 7377# Summary: Civilization 4 video 7378# Extension: .bik 7379# Created by: Abel Cheung <abelcheung@gmail.com> 73800 string BIKi Civilization 4 Video 7381 7382 7383############################################## 7384# NetImmerse/Gamebryo game engine entries 7385 7386# Summary: Gamebryo game engine file 7387# Extension: .nif, .kf 7388# Created by: Abel Cheung <abelcheung@gmail.com> 73890 string Gamebryo\ File\ Format,\ Version\ Gamebryo game engine file 7390>&0 regex [0-9a-z.]+ \b, version %s 7391 7392# Summary: Gamebryo game engine file 7393# Extension: .kfm 7394# Created by: Abel Cheung <abelcheung@gmail.com> 73950 string ;Gamebryo\ KFM\ File\ Version\ Gamebryo game engine animation File 7396>&0 regex [0-9a-z.]+ \b, version %s 7397 7398# Summary: NetImmerse game engine file 7399# Extension .nif 7400# Created by: Abel Cheung <abelcheung@gmail.com> 74010 string NetImmerse\ File\ Format,\ Versio 7402>&0 string n\ NetImmerse game engine file 7403>>&0 regex [0-9a-z.]+ \b, version %s 7404 7405# Type: SGF Smart Game Format 7406# URL: http://www.red-bean.com/sgf/ 7407# From: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar> 74082 regex/c \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format 7409>2 regex/c GM\\[1\\] - Go Game 7410>2 regex/c GM\\[6\\] - BackGammon Game 7411>2 regex/c GM\\[11\\] - Hex Game 7412>2 regex/c GM\\[18\\] - Amazons Game 7413>2 regex/c GM\\[19\\] - Octi Game 7414>2 regex/c GM\\[20\\] - Gess Game 7415>2 regex/c GM\\[21\\] - twix Game 7416 7417#------------------------------------------------------------------------------ 7418# $File: gcc,v 1.4 2009/09/19 16:28:09 christos Exp $ 7419# gcc: file(1) magic for GCC special files 7420# 74210 string gpch GCC precompiled header 7422 7423# The version field is annoying. It's 3 characters, not zero-terminated. 7424>5 byte x (version %c 7425>6 byte x \b%c 7426>7 byte x \b%c) 7427 7428# 67 = 'C', 111 = 'o', 43 = '+', 79 = 'O' 7429>4 byte 67 for C 7430>4 byte 111 for Objective C 7431>4 byte 43 for C++ 7432>4 byte 79 for Objective C++ 7433 7434#------------------------------------------------------------------------------ 7435# $File: geos,v 1.4 2009/09/19 16:28:09 christos Exp $ 7436# GEOS files (Vidar Madsen, vidar@gimp.org) 7437# semi-commonly used in embedded and handheld systems. 74380 belong 0xc745c153 GEOS 7439>40 byte 1 executable 7440>40 byte 2 VMFile 7441>40 byte 3 binary 7442>40 byte 4 directory label 7443>40 byte <1 unknown 7444>40 byte >4 unknown 7445>4 string >\0 \b, name "%s" 7446#>44 short x \b, version %d 7447#>46 short x \b.%d 7448#>48 short x \b, rev %d 7449#>50 short x \b.%d 7450#>52 short x \b, proto %d 7451#>54 short x \br%d 7452#>168 string >\0 \b, copyright "%s" 7453 7454#------------------------------------------------------------------------------ 7455# $File: gimp,v 1.6 2009/09/19 16:28:09 christos Exp $ 7456# GIMP Gradient: file(1) magic for the GIMP's gradient data files 7457# by Federico Mena <federico@nuclecu.unam.mx> 7458 74590 string GIMP\ Gradient GIMP gradient data 7460 7461#------------------------------------------------------------------------------ 7462# XCF: file(1) magic for the XCF image format used in the GIMP developed 7463# by Spencer Kimball and Peter Mattis 7464# ('Bucky' LaDieu, nega@vt.edu) 7465 74660 string gimp\ xcf GIMP XCF image data, 7467!:mime image/x-xcf 7468>9 string file version 0, 7469>9 string v version 7470>>10 string >\0 %s, 7471>14 belong x %lu x 7472>18 belong x %lu, 7473>22 belong 0 RGB Color 7474>22 belong 1 Greyscale 7475>22 belong 2 Indexed Color 7476>22 belong >2 Unknown Image Type. 7477 7478#------------------------------------------------------------------------------ 7479# XCF: file(1) magic for the patterns used in the GIMP, developed 7480# by Spencer Kimball and Peter Mattis 7481# ('Bucky' LaDieu, nega@vt.edu) 7482 748320 string GPAT GIMP pattern data, 7484>24 string x %s 7485 7486#------------------------------------------------------------------------------ 7487# XCF: file(1) magic for the brushes used in the GIMP, developed 7488# by Spencer Kimball and Peter Mattis 7489# ('Bucky' LaDieu, nega@vt.edu) 7490 749120 string GIMP GIMP brush data 7492 7493# GIMP Curves File 7494# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 74950 string #\040GIMP\040Curves\040File GIMP curve file 7496 7497#------------------------------------------------------------------------------ 7498# $File: gnome-keyring,v 1.2 2009/09/19 16:28:09 christos Exp $ 7499# GNOME keyring 7500# Contributed by Josh Triplett 7501# FIXME: Could be simplified if pstring supported two-byte counts 75020 string GnomeKeyring\n\r\0\n GNOME keyring 7503>&0 ubyte 0 \b, major version 0 7504>>&0 ubyte 0 \b, minor version 0 7505>>>&0 ubyte 0 \b, crypto type 0 (AEL) 7506>>>&0 ubyte >0 \b, crypto type %hhu (unknown) 7507>>>&1 ubyte 0 \b, hash type 0 (MD5) 7508>>>&1 ubyte >0 \b, hash type %hhu (unknown) 7509>>>&2 ubelong 0xFFFFFFFF \b, name NULL 7510>>>&2 ubelong !0xFFFFFFFF 7511>>>>&-4 ubelong >255 \b, name too long for file's pstring type 7512>>>>&-4 ubelong <256 7513>>>>>&-1 pstring x \b, name "%s" 7514>>>>>>&0 ubeqdate x \b, last modified %s 7515>>>>>>&8 ubeqdate x \b, created %s 7516>>>>>>&16 ubelong &1 7517>>>>>>>&0 ubelong x \b, locked if idle for %u seconds 7518>>>>>>&16 ubelong ^1 \b, not locked if idle 7519>>>>>>&24 ubelong x \b, hash iterations %u 7520>>>>>>&28 ubequad x \b, salt %llu 7521>>>>>>&52 ubelong x \b, %u item(s) 7522 7523#------------------------------------------------------------------------------ 7524# $File: gnu,v 1.11 2009/09/19 16:28:09 christos Exp $ 7525# gnu: file(1) magic for various GNU tools 7526# 7527# GNU nlsutils message catalog file format 7528# 75290 string \336\22\4\225 GNU message catalog (little endian), 7530>4 lelong x revision %d, 7531>8 lelong x %d messages 75320 string \225\4\22\336 GNU message catalog (big endian), 7533>4 belong x revision %d, 7534>8 belong x %d messages 7535# message catalogs, from Mitchum DSouza <m.dsouza@mrc-apu.cam.ac.uk> 75360 string *nazgul* Nazgul style compiled message catalog 7537>8 lelong >0 \b, version %ld 7538 7539# GnuPG 7540# The format is very similar to pgp 75410 string \001gpg GPG key trust database 7542>4 byte x version %d 7543# Note: magic.mime had 0x8501 for the next line instead of 0x8502 75440 beshort 0x8502 GPG encrypted data 7545!:mime text/PGP # encoding: data 7546 7547# This magic is not particularly good, as the keyrings don't have true 7548# magic. Nevertheless, it covers many keyrings. 75490 beshort 0x9901 GPG key public ring 7550!:mime application/x-gnupg-keyring 7551 7552# Gnumeric spreadsheet 7553# This entry is only semi-helpful, as Gnumeric compresses its files, so 7554# they will ordinarily reported as "compressed", but at least -z helps 755539 string =<gmr:Workbook Gnumeric spreadsheet 7556 7557# From: James Youngman <jay@gnu.org> 7558# gnu find magic 75590 string \0LOCATE GNU findutils locate database data 7560>7 string >\0 \b, format %s 7561>7 string 02 \b (frcode) 7562 7563# Files produced by GNU gettext 75640 long 0xDE120495 GNU-format message catalog data 75650 long 0x950412DE GNU-format message catalog data 7566 7567#------------------------------------------------------------------------------ 7568# $File: gnumeric,v 1.4 2009/09/19 16:28:09 christos Exp $ 7569# gnumeric: file(1) magic for Gnumeric spreadsheet 7570# This entry is only semi-helpful, as Gnumeric compresses its files, so 7571# they will ordinarily reported as "compressed", but at least -z helps 757239 string =<gmr:Workbook Gnumeric spreadsheet 7573!:mime application/x-gnumeric 7574 7575#------------------------------------------------------------------------------ 7576# $File: grace,v 1.4 2009/09/19 16:28:09 christos Exp $ 7577# ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE 7578# 7579# ACE/gr binary 75800 string \000\000\0001\000\000\0000\000\000\0000\000\000\0002\000\000\0000\000\000\0000\000\000\0003 old ACE/gr binary file 7581>39 byte >0 - version %c 7582# ACE/gr ascii 75830 string #\ xvgr\ parameter\ file ACE/gr ascii file 75840 string #\ xmgr\ parameter\ file ACE/gr ascii file 75850 string #\ ACE/gr\ parameter\ file ACE/gr ascii file 7586# Grace projects 75870 string #\ Grace\ project\ file Grace project file 7588>23 string @version\ (version 7589>>32 byte >0 %c 7590>>33 string >\0 \b.%.2s 7591>>35 string >\0 \b.%.2s) 7592# ACE/gr fit description files 75930 string #\ ACE/gr\ fit\ description\ ACE/gr fit description file 7594# end of ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE 7595 7596#------------------------------------------------------------------------------ 7597# $File: graphviz,v 1.7 2009/09/19 16:28:09 christos Exp $ 7598# graphviz: file(1) magic for http://www.graphviz.org/ 7599 7600# FIXME: These patterns match too generally. For example, the first 7601# line matches a LaTeX file containing the word "graph" (with a { 7602# following later) and the second line matches this file. 7603#0 regex/100 [\r\n\t\ ]*graph[\r\n\t\ ]+.*\\{ graphviz graph text 7604#!:mime text/vnd.graphviz 7605#0 regex/100 [\r\n\t\ ]*digraph[\r\n\t\ ]+.*\\{ graphviz digraph text 7606#!:mime text/vnd.graphviz 7607 7608#------------------------------------------------------------------------------ 7609# $File: gringotts,v 1.5 2009/09/19 16:28:09 christos Exp $ 7610# gringotts: file(1) magic for Gringotts 7611# http://devel.pluto.linux.it/projects/Gringotts/ 7612# author: Germano Rizzo <mano@pluto.linux.it> 7613#GRG3????Y 76140 string GRG Gringotts data file 7615#file format 1 7616>3 string 1 v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9 7617#file format 2 7618>3 string 2 v.2, MCRYPT S2K, 7619>>8 byte&0x70 0x00 RIJNDAEL-128 crypt, 7620>>8 byte&0x70 0x10 SERPENT crypt, 7621>>8 byte&0x70 0x20 TWOFISH crypt, 7622>>8 byte&0x70 0x30 CAST-256 crypt, 7623>>8 byte&0x70 0x40 SAFER+ crypt, 7624>>8 byte&0x70 0x50 LOKI97 crypt, 7625>>8 byte&0x70 0x60 3DES crypt, 7626>>8 byte&0x70 0x70 RIJNDAEL-256 crypt, 7627>>8 byte&0x08 0x00 SHA1 hash, 7628>>8 byte&0x08 0x08 RIPEMD-160 hash, 7629>>8 byte&0x04 0x00 ZLib 7630>>8 byte&0x04 0x04 BZip2 7631>>8 byte&0x03 0x00 lvl.0 7632>>8 byte&0x03 0x01 lvl.3 7633>>8 byte&0x03 0x02 lvl.6 7634>>8 byte&0x03 0x03 lvl.9 7635#file format 3 7636>3 string 3 v.3, OpenPGP S2K, 7637>>8 byte&0x70 0x00 RIJNDAEL-128 crypt, 7638>>8 byte&0x70 0x10 SERPENT crypt, 7639>>8 byte&0x70 0x20 TWOFISH crypt, 7640>>8 byte&0x70 0x30 CAST-256 crypt, 7641>>8 byte&0x70 0x40 SAFER+ crypt, 7642>>8 byte&0x70 0x50 LOKI97 crypt, 7643>>8 byte&0x70 0x60 3DES crypt, 7644>>8 byte&0x70 0x70 RIJNDAEL-256 crypt, 7645>>8 byte&0x08 0x00 SHA1 hash, 7646>>8 byte&0x08 0x08 RIPEMD-160 hash, 7647>>8 byte&0x04 0x00 ZLib 7648>>8 byte&0x04 0x04 BZip2 7649>>8 byte&0x03 0x00 lvl.0 7650>>8 byte&0x03 0x01 lvl.3 7651>>8 byte&0x03 0x02 lvl.6 7652>>8 byte&0x03 0x03 lvl.9 7653#file format >3 7654>3 string >3 v.%.1s (unknown details) 7655 7656#------------------------------------------------------------------------------ 7657# $File: hitachi-sh,v 1.5 2009/09/19 16:28:09 christos Exp $ 7658# hitach-sh: file(1) magic for Hitachi Super-H 7659# 7660# Super-H COFF 7661# 76620 beshort 0x0500 Hitachi SH big-endian COFF 7663>18 beshort&0x0002 =0x0000 object 7664>18 beshort&0x0002 =0x0002 executable 7665>18 beshort&0x0008 =0x0008 \b, stripped 7666>18 beshort&0x0008 =0x0000 \b, not stripped 7667# 76680 leshort 0x0550 Hitachi SH little-endian COFF 7669>18 leshort&0x0002 =0x0000 object 7670>18 leshort&0x0002 =0x0002 executable 7671>18 leshort&0x0008 =0x0008 \b, stripped 7672>18 leshort&0x0008 =0x0000 \b, not stripped 7673 7674 7675#------------------------------------------------------------------------------ 7676# $File: hp,v 1.23 2009/09/19 16:28:09 christos Exp $ 7677# hp: file(1) magic for Hewlett Packard machines (see also "printer") 7678# 7679# XXX - somebody should figure out whether any byte order needs to be 7680# applied to the "TML" stuff; I'm assuming the Apollo stuff is 7681# big-endian as it was mostly 68K-based. 7682# 7683# I think the 500 series was the old stack-based machines, running a 7684# UNIX environment atop the "SUN kernel"; dunno whether it was 7685# big-endian or little-endian. 7686# 7687# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based; 7688# hp300 are 68020+68881 based; hp400 are also 68k. The following basic 7689# HP magic is useful for reference, but using "long" magic is a better 7690# practice in order to avoid collisions. 7691# 7692# Guy Harris (guy@netapp.com): some additions to this list came from 7693# HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1, 7694# 1.2, and 2.0). The 1.2 and 2.0 stuff isn't in the HP-UX 10.0 7695# "/etc/magic", though, except for the "archive file relocatable library" 7696# stuff, and the 68030 and 68040 stuff isn't there at all - are they not 7697# used in executables, or have they just not yet updated "/etc/magic" 7698# completely? 7699# 7700# 0 beshort 200 hp200 (68010) BSD binary 7701# 0 beshort 300 hp300 (68020+68881) BSD binary 7702# 0 beshort 0x20c hp200/300 HP-UX binary 7703# 0 beshort 0x20d hp400 (68030) HP-UX binary 7704# 0 beshort 0x20e hp400 (68040?) HP-UX binary 7705# 0 beshort 0x20b PA-RISC1.0 HP-UX binary 7706# 0 beshort 0x210 PA-RISC1.1 HP-UX binary 7707# 0 beshort 0x211 PA-RISC1.2 HP-UX binary 7708# 0 beshort 0x214 PA-RISC2.0 HP-UX binary 7709 7710# 7711# The "misc" stuff needs a byte order; the archives look suspiciously 7712# like the old 177545 archives (0xff65 = 0177545). 7713# 7714#### Old Apollo stuff 77150 beshort 0627 Apollo m68k COFF executable 7716>18 beshort ^040000 not stripped 7717>22 beshort >0 - version %ld 77180 beshort 0624 apollo a88k COFF executable 7719>18 beshort ^040000 not stripped 7720>22 beshort >0 - version %ld 77210 long 01203604016 TML 0123 byte-order format 77220 long 01702407010 TML 1032 byte-order format 77230 long 01003405017 TML 2301 byte-order format 77240 long 01602007412 TML 3210 byte-order format 7725#### PA-RISC 1.1 77260 belong 0x02100106 PA-RISC1.1 relocatable object 77270 belong 0x02100107 PA-RISC1.1 executable 7728>168 belong &0x00000004 dynamically linked 7729>(144) belong 0x054ef630 dynamically linked 7730>96 belong >0 - not stripped 7731 77320 belong 0x02100108 PA-RISC1.1 shared executable 7733>168 belong&0x4 0x4 dynamically linked 7734>(144) belong 0x054ef630 dynamically linked 7735>96 belong >0 - not stripped 7736 77370 belong 0x0210010b PA-RISC1.1 demand-load executable 7738>168 belong&0x4 0x4 dynamically linked 7739>(144) belong 0x054ef630 dynamically linked 7740>96 belong >0 - not stripped 7741 77420 belong 0x0210010e PA-RISC1.1 shared library 7743>96 belong >0 - not stripped 7744 77450 belong 0x0210010d PA-RISC1.1 dynamic load library 7746>96 belong >0 - not stripped 7747 7748#### PA-RISC 2.0 77490 belong 0x02140106 PA-RISC2.0 relocatable object 7750 77510 belong 0x02140107 PA-RISC2.0 executable 7752>168 belong &0x00000004 dynamically linked 7753>(144) belong 0x054ef630 dynamically linked 7754>96 belong >0 - not stripped 7755 77560 belong 0x02140108 PA-RISC2.0 shared executable 7757>168 belong &0x00000004 dynamically linked 7758>(144) belong 0x054ef630 dynamically linked 7759>96 belong >0 - not stripped 7760 77610 belong 0x0214010b PA-RISC2.0 demand-load executable 7762>168 belong &0x00000004 dynamically linked 7763>(144) belong 0x054ef630 dynamically linked 7764>96 belong >0 - not stripped 7765 77660 belong 0x0214010e PA-RISC2.0 shared library 7767>96 belong >0 - not stripped 7768 77690 belong 0x0214010d PA-RISC2.0 dynamic load library 7770>96 belong >0 - not stripped 7771 7772#### 800 77730 belong 0x020b0106 PA-RISC1.0 relocatable object 7774 77750 belong 0x020b0107 PA-RISC1.0 executable 7776>168 belong&0x4 0x4 dynamically linked 7777>(144) belong 0x054ef630 dynamically linked 7778>96 belong >0 - not stripped 7779 77800 belong 0x020b0108 PA-RISC1.0 shared executable 7781>168 belong&0x4 0x4 dynamically linked 7782>(144) belong 0x054ef630 dynamically linked 7783>96 belong >0 - not stripped 7784 77850 belong 0x020b010b PA-RISC1.0 demand-load executable 7786>168 belong&0x4 0x4 dynamically linked 7787>(144) belong 0x054ef630 dynamically linked 7788>96 belong >0 - not stripped 7789 77900 belong 0x020b010e PA-RISC1.0 shared library 7791>96 belong >0 - not stripped 7792 77930 belong 0x020b010d PA-RISC1.0 dynamic load library 7794>96 belong >0 - not stripped 7795 77960 belong 0x213c6172 archive file 7797>68 belong 0x020b0619 - PA-RISC1.0 relocatable library 7798>68 belong 0x02100619 - PA-RISC1.1 relocatable library 7799>68 belong 0x02110619 - PA-RISC1.2 relocatable library 7800>68 belong 0x02140619 - PA-RISC2.0 relocatable library 7801 7802#### 500 78030 long 0x02080106 HP s500 relocatable executable 7804>16 long >0 - version %ld 7805 78060 long 0x02080107 HP s500 executable 7807>16 long >0 - version %ld 7808 78090 long 0x02080108 HP s500 pure executable 7810>16 long >0 - version %ld 7811 7812#### 200 78130 belong 0x020c0108 HP s200 pure executable 7814>4 beshort >0 - version %ld 7815>8 belong &0x80000000 save fp regs 7816>8 belong &0x40000000 dynamically linked 7817>8 belong &0x20000000 debuggable 7818>36 belong >0 not stripped 7819 78200 belong 0x020c0107 HP s200 executable 7821>4 beshort >0 - version %ld 7822>8 belong &0x80000000 save fp regs 7823>8 belong &0x40000000 dynamically linked 7824>8 belong &0x20000000 debuggable 7825>36 belong >0 not stripped 7826 78270 belong 0x020c010b HP s200 demand-load executable 7828>4 beshort >0 - version %ld 7829>8 belong &0x80000000 save fp regs 7830>8 belong &0x40000000 dynamically linked 7831>8 belong &0x20000000 debuggable 7832>36 belong >0 not stripped 7833 78340 belong 0x020c0106 HP s200 relocatable executable 7835>4 beshort >0 - version %ld 7836>6 beshort >0 - highwater %d 7837>8 belong &0x80000000 save fp regs 7838>8 belong &0x20000000 debuggable 7839>8 belong &0x10000000 PIC 7840 78410 belong 0x020a0108 HP s200 (2.x release) pure executable 7842>4 beshort >0 - version %ld 7843>36 belong >0 not stripped 7844 78450 belong 0x020a0107 HP s200 (2.x release) executable 7846>4 beshort >0 - version %ld 7847>36 belong >0 not stripped 7848 78490 belong 0x020c010e HP s200 shared library 7850>4 beshort >0 - version %ld 7851>6 beshort >0 - highwater %d 7852>36 belong >0 not stripped 7853 78540 belong 0x020c010d HP s200 dynamic load library 7855>4 beshort >0 - version %ld 7856>6 beshort >0 - highwater %d 7857>36 belong >0 not stripped 7858 7859#### MISC 78600 long 0x0000ff65 HP old archive 78610 long 0x020aff65 HP s200 old archive 78620 long 0x020cff65 HP s200 old archive 78630 long 0x0208ff65 HP s500 old archive 7864 78650 long 0x015821a6 HP core file 7866 78670 long 0x4da7eee8 HP-WINDOWS font 7868>8 byte >0 - version %ld 78690 string Bitmapfile HP Bitmapfile 7870 78710 string IMGfile CIS compimg HP Bitmapfile 7872# XXX - see "lif" 7873#0 short 0x8000 lif file 78740 long 0x020c010c compiled Lisp 7875 78760 string msgcat01 HP NLS message catalog, 7877>8 long >0 %d messages 7878 7879# Summary: HP-48/49 calculator 7880# Created by: phk@data.fls.dk 7881# Modified by (1): AMAKAWA Shuhei <sa264@cam.ac.uk> 7882# Modified by (2): Samuel Thibault <samuel.thibault@ens-lyon.org> (HP49 support) 78830 string HPHP HP 7884>4 string 48 48 binary 7885>4 string 49 49 binary 7886>7 byte >64 - Rev %c 7887>8 leshort 0x2911 (ADR) 7888>8 leshort 0x2933 (REAL) 7889>8 leshort 0x2955 (LREAL) 7890>8 leshort 0x2977 (COMPLX) 7891>8 leshort 0x299d (LCOMPLX) 7892>8 leshort 0x29bf (CHAR) 7893>8 leshort 0x29e8 (ARRAY) 7894>8 leshort 0x2a0a (LNKARRAY) 7895>8 leshort 0x2a2c (STRING) 7896>8 leshort 0x2a4e (HXS) 7897>8 leshort 0x2a74 (LIST) 7898>8 leshort 0x2a96 (DIR) 7899>8 leshort 0x2ab8 (ALG) 7900>8 leshort 0x2ada (UNIT) 7901>8 leshort 0x2afc (TAGGED) 7902>8 leshort 0x2b1e (GROB) 7903>8 leshort 0x2b40 (LIB) 7904>8 leshort 0x2b62 (BACKUP) 7905>8 leshort 0x2b88 (LIBDATA) 7906>8 leshort 0x2d9d (PROG) 7907>8 leshort 0x2dcc (CODE) 7908>8 leshort 0x2e48 (GNAME) 7909>8 leshort 0x2e6d (LNAME) 7910>8 leshort 0x2e92 (XLIB) 7911 79120 string %%HP: HP text 7913>6 string T(0) - T(0) 7914>6 string T(1) - T(1) 7915>6 string T(2) - T(2) 7916>6 string T(3) - T(3) 7917>10 string A(D) A(D) 7918>10 string A(R) A(R) 7919>10 string A(G) A(G) 7920>14 string F(.) F(.); 7921>14 string F(,) F(,); 7922 7923 7924# Summary: HP-38/39 calculator 7925# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org> 79260 string HP3 7927>3 string 8 HP 38 7928>3 string 9 HP 39 7929>4 string Bin binary 7930>4 string Asc ASCII 7931>7 string A (Directory List) 7932>7 string B (Zaplet) 7933>7 string C (Note) 7934>7 string D (Program) 7935>7 string E (Variable) 7936>7 string F (List) 7937>7 string G (Matrix) 7938>7 string H (Library) 7939>7 string I (Target List) 7940>7 string J (ASCII Vector specification) 7941>7 string K (wildcard) 7942 7943# Summary: HP-38/39 calculator 7944# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org> 79450 string HP3 7946>3 string 8 HP 38 7947>3 string 9 HP 39 7948>4 string Bin binary 7949>4 string Asc ASCII 7950>7 string A (Directory List) 7951>7 string B (Zaplet) 7952>7 string C (Note) 7953>7 string D (Program) 7954>7 string E (Variable) 7955>7 string F (List) 7956>7 string G (Matrix) 7957>7 string H (Library) 7958>7 string I (Target List) 7959>7 string J (ASCII Vector specification) 7960>7 string K (wildcard) 7961 7962# hpBSD magic numbers 79630 beshort 200 hp200 (68010) BSD 7964>2 beshort 0407 impure binary 7965>2 beshort 0410 read-only binary 7966>2 beshort 0413 demand paged binary 79670 beshort 300 hp300 (68020+68881) BSD 7968>2 beshort 0407 impure binary 7969>2 beshort 0410 read-only binary 7970>2 beshort 0413 demand paged binary 7971# 7972# From David Gero <dgero@nortelnetworks.com> 7973# HP-UX 10.20 core file format from /usr/include/sys/core.h 7974# Unfortunately, HP-UX uses corehead blocks without specifying the order 7975# There are four we care about: 7976# CORE_KERNEL, which starts with the string "HP-UX" 7977# CORE_EXEC, which contains the name of the command 7978# CORE_PROC, which contains the signal number that caused the core dump 7979# CORE_FORMAT, which contains the version of the core file format (== 1) 7980# The only observed order in real core files is KERNEL, EXEC, FORMAT, PROC 7981# but we include all 6 variations of the order of the first 3, and 7982# assume that PROC will always be last 7983# Order 1: KERNEL, EXEC, FORMAT, PROC 79840x10 string HP-UX 7985>0 belong 2 7986>>0xC belong 0x3C 7987>>>0x4C belong 0x100 7988>>>>0x58 belong 0x44 7989>>>>>0xA0 belong 1 7990>>>>>>0xAC belong 4 7991>>>>>>>0xB0 belong 1 7992>>>>>>>>0xB4 belong 4 core file 7993>>>>>>>>>0x90 string >\0 from '%s' 7994>>>>>>>>>0xC4 belong 3 - received SIGQUIT 7995>>>>>>>>>0xC4 belong 4 - received SIGILL 7996>>>>>>>>>0xC4 belong 5 - received SIGTRAP 7997>>>>>>>>>0xC4 belong 6 - received SIGABRT 7998>>>>>>>>>0xC4 belong 7 - received SIGEMT 7999>>>>>>>>>0xC4 belong 8 - received SIGFPE 8000>>>>>>>>>0xC4 belong 10 - received SIGBUS 8001>>>>>>>>>0xC4 belong 11 - received SIGSEGV 8002>>>>>>>>>0xC4 belong 12 - received SIGSYS 8003>>>>>>>>>0xC4 belong 33 - received SIGXCPU 8004>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 8005# Order 2: KERNEL, FORMAT, EXEC, PROC 8006>>>0x4C belong 1 8007>>>>0x58 belong 4 8008>>>>>0x5C belong 1 8009>>>>>>0x60 belong 0x100 8010>>>>>>>0x6C belong 0x44 8011>>>>>>>>0xB4 belong 4 core file 8012>>>>>>>>>0xA4 string >\0 from '%s' 8013>>>>>>>>>0xC4 belong 3 - received SIGQUIT 8014>>>>>>>>>0xC4 belong 4 - received SIGILL 8015>>>>>>>>>0xC4 belong 5 - received SIGTRAP 8016>>>>>>>>>0xC4 belong 6 - received SIGABRT 8017>>>>>>>>>0xC4 belong 7 - received SIGEMT 8018>>>>>>>>>0xC4 belong 8 - received SIGFPE 8019>>>>>>>>>0xC4 belong 10 - received SIGBUS 8020>>>>>>>>>0xC4 belong 11 - received SIGSEGV 8021>>>>>>>>>0xC4 belong 12 - received SIGSYS 8022>>>>>>>>>0xC4 belong 33 - received SIGXCPU 8023>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 8024# Order 3: FORMAT, KERNEL, EXEC, PROC 80250x24 string HP-UX 8026>0 belong 1 8027>>0xC belong 4 8028>>>0x10 belong 1 8029>>>>0x14 belong 2 8030>>>>>0x20 belong 0x3C 8031>>>>>>0x60 belong 0x100 8032>>>>>>>0x6C belong 0x44 8033>>>>>>>>0xB4 belong 4 core file 8034>>>>>>>>>0xA4 string >\0 from '%s' 8035>>>>>>>>>0xC4 belong 3 - received SIGQUIT 8036>>>>>>>>>0xC4 belong 4 - received SIGILL 8037>>>>>>>>>0xC4 belong 5 - received SIGTRAP 8038>>>>>>>>>0xC4 belong 6 - received SIGABRT 8039>>>>>>>>>0xC4 belong 7 - received SIGEMT 8040>>>>>>>>>0xC4 belong 8 - received SIGFPE 8041>>>>>>>>>0xC4 belong 10 - received SIGBUS 8042>>>>>>>>>0xC4 belong 11 - received SIGSEGV 8043>>>>>>>>>0xC4 belong 12 - received SIGSYS 8044>>>>>>>>>0xC4 belong 33 - received SIGXCPU 8045>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 8046# Order 4: EXEC, KERNEL, FORMAT, PROC 80470x64 string HP-UX 8048>0 belong 0x100 8049>>0xC belong 0x44 8050>>>0x54 belong 2 8051>>>>0x60 belong 0x3C 8052>>>>>0xA0 belong 1 8053>>>>>>0xAC belong 4 8054>>>>>>>0xB0 belong 1 8055>>>>>>>>0xB4 belong 4 core file 8056>>>>>>>>>0x44 string >\0 from '%s' 8057>>>>>>>>>0xC4 belong 3 - received SIGQUIT 8058>>>>>>>>>0xC4 belong 4 - received SIGILL 8059>>>>>>>>>0xC4 belong 5 - received SIGTRAP 8060>>>>>>>>>0xC4 belong 6 - received SIGABRT 8061>>>>>>>>>0xC4 belong 7 - received SIGEMT 8062>>>>>>>>>0xC4 belong 8 - received SIGFPE 8063>>>>>>>>>0xC4 belong 10 - received SIGBUS 8064>>>>>>>>>0xC4 belong 11 - received SIGSEGV 8065>>>>>>>>>0xC4 belong 12 - received SIGSYS 8066>>>>>>>>>0xC4 belong 33 - received SIGXCPU 8067>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 8068# Order 5: FORMAT, EXEC, KERNEL, PROC 80690x78 string HP-UX 8070>0 belong 1 8071>>0xC belong 4 8072>>>0x10 belong 1 8073>>>>0x14 belong 0x100 8074>>>>>0x20 belong 0x44 8075>>>>>>0x68 belong 2 8076>>>>>>>0x74 belong 0x3C 8077>>>>>>>>0xB4 belong 4 core file 8078>>>>>>>>>0x58 string >\0 from '%s' 8079>>>>>>>>>0xC4 belong 3 - received SIGQUIT 8080>>>>>>>>>0xC4 belong 4 - received SIGILL 8081>>>>>>>>>0xC4 belong 5 - received SIGTRAP 8082>>>>>>>>>0xC4 belong 6 - received SIGABRT 8083>>>>>>>>>0xC4 belong 7 - received SIGEMT 8084>>>>>>>>>0xC4 belong 8 - received SIGFPE 8085>>>>>>>>>0xC4 belong 10 - received SIGBUS 8086>>>>>>>>>0xC4 belong 11 - received SIGSEGV 8087>>>>>>>>>0xC4 belong 12 - received SIGSYS 8088>>>>>>>>>0xC4 belong 33 - received SIGXCPU 8089>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 8090# Order 6: EXEC, FORMAT, KERNEL, PROC 8091>0 belong 0x100 8092>>0xC belong 0x44 8093>>>0x54 belong 1 8094>>>>0x60 belong 4 8095>>>>>0x64 belong 1 8096>>>>>>0x68 belong 2 8097>>>>>>>0x74 belong 0x2C 8098>>>>>>>>0xB4 belong 4 core file 8099>>>>>>>>>0x44 string >\0 from '%s' 8100>>>>>>>>>0xC4 belong 3 - received SIGQUIT 8101>>>>>>>>>0xC4 belong 4 - received SIGILL 8102>>>>>>>>>0xC4 belong 5 - received SIGTRAP 8103>>>>>>>>>0xC4 belong 6 - received SIGABRT 8104>>>>>>>>>0xC4 belong 7 - received SIGEMT 8105>>>>>>>>>0xC4 belong 8 - received SIGFPE 8106>>>>>>>>>0xC4 belong 10 - received SIGBUS 8107>>>>>>>>>0xC4 belong 11 - received SIGSEGV 8108>>>>>>>>>0xC4 belong 12 - received SIGSYS 8109>>>>>>>>>0xC4 belong 33 - received SIGXCPU 8110>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 8111 8112 8113 8114#------------------------------------------------------------------------------ 8115# $File: human68k,v 1.5 2009/09/19 16:28:09 christos Exp $ 8116# human68k: file(1) magic for Human68k (X680x0 DOS) binary formats 8117# Magic too short! 8118#0 string HU Human68k 8119#>68 string LZX LZX compressed 8120#>>72 string >\0 (version %s) 8121#>(8.L+74) string LZX LZX compressed 8122#>>(8.L+78) string >\0 (version %s) 8123#>60 belong >0 binded 8124#>(8.L+66) string #HUPAIR hupair 8125#>0 string HU X executable 8126#>(8.L+74) string #LIBCV1 - linked PD LIBC ver 1 8127#>4 belong >0 - base address 0x%x 8128#>28 belong >0 not stripped 8129#>32 belong >0 with debug information 8130#0 beshort 0x601a Human68k Z executable 8131#0 beshort 0x6000 Human68k object file 8132#0 belong 0xd1000000 Human68k ar binary archive 8133#0 belong 0xd1010000 Human68k ar ascii archive 8134#0 beshort 0x0068 Human68k lib archive 8135#4 string LZX Human68k LZX compressed 8136#>8 string >\0 (version %s) 8137#>4 string LZX R executable 8138#2 string #HUPAIR Human68k hupair R executable 8139 8140#------------------------------------------------------------------------------ 8141# $File: ibm370,v 1.8 2009/09/19 16:28:09 christos Exp $ 8142# ibm370: file(1) magic for IBM 370 and compatibles. 8143# 8144# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable". 8145# What the heck *is* "USS/370"? 8146# AIX 4.1's "/etc/magic" has 8147# 8148# 0 short 0535 370 sysV executable 8149# >12 long >0 not stripped 8150# >22 short >0 - version %d 8151# >30 long >0 - 5.2 format 8152# 0 short 0530 370 sysV pure executable 8153# >12 long >0 not stripped 8154# >22 short >0 - version %d 8155# >30 long >0 - 5.2 format 8156# 8157# instead of the "USS/370" versions of the same magic numbers. 8158# 81590 beshort 0537 370 XA sysV executable 8160>12 belong >0 not stripped 8161>22 beshort >0 - version %d 8162>30 belong >0 - 5.2 format 81630 beshort 0532 370 XA sysV pure executable 8164>12 belong >0 not stripped 8165>22 beshort >0 - version %d 8166>30 belong >0 - 5.2 format 81670 beshort 054001 370 sysV pure executable 8168>12 belong >0 not stripped 81690 beshort 055001 370 XA sysV pure executable 8170>12 belong >0 not stripped 81710 beshort 056401 370 sysV executable 8172>12 belong >0 not stripped 81730 beshort 057401 370 XA sysV executable 8174>12 belong >0 not stripped 81750 beshort 0531 SVR2 executable (Amdahl-UTS) 8176>12 belong >0 not stripped 8177>24 belong >0 - version %ld 81780 beshort 0534 SVR2 pure executable (Amdahl-UTS) 8179>12 belong >0 not stripped 8180>24 belong >0 - version %ld 81810 beshort 0530 SVR2 pure executable (USS/370) 8182>12 belong >0 not stripped 8183>24 belong >0 - version %ld 81840 beshort 0535 SVR2 executable (USS/370) 8185>12 belong >0 not stripped 8186>24 belong >0 - version %ld 8187 8188#------------------------------------------------------------------------------ 8189# $File: ibm6000,v 1.9 2009/09/19 16:28:09 christos Exp $ 8190# ibm6000: file(1) magic for RS/6000 and the RT PC. 8191# 81920 beshort 0x01df executable (RISC System/6000 V3.1) or obj module 8193>12 belong >0 not stripped 8194# Breaks sun4 statically linked execs. 8195#0 beshort 0x0103 executable (RT Version 2) or obj module 8196#>2 byte 0x50 pure 8197#>28 belong >0 not stripped 8198#>6 beshort >0 - version %ld 81990 beshort 0x0104 shared library 82000 beshort 0x0105 ctab data 82010 beshort 0xfe04 structured file 82020 string 0xabcdef AIX message catalog 82030 belong 0x000001f9 AIX compiled message catalog 82040 string \<aiaff> archive 82050 string \<bigaf> archive (big format) 8206 8207 8208#------------------------------------------------------------------------------ 8209# $File: iff,v 1.12 2009/09/19 16:28:09 christos Exp $ 8210# iff: file(1) magic for Interchange File Format (see also "audio" & "images") 8211# 8212# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic 8213# Arts for file interchange. It has also been used by Apple, SGI, and 8214# especially Commodore-Amiga. 8215# 8216# IFF files begin with an 8 byte FORM header, followed by a 4 character 8217# FORM type, which is followed by the first chunk in the FORM. 8218 82190 string FORM IFF data 8220#>4 belong x \b, FORM is %d bytes long 8221# audio formats 8222>8 string AIFF \b, AIFF audio 8223!:mime audio/x-aiff 8224>8 string AIFC \b, AIFF-C compressed audio 8225!:mime audio/x-aiff 8226>8 string 8SVX \b, 8SVX 8-bit sampled sound voice 8227!:mime audio/x-aiff 8228>8 string 16SV \b, 16SV 16-bit sampled sound voice 8229>8 string SAMP \b, SAMP sampled audio 8230>8 string MAUD \b, MAUD MacroSystem audio 8231>8 string SMUS \b, SMUS simple music 8232>8 string CMUS \b, CMUS complex music 8233# image formats 8234>8 string ILBMBMHD \b, ILBM interleaved image 8235>>20 beshort x \b, %d x 8236>>22 beshort x %d 8237>8 string RGBN \b, RGBN 12-bit RGB image 8238>8 string RGB8 \b, RGB8 24-bit RGB image 8239>8 string DEEP \b, DEEP TVPaint/XiPaint image 8240>8 string DR2D \b, DR2D 2-D object 8241>8 string TDDD \b, TDDD 3-D rendering 8242>8 string LWOB \b, LWOB 3-D object 8243>8 string LWO2 \b, LWO2 3-D object, v2 8244>8 string LWLO \b, LWLO 3-D layered object 8245>8 string REAL \b, REAL Real3D rendering 8246>8 string MC4D \b, MC4D MaxonCinema4D rendering 8247>8 string ANIM \b, ANIM animation 8248>8 string YAFA \b, YAFA animation 8249>8 string SSA\ \b, SSA super smooth animation 8250>8 string ACBM \b, ACBM continuous image 8251>8 string FAXX \b, FAXX fax image 8252# other formats 8253>8 string FTXT \b, FTXT formatted text 8254>8 string CTLG \b, CTLG message catalog 8255>8 string PREF \b, PREF preferences 8256>8 string DTYP \b, DTYP datatype description 8257>8 string PTCH \b, PTCH binary patch 8258>8 string AMFF \b, AMFF AmigaMetaFile format 8259>8 string WZRD \b, WZRD StormWIZARD resource 8260>8 string DOC\ \b, DOC desktop publishing document 8261 8262# These go at the end of the iff rules 8263# 8264# I don't see why these might collide with anything else. 8265# 8266# Interactive Fiction related formats 8267# 8268>8 string IFRS \b, Blorb Interactive Fiction 8269>>24 string Exec with executable chunk 8270>8 string IFZS \b, Z-machine or Glulx saved game file (Quetzal) 8271 8272#------------------------------------------------------------------------------ 8273# $File: images,v 1.64 2009/12/06 00:38:50 christos Exp $ 8274# images: file(1) magic for image formats (see also "iff", and "c-lang" for 8275# XPM bitmaps) 8276# 8277# originally from jef@helios.ee.lbl.gov (Jef Poskanzer), 8278# additions by janl@ifi.uio.no as well as others. Jan also suggested 8279# merging several one- and two-line files into here. 8280# 8281# little magic: PCX (first byte is 0x0a) 8282 8283# Targa - matches `povray', `ppmtotga' and `xv' outputs 8284# by Philippe De Muyter <phdm@macqel.be> 8285# at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11 8286# at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise 8287# at 3, leshort Index is 0 for povray, ppmtotga and xv outputs 8288# `xv' recognizes only a subset of the following (RGB with pixelsize = 24) 8289# `tgatoppm' recognizes a superset (Index may be anything) 82901 belong&0xfff7ffff 0x01010000 Targa image data - Map 8291>2 byte&8 8 - RLE 8292>12 leshort >0 %hd x 8293>14 leshort >0 %hd 82941 belong&0xfff7ffff 0x00020000 Targa image data - RGB 8295>2 byte&8 8 - RLE 8296>12 leshort >0 %hd x 8297>14 leshort >0 %hd 82981 belong&0xfff7ffff 0x00030000 Targa image data - Mono 8299>2 byte&8 8 - RLE 8300>12 leshort >0 %hd x 8301>14 leshort >0 %hd 8302 8303# PBMPLUS images 8304# The next byte following the magic is always whitespace. 83050 search/1 P1 Netpbm PBM image text 8306!:mime image/x-portable-bitmap 83070 search/1 P2 Netpbm PGM image text 8308!:mime image/x-portable-greymap 83090 search/1 P3 Netpbm PPM image text 8310!:mime image/x-portable-pixmap 83110 string P4 Netpbm PBM "rawbits" image data 8312!:mime image/x-portable-bitmap 83130 string P5 Netpbm PGM "rawbits" image data 8314!:mime image/x-portable-greymap 83150 string P6 Netpbm PPM "rawbits" image data 8316!:mime image/x-portable-pixmap 83170 string P7 Netpbm PAM image file 8318!:mime image/x-portable-pixmap 8319 8320# From: bryanh@giraffe-data.com (Bryan Henderson) 83210 string \117\072 Solitaire Image Recorder format 8322>4 string \013 MGI Type 11 8323>4 string \021 MGI Type 17 83240 string .MDA MicroDesign data 8325>21 byte 48 version 2 8326>21 byte 51 version 3 83270 string .MDP MicroDesign page data 8328>21 byte 48 version 2 8329>21 byte 51 version 3 8330 8331# NIFF (Navy Interchange File Format, a modification of TIFF) images 8332# [GRR: this *must* go before TIFF] 83330 string IIN1 NIFF image data 8334!:mime image/x-niff 8335 8336# Canon RAW version 1 (CRW) files are a type of Canon Image File Format 8337# (CIFF) file. These are apparently all little-endian. 8338# From: Adam Buchbinder <adam.buchbinder@gmail.com> 8339# URL: http://www.sno.phy.queensu.ca/~phil/exiftool/canon_raw.html 83400 string II\x1a\0\0\0HEAPCCDR Canon CIFF raw image data 8341!:mime image/x-canon-crw 8342>16 leshort x \b, version %d. 8343>14 leshort x \b%d 8344 8345# Canon RAW version 2 (CR2) files are a kind of TIFF with an extra magic 8346# number. Put this above the TIFF test to make sure we detect them. 8347# These are apparently all little-endian. 8348# From: Adam Buchbinder <adam.buchbinder@gmail.com> 8349# URL: http://libopenraw.freedesktop.org/wiki/Canon_CR2 83500 string II\x2a\0\x10\0\0\0CR Canon CR2 raw image data 8351!:mime image/x-canon-cr2 8352>10 byte x \b, version %d. 8353>11 byte x \b%d 8354 8355# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com) 8356# The second word of TIFF files is the TIFF version number, 42, which has 8357# never changed. The TIFF specification recommends testing for it. 83580 string MM\x00\x2a TIFF image data, big-endian 8359!:mime image/tiff 83600 string II\x2a\x00 TIFF image data, little-endian 8361!:mime image/tiff 8362 8363# PNG [Portable Network Graphics, or "PNG's Not GIF"] images 8364# (Greg Roelofs, newt@uchicago.edu) 8365# (Albert Cahalan, acahalan@cs.uml.edu) 8366# 8367# 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ... 8368# 83690 string \x89PNG\x0d\x0a\x1a\x0a PNG image data 8370!:mime image/png 8371>16 belong x \b, %ld x 8372>20 belong x %ld, 8373>24 byte x %d-bit 8374>25 byte 0 grayscale, 8375>25 byte 2 \b/color RGB, 8376>25 byte 3 colormap, 8377>25 byte 4 gray+alpha, 8378>25 byte 6 \b/color RGBA, 8379#>26 byte 0 deflate/32K, 8380>28 byte 0 non-interlaced 8381>28 byte 1 interlaced 8382 8383# possible GIF replacements; none yet released! 8384# (Greg Roelofs, newt@uchicago.edu) 8385# 8386# GRR 950115: this was mine ("Zip GIF"): 83870 string GIF94z ZIF image (GIF+deflate alpha) 8388!:mime image/x-unknown 8389# 8390# GRR 950115: this is Jeremy Wohl's Free Graphics Format (better): 8391# 83920 string FGF95a FGF image (GIF+deflate beta) 8393!:mime image/x-unknown 8394# 8395# GRR 950115: this is Thomas Boutell's Portable Bitmap Format proposal 8396# (best; not yet implemented): 8397# 83980 string PBF PBF image (deflate compression) 8399!:mime image/x-unknown 8400 8401# GIF 84020 string GIF8 GIF image data 8403!:mime image/gif 8404!:apple 8BIMGIFf 8405>4 string 7a \b, version 8%s, 8406>4 string 9a \b, version 8%s, 8407>6 leshort >0 %hd x 8408>8 leshort >0 %hd 8409#>10 byte &0x80 color mapped, 8410#>10 byte&0x07 =0x00 2 colors 8411#>10 byte&0x07 =0x01 4 colors 8412#>10 byte&0x07 =0x02 8 colors 8413#>10 byte&0x07 =0x03 16 colors 8414#>10 byte&0x07 =0x04 32 colors 8415#>10 byte&0x07 =0x05 64 colors 8416#>10 byte&0x07 =0x06 128 colors 8417#>10 byte&0x07 =0x07 256 colors 8418 8419# ITC (CMU WM) raster files. It is essentially a byte-reversed Sun raster, 8420# 1 plane, no encoding. 84210 string \361\0\100\273 CMU window manager raster image data 8422>4 lelong >0 %d x 8423>8 lelong >0 %d, 8424>12 lelong >0 %d-bit 8425 8426# Magick Image File Format 84270 string id=ImageMagick MIFF image data 8428 8429# Artisan 84300 long 1123028772 Artisan image data 8431>4 long 1 \b, rectangular 24-bit 8432>4 long 2 \b, rectangular 8-bit with colormap 8433>4 long 3 \b, rectangular 32-bit (24-bit with matte) 8434 8435# FIG (Facility for Interactive Generation of figures), an object-based format 84360 search/1 #FIG FIG image text 8437>5 string x \b, version %.3s 8438 8439# PHIGS 84400 string ARF_BEGARF PHIGS clear text archive 84410 string @(#)SunPHIGS SunPHIGS 8442# version number follows, in the form m.n 8443>40 string SunBin binary 8444>32 string archive archive 8445 8446# GKS (Graphics Kernel System) 84470 string GKSM GKS Metafile 8448>24 string SunGKS \b, SunGKS 8449 8450# CGM image files 84510 string BEGMF clear text Computer Graphics Metafile 8452 8453# MGR bitmaps (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de) 84540 string yz MGR bitmap, modern format, 8-bit aligned 84550 string zz MGR bitmap, old format, 1-bit deep, 16-bit aligned 84560 string xz MGR bitmap, old format, 1-bit deep, 32-bit aligned 84570 string yx MGR bitmap, modern format, squeezed 8458 8459# Fuzzy Bitmap (FBM) images 84600 string %bitmap\0 FBM image data 8461>30 long 0x31 \b, mono 8462>30 long 0x33 \b, color 8463 8464# facsimile data 84651 string PC\ Research,\ Inc group 3 fax data 8466>29 byte 0 \b, normal resolution (204x98 DPI) 8467>29 byte 1 \b, fine resolution (204x196 DPI) 8468# From: Herbert Rosmanith <herp@wildsau.idv.uni.linz.at> 84690 string Sfff structured fax file 8470 8471 8472# PC bitmaps (OS/2, Windows BMP files) (Greg Roelofs, newt@uchicago.edu) 84730 string BM 8474>14 leshort 12 PC bitmap, OS/2 1.x format 8475!:mime image/x-ms-bmp 8476>>18 leshort x \b, %d x 8477>>20 leshort x %d 8478>14 leshort 64 PC bitmap, OS/2 2.x format 8479!:mime image/x-ms-bmp 8480>>18 leshort x \b, %d x 8481>>20 leshort x %d 8482>14 leshort 40 PC bitmap, Windows 3.x format 8483!:mime image/x-ms-bmp 8484>>18 lelong x \b, %d x 8485>>22 lelong x %d x 8486>>28 leshort x %d 8487>14 leshort 128 PC bitmap, Windows NT/2000 format 8488!:mime image/x-ms-bmp 8489>>18 lelong x \b, %d x 8490>>22 lelong x %d x 8491>>28 leshort x %d 8492# Too simple - MPi 8493#0 string IC PC icon data 8494#0 string PI PC pointer image data 8495#0 string CI PC color icon data 8496#0 string CP PC color pointer image data 8497# Conflicts with other entries [BABYL] 8498#0 string BA PC bitmap array data 8499 8500# XPM icons (Greg Roelofs, newt@uchicago.edu) 8501# note possible collision with C/REXX entry in c-lang; currently commented out 85020 search/1 /*\ XPM\ */ X pixmap image text 8503 8504# Utah Raster Toolkit RLE images (janl@ifi.uio.no) 85050 leshort 0xcc52 RLE image data, 8506>6 leshort x %d x 8507>8 leshort x %d 8508>2 leshort >0 \b, lower left corner: %d 8509>4 leshort >0 \b, lower right corner: %d 8510>10 byte&0x1 =0x1 \b, clear first 8511>10 byte&0x2 =0x2 \b, no background 8512>10 byte&0x4 =0x4 \b, alpha channel 8513>10 byte&0x8 =0x8 \b, comment 8514>11 byte >0 \b, %d color channels 8515>12 byte >0 \b, %d bits per pixel 8516>13 byte >0 \b, %d color map channels 8517 8518# image file format (Robert Potter, potter@cs.rochester.edu) 85190 string Imagefile\ version- iff image data 8520# this adds the whole header (inc. version number), informative but longish 8521>10 string >\0 %s 8522 8523# Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com) 85240 belong 0x59a66a95 Sun raster image data 8525>4 belong >0 \b, %d x 8526>8 belong >0 %d, 8527>12 belong >0 %d-bit, 8528#>16 belong >0 %d bytes long, 8529>20 belong 0 old format, 8530#>20 belong 1 standard, 8531>20 belong 2 compressed, 8532>20 belong 3 RGB, 8533>20 belong 4 TIFF, 8534>20 belong 5 IFF, 8535>20 belong 0xffff reserved for testing, 8536>24 belong 0 no colormap 8537>24 belong 1 RGB colormap 8538>24 belong 2 raw colormap 8539#>28 belong >0 colormap is %d bytes long 8540 8541# SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com) 8542# 8543# See 8544# http://reality.sgi.com/grafica/sgiimage.html 8545# 85460 beshort 474 SGI image data 8547#>2 byte 0 \b, verbatim 8548>2 byte 1 \b, RLE 8549#>3 byte 1 \b, normal precision 8550>3 byte 2 \b, high precision 8551>4 beshort x \b, %d-D 8552>6 beshort x \b, %d x 8553>8 beshort x %d 8554>10 beshort x \b, %d channel 8555>10 beshort !1 \bs 8556>80 string >0 \b, "%s" 8557 85580 string IT01 FIT image data 8559>4 belong x \b, %d x 8560>8 belong x %d x 8561>12 belong x %d 8562# 85630 string IT02 FIT image data 8564>4 belong x \b, %d x 8565>8 belong x %d x 8566>12 belong x %d 8567# 85682048 string PCD_IPI Kodak Photo CD image pack file 8569>0xe02 byte&0x03 0x00 , landscape mode 8570>0xe02 byte&0x03 0x01 , portrait mode 8571>0xe02 byte&0x03 0x02 , landscape mode 8572>0xe02 byte&0x03 0x03 , portrait mode 85730 string PCD_OPA Kodak Photo CD overview pack file 8574 8575# FITS format. Jeff Uphoff <juphoff@tarsier.cv.nrao.edu> 8576# FITS is the Flexible Image Transport System, the de facto standard for 8577# data and image transfer, storage, etc., for the astronomical community. 8578# (FITS floating point formats are big-endian.) 85790 string SIMPLE\ \ = FITS image data 8580>109 string 8 \b, 8-bit, character or unsigned binary integer 8581>108 string 16 \b, 16-bit, two's complement binary integer 8582>107 string \ 32 \b, 32-bit, two's complement binary integer 8583>107 string -32 \b, 32-bit, floating point, single precision 8584>107 string -64 \b, 64-bit, floating point, double precision 8585 8586# other images 85870 string This\ is\ a\ BitMap\ file Lisp Machine bit-array-file 8588 8589# From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image 8590# stuff. 8591# 85920 beshort 0x1010 PEX Binary Archive 8593 8594# DICOM medical imaging data 8595128 string DICM DICOM medical imaging data 8596!:mime application/dicom 8597 8598# XWD - X Window Dump file. 8599# As described in /usr/X11R6/include/X11/XWDFile.h 8600# used by the xwd program. 8601# Bradford Castalia, idaeim, 1/01 8602# updated by Adam Buchbinder, 2/09 8603# The following assumes version 7 of the format; the first long is the length 8604# of the header, which is at least 25 4-byte longs, and the one at offset 8 8605# is a constant which is always either 1 or 2. Offset 12 is the pixmap depth, 8606# which is a maximum of 32. 86070 belong >100 8608>8 belong <3 8609>>12 belong <33 8610>>>4 belong 7 XWD X Window Dump image data 8611!:mime image/x-xwindowdump 8612>>>>100 string >\0 \b, "%s" 8613>>>>16 belong x \b, %dx 8614>>>>20 belong x \b%dx 8615>>>>12 belong x \b%d 8616 8617# PDS - Planetary Data System 8618# These files use Parameter Value Language in the header section. 8619# Unfortunately, there is no certain magic, but the following 8620# strings have been found to be most likely. 86210 string NJPL1I00 PDS (JPL) image data 86222 string NJPL1I PDS (JPL) image data 86230 string CCSD3ZF PDS (CCSD) image data 86242 string CCSD3Z PDS (CCSD) image data 86250 string PDS_ PDS image data 86260 string LBLSIZE= PDS (VICAR) image data 8627 8628# pM8x: ATARI STAD compressed bitmap format 8629# 8630# from Oskar Schirmer <schirmer@scara.com> Feb 2, 2001 8631# p M 8 5/6 xx yy zz data... 8632# Atari ST STAD bitmap is always 640x400, bytewise runlength compressed. 8633# bytes either run horizontally (pM85) or vertically (pM86). yy is the 8634# most frequent byte, xx and zz are runlength escape codes, where xx is 8635# used for runs of yy. 8636# 86370 string pM85 Atari ST STAD bitmap image data (hor) 8638>5 byte 0x00 (white background) 8639>5 byte 0xFF (black background) 86400 string pM86 Atari ST STAD bitmap image data (vert) 8641>5 byte 0x00 (white background) 8642>5 byte 0xFF (black background) 8643 8644# Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu 8645# http://www.atarimax.com/jindroush.atari.org/afmtatr.html 86460 leshort 0x0296 Atari ATR image 8647 8648# XXX: 8649# This is bad magic 0x5249 == 'RI' conflicts with RIFF and other 8650# magic. 8651# SGI RICE image file <mpruett@sgi.com> 8652#0 beshort 0x5249 RICE image 8653#>2 beshort x v%d 8654#>4 beshort x (%d x 8655#>6 beshort x %d) 8656#>8 beshort 0 8 bit 8657#>8 beshort 1 10 bit 8658#>8 beshort 2 12 bit 8659#>8 beshort 3 13 bit 8660#>10 beshort 0 4:2:2 8661#>10 beshort 1 4:2:2:4 8662#>10 beshort 2 4:4:4 8663#>10 beshort 3 4:4:4:4 8664#>12 beshort 1 RGB 8665#>12 beshort 2 CCIR601 8666#>12 beshort 3 RP175 8667#>12 beshort 4 YUV 8668 8669#------------------------------------------------------------------------------ 8670# 8671# Marco Schmidt (marcoschmidt@users.sourceforge.net) -- an image file format 8672# for the EPOC operating system, which is used with PDAs like those from Psion 8673# 8674# see http://huizen.dds.nl/~frodol/psiconv/html/Index.html for a description 8675# of various EPOC file formats 8676 86770 string \x37\x00\x00\x10\x42\x00\x00\x10\x00\x00\x00\x00\x39\x64\x39\x47 EPOC MBM image file 8678 8679# PCX image files 8680# From: Dan Fandrich <dan@coneharvesters.com> 86810 beshort 0x0a00 PCX ver. 2.5 image data 86820 beshort 0x0a02 PCX ver. 2.8 image data, with palette 86830 beshort 0x0a03 PCX ver. 2.8 image data, without palette 86840 beshort 0x0a04 PCX for Windows image data 86850 beshort 0x0a05 PCX ver. 3.0 image data 8686>4 leshort x bounding box [%hd, 8687>6 leshort x %hd] - 8688>8 leshort x [%hd, 8689>10 leshort x %hd], 8690>65 byte >1 %d planes each of 8691>3 byte x %hhd-bit 8692>68 byte 0 image, 8693>68 byte 1 colour, 8694>68 byte 2 grayscale, 8695>68 byte >2 image, 8696>68 byte <0 image, 8697>12 leshort >0 %hd x 8698>>14 leshort x %hd dpi, 8699>2 byte 0 uncompressed 8700>2 byte 1 RLE compressed 8701 8702# Adobe Photoshop 8703# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 87040 string 8BPS Adobe Photoshop Image 8705!:mime image/vnd.adobe.photoshop 8706>4 beshort 2 (PSB) 8707>18 belong x \b, %d x 8708>14 belong x %d, 8709>24 beshort 0 bitmap 8710>24 beshort 1 grayscale 8711>>12 beshort 2 with alpha 8712>24 beshort 2 indexed 8713>24 beshort 3 RGB 8714>>12 beshort 4 \bA 8715>24 beshort 4 CMYK 8716>>12 beshort 5 \bA 8717>24 beshort 7 multichannel 8718>24 beshort 8 duotone 8719>24 beshort 9 lab 8720>12 beshort > 1 8721>>12 beshort x \b, %dx 8722>12 beshort 1 \b, 8723>22 beshort x %d-bit channel 8724>12 beshort > 1 \bs 8725 8726# XV thumbnail indicator (ThMO) 87270 string P7\ 332 XV thumbnail image data 8728 8729# NITF is defined by United States MIL-STD-2500A 87300 string NITF National Imagery Transmission Format 8731>25 string >\0 dated %.14s 8732 8733# GEM Image: Version 1, Headerlen 8 (Wolfram Kleff) 87340 belong 0x00010008 GEM Image data 8735>12 beshort x %d x 8736>14 beshort x %d, 8737>4 beshort x %d planes, 8738>8 beshort x %d x 8739>10 beshort x %d pixelsize 8740 8741# GEM Metafile (Wolfram Kleff) 87420 lelong 0x0018FFFF GEM Metafile data 8743>4 leshort x version %d 8744 8745# 8746# SMJPEG. A custom Motion JPEG format used by Loki Entertainment 8747# Software Torbjorn Andersson <d91tan@Update.UU.SE>. 8748# 87490 string \0\nSMJPEG SMJPEG 8750>8 belong x %d.x data 8751# According to the specification you could find any number of _TXT 8752# headers here, but I can't think of any way of handling that. None of 8753# the SMJPEG files I tried it on used this feature. Even if such a 8754# file is encountered the output should still be reasonable. 8755>16 string _SND \b, 8756>>24 beshort >0 %d Hz 8757>>26 byte 8 8-bit 8758>>26 byte 16 16-bit 8759>>28 string NONE uncompressed 8760# >>28 string APCM ADPCM compressed 8761>>27 byte 1 mono 8762>>28 byte 2 stereo 8763# Help! Isn't there any way to avoid writing this part twice? 8764>>32 string _VID \b, 8765# >>>48 string JFIF JPEG 8766>>>40 belong >0 %d frames 8767>>>44 beshort >0 (%d x 8768>>>46 beshort >0 %d) 8769>16 string _VID \b, 8770# >>32 string JFIF JPEG 8771>>24 belong >0 %d frames 8772>>28 beshort >0 (%d x 8773>>30 beshort >0 %d) 8774 87750 string Paint\ Shop\ Pro\ Image\ File Paint Shop Pro Image File 8776 8777# "thumbnail file" (icon) 8778# descended from "xv", but in use by other applications as well (Wolfram Kleff) 87790 string P7\ 332 XV "thumbnail file" (icon) data 8780 8781# taken from fkiss: (<yav@mte.biglobe.ne.jp> ?) 87820 string KiSS KISS/GS 8783>4 byte 16 color 8784>>5 byte x %d bit 8785>>8 leshort x %d colors 8786>>10 leshort x %d groups 8787>4 byte 32 cell 8788>>5 byte x %d bit 8789>>8 leshort x %d x 8790>>10 leshort x %d 8791>>12 leshort x +%d 8792>>14 leshort x +%d 8793 8794# Webshots (www.webshots.com), by John Harrison 87950 string C\253\221g\230\0\0\0 Webshots Desktop .wbz file 8796 8797# Hercules DASD image files 8798# From Jan Jaeger <jj@septa.nl> 87990 string CKD_P370 Hercules CKD DASD image file 8800>8 long x \b, %d heads per cylinder 8801>12 long x \b, track size %d bytes 8802>16 byte x \b, device type 33%2.2X 8803 88040 string CKD_C370 Hercules compressed CKD DASD image file 8805>8 long x \b, %d heads per cylinder 8806>12 long x \b, track size %d bytes 8807>16 byte x \b, device type 33%2.2X 8808 88090 string CKD_S370 Hercules CKD DASD shadow file 8810>8 long x \b, %d heads per cylinder 8811>12 long x \b, track size %d bytes 8812>16 byte x \b, device type 33%2.2X 8813 8814# Squeak images and programs - etoffi@softhome.net 88150 string \146\031\0\0 Squeak image data 88160 search/1 'From\040Squeak Squeak program text 8817 8818# partimage: file(1) magic for PartImage files (experimental, incomplete) 8819# Author: Hans-Joachim Baader <hjb@pro-linux.de> 88200 string PaRtImAgE-VoLuMe PartImage 8821>0x0020 string 0.6.1 file version %s 8822>>0x0060 lelong >-1 volume %ld 8823#>>0x0064 8 byte identifier 8824#>>0x007c reserved 8825>>0x0200 string >\0 type %s 8826>>0x1400 string >\0 device %s, 8827>>0x1600 string >\0 original filename %s, 8828# Some fields omitted 8829>>0x2744 lelong 0 not compressed 8830>>0x2744 lelong 1 gzip compressed 8831>>0x2744 lelong 2 bzip2 compressed 8832>>0x2744 lelong >2 compressed with unknown algorithm 8833>0x0020 string >0.6.1 file version %s 8834>0x0020 string <0.6.1 file version %s 8835 8836# DCX is multi-page PCX, using a simple header of up to 1024 8837# offsets for the respective PCX components. 8838# From: Joerg Wunsch <joerg_wunsch@uriah.heep.sax.de> 88390 lelong 987654321 DCX multi-page PCX image data 8840 8841# Simon Walton <simonw@matteworld.com> 8842# Kodak Cineon format for scanned negatives 8843# http://www.kodak.com/US/en/motion/support/dlad/ 88440 lelong 0xd75f2a80 Cineon image data 8845>200 belong >0 \b, %ld x 8846>204 belong >0 %ld 8847 8848 8849# Bio-Rad .PIC is an image format used by microscope control systems 8850# and related image processing software used by biologists. 8851# From: Vebjorn Ljosa <vebjorn@ljosa.com> 8852# BOOL values are two-byte integers; use them to rule out false positives. 8853# http://web.archive.org/web/20050317223257/www.cs.ubc.ca/spider/ladic/text/biorad.txt 8854# Samples: http://www.loci.wisc.edu/software/sample-data 885514 leshort <2 8856>62 leshort <2 8857>>54 leshort 12345 Bio-Rad .PIC Image File 8858>>>0 leshort >0 %hd x 8859>>>2 leshort >0 %hd, 8860>>>4 leshort =1 1 image in file 8861>>>4 leshort >1 %hd images in file 8862 8863# From Jan "Yenya" Kasprzak <kas@fi.muni.cz> 8864# The description of *.mrw format can be found at 8865# http://www.dalibor.cz/minolta/raw_file_format.htm 88660 string \000MRM Minolta Dimage camera raw image data 8867 8868# Summary: DjVu image / document 8869# Extension: .djvu 8870# Reference: http://djvu.org/docs/DjVu3Spec.djvu 8871# Submitted by: Stephane Loeuillet <stephane.loeuillet@tiscali.fr> 8872# Modified by (1): Abel Cheung <abelcheung@gmail.com> 88730 string AT&TFORM 8874>12 string DJVM DjVu multiple page document 8875!:mime image/vnd.djvu 8876>12 string DJVU DjVu image or single page document 8877!:mime image/vnd.djvu 8878>12 string DJVI DjVu shared document 8879!:mime image/vnd.djvu 8880>12 string THUM DjVu page thumbnails 8881!:mime image/vnd.djvu 8882 8883 8884# From Marc Espie 88850 lelong 20000630 OpenEXR image data 8886 8887# From: Tom Hilinski <tom.hilinski@comcast.net> 8888# http://www.unidata.ucar.edu/packages/netcdf/ 88890 string CDF\001 NetCDF Data Format data 8890 8891#----------------------------------------------------------------------- 8892# Hierarchical Data Format, used to facilitate scientific data exchange 8893# specifications at http://hdf.ncsa.uiuc.edu/ 88940 belong 0x0e031301 Hierarchical Data Format (version 4) data 8895!:mime application/x-hdf 88960 string \211HDF\r\n\032 Hierarchical Data Format (version 5) data 8897!:mime application/x-hdf 8898 8899# From: Tobias Burnus <burnus@net-b.de> 8900# Xara (for a while: Corel Xara) is a graphic package, see 8901# http://www.xara.com/ for Windows and as GPL application for Linux 89020 string XARA\243\243 Xara graphics file 8903 8904# http://www.cartesianinc.com/Tech/ 89050 string CPC\262 Cartesian Perceptual Compression image 8906!:mime image/x-cpi 8907 8908# From Albert Cahalan <acahalan@gmail.com> 8909# puredigital used it for the CVS disposable camcorder 8910#8 lelong 4 ZBM bitmap image data 8911#>4 leshort x %u x 8912#>6 leshort x %u 8913 8914# From Albert Cahalan <acahalan@gmail.com> 8915# uncompressed 5:6:5 HighColor image for OLPC XO firmware icons 89160 string C565 OLPC firmware icon image data 8917>4 leshort x %u x 8918>6 leshort x %u 8919 8920# Applied Images - Image files from Cytovision 8921# Gustavo Junior Alves <gjalves@gjalves.com.br> 89220 string \xce\xda\xde\xfa Cytovision Metaphases file 89230 string \xed\xad\xef\xac Cytovision Karyotype file 89240 string \x0b\x00\x03\x00 Cytovision FISH Probe file 89250 string \xed\xfe\xda\xbe Cytovision FLEX file 89260 string \xed\xab\xed\xfe Cytovision FLEX file 89270 string \xad\xfd\xea\xad Cytovision RATS file 8928 8929# Wavelet Scalar Quantization format used in gray-scale fingerprint images 8930# From Tano M Fotang <mfotang@quanteq.com> 89310 string \xff\xa0\xff\xa8\x00 Wavelet Scalar Quantization image data 8932 8933# JPEG 2000 Code Stream Bitmap 8934# From Petr Splichal <psplicha@redhat.com> 89350 string \xFF\x4F\xFF\x51\x00 JPEG-2000 Code Stream Bitmap data 8936 8937# Type: Ulead Photo Explorer5 (.pe5) 8938# URL: http://www.jisyo.com/cgibin/view.cgi?EXT=pe5 (Japanese) 8939# From: Simon Horman <horms@debian.org> 89400 string IIO2H Ulead Photo Explorer5 8941 8942# Type: X11 cursor 8943# URL: http://webcvs.freedesktop.org/mime/shared-mime-info/freedesktop.org.xml.in?view=markup 8944# From: Mathias Brodala <info@noctus.net> 89450 string Xcur X11 cursor 8946 8947# Type: Olympus ORF raw images. 8948# URL: http://libopenraw.freedesktop.org/wiki/Olympus_ORF 8949# From: Adam Buchbinder <adam.buchbinder@gmail.com> 89500 string MMOR Olympus ORF raw image data, big-endian 8951!:mime image/x-olympus-orf 89520 string IIRO Olympus ORF raw image data, little-endian 8953!:mime image/x-olympus-orf 89540 string IIRS Olympus ORF raw image data, little-endian 8955!:mime image/x-olympus-orf 8956 8957# Type: files used in modern AVCHD camcoders to store clip information 8958# Extension: .cpi 8959# From: Alexander Danilov <alexander.a.danilov@gmail.com> 89600 string HDMV0100 AVCHD Clip Information 8961 8962# From: Adam Buchbinder <adam.buchbinder@gmail.com> 8963# URL: http://local.wasp.uwa.edu.au/~pbourke/dataformats/pic/ 8964# Radiance HDR; usually has .pic or .hdr extension. 89650 string #?RADIANCE\n Radiance HDR image data 8966#!mime image/vnd.radiance 8967 8968# From: Adam Buchbinder <adam.buchbinder@gmail.com> 8969# URL: http://www.mpi-inf.mpg.de/resources/pfstools/pfs_format_spec.pdf 8970# Used by the pfstools packages. The regex matches for the image size could 8971# probably use some work. The MIME type is made up; if there's one in 8972# actual common use, it should replace the one below. 89730 string PFS1\x0a PFS HDR image data 8974#!mime image/x-pfs 8975>1 regex [0-9]*\ \b, %s 8976>>1 regex \ [0-9]{4} \bx%s 8977 8978# Type: Foveon X3F 8979# URL: http://www.photofo.com/downloads/x3f-raw-format.pdf 8980# From: Adam Buchbinder <adam.buchbinder@gmail.com> 8981# Note that the MIME type isn't defined anywhere that I can find; if 8982# there's a canonical type for this format, it should replace this one. 89830 string FOVb Foveon X3F raw image data 8984!:mime image/x-x3f 8985>6 leshort x \b, version %d. 8986>4 leshort x \b%d 8987>28 lelong x \b, %dx 8988>32 lelong x \b%d 8989 8990# Paint.NET file 8991# From Adam Buchbinder <adam.buchbinder@gmail.com> 89920 string PDN3 Paint.NET image data 8993!:mime image/x-paintnet 8994 8995#------------------------------------------------------------------------------ 8996# $File: inform,v 1.5 2009/09/19 16:28:09 christos Exp $ 8997# inform: file(1) magic for Inform interactive fiction language 8998 8999# URL: http://www.inform-fiction.org/ 9000# From: Reuben Thomas <rrt@sc3d.org> 9001 90020 search/100/cW constant\ story Inform source text 9003 9004#------------------------------------------------------------------------------ 9005# $File: intel,v 1.8 2009/09/19 16:28:10 christos Exp $ 9006# intel: file(1) magic for x86 Unix 9007# 9008# Various flavors of x86 UNIX executable/object (other than Xenix, which 9009# is in "microsoft"). DOS is in "msdos"; the ambitious soul can do 9010# Windows as well. 9011# 9012# Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and 9013# whatever comes next (HP-PA Hummingbird?). OS/2 may also go elsewhere 9014# as well, if, as, and when IBM makes it portable. 9015# 9016# The `versions' should be un-commented if they work for you. 9017# (Was the problem just one of endianness?) 9018# 90190 leshort 0502 basic-16 executable 9020>12 lelong >0 not stripped 9021#>22 leshort >0 - version %ld 90220 leshort 0503 basic-16 executable (TV) 9023>12 lelong >0 not stripped 9024#>22 leshort >0 - version %ld 90250 leshort 0510 x86 executable 9026>12 lelong >0 not stripped 90270 leshort 0511 x86 executable (TV) 9028>12 lelong >0 not stripped 90290 leshort =0512 iAPX 286 executable small model (COFF) 9030>12 lelong >0 not stripped 9031#>22 leshort >0 - version %ld 90320 leshort =0522 iAPX 286 executable large model (COFF) 9033>12 lelong >0 not stripped 9034#>22 leshort >0 - version %ld 9035# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan 90360 leshort =0514 80386 COFF executable 9037>12 lelong >0 not stripped 9038>22 leshort >0 - version %ld 9039 9040# rom: file(1) magic for BIOS ROM Extensions found in intel machines 9041# mapped into memory between 0xC0000 and 0xFFFFF 9042# From Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu 90430 beshort 0x55AA BIOS (ia32) ROM Ext. 9044>5 string USB USB 9045>7 string LDR UNDI image 9046>30 string IBM IBM comp. Video 9047>26 string Adaptec Adaptec 9048>28 string Adaptec Adaptec 9049>42 string PROMISE Promise 9050>2 byte x (%d*512) 9051 9052#------------------------------------------------------------------------------ 9053# $File: interleaf,v 1.10 2009/09/19 16:28:10 christos Exp $ 9054# interleaf: file(1) magic for InterLeaf TPS: 9055# 90560 string =\210OPS Interleaf saved data 90570 string =<!OPS Interleaf document text 9058>5 string ,\ Version\ = \b, version 9059>>17 string >\0 %.3s 9060 9061#------------------------------------------------------------------------------ 9062# $File: island,v 1.5 2009/09/19 16:28:10 christos Exp $ 9063# island: file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1 9064# "/etc/magic": 9065# From: guy@netapp.com (Guy Harris) 9066# 90674 string pgscriptver IslandWrite document 906813 string DrawFile IslandDraw document 9069 9070 9071#------------------------------------------------------------------------------ 9072# $File: ispell,v 1.8 2009/09/19 16:28:10 christos Exp $ 9073# ispell: file(1) magic for ispell 9074# 9075# Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602. This magic 9076# will match 0x9600 through 0x9603 in *both* little endian and big endian. 9077# (No other current magic entries collide.) 9078# 9079# Updated by Daniel Quinlan (quinlan@yggdrasil.com) 9080# 90810 leshort&0xFFFC 0x9600 little endian ispell 9082>0 byte 0 hash file (?), 9083>0 byte 1 3.0 hash file, 9084>0 byte 2 3.1 hash file, 9085>0 byte 3 hash file (?), 9086>2 leshort 0x00 8-bit, no capitalization, 26 flags 9087>2 leshort 0x01 7-bit, no capitalization, 26 flags 9088>2 leshort 0x02 8-bit, capitalization, 26 flags 9089>2 leshort 0x03 7-bit, capitalization, 26 flags 9090>2 leshort 0x04 8-bit, no capitalization, 52 flags 9091>2 leshort 0x05 7-bit, no capitalization, 52 flags 9092>2 leshort 0x06 8-bit, capitalization, 52 flags 9093>2 leshort 0x07 7-bit, capitalization, 52 flags 9094>2 leshort 0x08 8-bit, no capitalization, 128 flags 9095>2 leshort 0x09 7-bit, no capitalization, 128 flags 9096>2 leshort 0x0A 8-bit, capitalization, 128 flags 9097>2 leshort 0x0B 7-bit, capitalization, 128 flags 9098>2 leshort 0x0C 8-bit, no capitalization, 256 flags 9099>2 leshort 0x0D 7-bit, no capitalization, 256 flags 9100>2 leshort 0x0E 8-bit, capitalization, 256 flags 9101>2 leshort 0x0F 7-bit, capitalization, 256 flags 9102>4 leshort >0 and %d string characters 91030 beshort&0xFFFC 0x9600 big endian ispell 9104>1 byte 0 hash file (?), 9105>1 byte 1 3.0 hash file, 9106>1 byte 2 3.1 hash file, 9107>1 byte 3 hash file (?), 9108>2 beshort 0x00 8-bit, no capitalization, 26 flags 9109>2 beshort 0x01 7-bit, no capitalization, 26 flags 9110>2 beshort 0x02 8-bit, capitalization, 26 flags 9111>2 beshort 0x03 7-bit, capitalization, 26 flags 9112>2 beshort 0x04 8-bit, no capitalization, 52 flags 9113>2 beshort 0x05 7-bit, no capitalization, 52 flags 9114>2 beshort 0x06 8-bit, capitalization, 52 flags 9115>2 beshort 0x07 7-bit, capitalization, 52 flags 9116>2 beshort 0x08 8-bit, no capitalization, 128 flags 9117>2 beshort 0x09 7-bit, no capitalization, 128 flags 9118>2 beshort 0x0A 8-bit, capitalization, 128 flags 9119>2 beshort 0x0B 7-bit, capitalization, 128 flags 9120>2 beshort 0x0C 8-bit, no capitalization, 256 flags 9121>2 beshort 0x0D 7-bit, no capitalization, 256 flags 9122>2 beshort 0x0E 8-bit, capitalization, 256 flags 9123>2 beshort 0x0F 7-bit, capitalization, 256 flags 9124>4 beshort >0 and %d string characters 9125# ispell 4.0 hash files kromJx <kromJx@crosswinds.net> 9126# Ispell 4.0 91270 string ISPL ispell 9128>4 long x hash file version %d, 9129>8 long x lexletters %d, 9130>12 long x lexsize %d, 9131>16 long x hashsize %d, 9132>20 long x stblsize %d 9133 9134#------------------------------------------------------------ 9135# $File: java,v 1.12 2009/09/19 16:28:10 christos Exp $ 9136# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the 9137# same magic number, 0xcafebabe, so they are both handled 9138# in the entry called "cafebabe". 9139#------------------------------------------------------------ 9140# Java serialization 9141# From Martin Pool (m.pool@pharos.com.au) 91420 beshort 0xaced Java serialization data 9143>2 beshort >0x0004 \b, version %d 9144 91450 belong 0xfeedfeed Java KeyStore 9146!:mime application/x-java-keystore 91470 belong 0xcececece Java JCE KeyStore 9148!:mime application/x-java-jce-keystore 9149 9150# Dalvik .dex format. http://retrodev.com/android/dexformat.html 9151# From <mkf@google.com> "Mike Fleming" 91520 string dex\n 9153>0 regex dex\n[0-9][0-9][0-9]\0 Dalvik dex file 9154>4 string >000 version %s 91550 string dey\n 9156>0 regex dey\n[0-9][0-9][0-9]\0 Dalvik dex file (optimized for host) 9157>4 string >000 version %s 9158 9159 9160#------------------------------------------------------------------------------ 9161# $File: jpeg,v 1.15 2009/09/19 16:28:10 christos Exp $ 9162# JPEG images 9163# SunOS 5.5.1 had 9164# 9165# 0 string \377\330\377\340 JPEG file 9166# 0 string \377\330\377\356 JPG file 9167# 9168# both of which turn into "JPEG image data" here. 9169# 91700 beshort 0xffd8 JPEG image data 9171!:mime image/jpeg 9172!:apple 8BIMJPEG 9173!:strength +1 9174>6 string JFIF \b, JFIF standard 9175# The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06 9176# in a vain attempt to add image size reporting for JFIF. Note that these 9177# tests are not fool-proof since some perfectly valid JPEGs are currently 9178# impossible to specify in magic(4) format. 9179# First, a little JFIF version info: 9180>>11 byte x \b %d. 9181>>12 byte x \b%02d 9182# Next, the resolution or aspect ratio of the image: 9183#>>13 byte 0 \b, aspect ratio 9184#>>13 byte 1 \b, resolution (DPI) 9185#>>13 byte 2 \b, resolution (DPCM) 9186#>>4 beshort x \b, segment length %d 9187# Next, show thumbnail info, if it exists: 9188>>18 byte !0 \b, thumbnail %dx 9189>>>19 byte x \b%d 9190 9191# EXIF moved down here to avoid reporting a bogus version number, 9192# and EXIF version number printing added. 9193# - Patrik R=E5dman <patrik+file-magic@iki.fi> 9194>6 string Exif \b, EXIF standard 9195# Look for EXIF IFD offset in IFD 0, and then look for EXIF version tag in EXIF IFD. 9196# All possible combinations of entries have to be enumerated, since no looping 9197# is possible. And both endians are possible... 9198# The combinations included below are from real-world JPEGs. 9199# Little-endian 9200>>12 string II 9201# IFD 0 Entry #5: 9202>>>70 leshort 0x8769 9203# EXIF IFD Entry #1: 9204>>>>(78.l+14) leshort 0x9000 9205>>>>>(78.l+23) byte x %c 9206>>>>>(78.l+24) byte x \b.%c 9207>>>>>(78.l+25) byte !0x30 \b%c 9208# IFD 0 Entry #9: 9209>>>118 leshort 0x8769 9210# EXIF IFD Entry #3: 9211>>>>(126.l+38) leshort 0x9000 9212>>>>>(126.l+47) byte x %c 9213>>>>>(126.l+48) byte x \b.%c 9214>>>>>(126.l+49) byte !0x30 \b%c 9215# IFD 0 Entry #10 9216>>>130 leshort 0x8769 9217# EXIF IFD Entry #3: 9218>>>>(138.l+38) leshort 0x9000 9219>>>>>(138.l+47) byte x %c 9220>>>>>(138.l+48) byte x \b.%c 9221>>>>>(138.l+49) byte !0x30 \b%c 9222# EXIF IFD Entry #4: 9223>>>>(138.l+50) leshort 0x9000 9224>>>>>(138.l+59) byte x %c 9225>>>>>(138.l+60) byte x \b.%c 9226>>>>>(138.l+61) byte !0x30 \b%c 9227# EXIF IFD Entry #5: 9228>>>>(138.l+62) leshort 0x9000 9229>>>>>(138.l+71) byte x %c 9230>>>>>(138.l+72) byte x \b.%c 9231>>>>>(138.l+73) byte !0x30 \b%c 9232# IFD 0 Entry #11 9233>>>142 leshort 0x8769 9234# EXIF IFD Entry #3: 9235>>>>(150.l+38) leshort 0x9000 9236>>>>>(150.l+47) byte x %c 9237>>>>>(150.l+48) byte x \b.%c 9238>>>>>(150.l+49) byte !0x30 \b%c 9239# EXIF IFD Entry #4: 9240>>>>(150.l+50) leshort 0x9000 9241>>>>>(150.l+59) byte x %c 9242>>>>>(150.l+60) byte x \b.%c 9243>>>>>(150.l+61) byte !0x30 \b%c 9244# EXIF IFD Entry #5: 9245>>>>(150.l+62) leshort 0x9000 9246>>>>>(150.l+71) byte x %c 9247>>>>>(150.l+72) byte x \b.%c 9248>>>>>(150.l+73) byte !0x30 \b%c 9249# Big-endian 9250>>12 string MM 9251# IFD 0 Entry #9: 9252>>>118 beshort 0x8769 9253# EXIF IFD Entry #1: 9254>>>>(126.L+14) beshort 0x9000 9255>>>>>(126.L+23) byte x %c 9256>>>>>(126.L+24) byte x \b.%c 9257>>>>>(126.L+25) byte !0x30 \b%c 9258# EXIF IFD Entry #3: 9259>>>>(126.L+38) beshort 0x9000 9260>>>>>(126.L+47) byte x %c 9261>>>>>(126.L+48) byte x \b.%c 9262>>>>>(126.L+49) byte !0x30 \b%c 9263# IFD 0 Entry #10 9264>>>130 beshort 0x8769 9265# EXIF IFD Entry #3: 9266>>>>(138.L+38) beshort 0x9000 9267>>>>>(138.L+47) byte x %c 9268>>>>>(138.L+48) byte x \b.%c 9269>>>>>(138.L+49) byte !0x30 \b%c 9270# EXIF IFD Entry #5: 9271>>>>(138.L+62) beshort 0x9000 9272>>>>>(138.L+71) byte x %c 9273>>>>>(138.L+72) byte x \b.%c 9274>>>>>(138.L+73) byte !0x30 \b%c 9275# IFD 0 Entry #11 9276>>>142 beshort 0x8769 9277# EXIF IFD Entry #4: 9278>>>>(150.L+50) beshort 0x9000 9279>>>>>(150.L+59) byte x %c 9280>>>>>(150.L+60) byte x \b.%c 9281>>>>>(150.L+61) byte !0x30 \b%c 9282# Here things get sticky. We can do ONE MORE marker segment with 9283# indirect addressing, and that's all. It would be great if we could 9284# do pointer arithemetic like in an assembler language. Christos? 9285# And if there was some sort of looping construct to do searches, plus a few 9286# named accumulators, it would be even more effective... 9287# At least we can show a comment if no other segments got inserted before: 9288>(4.S+5) byte 0xFE 9289>>(4.S+8) string >\0 \b, comment: "%s" 9290# FIXME: When we can do non-byte counted strings, we can use that to get 9291# the string's count, and fix Debian bug #283760 9292#>(4.S+5) byte 0xFE \b, comment 9293#>>(4.S+6) beshort x \b length=%d 9294#>>(4.S+8) string >\0 \b, "%s" 9295# Or, we can show the encoding type (I've included only the three most common) 9296# and image dimensions if we are lucky and the SOFn (image segment) is here: 9297>(4.S+5) byte 0xC0 \b, baseline 9298>>(4.S+6) byte x \b, precision %d 9299>>(4.S+7) beshort x \b, %dx 9300>>(4.S+9) beshort x \b%d 9301>(4.S+5) byte 0xC1 \b, extended sequential 9302>>(4.S+6) byte x \b, precision %d 9303>>(4.S+7) beshort x \b, %dx 9304>>(4.S+9) beshort x \b%d 9305>(4.S+5) byte 0xC2 \b, progressive 9306>>(4.S+6) byte x \b, precision %d 9307>>(4.S+7) beshort x \b, %dx 9308>>(4.S+9) beshort x \b%d 9309# I've commented-out quantisation table reporting. I doubt anyone cares yet. 9310#>(4.S+5) byte 0xDB \b, quantisation table 9311#>>(4.S+6) beshort x \b length=%d 9312#>14 beshort x \b, %d x 9313#>16 beshort x \b %d 9314 9315# HSI is Handmade Software's proprietary JPEG encoding scheme 93160 string hsi1 JPEG image data, HSI proprietary 9317 9318# From: David Santinoli <david@santinoli.com> 93190 string \x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A JPEG 2000 image data 9320 9321# Type: JPEG 2000 codesream 9322# From: Mathieu Malaterre <mathieu.malaterre@gmail.com> 93230 belong 0xff4fff51 JPEG 2000 codestream 932445 beshort 0xff52 9325 9326#------------------------------------------------------------------------------ 9327# $File: karma,v 1.6 2009/09/19 16:28:10 christos Exp $ 9328# karma: file(1) magic for Karma data files 9329# 9330# From <rgooch@atnf.csiro.au> 9331 93320 string KarmaRHD Version Karma Data Structure Version 9333>16 belong x %lu 9334 9335#------------------------------------------------------------------------------ 9336# $File: kde,v 1.4 2009/09/19 16:28:10 christos Exp $ 9337# kde: file(1) magic for KDE 9338 93390 string [KDE\ Desktop\ Entry] KDE desktop entry 9340!:mime application/x-kdelnk 93410 string #\ KDE\ Config\ File KDE config file 9342!:mime application/x-kdelnk 93430 string #\ xmcd xmcd database file for kscd 9344!:mime text/x-xmcd 9345 9346#------------------------------------------------------------------------------ 9347# $File: kml,v 1.2 2009/09/19 16:28:10 christos Exp $ 9348# Type: Google KML, formerly Keyhole Markup Language 9349# Future development of this format has been handed 9350# over to the Open Geospatial Consortium. 9351# http://www.opengeospatial.org/standards/kml/ 9352# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 93530 string \<?xml 9354>20 search/400 \ xmlns= 9355>>&0 regex ['"]http://earth.google.com/kml Google KML document 9356!:mime application/vnd.google-earth.kml+xml 9357>>>&1 string 2.0' \b, version 2.0 9358>>>&1 string 2.1' \b, version 2.1 9359>>>&1 string 2.2' \b, version 2.2 9360 9361#------------------------------------------------------------------------------ 9362# Type: OpenGIS KML, formerly Keyhole Markup Language 9363# This standard is maintained by the 9364# Open Geospatial Consortium. 9365# http://www.opengeospatial.org/standards/kml/ 9366# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 9367>>&0 regex ['"]http://www.opengis.net/kml OpenGIS KML document 9368!:mime application/vnd.google-earth.kml+xml 9369>>>&1 string 2.2 \b, version 2.2 9370 9371#------------------------------------------------------------------------------ 9372# Type: Google KML Archive (ZIP based) 9373# http://code.google.com/apis/kml/documentation/kml_tut.html 9374# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 93750 string PK\003\004 9376>4 byte 0x14 9377>>30 string doc.kml Compressed Google KML Document, including resources. 9378!:mime application/vnd.google-earth.kmz 9379 9380#------------------------------------------------------------------------------ 9381# $File: lecter,v 1.4 2009/09/19 16:28:10 christos Exp $ 9382# DEC SRC Virtual Paper: Lectern files 9383# Karl M. Hegbloom <karlheg@inetarena.com> 93840 string lect DEC SRC Virtual Paper Lectern file 9385 9386#------------------------------------------------------------------------------ 9387# $File: lex,v 1.6 2009/09/19 16:28:10 christos Exp $ 9388# lex: file(1) magic for lex 9389# 9390# derived empirically, your offsets may vary! 93910 search/100 yyprevious C program text (from lex) 9392>3 search/1 >\0 for %s 9393# C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com> 93940 search/100 generated\ by\ flex C program text (from flex) 9395# lex description file, from Daniel Quinlan <quinlan@yggdrasil.com> 93960 search/1 %{ lex description text 9397 9398#------------------------------------------------------------------------------ 9399# $File: lif,v 1.8 2009/09/19 16:28:10 christos Exp $ 9400# lif: file(1) magic for lif 9401# 9402# (Daniel Quinlan <quinlan@yggdrasil.com>) 9403# 94040 beshort 0x8000 lif file 9405 9406#------------------------------------------------------------------------------ 9407# $File: linux,v 1.33 2009/10/23 16:44:59 christos Exp $ 9408# linux: file(1) magic for Linux files 9409# 9410# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com> 9411# The following basic Linux magic is useful for reference, but using 9412# "long" magic is a better practice in order to avoid collisions. 9413# 9414# 2 leshort 100 Linux/i386 9415# >0 leshort 0407 impure executable (OMAGIC) 9416# >0 leshort 0410 pure executable (NMAGIC) 9417# >0 leshort 0413 demand-paged executable (ZMAGIC) 9418# >0 leshort 0314 demand-paged executable (QMAGIC) 9419# 94200 lelong 0x00640107 Linux/i386 impure executable (OMAGIC) 9421>16 lelong 0 \b, stripped 94220 lelong 0x00640108 Linux/i386 pure executable (NMAGIC) 9423>16 lelong 0 \b, stripped 94240 lelong 0x0064010b Linux/i386 demand-paged executable (ZMAGIC) 9425>16 lelong 0 \b, stripped 94260 lelong 0x006400cc Linux/i386 demand-paged executable (QMAGIC) 9427>16 lelong 0 \b, stripped 9428# 94290 string \007\001\000 Linux/i386 object file 9430>20 lelong >0x1020 \b, DLL library 9431# Linux-8086 stuff: 94320 string \01\03\020\04 Linux-8086 impure executable 9433>28 long !0 not stripped 94340 string \01\03\040\04 Linux-8086 executable 9435>28 long !0 not stripped 9436# 94370 string \243\206\001\0 Linux-8086 object file 9438# 94390 string \01\03\020\20 Minix-386 impure executable 9440>28 long !0 not stripped 94410 string \01\03\040\20 Minix-386 executable 9442>28 long !0 not stripped 9443# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov> 9444216 lelong 0421 Linux/i386 core file 9445>220 string >\0 of '%s' 9446>200 lelong >0 (signal %d) 9447# 9448# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com> 9449# this can be overridden by the DOS executable (COM) entry 94502 string LILO Linux/i386 LILO boot/chain loader 9451# 9452# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com> 9453# Updated by Adam Buchbinder <adam.buchbinder@gmail.com> 9454# See: http://www.win.tue.nl/~aeb/linux/kbd/font-formats-1.html 94550 leshort 0x0436 Linux/i386 PC Screen Font v1 data, 9456>2 byte&0x01 0 256 characters, 9457>2 byte&0x01 !0 512 characters, 9458>2 byte&0x02 0 no directory, 9459>2 byte&0x02 !0 Unicode directory, 9460>3 byte >0 8x%d 94610 string \x72\xb5\x4a\x86\x00\x00 Linux/i386 PC Screen Font v2 data, 9462>16 lelong x %d characters, 9463>12 lelong&0x01 0 no directory, 9464>12 lelong&0x01 !0 Unicode directory, 9465>24 lelong x %d 9466>28 lelong x \bx%d 9467 9468# Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com> 94694086 string SWAP-SPACE Linux/i386 swap file 9470# From: Jeff Bailey <jbailey@ubuntu.com> 9471# Linux swap file with swsusp1 image, from Jeff Bailey <jbailey@ubuntu.com> 94724076 string SWAPSPACE2S1SUSPEND Linux/i386 swap file (new style) with SWSUSP1 image 9473# according to man page of mkswap (8) March 1999 9474# volume label and UUID Russell Coker 9475# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/ 94764086 string SWAPSPACE2 Linux/i386 swap file (new style), 9477>0x400 long x version %d (4K pages), 9478>0x404 long x size %d pages, 9479>1052 string \0 no label, 9480>1052 string >\0 LABEL=%s, 9481>0x40c belong x UUID=%08x 9482>0x410 beshort x \b-%04x 9483>0x412 beshort x \b-%04x 9484>0x414 beshort x \b-%04x 9485>0x416 belong x \b-%08x 9486>0x41a beshort x \b%04x 9487# From Daniel Novotny <dnovotny@redhat.com> 9488# swap file for PowerPC 948965526 string SWAPSPACE2 Linux/ppc swap file 9490# ECOFF magic for OSF/1 and Linux (only tested under Linux though) 9491# 9492# from Erik Troan (ewt@redhat.com) examining od dumps, so this 9493# could be wrong 9494# updated by David Mosberger (davidm@azstarnet.com) based on 9495# GNU BFD and MIPS info found below. 9496# 94970 leshort 0x0183 ECOFF alpha 9498>24 leshort 0407 executable 9499>24 leshort 0410 pure 9500>24 leshort 0413 demand paged 9501>8 long >0 not stripped 9502>8 long 0 stripped 9503>23 leshort >0 - version %ld. 9504# 9505# Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu> 9506# and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de> 9507# and Nicol�s Lichtmaier <nick@debian.org> 9508# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29 9509# Linux kernel boot images (i386 arch) (Wolfram Kleff) 9510514 string HdrS Linux kernel 9511>510 leshort 0xAA55 x86 boot executable 9512>>518 leshort >0x1ff 9513>>>529 byte 0 zImage, 9514>>>529 byte 1 bzImage, 9515>>>(526.s+0x200) string >\0 version %s, 9516>>498 leshort 1 RO-rootFS, 9517>>498 leshort 0 RW-rootFS, 9518>>508 leshort >0 root_dev 0x%X, 9519>>502 leshort >0 swap_dev 0x%X, 9520>>504 leshort >0 RAMdisksize %u KB, 9521>>506 leshort 0xFFFF Normal VGA 9522>>506 leshort 0xFFFE Extended VGA 9523>>506 leshort 0xFFFD Prompt for Videomode 9524>>506 leshort >0 Video mode %d 9525# This also matches new kernels, which were caught above by "HdrS". 95260 belong 0xb8c0078e Linux kernel 9527>0x1e3 string Loading version 1.3.79 or older 9528>0x1e9 string Loading from prehistoric times 9529 9530# System.map files - Nicol�s Lichtmaier <nick@debian.org> 95318 search/1 \ A\ _text Linux kernel symbol map text 9532 9533# LSM entries - Nicol�s Lichtmaier <nick@debian.org> 95340 search/1 Begin3 Linux Software Map entry text 95350 search/1 Begin4 Linux Software Map entry text (new format) 9536 9537# From Matt Zimmerman, enhanced for v3 by Matthew Palmer 95380 belong 0x4f4f4f4d User-mode Linux COW file 9539>4 belong <3 \b, version %d 9540>>8 string >\0 \b, backing file %s 9541>4 belong >2 \b, version %d 9542>>32 string >\0 \b, backing file %s 9543 9544############################################################################ 9545# Linux kernel versions 9546 95470 string \xb8\xc0\x07\x8e\xd8\xb8\x00\x90 Linux 9548>497 leshort 0 x86 boot sector 9549>>514 belong 0x8e of a kernel from the dawn of time! 9550>>514 belong 0x908ed8b4 version 0.99-1.1.42 9551>>514 belong 0x908ed8b8 for memtest86 9552 9553>497 leshort !0 x86 kernel 9554>>504 leshort >0 RAMdisksize=%u KB 9555>>502 leshort >0 swap=0x%X 9556>>508 leshort >0 root=0x%X 9557>>>498 leshort 1 \b-ro 9558>>>498 leshort 0 \b-rw 9559>>506 leshort 0xFFFF vga=normal 9560>>506 leshort 0xFFFE vga=extended 9561>>506 leshort 0xFFFD vga=ask 9562>>506 leshort >0 vga=%d 9563>>514 belong 0x908ed881 version 1.1.43-1.1.45 9564>>514 belong 0x15b281cd 9565>>>0xa8e belong 0x55AA5a5a version 1.1.46-1.2.13,1.3.0 9566>>>0xa99 belong 0x55AA5a5a version 1.3.1,2 9567>>>0xaa3 belong 0x55AA5a5a version 1.3.3-1.3.30 9568>>>0xaa6 belong 0x55AA5a5a version 1.3.31-1.3.41 9569>>>0xb2b belong 0x55AA5a5a version 1.3.42-1.3.45 9570>>>0xaf7 belong 0x55AA5a5a version 1.3.46-1.3.72 9571>>514 string HdrS 9572>>>518 leshort >0x1FF 9573>>>>529 byte 0 \b, zImage 9574>>>>529 byte 1 \b, bzImage 9575>>>>(526.s+0x200) string >\0 \b, version %s 9576 9577# Linux boot sector thefts. 95780 belong 0xb8c0078e Linux 9579>0x1e6 belong 0x454c4b53 ELKS Kernel 9580>0x1e6 belong !0x454c4b53 style boot sector 9581 9582############################################################################ 9583# Linux 8086 executable 95840 lelong&0xFF0000FF 0xC30000E9 Linux-Dev86 executable, headerless 9585>5 string . 9586>>4 string >\0 \b, libc version %s 9587 95880 lelong&0xFF00FFFF 0x4000301 Linux-8086 executable 9589>2 byte&0x01 !0 \b, unmapped zero page 9590>2 byte&0x20 0 \b, impure 9591>2 byte&0x20 !0 9592>>2 byte&0x10 !0 \b, A_EXEC 9593>2 byte&0x02 !0 \b, A_PAL 9594>2 byte&0x04 !0 \b, A_NSYM 9595>2 byte&0x08 !0 \b, A_STAND 9596>2 byte&0x40 !0 \b, A_PURE 9597>2 byte&0x80 !0 \b, A_TOVLY 9598>28 long !0 \b, not stripped 9599>37 string . 9600>>36 string >\0 \b, libc version %s 9601 9602# 0 lelong&0xFF00FFFF 0x10000301 ld86 I80386 executable 9603# 0 lelong&0xFF00FFFF 0xB000301 ld86 M68K executable 9604# 0 lelong&0xFF00FFFF 0xC000301 ld86 NS16K executable 9605# 0 lelong&0xFF00FFFF 0x17000301 ld86 SPARC executable 9606 9607# SYSLINUX boot logo files (from 'ppmtolss16' sources) 9608# http://syslinux.zytor.com/ 9609# 96100 lelong =0x1413f33d SYSLINUX' LSS16 image data 9611>4 leshort x \b, width %d 9612>6 leshort x \b, height %d 9613 96140 string OOOM User-Mode-Linux's Copy-On-Write disk image 9615>4 belong x version %d 9616 9617# SE Linux policy database 9618# From: Mike Frysinger <vapier@gentoo.org> 96190 lelong 0xf97cff8c SE Linux policy 9620>16 lelong x v%d 9621>20 lelong 1 MLS 9622>24 lelong x %d symbols 9623>28 lelong x %d ocons 9624 9625# Linux Logical Volume Manager (LVM) 9626# Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net> 9627# 9628# System ID, UUID and volume group name are 128 bytes long 9629# but they should never be full and initialized with zeros... 9630# 9631# LVM1 9632# 96330x0 string HM\001 LVM1 (Linux Logical Volume Manager), version 1 9634>0x12c string >\0 , System ID: %s 9635 96360x0 string HM\002 LVM1 (Linux Logical Volume Manager), version 2 9637>0x12c string >\0 , System ID: %s 9638 9639# LVM2 9640# 9641# It seems that the label header can be in one the four first sector 9642# of the disk... (from _find_labeller in lib/label/label.c of LVM2) 9643# 9644# 0x200 seems to be the common case 9645 96460x218 string LVM2\ 001 LVM2 (Linux Logical Volume Manager) 9647# read the offset to add to the start of the header, and the header 9648# start in 0x200 9649>(0x214.l+0x200) string >\0 , UUID: %s 9650 96510x018 string LVM2\ 001 LVM2 (Linux Logical Volume Manager) 9652>(0x014.l) string >\0 , UUID: %s 9653 96540x418 string LVM2\ 001 LVM2 (Linux Logical Volume Manager) 9655>(0x414.l+0x400) string >\0 , UUID: %s 9656 96570x618 string LVM2\ 001 LVM2 (Linux Logical Volume Manager) 9658>(0x614.l+0x600) string >\0 , UUID: %s 9659 9660# LVM snapshot 9661# from Jason Farrel 96620 string SnAp LVM Snapshot (CopyOnWrite store) 9663>4 lelong !0 - valid, 9664>4 lelong 0 - invalid, 9665>8 lelong x version %d, 9666>12 lelong x chunk_size %d 9667 9668# SE Linux policy database 96690 lelong 0xf97cff8c SE Linux policy 9670>16 lelong x v%d 9671>20 lelong 1 MLS 9672>24 lelong x %d symbols 9673>28 lelong x %d ocons 9674 9675# LUKS: Linux Unified Key Setup, On-Disk Format, http://luks.endorphin.org/spec 9676# Anthon van der Neut (anthon@mnt.org) 96770 string LUKS\xba\xbe LUKS encrypted file, 9678>6 beshort x ver %d 9679>8 string x [%s, 9680>40 string x %s, 9681>72 string x %s] 9682>168 string x UUID: %s 9683 9684 9685# Summary: Xen saved domain file 9686# Created by: Radek Vokal <rvokal@redhat.com> 96870 string LinuxGuestRecord Xen saved domain 9688>20 search/256 (name 9689>>&1 string x (name %s) 9690 9691# Type: Xen, the virtual machine monitor 9692# From: Radek Vokal <rvokal@redhat.com> 96930 string LinuxGuestRecord Xen saved domain 9694#>2 regex \(name\ [^)]*\) %s 9695>20 search/256 (name (name 9696>>&1 string x %s...) 9697 9698#------------------------------------------------------------------------------ 9699# $File: lisp,v 1.23 2009/09/19 16:28:10 christos Exp $ 9700# lisp: file(1) magic for lisp programs 9701# 9702# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com) 9703 9704# updated by Joerg Jenderek 9705# GRR: This lot is too weak 9706#0 string ;; 9707# windows INF files often begin with semicolon and use CRLF as line end 9708# lisp files are mainly created on unix system with LF as line end 9709#>2 search/4096 !\r Lisp/Scheme program text 9710#>2 search/4096 \r Windows INF file 9711 97120 search/4096 (setq\ Lisp/Scheme program text 9713!:mime text/x-lisp 97140 search/4096 (defvar\ Lisp/Scheme program text 9715!:mime text/x-lisp 97160 search/4096 (defparam\ Lisp/Scheme program text 9717!:mime text/x-lisp 97180 search/4096 (defun\ Lisp/Scheme program text 9719!:mime text/x-lisp 97200 search/4096 (autoload\ Lisp/Scheme program text 9721!:mime text/x-lisp 97220 search/4096 (custom-set-variables\ Lisp/Scheme program text 9723!:mime text/x-lisp 9724 9725# Emacs 18 - this is always correct, but not very magical. 97260 string \012( Emacs v18 byte-compiled Lisp data 9727!:mime application/x-elc 9728# Emacs 19+ - ver. recognition added by Ian Springer 9729# Also applies to XEmacs 19+ .elc files; could tell them apart with regexs 9730# - Chris Chittleborough <cchittleborough@yahoo.com.au> 97310 string ;ELC 9732>4 byte >18 9733>4 byte <32 Emacs/XEmacs v%d byte-compiled Lisp data 9734!:mime application/x-elc 9735 9736# Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr> 97370 string (SYSTEM::VERSION\040' CLISP byte-compiled Lisp program (pre 2004-03-27) 97380 string (|SYSTEM|::|VERSION|\040' CLISP byte-compiled Lisp program text 9739 97400 long 0x70768BD2 CLISP memory image data 97410 long 0xD28B7670 CLISP memory image data, other endian 9742 9743#.com and .bin for MIT scheme 97440 string \372\372\372\372 MIT scheme (library?) 9745 9746# From: David Allouche <david@allouche.net> 97470 search/1 \<TeXmacs| TeXmacs document text 9748!:mime text/texmacs 9749 9750#------------------------------------------------------------------------------ 9751# $File: llvm,v 1.4 2009/09/19 16:28:10 christos Exp $ 9752# llvm: file(1) magic for LLVM byte-codes 9753# URL: http://llvm.org/docs/BitCodeFormat.html 9754# From: Al Stone <ahs3@fc.hp.com> 9755 97560 string llvm LLVM byte-codes, uncompressed 97570 string llvc0 LLVM byte-codes, null compression 97580 string llvc1 LLVM byte-codes, gzip compression 97590 string llvc2 LLVM byte-codes, bzip2 compression 97600 string \xde\xc0\x17\x0b LLVM bitcode, wrapper 97610 string BC\xc0\xde LLVM bitcode 9762 9763#------------------------------------------------------------------------------ 9764# $File: lua,v 1.5 2009/09/19 16:28:10 christos Exp $ 9765# lua: file(1) magic for Lua scripting language 9766# URL: http://www.lua.org/ 9767# From: Reuben Thomas <rrt@sc3d.org>, Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr> 9768 9769# Lua scripts 97700 search/1/w #!\ /usr/bin/lua Lua script text executable 9771!:mime text/x-lua 97720 search/1/w #!\ /usr/local/bin/lua Lua script text executable 9773!:mime text/x-lua 97740 search/1 #!/usr/bin/env\ lua Lua script text executable 9775!:mime text/x-lua 97760 search/1 #!\ /usr/bin/env\ lua Lua script text executable 9777!:mime text/x-lua 9778 9779# Lua bytecode 97800 string \033Lua Lua bytecode, 9781>4 byte 0x50 version 5.0 9782>4 byte 0x51 version 5.1 9783 9784#------------------------------------------------------------------------------ 9785# $File: luks,v 1.4 2009/09/19 16:28:10 christos Exp $ 9786# luks: file(1) magic for Linux Unified Key Setup 9787# URL: http://luks.endorphin.org/spec 9788# From: Anthon van der Neut <anthon@mnt.org> 9789 97900 string LUKS\xba\xbe LUKS encrypted file, 9791>6 beshort x ver %d 9792>8 string x [%s, 9793>40 string x %s, 9794>72 string x %s] 9795>168 string x UUID: %s 9796 9797#------------------------------------------------------------ 9798# $File: mach,v 1.9 2009/09/19 16:28:10 christos Exp $ 9799# Mach has two magic numbers, 0xcafebabe and 0xfeedface. 9800# Unfortunately the first, cafebabe, is shared with 9801# Java ByteCode, so they are both handled in the file "cafebabe". 9802# The "feedface" ones are handled herein. 9803#------------------------------------------------------------ 98040 lelong&0xfffffffe 0xfeedface Mach-O 9805>0 byte 0xcf 64-bit 9806>12 lelong 1 object 9807>12 lelong 2 executable 9808>12 lelong 3 fixed virtual memory shared library 9809>12 lelong 4 core 9810>12 lelong 5 preload executable 9811>12 lelong 6 dynamically linked shared library 9812>12 lelong 7 dynamic linker 9813>12 lelong 8 bundle 9814>12 lelong 9 dynamically linked shared library stub 9815>12 lelong >9 9816>>12 lelong x filetype=%ld 9817>4 lelong <0 9818>>4 lelong x architecture=%ld 9819>4 lelong 1 vax 9820>4 lelong 2 romp 9821>4 lelong 3 architecture=3 9822>4 lelong 4 ns32032 9823>4 lelong 5 ns32332 9824>4 lelong 6 m68k 9825>4 lelong 7 i386 9826>4 lelong 8 mips 9827>4 lelong 9 ns32532 9828>4 lelong 10 architecture=10 9829>4 lelong 11 hppa 9830>4 lelong 12 acorn 9831>4 lelong 13 m88k 9832>4 lelong 14 sparc 9833>4 lelong 15 i860-big 9834>4 lelong 16 i860 9835>4 lelong 17 rs6000 9836>4 lelong 18 ppc 9837>4 lelong 16777234 ppc64 9838>4 lelong >16777234 9839>>4 lelong x architecture=%ld 9840# 98410 belong&0xfffffffe 0xfeedface Mach-O 9842>3 byte 0xcf 64-bit 9843>12 belong 1 object 9844>12 belong 2 executable 9845>12 belong 3 fixed virtual memory shared library 9846>12 belong 4 core 9847>12 belong 5 preload executable 9848>12 belong 6 dynamically linked shared library 9849>12 belong 7 dynamic linker 9850>12 belong 8 bundle 9851>12 belong 9 dynamically linked shared library stub 9852>12 belong >9 9853>>12 belong x filetype=%ld 9854>4 belong <0 9855>>4 belong x architecture=%ld 9856>4 belong 1 vax 9857>4 belong 2 romp 9858>4 belong 3 architecture=3 9859>4 belong 4 ns32032 9860>4 belong 5 ns32332 9861>4 belong 6 for m68k architecture 9862# from NeXTstep 3.0 <mach/machine.h> 9863# i.e. mc680x0_all, ignore 9864# >>8 belong 1 (mc68030) 9865>>8 belong 2 (mc68040) 9866>>8 belong 3 (mc68030 only) 9867>4 belong 7 i386 9868>4 belong 8 mips 9869>4 belong 9 ns32532 9870>4 belong 10 architecture=10 9871>4 belong 11 hppa 9872>4 belong 12 acorn 9873>4 belong 13 m88k 9874>4 belong 14 sparc 9875>4 belong 15 i860-big 9876>4 belong 16 i860 9877>4 belong 17 rs6000 9878>4 belong 18 ppc 9879>4 belong 16777234 ppc64 9880>4 belong >16777234 9881>>4 belong x architecture=%ld 9882 9883#------------------------------------------------------------------------------ 9884# $File: macintosh,v 1.20 2009/09/19 16:28:10 christos Exp $ 9885# macintosh description 9886# 9887# BinHex is the Macintosh ASCII-encoded file format (see also "apple") 9888# Daniel Quinlan, quinlan@yggdrasil.com 988911 string must\ be\ converted\ with\ BinHex BinHex binary text 9890!:mime application/mac-binhex40 9891>41 string x \b, version %.3s 9892 9893# Stuffit archives are the de facto standard of compression for Macintosh 9894# files obtained from most archives. (franklsm@tuns.ca) 98950 string SIT! StuffIt Archive (data) 9896!:mime application/x-stuffit 9897!:apple SIT!SIT! 9898>2 string x : %s 98990 string SITD StuffIt Deluxe (data) 9900>2 string x : %s 99010 string Seg StuffIt Deluxe Segment (data) 9902>2 string x : %s 9903 9904# Newer StuffIt archives (grant@netbsd.org) 99050 string StuffIt StuffIt Archive 9906!:mime application/x-stuffit 9907!:apple SIT!SIT! 9908#>162 string >0 : %s 9909 9910# Macintosh Applications and Installation binaries (franklsm@tuns.ca) 9911# GRR: Too weak 9912#0 string APPL Macintosh Application (data) 9913#>2 string x \b: %s 9914 9915# Macintosh System files (franklsm@tuns.ca) 9916# GRR: Too weak 9917#0 string zsys Macintosh System File (data) 9918#0 string FNDR Macintosh Finder (data) 9919#0 string libr Macintosh Library (data) 9920#>2 string x : %s 9921#0 string shlb Macintosh Shared Library (data) 9922#>2 string x : %s 9923#0 string cdev Macintosh Control Panel (data) 9924#>2 string x : %s 9925#0 string INIT Macintosh Extension (data) 9926#>2 string x : %s 9927#0 string FFIL Macintosh Truetype Font (data) 9928#>2 string x : %s 9929#0 string LWFN Macintosh Postscript Font (data) 9930#>2 string x : %s 9931 9932# Additional Macintosh Files (franklsm@tuns.ca) 9933# GRR: Too weak 9934#0 string PACT Macintosh Compact Pro Archive (data) 9935#>2 string x : %s 9936#0 string ttro Macintosh TeachText File (data) 9937#>2 string x : %s 9938#0 string TEXT Macintosh TeachText File (data) 9939#>2 string x : %s 9940#0 string PDF Macintosh PDF File (data) 9941#>2 string x : %s 9942 9943# MacBinary format (Eric Fischer, enf@pobox.com) 9944# 9945# Unfortunately MacBinary doesn't really have a magic number prior 9946# to the MacBinary III format. The checksum is really the way to 9947# do it, but the magic file format isn't up to the challenge. 9948# 9949# 0 byte 0 9950# 1 byte # filename length 9951# 2 string # filename 9952# 65 string # file type 9953# 69 string # file creator 9954# 73 byte # Finder flags 9955# 74 byte 0 9956# 75 beshort # vertical posn in window 9957# 77 beshort # horiz posn in window 9958# 79 beshort # window or folder ID 9959# 81 byte # protected? 9960# 82 byte 0 9961# 83 belong # length of data segment 9962# 87 belong # length of resource segment 9963# 91 belong # file creation date 9964# 95 belong # file modification date 9965# 99 beshort # length of comment after resource 9966# 101 byte # new Finder flags 9967# 102 string mBIN # (only in MacBinary III) 9968# 106 byte # char. code of file name 9969# 107 byte # still more Finder flags 9970# 116 belong # total file length 9971# 120 beshort # length of add'l header 9972# 122 byte 129 # for MacBinary II 9973# 122 byte 130 # for MacBinary III 9974# 123 byte 129 # minimum version that can read fmt 9975# 124 beshort # checksum 9976# 9977# This attempts to use the version numbers as a magic number, requiring 9978# that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second 9979# be 0x81. This works for the files I have, but maybe not for everyone's. 9980 9981# Unfortunately, this magic is quite weak - MPi 9982#122 beshort&0xFCFF 0x8081 Macintosh MacBinary data 9983 9984# MacBinary I doesn't have the version number field at all, but MacBinary II 9985# has been in use since 1987 so I hope there aren't many really old files 9986# floating around that this will miss. The original spec calls for using 9987# the nulls in 0, 74, and 82 as the magic number. 9988# 9989# Another possibility, that would also work for MacBinary I, is to use 9990# the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will 9991# have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset, 9992# and that 74 will be 0. So something like 9993# 9994# 71 belong&0x80804EFF 0x00000000 Macintosh MacBinary data 9995# 9996# >73 byte&0x01 0x01 \b, inited 9997# >73 byte&0x02 0x02 \b, changed 9998# >73 byte&0x04 0x04 \b, busy 9999# >73 byte&0x08 0x08 \b, bozo 10000# >73 byte&0x10 0x10 \b, system 10001# >73 byte&0x10 0x20 \b, bundle 10002# >73 byte&0x10 0x40 \b, invisible 10003# >73 byte&0x10 0x80 \b, locked 10004 10005#>65 string x \b, type "%4.4s" 10006 10007#>65 string 8BIM (PhotoShop) 10008#>65 string ALB3 (PageMaker 3) 10009#>65 string ALB4 (PageMaker 4) 10010#>65 string ALT3 (PageMaker 3) 10011#>65 string APPL (application) 10012#>65 string AWWP (AppleWorks word processor) 10013#>65 string CIRC (simulated circuit) 10014#>65 string DRWG (MacDraw) 10015#>65 string EPSF (Encapsulated PostScript) 10016#>65 string FFIL (font suitcase) 10017#>65 string FKEY (function key) 10018#>65 string FNDR (Macintosh Finder) 10019#>65 string GIFf (GIF image) 10020#>65 string Gzip (GNU gzip) 10021#>65 string INIT (system extension) 10022#>65 string LIB\ (library) 10023#>65 string LWFN (PostScript font) 10024#>65 string MSBC (Microsoft BASIC) 10025#>65 string PACT (Compact Pro archive) 10026#>65 string PDF\ (Portable Document Format) 10027#>65 string PICT (picture) 10028#>65 string PNTG (MacPaint picture) 10029#>65 string PREF (preferences) 10030#>65 string PROJ (Think C project) 10031#>65 string QPRJ (Think Pascal project) 10032#>65 string SCFL (Defender scores) 10033#>65 string SCRN (startup screen) 10034#>65 string SITD (StuffIt Deluxe) 10035#>65 string SPn3 (SuperPaint) 10036#>65 string STAK (HyperCard stack) 10037#>65 string Seg\ (StuffIt segment) 10038#>65 string TARF (Unix tar archive) 10039#>65 string TEXT (ASCII) 10040#>65 string TIFF (TIFF image) 10041#>65 string TOVF (Eudora table of contents) 10042#>65 string WDBN (Microsoft Word word processor) 10043#>65 string WORD (MacWrite word processor) 10044#>65 string XLS\ (Microsoft Excel) 10045#>65 string ZIVM (compress (.Z)) 10046#>65 string ZSYS (Pre-System 7 system file) 10047#>65 string acf3 (Aldus FreeHand) 10048#>65 string cdev (control panel) 10049#>65 string dfil (Desk Acessory suitcase) 10050#>65 string libr (library) 10051#>65 string nX^d (WriteNow word processor) 10052#>65 string nX^w (WriteNow dictionary) 10053#>65 string rsrc (resource) 10054#>65 string scbk (Scrapbook) 10055#>65 string shlb (shared library) 10056#>65 string ttro (SimpleText read-only) 10057#>65 string zsys (system file) 10058 10059#>69 string x \b, creator "%4.4s" 10060 10061# Somewhere, Apple has a repository of registered Creator IDs. These are 10062# just the ones that I happened to have files from and was able to identify. 10063 10064#>69 string 8BIM (Adobe Photoshop) 10065#>69 string ALD3 (PageMaker 3) 10066#>69 string ALD4 (PageMaker 4) 10067#>69 string ALFA (Alpha editor) 10068#>69 string APLS (Apple Scanner) 10069#>69 string APSC (Apple Scanner) 10070#>69 string BRKL (Brickles) 10071#>69 string BTFT (BitFont) 10072#>69 string CCL2 (Common Lisp 2) 10073#>69 string CCL\ (Common Lisp) 10074#>69 string CDmo (The Talking Moose) 10075#>69 string CPCT (Compact Pro) 10076#>69 string CSOm (Eudora) 10077#>69 string DMOV (Font/DA Mover) 10078#>69 string DSIM (DigSim) 10079#>69 string EDIT (Macintosh Edit) 10080#>69 string ERIK (Macintosh Finder) 10081#>69 string EXTR (self-extracting archive) 10082#>69 string Gzip (GNU gzip) 10083#>69 string KAHL (Think C) 10084#>69 string LWFU (LaserWriter Utility) 10085#>69 string LZIV (compress) 10086#>69 string MACA (MacWrite) 10087#>69 string MACS (Macintosh operating system) 10088#>69 string MAcK (MacKnowledge terminal emulator) 10089#>69 string MLND (Defender) 10090#>69 string MPNT (MacPaint) 10091#>69 string MSBB (Microsoft BASIC (binary)) 10092#>69 string MSWD (Microsoft Word) 10093#>69 string NCSA (NCSA Telnet) 10094#>69 string PJMM (Think Pascal) 10095#>69 string PSAL (Hunt the Wumpus) 10096#>69 string PSI2 (Apple File Exchange) 10097#>69 string R*ch (BBEdit) 10098#>69 string RMKR (Resource Maker) 10099#>69 string RSED (Resource Editor) 10100#>69 string Rich (BBEdit) 10101#>69 string SIT! (StuffIt) 10102#>69 string SPNT (SuperPaint) 10103#>69 string Unix (NeXT Mac filesystem) 10104#>69 string VIM! (Vim editor) 10105#>69 string WILD (HyperCard) 10106#>69 string XCEL (Microsoft Excel) 10107#>69 string aCa2 (Fontographer) 10108#>69 string aca3 (Aldus FreeHand) 10109#>69 string dosa (Macintosh MS-DOS file system) 10110#>69 string movr (Font/DA Mover) 10111#>69 string nX^n (WriteNow) 10112#>69 string pdos (Apple ProDOS file system) 10113#>69 string scbk (Scrapbook) 10114#>69 string ttxt (SimpleText) 10115#>69 string ufox (Foreign File Access) 10116 10117# Just in case... 10118 10119102 string mBIN MacBinary III data with surprising version number 10120 10121# sas magic from Bruce Foster (bef@nwu.edu) 10122# 10123#0 string SAS SAS 10124#>8 string x %s 101250 string SAS SAS 10126>24 string DATA data file 10127>24 string CATALOG catalog 10128>24 string INDEX data file index 10129>24 string VIEW data view 10130# sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com) 10131# 101320x54 string SAS SAS 7+ 10133>0x9C string DATA data file 10134>0x9C string CATALOG catalog 10135>0x9C string INDEX data file index 10136>0x9C string VIEW data view 10137 10138# spss magic for SPSS system and portable files, 10139# from Bruce Foster (bef@nwu.edu). 10140 101410 long 0xc1e2c3c9 SPSS Portable File 10142>40 string x %s 10143 101440 string $FL2 SPSS System File 10145>24 string x %s 10146 10147# Macintosh filesystem data 10148# From "Tom N Harris" <telliamed@mac.com> 10149# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net> 10150# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these 10151# entries depend on the data arithmetic added after v.35 10152# There's also some Pascal strings in here, ditto... 10153 10154# The boot block signature, according to IM:Files, is 10155# "for HFS volumes, this field always contains the value 0x4C4B." 10156# But if this is true for MFS or HFS+ volumes, I don't know. 10157# Alternatively, the boot block is supposed to be zeroed if it's 10158# unused, so a simply >0 should suffice. 10159 101600x400 beshort 0xD2D7 Macintosh MFS data 10161>0 beshort 0x4C4B (bootable) 10162>0x40a beshort &0x8000 (locked) 10163>0x402 beldate-0x7C25B080 x created: %s, 10164>0x406 beldate-0x7C25B080 >0 last backup: %s, 10165>0x414 belong x block size: %d, 10166>0x412 beshort x number of blocks: %d, 10167>0x424 pstring x volume name: %s 10168 10169# "BD" is has many false positives 10170#0x400 beshort 0x4244 Macintosh HFS data 10171#>0 beshort 0x4C4B (bootable) 10172#>0x40a beshort &0x8000 (locked) 10173#>0x40a beshort ^0x0100 (mounted) 10174#>0x40a beshort &0x0200 (spared blocks) 10175#>0x40a beshort &0x0800 (unclean) 10176#>0x47C beshort 0x482B (Embedded HFS+ Volume) 10177#>0x402 beldate-0x7C25B080 x created: %s, 10178#>0x406 beldate-0x7C25B080 x last modified: %s, 10179#>0x440 beldate-0x7C25B080 >0 last backup: %s, 10180#>0x414 belong x block size: %d, 10181#>0x412 beshort x number of blocks: %d, 10182#>0x424 pstring x volume name: %s 10183 101840x400 beshort 0x482B Macintosh HFS Extended 10185>&0 beshort x version %d data 10186>0 beshort 0x4C4B (bootable) 10187>0x404 belong ^0x00000100 (mounted) 10188>&2 belong &0x00000200 (spared blocks) 10189>&2 belong &0x00000800 (unclean) 10190>&2 belong &0x00008000 (locked) 10191>&6 string x last mounted by: '%.4s', 10192# really, that should be treated as a belong and we print a string 10193# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1" 10194>&14 beldate-0x7C25B080 x created: %s, 10195# only the creation date is local time, all other timestamps in HFS+ are UTC. 10196>&18 bedate-0x7C25B080 x last modified: %s, 10197>&22 bedate-0x7C25B080 >0 last backup: %s, 10198>&26 bedate-0x7C25B080 >0 last checked: %s, 10199>&38 belong x block size: %d, 10200>&42 belong x number of blocks: %d, 10201>&46 belong x free blocks: %d 10202 10203# I don't think this is really necessary since it doesn't do much and 10204# anything with a valid driver descriptor will also have a valid 10205# partition map 10206#0 beshort 0x4552 Apple Device Driver data 10207#>&24 beshort =1 \b, MacOS 10208 10209# Is that the partition type a cstring or a pstring? Well, IM says "strings 10210# shorter than 32 bytes must be terminated with NULL" so I'll treat it as a 10211# cstring. Of course, partitions can contain more than four entries, but 10212# what're you gonna do? 10213# GRR: This magic is too weak, it is just "PM" 10214#0x200 beshort 0x504D Apple Partition data 10215#>0x2 beshort x (block size: %d): 10216#>0x230 string x first type: %s, 10217#>0x210 string x name: %s, 10218#>0x254 belong x number of blocks: %d, 10219#>0x400 beshort 0x504D 10220#>>0x430 string x second type: %s, 10221#>>0x410 string x name: %s, 10222#>>0x454 belong x number of blocks: %d, 10223#>>0x600 beshort 0x504D 10224#>>>0x630 string x third type: %s, 10225#>>>0x610 string x name: %s, 10226#>>>0x654 belong x number of blocks: %d, 10227#>>0x800 beshort 0x504D 10228#>>>0x830 string x fourth type: %s, 10229#>>>0x810 string x name: %s, 10230#>>>0x854 belong x number of blocks: %d, 10231#>>>0xa00 beshort 0x504D 10232#>>>>0xa30 string x fifth type: %s, 10233#>>>>0xa10 string x name: %s, 10234#>>>>0xa54 belong x number of blocks: %d 10235#>>>0xc00 beshort 0x504D 10236#>>>>0xc30 string x sixth type: %s, 10237#>>>>0xc10 string x name: %s, 10238#>>>>0xc54 belong x number of blocks: %d 10239## AFAIK, only the signature is different 10240#0x200 beshort 0x5453 Apple Old Partition data 10241#>0x2 beshort x block size: %d, 10242#>0x230 string x first type: %s, 10243#>0x210 string x name: %s, 10244#>0x254 belong x number of blocks: %d, 10245#>0x400 beshort 0x504D 10246#>>0x430 string x second type: %s, 10247#>>0x410 string x name: %s, 10248#>>0x454 belong x number of blocks: %d, 10249#>>0x800 beshort 0x504D 10250#>>>0x830 string x third type: %s, 10251#>>>0x810 string x name: %s, 10252#>>>0x854 belong x number of blocks: %d, 10253#>>>0xa00 beshort 0x504D 10254#>>>>0xa30 string x fourth type: %s, 10255#>>>>0xa10 string x name: %s, 10256#>>>>0xa54 belong x number of blocks: %d 10257 10258# From: Remi Mommsen <mommsen@slac.stanford.edu> 102590 string BOMStore Mac OS X bill of materials (BOM) file 10260 10261# From: Adam Buchbinder <adam.buchbinder@gmail.com> 10262# URL: http://en.wikipedia.org/wiki/Datafork_TrueType 10263# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is 10264# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I 10265# don't know what they mean. 102660 belong 0x100 10267>(0x4.L+24) beshort x 10268>>&4 belong 0x73666e74 Mac OSX datafork font, TrueType 10269>>&4 belong 0x464f4e54 Mac OSX datafork font, 'FONT' 10270>>&4 belong 0x4e464e54 Mac OSX datafork font, 'NFNT' 10271>>&4 belong 0x504f5354 Mac OSX datafork font, PostScript 10272 10273#------------------------------------------------------------------------------ 10274# $File: magic,v 1.9 2009/09/19 16:28:10 christos Exp $ 10275# magic: file(1) magic for magic files 10276# 102770 string #\ Magic magic text file for file(1) cmd 102780 lelong 0xF11E041C magic binary file for file(1) cmd 10279>4 lelong x (version %d) (little endian) 102800 belong 0xF11E041C magic binary file for file(1) cmd 10281>4 belong x (version %d) (big endian) 10282 10283#------------------------------------------------------------------------------ 10284# $File: mail.news,v 1.17 2009/09/19 16:28:10 christos Exp $ 10285# mail.news: file(1) magic for mail and news 10286# 10287# Unfortunately, saved netnews also has From line added in some news software. 10288#0 string From mail text 10289# There are tests to ascmagic.c to cope with mail and news. 102900 string Relay-Version: old news text 10291!:mime message/rfc822 102920 string #!\ rnews batched news text 10293!:mime message/rfc822 102940 string N#!\ rnews mailed, batched news text 10295!:mime message/rfc822 102960 string Forward\ to mail forwarding text 10297!:mime message/rfc822 102980 string Pipe\ to mail piping text 10299!:mime message/rfc822 103000 string Return-Path: smtp mail text 10301!:mime message/rfc822 103020 string Path: news text 10303!:mime message/news 103040 string Xref: news text 10305!:mime message/news 103060 string From: news or mail text 10307!:mime message/rfc822 103080 string Article saved news text 10309!:mime message/news 103100 string BABYL Emacs RMAIL text 103110 string Received: RFC 822 mail text 10312!:mime message/rfc822 103130 string MIME-Version: MIME entity text 10314#0 string Content- MIME entity text 10315 10316# TNEF files... 103170 lelong 0x223E9F78 Transport Neutral Encapsulation Format 10318 10319# From: Kevin Sullivan <ksulliva@psc.edu> 103200 string *mbx* MBX mail folder 10321 10322# From: Simon Matter <simon.matter@invoca.ch> 103230 string \241\002\213\015skiplist\ file\0\0\0 Cyrus skiplist DB 10324 10325# JAM(mbp) Fidonet message area databases 10326# JHR file 103270 string JAM\0 JAM message area header file 10328>12 leshort >0 (%d messages) 10329 10330# Squish Fidonet message area databases 10331# SQD file (requires at least one message in the area) 10332# XXX: Weak magic 10333#256 leshort 0xAFAE4453 Squish message area data file 10334#>4 leshort >0 (%d messages) 10335 10336#0 string \<!--\ MHonArc text/html; x-type=mhonarc 10337 10338#------------------------------------------------------------------------------ 10339# $File: maple,v 1.6 2009/09/19 16:28:10 christos Exp $ 10340# maple: file(1) magic for maple files 10341# "H. Nanosecond" <aldomel@ix.netcom.com> 10342# Maple V release 4, a multi-purpose math program 10343# 10344 10345# maple library .lib 103460 string \000MVR4\nI MapleVr4 library 10347 10348# .ind 10349# no magic for these :-( 10350# they are compiled indexes for maple files 10351 10352# .hdb 103530 string \000\004\000\000 Maple help database 10354 10355# .mhp 10356# this has the form <PACKAGE=name> 103570 string \<PACKAGE= Maple help file 103580 string \<HELP\ NAME= Maple help file 103590 string \n\<HELP\ NAME= Maple help file with extra carriage return at start (yuck) 10360#0 string #\ Newton Maple help file, old style 103610 string #\ daub Maple help file, old style 10362#0 string #=========== Maple help file, old style 10363 10364# .mws 103650 string \000\000\001\044\000\221 Maple worksheet 10366#this is anomalous 103670 string WriteNow\000\002\000\001\000\000\000\000\100\000\000\000\000\000 Maple worksheet, but weird 10368# this has the form {VERSION 2 3 "IBM INTEL NT" "2.3" }\n 10369# that is {VERSION major_version miunor_version computer_type version_string} 103700 string {VERSION\ Maple worksheet 10371>9 string >\0 version %.1s. 10372>>>11 string >\0 %.1s 10373 10374# .mps 103750 string \0\0\001$ Maple something 10376# from byte 4 it is either 'nul E' or 'soh R' 10377# I think 'nul E' means a file that was saved as a different name 10378# a sort of revision marking 10379# 'soh R' means new 10380>4 string \000\105 An old revision 10381>4 string \001\122 The latest save 10382 10383# .mpl 10384# some of these are the same as .mps above 10385#0000000 000 000 001 044 000 105 same as .mps 10386#0000000 000 000 001 044 001 122 same as .mps 10387 103880 string #\n##\ <SHAREFILE= Maple something 103890 string \n#\n##\ <SHAREFILE= Maple something 103900 string ##\ <SHAREFILE= Maple something 103910 string #\r##\ <SHAREFILE= Maple something 103920 string \r#\r##\ <SHAREFILE= Maple something 103930 string #\ \r##\ <DESCRIBE> Maple something anomalous. 10394 10395#------------------------------------------------------------------------------ 10396# $File: mathcad,v 1.5 2009/09/19 16:28:10 christos Exp $ 10397# mathcad: file(1) magic for Mathcad documents 10398# URL: http://www.mathsoft.com/ 10399# From: Josh Triplett <josh@freedesktop.org> 10400 104010 string .MCAD\t Mathcad document 10402 10403#------------------------------------------------------------------------------ 10404# $File: mathematica,v 1.7 2009/09/19 16:28:10 christos Exp $ 10405# mathematica: file(1) magic for mathematica files 10406# "H. Nanosecond" <aldomel@ix.netcom.com> 10407# Mathematica a multi-purpose math program 10408# versions 2.2 and 3.0 10409 10410#mathematica .mb 104110 string \064\024\012\000\035\000\000\000 Mathematica version 2 notebook 104120 string \064\024\011\000\035\000\000\000 Mathematica version 2 notebook 10413 10414# .ma 10415# multiple possibilites: 10416 104170 string (*^\n\n::[\011frontEndVersion\ =\ Mathematica notebook 10418#>41 string >\0 %s 10419 10420#0 string (*^\n\n::[\011palette Mathematica notebook version 2.x 10421 10422#0 string (*^\n\n::[\011Information Mathematica notebook version 2.x 10423#>675 string >\0 %s #doesn't work well 10424 10425# there may be 'cr' instread of 'nl' in some does this matter? 10426 10427# generic: 104280 string (*^\r\r::[\011 Mathematica notebook version 2.x 104290 string (*^\r\n\r\n::[\011 Mathematica notebook version 2.x 104300 string (*^\015 Mathematica notebook version 2.x 104310 string (*^\n\r\n\r::[\011 Mathematica notebook version 2.x 104320 string (*^\r::[\011 Mathematica notebook version 2.x 104330 string (*^\r\n::[\011 Mathematica notebook version 2.x 104340 string (*^\n\n::[\011 Mathematica notebook version 2.x 104350 string (*^\n::[\011 Mathematica notebook version 2.x 10436 10437 10438# Mathematica .mx files 10439 10440#0 string (*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*) Mathematica binary file 104410 string (*This\ is\ a\ Mathematica\ binary\ Mathematica binary file 10442#>71 string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000 10443# >71... is optional 10444>88 string >\0 from %s 10445 10446 10447# Mathematica files PBF: 10448# 115 115 101 120 102 106 000 001 000 000 000 203 000 001 000 104490 string MMAPBF\000\001\000\000\000\203\000\001\000 Mathematica PBF (fonts I think) 10450 10451# .ml files These are menu resources I think 10452# these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\ 10453# how to put that into a magic rule? 104544 string \ A~ MAthematica .ml file 10455 10456# .nb files 10457#too long 0 string (***********************************************************************\n\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Mathematica-Compatible Notebook Mathematica 3.0 notebook 104580 string (*********************** Mathematica 3.0 notebook 10459 10460# other (* matches it is a comment start in these langs 10461# GRR: Too weak; also matches other languages e.g. ML 10462#0 string (* Mathematica, or Pascal, Modula-2 or 3 code text 10463 10464######################### 10465# MatLab v5 104660 string MATLAB Matlab v5 mat-file 10467>126 short 0x494d (big endian) 10468>>124 beshort x version 0x%04x 10469>126 short 0x4d49 (little endian) 10470>>124 leshort x version 0x%04x 10471 10472 10473#------------------------------------------------------------------------------ 10474# $File: matroska,v 1.5 2009/09/27 19:02:12 christos Exp $ 10475# matroska: file(1) magic for Matroska files 10476# 10477# See http://www.matroska.org/ 10478# 10479 10480# EBML id: 104810 belong 0x1a45dfa3 10482# DocType id: 10483>5 beshort 0x4282 10484# DocType contents: 10485>>8 string matroska Matroska data 10486!:mime video/x-matroska 10487 10488#------------------------------------------------------------------------------ 10489# $File: mcrypt,v 1.5 2009/09/19 16:28:10 christos Exp $ 10490# Mavroyanopoulos Nikos <nmav@hellug.gr> 10491# mcrypt: file(1) magic for mcrypt 2.2.x; 104920 string \0m\3 mcrypt 2.5 encrypted data, 10493>4 string >\0 algorithm: %s, 10494>>&1 leshort >0 keysize: %d bytes, 10495>>>&0 string >\0 mode: %s, 10496 104970 string \0m\2 mcrypt 2.2 encrypted data, 10498>3 byte 0 algorithm: blowfish-448, 10499>3 byte 1 algorithm: DES, 10500>3 byte 2 algorithm: 3DES, 10501>3 byte 3 algorithm: 3-WAY, 10502>3 byte 4 algorithm: GOST, 10503>3 byte 6 algorithm: SAFER-SK64, 10504>3 byte 7 algorithm: SAFER-SK128, 10505>3 byte 8 algorithm: CAST-128, 10506>3 byte 9 algorithm: xTEA, 10507>3 byte 10 algorithm: TWOFISH-128, 10508>3 byte 11 algorithm: RC2, 10509>3 byte 12 algorithm: TWOFISH-192, 10510>3 byte 13 algorithm: TWOFISH-256, 10511>3 byte 14 algorithm: blowfish-128, 10512>3 byte 15 algorithm: blowfish-192, 10513>3 byte 16 algorithm: blowfish-256, 10514>3 byte 100 algorithm: RC6, 10515>3 byte 101 algorithm: IDEA, 10516>4 byte 0 mode: CBC, 10517>4 byte 1 mode: ECB, 10518>4 byte 2 mode: CFB, 10519>4 byte 3 mode: OFB, 10520>4 byte 4 mode: nOFB, 10521>5 byte 0 keymode: 8bit 10522>5 byte 1 keymode: 4bit 10523>5 byte 2 keymode: SHA-1 hash 10524>5 byte 3 keymode: MD5 hash 10525 10526#------------------------------------------------------------------------------ 10527# $File: mercurial,v 1.4 2009/09/19 16:28:10 christos Exp $ 10528# mercurial: file(1) magic for Mercurial changeset bundles 10529# http://www.selenic.com/mercurial/wiki/ 10530# 10531# Jesse Glick (jesse.glick@sun.com) 10532# 10533 105340 string HG10 Mercurial changeset bundle 10535>4 string UN (uncompressed) 10536>4 string GZ (gzip compressed) 10537>4 string BZ (bzip2 compressed) 10538 10539#------------------------------------------------------------------------------ 10540# $File: mime,v 1.5 2009/09/19 16:28:10 christos Exp $ 10541# mime: file(1) magic for MIME encoded files 10542# 105430 string Content-Type:\ 10544>14 string >\0 %s 105450 string Content-Type: 10546>13 string >\0 %s 10547 10548#------------------------------------------------------------------------------ 10549# $File: mips,v 1.5 2009/09/19 16:28:10 christos Exp $ 10550# mips: file(1) magic for Silicon Graphics (MIPS, IRIS, IRIX, etc.) 10551# Dec Ultrix (MIPS) 10552# all of SGI's *current* machines and OSes run in big-endian mode on the 10553# MIPS machines, as far as I know. 10554# 10555# XXX - what is the blank "-" line? 10556# 10557# kbd file definitions 105580 string kbd!map kbd map file 10559>8 byte >0 Ver %d: 10560>10 short >0 with %d table(s) 105610 belong 0407 old SGI 68020 executable 105620 belong 0410 old SGI 68020 pure executable 105630 beshort 0x8765 disk quotas file 105640 beshort 0x0506 IRIS Showcase file 10565>2 byte 0x49 - 10566>3 byte x - version %ld 105670 beshort 0x0226 IRIS Showcase template 10568>2 byte 0x63 - 10569>3 byte x - version %ld 105700 belong 0x5343464d IRIS Showcase file 10571>4 byte x - version %ld 105720 belong 0x5443464d IRIS Showcase template 10573>4 byte x - version %ld 105740 belong 0xdeadbabe IRIX Parallel Arena 10575>8 belong >0 - version %ld 10576# 105770 beshort 0x0160 MIPSEB ECOFF executable 10578>20 beshort 0407 (impure) 10579>20 beshort 0410 (swapped) 10580>20 beshort 0413 (paged) 10581>8 belong >0 not stripped 10582>8 belong 0 stripped 10583>22 byte x - version %ld 10584>23 byte x .%ld 10585# 105860 beshort 0x0162 MIPSEL-BE ECOFF executable 10587>20 beshort 0407 (impure) 10588>20 beshort 0410 (swapped) 10589>20 beshort 0413 (paged) 10590>8 belong >0 not stripped 10591>8 belong 0 stripped 10592>23 byte x - version %d 10593>22 byte x .%ld 10594# 105950 beshort 0x6001 MIPSEB-LE ECOFF executable 10596>20 beshort 03401 (impure) 10597>20 beshort 04001 (swapped) 10598>20 beshort 05401 (paged) 10599>8 belong >0 not stripped 10600>8 belong 0 stripped 10601>23 byte x - version %d 10602>22 byte x .%ld 10603# 106040 beshort 0x6201 MIPSEL ECOFF executable 10605>20 beshort 03401 (impure) 10606>20 beshort 04001 (swapped) 10607>20 beshort 05401 (paged) 10608>8 belong >0 not stripped 10609>8 belong 0 stripped 10610>23 byte x - version %ld 10611>22 byte x .%ld 10612# 10613# MIPS 2 additions 10614# 106150 beshort 0x0163 MIPSEB MIPS-II ECOFF executable 10616>20 beshort 0407 (impure) 10617>20 beshort 0410 (swapped) 10618>20 beshort 0413 (paged) 10619>8 belong >0 not stripped 10620>8 belong 0 stripped 10621>22 byte x - version %ld 10622>23 byte x .%ld 10623# 106240 beshort 0x0166 MIPSEL-BE MIPS-II ECOFF executable 10625>20 beshort 0407 (impure) 10626>20 beshort 0410 (swapped) 10627>20 beshort 0413 (paged) 10628>8 belong >0 not stripped 10629>8 belong 0 stripped 10630>22 byte x - version %ld 10631>23 byte x .%ld 10632# 106330 beshort 0x6301 MIPSEB-LE MIPS-II ECOFF executable 10634>20 beshort 03401 (impure) 10635>20 beshort 04001 (swapped) 10636>20 beshort 05401 (paged) 10637>8 belong >0 not stripped 10638>8 belong 0 stripped 10639>23 byte x - version %ld 10640>22 byte x .%ld 10641# 106420 beshort 0x6601 MIPSEL MIPS-II ECOFF executable 10643>20 beshort 03401 (impure) 10644>20 beshort 04001 (swapped) 10645>20 beshort 05401 (paged) 10646>8 belong >0 not stripped 10647>8 belong 0 stripped 10648>23 byte x - version %ld 10649>22 byte x .%ld 10650# 10651# MIPS 3 additions 10652# 106530 beshort 0x0140 MIPSEB MIPS-III ECOFF executable 10654>20 beshort 0407 (impure) 10655>20 beshort 0410 (swapped) 10656>20 beshort 0413 (paged) 10657>8 belong >0 not stripped 10658>8 belong 0 stripped 10659>22 byte x - version %ld 10660>23 byte x .%ld 10661# 106620 beshort 0x0142 MIPSEL-BE MIPS-III ECOFF executable 10663>20 beshort 0407 (impure) 10664>20 beshort 0410 (swapped) 10665>20 beshort 0413 (paged) 10666>8 belong >0 not stripped 10667>8 belong 0 stripped 10668>22 byte x - version %ld 10669>23 byte x .%ld 10670# 106710 beshort 0x4001 MIPSEB-LE MIPS-III ECOFF executable 10672>20 beshort 03401 (impure) 10673>20 beshort 04001 (swapped) 10674>20 beshort 05401 (paged) 10675>8 belong >0 not stripped 10676>8 belong 0 stripped 10677>23 byte x - version %ld 10678>22 byte x .%ld 10679# 106800 beshort 0x4201 MIPSEL MIPS-III ECOFF executable 10681>20 beshort 03401 (impure) 10682>20 beshort 04001 (swapped) 10683>20 beshort 05401 (paged) 10684>8 belong >0 not stripped 10685>8 belong 0 stripped 10686>23 byte x - version %ld 10687>22 byte x .%ld 10688# 106890 beshort 0x180 MIPSEB Ucode 106900 beshort 0x182 MIPSEL-BE Ucode 10691# 32bit core file 106920 belong 0xdeadadb0 IRIX core dump 10693>4 belong 1 of 10694>16 string >\0 '%s' 10695# 64bit core file 106960 belong 0xdeadad40 IRIX 64-bit core dump 10697>4 belong 1 of 10698>16 string >\0 '%s' 10699# N32bit core file 107000 belong 0xbabec0bb IRIX N32 core dump 10701>4 belong 1 of 10702>16 string >\0 '%s' 10703# New style crash dump file 107040 string \x43\x72\x73\x68\x44\x75\x6d\x70 IRIX vmcore dump of 10705>36 string >\0 '%s' 10706# Trusted IRIX info 107070 string SGIAUDIT SGI Audit file 10708>8 byte x - version %d 10709>9 byte x .%ld 10710# 107110 string WNGZWZSC Wingz compiled script 107120 string WNGZWZSS Wingz spreadsheet 107130 string WNGZWZHP Wingz help file 10714# 107150 string #Inventor V IRIS Inventor 1.0 file 107160 string #Inventor V2 Open Inventor 2.0 file 10717# GLF is OpenGL stream encoding 107180 string glfHeadMagic(); GLF_TEXT 107194 belong 0x7d000000 GLF_BINARY_LSB_FIRST 107204 belong 0x0000007d GLF_BINARY_MSB_FIRST 10721# GLS is OpenGL stream encoding; GLS is the successor of GLF 107220 string glsBeginGLS( GLS_TEXT 107234 belong 0x10000000 GLS_BINARY_LSB_FIRST 107244 belong 0x00000010 GLS_BINARY_MSB_FIRST 10725 10726#------------------------------------------------------------------------------ 10727# $File: mirage,v 1.7 2009/09/19 16:28:10 christos Exp $ 10728# mirage: file(1) magic for Mirage executables 10729# 10730# XXX - byte order? 10731# 107320 long 31415 Mirage Assembler m.out executable 10733 10734#----------------------------------------------------------------------------- 10735# $File: misctools,v 1.10 2009/09/19 16:28:10 christos Exp $ 10736# misctools: file(1) magic for miscellaneous UNIX tools. 10737# 107380 search/1 %%!! X-Post-It-Note text 107390 string/c BEGIN:VCALENDAR vCalendar calendar file 107400 string/c BEGIN:VCARD vCard visiting card 10741!:mime text/x-vcard 10742 10743# From: Alex Beregszaszi <alex@fsn.hu> 107444 string gtktalog GNOME Catalogue (gtktalog) 10745>13 string >\0 version %s 10746 10747# Summary: GStreamer binary registry 10748# Extension: .bin 10749# Submitted by: Josh Triplett <josh@joshtriplett.org> 107500 belong 0xc0def00d GStreamer binary registry 10751>4 string x \b, version %s 10752 10753# Summary: Libtool library file 10754# Extension: .la 10755# Submitted by: Tomasz Trojanowski <tomek@uninet.com.pl> 107560 search/80 .la\ -\ a\ libtool\ library\ file libtool library file 10757 10758# Summary: Libtool object file 10759# Extension: .lo 10760# Submitted by: Abel Cheung <abelcheung@gmail.com> 107610 search/80 .lo\ -\ a\ libtool\ object\ file libtool object file 10762 10763# From: Daniel Novotny <dnovotny@redhat.com> 107640 string MDMP\x93\xA7 MDMP crash report data 10765 10766#------------------------------------------------------------------------------ 10767# $File: mkid,v 1.6 2009/09/19 16:28:10 christos Exp $ 10768# mkid: file(1) magic for mkid(1) databases 10769# 10770# ID is the binary tags database produced by mkid(1). 10771# 10772# XXX - byte order? 10773# 107740 string \311\304 ID tags data 10775>2 short >0 version %d 10776 10777#------------------------------------------------------------------------------ 10778# $File: mlssa,v 1.4 2009/09/19 16:28:10 christos Exp $ 10779# mlssa: file(1) magic for MLSSA datafiles 10780# 107810 lelong 0xffffabcd MLSSA datafile, 10782>4 leshort x algorithm %d, 10783>10 lelong x %d samples 10784 10785#------------------------------------------------------------------------------ 10786# $File: mmdf,v 1.6 2009/09/19 16:28:10 christos Exp $ 10787# mmdf: file(1) magic for MMDF mail files 10788# 107890 string \001\001\001\001 MMDF mailbox 10790 10791#------------------------------------------------------------------------------ 10792# $File: modem,v 1.4 2009/09/19 16:28:10 christos Exp $ 10793# modem: file(1) magic for modem programs 10794# 10795# From: Florian La Roche <florian@knorke.saar.de> 107961 string PC\ Research,\ Inc Digifax-G3-File 10797>29 byte 1 \b, fine resolution 10798>29 byte 0 \b, normal resolution 10799 108000 short 0x0100 raw G3 data, byte-padded 108010 short 0x1400 raw G3 data 10802# 10803# Magic data for vgetty voice formats 10804# (Martin Seine & Marc Eberhard) 10805 10806# 10807# raw modem data version 1 10808# 108090 string RMD1 raw modem data 10810>4 string >\0 (%s / 10811>20 short >0 compression type 0x%04x) 10812 10813# 10814# portable voice format 1 10815# 108160 string PVF1\n portable voice format 10817>5 string >\0 (binary %s) 10818 10819# 10820# portable voice format 2 10821# 108220 string PVF2\n portable voice format 10823>5 string >\0 (ascii %s) 10824 10825 10826#------------------------------------------------------------------------------ 10827# $File: motorola,v 1.10 2009/09/19 16:28:11 christos Exp $ 10828# motorola: file(1) magic for Motorola 68K and 88K binaries 10829# 10830# 68K 10831# 108320 beshort 0520 mc68k COFF 10833>18 beshort ^00000020 object 10834>18 beshort &00000020 executable 10835>12 belong >0 not stripped 10836>168 string .lowmem Apple toolbox 10837>20 beshort 0407 (impure) 10838>20 beshort 0410 (pure) 10839>20 beshort 0413 (demand paged) 10840>20 beshort 0421 (standalone) 108410 beshort 0521 mc68k executable (shared) 10842>12 belong >0 not stripped 108430 beshort 0522 mc68k executable (shared demand paged) 10844>12 belong >0 not stripped 10845# 10846# Motorola/UniSoft 68K Binary Compatibility Standard (BCS) 10847# 108480 beshort 0554 68K BCS executable 10849# 10850# 88K 10851# 10852# Motorola/88Open BCS 10853# 108540 beshort 0555 88K BCS executable 10855# 10856# Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de> 108570 string S0 Motorola S-Record; binary data in text format 10858 10859# ATARI ST relocatable PRG 10860# 10861# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 10862# (according to Roland Waldi, Oct 21, 1987) 10863# besides the magic 0x601a, the text segment size is checked to be 10864# not larger than 1 MB (which is a lot on ST). 10865# The additional 0x601b distinction I took from Doug Lee's magic. 108660 belong&0xFFFFFFF0 0x601A0000 Atari ST M68K contiguous executable 10867>2 belong x (txt=%ld, 10868>6 belong x dat=%ld, 10869>10 belong x bss=%ld, 10870>14 belong x sym=%ld) 108710 belong&0xFFFFFFF0 0x601B0000 Atari ST M68K non-contig executable 10872>2 belong x (txt=%ld, 10873>6 belong x dat=%ld, 10874>10 belong x bss=%ld, 10875>14 belong x sym=%ld) 10876 10877# Atari ST/TT... program format (sent by Wolfram Kleff <kleff@cs.uni-bonn.de>) 108780 beshort 0x601A Atari 68xxx executable, 10879>2 belong x text len %lu, 10880>6 belong x data len %lu, 10881>10 belong x BSS len %lu, 10882>14 belong x symboltab len %lu, 10883>18 belong 0 10884>22 belong &0x01 fastload flag, 10885>22 belong &0x02 may be loaded to alternate RAM, 10886>22 belong &0x04 malloc may be from alternate RAM, 10887>22 belong x flags: 0x%lX, 10888>26 beshort 0 no relocation tab 10889>26 beshort !0 + relocation tab 10890>30 string SFX [Self-Extracting LZH SFX archive] 10891>38 string SFX [Self-Extracting LZH SFX archive] 10892>44 string ZIP! [Self-Extracting ZIP SFX archive] 10893 108940 beshort 0x0064 Atari 68xxx CPX file 10895>8 beshort x (version %04lx) 10896 10897#------------------------------------------------------------------------------ 10898# $File: mozilla,v 1.4 2009/09/19 16:28:11 christos Exp $ 10899# mozilla: file(1) magic for Mozilla XUL fastload files 10900# (XUL.mfasl and XPC.mfasl) 10901# URL: http://www.mozilla.org/ 10902# From: Josh Triplett <josh@freedesktop.org> 10903 109040 string XPCOM\nMozFASL\r\n\x1A Mozilla XUL fastload data 10905 10906#------------------------------------------------------------------------------ 10907# $File: msdos,v 1.65 2009/09/19 16:28:11 christos Exp $ 10908# msdos: file(1) magic for MS-DOS files 10909# 10910 10911# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com) 10912# updated by Joerg Jenderek at Oct 2008 109130 string @ 10914>1 string/cW \ echo\ off DOS batch file text 10915!:mime text/x-msdos-batch 10916>1 string/cW echo\ off DOS batch file text 10917!:mime text/x-msdos-batch 10918>1 string/cW rem\ DOS batch file text 10919!:mime text/x-msdos-batch 10920>1 string/cW set\ DOS batch file text 10921!:mime text/x-msdos-batch 10922 10923 10924# OS/2 batch files are REXX. the second regex is a bit generic, oh well 10925# the matched commands seem to be common in REXX and uncommon elsewhere 10926100 search/0xffff rxfuncadd 10927>100 regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc OS/2 REXX batch file text 10928100 search/0xffff say 10929>100 regex/c =^[\ \t]{0,10}say\ ['"] OS/2 REXX batch file text 10930 109310 leshort 0x14c MS Windows COFF Intel 80386 object file 10932#>4 ledate x stamp %s 109330 leshort 0x166 MS Windows COFF MIPS R4000 object file 10934#>4 ledate x stamp %s 109350 leshort 0x184 MS Windows COFF Alpha object file 10936#>4 ledate x stamp %s 109370 leshort 0x268 MS Windows COFF Motorola 68000 object file 10938#>4 ledate x stamp %s 109390 leshort 0x1f0 MS Windows COFF PowerPC object file 10940#>4 ledate x stamp %s 109410 leshort 0x290 MS Windows COFF PA-RISC object file 10942#>4 ledate x stamp %s 10943 10944# XXX - according to Microsoft's spec, at an offset of 0x3c in a 10945# PE-format executable is the offset in the file of the PE header; 10946# unfortunately, that's a little-endian offset, and there's no way 10947# to specify an indirect offset with a specified byte order. 10948# So, for now, we assume the standard MS-DOS stub, which puts the 10949# PE header at 0x80 = 128. 10950# 10951# Required OS version and subsystem version were 4.0 on some NT 3.51 10952# executables built with Visual C++ 4.0, so it's not clear that 10953# they're interesting. The user version was 0.0, but there's 10954# probably some linker directive to set it. The linker version was 10955# 3.0, except for one ".exe" which had it as 4.20 (same damn linker!). 10956# 10957# many of the compressed formats were extraced from IDARC 1.23 source code 10958# 109590 string MZ 10960!:mime application/x-dosexec 10961>0x18 leshort <0x40 MS-DOS executable 10962>0 string MZ\0\0\0\0\0\0\0\0\0\0PE\0\0 \b, PE for MS Windows 10963>>&18 leshort&0x2000 >0 (DLL) 10964>>&88 leshort 0 (unknown subsystem) 10965>>&88 leshort 1 (native) 10966>>&88 leshort 2 (GUI) 10967>>&88 leshort 3 (console) 10968>>&88 leshort 7 (POSIX) 10969>>&0 leshort 0x0 unknown processor 10970>>&0 leshort 0x14c Intel 80386 10971>>&0 leshort 0x166 MIPS R4000 10972>>&0 leshort 0x184 Alpha 10973>>&0 leshort 0x268 Motorola 68000 10974>>&0 leshort 0x1f0 PowerPC 10975>>&0 leshort 0x290 PA-RISC 10976>>&18 leshort&0x0100 >0 32-bit 10977>>&18 leshort&0x1000 >0 system file 10978>>&228 lelong >0 \b, Mono/.Net assembly 10979>>&0xf4 search/0x140 \x0\x40\x1\x0 10980>>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive 10981>30 string Copyright\ 1989-1990\ PKWARE\ Inc. Self-extracting PKZIP archive 10982!:mime application/zip 10983# Is next line correct? One might expect "Corp." not "Copr." If it is right, add a note to that effect. 10984>30 string PKLITE\ Copr. Self-extracting PKZIP archive 10985!:mime application/zip 10986 10987>0x18 leshort >0x3f 10988>>(0x3c.l) string PE\0\0 PE 10989>>>(0x3c.l+25) byte 1 \b32 executable 10990>>>(0x3c.l+25) byte 2 \b32+ executable 10991# hooray, there's a DOS extender using the PE format, with a valid PE 10992# executable inside (which just prints a message and exits if run in win) 10993>>>(0x3c.l+92) leshort <10 10994>>>>(8.s*16) string 32STUB for MS-DOS, 32rtm DOS extender 10995>>>>(8.s*16) string !32STUB for MS Windows 10996>>>>>(0x3c.l+22) leshort&0x2000 >0 (DLL) 10997>>>>>(0x3c.l+92) leshort 0 (unknown subsystem) 10998>>>>>(0x3c.l+92) leshort 1 (native) 10999>>>>>(0x3c.l+92) leshort 2 (GUI) 11000>>>>>(0x3c.l+92) leshort 3 (console) 11001>>>>>(0x3c.l+92) leshort 7 (POSIX) 11002>>>(0x3c.l+92) leshort 10 (EFI application) 11003>>>(0x3c.l+92) leshort 11 (EFI boot service driver) 11004>>>(0x3c.l+92) leshort 12 (EFI runtime driver) 11005>>>(0x3c.l+92) leshort 13 (XBOX) 11006>>>(0x3c.l+4) leshort 0x0 unknown processor 11007>>>(0x3c.l+4) leshort 0x14c Intel 80386 11008>>>(0x3c.l+4) leshort 0x166 MIPS R4000 11009>>>(0x3c.l+4) leshort 0x184 Alpha 11010>>>(0x3c.l+4) leshort 0x268 Motorola 68000 11011>>>(0x3c.l+4) leshort 0x1f0 PowerPC 11012>>>(0x3c.l+4) leshort 0x290 PA-RISC 11013>>>(0x3c.l+4) leshort 0x200 Intel Itanium 11014>>>(0x3c.l+22) leshort&0x0100 >0 32-bit 11015>>>(0x3c.l+22) leshort&0x1000 >0 system file 11016>>>(0x3c.l+232) lelong >0 Mono/.Net assembly 11017 11018>>>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed 11019>>>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed 11020>>>>(0x3c.l+0xf8) search/0x140 UPX2 11021>>>>>(&0x10.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) 11022>>>>(0x3c.l+0xf8) search/0x140 .idata 11023>>>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) 11024>>>>>(&0xe.l+(-4)) string ZZ0 \b, ZZip self-extracting archive 11025>>>>>(&0xe.l+(-4)) string ZZ1 \b, ZZip self-extracting archive 11026>>>>(0x3c.l+0xf8) search/0x140 .rsrc 11027>>>>>(&0x0f.l+(-4)) string a\\\4\5 \b, WinHKI self-extracting archive 11028>>>>>(&0x0f.l+(-4)) string Rar! \b, RAR self-extracting archive 11029>>>>>(&0x0f.l+(-4)) search/0x3000 MSCF \b, InstallShield self-extracting archive 11030>>>>>(&0x0f.l+(-4)) search/32 Nullsoft \b, Nullsoft Installer self-extracting archive 11031>>>>(0x3c.l+0xf8) search/0x140 .data 11032>>>>>(&0x0f.l) string WEXTRACT \b, MS CAB-Installer self-extracting archive 11033>>>>(0x3c.l+0xf8) search/0x140 .petite\0 \b, Petite compressed 11034>>>>>(0x3c.l+0xf7) byte x 11035>>>>>>(&0x104.l+(-4)) string =!sfx! \b, ACE self-extracting archive 11036>>>>(0x3c.l+0xf8) search/0x140 .WISE \b, WISE installer self-extracting archive 11037>>>>(0x3c.l+0xf8) search/0x140 .dz\0\0\0 \b, Dzip self-extracting archive 11038>>>>(0x3c.l+0xf8) search/0x140 .reloc 11039>>>>>(&0xe.l+(-4)) search/0x180 PK\3\4 \b, ZIP self-extracting archive (WinZip) 11040 11041>>>>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip) 11042>>>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive 11043>>>>0x30 string Inno \b, InnoSetup self-extracting archive 11044 11045>>(0x3c.l) string !PE\0\0 MS-DOS executable 11046 11047>>(0x3c.l) string NE \b, NE 11048>>>(0x3c.l+0x36) byte 0 (unknown OS) 11049>>>(0x3c.l+0x36) byte 1 for OS/2 1.x 11050>>>(0x3c.l+0x36) byte 2 for MS Windows 3.x 11051>>>(0x3c.l+0x36) byte 3 for MS-DOS 11052>>>(0x3c.l+0x36) byte >3 (unknown OS) 11053>>>(0x3c.l+0x36) byte 0x81 for MS-DOS, Phar Lap DOS extender 11054>>>(0x3c.l+0x0c) leshort&0x8003 0x8002 (DLL) 11055>>>(0x3c.l+0x0c) leshort&0x8003 0x8001 (driver) 11056>>>&(&0x24.s-1) string ARJSFX \b, ARJ self-extracting archive 11057>>>(0x3c.l+0x70) search/0x80 WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip) 11058 11059>>(0x3c.l) string LX\0\0 \b, LX 11060>>>(0x3c.l+0x0a) leshort <1 (unknown OS) 11061>>>(0x3c.l+0x0a) leshort 1 for OS/2 11062>>>(0x3c.l+0x0a) leshort 2 for MS Windows 11063>>>(0x3c.l+0x0a) leshort 3 for DOS 11064>>>(0x3c.l+0x0a) leshort >3 (unknown OS) 11065>>>(0x3c.l+0x10) lelong&0x28000 =0x8000 (DLL) 11066>>>(0x3c.l+0x10) lelong&0x20000 >0 (device driver) 11067>>>(0x3c.l+0x10) lelong&0x300 0x300 (GUI) 11068>>>(0x3c.l+0x10) lelong&0x28300 <0x300 (console) 11069>>>(0x3c.l+0x08) leshort 1 i80286 11070>>>(0x3c.l+0x08) leshort 2 i80386 11071>>>(0x3c.l+0x08) leshort 3 i80486 11072>>>(8.s*16) string emx \b, emx 11073>>>>&1 string x %s 11074>>>&(&0x54.l-3) string arjsfx \b, ARJ self-extracting archive 11075 11076# MS Windows system file, supposedly a collection of LE executables 11077>>(0x3c.l) string W3 \b, W3 for MS Windows 11078 11079>>(0x3c.l) string LE\0\0 \b, LE executable 11080>>>(0x3c.l+0x0a) leshort 1 11081# some DOS extenders use LE files with OS/2 header 11082>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender 11083>>>>0x240 search/0x200 WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender 11084>>>>0x440 search/0x100 CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender 11085>>>>0x40 search/0x40 PMODE/W for MS-DOS, PMODE/W DOS extender 11086>>>>0x40 search/0x40 STUB/32A for MS-DOS, DOS/32A DOS extender (stub) 11087>>>>0x40 search/0x80 STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub) 11088>>>>0x40 search/0x80 DOS/32A for MS-DOS, DOS/32A DOS extender (embedded) 11089# this is a wild guess; hopefully it is a specific signature 11090>>>>&0x24 lelong <0x50 11091>>>>>(&0x4c.l) string \xfc\xb8WATCOM 11092>>>>>>&0 search/8 3\xdbf\xb9 \b, 32Lite compressed 11093# another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP 11094#>>>>(0x3c.l+0x1c) lelong >0x10000 for OS/2 11095# fails with DOS-Extenders. 11096>>>(0x3c.l+0x0a) leshort 2 for MS Windows 11097>>>(0x3c.l+0x0a) leshort 3 for DOS 11098>>>(0x3c.l+0x0a) leshort 4 for MS Windows (VxD) 11099>>>(&0x7c.l+0x26) string UPX \b, UPX compressed 11100>>>&(&0x54.l-3) string UNACE \b, ACE self-extracting archive 11101 11102# looks like ASCII, probably some embedded copyright message. 11103# and definitely not NE/LE/LX/PE 11104>>0x3c lelong >0x20000000 11105>>>(4.s*512) leshort !0x014c \b, MZ for MS-DOS 11106# header data too small for extended executable 11107>2 long !0 11108>>0x18 leshort <0x40 11109>>>(4.s*512) leshort !0x014c 11110 11111>>>>&(2.s-514) string !LE 11112>>>>>&-2 string !BW \b, MZ for MS-DOS 11113>>>>&(2.s-514) string LE \b, LE 11114>>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender 11115# educated guess since indirection is still not capable enough for complex offset 11116# calculations (next embedded executable would be at &(&2*512+&0-2) 11117# I suspect there are only LE executables in these multi-exe files 11118>>>>&(2.s-514) string BW 11119>>>>>0x240 search/0x100 DOS/4G ,\b LE for MS-DOS, DOS4GW DOS extender (embedded) 11120>>>>>0x240 search/0x100 !DOS/4G ,\b BW collection for MS-DOS 11121 11122# This sequence skips to the first COFF segment, usually .text 11123>(4.s*512) leshort 0x014c \b, COFF 11124>>(8.s*16) string go32stub for MS-DOS, DJGPP go32 DOS extender 11125>>(8.s*16) string emx 11126>>>&1 string x for DOS, Win or OS/2, emx %s 11127>>&(&0x42.l-3) byte x 11128>>>&0x26 string UPX \b, UPX compressed 11129# and yet another guess: small .text, and after large .data is unusal, could be 32lite 11130>>&0x2c search/0xa0 .text 11131>>>&0x0b lelong <0x2000 11132>>>>&0 lelong >0x6000 \b, 32lite compressed 11133 11134>(8.s*16) string $WdX \b, WDos/X DOS extender 11135 11136# .EXE formats (Greg Roelofs, newt@uchicago.edu) 11137# 11138>0x35 string \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed 11139>0xe7 string LH/2\ Self-Extract \b, %s 11140>0x1c string diet \b, diet compressed 11141>0x1c string LZ09 \b, LZEXE v0.90 compressed 11142>0x1c string LZ91 \b, LZEXE v0.91 compressed 11143>0x1c string tz \b, TinyProg compressed 11144>0x1e string PKLITE \b, %s compressed 11145>0x64 string W\ Collis\0\0 \b, Compack compressed 11146>0x24 string LHa's\ SFX \b, LHa self-extracting archive 11147!:mime application/x-lha 11148>0x24 string LHA's\ SFX \b, LHa self-extracting archive 11149!:mime application/x-lha 11150>0x24 string \ $ARX \b, ARX self-extracting archive 11151>0x24 string \ $LHarc \b, LHarc self-extracting archive 11152>0x20 string SFX\ by\ LARC \b, LARC self-extracting archive 11153>1638 string -lh5- \b, LHa self-extracting archive v2.13S 11154>0x17888 string Rar! \b, RAR self-extracting archive 11155>0x40 string aPKG \b, aPackage self-extracting archive 11156 11157>32 string AIN 11158>>35 string 2 \b, AIN 2.x compressed 11159>>35 string <2 \b, AIN 1.x compressed 11160>>35 string >2 \b, AIN 1.x compressed 11161>28 string UC2X \b, UCEXE compressed 11162>28 string WWP\ \b, WWPACK compressed 11163 11164# skip to the end of the exe 11165>(4.s*512) long x 11166>>&(2.s-517) byte x 11167>>>&0 string PK\3\4 \b, ZIP self-extracting archive 11168>>>&0 string Rar! \b, RAR self-extracting archive 11169>>>&0 string =!\x11 \b, AIN 2.x self-extracting archive 11170>>>&0 string =!\x12 \b, AIN 2.x self-extracting archive 11171>>>&0 string =!\x17 \b, AIN 1.x self-extracting archive 11172>>>&0 string =!\x18 \b, AIN 1.x self-extracting archive 11173>>>&7 search/400 **ACE** \b, ACE self-extracting archive 11174>>>&0 search/0x480 UC2SFX\ Header \b, UC2 self-extracting archive 11175 11176>0x1c string RJSX \b, ARJ self-extracting archive 11177# winarj stores a message in the stub instead of the sig in the MZ header 11178>0x20 search/0xe0 aRJsfX \b, ARJ self-extracting archive 11179 11180# a few unknown ZIP sfxes, no idea if they are needed or if they are 11181# already captured by the generic patterns above 11182>0x7a string Windows\ self-extracting\ ZIP \b, ZIP self-extracting archive 11183>(8.s*16) search/0x20 PKSFX \b, ZIP self-extracting archive (PKZIP) 11184# TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive 11185# 11186 11187# TELVOX Teleinformatica CODEC self-extractor for OS/2: 11188>49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21 11189>>49824 leshort =1 \b, 1 file 11190>>49824 leshort >1 \b, %u files 11191 11192# .COM formats (Daniel Quinlan, quinlan@yggdrasil.com) 11193# Uncommenting only the first two lines will cover about 2/3 of COM files, 11194# but it isn't feasible to match all COM files since there must be at least 11195# two dozen different one-byte "magics". 11196# test too generic ? 111970 byte 0xe9 DOS executable (COM) 11198>0x1FE leshort 0xAA55 \b, boot code 11199>6 string SFX\ of\ LHarc (%s) 112000 belong 0xffffffff DOS executable (device driver) 11201#CMD640X2.SYS 11202>10 string >\x23 11203>>10 string !\x2e 11204>>>17 string <\x5B 11205>>>>10 string x \b, name: %.8s 11206#UDMA.SYS KEYB.SYS CMD640X2.SYS 11207>10 string <\x41 11208>>12 string >\x40 11209>>>10 string !$ 11210>>>>12 string x \b, name: %.8s 11211#BTCDROM.SYS ASPICD.SYS 11212>22 string >\x40 11213>>22 string <\x5B 11214>>>23 string <\x5B 11215>>>>22 string x \b, name: %.8s 11216#ATAPICD.SYS 11217>76 string \0 11218>>77 string >\x40 11219>>>77 string <\x5B 11220>>>>77 string x \b, name: %.8s 11221# test too generic ? 112220 byte 0x8c DOS executable (COM) 11223# updated by Joerg Jenderek at Oct 2008 112240 ulelong 0xffff10eb DR-DOS executable (COM) 11225# byte 0xeb conflicts with "sequent" magic leshort 0xn2eb 112260 ubeshort&0xeb8d >0xeb00 11227# DR-DOS STACKER.COM SCREATE.SYS missed 11228>0 byte 0xeb DOS executable (COM) 11229>>0x1FE leshort 0xAA55 \b, boot code 11230>>85 string UPX \b, UPX compressed 11231>>4 string \ $ARX \b, ARX self-extracting archive 11232>>4 string \ $LHarc \b, LHarc self-extracting archive 11233>>0x20e string SFX\ by\ LARC \b, LARC self-extracting archive 11234# updated by Joerg Jenderek at Oct 2008 11235#0 byte 0xb8 COM executable 112360 uleshort&0x80ff 0x00b8 11237# modified by Joerg Jenderek 11238>1 lelong !0x21cd4cff COM executable for DOS 11239# http://syslinux.zytor.com/comboot.php 11240# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode 11241# start with assembler instructions mov eax,21cd4cffh 112420 uleshort&0xc0ff 0xc0b8 11243>1 lelong 0x21cd4cff COM executable (32-bit COMBOOT) 112440 string \x81\xfc 11245>4 string \x77\x02\xcd\x20\xb9 11246>>36 string UPX! FREE-DOS executable (COM), UPX compressed 11247252 string Must\ have\ DOS\ version DR-DOS executable (COM) 11248# added by Joerg Jenderek at Oct 2008 11249# GRR search is not working 11250#34 search/2 UPX! FREE-DOS executable (COM), UPX compressed 1125134 string UPX! FREE-DOS executable (COM), UPX compressed 1125235 string UPX! FREE-DOS executable (COM), UPX compressed 11253# GRR search is not working 11254#2 search/28 \xcd\x21 COM executable for MS-DOS 11255#WHICHFAT.cOM 112562 string \xcd\x21 COM executable for DOS 11257#DELTREE.cOM DELTREE2.cOM 112584 string \xcd\x21 COM executable for DOS 11259#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM 112605 string \xcd\x21 COM executable for DOS 11261#DELTMP.COm HASFAT32.cOM 112627 string \xcd\x21 11263>0 byte !0xb8 COM executable for DOS 11264#COMP.cOM MORE.COm 1126510 string \xcd\x21 11266>5 string !\xcd\x21 COM executable for DOS 11267#comecho.com 1126813 string \xcd\x21 COM executable for DOS 11269#HELP.COm EDIT.coM 1127018 string \xcd\x21 COM executable for MS-DOS 11271#NWRPLTRM.COm 1127223 string \xcd\x21 COM executable for MS-DOS 11273#LOADFIX.cOm LOADFIX.cOm 1127430 string \xcd\x21 COM executable for MS-DOS 11275#syslinux.com 3.11 1127670 string \xcd\x21 COM executable for DOS 11277# many compressed/converted COMs start with a copy loop instead of a jump 112780x6 search/0xa \xfc\x57\xf3\xa5\xc3 COM executable for MS-DOS 112790x6 search/0xa \xfc\x57\xf3\xa4\xc3 COM executable for DOS 11280>0x18 search/0x10 \x50\xa4\xff\xd5\x73 \b, aPack compressed 112810x3c string W\ Collis\0\0 COM executable for MS-DOS, Compack compressed 11282# FIXME: missing diet .com compression 11283 11284# miscellaneous formats 112850 string LZ MS-DOS executable (built-in) 11286#0 byte 0xf0 MS-DOS program library data 11287# 11288 11289# AAF files: 11290# <stuartc@rd.bbc.co.uk> Stuart Cunningham 112910 string \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage 11292>30 byte 9 (512B sectors) 11293>30 byte 12 (4kB sectors) 112940 string \320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001 AAF file using MS Structured Storage 11295>30 byte 9 (512B sectors) 11296>30 byte 12 (4kB sectors) 11297 11298# Popular applications 112992080 string Microsoft\ Word\ 6.0\ Document %s 11300!:mime application/msword 113012080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data 11302!:mime application/msword 11303# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word) 113042112 string MSWordDoc Microsoft Word document data 11305!:mime application/msword 11306# 113070 belong 0x31be0000 Microsoft Word Document 11308!:mime application/msword 11309# 113100 string PO^Q` Microsoft Word 6.0 Document 11311!:mime application/msword 11312# 113130 string \376\067\0\043 Microsoft Office Document 11314!:mime application/msword 113150 string \333\245-\0\0\0 Microsoft Office Document 11316!:mime application/msword 11317512 string \354\245\301 Microsoft Word Document 11318!:mime application/msword 11319# 113202080 string Microsoft\ Excel\ 5.0\ Worksheet %s 11321!:mime application/vnd.ms-excel 11322 113232080 string Foglio\ di\ lavoro\ Microsoft\ Exce %s 11324!:mime application/vnd.ms-excel 11325# 11326# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel) 113272114 string Biff5 Microsoft Excel 5.0 Worksheet 11328!:mime application/vnd.ms-excel 11329# Italian MS-Excel 113302121 string Biff5 Microsoft Excel 5.0 Worksheet 11331!:mime application/vnd.ms-excel 113320 string \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet 11333!:mime application/vnd.ms-excel 11334# 113350 belong 0x00001a00 Lotus 1-2-3 11336!:mime application/x-123 11337>4 belong 0x00100400 wk3 document data 11338>4 belong 0x02100400 wk4 document data 11339>4 belong 0x07800100 fm3 or fmb document data 11340>4 belong 0x07800000 fm3 or fmb document data 11341# 113420 belong 0x00000200 Lotus 1-2-3 11343!:mime application/x-123 11344>4 belong 0x06040600 wk1 document data 11345>4 belong 0x06800200 fmt document data 113460 string WordPro\0 Lotus WordPro 11347!:mime application/vnd.lotus-wordpro 113480 string WordPro\r\373 Lotus WordPro 11349!:mime application/vnd.lotus-wordpro 11350 11351 11352# Summary: Script used by InstallScield to uninstall applications 11353# Extension: .isu 11354# Submitted by: unknown 11355# Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry) 113560 string \x71\xa8\x00\x00\x01\x02 11357>12 string Stirling\ Technologies, InstallShield Uninstall Script 11358 11359# Winamp .avs 11360#0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player 113610 string Nullsoft\ AVS\ Preset\ Winamp plug in 11362 11363# Windows Metafont .WMF 113640 string \327\315\306\232 ms-windows metafont .wmf 113650 string \002\000\011\000 ms-windows metafont .wmf 113660 string \001\000\011\000 ms-windows metafont .wmf 11367 11368#tz3 files whatever that is (MS Works files) 113690 string \003\001\001\004\070\001\000\000 tz3 ms-works file 113700 string \003\002\001\004\070\001\000\000 tz3 ms-works file 113710 string \003\003\001\004\070\001\000\000 tz3 ms-works file 11372 11373# PGP sig files .sig 11374#0 string \211\000\077\003\005\000\063\237\127 065 to \027\266\151\064\005\045\101\233\021\002 PGP sig 113750 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig 113760 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig 113770 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig 113780 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig 113790 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig 113800 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig 11381 11382# windows zips files .dmf 113830 string MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file 11384 11385 11386#ico files 113870 string \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for MS Windows 11388 11389# Windows icons (Ian Springer <ips@fpk.hp.com>) 113900 string \000\000\001\000 MS Windows icon resource 11391!:mime image/x-ico 11392>4 byte 1 - 1 icon 11393>4 byte >1 - %d icons 11394>>6 byte >0 \b, %dx 11395>>>7 byte >0 \b%d 11396>>8 byte 0 \b, 256-colors 11397>>8 byte >0 \b, %d-colors 11398 11399 11400# .chr files 114010 string PK\010\010BGI Borland font 11402>4 string >\0 %s 11403# then there is a copyright notice 11404 11405 11406# .bgi files 114070 string pk\010\010BGI Borland device 11408>4 string >\0 %s 11409# then there is a copyright notice 11410 11411 11412# Windows Recycle Bin record file (named INFO2) 11413# By Abel Cheung (abelcheung AT gmail dot com) 11414# Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes 11415# Since Vista uses another structure, INFO2 structure probably won't change 11416# anymore. Detailed analysis in: 11417# http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf 114180 lelong 0x00000004 11419>12 lelong 0x00000118 Windows Recycle Bin INFO2 file (Win98 or below) 11420 114210 lelong 0x00000005 11422>12 lelong 0x00000320 Windows Recycle Bin INFO2 file (Win2k - WinXP) 11423 11424 11425##### put in Either Magic/font or Magic/news 11426# Acroread or something files wrongly identified as G3 .pfm 11427# these have the form \000 \001 any? \002 \000 \000 11428# or \000 \001 any? \022 \000 \000 114290 belong&0xffff00ff 0x00010012 PFM data 11430>4 string \000\000 11431>6 string >\060 - %s 11432 114330 belong&0xffff00ff 0x00010002 PFM data 11434>4 string \000\000 11435>6 string >\060 - %s 11436#0 string \000\001 pfm? 11437#>3 string \022\000\000Copyright\ yes 11438#>3 string \002\000\000Copyright\ yes 11439#>3 string >\0 oops, not a font file. Cancel that. 11440#it clashes with ttf files so put it lower down. 11441 11442# From Doug Lee via a FreeBSD pr 114439 string GERBILDOC First Choice document 114449 string GERBILDB First Choice database 114459 string GERBILCLIP First Choice database 114460 string GERBIL First Choice device file 114479 string RABBITGRAPH RabbitGraph file 114480 string DCU1 Borland Delphi .DCU file 114490 string =!<spell> MKS Spell hash list (old format) 114500 string =!<spell2> MKS Spell hash list 11451# Too simple - MPi 11452#0 string AH Halo(TM) bitmapped font file 114530 lelong 0x08086b70 TurboC BGI file 114540 lelong 0x08084b50 TurboC Font file 11455 11456# WARNING: below line conflicts with Infocom game data Z-machine 3 114570 byte 0x03 DBase 3 data file 11458>0x04 lelong 0 (no records) 11459>0x04 lelong >0 (%ld records) 114600 byte 0x83 DBase 3 data file with memo(s) 11461>0x04 lelong 0 (no records) 11462>0x04 lelong >0 (%ld records) 114630 leshort 0x0006 DBase 3 index file 114640 string PMCC Windows 3.x .GRP file 114651 string RDC-meg MegaDots 11466>8 byte >0x2F version %c 11467>9 byte >0x2F \b.%c file 114680 lelong 0x4C 11469>4 lelong 0x00021401 Windows shortcut file 11470 11471# DOS EPS Binary File Header 11472# From: Ed Sznyter <ews@Black.Market.NET> 114730 belong 0xC5D0D3C6 DOS EPS Binary File 11474>4 long >0 Postscript starts at byte %d 11475>>8 long >0 length %d 11476>>>12 long >0 Metafile starts at byte %d 11477>>>>16 long >0 length %d 11478>>>20 long >0 TIFF starts at byte %d 11479>>>>24 long >0 length %d 11480 11481# TNEF magic From "Joomy" <joomy@se-ed.net> 11482# Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF) 114830 leshort 0x223e9f78 TNEF 11484!:mime application/vnd.ms-tnef 11485 11486# HtmlHelp files (.chm) 114870 string ITSF\003\000\000\000\x60\000\000\000\001\000\000\000 MS Windows HtmlHelp Data 11488 11489# GFA-BASIC (Wolfram Kleff) 114902 string GFA-BASIC3 GFA-BASIC 3 data 11491 11492#------------------------------------------------------------------------------ 11493# From Stuart Caie <kyzer@4u.net> (developer of cabextract) 11494# Microsoft Cabinet files 114950 string MSCF\0\0\0\0 Microsoft Cabinet archive data 11496!:mime application/vnd.ms-cab-compressed 11497>8 lelong x \b, %u bytes 11498>28 leshort 1 \b, 1 file 11499>28 leshort >1 \b, %u files 11500 11501# InstallShield Cabinet files 115020 string ISc( InstallShield Cabinet archive data 11503>5 byte&0xf0 =0x60 version 6, 11504>5 byte&0xf0 !0x60 version 4/5, 11505>(12.l+40) lelong x %u files 11506 11507# Windows CE package files 115080 string MSCE\0\0\0\0 Microsoft WinCE install header 11509>20 lelong 0 \b, architecture-independent 11510>20 lelong 103 \b, Hitachi SH3 11511>20 lelong 104 \b, Hitachi SH4 11512>20 lelong 0xA11 \b, StrongARM 11513>20 lelong 4000 \b, MIPS R4000 11514>20 lelong 10003 \b, Hitachi SH3 11515>20 lelong 10004 \b, Hitachi SH3E 11516>20 lelong 10005 \b, Hitachi SH4 11517>20 lelong 70001 \b, ARM 7TDMI 11518>52 leshort 1 \b, 1 file 11519>52 leshort >1 \b, %u files 11520>56 leshort 1 \b, 1 registry entry 11521>56 leshort >1 \b, %u registry entries 11522 11523 11524# Windows Enhanced Metafile (EMF) 11525# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp 11526# for further information. 115270 ulelong 1 11528>40 string \ EMF Windows Enhanced Metafile (EMF) image data 11529>>44 ulelong x version 0x%x 11530 11531# From: Alex Beregszaszi <alex@fsn.hu> 115320 string COWD VMWare3 11533>4 byte 3 disk image 11534>>32 lelong x (%d/ 11535>>36 lelong x \b%d/ 11536>>40 lelong x \b%d) 11537>4 byte 2 undoable disk image 11538>>32 string >\0 (%s) 11539 115400 string VMDK VMware4 disk image 115410 string KDMV VMware4 disk image 11542 11543#-------------------------------------------------------------------- 11544# Qemu Emulator Images 11545# Lines written by Friedrich Schwittay (f.schwittay@yousable.de) 11546# Updated by Adam Buchbinder (adam.buchbinder@gmail.com) 11547# Made by reading sources, reading documentation, and doing trial and error 11548# on existing QCOW files 115490 string QFI\xFB QEMU QCOW Image 11550 11551# Uncomment the following line to display Magic (only used for debugging 11552# this magic number) 11553#>0 string x , Magic: %s 11554 11555# There are currently 2 Versions: "1" and "2". 11556# http://www.gnome.org/~markmc/qcow-image-format-version-1.html 11557>4 belong 1 (v1) 11558 11559# Using the existence of the Backing File Offset to determine whether 11560# to read Backing File Information 11561>>12 belong >0 \b, has backing file ( 11562# Note that this isn't a null-terminated string; the length is actually 11563# (16.L). Assuming a null-terminated string happens to work usually, but it 11564# may spew junk until it reaches a \0 in some cases. 11565>>>(12.L) string >\0 \bpath %s 11566 11567# Modification time of the Backing File 11568# Really useful if you want to know if your backing 11569# file is still usable together with this image 11570>>>>20 bedate >0 \b, mtime %s) 11571>>>>20 default x \b) 11572 11573# Size is stored in bytes in a big-endian u64. 11574>>24 bequad x \b, %lld bytes 11575 11576# 1 for AES encryption, 0 for none. 11577>>36 belong 1 \b, AES-encrypted 11578 11579# http://www.gnome.org/~markmc/qcow-image-format.html 11580>4 belong 2 (v2) 11581# Using the existence of the Backing File Offset to determine whether 11582# to read Backing File Information 11583>>8 bequad >0 \b, has backing file 11584# Note that this isn't a null-terminated string; the length is actually 11585# (16.L). Assuming a null-terminated string happens to work usually, but it 11586# may spew junk until it reaches a \0 in some cases. Also, since there's no 11587# .Q modifier, we just use the bottom four bytes as an offset. Note that if 11588# the file is over 4G, and the backing file path is stored after the first 4G, 11589# the wrong filename will be printed. (This should be (8.Q), when that syntax 11590# is introduced.) 11591>>>(12.L) string >\0 (path %s) 11592>>24 bequad x \b, %lld bytes 11593>>32 belong 1 \b, AES-encrypted 11594 11595>4 default x (unknown version) 11596 115970 string QEVM QEMU suspend to disk image 11598 115990 string Bochs\ Virtual\ HD\ Image Bochs disk image, 11600>32 string x type %s, 11601>48 string x subtype %s 11602 116030 lelong 0x02468ace Bochs Sparse disk image 11604 11605# from http://filext.com by Derek M Jones <derek@knosof.co.uk> 11606# False positive with PPT (also currently this string is too long) 11607#0 string \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF\x09\x00\x06 Microsoft Installer 116080 string \320\317\021\340\241\261\032\341 Microsoft Office Document 11609#>48 byte 0x1B Excel Document 11610#!:mime application/vnd.ms-excel 11611>546 string bjbj Microsoft Word Document 11612!:mime application/msword 11613>546 string jbjb Microsoft Word Document 11614!:mime application/msword 11615 116160 string \224\246\056 Microsoft Word Document 11617!:mime application/msword 11618 11619512 string R\0o\0o\0t\0\ \0E\0n\0t\0r\0y Microsoft Word Document 11620!:mime application/msword 11621 11622# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 11623# Magic type for Dell's BIOS .hdr files 11624# Dell's .hdr 116250 string $RBU 11626>23 string Dell %s system BIOS 11627>48 string x version %.3s 11628 11629# Type: Microsoft DirectDraw Surface 11630# URL: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp 11631# From: Morten Hustveit <morten@debian.org> 116320 string DDS\040\174\000\000\000 Microsoft DirectDraw Surface (DDS), 11633>16 lelong >0 %hd x 11634>12 lelong >0 %hd, 11635>84 string x %.4s 11636 11637# Type: Microsoft Document Imaging Format (.mdi) 11638# URL: http://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format 11639# From: Daniele Sempione <scrows@oziosi.org> 116400 short 0x5045 Microsoft Document Imaging Format 11641 11642# MS eBook format (.lit) 116430 string ITOLITLS Microsoft Reader eBook Data 11644>8 lelong x \b, version %u 11645!:mime application/x-ms-reader 11646 11647#------------------------------------------------------------------------------ 11648# $File: msvc,v 1.5 2009/09/19 16:28:11 christos Exp $ 11649# msvc: file(1) magic for msvc 11650# "H. Nanosecond" <aldomel@ix.netcom.com> 11651# Microsoft visual C 11652# 11653# I have version 1.0 11654 11655# .aps 116560 string HWB\000\377\001\000\000\000 Microsoft Visual C .APS file 11657 11658# .ide 11659#too long 0 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157\152\145\143\164\040\106\151\154\145\012\000\032\000\002\000\262\000\272\276\372\316 MSVC .ide 116600 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157 MSVC .ide 11661 11662# .res 116630 string \000\000\000\000\040\000\000\000\377 MSVC .res 116640 string \377\003\000\377\001\000\020\020\350 MSVC .res 116650 string \377\003\000\377\001\000\060\020\350 MSVC .res 11666 11667#.lib 116680 string \360\015\000\000 Microsoft Visual C library 116690 string \360\075\000\000 Microsoft Visual C library 116700 string \360\175\000\000 Microsoft Visual C library 11671 11672#.pch 116730 string DTJPCH0\000\022\103\006\200 Microsoft Visual C .pch 11674 11675# .pdb 11676# too long 0 string Microsoft\ C/C++\ program\ database\ 116770 string Microsoft\ C/C++\ MSVC program database 11678>18 string program\ database\ 11679>33 string >\0 ver %s 11680 11681#.sbr 116820 string \000\002\000\007\000 MSVC .sbr 11683>5 string >\0 %s 11684 11685#.bsc 116860 string \002\000\002\001 MSVC .bsc 11687 11688#.wsp 116890 string 1.00\ .0000.0000\000\003 MSVC .wsp version 1.0000.0000 11690# these seem to start with the version and contain menus 11691 11692# ------------------------------------------------------------------------ 11693# $File: mup,v 1.4 2009/09/19 16:28:11 christos Exp $ 11694# mup: file(1) magic for Mup (Music Publisher) input file. 11695# 11696# From: Abel Cheung <abel (@) oaka.org> 11697# 11698# NOTE: This header is mainly proposed in the Arkkra mailing list, 11699# and is not a mandatory header because of old mup input file 11700# compatibility. Noteedit also use mup format, but is not forcing 11701# user to use any header as well. 11702# 117030 search/1 //!Mup Mup music publication program input text 11704>6 string -Arkkra (Arkkra) 11705>>13 string - 11706>>>16 string . 11707>>>>14 string x \b, need V%.4s 11708>>>15 string . 11709>>>>14 string x \b, need V%.3s 11710>6 string - 11711>>9 string . 11712>>>7 string x \b, need V%.4s 11713>>8 string . 11714>>>7 string x \b, need V%.3s 11715 11716#----------------------------------------------------------------------------- 11717# $File: natinst,v 1.4 2009/09/19 16:28:11 christos Exp $ 11718# natinst: file(1) magic for National Instruments Code Files 11719 11720# 11721# From <egamez@fcfm.buap.mx> Enrique G�mez-Flores 11722# version 1 11723# Many formats still missing, we use, for the moment LabVIEW 11724# We guess VXI format file. VISA, LabWindowsCVI, BridgeVIEW, etc, are missing 11725# 117260 string RSRC National Instruments, 11727# Check if it's a LabVIEW File 11728>8 string LV LabVIEW File, 11729# Check wich kind of file is 11730>>10 string SB Code Resource File, data 11731>>10 string IN Virtual Instrument Program, data 11732>>10 string AR VI Library, data 11733# This is for Menu Libraries 11734>8 string LMNULBVW Portable File Names, data 11735# This is for General Resources 11736>8 string rsc Resources File, data 11737# This is for VXI Package 117380 string VMAP National Instruments, VXI File, data 11739 11740#------------------------------------------------------------------------------ 11741# $File: ncr,v 1.7 2009/09/19 16:28:11 christos Exp $ 11742# ncr: file(1) magic for NCR Tower objects 11743# 11744# contributed by 11745# Michael R. Wayne *** TMC & Associates *** INTERNET: wayne@ford-vax.arpa 11746# uucp: {philabs | pyramid} !fmsrl7!wayne OR wayne@fmsrl7.UUCP 11747# 117480 beshort 000610 Tower/XP rel 2 object 11749>12 belong >0 not stripped 11750>20 beshort 0407 executable 11751>20 beshort 0410 pure executable 11752>22 beshort >0 - version %ld 117530 beshort 000615 Tower/XP rel 2 object 11754>12 belong >0 not stripped 11755>20 beshort 0407 executable 11756>20 beshort 0410 pure executable 11757>22 beshort >0 - version %ld 117580 beshort 000620 Tower/XP rel 3 object 11759>12 belong >0 not stripped 11760>20 beshort 0407 executable 11761>20 beshort 0410 pure executable 11762>22 beshort >0 - version %ld 117630 beshort 000625 Tower/XP rel 3 object 11764>12 belong >0 not stripped 11765>20 beshort 0407 executable 11766>20 beshort 0410 pure executable 11767>22 beshort >0 - version %ld 117680 beshort 000630 Tower32/600/400 68020 object 11769>12 belong >0 not stripped 11770>20 beshort 0407 executable 11771>20 beshort 0410 pure executable 11772>22 beshort >0 - version %ld 117730 beshort 000640 Tower32/800 68020 11774>18 beshort &020000 w/68881 object 11775>18 beshort &040000 compatible object 11776>18 beshort &060000 object 11777>20 beshort 0407 executable 11778>20 beshort 0413 pure executable 11779>12 belong >0 not stripped 11780>22 beshort >0 - version %ld 117810 beshort 000645 Tower32/800 68010 11782>18 beshort &040000 compatible object 11783>18 beshort &060000 object 11784>20 beshort 0407 executable 11785>20 beshort 0413 pure executable 11786>12 belong >0 not stripped 11787>22 beshort >0 - version %ld 11788 11789#------------------------------------------------------------------------------ 11790# $File: netbsd,v 1.18 2009/09/19 16:28:11 christos Exp $ 11791# netbsd: file(1) magic for NetBSD objects 11792# 11793# All new-style magic numbers are in network byte order. 11794# 11795 117960 lelong 000000407 a.out NetBSD little-endian object file 11797>16 lelong >0 not stripped 117980 belong 000000407 a.out NetBSD big-endian object file 11799>16 belong >0 not stripped 11800 118010 belong&0377777777 041400413 a.out NetBSD/i386 demand paged 11802>0 byte &0x80 11803>>20 lelong <4096 shared library 11804>>20 lelong =4096 dynamically linked executable 11805>>20 lelong >4096 dynamically linked executable 11806>0 byte ^0x80 executable 11807>16 lelong >0 not stripped 118080 belong&0377777777 041400410 a.out NetBSD/i386 pure 11809>0 byte &0x80 dynamically linked executable 11810>0 byte ^0x80 executable 11811>16 lelong >0 not stripped 118120 belong&0377777777 041400407 a.out NetBSD/i386 11813>0 byte &0x80 dynamically linked executable 11814>0 byte ^0x80 11815>>0 byte &0x40 position independent 11816>>20 lelong !0 executable 11817>>20 lelong =0 object file 11818>16 lelong >0 not stripped 118190 belong&0377777777 041400507 a.out NetBSD/i386 core 11820>12 string >\0 from '%s' 11821>32 lelong !0 (signal %d) 11822 118230 belong&0377777777 041600413 a.out NetBSD/m68k demand paged 11824>0 byte &0x80 11825>>20 belong <8192 shared library 11826>>20 belong =8192 dynamically linked executable 11827>>20 belong >8192 dynamically linked executable 11828>0 byte ^0x80 executable 11829>16 belong >0 not stripped 118300 belong&0377777777 041600410 a.out NetBSD/m68k pure 11831>0 byte &0x80 dynamically linked executable 11832>0 byte ^0x80 executable 11833>16 belong >0 not stripped 118340 belong&0377777777 041600407 a.out NetBSD/m68k 11835>0 byte &0x80 dynamically linked executable 11836>0 byte ^0x80 11837>>0 byte &0x40 position independent 11838>>20 belong !0 executable 11839>>20 belong =0 object file 11840>16 belong >0 not stripped 118410 belong&0377777777 041600507 a.out NetBSD/m68k core 11842>12 string >\0 from '%s' 11843>32 belong !0 (signal %d) 11844 118450 belong&0377777777 042000413 a.out NetBSD/m68k4k demand paged 11846>0 byte &0x80 11847>>20 belong <4096 shared library 11848>>20 belong =4096 dynamically linked executable 11849>>20 belong >4096 dynamically linked executable 11850>0 byte ^0x80 executable 11851>16 belong >0 not stripped 118520 belong&0377777777 042000410 a.out NetBSD/m68k4k pure 11853>0 byte &0x80 dynamically linked executable 11854>0 byte ^0x80 executable 11855>16 belong >0 not stripped 118560 belong&0377777777 042000407 a.out NetBSD/m68k4k 11857>0 byte &0x80 dynamically linked executable 11858>0 byte ^0x80 11859>>0 byte &0x40 position independent 11860>>20 belong !0 executable 11861>>20 belong =0 object file 11862>16 belong >0 not stripped 118630 belong&0377777777 042000507 a.out NetBSD/m68k4k core 11864>12 string >\0 from '%s' 11865>32 belong !0 (signal %d) 11866 118670 belong&0377777777 042200413 a.out NetBSD/ns32532 demand paged 11868>0 byte &0x80 11869>>20 lelong <4096 shared library 11870>>20 lelong =4096 dynamically linked executable 11871>>20 lelong >4096 dynamically linked executable 11872>0 byte ^0x80 executable 11873>16 lelong >0 not stripped 118740 belong&0377777777 042200410 a.out NetBSD/ns32532 pure 11875>0 byte &0x80 dynamically linked executable 11876>0 byte ^0x80 executable 11877>16 lelong >0 not stripped 118780 belong&0377777777 042200407 a.out NetBSD/ns32532 11879>0 byte &0x80 dynamically linked executable 11880>0 byte ^0x80 11881>>0 byte &0x40 position independent 11882>>20 lelong !0 executable 11883>>20 lelong =0 object file 11884>16 lelong >0 not stripped 118850 belong&0377777777 042200507 a.out NetBSD/ns32532 core 11886>12 string >\0 from '%s' 11887>32 lelong !0 (signal %d) 11888 118890 belong&0377777777 045200507 a.out NetBSD/powerpc core 11890>12 string >\0 from '%s' 11891 118920 belong&0377777777 042400413 a.out NetBSD/sparc demand paged 11893>0 byte &0x80 11894>>20 belong <8192 shared library 11895>>20 belong =8192 dynamically linked executable 11896>>20 belong >8192 dynamically linked executable 11897>0 byte ^0x80 executable 11898>16 belong >0 not stripped 118990 belong&0377777777 042400410 a.out NetBSD/sparc pure 11900>0 byte &0x80 dynamically linked executable 11901>0 byte ^0x80 executable 11902>16 belong >0 not stripped 119030 belong&0377777777 042400407 a.out NetBSD/sparc 11904>0 byte &0x80 dynamically linked executable 11905>0 byte ^0x80 11906>>0 byte &0x40 position independent 11907>>20 belong !0 executable 11908>>20 belong =0 object file 11909>16 belong >0 not stripped 119100 belong&0377777777 042400507 a.out NetBSD/sparc core 11911>12 string >\0 from '%s' 11912>32 belong !0 (signal %d) 11913 119140 belong&0377777777 042600413 a.out NetBSD/pmax demand paged 11915>0 byte &0x80 11916>>20 lelong <4096 shared library 11917>>20 lelong =4096 dynamically linked executable 11918>>20 lelong >4096 dynamically linked executable 11919>0 byte ^0x80 executable 11920>16 lelong >0 not stripped 119210 belong&0377777777 042600410 a.out NetBSD/pmax pure 11922>0 byte &0x80 dynamically linked executable 11923>0 byte ^0x80 executable 11924>16 lelong >0 not stripped 119250 belong&0377777777 042600407 a.out NetBSD/pmax 11926>0 byte &0x80 dynamically linked executable 11927>0 byte ^0x80 11928>>0 byte &0x40 position independent 11929>>20 lelong !0 executable 11930>>20 lelong =0 object file 11931>16 lelong >0 not stripped 119320 belong&0377777777 042600507 a.out NetBSD/pmax core 11933>12 string >\0 from '%s' 11934>32 lelong !0 (signal %d) 11935 119360 belong&0377777777 043000413 a.out NetBSD/vax 1k demand paged 11937>0 byte &0x80 11938>>20 lelong <4096 shared library 11939>>20 lelong =4096 dynamically linked executable 11940>>20 lelong >4096 dynamically linked executable 11941>0 byte ^0x80 executable 11942>16 lelong >0 not stripped 119430 belong&0377777777 043000410 a.out NetBSD/vax 1k pure 11944>0 byte &0x80 dynamically linked executable 11945>0 byte ^0x80 executable 11946>16 lelong >0 not stripped 119470 belong&0377777777 043000407 a.out NetBSD/vax 1k 11948>0 byte &0x80 dynamically linked executable 11949>0 byte ^0x80 11950>>0 byte &0x40 position independent 11951>>20 lelong !0 executable 11952>>20 lelong =0 object file 11953>16 lelong >0 not stripped 119540 belong&0377777777 043000507 a.out NetBSD/vax 1k core 11955>12 string >\0 from '%s' 11956>32 lelong !0 (signal %d) 11957 119580 belong&0377777777 045400413 a.out NetBSD/vax 4k demand paged 11959>0 byte &0x80 11960>>20 lelong <4096 shared library 11961>>20 lelong =4096 dynamically linked executable 11962>>20 lelong >4096 dynamically linked executable 11963>0 byte ^0x80 executable 11964>16 lelong >0 not stripped 119650 belong&0377777777 045400410 a.out NetBSD/vax 4k pure 11966>0 byte &0x80 dynamically linked executable 11967>0 byte ^0x80 executable 11968>16 lelong >0 not stripped 119690 belong&0377777777 045400407 a.out NetBSD/vax 4k 11970>0 byte &0x80 dynamically linked executable 11971>0 byte ^0x80 11972>>0 byte &0x40 position independent 11973>>20 lelong !0 executable 11974>>20 lelong =0 object file 11975>16 lelong >0 not stripped 119760 belong&0377777777 045400507 a.out NetBSD/vax 4k core 11977>12 string >\0 from '%s' 11978>32 lelong !0 (signal %d) 11979 11980# NetBSD/alpha does not support (and has never supported) a.out objects, 11981# so no rules are provided for them. NetBSD/alpha ELF objects are 11982# dealt with in "elf". 119830 lelong 0x00070185 ECOFF NetBSD/alpha binary 11984>10 leshort 0x0001 not stripped 11985>10 leshort 0x0000 stripped 119860 belong&0377777777 043200507 a.out NetBSD/alpha core 11987>12 string >\0 from '%s' 11988>32 lelong !0 (signal %d) 11989 119900 belong&0377777777 043400413 a.out NetBSD/mips demand paged 11991>0 byte &0x80 11992>>20 belong <8192 shared library 11993>>20 belong =8192 dynamically linked executable 11994>>20 belong >8192 dynamically linked executable 11995>0 byte ^0x80 executable 11996>16 belong >0 not stripped 119970 belong&0377777777 043400410 a.out NetBSD/mips pure 11998>0 byte &0x80 dynamically linked executable 11999>0 byte ^0x80 executable 12000>16 belong >0 not stripped 120010 belong&0377777777 043400407 a.out NetBSD/mips 12002>0 byte &0x80 dynamically linked executable 12003>0 byte ^0x80 12004>>0 byte &0x40 position independent 12005>>20 belong !0 executable 12006>>20 belong =0 object file 12007>16 belong >0 not stripped 120080 belong&0377777777 043400507 a.out NetBSD/mips core 12009>12 string >\0 from '%s' 12010>32 belong !0 (signal %d) 12011 120120 belong&0377777777 043600413 a.out NetBSD/arm32 demand paged 12013>0 byte &0x80 12014>>20 lelong <4096 shared library 12015>>20 lelong =4096 dynamically linked executable 12016>>20 lelong >4096 dynamically linked executable 12017>0 byte ^0x80 executable 12018>16 lelong >0 not stripped 120190 belong&0377777777 043600410 a.out NetBSD/arm32 pure 12020>0 byte &0x80 dynamically linked executable 12021>0 byte ^0x80 executable 12022>16 lelong >0 not stripped 120230 belong&0377777777 043600407 a.out NetBSD/arm32 12024>0 byte &0x80 dynamically linked executable 12025>0 byte ^0x80 12026>>0 byte &0x40 position independent 12027>>20 lelong !0 executable 12028>>20 lelong =0 object file 12029>16 lelong >0 not stripped 12030# NetBSD/arm26 has always used ELF objects, but it shares a core file 12031# format with NetBSD/arm32. 120320 belong&0377777777 043600507 a.out NetBSD/arm core 12033>12 string >\0 from '%s' 12034>32 lelong !0 (signal %d) 12035 12036#------------------------------------------------------------------------------ 12037# $File: netscape,v 1.6 2009/09/19 16:28:11 christos Exp $ 12038# netscape: file(1) magic for Netscape files 12039# "H. Nanosecond" <aldomel@ix.netcom.com> 12040# version 3 and 4 I think 12041# 12042 12043# Netscape Address book .nab 120440 string \000\017\102\104\000\000\000\000\000\000\001\000\000\000\000\002\000\000\000\002\000\000\004\000 Netscape Address book 12045 12046# Netscape Communicator address book 120470 string \000\017\102\111 Netscape Communicator address book 12048 12049# .snm Caches 120500 string #\ Netscape\ folder\ cache Netscape folder cache 120510 string \000\036\204\220\000 Netscape folder cache 12052# .n2p 12053# Net 2 Phone 12054#0 string 123\130\071\066\061\071\071\071\060\070\061\060\061\063\060 120550 string SX961999 Net2phone 12056 12057# 12058#This is files ending in .art, FIXME add more rules 120590 string JG\004\016\0\0\0\0 ART 12060 12061#------------------------------------------------------------------------------ 12062# $File: netware,v 1.4 2009/09/19 16:28:11 christos Exp $ 12063# netware: file(1) magic for NetWare Loadable Modules (NLMs) 12064# From: Mads Martin Joergensen <mmj@suse.de> 12065 120660 string NetWare\ Loadable\ Module NetWare Loadable Module 12067 12068#------------------------------------------------------------------------------ 12069# $File: news,v 1.6 2009/09/19 16:28:11 christos Exp $ 12070# news: file(1) magic for SunOS NeWS fonts (not "news" as in "netnews") 12071# 120720 string StartFontMetrics ASCII font metrics 120730 string StartFont ASCII font bits 120740 belong 0x137A2944 NeWS bitmap font 120750 belong 0x137A2947 NeWS font family 120760 belong 0x137A2950 scalable OpenFont binary 120770 belong 0x137A2951 encrypted scalable OpenFont binary 120788 belong 0x137A2B45 X11/NeWS bitmap font 120798 belong 0x137A2B48 X11/NeWS font family 12080 12081#------------------------------------------------------------------------------ 12082# $File: nitpicker,v 1.4 2009/09/19 16:28:11 christos Exp $ 12083# nitpicker: file(1) magic for Flowfiles. 12084# From: Christian Jachmann <C.Jachmann@gmx.net> http://www.nitpicker.de 120850 string NPFF NItpicker Flow File 12086>4 byte x V%d. 12087>5 byte x %d 12088>6 bedate x started: %s 12089>10 bedate x stopped: %s 12090>14 belong x Bytes: %u 12091>18 belong x Bytes1: %u 12092>22 belong x Flows: %u 12093>26 belong x Pkts: %u 12094 12095#------------------------------------------------------------------------------ 12096# $File: ocaml,v 1.4 2009/09/19 16:28:11 christos Exp $ 12097# ocaml: file(1) magic for Objective Caml files. 120980 string Caml1999 OCaml 12099>8 string X exec file 12100>8 string I interface file (.cmi) 12101>8 string O object file (.cmo) 12102>8 string A library file (.cma) 12103>8 string Y native object file (.cmx) 12104>8 string Z native library file (.cmxa) 12105>8 string M abstract syntax tree implementation file 12106>8 string N abstract syntax tree interface file 12107>9 string >\0 (Version %3.3s) 12108 12109#------------------------------------------------------------------------------ 12110# $File: octave,v 1.4 2009/09/19 16:28:11 christos Exp $ 12111# octave binary data file(1) magic, from Dirk Eddelbuettel <edd@debian.org> 121120 string Octave-1-L Octave binary data (little endian) 121130 string Octave-1-B Octave binary data (big endian) 12114 12115#------------------------------------------------------------------------------ 12116# $File: ole2compounddocs,v 1.4 2009/09/19 16:28:11 christos Exp $ 12117# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured 12118# storage (http://en.wikipedia.org/wiki/Structured_Storage) 12119# Additional tests for OLE 2 Compound Documents should be under this recipe. 12120 121210 string \320\317\021\340\241\261\032\341 OLE 2 Compound Document 12122# - Microstation V8 DGN files (www.bentley.com) 12123# Last update on 10/23/2006 by Lester Hightower 12124> 0x480 string D\000g\000n\000~\000H : Microstation V8 DGN 12125# - Visio documents 12126# Last update on 10/23/2006 by Lester Hightower 12127> 0x480 string V\000i\000s\000i\000o\000D\000o\000c : Visio Document 12128 12129#------------------------------------------------------------------------------ 12130# $File: olf,v 1.4 2009/09/19 16:28:11 christos Exp $ 12131# olf: file(1) magic for OLF executables 12132# 12133# We have to check the byte order flag to see what byte order all the 12134# other stuff in the header is in. 12135# 12136# MIPS R3000 may also be for MIPS R2000. 12137# What're the correct byte orders for the nCUBE and the Fujitsu VPP500? 12138# 12139# Created by Erik Theisen <etheisen@openbsd.org> 12140# Based on elf from Daniel Quinlan <quinlan@yggdrasil.com> 121410 string \177OLF OLF 12142>4 byte 0 invalid class 12143>4 byte 1 32-bit 12144>4 byte 2 64-bit 12145>7 byte 0 invalid os 12146>7 byte 1 OpenBSD 12147>7 byte 2 NetBSD 12148>7 byte 3 FreeBSD 12149>7 byte 4 4.4BSD 12150>7 byte 5 Linux 12151>7 byte 6 SVR4 12152>7 byte 7 esix 12153>7 byte 8 Solaris 12154>7 byte 9 Irix 12155>7 byte 10 SCO 12156>7 byte 11 Dell 12157>7 byte 12 NCR 12158>5 byte 0 invalid byte order 12159>5 byte 1 LSB 12160>>16 leshort 0 no file type, 12161>>16 leshort 1 relocatable, 12162>>16 leshort 2 executable, 12163>>16 leshort 3 shared object, 12164# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de> 12165# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> 12166>>16 leshort 4 core file 12167>>>(0x38+0xcc) string >\0 of '%s' 12168>>>(0x38+0x10) lelong >0 (signal %d), 12169>>16 leshort &0xff00 processor-specific, 12170>>18 leshort 0 no machine, 12171>>18 leshort 1 AT&T WE32100 - invalid byte order, 12172>>18 leshort 2 SPARC - invalid byte order, 12173>>18 leshort 3 Intel 80386, 12174>>18 leshort 4 Motorola 68000 - invalid byte order, 12175>>18 leshort 5 Motorola 88000 - invalid byte order, 12176>>18 leshort 6 Intel 80486, 12177>>18 leshort 7 Intel 80860, 12178>>18 leshort 8 MIPS R3000_BE - invalid byte order, 12179>>18 leshort 9 Amdahl - invalid byte order, 12180>>18 leshort 10 MIPS R3000_LE, 12181>>18 leshort 11 RS6000 - invalid byte order, 12182>>18 leshort 15 PA-RISC - invalid byte order, 12183>>18 leshort 16 nCUBE, 12184>>18 leshort 17 VPP500, 12185>>18 leshort 18 SPARC32PLUS, 12186>>18 leshort 20 PowerPC, 12187>>18 leshort 0x9026 Alpha, 12188>>20 lelong 0 invalid version 12189>>20 lelong 1 version 1 12190>>36 lelong 1 MathCoPro/FPU/MAU Required 12191>8 string >\0 (%s) 12192>5 byte 2 MSB 12193>>16 beshort 0 no file type, 12194>>16 beshort 1 relocatable, 12195>>16 beshort 2 executable, 12196>>16 beshort 3 shared object, 12197>>16 beshort 4 core file, 12198>>>(0x38+0xcc) string >\0 of '%s' 12199>>>(0x38+0x10) belong >0 (signal %d), 12200>>16 beshort &0xff00 processor-specific, 12201>>18 beshort 0 no machine, 12202>>18 beshort 1 AT&T WE32100, 12203>>18 beshort 2 SPARC, 12204>>18 beshort 3 Intel 80386 - invalid byte order, 12205>>18 beshort 4 Motorola 68000, 12206>>18 beshort 5 Motorola 88000, 12207>>18 beshort 6 Intel 80486 - invalid byte order, 12208>>18 beshort 7 Intel 80860, 12209>>18 beshort 8 MIPS R3000_BE, 12210>>18 beshort 9 Amdahl, 12211>>18 beshort 10 MIPS R3000_LE - invalid byte order, 12212>>18 beshort 11 RS6000, 12213>>18 beshort 15 PA-RISC, 12214>>18 beshort 16 nCUBE, 12215>>18 beshort 17 VPP500, 12216>>18 beshort 18 SPARC32PLUS, 12217>>18 beshort 20 PowerPC or cisco 4500, 12218>>18 beshort 21 cisco 7500, 12219>>18 beshort 24 cisco SVIP, 12220>>18 beshort 25 cisco 7200, 12221>>18 beshort 36 cisco 12000, 12222>>18 beshort 0x9026 Alpha, 12223>>20 belong 0 invalid version 12224>>20 belong 1 version 1 12225>>36 belong 1 MathCoPro/FPU/MAU Required 12226 12227#------------------------------------------------------------------------------ 12228# $File: os2,v 1.7 2009/09/19 16:28:11 christos Exp $ 12229# os2: file(1) magic for OS/2 files 12230# 12231 12232# Provided 1998/08/22 by 12233# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net> 122341 search/1 InternetShortcut MS Windows 95 Internet shortcut text 12235>24 search/1 >\ (URL=<%s>) 12236 12237# OS/2 URL objects 12238# Provided 1998/08/22 by 12239# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net> 12240#0 string http: OS/2 URL object text 12241#>5 string >\ (WWW) <http:%s> 12242#0 string mailto: OS/2 URL object text 12243#>7 string >\ (email) <%s> 12244#0 string news: OS/2 URL object text 12245#>5 string >\ (Usenet) <%s> 12246#0 string ftp: OS/2 URL object text 12247#>4 string >\ (FTP) <ftp:%s> 12248#0 string file: OS/2 URL object text 12249#>5 string >\ (Local file) <%s> 12250 12251# >>>>> OS/2 INF/HLP <<<<< (source: Daniel Dissett ddissett@netcom.com) 12252# Carl Hauser (chauser.parc@xerox.com) and 12253# Marcus Groeber (marcusg@ph-cip.uni-koeln.de) 12254# list the following header format in inf02a.doc: 12255# 12256# int16 ID; // ID magic word (5348h = "HS") 12257# int8 unknown1; // unknown purpose, could be third letter of ID 12258# int8 flags; // probably a flag word... 12259# // bit 0: set if INF style file 12260# // bit 4: set if HLP style file 12261# // patching this byte allows reading HLP files 12262# // using the VIEW command, while help files 12263# // seem to work with INF settings here as well. 12264# int16 hdrsize; // total size of header 12265# int16 unknown2; // unknown purpose 12266# 122670 string HSP\x01\x9b\x00 OS/2 INF 12268>107 string >0 (%s) 122690 string HSP\x10\x9b\x00 OS/2 HLP 12270>107 string >0 (%s) 12271 12272# OS/2 INI (this is a guess) 122730 string \xff\xff\xff\xff\x14\0\0\0 OS/2 INI 12274 12275#------------------------------------------------------------------------------ 12276# $File: os400,v 1.5 2009/09/19 16:28:11 christos Exp $ 12277# os400: file(1) magic for IBM OS/400 files 12278# 12279# IBM OS/400 (i5/OS) Save file (SAVF) - gerardo.cacciari@gmail.com 12280# In spite of its quite variable format (due to internal memory page 12281# length differences between CISC and RISC versions of the OS) the 12282# SAVF structure hasn't suitable offsets to identify the catalog 12283# header in the first descriptor where there are some useful infos, 12284# so we must search in a somewhat large area for a particular string 12285# that represents the EBCDIC encoding of 'QSRDSSPC' (save/restore 12286# descriptor space) preceded by a two byte constant. 12287# 122881090 search/7393 \x19\xDB\xD8\xE2\xD9\xC4\xE2\xE2\xD7\xC3 IBM OS/400 save file data 12289>&212 byte 0x01 \b, created with SAVOBJ 12290>&212 byte 0x02 \b, created with SAVLIB 12291>&212 byte 0x07 \b, created with SAVCFG 12292>&212 byte 0x08 \b, created with SAVSECDTA 12293>&212 byte 0x0A \b, created with SAVSECDTA 12294>&212 byte 0x0B \b, created with SAVDLO 12295>&212 byte 0x0D \b, created with SAVLICPGM 12296>&212 byte 0x11 \b, created with SAVCHGOBJ 12297>&213 byte 0x44 \b, at least V5R4 to open 12298>&213 byte 0x43 \b, at least V5R3 to open 12299>&213 byte 0x42 \b, at least V5R2 to open 12300>&213 byte 0x41 \b, at least V5R1 to open 12301>&213 byte 0x40 \b, at least V4R5 to open 12302>&213 byte 0x3F \b, at least V4R4 to open 12303>&213 byte 0x3E \b, at least V4R3 to open 12304>&213 byte 0x3C \b, at least V4R2 to open 12305>&213 byte 0x3D \b, at least V4R1M4 to open 12306>&213 byte 0x3B \b, at least V4R1 to open 12307>&213 byte 0x3A \b, at least V3R7 to open 12308>&213 byte 0x35 \b, at least V3R6 to open 12309>&213 byte 0x36 \b, at least V3R2 to open 12310>&213 byte 0x34 \b, at least V3R1 to open 12311>&213 byte 0x31 \b, at least V3R0M5 to open 12312>&213 byte 0x30 \b, at least V2R3 to open 12313 12314#------------------------------------------------------------------------------ 12315# $File: os9,v 1.6 2009/09/19 16:28:11 christos Exp $ 12316# 12317# Copyright (c) 1996 Ignatios Souvatzis. All rights reserved. 12318# 12319# Redistribution and use in source and binary forms, with or without 12320# modification, are permitted provided that the following conditions 12321# are met: 12322# 1. Redistributions of source code must retain the above copyright 12323# notice, this list of conditions and the following disclaimer. 12324# 2. Redistributions in binary form must reproduce the above copyright 12325# notice, this list of conditions and the following disclaimer in the 12326# documentation and/or other materials provided with the distribution. 12327# 3. All advertising materials mentioning features or use of this software 12328# must display the following acknowledgement: 12329# This product includes software developed by Ignatios Souvatzis for 12330# the NetBSD project. 12331# 4. The name of the author may not be used to endorse or promote products 12332# derived from this software without specific prior written permission. 12333# 12334# 12335# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 12336# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 12337# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 12338# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 12339# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, 12340# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; 12341# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, 12342# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR 12343# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF 12344# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 12345# 12346# 12347# 12348# OS9/6809 module descriptions: 12349# 123500 beshort 0x87CD OS9/6809 module: 12351# 12352>6 byte&0x0f 0x00 non-executable 12353>6 byte&0x0f 0x01 machine language 12354>6 byte&0x0f 0x02 BASIC I-code 12355>6 byte&0x0f 0x03 Pascal P-code 12356>6 byte&0x0f 0x04 C I-code 12357>6 byte&0x0f 0x05 COBOL I-code 12358>6 byte&0x0f 0x06 Fortran I-code 12359# 12360>6 byte&0xf0 0x10 program executable 12361>6 byte&0xf0 0x20 subroutine 12362>6 byte&0xf0 0x30 multi-module 12363>6 byte&0xf0 0x40 data module 12364# 12365>6 byte&0xf0 0xC0 system module 12366>6 byte&0xf0 0xD0 file manager 12367>6 byte&0xf0 0xE0 device driver 12368>6 byte&0xf0 0xF0 device descriptor 12369# 12370# OS9/m68k stuff (to be continued) 12371# 123720 beshort 0x4AFC OS9/68K module: 12373# 12374# attr 12375>0x14 byte&0x80 0x80 re-entrant 12376>0x14 byte&0x40 0x40 ghost 12377>0x14 byte&0x20 0x20 system-state 12378# 12379# lang: 12380# 12381>0x13 byte 1 machine language 12382>0x13 byte 2 BASIC I-code 12383>0x13 byte 3 Pascal P-code 12384>0x13 byte 4 C I-code 12385>0x13 byte 5 COBOL I-code 12386>0x13 byte 6 Fortran I-code 12387# 12388# 12389# type: 12390# 12391>0x12 byte 1 program executable 12392>0x12 byte 2 subroutine 12393>0x12 byte 3 multi-module 12394>0x12 byte 4 data module 12395>0x12 byte 11 trap library 12396>0x12 byte 12 system module 12397>0x12 byte 13 file manager 12398>0x12 byte 14 device driver 12399>0x12 byte 15 device descriptor 12400 12401#------------------------------------------------------------------------------ 12402# $File: osf1,v 1.7 2009/09/19 16:28:11 christos Exp $ 12403# 12404# Mach magic number info 12405# 124060 long 0xefbe OSF/Rose object 12407# I386 magic number info 12408# 124090 short 0565 i386 COFF object 12410 12411#------------------------------------------------------------------------------ 12412# $File: palm,v 1.7 2009/09/19 16:28:11 christos Exp $ 12413# palm: file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks 12414# 12415# Brian Lalor <blalor@hcirisc.cs.binghamton.edu> 12416 12417# appl 1241860 belong 0x6170706c PalmOS application 12419>0 string >\0 "%s" 12420# TEXt 1242160 belong 0x54455874 AportisDoc file 12422>0 string >\0 "%s" 12423# HACK 1242460 belong 0x4841434b HackMaster hack 12425>0 string >\0 "%s" 12426 12427# Variety of PalmOS document types 12428# Michael-John Turner <mj@debian.org> 12429# Thanks to Hasan Umit Ezerce <humit@tr-net.net.tr> for his DocType 1243060 string BVokBDIC BDicty PalmOS document 12431>0 string >\0 "%s" 1243260 string DB99DBOS DB PalmOS document 12433>0 string >\0 "%s" 1243460 string vIMGView FireViewer/ImageViewer PalmOS document 12435>0 string >\0 "%s" 1243660 string PmDBPmDB HanDBase PalmOS document 12437>0 string >\0 "%s" 1243860 string InfoINDB InfoView PalmOS document 12439>0 string >\0 "%s" 1244060 string ToGoToGo iSilo PalmOS document 12441>0 string >\0 "%s" 1244260 string JfDbJBas JFile PalmOS document 12443>0 string >\0 "%s" 1244460 string JfDbJFil JFile Pro PalmOS document 12445>0 string >\0 "%s" 1244660 string DATALSdb List PalmOS document 12447>0 string >\0 "%s" 1244860 string Mdb1Mdb1 MobileDB PalmOS document 12449>0 string >\0 "%s" 1245060 string PNRdPPrs PeanutPress PalmOS document 12451>0 string >\0 "%s" 1245260 string DataPlkr Plucker PalmOS document 12453>0 string >\0 "%s" 1245460 string DataSprd QuickSheet PalmOS document 12455>0 string >\0 "%s" 1245660 string SM01SMem SuperMemo PalmOS document 12457>0 string >\0 "%s" 1245860 string TEXtTlDc TealDoc PalmOS document 12459>0 string >\0 "%s" 1246060 string InfoTlIf TealInfo PalmOS document 12461>0 string >\0 "%s" 1246260 string DataTlMl TealMeal PalmOS document 12463>0 string >\0 "%s" 1246460 string DataTlPt TealPaint PalmOS document 12465>0 string >\0 "%s" 1246660 string dataTDBP ThinkDB PalmOS document 12467>0 string >\0 "%s" 1246860 string TdatTide Tides PalmOS document 12469>0 string >\0 "%s" 1247060 string ToRaTRPW TomeRaider PalmOS document 12471>0 string >\0 "%s" 12472 12473# A GutenPalm zTXT etext for use on Palm Pilots (http://gutenpalm.sf.net) 12474# For version 1.xx zTXTs, outputs version and numbers of bookmarks and 12475# annotations. 12476# For other versions, just outputs version. 12477# 1247860 string zTXT A GutenPalm zTXT e-book 12479>0 string >\0 "%s" 12480>(0x4E.L) byte 0 12481>>(0x4E.L+1) byte x (v0.%02d) 12482>(0x4E.L) byte 1 12483>>(0x4E.L+1) byte x (v1.%02d) 12484>>>(0x4E.L+10) beshort >0 12485>>>>(0x4E.L+10) beshort <2 - 1 bookmark 12486>>>>(0x4E.L+10) beshort >1 - %d bookmarks 12487>>>(0x4E.L+14) beshort >0 12488>>>>(0x4E.L+14) beshort <2 - 1 annotation 12489>>>>(0x4E.L+14) beshort >1 - %d annotations 12490>(0x4E.L) byte >1 (v%d. 12491>>(0x4E.L+1) byte x %02d) 12492 12493# Palm OS .prc file types 1249460 string libr Palm OS dynamic library data 12495>0 string >\0 "%s" 1249660 string ptch Palm OS operating system patch data 12497>0 string >\0 "%s" 12498 12499# Mobipocket (www.mobipocket.com), donated by Carl Witty 1250060 string BOOKMOBI Mobipocket E-book 12501>0 string >\0 "%s" 12502 12503#------------------------------------------------------------------------------ 12504# $File: parix,v 1.4 2009/09/19 16:28:11 christos Exp $ 12505# 12506# Parix COFF executables 12507# From: Ignatios Souvatzis <ignatios@cs.uni-bonn.de> 12508# 125090 beshort&0xfff 0xACE PARIX 12510>0 byte&0xf0 0x80 T800 12511>0 byte&0xf0 0x90 T9000 12512>19 byte&0x02 0x02 executable 12513>19 byte&0x02 0x00 object 12514>19 byte&0x0c 0x00 not stripped 12515 12516#------------------------------------------------------------------------------ 12517# $File: pbm,v 1.6 2009/09/19 16:28:11 christos Exp $ 12518# pbm: file(1) magic for Portable Bitmap files 12519# 12520# XXX - byte order? 12521# 125220 short 0x2a17 "compact bitmap" format (Poskanzer) 12523 12524#------------------------------------------------------------------------------ 12525# $File: pdf,v 1.6 2009/09/19 16:28:11 christos Exp $ 12526# pdf: file(1) magic for Portable Document Format 12527# 12528 125290 string %PDF- PDF document 12530!:mime application/pdf 12531>5 byte x \b, version %c 12532>7 byte x \b.%c 12533 12534# From: Nick Schmalenberger <nick@schmalenberger.us> 12535# Forms Data Format 125360 string %FDF- FDF document 12537>5 byte x \b, version %c 12538>7 byte x \b.%c 12539 12540#------------------------------------------------------------------------------ 12541# $File: pdp,v 1.8 2009/09/19 16:28:11 christos Exp $ 12542# pdp: file(1) magic for PDP-11 executable/object and APL workspace 12543# 125440 lelong 0101555 PDP-11 single precision APL workspace 125450 lelong 0101554 PDP-11 double precision APL workspace 12546# 12547# PDP-11 a.out 12548# 125490 leshort 0407 PDP-11 executable 12550>8 leshort >0 not stripped 12551>15 byte >0 - version %ld 12552 125530 leshort 0401 PDP-11 UNIX/RT ldp 125540 leshort 0405 PDP-11 old overlay 12555 125560 leshort 0410 PDP-11 pure executable 12557>8 leshort >0 not stripped 12558>15 byte >0 - version %ld 12559 125600 leshort 0411 PDP-11 separate I&D executable 12561>8 leshort >0 not stripped 12562>15 byte >0 - version %ld 12563 125640 leshort 0437 PDP-11 kernel overlay 12565 12566# These last three are derived from 2.11BSD file(1) 125670 leshort 0413 PDP-11 demand-paged pure executable 12568>8 leshort >0 not stripped 12569 125700 leshort 0430 PDP-11 overlaid pure executable 12571>8 leshort >0 not stripped 12572 125730 leshort 0431 PDP-11 overlaid separate executable 12574>8 leshort >0 not stripped 12575 12576#------------------------------------------------------------------------------ 12577# $File: perl,v 1.16 2009/09/19 16:28:11 christos Exp $ 12578# perl: file(1) magic for Larry Wall's perl language. 12579# 12580# The `eval' lines recognizes an outrageously clever hack. 12581# Keith Waclena <keith@cerberus.uchicago.edu> 12582# Send additions to <perl5-porters@perl.org> 125830 search/1/w #!\ /bin/perl Perl script text executable 12584!:mime text/x-perl 125850 search/1 eval\ "exec\ /bin/perl Perl script text 12586!:mime text/x-perl 125870 search/1/w #!\ /usr/bin/perl Perl script text executable 12588!:mime text/x-perl 125890 search/1 eval\ "exec\ /usr/bin/perl Perl script text 12590!:mime text/x-perl 125910 search/1/w #!\ /usr/local/bin/perl Perl script text executable 12592!:mime text/x-perl 125930 search/1 eval\ "exec\ /usr/local/bin/perl Perl script text 12594!:mime text/x-perl 125950 search/1 eval\ '(exit\ $?0)'\ &&\ eval\ 'exec Perl script text 12596!:mime text/x-perl 12597 12598 12599# by Dmitry V. Levin and Alexey Tourbin 12600# check the first line 126010 search/1 package 12602>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; Perl5 module source text 12603# not 'p', check other lines 126040 search/1 !p 12605>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; 12606>>0 regex \^1\ *;|\^(use|sub|my)\ .*[(;{=] Perl5 module source text 12607 12608 12609 12610# Perl POD documents 12611# From: Tom Hukins <tom@eborcom.com> 126120 search/1/W \=pod\n Perl POD document text 126130 search/1/W \n\=pod\n Perl POD document text 126140 search/1/W \=head1\ Perl POD document text 126150 search/1/W \n\=head1\ Perl POD document text 126160 search/1/W \=head2\ Perl POD document text 126170 search/1/W \n\=head2\ Perl POD document text 12618 12619# Perl Storable data files. 126200 string perl-store perl Storable (v0.6) data 12621>4 byte >0 (net-order %d) 12622>>4 byte &01 (network-ordered) 12623>>4 byte =3 (major 1) 12624>>4 byte =2 (major 1) 12625 126260 string pst0 perl Storable (v0.7) data 12627>4 byte >0 12628>>4 byte &01 (network-ordered) 12629>>4 byte =5 (major 2) 12630>>4 byte =4 (major 2) 12631>>5 byte >0 (minor %d) 12632 12633#------------------------------------------------------------------------------ 12634# $File: pgp,v 1.9 2009/09/19 16:28:11 christos Exp $ 12635# pgp: file(1) magic for Pretty Good Privacy 12636# see http://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html 12637# 126380 beshort 0x9900 PGP key public ring 12639!:mime application/x-pgp-keyring 126400 beshort 0x9501 PGP key security ring 12641!:mime application/x-pgp-keyring 126420 beshort 0x9500 PGP key security ring 12643!:mime application/x-pgp-keyring 126440 beshort 0xa600 PGP encrypted data 12645#!:mime application/pgp-encrypted 12646#0 string -----BEGIN\040PGP text/PGP armored data 12647!:mime text/PGP # encoding: armored data 12648#>15 string PUBLIC\040KEY\040BLOCK- public key block 12649#>15 string MESSAGE- message 12650#>15 string SIGNED\040MESSAGE- signed message 12651#>15 string PGP\040SIGNATURE- signature 12652 126532 string ---BEGIN\ PGP\ PUBLIC\ KEY\ BLOCK- PGP public key block 12654!:mime application/pgp-keys 126550 string -----BEGIN\040PGP\40MESSAGE- PGP message 12656!:mime application/pgp 126570 string -----BEGIN\040PGP\40SIGNATURE- PGP signature 12658!:mime application/pgp-signature 12659 12660#------------------------------------------------------------------------------ 12661# $File: pkgadd,v 1.6 2009/09/19 16:28:11 christos Exp $ 12662# pkgadd: file(1) magic for SysV R4 PKG Datastreams 12663# 126640 string #\ PaCkAgE\ DaTaStReAm pkg Datastream (SVR4) 12665!:mime application/x-svr4-package 12666 12667#------------------------------------------------------------------------------ 12668# $File: plan9,v 1.5 2009/09/19 16:28:11 christos Exp $ 12669# plan9: file(1) magic for AT&T Bell Labs' Plan 9 executables 12670# From: "Stefan A. Haubenthal" <polluks@web.de> 12671# 126720 belong 0x00000107 Plan 9 executable, Motorola 68k 126730 belong 0x000001EB Plan 9 executable, Intel 386 126740 belong 0x00000247 Plan 9 executable, Intel 960 126750 belong 0x000002AB Plan 9 executable, SPARC 126760 belong 0x00000407 Plan 9 executable, MIPS R3000 126770 belong 0x0000048B Plan 9 executable, AT&T DSP 3210 126780 belong 0x00000517 Plan 9 executable, MIPS R4000 BE 126790 belong 0x000005AB Plan 9 executable, AMD 29000 126800 belong 0x00000647 Plan 9 executable, ARM 7-something 126810 belong 0x000006EB Plan 9 executable, PowerPC 126820 belong 0x00000797 Plan 9 executable, MIPS R4000 LE 126830 belong 0x0000084B Plan 9 executable, DEC Alpha 12684 12685#------------------------------------------------------------------------------ 12686# $File: plus5,v 1.6 2009/09/19 16:28:11 christos Exp $ 12687# plus5: file(1) magic for Plus Five's UNIX MUMPS 12688# 12689# XXX - byte order? Paging Hokey.... 12690# 126910 short 0x259 mumps avl global 12692>2 byte >0 (V%d) 12693>6 byte >0 with %d byte name 12694>7 byte >0 and %d byte data cells 126950 short 0x25a mumps blt global 12696>2 byte >0 (V%d) 12697>8 short >0 - %d byte blocks 12698>15 byte 0x00 - P/D format 12699>15 byte 0x01 - P/K/D format 12700>15 byte 0x02 - K/D format 12701>15 byte >0x02 - Bad Flags 12702 12703#------------------------------------------------------------------------------ 12704# $File: printer,v 1.22 2009/09/19 16:28:11 christos Exp $ 12705# printer: file(1) magic for printer-formatted files 12706# 12707 12708# PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com) 127090 string %! PostScript document text 12710!:mime application/postscript 12711!:apple ASPSTEXT 12712>2 string PS-Adobe- conforming 12713>>11 string >\0 DSC level %.3s 12714>>>15 string EPS \b, type %s 12715>>>15 string Query \b, type %s 12716>>>15 string ExitServer \b, type %s 12717>>>15 search/1000 %%LanguageLevel:\ 12718>>>>&0 string >\0 \b, Level %s 12719# Some PCs have the annoying habit of adding a ^D as a document separator 127200 string \004%! PostScript document text 12721!:mime application/postscript 12722!:apple ASPSTEXT 12723>3 string PS-Adobe- conforming 12724>>12 string >\0 DSC level %.3s 12725>>>16 string EPS \b, type %s 12726>>>16 string Query \b, type %s 12727>>>16 string ExitServer \b, type %s 12728>>>16 search/1000 %%LanguageLevel:\ 12729>>>>&0 string >\0 \b, Level %s 127300 string \033%-12345X%!PS PostScript document 12731 12732# DOS EPS Binary File Header 12733# From: Ed Sznyter <ews@Black.Market.NET> 127340 belong 0xC5D0D3C6 DOS EPS Binary File 12735>4 long >0 Postscript starts at byte %d 12736>>8 long >0 length %d 12737>>>12 long >0 Metafile starts at byte %d 12738>>>>16 long >0 length %d 12739>>>20 long >0 TIFF starts at byte %d 12740>>>>24 long >0 length %d 12741 12742# Summary: Adobe's PostScript Printer Description File 12743# Extension: .ppd 12744# Reference: http://partners.adobe.com/public/developer/en/ps/5003.PPD_Spec_v4.3.pdf, Section 3.8 12745# Submitted by: Yves Arrouye <arrouye@marin.fdn.fr> 12746# 127470 string *PPD-Adobe:\x20 PPD file 12748>&0 string x \b, version %s 12749 12750# HP Printer Job Language 127510 string \033%-12345X@PJL HP Printer Job Language data 12752# HP Printer Job Language 12753# The header found on Win95 HP plot files is the "Silliest Thing possible" 12754# (TM) 12755# Every driver puts the language at some random position, with random case 12756# (LANGUAGE and Language) 12757# For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10 12758# From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de> 12759# 127600 string \033%-12345X@PJL HP Printer Job Language data 12761>&0 string >\0 %s 12762>>&0 string >\0 %s 12763>>>&0 string >\0 %s 12764>>>>&0 string >\0 %s 12765#>15 string \ ENTER\ LANGUAGE\ = 12766#>31 string PostScript PostScript 12767 12768# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com) 127690 string \033E\033 HP PCL printer data 12770>3 string \&l0A - default page size 12771>3 string \&l1A - US executive page size 12772>3 string \&l2A - US letter page size 12773>3 string \&l3A - US legal page size 12774>3 string \&l26A - A4 page size 12775>3 string \&l80A - Monarch envelope size 12776>3 string \&l81A - No. 10 envelope size 12777>3 string \&l90A - Intl. DL envelope size 12778>3 string \&l91A - Intl. C5 envelope size 12779>3 string \&l100A - Intl. B5 envelope size 12780>3 string \&l-81A - No. 10 envelope size (landscape) 12781>3 string \&l-90A - Intl. DL envelope size (landscape) 12782 12783# IMAGEN printer-ready files: 127840 string @document( Imagen printer 12785# this only works if "language xxx" is first item in Imagen header. 12786>10 string language\ impress (imPRESS data) 12787>10 string language\ daisy (daisywheel text) 12788>10 string language\ diablo (daisywheel text) 12789>10 string language\ printer (line printer emulation) 12790>10 string language\ tektronix (Tektronix 4014 emulation) 12791# Add any other languages that your Imagen uses - remember 12792# to keep the word `text' if the file is human-readable. 12793# [GRR 950115: missing "postscript" or "ultrascript" (whatever it was called)] 12794# 12795# Now magic for IMAGEN font files... 127960 string Rast RST-format raster font data 12797>45 string >0 face %s 12798# From Jukka Ukkonen 127990 string \033[K\002\0\0\017\033(a\001\0\001\033(g Canon Bubble Jet BJC formatted data 12800 12801# From <mike@flyn.org> 12802# These are the /etc/magic entries to decode data sent to an Epson printer. 128030 string \x1B\x40\x1B\x28\x52\x08\x00\x00REMOTE1P Epson Stylus Color 460 data 12804 12805 12806#------------------------------------------------------------------------------ 12807# zenographics: file(1) magic for Zenographics ZjStream printer data 12808# Rick Richardson rickr@mn.rr.com 128090 string JZJZ 12810>0x12 string ZZ Zenographics ZjStream printer data (big-endian) 128110 string ZJZJ 12812>0x12 string ZZ Zenographics ZjStream printer data (little-endian) 12813 12814 12815#------------------------------------------------------------------------------ 12816# Oak Technologies printer stream 12817# Rick Richardson <rickr@mn.rr.com> 128180 string OAK 12819>0x07 byte 0 12820>0x0b byte 0 Oak Technologies printer stream 12821 12822# This would otherwise be recognized as PostScript - nick@debian.org 128230 string %!VMF SunClock's Vector Map Format data 12824 12825#------------------------------------------------------------------------------ 12826# HP LaserJet 1000 series downloadable firmware file 128270 string \xbe\xefABCDEFGH HP LaserJet 1000 series downloadable firmware 12828 12829# From: Paolo <oopla@users.sf.net> 12830# Epson ESC/Page, ESC/PageColor 128310 string \x1b\x01@EJL Epson ESC/Page language printer data 12832 12833#------------------------------------------------------------------------------ 12834# $File: project,v 1.4 2009/09/19 16:28:11 christos Exp $ 12835# project: file(1) magic for Project management 12836# 12837# Magic strings for ftnchek project files. Alexander Mai 128380 string FTNCHEK_\ P project file for ftnchek 12839>10 string 1 version 2.7 12840>10 string 2 version 2.8 to 2.10 12841>10 string 3 version 2.11 or later 12842 12843#------------------------------------------------------------------------------ 12844# $File: psdbms,v 1.6 2009/09/19 16:28:11 christos Exp $ 12845# psdbms: file(1) magic for psdatabase 12846# 128470 belong&0xff00ffff 0x56000000 ps database 12848>1 string >\0 version %s 12849>4 string >\0 from kernel %s 12850 12851#------------------------------------------------------------------------------ 12852# $File: pulsar,v 1.5 2009/09/19 16:28:12 christos Exp $ 12853# pulsar: file(1) magic for Pulsar POP3 daemon binary files 12854# 12855# http://pulsar.sourceforge.net 12856# mailto:rok.papez@lugos.si 12857# 12858 128590 belong 0x1ee7f11e Pulsar POP3 daemon mailbox cache file. 12860>4 ubelong x Version: %d. 12861>8 ubelong x \b%d 12862 12863 12864#------------------------------------------------------------------------------ 12865# $File: pyramid,v 1.7 2009/09/19 16:28:12 christos Exp $ 12866# pyramid: file(1) magic for Pyramids 12867# 12868# XXX - byte order? 12869# 128700 long 0x50900107 Pyramid 90x family executable 128710 long 0x50900108 Pyramid 90x family pure executable 12872>16 long >0 not stripped 128730 long 0x5090010b Pyramid 90x family demand paged pure executable 12874>16 long >0 not stripped 12875 12876#------------------------------------------------------------------------------ 12877# $File: python,v 1.12 2009/10/27 14:49:57 christos Exp $ 12878# python: file(1) magic for python 12879# 12880# From: David Necas <yeti@physics.muni.cz> 12881# often the module starts with a multiline string 128820 string """ a python script text executable 12883# MAGIC as specified in Python/import.c (1.5 to 2.6a1 and 3.1a0, assuming 12884# that Py_UnicodeFlag is off for Python 2) 12885# 20121 ( YEAR - 1995 ) + MONTH + DAY (little endian followed by "\r\n" 128860 belong 0x994e0d0a python 1.5/1.6 byte-compiled 128870 belong 0x87c60d0a python 2.0 byte-compiled 128880 belong 0x2aeb0d0a python 2.1 byte-compiled 128890 belong 0x2ded0d0a python 2.2 byte-compiled 128900 belong 0x3bf20d0a python 2.3 byte-compiled 128910 belong 0x6df20d0a python 2.4 byte-compiled 128920 belong 0xb3f20d0a python 2.5 byte-compiled 128930 belong 0xd1f20d0a python 2.6 byte-compiled 128940 belong 0x3b0c0d0a python 3.0 byte-compiled 128950 belong 0x4f0c0d0a python 3.1 byte-compiled 12896 128970 search/1/w #!\ /usr/bin/python Python script text executable 12898!:mime text/x-python 128990 search/1/w #!\ /usr/local/bin/python Python script text executable 12900!:mime text/x-python 129010 search/1 #!/usr/bin/env\ python Python script text executable 12902!:mime text/x-python 129030 search/1 #!\ /usr/bin/env\ ruby Python script text executable 12904!:mime text/x-python 12905 12906#------------------------------------------------------------------------------ 12907# $File: revision,v 1.6 2009/09/19 16:28:12 christos Exp $ 12908# file(1) magic for revision control files 12909# From Hendrik Scholz <hendrik@scholz.net> 129100 string /1\ :pserver: cvs password text file 12911 12912# Conary changesets 12913# From: Jonathan Smith <smithj@rpath.com> 129140 belong 0xea3f81bb Conary changeset data 12915 12916# Type: Git bundles (git-bundle) 12917# From: Josh Triplett <josh@freedesktop.org> 129180 string #\ v2\ git\ bundle\n Git bundle 12919 12920# Type: Git pack 12921# From: Adam Buchbinder <adam.buchbinder@gmail.com> 12922# The actual magic is 'PACK', but that clashes with Doom/Quake packs. However, 12923# those have a little-endian offset immediately following the magic 'PACK', 12924# the first byte of which is never 0, while the first byte of the Git pack 12925# version, since it's a tiny number stored in big-endian format, is always 0. 129260 string PACK\0 Git pack 12927>4 belong >0 \b, version %d 12928>>8 belong >0 \b, %d objects 12929 12930# Type: Git pack index 12931# From: Adam Buchbinder <adam.buchbinder@gmail.com> 129320 string \377tOc Git pack index 12933>4 belong =2 \b, version 2 12934 12935# Type: Git index file 12936# From: Frédéric Brière <fbriere@fbriere.net> 129370 string DIRC Git index 12938>4 belong >0 \b, version %d 12939>>8 belong >0 \b, %d entries 12940 12941# Type: Mercurial bundles 12942# From: Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr> 129430 string HG10 Mercurial bundle, 12944>4 string UN uncompressed 12945>4 string BZ bzip2 compressed 12946 12947# Type: Subversion (SVN) dumps 12948# From: Uwe Zeisberger <zeisberg@informatik.uni-freiburg.de> 129490 string SVN-fs-dump-format-version: Subversion dumpfile 12950>28 string >\0 (version: %s) 12951 12952# Type: Bazaar revision bundles and merge requests 12953# URL: http://www.bazaar-vcs.org/ 12954# From: Jelmer Vernooij <jelmer@samba.org> 129550 string #\ Bazaar\ revision\ bundle\ v Bazaar Bundle 129560 string #\ Bazaar\ merge\ directive\ format Bazaar merge directive 12957 12958#------------------------------------------------------------------------------ 12959# $File: riff,v 1.18 2009/09/19 16:28:12 christos Exp $ 12960# riff: file(1) magic for RIFF format 12961# See 12962# 12963# http://www.seanet.com/users/matts/riffmci/riffmci.htm 12964# 12965# AVI section extended by Patrik R�dman <patrik+file-magic@iki.fi> 12966# 129670 string RIFF RIFF (little-endian) data 12968# RIFF Palette format 12969>8 string PAL \b, palette 12970>>16 leshort x \b, version %d 12971>>18 leshort x \b, %d entries 12972# RIFF Device Independent Bitmap format 12973>8 string RDIB \b, device-independent bitmap 12974>>16 string BM 12975>>>30 leshort 12 \b, OS/2 1.x format 12976>>>>34 leshort x \b, %d x 12977>>>>36 leshort x %d 12978>>>30 leshort 64 \b, OS/2 2.x format 12979>>>>34 leshort x \b, %d x 12980>>>>36 leshort x %d 12981>>>30 leshort 40 \b, Windows 3.x format 12982>>>>34 lelong x \b, %d x 12983>>>>38 lelong x %d x 12984>>>>44 leshort x %d 12985# RIFF MIDI format 12986>8 string RMID \b, MIDI 12987# RIFF Multimedia Movie File format 12988>8 string RMMP \b, multimedia movie 12989# RIFF wrapper for MP3 12990>8 string RMP3 \b, MPEG Layer 3 audio 12991# Microsoft WAVE format (*.wav) 12992>8 string WAVE \b, WAVE audio 12993!:mime audio/x-wav 12994>>20 leshort 1 \b, Microsoft PCM 12995>>>34 leshort >0 \b, %d bit 12996>>20 leshort 2 \b, Microsoft ADPCM 12997>>20 leshort 6 \b, ITU G.711 A-law 12998>>20 leshort 7 \b, ITU G.711 mu-law 12999>>20 leshort 8 \b, Microsoft DTS 13000>>20 leshort 17 \b, IMA ADPCM 13001>>20 leshort 20 \b, ITU G.723 ADPCM (Yamaha) 13002>>20 leshort 49 \b, GSM 6.10 13003>>20 leshort 64 \b, ITU G.721 ADPCM 13004>>20 leshort 80 \b, MPEG 13005>>20 leshort 85 \b, MPEG Layer 3 13006>>20 leshort 0x2001 \b, DTS 13007>>22 leshort =1 \b, mono 13008>>22 leshort =2 \b, stereo 13009>>22 leshort >2 \b, %d channels 13010>>24 lelong >0 %d Hz 13011# Corel Draw Picture 13012>8 string CDRA \b, Corel Draw Picture 13013!:mime image/x-coreldraw 13014# AVI == Audio Video Interleave 13015>8 string AVI\040 \b, AVI 13016!:mime video/x-msvideo 13017>>12 string LIST 13018>>>20 string hdrlavih 13019>>>>&36 lelong x \b, %lu x 13020>>>>&40 lelong x %lu, 13021>>>>&4 lelong >1000000 <1 fps, 13022>>>>&4 lelong 1000000 1.00 fps, 13023>>>>&4 lelong 500000 2.00 fps, 13024>>>>&4 lelong 333333 3.00 fps, 13025>>>>&4 lelong 250000 4.00 fps, 13026>>>>&4 lelong 200000 5.00 fps, 13027>>>>&4 lelong 166667 6.00 fps, 13028>>>>&4 lelong 142857 7.00 fps, 13029>>>>&4 lelong 125000 8.00 fps, 13030>>>>&4 lelong 111111 9.00 fps, 13031>>>>&4 lelong 100000 10.00 fps, 13032# ]9.9,10.1[ 13033>>>>&4 lelong <101010 13034>>>>>&-4 lelong >99010 13035>>>>>>&-4 lelong !100000 ~10 fps, 13036>>>>&4 lelong 83333 12.00 fps, 13037# ]11.9,12.1[ 13038>>>>&4 lelong <84034 13039>>>>>&-4 lelong >82645 13040>>>>>>&-4 lelong !83333 ~12 fps, 13041>>>>&4 lelong 66667 15.00 fps, 13042# ]14.9,15.1[ 13043>>>>&4 lelong <67114 13044>>>>>&-4 lelong >66225 13045>>>>>>&-4 lelong !66667 ~15 fps, 13046>>>>&4 lelong 50000 20.00 fps, 13047>>>>&4 lelong 41708 23.98 fps, 13048>>>>&4 lelong 41667 24.00 fps, 13049# ]23.9,24.1[ 13050>>>>&4 lelong <41841 13051>>>>>&-4 lelong >41494 13052>>>>>>&-4 lelong !41708 13053>>>>>>>&-4 lelong !41667 ~24 fps, 13054>>>>&4 lelong 40000 25.00 fps, 13055# ]24.9,25.1[ 13056>>>>&4 lelong <40161 13057>>>>>&-4 lelong >39841 13058>>>>>>&-4 lelong !40000 ~25 fps, 13059>>>>&4 lelong 33367 29.97 fps, 13060>>>>&4 lelong 33333 30.00 fps, 13061# ]29.9,30.1[ 13062>>>>&4 lelong <33445 13063>>>>>&-4 lelong >33223 13064>>>>>>&-4 lelong !33367 13065>>>>>>>&-4 lelong !33333 ~30 fps, 13066>>>>&4 lelong <32224 >30 fps, 13067##>>>>&4 lelong x (%lu) 13068##>>>>&20 lelong x %lu frames, 13069# Note: The tests below assume that the AVI has 1 or 2 streams, 13070# "vids" optionally followed by "auds". 13071# (Should cover 99.9% of all AVIs.) 13072# assuming avih length = 56 13073>>>88 string LIST 13074>>>>96 string strlstrh 13075>>>>>108 string vids video: 13076>>>>>>&0 lelong 0 uncompressed 13077# skip past vids strh 13078>>>>>>(104.l+108) string strf 13079>>>>>>>(104.l+132) lelong 1 RLE 8bpp 13080>>>>>>>(104.l+132) string/c cvid Cinepak 13081>>>>>>>(104.l+132) string/c i263 Intel I.263 13082>>>>>>>(104.l+132) string/c iv32 Indeo 3.2 13083>>>>>>>(104.l+132) string/c iv41 Indeo 4.1 13084>>>>>>>(104.l+132) string/c iv50 Indeo 5.0 13085>>>>>>>(104.l+132) string/c mp42 Microsoft MPEG-4 v2 13086>>>>>>>(104.l+132) string/c mp43 Microsoft MPEG-4 v3 13087>>>>>>>(104.l+132) string/c fmp4 FFMpeg MPEG-4 13088>>>>>>>(104.l+132) string/c mjpg Motion JPEG 13089>>>>>>>(104.l+132) string/c div3 DivX 3 13090>>>>>>>>112 string/c div3 Low-Motion 13091>>>>>>>>112 string/c div4 Fast-Motion 13092>>>>>>>(104.l+132) string/c divx DivX 4 13093>>>>>>>(104.l+132) string/c dx50 DivX 5 13094>>>>>>>(104.l+132) string/c xvid XviD 13095>>>>>>>(104.l+132) string/c h264 H.264 13096>>>>>>>(104.l+132) string/c wmv3 Windows Media Video 9 13097>>>>>>>(104.l+132) string/c h264 X.264 or H.264 13098>>>>>>>(104.l+132) lelong 0 13099##>>>>>>>(104.l+132) string x (%.4s) 13100# skip past first (video) LIST 13101>>>>(92.l+96) string LIST 13102>>>>>(92.l+104) string strlstrh 13103>>>>>>(92.l+116) string auds \b, audio: 13104# auds strh length = 56: 13105>>>>>>>(92.l+172) string strf 13106>>>>>>>>(92.l+180) leshort 0x0001 uncompressed PCM 13107>>>>>>>>(92.l+180) leshort 0x0002 ADPCM 13108>>>>>>>>(92.l+180) leshort 0x0006 aLaw 13109>>>>>>>>(92.l+180) leshort 0x0007 uLaw 13110>>>>>>>>(92.l+180) leshort 0x0050 MPEG-1 Layer 1 or 2 13111>>>>>>>>(92.l+180) leshort 0x0055 MPEG-1 Layer 3 13112>>>>>>>>(92.l+180) leshort 0x2000 Dolby AC3 13113>>>>>>>>(92.l+180) leshort 0x0161 DivX 13114##>>>>>>>>(92.l+180) leshort x (0x%.4x) 13115>>>>>>>>(92.l+182) leshort 1 (mono, 13116>>>>>>>>(92.l+182) leshort 2 (stereo, 13117>>>>>>>>(92.l+182) leshort >2 (%d channels, 13118>>>>>>>>(92.l+184) lelong x %d Hz) 13119# auds strh length = 64: 13120>>>>>>>(92.l+180) string strf 13121>>>>>>>>(92.l+188) leshort 0x0001 uncompressed PCM 13122>>>>>>>>(92.l+188) leshort 0x0002 ADPCM 13123>>>>>>>>(92.l+188) leshort 0x0055 MPEG-1 Layer 3 13124>>>>>>>>(92.l+188) leshort 0x2000 Dolby AC3 13125>>>>>>>>(92.l+188) leshort 0x0161 DivX 13126##>>>>>>>>(92.l+188) leshort x (0x%.4x) 13127>>>>>>>>(92.l+190) leshort 1 (mono, 13128>>>>>>>>(92.l+190) leshort 2 (stereo, 13129>>>>>>>>(92.l+190) leshort >2 (%d channels, 13130>>>>>>>>(92.l+192) lelong x %d Hz) 13131# Animated Cursor format 13132>8 string ACON \b, animated cursor 13133# SoundFont 2 <mpruett@sgi.com> 13134>8 string sfbk SoundFont/Bank 13135# MPEG-1 wrapped in a RIFF, apparently 13136>8 string CDXA \b, wrapped MPEG-1 (CDXA) 13137>8 string 4XMV \b, 4X Movie file 13138 13139# 13140# XXX - some of the below may only appear in little-endian form. 13141# 13142# Also "MV93" appears to be for one form of Macromedia Director 13143# files, and "GDMF" appears to be another multimedia format. 13144# 131450 string RIFX RIFF (big-endian) data 13146# RIFF Palette format 13147>8 string PAL \b, palette 13148>>16 beshort x \b, version %d 13149>>18 beshort x \b, %d entries 13150# RIFF Device Independent Bitmap format 13151>8 string RDIB \b, device-independent bitmap 13152>>16 string BM 13153>>>30 beshort 12 \b, OS/2 1.x format 13154>>>>34 beshort x \b, %d x 13155>>>>36 beshort x %d 13156>>>30 beshort 64 \b, OS/2 2.x format 13157>>>>34 beshort x \b, %d x 13158>>>>36 beshort x %d 13159>>>30 beshort 40 \b, Windows 3.x format 13160>>>>34 belong x \b, %d x 13161>>>>38 belong x %d x 13162>>>>44 beshort x %d 13163# RIFF MIDI format 13164>8 string RMID \b, MIDI 13165# RIFF Multimedia Movie File format 13166>8 string RMMP \b, multimedia movie 13167# Microsoft WAVE format (*.wav) 13168>8 string WAVE \b, WAVE audio 13169>>20 leshort 1 \b, Microsoft PCM 13170>>>34 leshort >0 \b, %d bit 13171>>22 beshort =1 \b, mono 13172>>22 beshort =2 \b, stereo 13173>>22 beshort >2 \b, %d channels 13174>>24 belong >0 %d Hz 13175# Corel Draw Picture 13176>8 string CDRA \b, Corel Draw Picture 13177# AVI == Audio Video Interleave 13178>8 string AVI\040 \b, AVI 13179# Animated Cursor format 13180>8 string ACON \b, animated cursor 13181# Notation Interchange File Format (big-endian only) 13182>8 string NIFF \b, Notation Interchange File Format 13183# SoundFont 2 <mpruett@sgi.com> 13184>8 string sfbk SoundFont/Bank 13185 13186#------------------------------------------------------------------------------ 13187# $File: rpm,v 1.9 2009/11/06 13:53:52 christos Exp $ 13188# 13189# RPM: file(1) magic for Red Hat Packages Erik Troan (ewt@redhat.com) 13190# 131910 beshort 0xedab 13192>2 beshort 0xeedb RPM 13193!:mime application/x-rpm 13194>>4 byte x v%d 13195>>5 byte x \b.%d 13196>>6 beshort 1 src 13197>>6 beshort 0 bin 13198>>>8 beshort 1 i386/x86_64 13199>>>8 beshort 2 Alpha/Sparc64 13200>>>8 beshort 3 Sparc 13201>>>8 beshort 4 MIPS 13202>>>8 beshort 5 PowerPC 13203>>>8 beshort 6 68000 13204>>>8 beshort 7 SGI 13205>>>8 beshort 8 RS6000 13206>>>8 beshort 9 IA64 13207>>>8 beshort 10 Sparc64 13208 13209#delta RPM Daniel Novotny (dnovotny@redhat.com) 132100 string drpm Delta RPM 13211!:mime application/x-rpm 13212>12 string x %s 13213 13214>>>8 beshort 11 MIPSel 13215>>>8 beshort 12 ARM 13216>>>8 beshort 13 MiNT 13217>>>8 beshort 14 S/390 13218>>>8 beshort 15 S/390x 13219>>>8 beshort 16 PowerPC64 13220>>>8 beshort 17 SuperH 13221>>>8 beshort 18 Xtensa 13222>>10 string x %s 13223 13224# Type: Delta RPM 13225# From: Daniel Novotny (dnovotny@redhat.com) 132260 string drpm Delta RPM 13227!:mime application/x-rpm 13228>12 string x %s 13229 13230#------------------------------------------------------------------------------ 13231# $File: rtf,v 1.7 2009/09/19 16:28:12 christos Exp $ 13232# rtf: file(1) magic for Rich Text Format (RTF) 13233# 13234# Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk 13235# 132360 string {\\rtf Rich Text Format data, 13237!:mime text/rtf 13238>5 string 1 version 1, 13239>>6 string \\ansi ANSI 13240>>6 string \\mac Apple Macintosh 13241>>6 string \\pc IBM PC, code page 437 13242>>6 string \\pca IBM PS/2, code page 850 13243>>6 default x unknown character set 13244>5 default x unknown version 13245 13246#------------------------------------------------------------------------------ 13247# $File: ruby,v 1.3 2009/09/19 16:28:12 christos Exp $ 13248# ruby: file(1) magic for Ruby scripting language 13249# URL: http://www.ruby-lang.org/ 13250# From: Reuben Thomas <rrt@sc3d.org> 13251 13252# Ruby scripts 132530 search/1/w #!\ /usr/bin/ruby Ruby script text executable 13254!:mime text/x-ruby 132550 search/1/w #!\ /usr/local/bin/ruby Ruby script text executable 13256!:mime text/x-ruby 132570 search/1 #!/usr/bin/env\ ruby Ruby script text executable 13258!:mime text/x-ruby 132590 search/1 #!\ /usr/bin/env\ ruby Ruby script text executable 13260!:mime text/x-ruby 13261 13262#------------------------------------------------------------------------------ 13263# $File: sc,v 1.6 2009/09/19 16:28:12 christos Exp $ 13264# sc: file(1) magic for "sc" spreadsheet 13265# 1326638 string Spreadsheet sc spreadsheet file 13267!:mime application/x-sc 13268 13269#------------------------------------------------------------------------------ 13270# $File: sccs,v 1.6 2009/09/19 16:28:12 christos Exp $ 13271# sccs: file(1) magic for SCCS archives 13272# 13273# SCCS archive structure: 13274# \001h01207 13275# \001s 00276/00000/00000 13276# \001d D 1.1 87/09/23 08:09:20 ian 1 0 13277# \001c date and time created 87/09/23 08:09:20 by ian 13278# \001e 13279# \001u 13280# \001U 13281# ... etc. 13282# Now '\001h' happens to be the same as the 3B20's a.out magic number (0550). 13283# *Sigh*. And these both came from various parts of the USG. 13284# Maybe we should just switch everybody from SCCS to RCS! 13285# Further, you can't just say '\001h0', because the five-digit number 13286# is a checksum that could (presumably) have any leading digit, 13287# and we don't have regular expression matching yet. 13288# Hence the following official kludge: 132898 string \001s\ SCCS archive data 13290 13291#------------------------------------------------------------------------------ 13292# $File: scientific,v 1.6 2009/09/19 16:28:12 christos Exp $ 13293# scientific: file(1) magic for scientific formats 13294# 13295# From: Joe Krahn <krahn@niehs.nih.gov> 13296 13297######################################################## 13298# CCP4 data and plot files: 132990 string MTZ\040 MTZ reflection file 13300 1330192 string PLOT%%84 Plot84 plotting file 13302>52 byte 1 , Little-endian 13303>55 byte 1 , Big-endian 13304 13305######################################################## 13306# Electron density MAP/MASK formats 13307 133080 string EZD_MAP NEWEZD Electron Density Map 13309109 string MAP\040( Old EZD Electron Density Map 13310 133110 string/c :-)\040Origin BRIX Electron Density Map 13312>170 string >0 , Sigma:%.12s 13313#>4 string >0 %.178s 13314#>4 addr x %.178s 13315 133167 string 18\040!NTITLE XPLOR ASCII Electron Density Map 133179 string \040!NTITLE\012\040REMARK CNS ASCII electron density map 13318 13319208 string MAP\040 CCP4 Electron Density Map 13320# Assumes same stamp for float and double (normal case) 13321>212 byte 17 \b, Big-endian 13322>212 byte 34 \b, VAX format 13323>212 byte 68 \b, Little-endian 13324>212 byte 85 \b, Convex native 13325 13326############################################################ 13327# X-Ray Area Detector images 133280 string R-AXIS4\ \ \ R-Axis Area Detector Image: 13329>796 lelong <20 Little-endian, IP #%d, 13330>>768 lelong >0 Size=%dx 13331>>772 lelong >0 \b%d 13332>796 belong <20 Big-endian, IP #%d, 13333>>768 belong >0 Size=%dx 13334>>772 belong >0 \b%d 13335 133360 string RAXIS\ \ \ \ \ R-Axis Area Detector Image, Win32: 13337>796 lelong <20 Little-endian, IP #%d, 13338>>768 lelong >0 Size=%dx 13339>>772 lelong >0 \b%d 13340>796 belong <20 Big-endian, IP #%d, 13341>>768 belong >0 Size=%dx 13342>>772 belong >0 \b%d 13343 13344 133451028 string MMX\000\000\000\000\000\000\000\000\000\000\000\000\000 MAR Area Detector Image, 13346>1072 ulong >1 Compressed(%d), 13347>1100 ulong >1 %d headers, 13348>1104 ulong >0 %d x 13349>1108 ulong >0 %d, 13350>1120 ulong >0 %d bits/pixel 13351 13352# Type: GEDCOM genealogical (family history) data 13353# From: Giuseppe Bilotta 133540 search/1/c 0\ HEAD GEDCOM genealogy text 13355>&0 search 1\ GEDC 13356>>&0 search 2\ VERS version 13357>>>&1 search/1 >\0 %s 13358# From: Phil Endecott <phil05@chezphil.org> 133590 string \000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data 133600 string \060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data 133610 string \376\377\000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data 133620 string \377\376\060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data 13363 13364# PDB: Protein Data Bank files 13365# Adam Buchbinder <adam.buchbinder@gmail.com> 13366# 13367# http://www.wwpdb.org/documentation/format32/sect2.html 13368# http://www.ch.ic.ac.uk/chemime/ 13369# 13370# The PDB file format is fixed-field, 80 columns. From the spec: 13371# 13372# COLS DATA 13373# 1 - 6 "HEADER" 13374# 11 - 50 String(40) 13375# 51 - 59 Date 13376# 63 - 66 IDcode 13377# 13378# Thus, positions 7-10, 60-62 and 67-80 are spaces. The Date must be in the 13379# format DD-MMM-YY, e.g., 01-JAN-70, and the IDcode consists of numbers and 13380# uppercase letters. However, examples have been seen without the date string, 13381# e.g., the example on the chemime site. 133820 string HEADER\ \ \ \ 13383>&0 regex/1 \^.{40} 13384>>&0 regex/1 [0-9]{2}-[A-Z]{3}-[0-9]{2}\ {3} 13385>>>&0 regex/1s [A-Z0-9]{4}.{14}$ 13386>>>>&0 regex/1 [A-Z0-9]{4} Protein Data Bank data, ID Code %s 13387!:mime chemical/x-pdb 13388>>>>0 regex/1 [0-9]{2}-[A-Z]{3}-[0-9]{2} \b, %s 13389 13390# Type: GDSII Stream file 133910 belong 0x00060002 GDSII Stream file 13392>4 byte 0x00 13393>>5 byte x version %d.0 13394>4 byte >0x00 version %d 13395>>5 byte x \b.%d 13396 13397#------------------------------------------------------------------------------ 13398# $File: securitycerts,v 1.4 2009/09/19 16:28:12 christos Exp $ 133990 search/1 -----BEGIN\ CERTIFICATE------ RFC1421 Security Certificate text 134000 search/1 -----BEGIN\ NEW\ CERTIFICATE RFC1421 Security Certificate Signing Request text 134010 belong 0xedfeedfe Sun 'jks' Java Keystore File data 13402# Type: SE Linux policy modules *.pp reference policy 13403# for Fedora 5 to 9, RHEL5, and Debian Etch and Lenny. 13404# URL: http://doc.coker.com.au/computers/selinux-magic 13405# From: Russell Coker <russell@coker.com.au> 13406 134070 lelong 0xf97cff8f SE Linux modular policy 13408>4 lelong x version %d, 13409>8 lelong x %d sections, 13410>>(12.l) lelong 0xf97cff8d 13411>>>(12.l+27) lelong x mod version %d, 13412>>>(12.l+31) lelong 0 Not MLS, 13413>>>(12.l+31) lelong 1 MLS, 13414>>>(12.l+23) lelong 2 13415>>>>(12.l+47) string >\0 module name %s 13416>>>(12.l+23) lelong 1 base 13417 134181 string policy_module( SE Linux policy module source 134192 string policy_module( SE Linux policy module source 13420 134210 string ##\ <summary> SE Linux policy interface source 13422 13423#0 search gen_context( SE Linux policy file contexts 13424 13425#0 search gen_sens( SE Linux policy MLS constraints source 13426 13427#------------------------------------------------------------------------------ 13428# $File: sendmail,v 1.7 2009/09/19 16:28:12 christos Exp $ 13429# sendmail: file(1) magic for sendmail config files 13430# 13431# XXX - byte order? 13432# 134330 byte 046 Sendmail frozen configuration 13434>16 string >\0 - version %s 134350 short 0x271c Sendmail frozen configuration 13436>16 string >\0 - version %s 13437 13438#------------------------------------------------------------------------------ 13439# sendmail: file(1) magic for sendmail m4(1) files 13440# 13441# From Hendrik Scholz <hendrik@scholz.net> 13442# i.e. files in /usr/share/sendmail/cf/ 13443# 134440 string divert(-1)\n sendmail m4 text file 13445 13446 13447#------------------------------------------------------------------------------ 13448# $File: sequent,v 1.8 2009/09/19 16:28:12 christos Exp $ 13449# sequent: file(1) magic for Sequent machines 13450# 13451# Sequent information updated by Don Dwiggins <atsun!dwiggins>. 13452# For Sequent's multiprocessor systems (incomplete). 134530 lelong 0x00ea BALANCE NS32000 .o 13454>16 lelong >0 not stripped 13455>124 lelong >0 version %ld 134560 lelong 0x10ea BALANCE NS32000 executable (0 @ 0) 13457>16 lelong >0 not stripped 13458>124 lelong >0 version %ld 134590 lelong 0x20ea BALANCE NS32000 executable (invalid @ 0) 13460>16 lelong >0 not stripped 13461>124 lelong >0 version %ld 134620 lelong 0x30ea BALANCE NS32000 standalone executable 13463>16 lelong >0 not stripped 13464>124 lelong >0 version %ld 13465# 13466# Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>. 13467# Symmetry magic nums will not be reached if DOS COM comes before them; 13468# byte 0xeb is matched before these get a chance. 134690 leshort 0x12eb SYMMETRY i386 .o 13470>16 lelong >0 not stripped 13471>124 lelong >0 version %ld 134720 leshort 0x22eb SYMMETRY i386 executable (0 @ 0) 13473>16 lelong >0 not stripped 13474>124 lelong >0 version %ld 134750 leshort 0x32eb SYMMETRY i386 executable (invalid @ 0) 13476>16 lelong >0 not stripped 13477>124 lelong >0 version %ld 134780 leshort 0x42eb SYMMETRY i386 standalone executable 13479>16 lelong >0 not stripped 13480>124 lelong >0 version %ld 13481 13482#------------------------------------------------------------------------------ 13483# $File: sgi,v 1.17 2009/09/19 16:28:12 christos Exp $ 13484# sgi: file(1) magic for Silicon Graphics applications 13485 13486# 13487# 13488# Performance Co-Pilot file types 134890 string PmNs PCP compiled namespace (V.0) 134900 string PmN PCP compiled namespace 13491>3 string >\0 (V.%1.1s) 13492#3 lelong 0x84500526 PCP archive 134933 belong 0x84500526 PCP archive 13494>7 byte x (V.%d) 13495#>20 lelong -2 temporal index 13496#>20 lelong -1 metadata 13497#>20 lelong 0 log volume #0 13498#>20 lelong >0 log volume #%ld 13499>20 belong -2 temporal index 13500>20 belong -1 metadata 13501>20 belong 0 log volume #0 13502>20 belong >0 log volume #%ld 13503>24 string >\0 host: %s 135040 string PCPFolio PCP 13505>9 string Version: Archive Folio 13506>18 string >\0 (V.%s) 135070 string #pmchart PCP pmchart view 13508>9 string Version 13509>17 string >\0 (V%-3.3s) 135100 string #kmchart PCP kmchart view 13511>9 string Version 13512>17 string >\0 (V.%s) 135130 string pmview PCP pmview config 13514>7 string Version 13515>15 string >\0 (V%-3.3s) 135160 string #pmlogger PCP pmlogger config 13517>10 string Version 13518>18 string >\0 (V%1.1s) 135190 string #pmdahotproc PCP pmdahotproc config 13520>13 string Version 13521>21 string >\0 (V%-3.3s) 135220 string PcPh PCP Help 13523>4 string 1 Index 13524>4 string 2 Text 13525>5 string >\0 (V.%1.1s) 135260 string #pmieconf-rules PCP pmieconf rules 13527>16 string >\0 (V.%1.1s) 135283 string pmieconf-pmie PCP pmie config 13529>17 string >\0 (V.%1.1s) 13530 13531# SpeedShop data files 135320 lelong 0x13130303 SpeedShop data file 13533 13534# mdbm files 135350 lelong 0x01023962 mdbm file, version 0 (obsolete) 135360 string mdbm mdbm file, 13537>5 byte x version %d, 13538>6 byte x 2^%d pages, 13539>7 byte x pagesize 2^%d, 13540>17 byte x hash %d, 13541>11 byte x dataformat %d 13542 13543# Alias Maya files 135440 string //Maya ASCII Alias Maya Ascii File, 13545>13 string >\0 version %s 135468 string MAYAFOR4 Alias Maya Binary File, 13547>32 string >\0 version %s scene 135488 string MayaFOR4 Alias Maya Binary File, 13549>32 string >\0 version %s scene 135508 string CIMG Alias Maya Image File 135518 string DEEP Alias Maya Image File 13552#------------------------------------------------------------------------------ 13553# $File: sgml,v 1.24 2009/09/19 17:31:35 christos Exp $ 13554# Type: SVG Vectorial Graphics 13555# From: Noel Torres <tecnico@ejerciciosresueltos.com> 135560 string \<?xml\ version=" 13557>15 string >\0 13558>>19 search/4096 \<svg SVG Scalable Vector Graphics image 13559!:mime image/svg+xml 13560>>19 search/4096 \<gnc-v2 GnuCash file 13561!:mime application/x-gnucash 13562 13563# Sitemap file 135640 string \<?xml\ version=" 13565>15 string >\0 13566>>19 search/4096 \<urlset XML Sitemap document text 13567!:mime application/xml-sitemap 13568 13569# xhtml 135700 string \<?xml\ version=" 13571>15 string >\0 13572>>19 search/4096/cWbt \<!doctype\ html xHTML document text 13573!:mime text/html 135740 string \<?xml\ version=' 13575>15 string >\0 13576>>19 search/4096/cWbt \<!doctype\ html xHTML document text 13577!:mime text/html 135780 string \<?xml\ version=" 13579>15 string >\0 13580>>19 search/4096/cWbt \<html broken xHTML document text 13581!:mime text/html 13582 13583#------------------------------------------------------------------------------ 13584# sgml: file(1) magic for Standard Generalized Markup Language 13585# HyperText Markup Language (HTML) is an SGML document type, 13586# from Daniel Quinlan (quinlan@yggdrasil.com) 13587# adapted to string extenstions by Anthon van der Neut <anthon@mnt.org) 135880 search/4096/cWbt \<!doctype\ html HTML document text 13589!:mime text/html 135900 search/4096/cwbt \<head HTML document text 13591!:mime text/html 135920 search/4096/cwbt \<title HTML document text 13593!:mime text/html 135940 search/4096/cwbt \<html HTML document text 13595!:mime text/html 135960 search/4096/cwbt \<script HTML document text 13597!:mime text/html 135980 search/4096/cwbt \<style HTML document text 13599!:mime text/html 136000 search/4096/cwbt \<table HTML document text 13601!:mime text/html 136020 search/4096/cwbt \<a\ href= HTML document text 13603!:mime text/html 13604 13605# Extensible markup language (XML), a subset of SGML 13606# from Marc Prud'hommeaux (marc@apocalypse.org) 136070 search/1/cwbt \<?xml XML document text 13608!:mime application/xml 136090 string \<?xml\ version\ " XML 13610!:mime application/xml 136110 string \<?xml\ version=" XML 13612!:mime application/xml 13613>15 search/1 >\0 %.3s document text 13614>>23 search/1 \<xsl:stylesheet (XSL stylesheet) 13615>>24 search/1 \<xsl:stylesheet (XSL stylesheet) 136160 string \<?xml\ version=' XML 13617!:mime application/xml 13618>15 search/1 >\0 %.3s document text 13619>>23 search/1 \<xsl:stylesheet (XSL stylesheet) 13620>>24 search/1 \<xsl:stylesheet (XSL stylesheet) 136210 search/1/wbt \<?xml XML document text 13622!:mime application/xml 13623!:strength - 10 136240 search/1/wbt \<?XML broken XML document text 13625!:mime application/xml 13626!:strength - 10 13627 13628 13629# SGML, mostly from rph@sq 136300 search/4096/cwbt \<!doctype exported SGML document text 136310 search/4096/cwbt \<!subdoc exported SGML subdocument text 136320 search/4096/cwbt \<!-- exported SGML document text 13633!:strength - 10 13634 13635# Web browser cookie files 13636# (Mozilla, Galeon, Netscape 4, Konqueror..) 13637# Ulf Harnhammar <ulfh@update.uu.se> 136380 search/1 #\ HTTP\ Cookie\ File Web browser cookie text 136390 search/1 #\ Netscape\ HTTP\ Cookie\ File Netscape cookie text 136400 search/1 #\ KDE\ Cookie\ File Konqueror cookie text 13641 13642#------------------------------------------------------------------------ 13643# $File: sharc,v 1.6 2009/09/19 16:28:12 christos Exp $ 13644# file(1) magic for sharc files 13645# 13646# SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by 13647# FutureGroove Music (dsp@futuregroove.de) 13648 13649#------------------------------------------------------------------------ 13650#0 string Draw RiscOS Drawfile 13651#0 string PACK RiscOS PackdDir archive 13652 13653#------------------------------------------------------------------------ 13654# SHARC DSP stuff (based on the FGM SHARC DSP SDK) 13655 13656#0 string =! Assembler source 13657#0 string Analog ADi asm listing file 136580 string .SYSTEM SHARC architecture file 136590 string .system SHARC architecture file 13660 136610 leshort 0x521C SHARC COFF binary 13662>2 leshort >1 , %hd sections 13663>>12 lelong >0 , not stripped 13664 13665#------------------------------------------------------------------------------ 13666# $File: sinclair,v 1.5 2009/09/19 16:28:12 christos Exp $ 13667# sinclair: file(1) sinclair QL 13668 13669# additions to /etc/magic by Thomas M. Ott (ThMO) 13670 13671# Sinclair QL floppy disk formats (ThMO) 136720 string =QL5 QL disk dump data, 13673>3 string =A 720 KB, 13674>3 string =B 1.44 MB, 13675>3 string =C 3.2 MB, 13676>4 string >\0 label:%.10s 13677 13678# Sinclair QL OS dump (ThMO) 13679# (NOTE: if `file' would be able to use indirect references in a endian format 13680# differing from the natural host format, this could be written more 13681# reliably and faster...) 13682# 13683# we *can't* lookup QL OS code dumps, because `file' is UNABLE to read more 13684# than the first 8K of a file... #-( 13685# 13686#0 belong =0x30000 13687#>49124 belong <47104 13688#>>49128 belong <47104 13689#>>>49132 belong <47104 13690#>>>>49136 belong <47104 QL OS dump data, 13691#>>>>>49148 string >\0 type %.3s, 13692#>>>>>49142 string >\0 version %.4s 13693 13694# Sinclair QL firmware executables (ThMO) 136950 string NqNqNq`\004 QL firmware executable (BCPL) 13696 13697# Sinclair QL libraries (was ThMO) 136980 beshort 0xFB01 QDOS object 13699>2 pstring x '%s' 13700 13701# Sinclair QL executables (was ThMO) 137024 belong 0x4AFB QDOS executable 13703>9 pstring x '%s' 13704 13705# Sinclair QL ROM (ThMO) 137060 belong =0x4AFB0001 QL plugin-ROM data, 13707>9 pstring =\0 un-named 13708>9 pstring >\0 named: %s 13709# Type: SiSU Markup Language 13710# URL: http://www.sisudoc.org/ 13711# From: Ralph Amissah <ralph.amissah@gmail.com> 13712 137130 regex \^%?[\ \t]*SiSU[\ \t]+insert SiSU text insert 13714>5 regex [0-9.]+ %s 13715 137160 regex \^%[\ \t]+SiSU[\ \t]+master SiSU text master 13717>5 regex [0-9.]+ %s 13718 137190 regex \^%?[\ \t]*SiSU[\ \t]+text SiSU text 13720>5 regex [0-9.]+ %s 13721 137220 regex \^%?[\ \t]*SiSU[\ \t][0-9.]+ SiSU text 13723>5 regex [0-9.]+ %s 13724 137250 regex \^%*[\ \t]*sisu-[0-9.]+ SiSU text 13726>5 regex [0-9.]+ %s 13727 13728#------------------------------------------------------------------------------ 13729# $File: sketch,v 1.4 2009/09/19 16:28:12 christos Exp $ 13730# Sketch Drawings: http://sketch.sourceforge.net/ 13731# From: Edwin Mons <e@ik.nu> 137320 search/1 ##Sketch Sketch document text 13733 13734#----------------------------------------------- 13735# $File: smalltalk,v 1.5 2009/09/19 16:28:12 christos Exp $ 13736# GNU Smalltalk image, starting at version 1.6.2 13737# From: catull_us@yahoo.com 13738# 137390 string GSTIm\0\0 GNU SmallTalk 13740# little-endian 13741>7 byte&1 =0 LE image version 13742>>10 byte x %d. 13743>>9 byte x \b%d. 13744>>8 byte x \b%d 13745#>>12 lelong x , data: %ld 13746#>>16 lelong x , table: %ld 13747#>>20 lelong x , memory: %ld 13748# big-endian 13749>7 byte&1 =1 BE image version 13750>>8 byte x %d. 13751>>9 byte x \b%d. 13752>>10 byte x \b%d 13753#>>12 belong x , data: %ld 13754#>>16 belong x , table: %ld 13755#>>20 belong x , memory: %ld 13756 13757 13758 13759#------------------------------------------------------------------------------ 13760# $File: sniffer,v 1.14 2009/09/19 16:28:12 christos Exp $ 13761# sniffer: file(1) magic for packet capture files 13762# 13763# From: guy@alum.mit.edu (Guy Harris) 13764# 13765 13766# 13767# Microsoft Network Monitor 1.x capture files. 13768# 137690 string RTSS NetMon capture file 13770>5 byte x - version %d 13771>4 byte x \b.%d 13772>6 leshort 0 (Unknown) 13773>6 leshort 1 (Ethernet) 13774>6 leshort 2 (Token Ring) 13775>6 leshort 3 (FDDI) 13776>6 leshort 4 (ATM) 13777 13778# 13779# Microsoft Network Monitor 2.x capture files. 13780# 137810 string GMBU NetMon capture file 13782>5 byte x - version %d 13783>4 byte x \b.%d 13784>6 leshort 0 (Unknown) 13785>6 leshort 1 (Ethernet) 13786>6 leshort 2 (Token Ring) 13787>6 leshort 3 (FDDI) 13788>6 leshort 4 (ATM) 13789 13790# 13791# Network General Sniffer capture files. 13792# Sorry, make that "Network Associates Sniffer capture files." 13793# Sorry, make that "Network General old DOS Sniffer capture files." 13794# 137950 string TRSNIFF\ data\ \ \ \ \032 Sniffer capture file 13796>33 byte 2 (compressed) 13797>23 leshort x - version %d 13798>25 leshort x \b.%d 13799>32 byte 0 (Token Ring) 13800>32 byte 1 (Ethernet) 13801>32 byte 2 (ARCNET) 13802>32 byte 3 (StarLAN) 13803>32 byte 4 (PC Network broadband) 13804>32 byte 5 (LocalTalk) 13805>32 byte 6 (Znet) 13806>32 byte 7 (Internetwork Analyzer) 13807>32 byte 9 (FDDI) 13808>32 byte 10 (ATM) 13809 13810# 13811# Cinco Networks NetXRay capture files. 13812# Sorry, make that "Network General Sniffer Basic capture files." 13813# Sorry, make that "Network Associates Sniffer Basic capture files." 13814# Sorry, make that "Network Associates Sniffer Basic, and Windows 13815# Sniffer Pro", capture files." 13816# Sorry, make that "Network General Sniffer capture files." 13817# 138180 string XCP\0 NetXRay capture file 13819>4 string >\0 - version %s 13820>44 leshort 0 (Ethernet) 13821>44 leshort 1 (Token Ring) 13822>44 leshort 2 (FDDI) 13823>44 leshort 3 (WAN) 13824>44 leshort 8 (ATM) 13825>44 leshort 9 (802.11) 13826 13827# 13828# "libpcap" capture files. 13829# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is 13830# the main program that uses that format, but there are other programs 13831# that use "libpcap", or that use the same capture file format.) 13832# 138330 ubelong 0xa1b2c3d4 tcpdump capture file (big-endian) 13834>4 beshort x - version %d 13835>6 beshort x \b.%d 13836>20 belong 0 (No link-layer encapsulation 13837>20 belong 1 (Ethernet 13838>20 belong 2 (3Mb Ethernet 13839>20 belong 3 (AX.25 13840>20 belong 4 (ProNET 13841>20 belong 5 (CHAOS 13842>20 belong 6 (Token Ring 13843>20 belong 7 (BSD ARCNET 13844>20 belong 8 (SLIP 13845>20 belong 9 (PPP 13846>20 belong 10 (FDDI 13847>20 belong 11 (RFC 1483 ATM 13848>20 belong 12 (raw IP 13849>20 belong 13 (BSD/OS SLIP 13850>20 belong 14 (BSD/OS PPP 13851>20 belong 19 (Linux ATM Classical IP 13852>20 belong 50 (PPP or Cisco HDLC 13853>20 belong 51 (PPP-over-Ethernet 13854>20 belong 99 (Symantec Enterprise Firewall 13855>20 belong 100 (RFC 1483 ATM 13856>20 belong 101 (raw IP 13857>20 belong 102 (BSD/OS SLIP 13858>20 belong 103 (BSD/OS PPP 13859>20 belong 104 (BSD/OS Cisco HDLC 13860>20 belong 105 (802.11 13861>20 belong 106 (Linux Classical IP over ATM 13862>20 belong 107 (Frame Relay 13863>20 belong 108 (OpenBSD loopback 13864>20 belong 109 (OpenBSD IPsec encrypted 13865>20 belong 112 (Cisco HDLC 13866>20 belong 113 (Linux "cooked" 13867>20 belong 114 (LocalTalk 13868>20 belong 117 (OpenBSD PFLOG 13869>20 belong 119 (802.11 with Prism header 13870>20 belong 122 (RFC 2625 IP over Fibre Channel 13871>20 belong 123 (SunATM 13872>20 belong 127 (802.11 with radiotap header 13873>20 belong 129 (Linux ARCNET 13874>20 belong 138 (Apple IP over IEEE 1394 13875>20 belong 140 (MTP2 13876>20 belong 141 (MTP3 13877>20 belong 143 (DOCSIS 13878>20 belong 144 (IrDA 13879>20 belong 147 (Private use 0 13880>20 belong 148 (Private use 1 13881>20 belong 149 (Private use 2 13882>20 belong 150 (Private use 3 13883>20 belong 151 (Private use 4 13884>20 belong 152 (Private use 5 13885>20 belong 153 (Private use 6 13886>20 belong 154 (Private use 7 13887>20 belong 155 (Private use 8 13888>20 belong 156 (Private use 9 13889>20 belong 157 (Private use 10 13890>20 belong 158 (Private use 11 13891>20 belong 159 (Private use 12 13892>20 belong 160 (Private use 13 13893>20 belong 161 (Private use 14 13894>20 belong 162 (Private use 15 13895>20 belong 163 (802.11 with AVS header 13896>16 belong x \b, capture length %d) 138970 ulelong 0xa1b2c3d4 tcpdump capture file (little-endian) 13898>4 leshort x - version %d 13899>6 leshort x \b.%d 13900>20 lelong 0 (No link-layer encapsulation 13901>20 lelong 1 (Ethernet 13902>20 lelong 2 (3Mb Ethernet 13903>20 lelong 3 (AX.25 13904>20 lelong 4 (ProNET 13905>20 lelong 5 (CHAOS 13906>20 lelong 6 (Token Ring 13907>20 lelong 7 (ARCNET 13908>20 lelong 8 (SLIP 13909>20 lelong 9 (PPP 13910>20 lelong 10 (FDDI 13911>20 lelong 11 (RFC 1483 ATM 13912>20 lelong 12 (raw IP 13913>20 lelong 13 (BSD/OS SLIP 13914>20 lelong 14 (BSD/OS PPP 13915>20 lelong 19 (Linux ATM Classical IP 13916>20 lelong 50 (PPP or Cisco HDLC 13917>20 lelong 51 (PPP-over-Ethernet 13918>20 lelong 99 (Symantec Enterprise Firewall 13919>20 lelong 100 (RFC 1483 ATM 13920>20 lelong 101 (raw IP 13921>20 lelong 102 (BSD/OS SLIP 13922>20 lelong 103 (BSD/OS PPP 13923>20 lelong 104 (BSD/OS Cisco HDLC 13924>20 lelong 105 (802.11 13925>20 lelong 106 (Linux Classical IP over ATM 13926>20 lelong 107 (Frame Relay 13927>20 lelong 108 (OpenBSD loopback 13928>20 lelong 109 (OpenBSD IPsec encrypted 13929>20 lelong 112 (Cisco HDLC 13930>20 lelong 113 (Linux "cooked" 13931>20 lelong 114 (LocalTalk 13932>20 lelong 117 (OpenBSD PFLOG 13933>20 lelong 119 (802.11 with Prism header 13934>20 lelong 122 (RFC 2625 IP over Fibre Channel 13935>20 lelong 123 (SunATM 13936>20 lelong 127 (802.11 with radiotap header 13937>20 lelong 129 (Linux ARCNET 13938>20 lelong 138 (Apple IP over IEEE 1394 13939>20 lelong 140 (MTP2 13940>20 lelong 141 (MTP3 13941>20 lelong 143 (DOCSIS 13942>20 lelong 144 (IrDA 13943>20 lelong 147 (Private use 0 13944>20 lelong 148 (Private use 1 13945>20 lelong 149 (Private use 2 13946>20 lelong 150 (Private use 3 13947>20 lelong 151 (Private use 4 13948>20 lelong 152 (Private use 5 13949>20 lelong 153 (Private use 6 13950>20 lelong 154 (Private use 7 13951>20 lelong 155 (Private use 8 13952>20 lelong 156 (Private use 9 13953>20 lelong 157 (Private use 10 13954>20 lelong 158 (Private use 11 13955>20 lelong 159 (Private use 12 13956>20 lelong 160 (Private use 13 13957>20 lelong 161 (Private use 14 13958>20 lelong 162 (Private use 15 13959>20 lelong 163 (802.11 with AVS header 13960>16 lelong x \b, capture length %d) 13961 13962# 13963# "libpcap"-with-Alexey-Kuznetsov's-patches capture files. 13964# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is 13965# the main program that uses that format, but there are other programs 13966# that use "libpcap", or that use the same capture file format.) 13967# 139680 ubelong 0xa1b2cd34 extended tcpdump capture file (big-endian) 13969>4 beshort x - version %d 13970>6 beshort x \b.%d 13971>20 belong 0 (No link-layer encapsulation 13972>20 belong 1 (Ethernet 13973>20 belong 2 (3Mb Ethernet 13974>20 belong 3 (AX.25 13975>20 belong 4 (ProNET 13976>20 belong 5 (CHAOS 13977>20 belong 6 (Token Ring 13978>20 belong 7 (ARCNET 13979>20 belong 8 (SLIP 13980>20 belong 9 (PPP 13981>20 belong 10 (FDDI 13982>20 belong 11 (RFC 1483 ATM 13983>20 belong 12 (raw IP 13984>20 belong 13 (BSD/OS SLIP 13985>20 belong 14 (BSD/OS PPP 13986>16 belong x \b, capture length %d) 139870 ulelong 0xa1b2cd34 extended tcpdump capture file (little-endian) 13988>4 leshort x - version %d 13989>6 leshort x \b.%d 13990>20 lelong 0 (No link-layer encapsulation 13991>20 lelong 1 (Ethernet 13992>20 lelong 2 (3Mb Ethernet 13993>20 lelong 3 (AX.25 13994>20 lelong 4 (ProNET 13995>20 lelong 5 (CHAOS 13996>20 lelong 6 (Token Ring 13997>20 lelong 7 (ARCNET 13998>20 lelong 8 (SLIP 13999>20 lelong 9 (PPP 14000>20 lelong 10 (FDDI 14001>20 lelong 11 (RFC 1483 ATM 14002>20 lelong 12 (raw IP 14003>20 lelong 13 (BSD/OS SLIP 14004>20 lelong 14 (BSD/OS PPP 14005>16 lelong x \b, capture length %d) 14006 14007# 14008# AIX "iptrace" capture files. 14009# 140100 string iptrace\ 1.0 "iptrace" capture file 140110 string iptrace\ 2.0 "iptrace" capture file 14012 14013# 14014# Novell LANalyzer capture files. 14015# 140160 leshort 0x1001 LANalyzer capture file 140170 leshort 0x1007 LANalyzer capture file 14018 14019# 14020# HP-UX "nettl" capture files. 14021# 140220 string \x54\x52\x00\x64\x00 "nettl" capture file 14023 14024# 14025# RADCOM WAN/LAN Analyzer capture files. 14026# 140270 string \x42\xd2\x00\x34\x12\x66\x22\x88 RADCOM WAN/LAN Analyzer capture file 14028 14029# 14030# NetStumbler log files. Not really packets, per se, but about as 14031# close as you can get. These are log files from NetStumbler, a 14032# Windows program, that scans for 802.11b networks. 14033# 140340 string NetS NetStumbler log file 14035>8 lelong x \b, %d stations found 14036 14037# 14038# EtherPeek/AiroPeek "version 9" capture files. 14039# 140400 string \177ver EtherPeek/AiroPeek capture file 14041 14042# 14043# Visual Networks traffic capture files. 14044# 140450 string \x05VNF Visual Networks traffic capture file 14046 14047# 14048# Network Instruments Observer capture files. 14049# 140500 string ObserverPktBuffe Network Instruments Observer capture file 14051 14052# 14053# Files from Accellent Group's 5View products. 14054# 140550 string \xaa\xaa\xaa\xaa 5View capture file 14056 14057#------------------------------------------------------------------------------ 14058# $File: softquad,v 1.13 2009/09/19 16:28:12 christos Exp $ 14059# softquad: file(1) magic for SoftQuad Publishing Software 14060# 14061# Author/Editor and RulesBuilder 14062# 14063# XXX - byte order? 14064# 140650 string \<!SQ\ DTD> Compiled SGML rules file 14066>9 string >\0 Type %s 140670 string \<!SQ\ A/E> A/E SGML Document binary 14068>9 string >\0 Type %s 140690 string \<!SQ\ STS> A/E SGML binary styles file 14070>9 string >\0 Type %s 140710 short 0xc0de Compiled PSI (v1) data 140720 short 0xc0da Compiled PSI (v2) data 14073>3 string >\0 (%s) 14074# Binary sqtroff font/desc files... 140750 short 0125252 SoftQuad DESC or font file binary 14076>2 short >0 - version %d 14077# Bitmaps... 140780 search/1 SQ\ BITMAP1 SoftQuad Raster Format text 14079#0 string SQ\ BITMAP2 SoftQuad Raster Format data 14080# sqtroff intermediate language (replacement for ditroff int. lang.) 140810 string X\ SoftQuad troff Context intermediate 14082>2 string 495 for AT&T 495 laser printer 14083>2 string hp for Hewlett-Packard LaserJet 14084>2 string impr for IMAGEN imPRESS 14085>2 string ps for PostScript 14086 14087# From: Michael Piefel <piefel@debian.org> 14088# sqtroff intermediate language (replacement for ditroff int. lang.) 140890 string X\ 495 SoftQuad troff Context intermediate for AT&T 495 laser printer 140900 string X\ hp SoftQuad troff Context intermediate for HP LaserJet 140910 string X\ impr SoftQuad troff Context intermediate for IMAGEN imPRESS 140920 string X\ ps SoftQuad troff Context intermediate for PostScript 14093 14094#------------------------------------------------------------------------------ 14095# $File: spec,v 1.4 2009/09/19 16:28:12 christos Exp $ 14096# spec: file(1) magic for SPEC raw results (*.raw, *.rsf) 14097# 14098# Cloyce D. Spradling <cloyce@headgear.org> 14099 141000 string spec SPEC 14101>4 string .cpu CPU 14102>>8 string <: \b%.4s 14103>>12 string . raw result text 14104 1410517 string version=SPECjbb SPECjbb 14106>32 string <: \b%.4s 14107>>37 string <: v%.4s raw result text 14108 141090 string BEGIN\040SPECWEB SPECweb 14110>13 string <: \b%.2s 14111>>15 string _SSL \b_SSL 14112>>>20 string <: v%.4s raw result text 14113>>16 string <: v%.4s raw result text 14114 14115#------------------------------------------------------------------------------ 14116# $File: spectrum,v 1.6 2009/09/19 16:28:12 christos Exp $ 14117# spectrum: file(1) magic for Spectrum emulator files. 14118# 14119# John Elliott <jce@seasip.demon.co.uk> 14120 14121# 14122# Spectrum +3DOS header 14123# 141240 string PLUS3DOS\032 Spectrum +3 data 14125>15 byte 0 - BASIC program 14126>15 byte 1 - number array 14127>15 byte 2 - character array 14128>15 byte 3 - memory block 14129>>16 belong 0x001B0040 (screen) 14130>15 byte 4 - Tasword document 14131>15 string TAPEFILE - ZXT tapefile 14132# 14133# Tape file. This assumes the .TAP starts with a Spectrum-format header, 14134# which nearly all will. 14135# 14136# Update: Sanity-check string contents to be printable. 14137# -Adam Buchbinder <adam.buchbinder@gmail.com> 14138# 141390 string \023\000\000 14140>4 string >\0 14141>>4 string <\177 Spectrum .TAP data "%-10.10s" 14142>>>3 byte 0 - BASIC program 14143>>>3 byte 1 - number array 14144>>>3 byte 2 - character array 14145>>>3 byte 3 - memory block 14146>>>>14 belong 0x001B0040 (screen) 14147 14148# The following three blocks are from pak21-spectrum@srcf.ucam.org 14149# TZX tape images 141500 string ZXTape!\x1a Spectrum .TZX data 14151>8 byte x version %d 14152>9 byte x \b.%d 14153 14154# RZX input recording files 141550 string RZX! Spectrum .RZX data 14156>4 byte x version %d 14157>5 byte x \b.%d 14158 14159# Floppy disk images 141600 string MV\ -\ CPCEMU\ Disk-Fil Amstrad/Spectrum .DSK data 141610 string MV\ -\ CPC\ format\ Dis Amstrad/Spectrum DU54 .DSK data 141620 string EXTENDED\ CPC\ DSK\ Fil Amstrad/Spectrum Extended .DSK data 141630 string SINCLAIR Spectrum .SCL Betadisk image 14164 14165# Hard disk images 141660 string RS-IDE\x1a Spectrum .HDF hard disk image 14167>7 byte x \b, version 0x%02x 14168 14169#------------------------------------------------------------------------------ 14170# $File: sql,v 1.6 2009/09/19 16:28:12 christos Exp $ 14171# sql: file(1) magic for SQL files 14172# 14173# From: "Marty Leisner" <mleisner@eng.mc.xerox.com> 14174# Recognize some MySQL files. 14175# 141760 beshort 0xfe01 MySQL table definition file 14177>2 byte x Version %d 141780 belong&0xffffff00 0xfefe0300 MySQL MISAM index file 14179>3 byte x Version %d 141800 belong&0xffffff00 0xfefe0700 MySQL MISAM compressed data file 14181>3 byte x Version %d 141820 belong&0xffffff00 0xfefe0500 MySQL ISAM index file 14183>3 byte x Version %d 141840 belong&0xffffff00 0xfefe0600 MySQL ISAM compressed data file 14185>3 byte x Version %d 141860 string \376bin MySQL replication log 14187 14188#------------------------------------------------------------------------------ 14189# iRiver H Series database file 14190# From Ken Guest <ken@linux.ie> 14191# As observed from iRivNavi.iDB and unencoded firmware 14192# 141930 string iRivDB iRiver Database file 14194>11 string >\0 Version %s 14195>39 string iHP-100 [H Series] 14196 14197#------------------------------------------------------------------------------ 14198# SQLite database files 14199# Ken Guest <ken@linux.ie>, Ty Sarna, Zack Weinberg 14200# 14201# Version 1 used GDBM internally; its files cannot be distinguished 14202# from other GDBM files. 14203# 14204# Version 2 used this format: 142050 string **\ This\ file\ contains\ an\ SQLite SQLite 2.x database 14206 14207# Version 3 of SQLite allows applications to embed their own "user version" 14208# number in the database. Detect this and distinguish those files. 14209 142100 string SQLite\ format\ 3 14211>60 string _MTN Monotone source repository 14212>60 belong !0 SQLite 3.x database, user version %u 14213>60 belong 0 SQLite 3.x database 14214# Type: OpenSSH key files 14215# From: Nicolas Collignon <tsointsoin@gmail.com> 14216 142170 string SSH\ PRIVATE\ KEY OpenSSH RSA1 private key, 14218>28 string >\0 version %s 14219 142200 string ssh-dss\ OpenSSH DSA public key 142210 string ssh-rsa\ OpenSSH RSA public key 14222# Type: OpenSSL certificates/key files 14223# From: Nicolas Collignon <tsointsoin@gmail.com> 14224 142250 string -----BEGIN\ CERTIFICATE----- PEM certificate 142260 string -----BEGIN\ CERTIFICATE\ REQ PEM certificate request 142270 string -----BEGIN\ RSA\ PRIVATE PEM RSA private key 142280 string -----BEGIN\ DSA\ PRIVATE PEM DSA private key 14229 14230#------------------------------------------------------------------------------ 14231# $File: sun,v 1.20 2009/09/19 16:28:12 christos Exp $ 14232# sun: file(1) magic for Sun machines 14233# 14234# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x 14235# releases. (5.x uses ELF.) 14236# 142370 belong&077777777 0600413 sparc demand paged 14238>0 byte &0x80 14239>>20 belong <4096 shared library 14240>>20 belong =4096 dynamically linked executable 14241>>20 belong >4096 dynamically linked executable 14242>0 byte ^0x80 executable 14243>16 belong >0 not stripped 14244 142450 belong&077777777 0600410 sparc pure 14246>0 byte &0x80 dynamically linked executable 14247>0 byte ^0x80 executable 14248>16 belong >0 not stripped 14249 142500 belong&077777777 0600407 sparc 14251>0 byte &0x80 dynamically linked executable 14252>0 byte ^0x80 executable 14253>16 belong >0 not stripped 14254 142550 belong&077777777 0400413 mc68020 demand paged 14256>0 byte &0x80 14257>>20 belong <4096 shared library 14258>>20 belong =4096 dynamically linked executable 14259>>20 belong >4096 dynamically linked executable 14260>0 byte ^0x80 executable 14261>16 belong >0 not stripped 14262 142630 belong&077777777 0400410 mc68020 pure 14264>0 byte &0x80 dynamically linked executable 14265>0 byte ^0x80 executable 14266>16 belong >0 not stripped 14267 142680 belong&077777777 0400407 mc68020 14269>0 byte &0x80 dynamically linked executable 14270>0 byte ^0x80 executable 14271>16 belong >0 not stripped 14272 142730 belong&077777777 0200413 mc68010 demand paged 14274>0 byte &0x80 14275>>20 belong <4096 shared library 14276>>20 belong =4096 dynamically linked executable 14277>>20 belong >4096 dynamically linked executable 14278>0 byte ^0x80 executable 14279>16 belong >0 not stripped 14280 142810 belong&077777777 0200410 mc68010 pure 14282>0 byte &0x80 dynamically linked executable 14283>0 byte ^0x80 executable 14284>16 belong >0 not stripped 14285 142860 belong&077777777 0200407 mc68010 14287>0 byte &0x80 dynamically linked executable 14288>0 byte ^0x80 executable 14289>16 belong >0 not stripped 14290 14291# reworked these to avoid anything beginning with zero becoming "old sun-2" 142920 belong 0407 old sun-2 executable 14293>16 belong >0 not stripped 142940 belong 0410 old sun-2 pure executable 14295>16 belong >0 not stripped 142960 belong 0413 old sun-2 demand paged executable 14297>16 belong >0 not stripped 14298 14299# 14300# Core files. "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC 14301# binary executed in compatibility mode under SunOS 5.x". 14302# 143030 belong 0x080456 SunOS core file 14304>4 belong 432 (SPARC) 14305>>132 string >\0 from '%s' 14306>>116 belong =3 (quit) 14307>>116 belong =4 (illegal instruction) 14308>>116 belong =5 (trace trap) 14309>>116 belong =6 (abort) 14310>>116 belong =7 (emulator trap) 14311>>116 belong =8 (arithmetic exception) 14312>>116 belong =9 (kill) 14313>>116 belong =10 (bus error) 14314>>116 belong =11 (segmentation violation) 14315>>116 belong =12 (bad argument to system call) 14316>>116 belong =29 (resource lost) 14317>>120 belong x (T=%dK, 14318>>124 belong x D=%dK, 14319>>128 belong x S=%dK) 14320>4 belong 826 (68K) 14321>>128 string >\0 from '%s' 14322>4 belong 456 (SPARC 4.x BCP) 14323>>152 string >\0 from '%s' 14324# Sun SunPC 143250 long 0xfa33c08e SunPC 4.0 Hard Disk 143260 string #SUNPC_CONFIG SunPC 4.0 Properties Values 14327# Sun snoop (see RFC 1761, which describes the capture file format). 14328# 143290 string snoop Snoop capture file 14330>8 belong >0 - version %ld 14331>12 belong 0 (IEEE 802.3) 14332>12 belong 1 (IEEE 802.4) 14333>12 belong 2 (IEEE 802.5) 14334>12 belong 3 (IEEE 802.6) 14335>12 belong 4 (Ethernet) 14336>12 belong 5 (HDLC) 14337>12 belong 6 (Character synchronous) 14338>12 belong 7 (IBM channel-to-channel adapter) 14339>12 belong 8 (FDDI) 14340>12 belong 9 (Unknown) 14341 14342# Microsoft ICM color profile 1434336 string acspMSFT Microsoft ICM Color Profile 14344# Sun KCMS 1434536 string acsp Kodak Color Management System, ICC Profile 14346 14347#--------------------------------------------------------------------------- 14348# The following entries have been tested by Duncan Laurie <duncan@sun.com> (a 14349# lead Sun/Cobalt developer) who agrees that they are good and worthy of 14350# inclusion. 14351 14352# Boot ROM images for Sun/Cobalt Linux server appliances 143530 string Cobalt\ Networks\ Inc.\nFirmware\ v Paged COBALT boot rom 14354>38 string x V%.4s 14355 14356# New format for Sun/Cobalt boot ROMs is annoying, it stores the version code 14357# at the very end where file(1) can't get it. 143580 string CRfs COBALT boot rom data (Flat boot rom or file system) 14359 14360 14361 14362#------------------------------------------------------------------------ 14363# $File: sysex,v 1.6 2009/09/19 16:28:12 christos Exp $ 14364# sysex: file(1) magic for MIDI sysex files 14365# 14366# 143670 byte 0xF0 SysEx File - 14368 14369# North American Group 14370>1 byte 0x01 Sequential 14371>1 byte 0x02 IDP 14372>1 byte 0x03 OctavePlateau 14373>1 byte 0x04 Moog 14374>1 byte 0x05 Passport 14375>1 byte 0x06 Lexicon 14376>1 byte 0x07 Kurzweil/Future Retro 14377>>3 byte 0x77 777 14378>>4 byte 0x00 Bank 14379>>4 byte 0x01 Song 14380>>5 byte 0x0f 16 14381>>5 byte 0x0e 15 14382>>5 byte 0x0d 14 14383>>5 byte 0x0c 13 14384>>5 byte 0x0b 12 14385>>5 byte 0x0a 11 14386>>5 byte 0x09 10 14387>>5 byte 0x08 9 14388>>5 byte 0x07 8 14389>>5 byte 0x06 7 14390>>5 byte 0x05 6 14391>>5 byte 0x04 5 14392>>5 byte 0x03 4 14393>>5 byte 0x02 3 14394>>5 byte 0x01 2 14395>>5 byte 0x00 1 14396>>5 byte 0x10 (ALL) 14397>>2 byte x \b, Channel %d 14398>1 byte 0x08 Fender 14399>1 byte 0x09 Gulbransen 14400>1 byte 0x0a AKG 14401>1 byte 0x0b Voyce 14402>1 byte 0x0c Waveframe 14403>1 byte 0x0d ADA 14404>1 byte 0x0e Garfield 14405>1 byte 0x0f Ensoniq 14406>1 byte 0x10 Oberheim 14407>>2 byte 0x06 Matrix 6 series 14408>>3 byte 0x0A Dump (All) 14409>>3 byte 0x01 Dump (Bank) 14410>>4 belong 0x0002040E Matrix 1000 14411>>>11 byte <2 User bank %d 14412>>>11 byte >1 Preset bank %d 14413>1 byte 0x11 Apple 14414>1 byte 0x12 GreyMatter 14415>1 byte 0x14 PalmTree 14416>1 byte 0x15 JLCooper 14417>1 byte 0x16 Lowrey 14418>1 byte 0x17 AdamsSmith 14419>1 byte 0x18 E-mu 14420>1 byte 0x19 Harmony 14421>1 byte 0x1a ART 14422>1 byte 0x1b Baldwin 14423>1 byte 0x1c Eventide 14424>1 byte 0x1d Inventronics 14425>1 byte 0x1f Clarity 14426 14427# European Group 14428>1 byte 0x21 SIEL 14429>1 byte 0x22 Synthaxe 14430>1 byte 0x24 Hohner 14431>1 byte 0x25 Twister 14432>1 byte 0x26 Solton 14433>1 byte 0x27 Jellinghaus 14434>1 byte 0x28 Southworth 14435>1 byte 0x29 PPG 14436>1 byte 0x2a JEN 14437>1 byte 0x2b SSL 14438>1 byte 0x2c AudioVertrieb 14439 14440>1 byte 0x2f ELKA 14441>>3 byte 0x09 EK-44 14442 14443>1 byte 0x30 Dynacord 14444>1 byte 0x31 Jomox 14445>1 byte 0x33 Clavia 14446>1 byte 0x39 Soundcraft 14447# Some Waldorf info from http://Stromeko.Synth.net/Downloads#WaldorfDocs 14448>1 byte 0x3e Waldorf 14449>>2 byte 0x00 microWave 14450>>2 byte 0x0E microwave2 / XT 14451>>2 byte 0x0F Q / Q+ 14452>>3 byte =0 (default id) 14453>>3 byte >0 ( 14454>>>3 byte <0x7F \bdevice %d) 14455>>>3 byte =0x7F \bbroadcast id) 14456>>3 byte 0x7f Microwave I 14457>>>4 byte 0x00 SNDR (Sound Request) 14458>>>4 byte 0x10 SNDD (Sound Dump) 14459>>>4 byte 0x20 SNDP (Sound Parameter Change) 14460>>>4 byte 0x30 SNDQ (Sound Parameter Inquiry) 14461>>>4 byte 0x70 BOOT (Sound Reserved) 14462>>>4 byte 0x01 MULR (Multi Request) 14463>>>4 byte 0x11 MULD (Multi Dump) 14464>>>4 byte 0x21 MULP (Multi Parameter Change) 14465>>>4 byte 0x31 MULQ (Multi Parameter Inquiry) 14466>>>4 byte 0x71 OS (Multi Reserved) 14467>>>4 byte 0x02 DRMR (Drum Map Request) 14468>>>4 byte 0x12 DRMD (Drum Map Dump) 14469>>>4 byte 0x22 DRMP (Drum Map Parameter Change) 14470>>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry) 14471>>>4 byte 0x72 BIN (Drum Map Reserved) 14472>>>4 byte 0x03 PATR (Sequencer Pattern Request) 14473>>>4 byte 0x13 PATD (Sequencer Pattern Dump) 14474>>>4 byte 0x23 PATP (Sequencer Pattern Parameter Change) 14475>>>4 byte 0x33 PATQ (Sequencer Pattern Parameter Inquiry) 14476>>>4 byte 0x73 AFM (Sequencer Pattern Reserved) 14477>>>4 byte 0x04 GLBR (Global Parameter Request) 14478>>>4 byte 0x14 GLBD (Global Parameter Dump) 14479>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) 14480>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) 14481>>>4 byte 0x07 MODR (Mode Parameter Request) 14482>>>4 byte 0x17 MODD (Mode Parameter Dump) 14483>>>4 byte 0x27 MODP (Mode Parameter Parameter Change) 14484>>>4 byte 0x37 MODQ (Mode Parameter Parameter Inquiry) 14485>>2 byte 0x10 microQ 14486>>>4 byte 0x00 SNDR (Sound Request) 14487>>>4 byte 0x10 SNDD (Sound Dump) 14488>>>4 byte 0x20 SNDP (Sound Parameter Change) 14489>>>4 byte 0x30 SNDQ (Sound Parameter Inquiry) 14490>>>4 byte 0x70 (Sound Reserved) 14491>>>4 byte 0x01 MULR (Multi Request) 14492>>>4 byte 0x11 MULD (Multi Dump) 14493>>>4 byte 0x21 MULP (Multi Parameter Change) 14494>>>4 byte 0x31 MULQ (Multi Parameter Inquiry) 14495>>>4 byte 0x71 OS (Multi Reserved) 14496>>>4 byte 0x02 DRMR (Drum Map Request) 14497>>>4 byte 0x12 DRMD (Drum Map Dump) 14498>>>4 byte 0x22 DRMP (Drum Map Parameter Change) 14499>>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry) 14500>>>4 byte 0x72 BIN (Drum Map Reserved) 14501>>>4 byte 0x04 GLBR (Global Parameter Request) 14502>>>4 byte 0x14 GLBD (Global Parameter Dump) 14503>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) 14504>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) 14505>>2 byte 0x11 rackAttack 14506>>>4 byte 0x00 SNDR (Sound Parameter Request) 14507>>>4 byte 0x10 SNDD (Sound Parameter Dump) 14508>>>4 byte 0x20 SNDP (Sound Parameter Parameter Change) 14509>>>4 byte 0x30 SNDQ (Sound Parameter Parameter Inquiry) 14510>>>4 byte 0x01 PRGR (Program Parameter Request) 14511>>>4 byte 0x11 PRGD (Program Parameter Dump) 14512>>>4 byte 0x21 PRGP (Program Parameter Parameter Change) 14513>>>4 byte 0x31 PRGQ (Program Parameter Parameter Inquiry) 14514>>>4 byte 0x71 OS (Program Parameter Reserved) 14515>>>4 byte 0x03 PATR (Pattern Parameter Request) 14516>>>4 byte 0x13 PATD (Pattern Parameter Dump) 14517>>>4 byte 0x23 PATP (Pattern Parameter Parameter Change) 14518>>>4 byte 0x33 PATQ (Pattern Parameter Parameter Inquiry) 14519>>>4 byte 0x04 GLBR (Global Parameter Request) 14520>>>4 byte 0x14 GLBD (Global Parameter Dump) 14521>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) 14522>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) 14523>>>4 byte 0x05 EFXR (FX Parameter Request) 14524>>>4 byte 0x15 EFXD (FX Parameter Dump) 14525>>>4 byte 0x25 EFXP (FX Parameter Parameter Change) 14526>>>4 byte 0x35 EFXQ (FX Parameter Parameter Inquiry) 14527>>>4 byte 0x07 MODR (Mode Command Request) 14528>>>4 byte 0x17 MODD (Mode Command Dump) 14529>>>4 byte 0x27 MODP (Mode Command Parameter Change) 14530>>>4 byte 0x37 MODQ (Mode Command Parameter Inquiry) 14531>>2 byte 0x03 Wave 14532>>>4 byte 0x00 SBPR (Soundprogram) 14533>>>4 byte 0x01 SAPR (Performance) 14534>>>4 byte 0x02 SWAVE (Wave) 14535>>>4 byte 0x03 SWTBL (Wave control table) 14536>>>4 byte 0x04 SVT (Velocity Curve) 14537>>>4 byte 0x05 STT (Tuning Table) 14538>>>4 byte 0x06 SGLB (Global Parameters) 14539>>>4 byte 0x07 SARRMAP (Performance Program Change Map) 14540>>>4 byte 0x08 SBPRMAP (Sound Program Change Map) 14541>>>4 byte 0x09 SBPRPAR (Sound Parameter) 14542>>>4 byte 0x0A SARRPAR (Performance Parameter) 14543>>>4 byte 0x0B SINSPAR (Instrument/External Parameter) 14544>>>4 byte 0x0F SBULK (Bulk Switch on/off) 14545 14546# Japanese Group 14547>1 byte 0x40 Kawai 14548>>3 byte 0x20 K1 14549>>3 byte 0x22 K4 14550 14551>1 byte 0x41 Roland 14552>>3 byte 0x14 D-50 14553>>3 byte 0x2b U-220 14554>>3 byte 0x02 TR-707 14555 14556>1 byte 0x42 Korg 14557>>3 byte 0x19 M1 14558 14559>1 byte 0x43 Yamaha 14560>1 byte 0x44 Casio 14561>1 byte 0x46 Kamiya 14562>1 byte 0x47 Akai 14563>1 byte 0x48 Victor 14564>1 byte 0x49 Mesosha 14565>1 byte 0x4b Fujitsu 14566>1 byte 0x4c Sony 14567>1 byte 0x4e Teac 14568>1 byte 0x50 Matsushita 14569>1 byte 0x51 Fostex 14570>1 byte 0x52 Zoom 14571>1 byte 0x54 Matsushita 14572>1 byte 0x57 Acoustic tech. lab. 14573 14574>1 belong&0xffffff00 0x00007400 Ta Horng 14575>1 belong&0xffffff00 0x00007500 e-Tek 14576>1 belong&0xffffff00 0x00007600 E-Voice 14577>1 belong&0xffffff00 0x00007700 Midisoft 14578>1 belong&0xffffff00 0x00007800 Q-Sound 14579>1 belong&0xffffff00 0x00007900 Westrex 14580>1 belong&0xffffff00 0x00007a00 Nvidia* 14581>1 belong&0xffffff00 0x00007b00 ESS 14582>1 belong&0xffffff00 0x00007c00 Mediatrix 14583>1 belong&0xffffff00 0x00007d00 Brooktree 14584>1 belong&0xffffff00 0x00007e00 Otari 14585>1 belong&0xffffff00 0x00007f00 Key Electronics 14586>1 belong&0xffffff00 0x00010000 Shure 14587>1 belong&0xffffff00 0x00010100 AuraSound 14588>1 belong&0xffffff00 0x00010200 Crystal 14589>1 belong&0xffffff00 0x00010300 Rockwell 14590>1 belong&0xffffff00 0x00010400 Silicon Graphics 14591>1 belong&0xffffff00 0x00010500 Midiman 14592>1 belong&0xffffff00 0x00010600 PreSonus 14593>1 belong&0xffffff00 0x00010800 Topaz 14594>1 belong&0xffffff00 0x00010900 Cast Lightning 14595>1 belong&0xffffff00 0x00010a00 Microsoft 14596>1 belong&0xffffff00 0x00010b00 Sonic Foundry 14597>1 belong&0xffffff00 0x00010c00 Line 6 14598>1 belong&0xffffff00 0x00010d00 Beatnik Inc. 14599>1 belong&0xffffff00 0x00010e00 Van Koerving 14600>1 belong&0xffffff00 0x00010f00 Altech Systems 14601>1 belong&0xffffff00 0x00011000 S & S Research 14602>1 belong&0xffffff00 0x00011100 VLSI Technology 14603>1 belong&0xffffff00 0x00011200 Chromatic 14604>1 belong&0xffffff00 0x00011300 Sapphire 14605>1 belong&0xffffff00 0x00011400 IDRC 14606>1 belong&0xffffff00 0x00011500 Justonic Tuning 14607>1 belong&0xffffff00 0x00011600 TorComp 14608>1 belong&0xffffff00 0x00011700 Newtek Inc. 14609>1 belong&0xffffff00 0x00011800 Sound Sculpture 14610>1 belong&0xffffff00 0x00011900 Walker Technical 14611>1 belong&0xffffff00 0x00011a00 Digital Harmony 14612>1 belong&0xffffff00 0x00011b00 InVision 14613>1 belong&0xffffff00 0x00011c00 T-Square 14614>1 belong&0xffffff00 0x00011d00 Nemesys 14615>1 belong&0xffffff00 0x00011e00 DBX 14616>1 belong&0xffffff00 0x00011f00 Syndyne 14617>1 belong&0xffffff00 0x00012000 Bitheadz 14618>1 belong&0xffffff00 0x00012100 Cakewalk 14619>1 belong&0xffffff00 0x00012200 Staccato 14620>1 belong&0xffffff00 0x00012300 National Semicon. 14621>1 belong&0xffffff00 0x00012400 Boom Theory 14622>1 belong&0xffffff00 0x00012500 Virtual DSP Corp 14623>1 belong&0xffffff00 0x00012600 Antares 14624>1 belong&0xffffff00 0x00012700 Angel Software 14625>1 belong&0xffffff00 0x00012800 St Louis Music 14626>1 belong&0xffffff00 0x00012900 Lyrrus dba G-VOX 14627>1 belong&0xffffff00 0x00012a00 Ashley Audio 14628>1 belong&0xffffff00 0x00012b00 Vari-Lite 14629>1 belong&0xffffff00 0x00012c00 Summit Audio 14630>1 belong&0xffffff00 0x00012d00 Aureal Semicon. 14631>1 belong&0xffffff00 0x00012e00 SeaSound 14632>1 belong&0xffffff00 0x00012f00 U.S. Robotics 14633>1 belong&0xffffff00 0x00013000 Aurisis 14634>1 belong&0xffffff00 0x00013100 Nearfield Multimedia 14635>1 belong&0xffffff00 0x00013200 FM7 Inc. 14636>1 belong&0xffffff00 0x00013300 Swivel Systems 14637>1 belong&0xffffff00 0x00013400 Hyperactive 14638>1 belong&0xffffff00 0x00013500 MidiLite 14639>1 belong&0xffffff00 0x00013600 Radical 14640>1 belong&0xffffff00 0x00013700 Roger Linn 14641>1 belong&0xffffff00 0x00013800 Helicon 14642>1 belong&0xffffff00 0x00013900 Event 14643>1 belong&0xffffff00 0x00013a00 Sonic Network 14644>1 belong&0xffffff00 0x00013b00 Realtime Music 14645>1 belong&0xffffff00 0x00013c00 Apogee Digital 14646 14647>1 belong&0xffffff00 0x00202b00 Medeli Electronics 14648>1 belong&0xffffff00 0x00202c00 Charlie Lab 14649>1 belong&0xffffff00 0x00202d00 Blue Chip Music 14650>1 belong&0xffffff00 0x00202e00 BEE OH Corp 14651>1 belong&0xffffff00 0x00202f00 LG Semicon America 14652>1 belong&0xffffff00 0x00203000 TESI 14653>1 belong&0xffffff00 0x00203100 EMAGIC 14654>1 belong&0xffffff00 0x00203200 Behringer 14655>1 belong&0xffffff00 0x00203300 Access Music 14656>1 belong&0xffffff00 0x00203400 Synoptic 14657>1 belong&0xffffff00 0x00203500 Hanmesoft Corp 14658>1 belong&0xffffff00 0x00203600 Terratec 14659>1 belong&0xffffff00 0x00203700 Proel SpA 14660>1 belong&0xffffff00 0x00203800 IBK MIDI 14661>1 belong&0xffffff00 0x00203900 IRCAM 14662>1 belong&0xffffff00 0x00203a00 Propellerhead Software 14663>1 belong&0xffffff00 0x00203b00 Red Sound Systems 14664>1 belong&0xffffff00 0x00203c00 Electron ESI AB 14665>1 belong&0xffffff00 0x00203d00 Sintefex Audio 14666>1 belong&0xffffff00 0x00203e00 Music and More 14667>1 belong&0xffffff00 0x00203f00 Amsaro 14668>1 belong&0xffffff00 0x00204000 CDS Advanced Technology 14669>1 belong&0xffffff00 0x00204100 Touched by Sound 14670>1 belong&0xffffff00 0x00204200 DSP Arts 14671>1 belong&0xffffff00 0x00204300 Phil Rees Music 14672>1 belong&0xffffff00 0x00204400 Stamer Musikanlagen GmbH 14673>1 belong&0xffffff00 0x00204500 Soundart 14674>1 belong&0xffffff00 0x00204600 C-Mexx Software 14675>1 belong&0xffffff00 0x00204700 Klavis Tech. 14676>1 belong&0xffffff00 0x00204800 Noteheads AB 14677 146780 string T707 Roland TR-707 Data 14679 14680#------------------------------------------------------------------------------ 14681# $File: teapot,v 1.4 2009/09/19 16:28:12 christos Exp $ 14682# teapot: file(1) magic for "teapot" spreadsheet 14683# 146840 string #!teapot\012xdr teapot work sheet (XDR format) 14685 14686#------------------------------------------------------------------------------ 14687# $File: terminfo,v 1.6 2009/09/19 16:28:12 christos Exp $ 14688# terminfo: file(1) magic for terminfo 14689# 14690# XXX - byte order for screen images? 14691# 146920 string \032\001 Compiled terminfo entry 146930 short 0433 Curses screen image 146940 short 0434 Curses screen image 14695 14696#------------------------------------------------------------------------------ 14697# $File: tex,v 1.16 2009/09/19 16:28:12 christos Exp $ 14698# tex: file(1) magic for TeX files 14699# 14700# XXX - needs byte-endian stuff (big-endian and little-endian DVI?) 14701# 14702# From <conklin@talisman.kaleida.com> 14703 14704# Although we may know the offset of certain text fields in TeX DVI 14705# and font files, we can't use them reliably because they are not 14706# zero terminated. [but we do anyway, christos] 147070 string \367\002 TeX DVI file 14708!:mime application/x-dvi 14709>16 string >\0 (%s) 147100 string \367\203 TeX generic font data 147110 string \367\131 TeX packed font data 14712>3 string >\0 (%s) 147130 string \367\312 TeX virtual font data 147140 search/1 This\ is\ TeX, TeX transcript text 147150 search/1 This\ is\ METAFONT, METAFONT transcript text 14716 14717# There is no way to detect TeX Font Metric (*.tfm) files without 14718# breaking them apart and reading the data. The following patterns 14719# match most *.tfm files generated by METAFONT or afm2tfm. 147202 string \000\021 TeX font metric data 14721!:mime application/x-tex-tfm 14722>33 string >\0 (%s) 147232 string \000\022 TeX font metric data 14724!:mime application/x-tex-tfm 14725>33 string >\0 (%s) 14726 14727# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com) 147280 search/1 \\input\ texinfo Texinfo source text 14729!:mime text/x-texinfo 147300 search/1 This\ is\ Info\ file GNU Info text 14731!:mime text/x-info 14732 14733# TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com) 147340 search/400 \\input TeX document text 14735!:mime text/x-tex 147360 search/400 \\section LaTeX document text 14737!:mime text/x-tex 147380 search/400 \\setlength LaTeX document text 14739!:mime text/x-tex 147400 search/400 \\documentstyle LaTeX document text 14741!:mime text/x-tex 147420 search/400 \\chapter LaTeX document text 14743!:mime text/x-tex 147440 search/400 \\documentclass LaTeX 2e document text 14745!:mime text/x-tex 147460 search/400 \\relax LaTeX auxiliary file 14747!:mime text/x-tex 147480 search/400 \\contentsline LaTeX table of contents 14749!:mime text/x-tex 147500 search/400 %\ -*-latex-*- LaTeX document text 14751!:mime text/x-tex 14752 14753# Tex document, from Hendrik Scholz <hendrik@scholz.net> 147540 search/1 \\ifx TeX document text 14755 14756# Index and glossary files 147570 search/400 \\indexentry LaTeX raw index file 147580 search/400 \\begin{theindex} LaTeX sorted index 147590 search/400 \\glossaryentry LaTeX raw glossary 147600 search/400 \\begin{theglossary} LaTeX sorted glossary 147610 search/400 This\ is\ makeindex Makeindex log file 14762 14763# End of TeX 14764 14765#------------------------------------------------------------------------------ 14766# file(1) magic for BibTex text files 14767# From Hendrik Scholz <hendrik@scholz.net> 14768 147690 search/1/c @article{ BibTeX text file 147700 search/1/c @book{ BibTeX text file 147710 search/1/c @inbook{ BibTeX text file 147720 search/1/c @incollection{ BibTeX text file 147730 search/1/c @inproceedings{ BibTeX text file 147740 search/1/c @manual{ BibTeX text file 147750 search/1/c @misc{ BibTeX text file 147760 search/1/c @preamble{ BibTeX text file 147770 search/1/c @phdthesis{ BibTeX text file 147780 search/1/c @techreport{ BibTeX text file 147790 search/1/c @unpublished{ BibTeX text file 14780 1478173 search/1 %%%\ \ BibTeX-file{ BibTex text file (with full header) 14782 1478373 search/1 %%%\ \ @BibTeX-style-file{ BibTeX style text file (with full header) 14784 147850 search/1 %\ BibTeX\ standard\ bibliography\ BibTeX standard bibliography style text file 14786 147870 search/1 %\ BibTeX\ ` BibTeX custom bibliography style text file 14788 147890 search/1 @c\ @mapfile{ TeX font aliases text file 14790 147910 string \#LyX LyX document text 14792 14793#------------------------------------------------------------------------------ 14794# $File: tgif,v 1.5 2009/09/19 16:28:12 christos Exp $ 14795# file(1) magic for tgif(1) files 14796# From Hendrik Scholz <hendrik@scholz.net> 147970 string %TGIF\ Tgif file version 14798>6 string x %s 14799 14800#------------------------------------------------------------------------------ 14801# $File: ti-8x,v 1.6 2009/09/19 16:28:12 christos Exp $ 14802# ti-8x: file(1) magic for the TI-8x and TI-9x Graphing Calculators. 14803# 14804# From: Ryan McGuire (rmcguire@freenet.columbus.oh.us). 14805# 14806# Update: Romain Lievin (roms@lpg.ticalc.org). 14807# 14808# NOTE: This list is not complete. 14809# Files for the TI-80 and TI-81 are pretty rare. I'm not going to put the 14810# program/group magic numbers in here because I cannot find any. 148110 string **TI80** TI-80 Graphing Calculator File. 148120 string **TI81** TI-81 Graphing Calculator File. 14813# 14814# Magic Numbers for the TI-73 14815# 148160 string **TI73** TI-73 Graphing Calculator 14817>0x00003B byte 0x00 (real number) 14818>0x00003B byte 0x01 (list) 14819>0x00003B byte 0x02 (matrix) 14820>0x00003B byte 0x03 (equation) 14821>0x00003B byte 0x04 (string) 14822>0x00003B byte 0x05 (program) 14823>0x00003B byte 0x06 (assembly program) 14824>0x00003B byte 0x07 (picture) 14825>0x00003B byte 0x08 (gdb) 14826>0x00003B byte 0x0C (complex number) 14827>0x00003B byte 0x0F (window settings) 14828>0x00003B byte 0x10 (zoom) 14829>0x00003B byte 0x11 (table setup) 14830>0x00003B byte 0x13 (backup) 14831 14832# Magic Numbers for the TI-82 14833# 148340 string **TI82** TI-82 Graphing Calculator 14835>0x00003B byte 0x00 (real) 14836>0x00003B byte 0x01 (list) 14837>0x00003B byte 0x02 (matrix) 14838>0x00003B byte 0x03 (Y-variable) 14839>0x00003B byte 0x05 (program) 14840>0x00003B byte 0x06 (protected prgm) 14841>0x00003B byte 0x07 (picture) 14842>0x00003B byte 0x08 (gdb) 14843>0x00003B byte 0x0B (window settings) 14844>0x00003B byte 0x0C (window settings) 14845>0x00003B byte 0x0D (table setup) 14846>0x00003B byte 0x0E (screenshot) 14847>0x00003B byte 0x0F (backup) 14848# 14849# Magic Numbers for the TI-83 14850# 148510 string **TI83** TI-83 Graphing Calculator 14852>0x00003B byte 0x00 (real) 14853>0x00003B byte 0x01 (list) 14854>0x00003B byte 0x02 (matrix) 14855>0x00003B byte 0x03 (Y-variable) 14856>0x00003B byte 0x04 (string) 14857>0x00003B byte 0x05 (program) 14858>0x00003B byte 0x06 (protected prgm) 14859>0x00003B byte 0x07 (picture) 14860>0x00003B byte 0x08 (gdb) 14861>0x00003B byte 0x0B (window settings) 14862>0x00003B byte 0x0C (window settings) 14863>0x00003B byte 0x0D (table setup) 14864>0x00003B byte 0x0E (screenshot) 14865>0x00003B byte 0x13 (backup) 14866# 14867# Magic Numbers for the TI-83+ 14868# 148690 string **TI83F* TI-83+ Graphing Calculator 14870>0x00003B byte 0x00 (real number) 14871>0x00003B byte 0x01 (list) 14872>0x00003B byte 0x02 (matrix) 14873>0x00003B byte 0x03 (equation) 14874>0x00003B byte 0x04 (string) 14875>0x00003B byte 0x05 (program) 14876>0x00003B byte 0x06 (assembly program) 14877>0x00003B byte 0x07 (picture) 14878>0x00003B byte 0x08 (gdb) 14879>0x00003B byte 0x0C (complex number) 14880>0x00003B byte 0x0F (window settings) 14881>0x00003B byte 0x10 (zoom) 14882>0x00003B byte 0x11 (table setup) 14883>0x00003B byte 0x13 (backup) 14884>0x00003B byte 0x15 (application variable) 14885>0x00003B byte 0x17 (group of variable) 14886 14887# 14888# Magic Numbers for the TI-85 14889# 148900 string **TI85** TI-85 Graphing Calculator 14891>0x00003B byte 0x00 (real number) 14892>0x00003B byte 0x01 (complex number) 14893>0x00003B byte 0x02 (real vector) 14894>0x00003B byte 0x03 (complex vector) 14895>0x00003B byte 0x04 (real list) 14896>0x00003B byte 0x05 (complex list) 14897>0x00003B byte 0x06 (real matrix) 14898>0x00003B byte 0x07 (complex matrix) 14899>0x00003B byte 0x08 (real constant) 14900>0x00003B byte 0x09 (complex constant) 14901>0x00003B byte 0x0A (equation) 14902>0x00003B byte 0x0C (string) 14903>0x00003B byte 0x0D (function GDB) 14904>0x00003B byte 0x0E (polar GDB) 14905>0x00003B byte 0x0F (parametric GDB) 14906>0x00003B byte 0x10 (diffeq GDB) 14907>0x00003B byte 0x11 (picture) 14908>0x00003B byte 0x12 (program) 14909>0x00003B byte 0x13 (range) 14910>0x00003B byte 0x17 (window settings) 14911>0x00003B byte 0x18 (window settings) 14912>0x00003B byte 0x19 (window settings) 14913>0x00003B byte 0x1A (window settings) 14914>0x00003B byte 0x1B (zoom) 14915>0x00003B byte 0x1D (backup) 14916>0x00003B byte 0x1E (unknown) 14917>0x00003B byte 0x2A (equation) 14918>0x000032 string ZS4 - ZShell Version 4 File. 14919>0x000032 string ZS3 - ZShell Version 3 File. 14920# 14921# Magic Numbers for the TI-86 14922# 149230 string **TI86** TI-86 Graphing Calculator 14924>0x00003B byte 0x00 (real number) 14925>0x00003B byte 0x01 (complex number) 14926>0x00003B byte 0x02 (real vector) 14927>0x00003B byte 0x03 (complex vector) 14928>0x00003B byte 0x04 (real list) 14929>0x00003B byte 0x05 (complex list) 14930>0x00003B byte 0x06 (real matrix) 14931>0x00003B byte 0x07 (complex matrix) 14932>0x00003B byte 0x08 (real constant) 14933>0x00003B byte 0x09 (complex constant) 14934>0x00003B byte 0x0A (equation) 14935>0x00003B byte 0x0C (string) 14936>0x00003B byte 0x0D (function GDB) 14937>0x00003B byte 0x0E (polar GDB) 14938>0x00003B byte 0x0F (parametric GDB) 14939>0x00003B byte 0x10 (diffeq GDB) 14940>0x00003B byte 0x11 (picture) 14941>0x00003B byte 0x12 (program) 14942>0x00003B byte 0x13 (range) 14943>0x00003B byte 0x17 (window settings) 14944>0x00003B byte 0x18 (window settings) 14945>0x00003B byte 0x19 (window settings) 14946>0x00003B byte 0x1A (window settings) 14947>0x00003B byte 0x1B (zoom) 14948>0x00003B byte 0x1D (backup) 14949>0x00003B byte 0x1E (unknown) 14950>0x00003B byte 0x2A (equation) 14951# 14952# Magic Numbers for the TI-89 14953# 149540 string **TI89** TI-89 Graphing Calculator 14955>0x000048 byte 0x00 (expression) 14956>0x000048 byte 0x04 (list) 14957>0x000048 byte 0x06 (matrix) 14958>0x000048 byte 0x0A (data) 14959>0x000048 byte 0x0B (text) 14960>0x000048 byte 0x0C (string) 14961>0x000048 byte 0x0D (graphic data base) 14962>0x000048 byte 0x0E (figure) 14963>0x000048 byte 0x10 (picture) 14964>0x000048 byte 0x12 (program) 14965>0x000048 byte 0x13 (function) 14966>0x000048 byte 0x14 (macro) 14967>0x000048 byte 0x1C (zipped) 14968>0x000048 byte 0x21 (assembler) 14969# 14970# Magic Numbers for the TI-92 14971# 149720 string **TI92** TI-92 Graphing Calculator 14973>0x000048 byte 0x00 (expression) 14974>0x000048 byte 0x04 (list) 14975>0x000048 byte 0x06 (matrix) 14976>0x000048 byte 0x0A (data) 14977>0x000048 byte 0x0B (text) 14978>0x000048 byte 0x0C (string) 14979>0x000048 byte 0x0D (graphic data base) 14980>0x000048 byte 0x0E (figure) 14981>0x000048 byte 0x10 (picture) 14982>0x000048 byte 0x12 (program) 14983>0x000048 byte 0x13 (function) 14984>0x000048 byte 0x14 (macro) 14985>0x000048 byte 0x1D (backup) 14986# 14987# Magic Numbers for the TI-92+/V200 14988# 149890 string **TI92P* TI-92+/V200 Graphing Calculator 14990>0x000048 byte 0x00 (expression) 14991>0x000048 byte 0x04 (list) 14992>0x000048 byte 0x06 (matrix) 14993>0x000048 byte 0x0A (data) 14994>0x000048 byte 0x0B (text) 14995>0x000048 byte 0x0C (string) 14996>0x000048 byte 0x0D (graphic data base) 14997>0x000048 byte 0x0E (figure) 14998>0x000048 byte 0x10 (picture) 14999>0x000048 byte 0x12 (program) 15000>0x000048 byte 0x13 (function) 15001>0x000048 byte 0x14 (macro) 15002>0x000048 byte 0x1C (zipped) 15003>0x000048 byte 0x21 (assembler) 15004# 15005# Magic Numbers for the TI-73/83+/89/92+/V200 FLASH upgrades 15006# 150070x0000016 string Advanced TI-XX Graphing Calculator (FLASH) 150080 string **TIFL** TI-XX Graphing Calculator (FLASH) 15009>8 byte >0 - Revision %d 15010>>9 byte x \b.%d, 15011>12 byte >0 Revision date %02x 15012>>13 byte x \b/%02x 15013>>14 beshort x \b/%04x, 15014>17 string >/0 name: '%s', 15015>48 byte 0x74 device: TI-73, 15016>48 byte 0x73 device: TI-83+, 15017>48 byte 0x98 device: TI-89, 15018>48 byte 0x88 device: TI-92+, 15019>49 byte 0x23 type: OS upgrade, 15020>49 byte 0x24 type: application, 15021>49 byte 0x25 type: certificate, 15022>49 byte 0x3e type: license, 15023>74 lelong >0 size: %ld bytes 15024 15025# VTi & TiEmu skins (TI Graphing Calculators). 15026# From: Romain Lievin (roms@lpg.ticalc.org). 15027# Magic Numbers for the VTi skins 150280 string VTI Virtual TI skin 15029>3 string v - Version 15030>>4 byte >0 \b %c 15031>>6 byte x \b.%c 15032# Magic Numbers for the TiEmu skins 150330 string TiEmu TiEmu skin 15034>6 string v - Version 15035>>7 byte >0 \b %c 15036>>9 byte x \b.%c 15037>>10 byte x \b%c 15038 15039#------------------------------------------------------------------------------ 15040# $File: timezone,v 1.11 2009/09/19 16:28:12 christos Exp $ 15041# timezone: file(1) magic for timezone data 15042# 15043# from Daniel Quinlan (quinlan@yggdrasil.com) 15044# this should work on Linux, SunOS, and maybe others 15045# Added new official magic number for recent versions of the Olson code 150460 string TZif timezone data 15047>4 byte 0 \b, old version 15048>4 byte >0 \b, version %c 15049>20 belong 0 \b, no gmt time flags 15050>20 belong 1 \b, 1 gmt time flag 15051>20 belong >1 \b, %d gmt time flags 15052>24 belong 0 \b, no std time flags 15053>20 belong 1 \b, 1 std time flag 15054>24 belong >1 \b, %d std time flags 15055>28 belong 0 \b, no leap seconds 15056>28 belong 1 \b, 1 leap second 15057>28 belong >1 \b, %d leap seconds 15058>32 belong 0 \b, no transition times 15059>32 belong 1 \b, 1 transition time 15060>32 belong >1 \b, %d transition times 15061>36 belong 0 \b, no abbreviation chars 15062>36 belong 1 \b, 1 abbreviation char 15063>36 belong >1 \b, %d abbreviation chars 150640 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0 old timezone data 150650 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0 old timezone data 150660 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0 old timezone data 150670 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0 old timezone data 150680 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0 old timezone data 150690 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0 old timezone data 15070 15071#------------------------------------------------------------------------------ 15072# $File: troff,v 1.10 2009/09/19 16:28:12 christos Exp $ 15073# troff: file(1) magic for *roff 15074# 15075# updated by Daniel Quinlan (quinlan@yggdrasil.com) 15076 15077# troff input 150780 search/1 .\\" troff or preprocessor input text 15079!:mime text/troff 150800 search/1 '\\" troff or preprocessor input text 15081!:mime text/troff 150820 search/1 '.\\" troff or preprocessor input text 15083!:mime text/troff 150840 search/1 \\" troff or preprocessor input text 15085!:mime text/troff 150860 search/1 ''' troff or preprocessor input text 15087!:mime text/troff 150880 regex/20 \^\\.[A-Za-z0-9][A-Za-z0-9][\ \t] troff or preprocessor input text 15089!:mime text/troff 150900 regex/20 \^\\.[A-Za-z0-9][A-Za-z0-9]$ troff or preprocessor input text 15091!:mime text/troff 15092 15093# ditroff intermediate output text 150940 search/1 x\ T ditroff output text 15095>4 search/1 cat for the C/A/T phototypesetter 15096>4 search/1 ps for PostScript 15097>4 search/1 dvi for DVI 15098>4 search/1 ascii for ASCII 15099>4 search/1 lj4 for LaserJet 4 15100>4 search/1 latin1 for ISO 8859-1 (Latin 1) 15101>4 search/1 X75 for xditview at 75dpi 15102>>7 search/1 -12 (12pt) 15103>4 search/1 X100 for xditview at 100dpi 15104>>8 search/1 -12 (12pt) 15105 15106# output data formats 151070 string \100\357 very old (C/A/T) troff output data 15108 15109#------------------------------------------------------------------------------ 15110# $File: tuxedo,v 1.4 2009/09/19 16:28:13 christos Exp $ 15111# tuxedo: file(1) magic for BEA TUXEDO data files 15112# 15113# from Ian Springer <ispringer@hotmail.com> 15114# 151150 string \0\0\1\236\0\0\0\0\0\0\0\0\0\0\0\0 BEA TUXEDO DES mask data 15116 15117#------------------------------------------------------------------------------ 15118# $File: typeset,v 1.8 2009/09/19 16:28:13 christos Exp $ 15119# typeset: file(1) magic for other typesetting 15120# 151210 string Interpress/Xerox Xerox InterPress data 15122>16 string / (version 15123>>17 string >\0 %s) 15124 15125#------------------------------------------------------------------------------ 15126# $File: unicode,v 1.5 2009/09/19 16:28:13 christos Exp $ 15127# Unicode: BOM prefixed text files - Adrian Havill <havill@turbolinux.co.jp> 15128# GRR: These types should be recognised in file_ascmagic so these 15129# encodings can be treated by text patterns. 15130# Missing types are already dealt with internally. 15131# 151320 string +/v8 Unicode text, UTF-7 151330 string +/v9 Unicode text, UTF-7 151340 string +/v+ Unicode text, UTF-7 151350 string +/v/ Unicode text, UTF-7 151360 string \335\163\146\163 Unicode text, UTF-8-EBCDIC 151370 string \000\000\376\377 Unicode text, UTF-32, big-endian 151380 string \377\376\000\000 Unicode text, UTF-32, little-endian 151390 string \016\376\377 Unicode text, SCSU (Standard Compression Scheme for Unicode) 15140 15141#------------------------------------------------------------------------------ 15142# $File: unknown,v 1.7 2009/09/19 16:28:13 christos Exp $ 15143# unknown: file(1) magic for unknown machines 15144# 15145# XXX - this probably should be pruned, as it'll match PDP-11 and 15146# VAX image formats. 15147# 15148# 0x107 is 0407; 0x108 is 0410; both are PDP-11 (executable and pure, 15149# respectively). 15150# 15151# 0x109 is 0411; that's PDP-11 split I&D, but the PDP-11 version doesn't 15152# have the "version %ld", which may be a bogus COFFism (I don't think 15153# there ever was COFF for the PDP-11). 15154# 15155# 0x10B is 0413; that's VAX demand-paged, but this is a short, not a 15156# long, as it would be on a VAX. 15157# 15158# 0x10C is 0414 and 0x10E is 416; those *are* unknown. 15159# 151600 short 0x107 unknown machine executable 15161>8 short >0 not stripped 15162>15 byte >0 - version %ld 151630 short 0x108 unknown pure executable 15164>8 short >0 not stripped 15165>15 byte >0 - version %ld 151660 short 0x109 PDP-11 separate I&D 15167>8 short >0 not stripped 15168>15 byte >0 - version %ld 151690 short 0x10b unknown pure executable 15170>8 short >0 not stripped 15171>15 byte >0 - version %ld 151720 long 0x10c unknown demand paged pure executable 15173>16 long >0 not stripped 151740 long 0x10e unknown readable demand paged pure executable 15175 15176#------------------------------------------------------------------------------ 15177# $File: uuencode,v 1.7 2009/09/19 16:28:13 christos Exp $ 15178# uuencode: file(1) magic for ASCII-encoded files 15179# 15180 15181# GRR: the first line of xxencoded files is identical to that in uuencoded 15182# files, but the first character in most subsequent lines is 'h' instead of 15183# 'M'. (xxencoding uses lowercase letters in place of most of uuencode's 15184# punctuation and survives BITNET gateways better.) If regular expressions 15185# were supported, this entry could possibly be split into two with 15186# "begin\040\.\*\012M" or "begin\040\.\*\012h" (where \. and \* are REs). 151870 search/1 begin\ uuencoded or xxencoded text 15188 15189# btoa(1) is an alternative to uuencode that requires less space. 151900 search/1 xbtoa\ Begin btoa'd text 15191 15192# ship(1) is another, much cooler alternative to uuencode. 15193# Greg Roelofs, newt@uchicago.edu 151940 search/1 $\012ship ship'd binary text 15195 15196# bencode(8) is used to encode compressed news batches (Bnews/Cnews only?) 15197# Greg Roelofs, newt@uchicago.edu 151980 search/1 Decode\ the\ following\ with\ bdeco bencoded News text 15199 15200# BinHex is the Macintosh ASCII-encoded file format (see also "apple") 15201# Daniel Quinlan, quinlan@yggdrasil.com 1520211 search/1 must\ be\ converted\ with\ BinHex BinHex binary text 15203>41 search/1 x \b, version %.3s 15204 15205# GRR: handle BASE64 15206 15207#------------------------------------------------------------------------------ 15208# $File: varied.out,v 1.21 2009/09/19 16:28:13 christos Exp $ 15209# varied.out: file(1) magic for various USG systems 15210# 15211# Herewith many of the object file formats used by USG systems. 15212# Most have been moved to files for a particular processor, 15213# and deleted if they duplicate other entries. 15214# 152150 short 0610 Perkin-Elmer executable 15216# AMD 29K 152170 beshort 0572 amd 29k coff noprebar executable 152180 beshort 01572 amd 29k coff prebar executable 152190 beshort 0160007 amd 29k coff archive 15220# Cray 152216 beshort 0407 unicos (cray) executable 15222# Ultrix 4.3 15223596 string \130\337\377\377 Ultrix core file 15224>600 string >\0 from '%s' 15225# BeOS and MAcOS PEF executables 15226# From: hplus@zilker.net (Jon Watte) 152270 string Joy!peffpwpc header for PowerPC PEF executable 15228# 15229# ava assembler/linker Uros Platise <uros.platise@ijs.si> 152300 string avaobj AVR assembler object code 15231>7 string >\0 version '%s' 15232# gnu gmon magic From: Eugen Dedu <dedu@ese-metz.fr> 152330 string gmon GNU prof performance data 15234>4 long x - version %ld 15235# From: Dave Pearson <davep@davep.org> 15236# Harbour <URL:http://www.harbour-project.org/> HRB files. 152370 string \xc0HRB Harbour HRB file 15238>4 short x version %d 15239 15240# From: Alex Beregszaszi <alex@fsn.hu> 15241# 0 string exec BugOS executable 15242# 0 string pack BugOS archive 15243 15244# From: Jason Spence <jspence@lightconsulting.com> 15245# Generated by the "examples" in STM's ST40 devkit, and derived code. 152460 lelong 0x13a9f17e ST40 component image format 15247>4 string >\0 \b, name '%s' 15248 15249 15250#------------------------------------------------------------------------------ 15251# $File: varied.script,v 1.6 2009/09/19 16:28:13 christos Exp $ 15252# varied.script: file(1) magic for various interpreter scripts 15253 152540 string #!\ / a 15255>3 string >\0 %s script text executable 152560 string #!\t/ a 15257>3 string >\0 %s script text executable 152580 string #!/ a 15259>2 string >\0 %s script text executable 152600 string #!\ script text executable 15261>3 string >\0 for %s 15262 15263# From: arno <arenevier@fdn.fr> 15264# mozilla xpconnect typelib 15265# see http://www.mozilla.org/scriptable/typelib_file.html 152660 string XPCOM\nTypeLib\r\n\032 XPConnect Typelib 15267>0x10 byte x version %d 15268>>0x11 byte x \b.%d 15269 15270#------------------------------------------------------------------------------ 15271# $File: vax,v 1.7 2009/09/19 16:28:13 christos Exp $ 15272# vax: file(1) magic for VAX executable/object and APL workspace 15273# 152740 lelong 0101557 VAX single precision APL workspace 152750 lelong 0101556 VAX double precision APL workspace 15276 15277# 15278# VAX a.out (32V, BSD) 15279# 152800 lelong 0407 VAX executable 15281>16 lelong >0 not stripped 15282 152830 lelong 0410 VAX pure executable 15284>16 lelong >0 not stripped 15285 152860 lelong 0413 VAX demand paged pure executable 15287>16 lelong >0 not stripped 15288 152890 lelong 0420 VAX demand paged (first page unmapped) pure executable 15290>16 lelong >0 not stripped 15291 15292# 15293# VAX COFF 15294# 15295# The `versions' should be un-commented if they work for you. 15296# (Was the problem just one of endianness?) 15297# 152980 leshort 0570 VAX COFF executable 15299>12 lelong >0 not stripped 15300>22 leshort >0 - version %ld 153010 leshort 0575 VAX COFF pure executable 15302>12 lelong >0 not stripped 15303>22 leshort >0 - version %ld 15304 15305#------------------------------------------------------------------------------ 15306# $File: vicar,v 1.4 2009/09/19 16:28:13 christos Exp $ 15307# vicar: file(1) magic for VICAR files. 15308# 15309# From: Ossama Othman <othman@astrosun.tn.cornell.edu 15310# VICAR is JPL's in-house spacecraft image processing program 15311# VICAR image 153120 string LBLSIZE= VICAR image data 15313>32 string BYTE \b, 8 bits = VAX byte 15314>32 string HALF \b, 16 bits = VAX word = Fortran INTEGER*2 15315>32 string FULL \b, 32 bits = VAX longword = Fortran INTEGER*4 15316>32 string REAL \b, 32 bits = VAX longword = Fortran REAL*4 15317>32 string DOUB \b, 64 bits = VAX quadword = Fortran REAL*8 15318>32 string COMPLEX \b, 64 bits = VAX quadword = Fortran COMPLEX*8 15319# VICAR label file 1532043 string SFDU_LABEL VICAR label file 15321 15322#------------------------------------------------------------------------------ 15323# $File: virtual,v 1.1 2009/12/25 16:04:30 christos Exp $ 15324# From: James Nobis <quel@quelrod.net> 15325# Microsoft hard disk images for: 15326# Virtual Server 15327# Virtual PC 15328# http://technet.microsoft.com/en-us/virtualserver/bb676673.aspx 15329# .vhd 153300 string conectix Microsoft Disk Image, Virtual Server or Virtual PC 15331 15332# Sun xVM VirtualBox Disk Image 15333# string <<< Sun xVM VirtualBox Disk Image >>> 15334# .vdi 153350 string \<\<\<\ Sun\ xVM\ VirtualBox\ Disk Sun xVM VirtualBox Disk Image 15336 15337 15338 15339#------------------------------------------------------------------------------ 15340# $File: virtutech,v 1.4 2009/09/19 16:28:13 christos Exp $ 15341# Virtutech Compressed Random Access File Format 15342# 15343# From <gustav@virtutech.com> 153440 string \211\277\036\203 Virtutech CRAFF 15345>4 belong x v%d 15346>20 belong 0 uncompressed 15347>20 belong 1 bzipp2ed 15348>20 belong 2 gzipped 15349>24 belong 0 not clean 15350 15351#------------------------------------------------------------------------------ 15352# $File: visx,v 1.5 2009/09/19 16:28:13 christos Exp $ 15353# visx: file(1) magic for Visx format files 15354# 153550 short 0x5555 VISX image file 15356>2 byte 0 (zero) 15357>2 byte 1 (unsigned char) 15358>2 byte 2 (short integer) 15359>2 byte 3 (float 32) 15360>2 byte 4 (float 64) 15361>2 byte 5 (signed char) 15362>2 byte 6 (bit-plane) 15363>2 byte 7 (classes) 15364>2 byte 8 (statistics) 15365>2 byte 10 (ascii text) 15366>2 byte 15 (image segments) 15367>2 byte 100 (image set) 15368>2 byte 101 (unsigned char vector) 15369>2 byte 102 (short integer vector) 15370>2 byte 103 (float 32 vector) 15371>2 byte 104 (float 64 vector) 15372>2 byte 105 (signed char vector) 15373>2 byte 106 (bit plane vector) 15374>2 byte 121 (feature vector) 15375>2 byte 122 (feature vector library) 15376>2 byte 124 (chain code) 15377>2 byte 126 (bit vector) 15378>2 byte 130 (graph) 15379>2 byte 131 (adjacency graph) 15380>2 byte 132 (adjacency graph library) 15381>2 string .VISIX (ascii text) 15382 15383#------------------------------------------------------------------------------ 15384# $File: vms,v 1.6 2009/09/19 16:28:13 christos Exp $ 15385# vms: file(1) magic for VMS executables (experimental) 15386# 15387# VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu) 15388 15389# GRR 950122: I'm just guessing on these, based on inspection of the headers 15390# of three executables each for Alpha and VAX architectures. The VAX files 15391# all had headers similar to this: 15392# 15393# 00000 b0 00 30 00 44 00 60 00 00 00 00 00 30 32 30 35 ..0.D.`.....0205 15394# 00010 01 01 00 00 ff ff ff ff ff ff ff ff 00 00 00 00 ................ 15395# 153960 string \xb0\0\x30\0 VMS VAX executable 15397>44032 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption 15398# 15399# The AXP files all looked like this, except that the byte at offset 0x22 15400# was 06 in some of them and 07 in others: 15401# 15402# 00000 03 00 00 00 00 00 00 00 ec 02 00 00 10 01 00 00 ................ 15403# 00010 68 00 00 00 98 00 00 00 b8 00 00 00 00 00 00 00 h............... 15404# 00020 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 15405# 00030 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................ 15406# 00040 00 00 00 00 ff ff ff ff ff ff ff ff 02 00 00 00 ................ 15407# 154080 belong 0x03000000 VMS Alpha executable 15409>75264 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption 15410 15411#------------------------------------------------------------------------------ 15412# $File: vmware,v 1.7 2009/09/19 16:28:13 christos Exp $ 15413# VMware specific files (deducted from version 1.1 and log file entries) 15414# Anthon van der Neut (anthon@mnt.org) 154150 belong 0x4d52564e VMware nvram 15416 15417#------------------------------------------------------------------------------ 15418# $File: vorbis,v 1.16 2009/09/19 16:28:13 christos Exp $ 15419# vorbis: file(1) magic for Ogg/Vorbis files 15420# 15421# From Felix von Leitner <leitner@fefe.de> 15422# Extended by Beni Cherniavsky <cben@crosswinds.net> 15423# Further extended by Greg Wooledge <greg@wooledge.org> 15424# 15425# Most (everything but the number of channels and bitrate) is commented 15426# out with `##' as it's not interesting to the average user. The most 15427# probable things advanced users would want to uncomment are probably 15428# the number of comments and the encoder version. 15429# 15430# FIXME: The first match has been made a search, so that it can skip 15431# over prepended ID3 tags. This will work for MIME type detection, but 15432# won't work for detecting other properties of the file (they all need 15433# to be made relative to the search). In any case, if the file has ID3 15434# tags, the ID3 information will be printed, not the Ogg information, 15435# so until that's fixed, this doesn't matter. 15436# FIXME[2]: Disable the above for now, since search assumes text mode. 15437# 15438# --- Ogg Framing --- 15439#0 search/1000 OggS Ogg data 154400 string OggS Ogg data 15441!:mime application/ogg 15442>4 byte !0 UNKNOWN REVISION %u 15443##>4 byte 0 revision 0 15444>4 byte 0 15445##>>14 lelong x (Serial %lX) 15446# non-Vorbis content: FLAC (Free Lossless Audio Codec, http://flac.sourceforge.net) 15447>>28 string \x7fFLAC \b, FLAC audio 15448# non-Vorbis content: Theora 15449>>28 string \x80theora \b, Theora video 15450# non-Vorbis content: Kate 15451>>28 string \x80kate\0\0\0\0 \b, Kate 15452>>>37 ubyte x v%u 15453>>>38 ubyte x \b.%u, 15454>>>40 byte 0 utf8 encoding, 15455>>>40 byte !0 unknown character encoding, 15456>>>60 string >\0 language %s, 15457>>>60 string \0 no language set, 15458>>>76 string >\0 category %s 15459>>>76 string \0 no category set 15460# non-Vorbis content: Skeleton 15461>>28 string fishead\0 \b, Skeleton 15462>>>36 short x v%u 15463>>>40 short x \b.%u 15464# non-Vorbis content: Speex 15465>>28 string Speex\ \ \ \b, Speex audio 15466# non-Vorbis content: OGM 15467>>28 string \x01video\0\0\0 \b, OGM video 15468>>>37 string/c div3 (DivX 3) 15469>>>37 string/c divx (DivX 4) 15470>>>37 string/c dx50 (DivX 5) 15471>>>37 string/c xvid (XviD) 15472# --- First vorbis packet - general header --- 15473>>28 string \x01vorbis \b, Vorbis audio, 15474>>>35 lelong !0 UNKNOWN VERSION %lu, 15475##>>>35 lelong 0 version 0, 15476>>>35 lelong 0 15477>>>>39 ubyte 1 mono, 15478>>>>39 ubyte 2 stereo, 15479>>>>39 ubyte >2 %u channels, 15480>>>>40 lelong x %lu Hz 15481# Minimal, nominal and maximal bitrates specified when encoding 15482>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff \b, 15483# The above tests if at least one of these is specified: 15484>>>>>52 lelong !-1 15485# Vorbis RC2 has a bug which puts -1000 in the min/max bitrate fields 15486# instead of -1. 15487# Vorbis 1.0 uses 0 instead of -1. 15488>>>>>>52 lelong !0 15489>>>>>>>52 lelong !-1000 15490>>>>>>>>52 lelong x <%lu 15491>>>>>48 lelong !-1 15492>>>>>>48 lelong x ~%lu 15493>>>>>44 lelong !-1 15494>>>>>>44 lelong !-1000 15495>>>>>>>44 lelong !0 15496>>>>>>>>44 lelong x >%lu 15497>>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff bps 15498# -- Second vorbis header packet - the comments 15499# A kludge to read the vendor string. It's a counted string, not a 15500# zero-terminated one, so file(1) can't read it in a generic way. 15501# libVorbis is the only one existing currently, so I detect specifically 15502# it. The interesting value is the cvs date (8 digits decimal). 15503# Post-RC1 Ogg files have the second header packet (and thus the version) 15504# in a different place, so we must use an indirect offset. 15505>>>(84.b+85) string \x03vorbis 15506>>>>(84.b+96) string/c Xiphophorus\ libVorbis\ I \b, created by: Xiphophorus libVorbis I 15507>>>>>(84.b+120) string >00000000 15508# Map to beta version numbers: 15509>>>>>>(84.b+120) string <20000508 (<beta1, prepublic) 15510>>>>>>(84.b+120) string 20000508 (1.0 beta 1 or beta 2) 15511>>>>>>(84.b+120) string >20000508 15512>>>>>>>(84.b+120) string <20001031 (beta2-3) 15513>>>>>>(84.b+120) string 20001031 (1.0 beta 3) 15514>>>>>>(84.b+120) string >20001031 15515>>>>>>>(84.b+120) string <20010225 (beta3-4) 15516>>>>>>(84.b+120) string 20010225 (1.0 beta 4) 15517>>>>>>(84.b+120) string >20010225 15518>>>>>>>(84.b+120) string <20010615 (beta4-RC1) 15519>>>>>>(84.b+120) string 20010615 (1.0 RC1) 15520>>>>>>(84.b+120) string 20010813 (1.0 RC2) 15521>>>>>>(84.b+120) string 20010816 (RC2 - Garf tuned v1) 15522>>>>>>(84.b+120) string 20011014 (RC2 - Garf tuned v2) 15523>>>>>>(84.b+120) string 20011217 (1.0 RC3) 15524>>>>>>(84.b+120) string 20011231 (1.0 RC3) 15525# Some pre-1.0 CVS snapshots still had "Xiphphorus"... 15526>>>>>>(84.b+120) string >20011231 (pre-1.0 CVS) 15527# For the 1.0 release, Xiphophorus is replaced by Xiph.Org 15528>>>>(84.b+96) string/c Xiph.Org\ libVorbis\ I \b, created by: Xiph.Org libVorbis I 15529>>>>>(84.b+117) string >00000000 15530>>>>>>(84.b+117) string <20020717 (pre-1.0 CVS) 15531>>>>>>(84.b+117) string 20020717 (1.0) 15532>>>>>>(84.b+117) string 20030909 (1.0.1) 15533>>>>>>(84.b+117) string 20040629 (1.1.0 RC1) 15534 15535#------------------------------------------------------------------------------ 15536# $File: vxl,v 1.4 2009/09/19 16:28:13 christos Exp $ 15537# VXL: file(1) magic for VXL binary IO data files 15538# 15539# from Ian Scott <scottim@sf.net> 15540# 15541# VXL is a collection of C++ libraries for Computer Vision. 15542# See the vsl chapter in the VXL Book for more info 15543# http://www.isbe.man.ac.uk/public_vxl_doc/books/vxl/book.html 15544# http:/vxl.sf.net 15545 155462 lelong 0x472b2c4e VXL data file, 15547>0 leshort >0 schema version no %d 15548 15549#------------------------------------------------------------------------------ 15550# $File: warc,v 1.2 2009/09/19 16:28:13 christos Exp $ 15551# warc: file(1) magic for WARC files 15552 155530 string WARC/ WARC Archive 15554>5 string x version %.4s 15555 15556#------------------------------------------------------------------------------ 15557# weak: file(1) magic for very weak magic entries, disabled by default 15558# 15559# These entries are so weak that they might interfere identification of 15560# other formats. Example include: 15561# - Only identify for 1 or 2 bytes 15562# - Match against very wide range of values 15563# - Match against generic word in some spoken languages (e.g. English) 15564 15565# Summary: Computer Graphics Metafile 15566# Extension: .cgm 15567#0 beshort&0xffe0 0x0020 binary Computer Graphics Metafile 15568#0 beshort 0x3020 character Computer Graphics Metafile 15569 15570#0 string =!! Bennet Yee's "face" format 15571 15572#------------------------------------------------------------------------------ 15573# $File: windows,v 1.4 2009/09/19 16:28:13 christos Exp $ 15574# windows: file(1) magic for Microsoft Windows 15575# 15576# This file is mainly reserved for files where programs 15577# using them are run almost always on MS Windows 3.x or 15578# above, or files only used exclusively in Windows OS, 15579# where there is no better category to allocate for. 15580# For example, even though WinZIP almost run on Windows 15581# only, it is better to treat them as "archive" instead. 15582# For format usable in DOS, such as generic executable 15583# format, please specify under "msdos" file. 15584# 15585 15586 15587# Summary: Outlook Express DBX file 15588# Extension: .dbx 15589# Created by: Christophe Monniez 155900 string \xCF\xAD\x12\xFE MS Outlook Express DBX file 15591>4 byte =0xC5 \b, message database 15592>4 byte =0xC6 \b, folder database 15593>4 byte =0xC7 \b, account information 15594>4 byte =0x30 \b, offline database 15595 15596 15597# Summary: Windows crash dump 15598# Extension: .dmp 15599# Created by: Andreas Schuster (http://computer.forensikblog.de/) 15600# Reference (1): http://computer.forensikblog.de/en/2008/02/64bit_magic.html 15601# Modified by (1): Abel Cheung (Avoid match with first 4 bytes only) 156020 string PAGE 15603>4 string DUMP MS Windows 32bit crash dump 15604>>0x05c byte 0 \b, no PAE 15605>>0x05c byte 1 \b, PAE 15606>>0xf88 lelong 1 \b, full dump 15607>>0xf88 lelong 2 \b, kernel dump 15608>>0xf88 lelong 3 \b, small dump 15609>>0x068 lelong x \b, %ld pages 15610>4 string DU64 MS Windows 64bit crash dump 15611>>0xf98 lelong 1 \b, full dump 15612>>0xf98 lelong 2 \b, kernel dump 15613>>0xf98 lelong 3 \b, small dump 15614>>0x090 lequad x \b, %lld pages 15615 15616 15617# Summary: Vista Event Log 15618# Extension: .evtx 15619# Created by: Andreas Schuster (http://computer.forensikblog.de/) 15620# Reference (1): http://computer.forensikblog.de/en/2007/05/some_magic.html 156210 string ElfFile\0 MS Windows Vista Event Log 15622>0x2a leshort x \b, %d chunks 15623>>0x10 lelong x \b (no. %d in use) 15624>0x18 lelong >1 \b, next record no. %d 15625>0x18 lelong =1 \b, empty 15626>0x78 lelong &1 \b, DIRTY 15627>0x78 lelong &2 \b, FULL 15628 15629 15630# Summary: Windows 3.1 group files 15631# Extension: .grp 15632# Created by: unknown 156330 string \120\115\103\103 MS Windows 3.1 group files 15634 15635 15636# Summary: Old format help files 15637# Extension: .hlp 15638# Created by: Dirk Jagdmann <doj@cubic.org> 156390 lelong 0x00035f3f MS Windows 3.x help file 15640 15641 15642# Summary: Hyper terminal 15643# Extension: .ht 15644# Created by: unknown 156450 string HyperTerminal\ 15646>15 string 1.0\ --\ HyperTerminal\ data\ file MS Windows HyperTerminal profile 15647 15648 15649# Summary: Windows shortcut 15650# Extension: .lnk 15651# Created by: unknown 156520 string \114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106 MS Windows shortcut 15653 15654 15655# Summary: Outlook Personal Folders 15656# Created by: unknown 156570 lelong 0x4E444221 Microsoft Outlook email folder 15658>10 leshort 0x0e (<=2002) 15659>10 leshort 0x17 (>=2003) 15660 15661 15662# Summary: Windows help cache 15663# Created by: unknown 156640 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache 15665 15666 15667# Summary: IE cache file 15668# Created by: Christophe Monniez 156690 string Client\ UrlCache\ MMF Internet Explorer cache file 15670>20 string >\0 version %s 15671 15672 15673# Summary: Registry files 15674# Created by: unknown 15675# Modified by (1): Joerg Jenderek 156760 string regf MS Windows registry file, NT/2000 or above 156770 string CREG MS Windows 95/98/ME registry file 156780 string SHCC3 MS Windows 3.1 registry file 15679 15680 15681# Summary: Windows Registry text 15682# Extension: .reg 15683# Submitted by: Abel Cheung <abelcheung@gmail.com> 156840 string REGEDIT4\r\n\r\n Windows Registry text (Win95 or above) 156850 string Windows\ Registry\ Editor\ 15686>&0 string Version\ 5.00\r\n\r\n Windows Registry text (Win2K or above) 15687 15688 15689# From: Pal Tamas <folti@balabit.hu> 15690# Autorun File 156910 string/c [autorun]\r\n Microsoft Windows Autorun file. 15692!:mime application/x-setupscript. 15693 15694#------------------------------------------------------------------------------ 15695# $File: wireless,v 1.2 2009/09/19 16:28:13 christos Exp $ 15696# wireless-regdb: file(1) magic for CRDA wireless-regdb file format 15697# 156980 string RGDB CRDA wireless regulatory database file 15699>4 belong 19 (Version 1) 15700 15701#------------------------------------------------------------------------------ 15702# $File: wordprocessors,v 1.14 2009/09/19 16:28:13 christos Exp $ 15703# wordprocessors: file(1) magic fo word processors. 15704# 15705####### PWP file format used on Smith Corona Personal Word Processors: 157062 string \040\040\040\040\040\040\040\040\040\040\040ML4D\040'92 Smith Corona PWP 15707>24 byte 2 \b, single spaced 15708>24 byte 3 \b, 1.5 spaced 15709>24 byte 4 \b, double spaced 15710>25 byte 0x42 \b, letter 15711>25 byte 0x54 \b, legal 15712>26 byte 0x46 \b, A4 15713 15714#WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE 157150 string \377WPC\020\000\000\000\022\012\001\001\000\000\000\000 (WP) loadable file 15716>15 byte 0 Optimized for Intel 15717>15 byte 1 Optimized for Non-Intel 157181 string WPC (Corel/WP) 15719>8 short 257 WordPerfect macro 15720>8 short 258 WordPerfect help file 15721>8 short 259 WordPerfect keyboard file 15722>8 short 266 WordPerfect document 15723>8 short 267 WordPerfect dictionary 15724>8 short 268 WordPerfect thesaurus 15725>8 short 269 WordPerfect block 15726>8 short 270 WordPerfect rectangular block 15727>8 short 271 WordPerfect column block 15728>8 short 272 WordPerfect printer data 15729>8 short 275 WordPerfect printer data 15730>8 short 276 WordPerfect driver resource data 15731>8 short 279 WordPerfect hyphenation code 15732>8 short 280 WordPerfect hyphenation data 15733>8 short 281 WordPerfect macro resource data 15734>8 short 283 WordPerfect hyphenation lex 15735>8 short 285 WordPerfect wordlist 15736>8 short 286 WordPerfect equation resource data 15737>8 short 289 WordPerfect spell rules 15738>8 short 290 WordPerfect dictionary rules 15739>8 short 295 WordPerfect spell rules (Microlytics) 15740>8 short 299 WordPerfect settings file 15741>8 short 301 WordPerfect 4.2 document 15742>8 short 325 WordPerfect dialog file 15743>8 short 332 WordPerfect button bar 15744>8 short 513 Shell macro 15745>8 short 522 Shell definition 15746>8 short 769 Notebook macro 15747>8 short 770 Notebook help file 15748>8 short 771 Notebook keyboard file 15749>8 short 778 Notebook definition 15750>8 short 1026 Calculator help file 15751>8 short 1538 Calendar help file 15752>8 short 1546 Calendar data file 15753>8 short 1793 Editor macro 15754>8 short 1794 Editor help file 15755>8 short 1795 Editor keyboard file 15756>8 short 1817 Editor macro resource file 15757>8 short 2049 Macro editor macro 15758>8 short 2050 Macro editor help file 15759>8 short 2051 Macro editor keyboard file 15760>8 short 2305 PlanPerfect macro 15761>8 short 2306 PlanPerfect help file 15762>8 short 2307 PlanPerfect keyboard file 15763>8 short 2314 PlanPerfect worksheet 15764>8 short 2319 PlanPerfect printer definition 15765>8 short 2322 PlanPerfect graphic definition 15766>8 short 2323 PlanPerfect data 15767>8 short 2324 PlanPerfect temporary printer 15768>8 short 2329 PlanPerfect macro resource data 15769>8 byte 11 Mail 15770>8 short 2818 help file 15771>8 short 2821 distribution list 15772>8 short 2826 out box 15773>8 short 2827 in box 15774>8 short 2836 users archived mailbox 15775>8 short 2837 archived message database 15776>8 short 2838 archived attachments 15777>8 short 3083 Printer temporary file 15778>8 short 3330 Scheduler help file 15779>8 short 3338 Scheduler in file 15780>8 short 3339 Scheduler out file 15781>8 short 3594 GroupWise settings file 15782>8 short 3601 GroupWise directory services 15783>8 short 3627 GroupWise settings file 15784>8 short 4362 Terminal resource data 15785>8 short 4363 Terminal resource data 15786>8 short 4395 Terminal resource data 15787>8 short 4619 GUI loadable text 15788>8 short 4620 graphics resource data 15789>8 short 4621 printer settings file 15790>8 short 4622 port definition file 15791>8 short 4623 print queue parameters 15792>8 short 4624 compressed file 15793>8 short 5130 Network service msg file 15794>8 short 5131 Network service msg file 15795>8 short 5132 Async gateway login msg 15796>8 short 5134 GroupWise message file 15797>8 short 7956 GroupWise admin domain database 15798>8 short 7957 GroupWise admin host database 15799>8 short 7959 GroupWise admin remote host database 15800>8 short 7960 GroupWise admin ADS deferment data file 15801>8 short 8458 IntelliTAG (SGML) compiled DTD 15802>8 long 18219264 WordPerfect graphic image (1.0) 15803>8 long 18219520 WordPerfect graphic image (2.0) 15804#end of WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE 15805 15806# Hangul (Korean) Word Processor File 158070 string HWP\ Document\ File Hangul (Korean) Word Processor File 3.0 15808# From: Won-Kyu Park <wkpark@kldp.org> 15809512 string R\0o\0o\0t\0 Hangul (Korean) Word Processor File 2000 15810!:mime application/x-hwp 15811 15812# CosmicBook, from Beno�t Rouits 158130 string CSBK Ted Neslson's CosmicBook hypertext file 15814 158152 string EYWR AmigaWriter file 15816 15817# chi: file(1) magic for ChiWriter files 158180 string \\1cw\ ChiWriter file 15819>5 string >\0 version %s 158200 string \\1cw ChiWriter file 15821 15822# Quark Express from http://www.garykessler.net/library/file_sigs.html 158232 string IIXPR3 Intel Quark Express Document (English) 158242 string IIXPRa Intel Quark Express Document (Korean) 158252 string MMXPR3 Motorola Quark Express Document (English) 15826!:mime application/x-quark-xpress-3 158272 string MMXPRa Motorola Quark Express Document (Korean) 15828 15829# adobe indesign (document, whatever...) from querkan 158300 belong 0x0606edf5 Adobe InDesign 15831>16 string DOCUMENT Document 15832 15833#------------------------------------------------------------------------------ 15834# ichitaro456: file(1) magic for Just System Word Processor Ichitaro 15835# 15836# Contributor kenzo-: 15837# Reversed-engineered JS Ichitaro magic numbers 15838# 15839 158400 string DOC 15841>43 byte 0x14 Just System Word Processor Ichitaro v4 15842!:mime application/x-ichitaro4 15843>144 string JDASH application/x-ichitaro4 15844 158450 string DOC 15846>43 byte 0x15 Just System Word Processor Ichitaro v5 15847!:mime application/x-ichitaro5 15848 158490 string DOC 15850>43 byte 0x16 Just System Word Processor Ichitaro v6 15851!:mime application/x-ichitaro6 15852 15853# Type: Freemind mindmap documents 15854# From: Jamie Thompson <debian-bugs@jamie-thompson.co.uk> 158550 string/w \<map\ version Freemind document 15856!:mime application/x-freemind 15857 15858# Type: Scribus 15859# From: Werner Fink <werner@suse.de> 158600 string \<SCRIBUSUTF8\ Version Scribus Document 158610 string \<SCRIBUSUTF8NEW\ Version Scribus Document 15862!:mime application/x-scribus 15863 15864#------------------------------------------------------------------------------ 15865# $File: xdelta,v 1.4 2009/09/19 16:28:13 christos Exp $ 15866# file(1) magic(5) data for xdelta Josh MacDonald <jmacd@CS.Berkeley.EDU> 15867# 158680 string %XDELTA% XDelta binary patch file 0.14 158690 string %XDZ000% XDelta binary patch file 0.18 158700 string %XDZ001% XDelta binary patch file 0.20 158710 string %XDZ002% XDelta binary patch file 1.0 158720 string %XDZ003% XDelta binary patch file 1.0.4 158730 string %XDZ004% XDelta binary patch file 1.1 15874 15875#------------------------------------------------------------------------------ 15876# $File: xenix,v 1.9 2009/09/19 16:28:13 christos Exp $ 15877# xenix: file(1) magic for Microsoft Xenix 15878# 15879# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small 15880# model" lifted from "magic.xenix", with comment "derived empirically; 15881# treat as folklore until proven" 15882# 15883# "small model", "large model", "huge model" stuff lifted from XXX 15884# 15885# XXX - "x.out" collides with PDP-11 archives 15886# 158870 string core core file (Xenix) 158880 byte 0x80 8086 relocatable (Microsoft) 158890 leshort 0xff65 x.out 15890>2 string __.SYMDEF randomized 15891>0 byte x archive 158920 leshort 0x206 Microsoft a.out 15893>8 leshort 1 Middle model 15894>0x1e leshort &0x10 overlay 15895>0x1e leshort &0x2 separate 15896>0x1e leshort &0x4 pure 15897>0x1e leshort &0x800 segmented 15898>0x1e leshort &0x400 standalone 15899>0x1e leshort &0x8 fixed-stack 15900>0x1c byte &0x80 byte-swapped 15901>0x1c byte &0x40 word-swapped 15902>0x10 lelong >0 not-stripped 15903>0x1e leshort ^0xc000 pre-SysV 15904>0x1e leshort &0x4000 V2.3 15905>0x1e leshort &0x8000 V3.0 15906>0x1c byte &0x4 86 15907>0x1c byte &0xb 186 15908>0x1c byte &0x9 286 15909>0x1c byte &0xa 386 15910>0x1f byte <0x040 small model 15911>0x1f byte =0x048 large model 15912>0x1f byte =0x049 huge model 15913>0x1e leshort &0x1 executable 15914>0x1e leshort ^0x1 object file 15915>0x1e leshort &0x40 Large Text 15916>0x1e leshort &0x20 Large Data 15917>0x1e leshort &0x120 Huge Objects Enabled 15918>0x10 lelong >0 not stripped 15919 159200 leshort 0x140 old Microsoft 8086 x.out 15921>0x3 byte &0x4 separate 15922>0x3 byte &0x2 pure 15923>0 byte &0x1 executable 15924>0 byte ^0x1 relocatable 15925>0x14 lelong >0 not stripped 15926 159270 lelong 0x206 b.out 15928>0x1e leshort &0x10 overlay 15929>0x1e leshort &0x2 separate 15930>0x1e leshort &0x4 pure 15931>0x1e leshort &0x800 segmented 15932>0x1e leshort &0x400 standalone 15933>0x1e leshort &0x1 executable 15934>0x1e leshort ^0x1 object file 15935>0x1e leshort &0x4000 V2.3 15936>0x1e leshort &0x8000 V3.0 15937>0x1c byte &0x4 86 15938>0x1c byte &0xb 186 15939>0x1c byte &0x9 286 15940>0x1c byte &0x29 286 15941>0x1c byte &0xa 386 15942>0x1e leshort &0x4 Large Text 15943>0x1e leshort &0x2 Large Data 15944>0x1e leshort &0x102 Huge Objects Enabled 15945 159460 leshort 0x580 XENIX 8086 relocatable or 80286 small model 15947 15948#------------------------------------------------------------------------------ 15949# $File: xilinx,v 1.4 2009/09/19 16:28:13 christos Exp $ 15950# This is Aaron's attempt at a MAGIC file for Xilinx .bit files. 15951# Xilinx-Magic@RevRagnarok.com 15952# Got the info from FPGA-FAQ 0026 15953# 15954# First there is the sync header and its length 159550 beshort 0x0009 15956>2 belong =0x0ff00ff0 15957>>&0 belong =0x0ff00ff0 15958>>>&0 beshort =0x0000 15959>>>>&0 pstring a Xilinx BIT data 15960# Next is a Pascal-style string with the NCD name. We want to capture that. 15961>>>>0x0F pstring x - from %s 15962# It is followed by a NUL 15963>>>>>&1 byte 0x00 15964# And then 'b' 15965>>>>>&2 string b 15966# With the part number: 15967#>>>>>&5 string 4v (Virtex4) 15968#>>>>>&5 string 2v (Virtex II 15969#>>>>>>&0 string !p \b) 15970#>>>>>>&0 string p Pro) 15971>>>>>&4 pstring x - for %s 15972# And then NUL / 'c' / Build Data / NUL / 'd' / Date / NUL / 'e' / Data Length 15973>>>>>>&1 byte 0x00 15974>>>>>>&2 string c 15975>>>>>>&4 pstring x - built %s 15976>>>>>>>&1 byte 0x00 15977>>>>>>>&2 string d 15978>>>>>>>&4 pstring x \b(%s) 15979>>>>>>>>&1 byte 0x00 15980>>>>>>>>&2 string e 15981>>>>>>>>&4 belong x - data length 0x%lx 15982 15983#------------------------------------------------------------------------------ 15984# $File: xo65,v 1.4 2009/09/19 16:28:13 christos Exp $ 15985# xo65 object files 15986# From: "Ullrich von Bassewitz" <uz@cc65.org> 15987# 159880 string \x55\x7A\x6E\x61 xo65 object, 15989>4 leshort x version %d, 15990>6 leshort&0x0001 =0x0001 with debug info 15991>6 leshort&0x0001 =0x0000 no debug info 15992 15993# xo65 library files 159940 string \x6E\x61\x55\x7A xo65 library, 15995>4 leshort x version %d 15996 15997# o65 object files 159980 string \x01\x00\x6F\x36\x35 o65 15999>6 leshort&0x1000 =0x0000 executable, 16000>6 leshort&0x1000 =0x1000 object, 16001>5 byte x version %d, 16002>6 leshort&0x8000 =0x8000 65816, 16003>6 leshort&0x8000 =0x0000 6502, 16004>6 leshort&0x2000 =0x2000 32 bit, 16005>6 leshort&0x2000 =0x0000 16 bit, 16006>6 leshort&0x4000 =0x4000 page reloc, 16007>6 leshort&0x4000 =0x0000 byte reloc, 16008>6 leshort&0x0003 =0x0000 alignment 1 16009>6 leshort&0x0003 =0x0001 alignment 2 16010>6 leshort&0x0003 =0x0002 alignment 4 16011>6 leshort&0x0003 =0x0003 alignment 256 16012 16013#------------------------------------------------------------------------------ 16014# $File: xwindows,v 1.6 2009/09/19 16:28:13 christos Exp $ 16015# xwindows: file(1) magic for various X/Window system file formats. 16016 16017# Compiled X Keymap 16018# XKM (compiled X keymap) files (including version and byte ordering) 160191 string mkx Compiled XKB Keymap: lsb, 16020>0 byte >0 version %d 16021>0 byte =0 obsolete 160220 string xkm Compiled XKB Keymap: msb, 16023>3 byte >0 version %d 16024>0 byte =0 obsolete 16025 16026# xfsdump archive 160270 string xFSdump0 xfsdump archive 16028>8 belong x (version %d) 16029 16030# Jaleo XFS files 160310 long 395726 Jaleo XFS file 16032>4 long x - version %ld 16033>8 long x - [%ld - 16034>20 long x %ldx 16035>24 long x %ldx 16036>28 long 1008 YUV422] 16037>28 long 1000 RGB24] 16038 16039# Xcursor data 16040# X11 mouse cursor format defined in libXcursor, see 16041# http://www.x.org/archive/X11R6.8.1/doc/Xcursor.3.html 16042# http://cgit.freedesktop.org/xorg/lib/libXcursor/tree/include/X11/Xcursor/Xcursor.h 160430 string Xcur Xcursor data 16044!:mime image/x-xcursor 16045>10 leshort x version %hd 16046>>8 leshort x \b.%hd 16047 16048#------------------------------------------------------------------------------ 16049# $File: zilog,v 1.7 2009/09/19 16:28:13 christos Exp $ 16050# zilog: file(1) magic for Zilog Z8000. 16051# 16052# Was it big-endian or little-endian? My Product Specification doesn't 16053# say. 16054# 160550 long 0xe807 object file (z8000 a.out) 160560 long 0xe808 pure object file (z8000 a.out) 160570 long 0xe809 separate object file (z8000 a.out) 160580 long 0xe805 overlay object file (z8000 a.out) 16059 16060#------------------------------------------------------------------------------ 16061# $File: zyxel,v 1.6 2009/09/19 16:28:13 christos Exp $ 16062# zyxel: file(1) magic for ZyXEL modems 16063# 16064# From <rob@pe1chl.ampr.org> 16065# These are the /etc/magic entries to decode datafiles as used for the 16066# ZyXEL U-1496E DATA/FAX/VOICE modems. (This header conforms to a 16067# ZyXEL-defined standard) 16068 160690 string ZyXEL\002 ZyXEL voice data 16070>10 byte 0 - CELP encoding 16071>10 byte&0x0B 1 - ADPCM2 encoding 16072>10 byte&0x0B 2 - ADPCM3 encoding 16073>10 byte&0x0B 3 - ADPCM4 encoding 16074>10 byte&0x0B 8 - New ADPCM3 encoding 16075>10 byte&0x04 4 with resync 16076
