1# Magic data for file(1) command. 2# Format is described in magic(files), where: 3# files is 5 on V7 and BSD, 4 on SV, and ?? on SVID. 4# Don't edit this file, edit /etc/magic or send your magic improvements 5# to the maintainers, at file@mx.gw.com 6 7#------------------------------------------------------------------------------ 8# Localstuff: file(1) magic for locally observed files 9# 10# $File: Localstuff,v 1.4 2003/03/23 04:17:27 christos Exp $ 11# Add any locally observed files here. Remember: 12# text if readable, executable if runnable binary, data if unreadable. 13 14#------------------------------------------------------------------------------ 15# $File: acorn,v 1.5 2009/09/19 16:28:07 christos Exp $ 16# acorn: file(1) magic for files found on Acorn systems 17# 18 19# RISC OS Chunk File Format 20# From RISC OS Programmer's Reference Manual, Appendix D 21# We guess the file type from the type of the first chunk. 220 lelong 0xc3cbc6c5 RISC OS Chunk data 23>12 string OBJ_ \b, AOF object 24>12 string LIB_ \b, ALF library 25 26# RISC OS AIF, contains "SWI OS_Exit" at offset 16. 2716 lelong 0xef000011 RISC OS AIF executable 28 29# RISC OS Draw files 30# From RISC OS Programmer's Reference Manual, Appendix E 310 string Draw RISC OS Draw file data 32 33# RISC OS new format font files 34# From RISC OS Programmer's Reference Manual, Appendix E 350 string FONT\0 RISC OS outline font data, 36>5 byte x version %d 370 string FONT\1 RISC OS 1bpp font data, 38>5 byte x version %d 390 string FONT\4 RISC OS 4bpp font data 40>5 byte x version %d 41 42# RISC OS Music files 43# From RISC OS Programmer's Reference Manual, Appendix E 440 string Maestro\r RISC OS music file 45>8 byte x version %d 46 47>8 byte x type %d 48 49# Digital Symphony data files 50# From: Bernard Jungen (bern8817@euphonynet.be) 510 string \x02\x01\x13\x13\x13\x01\x0d\x10 Digital Symphony sound sample (RISC OS), 52>8 byte x version %d, 53>9 pstring x named "%s", 54>(9.b+19) byte =0 8-bit logarithmic 55>(9.b+19) byte =1 LZW-compressed linear 56>(9.b+19) byte =2 8-bit linear signed 57>(9.b+19) byte =3 16-bit linear signed 58>(9.b+19) byte =4 SigmaDelta-compressed linear 59>(9.b+19) byte =5 SigmaDelta-compressed logarithmic 60>(9.b+19) byte >5 unknown format 61 620 string \x02\x01\x13\x13\x14\x12\x01\x0b Digital Symphony song (RISC OS), 63>8 byte x version %d, 64>9 byte =1 1 voice, 65>9 byte !1 %d voices, 66>10 leshort =1 1 track, 67>10 leshort !1 %d tracks, 68>12 leshort =1 1 pattern 69>12 leshort !1 %d patterns 70 710 string \x02\x01\x13\x13\x10\x14\x12\x0e 72>9 byte =0 Digital Symphony sequence (RISC OS), 73>>8 byte x version %d, 74>>10 byte =1 1 line, 75>>10 byte !1 %d lines, 76>>11 leshort =1 1 position 77>>11 leshort !1 %d positions 78>9 byte =1 Digital Symphony pattern data (RISC OS), 79>>8 byte x version %d, 80>>10 leshort =1 1 pattern 81>>10 leshort !1 %d patterns 82 83#------------------------------------------------------------------------------ 84# $File: adi,v 1.4 2009/09/19 16:28:07 christos Exp $ 85# adi: file(1) magic for ADi's objects 86# From Gregory McGarry <g.mcgarry@ieee.org> 87# 880 leshort 0x521c COFF DSP21k 89>18 lelong &02 executable, 90>18 lelong ^02 91>>18 lelong &01 static object, 92>>18 lelong ^01 relocatable object, 93>18 lelong &010 stripped 94>18 lelong ^010 not stripped 95 96#------------------------------------------------------------------------------ 97# $File: adventure,v 1.14 2012/06/21 01:32:26 christos Exp $ 98# adventure: file(1) magic for Adventure game files 99# 100# from Allen Garvin <earendil@faeryland.tamu-commerce.edu> 101# Edited by Dave Chapeskie <dchapes@ddm.on.ca> Jun 28, 1998 102# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002 103# 104# ALAN 105# I assume there are other, lower versions, but these are the only ones I 106# saw in the archive. 1070 beshort 0x0206 ALAN game data 108>2 byte <10 version 2.6%d 109 110 111# Infocom (see z-machine) 112#------------------------------------------------------------------------------ 113# Z-machine: file(1) magic for Z-machine binaries. 114# Updated by Adam Buchbinder <adam.buchbinder@gmail.com> 115# 116#http://www.gnelson.demon.co.uk/zspec/sect11.html 117#http://www.jczorkmid.net/~jpenney/ZSpec11-latest.txt 118#http://en.wikipedia.org/wiki/Z-machine 119# The first byte is the Z-machine revision; it is always between 1 and 8. We 120# had false matches (for instance, inbig5.ocp from the Omega TeX extension as 121# well as an occasional MP3 file), so we sanity-check the version number. 122# 123# It might be possible to sanity-check the release number as well, as it seems 124# (at least in classic Infocom games) to always be a relatively small number, 125# always under 150 or so, but as this isn't rigorous, we'll wait on that until 126# it becomes clear that it's needed. 127# 1280 ubyte >0 129>0 ubyte <9 130>>16 belong&0xfe00f0f0 0x3030 131>>>0 ubyte < 10 132>>>>2 ubeshort < 10 133>>>>>18 regex [0-9][0-9][0-9][0-9][0-9][0-9] 134>>>>>>0 ubyte < 10 Infocom (Z-machine %d, 135>>>>>>>2 ubeshort < 10 Release %d / 136>>>>>>>>18 string >\0 Serial %.6s) 137!:strength + 40 138 139#------------------------------------------------------------------------------ 140# Glulx: file(1) magic for Glulx binaries. 141# 142# I haven't checked for false matches yet. 143# 1440 string Glul Glulx game data 145>4 beshort x (Version %d 146>>6 byte x \b.%d 147>>8 byte x \b.%d) 148>36 string Info Compiled by Inform 149 150 151 152# For Quetzal and blorb magic see iff 153 154 155# TADS (Text Adventure Development System) version 2 156# All files are machine-independent (games compile to byte-code) and are tagged 157# with a version string of the form "V2.<digit>.<digit>\0". 158# Game files start with "TADS2 bin\n\r\032\0" then the compiler version. 1590 string TADS2\ bin TADS 160>9 belong !0x0A0D1A00 game data, CORRUPTED 161>9 belong 0x0A0D1A00 162>>13 string >\0 %s game data 163# Resource files start with "TADS2 rsc\n\r\032\0" then the compiler version. 1640 string TADS2\ rsc TADS 165>9 belong !0x0A0D1A00 resource data, CORRUPTED 166>9 belong 0x0A0D1A00 167>>13 string >\0 %s resource data 168# Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian 169# 2-byte length N, the N-char name of the game file *without* a NUL (darn!), 170# "TADS2 save\n\r\032\0" and the interpreter version. 1710 string TADS2\ save/g TADS 172>12 belong !0x0A0D1A00 saved game data, CORRUPTED 173>12 belong 0x0A0D1A00 174>>(16.s+32) string >\0 %s saved game data 175# Other saved game files start with "TADS2 save\n\r\032\0" and the interpreter 176# version. 1770 string TADS2\ save TADS 178>10 belong !0x0A0D1A00 saved game data, CORRUPTED 179>10 belong 0x0A0D1A00 180>>14 string >\0 %s saved game data 181 182# TADS (Text Adventure Development System) version 3 183# Game files start with "T3-image\015\012\032" 1840 string T3-image\015\012\032 185>11 leshort x TADS 3 game data (format version %d) 186# Saved game files start with "T3-state-v####\015\012\032" 187# where #### is a format version number 1880 string T3-state-v 189>14 string \015\012\032 TADS 3 saved game data (format version 190>>10 byte x %c 191>>11 byte x \b%c 192>>12 byte x \b%c 193>>13 byte x \b%c) 194 195# Danny Milosavljevic <danny.milo@gmx.net> 196# this are adrift (adventure game standard) game files, extension .taf 197# depending on version magic continues with 0x93453E6139FA (V 4.0) 198# 0x9445376139FA (V 3.90) 199# 0x9445366139FA (V 3.80) 200# this is from source (http://www.adrift.org.uk/) and I have some taf 201# files, and checked them. 202#0 belong 0x3C423FC9 203#>4 belong 0x6A87C2CF Adrift game file 204#!:mime application/x-adrift 205 206#------------------------------------------------------------------------------ 207# $File: allegro,v 1.4 2009/09/19 16:28:07 christos Exp $ 208# allegro: file(1) magic for Allegro datafiles 209# Toby Deshane <hac@shoelace.digivill.net> 210# 2110 belong 0x736C6821 Allegro datafile (packed) 2120 belong 0x736C682E Allegro datafile (not packed/autodetect) 2130 belong 0x736C682B Allegro datafile (appended exe data) 214 215#------------------------------------------------------------------------------ 216# $File: alliant,v 1.7 2009/09/19 16:28:07 christos Exp $ 217# alliant: file(1) magic for Alliant FX series a.out files 218# 219# If the FX series is the one that had a processor with a 68K-derived 220# instruction set, the "short" should probably become "beshort" and the 221# "long" should probably become "belong". 222# If it's the i860-based one, they should probably become either the 223# big-endian or little-endian versions, depending on the mode they ran 224# the 860 in.... 225# 2260 short 0420 0420 Alliant virtual executable 227>2 short &0x0020 common library 228>16 long >0 not stripped 2290 short 0421 0421 Alliant compact executable 230>2 short &0x0020 common library 231>16 long >0 not stripped 232 233#------------------------------------------------------------------------------ 234# $File: amanda,v 1.5 2009/09/19 16:28:07 christos Exp $ 235# amanda: file(1) magic for amanda file format 236# 2370 string AMANDA:\ AMANDA 238>8 string TAPESTART\ DATE tape header file, 239>>23 string X 240>>>25 string >\ Unused %s 241>>23 string >\ DATE %s 242>8 string FILE\ dump file, 243>>13 string >\ DATE %s 244 245#------------------------------------------------------------------------------ 246# $File: amigaos,v 1.15 2012/06/21 01:13:59 christos Exp $ 247# amigaos: file(1) magic for AmigaOS binary formats: 248 249# 250# From ignatios@cs.uni-bonn.de (Ignatios Souvatzis) 251# 2520 belong 0x000003fa AmigaOS shared library 2530 belong 0x000003f3 AmigaOS loadseg()ble executable/binary 2540 belong 0x000003e7 AmigaOS object/library data 255# 2560 beshort 0xe310 Amiga Workbench 257>2 beshort 1 258>>48 byte 1 disk icon 259>>48 byte 2 drawer icon 260>>48 byte 3 tool icon 261>>48 byte 4 project icon 262>>48 byte 5 garbage icon 263>>48 byte 6 device icon 264>>48 byte 7 kickstart icon 265>>48 byte 8 workbench application icon 266>2 beshort >1 icon, vers. %d 267# 268# various sound formats from the Amiga 269# G=F6tz Waschk <waschk@informatik.uni-rostock.de> 270# 2710 string FC14 Future Composer 1.4 Module sound file 2720 string SMOD Future Composer 1.3 Module sound file 2730 string AON4artofnoise Art Of Noise Module sound file 2741 string MUGICIAN/SOFTEYES Mugician Module sound file 27558 string SIDMON\ II\ -\ THE Sidmon 2.0 Module sound file 2760 string Synth4.0 Synthesis Module sound file 2770 string ARP. The Holy Noise Module sound file 2780 string BeEp\0 JamCracker Module sound file 2790 string COSO\0 Hippel-COSO Module sound file 280# Too simple (short, pure ASCII, deep), MPi 281#26 string V.3 Brian Postma's Soundmon Module sound file v3 282#26 string BPSM Brian Postma's Soundmon Module sound file v3 283#26 string V.2 Brian Postma's Soundmon Module sound file v2 284 285# The following are from: "Stefan A. Haubenthal" <polluks@web.de> 2860 beshort 0x0f00 AmigaOS bitmap font 2870 beshort 0x0f03 AmigaOS outline font 2880 belong 0x80001001 AmigaOS outline tag 2890 string ##\ version catalog translation 2900 string EMOD\0 Amiga E module 2918 string ECXM\0 ECX module 2920 string/c @database AmigaGuide file 293 294# Amiga disk types 295# 2960 string RDSK Rigid Disk Block 297>160 string x on %.24s 2980 string DOS\0 Amiga DOS disk 2990 string DOS\1 Amiga FFS disk 3000 string DOS\2 Amiga Inter DOS disk 3010 string DOS\3 Amiga Inter FFS disk 3020 string DOS\4 Amiga Fastdir DOS disk 3030 string DOS\5 Amiga Fastdir FFS disk 3040 string KICK Kickstart disk 305 306# From: Alex Beregszaszi <alex@fsn.hu> 3070 string LZX LZX compressed archive (Amiga) 308 309# From: Przemek Kramarczyk <pkramarczyk@gmail.com> 3100 string .KEY AmigaDOS script 3110 string .key AmigaDOS script 312 313#------------------------------------------------------------ 314# $File: android,v 1.3 2013/11/08 01:24:22 christos Exp $ 315# Various android related magic entries 316#------------------------------------------------------------ 317 318# Dalvik .dex format. http://retrodev.com/android/dexformat.html 319# From <mkf@google.com> "Mike Fleming" 320# Fixed to avoid regexec 17 errors on some dex files 321# From <diff@lookout.com> "Tim Strazzere" 3220 string dex\n 323>0 regex dex\n[0-9]{2}\0 Dalvik dex file 324>4 string >000 version %s 3250 string dey\n 326>0 regex dey\n[0-9]{2}\0 Dalvik dex file (optimized for host) 327>4 string >000 version %s 328 329# http://android.stackexchange.com/questions/23357/\ 330# is-there-a-way-to-look-inside-and-modify-an-adb-backup-created-file/\ 331# 23608#23608 3320 string ANDROID\040BACKUP\n Android Backup 333>15 string 1\n \b, version 1 334>17 string 0\n \b, uncompressed 335>17 string 1\n \b, compressed 336>19 string none\n \b, unencrypted 337>19 string AES-256\n \b, encrypted AES-256 338 339# Android bootimg format 340# From https://android.googlesource.com/\ 341# platform/system/core/+/master/mkbootimg/bootimg.h 3420 string ANDROID! Android bootimg 343>8 lelong >0 \b, kernel 344>>12 lelong >0 \b (0x%x) 345>16 lelong >0 \b, ramdisk 346>>20 lelong >0 \b (0x%x) 347>24 lelong >0 \b, second stage 348>>28 lelong >0 \b (0x%x) 349>36 lelong >0 \b, page size: %d 350>38 string >0 \b, name: %s 351>64 string >0 \b, cmdline (%s) 352# Dalvik .dex format. http://retrodev.com/android/dexformat.html 353# From <mkf@google.com> "Mike Fleming" 354# Fixed to avoid regexec 17 errors on some dex files 355# From <diff@lookout.com> "Tim Strazzere" 3560 string dex\n 357>0 regex dex\n[0-9]{2}\0 Dalvik dex file 358>4 string >000 version %s 3590 string dey\n 360>0 regex dey\n[0-9]{2}\0 Dalvik dex file (optimized for host) 361>4 string >000 version %s 362 363# http://android.stackexchange.com/questions/23357/\ 364# is-there-a-way-to-look-inside-and-modify-an-adb-backup-created-file/\ 365# 23608#23608 3660 string ANDROID\040BACKUP\n Android Backup 367>15 string 1\n \b, version 1 368>17 string 0\n \b, uncompressed 369>17 string 1\n \b, compressed 370>19 string none\n \b, unencrypted 371>19 string AES-256\n \b, encrypted AES-256 372 373# Android bootimg format 374# From https://android.googlesource.com/\ 375# platform/system/core/+/master/mkbootimg/bootimg.h 3760 string ANDROID! Android bootimg 377>8 lelong >0 \b, kernel 378>>12 lelong >0 \b (0x%x) 379>16 lelong >0 \b, ramdisk 380>>20 lelong >0 \b (0x%x) 381>24 lelong >0 \b, second stage 382>>28 lelong >0 \b (0x%x) 383>36 lelong >0 \b, page size: %d 384>38 string >0 \b, name: %s 385>64 string >0 \b, cmdline (%s) 386 387# Android Backup archive 388# From: Ariel Shkedi 389# File extension: .ab 390# No mime-type defined 391# URL: https://github.com/android/platform_frameworks_base/blob/\ 392# 0bacfd2ba68d21a68a3df345b830bc2a1e515b5a/services/java/com/\ 393# android/server/BackupManagerService.java#L2367 394# After the header comes a tar file 395# If compressed, the entire tar file is compressed with JAVA deflate 396# 397# Include the version number hardcoded with the magic string to avoid 398# false positives 3990 string/b ANDROID\ BACKUP\n1\n Android Backup 400>17 string 0\n \b, Not-Compressed 401>17 string 1\n \b, Compressed 402# any string as long as it's not the word none (which is matched below) 403>>19 regex/1 \^([^n\n]|n[^o]|no[^n]|non[^e]|none.+).* \b, Encrypted (%s) 404>>19 string none\n \b, Not-Encrypted 405# Commented out because they don't seem useful to print 406# (but they are part of the header - the tar file comes after them): 407#>>>&1 regex/1 .* \b, Password salt: %s 408#>>>>&1 regex/1 .* \b, Master salt: %s 409#>>>>>&1 regex/1 .* \b, PBKDF2 rounds: %s 410#>>>>>>&1 regex/1 .* \b, IV: %s 411#>>>>>>>&1 regex/1 .* \b, Key: %s 412 413#------------------------------------------------------------------------------ 414# $File: animation,v 1.49 2013/08/15 13:15:11 christos Exp $ 415# animation: file(1) magic for animation/movie formats 416# 417# animation formats 418# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8) 419# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com) 420 421# SGI and Apple formats 4220 string MOVI Silicon Graphics movie file 423!:mime video/x-sgi-movie 4244 string moov Apple QuickTime 425!:mime video/quicktime 426>12 string mvhd \b movie (fast start) 427>12 string mdra \b URL 428>12 string cmov \b movie (fast start, compressed header) 429>12 string rmra \b multiple URLs 4304 string mdat Apple QuickTime movie (unoptimized) 431!:mime video/quicktime 432#4 string wide Apple QuickTime movie (unoptimized) 433#!:mime video/quicktime 434#4 string skip Apple QuickTime movie (modified) 435#!:mime video/quicktime 436#4 string free Apple QuickTime movie (modified) 437#!:mime video/quicktime 4384 string idsc Apple QuickTime image (fast start) 439!:mime image/x-quicktime 440#4 string idat Apple QuickTime image (unoptimized) 441#!:mime image/x-quicktime 4424 string pckg Apple QuickTime compressed archive 443!:mime application/x-quicktime-player 4444 string/W jP JPEG 2000 image 445!:mime image/jp2 4464 string ftyp ISO Media 447>8 string isom \b, MPEG v4 system, version 1 448!:mime video/mp4 449>8 string iso2 \b, MPEG v4 system, part 12 revision 450>8 string mp41 \b, MPEG v4 system, version 1 451!:mime video/mp4 452>8 string mp42 \b, MPEG v4 system, version 2 453!:mime video/mp4 454>8 string mp7t \b, MPEG v4 system, MPEG v7 XML 455>8 string mp7b \b, MPEG v4 system, MPEG v7 binary XML 456>8 string/W jp2 \b, JPEG 2000 457!:mime image/jp2 458>8 string 3ge \b, MPEG v4 system, 3GPP 459!:mime video/3gpp 460>8 string 3gg \b, MPEG v4 system, 3GPP 461!:mime video/3gpp 462>8 string 3gp \b, MPEG v4 system, 3GPP 463!:mime video/3gpp 464>8 string 3gs \b, MPEG v4 system, 3GPP 465!:mime video/3gpp 466>8 string 3g2 \b, MPEG v4 system, 3GPP2 467!:mime video/3gpp2 468>>11 byte 4 \b v4 (H.263/AMR GSM 6.10) 469>>11 byte 5 \b v5 (H.263/AMR GSM 6.10) 470>>11 byte 6 \b v6 (ITU H.264/AMR GSM 6.10) 471>8 string mmp4 \b, MPEG v4 system, 3GPP Mobile 472!:mime video/mp4 473>8 string avc1 \b, MPEG v4 system, 3GPP JVT AVC 474!:mime video/3gpp 475>8 string/W M4A \b, MPEG v4 system, iTunes AAC-LC 476!:mime audio/mp4 477>8 string/W M4V \b, MPEG v4 system, iTunes AVC-LC 478!:mime video/mp4 479>8 string/W M4P \b, MPEG v4 system, iTunes AES encrypted 480>8 string/W M4B \b, MPEG v4 system, iTunes bookmarked 481>8 string/W qt \b, Apple QuickTime movie 482!:mime video/quicktime 483 484# MPEG sequences 485# Scans for all common MPEG header start codes 4860 belong 0x00000001 487>4 byte&0x1F 0x07 JVT NAL sequence, H.264 video 488>>5 byte 66 \b, baseline 489>>5 byte 77 \b, main 490>>5 byte 88 \b, extended 491>>7 byte x \b @ L %u 4920 belong&0xFFFFFF00 0x00000100 493>3 byte 0xBA MPEG sequence 494!:mime video/mpeg 495>>4 byte &0x40 \b, v2, program multiplex 496>>4 byte ^0x40 \b, v1, system multiplex 497>3 byte 0xBB MPEG sequence, v1/2, multiplex (missing pack header) 498>3 byte&0x1F 0x07 MPEG sequence, H.264 video 499>>4 byte 66 \b, baseline 500>>4 byte 77 \b, main 501>>4 byte 88 \b, extended 502>>6 byte x \b @ L %u 503# GRR too general as it catches also FoxPro Memo example NG.FPT 504>3 byte 0xB0 MPEG sequence, v4 505# TODO: maybe this extra line exclude FoxPro Memo example NG.FPT starting with 000001b0 00000100 00000000 506#>>4 byte !0 MPEG sequence, v4 507!:mime video/mpeg4-generic 508>>5 belong 0x000001B5 509>>>9 byte &0x80 510>>>>10 byte&0xF0 16 \b, video 511>>>>10 byte&0xF0 32 \b, still texture 512>>>>10 byte&0xF0 48 \b, mesh 513>>>>10 byte&0xF0 64 \b, face 514>>>9 byte&0xF8 8 \b, video 515>>>9 byte&0xF8 16 \b, still texture 516>>>9 byte&0xF8 24 \b, mesh 517>>>9 byte&0xF8 32 \b, face 518>>4 byte 1 \b, simple @ L1 519>>4 byte 2 \b, simple @ L2 520>>4 byte 3 \b, simple @ L3 521>>4 byte 4 \b, simple @ L0 522>>4 byte 17 \b, simple scalable @ L1 523>>4 byte 18 \b, simple scalable @ L2 524>>4 byte 33 \b, core @ L1 525>>4 byte 34 \b, core @ L2 526>>4 byte 50 \b, main @ L2 527>>4 byte 51 \b, main @ L3 528>>4 byte 53 \b, main @ L4 529>>4 byte 66 \b, n-bit @ L2 530>>4 byte 81 \b, scalable texture @ L1 531>>4 byte 97 \b, simple face animation @ L1 532>>4 byte 98 \b, simple face animation @ L2 533>>4 byte 99 \b, simple face basic animation @ L1 534>>4 byte 100 \b, simple face basic animation @ L2 535>>4 byte 113 \b, basic animation text @ L1 536>>4 byte 114 \b, basic animation text @ L2 537>>4 byte 129 \b, hybrid @ L1 538>>4 byte 130 \b, hybrid @ L2 539>>4 byte 145 \b, advanced RT simple @ L! 540>>4 byte 146 \b, advanced RT simple @ L2 541>>4 byte 147 \b, advanced RT simple @ L3 542>>4 byte 148 \b, advanced RT simple @ L4 543>>4 byte 161 \b, core scalable @ L1 544>>4 byte 162 \b, core scalable @ L2 545>>4 byte 163 \b, core scalable @ L3 546>>4 byte 177 \b, advanced coding efficiency @ L1 547>>4 byte 178 \b, advanced coding efficiency @ L2 548>>4 byte 179 \b, advanced coding efficiency @ L3 549>>4 byte 180 \b, advanced coding efficiency @ L4 550>>4 byte 193 \b, advanced core @ L1 551>>4 byte 194 \b, advanced core @ L2 552>>4 byte 209 \b, advanced scalable texture @ L1 553>>4 byte 210 \b, advanced scalable texture @ L2 554>>4 byte 211 \b, advanced scalable texture @ L3 555>>4 byte 225 \b, simple studio @ L1 556>>4 byte 226 \b, simple studio @ L2 557>>4 byte 227 \b, simple studio @ L3 558>>4 byte 228 \b, simple studio @ L4 559>>4 byte 229 \b, core studio @ L1 560>>4 byte 230 \b, core studio @ L2 561>>4 byte 231 \b, core studio @ L3 562>>4 byte 232 \b, core studio @ L4 563>>4 byte 240 \b, advanced simple @ L0 564>>4 byte 241 \b, advanced simple @ L1 565>>4 byte 242 \b, advanced simple @ L2 566>>4 byte 243 \b, advanced simple @ L3 567>>4 byte 244 \b, advanced simple @ L4 568>>4 byte 245 \b, advanced simple @ L5 569>>4 byte 247 \b, advanced simple @ L3b 570>>4 byte 248 \b, FGS @ L0 571>>4 byte 249 \b, FGS @ L1 572>>4 byte 250 \b, FGS @ L2 573>>4 byte 251 \b, FGS @ L3 574>>4 byte 252 \b, FGS @ L4 575>>4 byte 253 \b, FGS @ L5 576>3 byte 0xB5 MPEG sequence, v4 577!:mime video/mpeg4-generic 578>>4 byte &0x80 579>>>5 byte&0xF0 16 \b, video (missing profile header) 580>>>5 byte&0xF0 32 \b, still texture (missing profile header) 581>>>5 byte&0xF0 48 \b, mesh (missing profile header) 582>>>5 byte&0xF0 64 \b, face (missing profile header) 583>>4 byte&0xF8 8 \b, video (missing profile header) 584>>4 byte&0xF8 16 \b, still texture (missing profile header) 585>>4 byte&0xF8 24 \b, mesh (missing profile header) 586>>4 byte&0xF8 32 \b, face (missing profile header) 587>3 byte 0xB3 MPEG sequence 588!:mime video/mpeg 589>>12 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video 590>>12 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video 591>>12 belong 0x000001B5 \b, v2, 592>>>16 byte&0x0F 1 \b HP 593>>>16 byte&0x0F 2 \b Spt 594>>>16 byte&0x0F 3 \b SNR 595>>>16 byte&0x0F 4 \b MP 596>>>16 byte&0x0F 5 \b SP 597>>>17 byte&0xF0 64 \b@HL 598>>>17 byte&0xF0 96 \b@H-14 599>>>17 byte&0xF0 128 \b@ML 600>>>17 byte&0xF0 160 \b@LL 601>>>17 byte &0x08 \b progressive 602>>>17 byte ^0x08 \b interlaced 603>>>17 byte&0x06 2 \b Y'CbCr 4:2:0 video 604>>>17 byte&0x06 4 \b Y'CbCr 4:2:2 video 605>>>17 byte&0x06 6 \b Y'CbCr 4:4:4 video 606>>11 byte &0x02 607>>>75 byte &0x01 608>>>>140 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video 609>>>>140 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video 610>>>>140 belong 0x000001B5 \b, v2, 611>>>>>144 byte&0x0F 1 \b HP 612>>>>>144 byte&0x0F 2 \b Spt 613>>>>>144 byte&0x0F 3 \b SNR 614>>>>>144 byte&0x0F 4 \b MP 615>>>>>144 byte&0x0F 5 \b SP 616>>>>>145 byte&0xF0 64 \b@HL 617>>>>>145 byte&0xF0 96 \b@H-14 618>>>>>145 byte&0xF0 128 \b@ML 619>>>>>145 byte&0xF0 160 \b@LL 620>>>>>145 byte &0x08 \b progressive 621>>>>>145 byte ^0x08 \b interlaced 622>>>>>145 byte&0x06 2 \b Y'CbCr 4:2:0 video 623>>>>>145 byte&0x06 4 \b Y'CbCr 4:2:2 video 624>>>>>145 byte&0x06 6 \b Y'CbCr 4:4:4 video 625>>76 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video 626>>76 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video 627>>76 belong 0x000001B5 \b, v2, 628>>>80 byte&0x0F 1 \b HP 629>>>80 byte&0x0F 2 \b Spt 630>>>80 byte&0x0F 3 \b SNR 631>>>80 byte&0x0F 4 \b MP 632>>>80 byte&0x0F 5 \b SP 633>>>81 byte&0xF0 64 \b@HL 634>>>81 byte&0xF0 96 \b@H-14 635>>>81 byte&0xF0 128 \b@ML 636>>>81 byte&0xF0 160 \b@LL 637>>>81 byte &0x08 \b progressive 638>>>81 byte ^0x08 \b interlaced 639>>>81 byte&0x06 2 \b Y'CbCr 4:2:0 video 640>>>81 byte&0x06 4 \b Y'CbCr 4:2:2 video 641>>>81 byte&0x06 6 \b Y'CbCr 4:4:4 video 642>>4 belong&0xFFFFFF00 0x78043800 \b, HD-TV 1920P 643>>>7 byte&0xF0 0x10 \b, 16:9 644>>4 belong&0xFFFFFF00 0x50002D00 \b, SD-TV 1280I 645>>>7 byte&0xF0 0x10 \b, 16:9 646>>4 belong&0xFFFFFF00 0x30024000 \b, PAL Capture 647>>>7 byte&0xF0 0x10 \b, 4:3 648>>4 beshort&0xFFF0 0x2C00 \b, 4CIF 649>>>5 beshort&0x0FFF 0x01E0 \b NTSC 650>>>5 beshort&0x0FFF 0x0240 \b PAL 651>>>7 byte&0xF0 0x20 \b, 4:3 652>>>7 byte&0xF0 0x30 \b, 16:9 653>>>7 byte&0xF0 0x40 \b, 11:5 654>>>7 byte&0xF0 0x80 \b, PAL 4:3 655>>>7 byte&0xF0 0xC0 \b, NTSC 4:3 656>>4 belong&0xFFFFFF00 0x2801E000 \b, LD-TV 640P 657>>>7 byte&0xF0 0x10 \b, 4:3 658>>4 belong&0xFFFFFF00 0x1400F000 \b, 320x240 659>>>7 byte&0xF0 0x10 \b, 4:3 660>>4 belong&0xFFFFFF00 0x0F00A000 \b, 240x160 661>>>7 byte&0xF0 0x10 \b, 4:3 662>>4 belong&0xFFFFFF00 0x0A007800 \b, 160x120 663>>>7 byte&0xF0 0x10 \b, 4:3 664>>4 beshort&0xFFF0 0x1600 \b, CIF 665>>>5 beshort&0x0FFF 0x00F0 \b NTSC 666>>>5 beshort&0x0FFF 0x0120 \b PAL 667>>>7 byte&0xF0 0x20 \b, 4:3 668>>>7 byte&0xF0 0x30 \b, 16:9 669>>>7 byte&0xF0 0x40 \b, 11:5 670>>>7 byte&0xF0 0x80 \b, PAL 4:3 671>>>7 byte&0xF0 0xC0 \b, NTSC 4:3 672>>>5 beshort&0x0FFF 0x0240 \b PAL 625 673>>>>7 byte&0xF0 0x20 \b, 4:3 674>>>>7 byte&0xF0 0x30 \b, 16:9 675>>>>7 byte&0xF0 0x40 \b, 11:5 676>>4 beshort&0xFFF0 0x2D00 \b, CCIR/ITU 677>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525 678>>>5 beshort&0x0FFF 0x0240 \b PAL 625 679>>>7 byte&0xF0 0x20 \b, 4:3 680>>>7 byte&0xF0 0x30 \b, 16:9 681>>>7 byte&0xF0 0x40 \b, 11:5 682>>4 beshort&0xFFF0 0x1E00 \b, SVCD 683>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525 684>>>5 beshort&0x0FFF 0x0240 \b PAL 625 685>>>7 byte&0xF0 0x20 \b, 4:3 686>>>7 byte&0xF0 0x30 \b, 16:9 687>>>7 byte&0xF0 0x40 \b, 11:5 688>>7 byte&0x0F 1 \b, 23.976 fps 689>>7 byte&0x0F 2 \b, 24 fps 690>>7 byte&0x0F 3 \b, 25 fps 691>>7 byte&0x0F 4 \b, 29.97 fps 692>>7 byte&0x0F 5 \b, 30 fps 693>>7 byte&0x0F 6 \b, 50 fps 694>>7 byte&0x0F 7 \b, 59.94 fps 695>>7 byte&0x0F 8 \b, 60 fps 696>>11 byte &0x04 \b, Constrained 697 698# MPEG ADTS Audio (*.mpx/mxa/aac) 699# from dreesen@math.fu-berlin.de 700# modified to fully support MPEG ADTS 701 702# MP3, M1A 703# modified by Joerg Jenderek 704# GRR the original test are too common for many DOS files 705# so don't accept as MP3 until we've tested the rate 7060 beshort&0xFFFE 0xFFFA 707# rates 708>2 byte&0xF0 0x10 MPEG ADTS, layer III, v1, 32 kbps 709!:mime audio/mpeg 710>2 byte&0xF0 0x20 MPEG ADTS, layer III, v1, 40 kbps 711!:mime audio/mpeg 712>2 byte&0xF0 0x30 MPEG ADTS, layer III, v1, 48 kbps 713!:mime audio/mpeg 714>2 byte&0xF0 0x40 MPEG ADTS, layer III, v1, 56 kbps 715!:mime audio/mpeg 716>2 byte&0xF0 0x50 MPEG ADTS, layer III, v1, 64 kbps 717!:mime audio/mpeg 718>2 byte&0xF0 0x60 MPEG ADTS, layer III, v1, 80 kbps 719!:mime audio/mpeg 720>2 byte&0xF0 0x70 MPEG ADTS, layer III, v1, 96 kbps 721!:mime audio/mpeg 722>2 byte&0xF0 0x80 MPEG ADTS, layer III, v1, 112 kbps 723!:mime audio/mpeg 724>2 byte&0xF0 0x90 MPEG ADTS, layer III, v1, 128 kbps 725!:mime audio/mpeg 726>2 byte&0xF0 0xA0 MPEG ADTS, layer III, v1, 160 kbps 727!:mime audio/mpeg 728>2 byte&0xF0 0xB0 MPEG ADTS, layer III, v1, 192 kbps 729!:mime audio/mpeg 730>2 byte&0xF0 0xC0 MPEG ADTS, layer III, v1, 224 kbps 731!:mime audio/mpeg 732>2 byte&0xF0 0xD0 MPEG ADTS, layer III, v1, 256 kbps 733!:mime audio/mpeg 734>2 byte&0xF0 0xE0 MPEG ADTS, layer III, v1, 320 kbps 735!:mime audio/mpeg 736# timing 737>2 byte&0x0C 0x00 \b, 44.1 kHz 738>2 byte&0x0C 0x04 \b, 48 kHz 739>2 byte&0x0C 0x08 \b, 32 kHz 740# channels/options 741>3 byte&0xC0 0x00 \b, Stereo 742>3 byte&0xC0 0x40 \b, JntStereo 743>3 byte&0xC0 0x80 \b, 2x Monaural 744>3 byte&0xC0 0xC0 \b, Monaural 745#>1 byte ^0x01 \b, Data Verify 746#>2 byte &0x02 \b, Packet Pad 747#>2 byte &0x01 \b, Custom Flag 748#>3 byte &0x08 \b, Copyrighted 749#>3 byte &0x04 \b, Original Source 750#>3 byte&0x03 1 \b, NR: 50/15 ms 751#>3 byte&0x03 3 \b, NR: CCIT J.17 752 753# MP2, M1A 7540 beshort&0xFFFE 0xFFFC MPEG ADTS, layer II, v1 755!:mime audio/mpeg 756# rates 757>2 byte&0xF0 0x10 \b, 32 kbps 758>2 byte&0xF0 0x20 \b, 48 kbps 759>2 byte&0xF0 0x30 \b, 56 kbps 760>2 byte&0xF0 0x40 \b, 64 kbps 761>2 byte&0xF0 0x50 \b, 80 kbps 762>2 byte&0xF0 0x60 \b, 96 kbps 763>2 byte&0xF0 0x70 \b, 112 kbps 764>2 byte&0xF0 0x80 \b, 128 kbps 765>2 byte&0xF0 0x90 \b, 160 kbps 766>2 byte&0xF0 0xA0 \b, 192 kbps 767>2 byte&0xF0 0xB0 \b, 224 kbps 768>2 byte&0xF0 0xC0 \b, 256 kbps 769>2 byte&0xF0 0xD0 \b, 320 kbps 770>2 byte&0xF0 0xE0 \b, 384 kbps 771# timing 772>2 byte&0x0C 0x00 \b, 44.1 kHz 773>2 byte&0x0C 0x04 \b, 48 kHz 774>2 byte&0x0C 0x08 \b, 32 kHz 775# channels/options 776>3 byte&0xC0 0x00 \b, Stereo 777>3 byte&0xC0 0x40 \b, JntStereo 778>3 byte&0xC0 0x80 \b, 2x Monaural 779>3 byte&0xC0 0xC0 \b, Monaural 780#>1 byte ^0x01 \b, Data Verify 781#>2 byte &0x02 \b, Packet Pad 782#>2 byte &0x01 \b, Custom Flag 783#>3 byte &0x08 \b, Copyrighted 784#>3 byte &0x04 \b, Original Source 785#>3 byte&0x03 1 \b, NR: 50/15 ms 786#>3 byte&0x03 3 \b, NR: CCIT J.17 787 788# MPA, M1A 789# updated by Joerg Jenderek 790# GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448 791# GRR this test is still too general as it catches a BOM of UTF-16 files (0xFFFE) 792# FIXME: Almost all little endian UTF-16 text with BOM are clobbered by these entries 793#0 beshort&0xFFFE 0xFFFE 794#>2 ubyte&0xF0 >0x0F 795#>>2 ubyte&0xF0 <0xE1 MPEG ADTS, layer I, v1 796## rate 797#>>>2 byte&0xF0 0x10 \b, 32 kbps 798#>>>2 byte&0xF0 0x20 \b, 64 kbps 799#>>>2 byte&0xF0 0x30 \b, 96 kbps 800#>>>2 byte&0xF0 0x40 \b, 128 kbps 801#>>>2 byte&0xF0 0x50 \b, 160 kbps 802#>>>2 byte&0xF0 0x60 \b, 192 kbps 803#>>>2 byte&0xF0 0x70 \b, 224 kbps 804#>>>2 byte&0xF0 0x80 \b, 256 kbps 805#>>>2 byte&0xF0 0x90 \b, 288 kbps 806#>>>2 byte&0xF0 0xA0 \b, 320 kbps 807#>>>2 byte&0xF0 0xB0 \b, 352 kbps 808#>>>2 byte&0xF0 0xC0 \b, 384 kbps 809#>>>2 byte&0xF0 0xD0 \b, 416 kbps 810#>>>2 byte&0xF0 0xE0 \b, 448 kbps 811## timing 812#>>>2 byte&0x0C 0x00 \b, 44.1 kHz 813#>>>2 byte&0x0C 0x04 \b, 48 kHz 814#>>>2 byte&0x0C 0x08 \b, 32 kHz 815## channels/options 816#>>>3 byte&0xC0 0x00 \b, Stereo 817#>>>3 byte&0xC0 0x40 \b, JntStereo 818#>>>3 byte&0xC0 0x80 \b, 2x Monaural 819#>>>3 byte&0xC0 0xC0 \b, Monaural 820##>1 byte ^0x01 \b, Data Verify 821##>2 byte &0x02 \b, Packet Pad 822##>2 byte &0x01 \b, Custom Flag 823##>3 byte &0x08 \b, Copyrighted 824##>3 byte &0x04 \b, Original Source 825##>3 byte&0x03 1 \b, NR: 50/15 ms 826##>3 byte&0x03 3 \b, NR: CCIT J.17 827 828# MP3, M2A 8290 beshort&0xFFFE 0xFFF2 MPEG ADTS, layer III, v2 830!:mime audio/mpeg 831# rate 832>2 byte&0xF0 0x10 \b, 8 kbps 833>2 byte&0xF0 0x20 \b, 16 kbps 834>2 byte&0xF0 0x30 \b, 24 kbps 835>2 byte&0xF0 0x40 \b, 32 kbps 836>2 byte&0xF0 0x50 \b, 40 kbps 837>2 byte&0xF0 0x60 \b, 48 kbps 838>2 byte&0xF0 0x70 \b, 56 kbps 839>2 byte&0xF0 0x80 \b, 64 kbps 840>2 byte&0xF0 0x90 \b, 80 kbps 841>2 byte&0xF0 0xA0 \b, 96 kbps 842>2 byte&0xF0 0xB0 \b, 112 kbps 843>2 byte&0xF0 0xC0 \b, 128 kbps 844>2 byte&0xF0 0xD0 \b, 144 kbps 845>2 byte&0xF0 0xE0 \b, 160 kbps 846# timing 847>2 byte&0x0C 0x00 \b, 22.05 kHz 848>2 byte&0x0C 0x04 \b, 24 kHz 849>2 byte&0x0C 0x08 \b, 16 kHz 850# channels/options 851>3 byte&0xC0 0x00 \b, Stereo 852>3 byte&0xC0 0x40 \b, JntStereo 853>3 byte&0xC0 0x80 \b, 2x Monaural 854>3 byte&0xC0 0xC0 \b, Monaural 855#>1 byte ^0x01 \b, Data Verify 856#>2 byte &0x02 \b, Packet Pad 857#>2 byte &0x01 \b, Custom Flag 858#>3 byte &0x08 \b, Copyrighted 859#>3 byte &0x04 \b, Original Source 860#>3 byte&0x03 1 \b, NR: 50/15 ms 861#>3 byte&0x03 3 \b, NR: CCIT J.17 862 863# MP2, M2A 8640 beshort&0xFFFE 0xFFF4 MPEG ADTS, layer II, v2 865# rate 866>2 byte&0xF0 0x10 \b, 8 kbps 867>2 byte&0xF0 0x20 \b, 16 kbps 868>2 byte&0xF0 0x30 \b, 24 kbps 869>2 byte&0xF0 0x40 \b, 32 kbps 870>2 byte&0xF0 0x50 \b, 40 kbps 871>2 byte&0xF0 0x60 \b, 48 kbps 872>2 byte&0xF0 0x70 \b, 56 kbps 873>2 byte&0xF0 0x80 \b, 64 kbps 874>2 byte&0xF0 0x90 \b, 80 kbps 875>2 byte&0xF0 0xA0 \b, 96 kbps 876>2 byte&0xF0 0xB0 \b, 112 kbps 877>2 byte&0xF0 0xC0 \b, 128 kbps 878>2 byte&0xF0 0xD0 \b, 144 kbps 879>2 byte&0xF0 0xE0 \b, 160 kbps 880# timing 881>2 byte&0x0C 0x00 \b, 22.05 kHz 882>2 byte&0x0C 0x04 \b, 24 kHz 883>2 byte&0x0C 0x08 \b, 16 kHz 884# channels/options 885>3 byte&0xC0 0x00 \b, Stereo 886>3 byte&0xC0 0x40 \b, JntStereo 887>3 byte&0xC0 0x80 \b, 2x Monaural 888>3 byte&0xC0 0xC0 \b, Monaural 889#>1 byte ^0x01 \b, Data Verify 890#>2 byte &0x02 \b, Packet Pad 891#>2 byte &0x01 \b, Custom Flag 892#>3 byte &0x08 \b, Copyrighted 893#>3 byte &0x04 \b, Original Source 894#>3 byte&0x03 1 \b, NR: 50/15 ms 895#>3 byte&0x03 3 \b, NR: CCIT J.17 896 897# MPA, M2A 8980 beshort&0xFFFE 0xFFF6 MPEG ADTS, layer I, v2 899!:mime audio/mpeg 900# rate 901>2 byte&0xF0 0x10 \b, 32 kbps 902>2 byte&0xF0 0x20 \b, 48 kbps 903>2 byte&0xF0 0x30 \b, 56 kbps 904>2 byte&0xF0 0x40 \b, 64 kbps 905>2 byte&0xF0 0x50 \b, 80 kbps 906>2 byte&0xF0 0x60 \b, 96 kbps 907>2 byte&0xF0 0x70 \b, 112 kbps 908>2 byte&0xF0 0x80 \b, 128 kbps 909>2 byte&0xF0 0x90 \b, 144 kbps 910>2 byte&0xF0 0xA0 \b, 160 kbps 911>2 byte&0xF0 0xB0 \b, 176 kbps 912>2 byte&0xF0 0xC0 \b, 192 kbps 913>2 byte&0xF0 0xD0 \b, 224 kbps 914>2 byte&0xF0 0xE0 \b, 256 kbps 915# timing 916>2 byte&0x0C 0x00 \b, 22.05 kHz 917>2 byte&0x0C 0x04 \b, 24 kHz 918>2 byte&0x0C 0x08 \b, 16 kHz 919# channels/options 920>3 byte&0xC0 0x00 \b, Stereo 921>3 byte&0xC0 0x40 \b, JntStereo 922>3 byte&0xC0 0x80 \b, 2x Monaural 923>3 byte&0xC0 0xC0 \b, Monaural 924#>1 byte ^0x01 \b, Data Verify 925#>2 byte &0x02 \b, Packet Pad 926#>2 byte &0x01 \b, Custom Flag 927#>3 byte &0x08 \b, Copyrighted 928#>3 byte &0x04 \b, Original Source 929#>3 byte&0x03 1 \b, NR: 50/15 ms 930#>3 byte&0x03 3 \b, NR: CCIT J.17 931 932# MP3, M25A 9330 beshort&0xFFFE 0xFFE2 MPEG ADTS, layer III, v2.5 934!:mime audio/mpeg 935# rate 936>2 byte&0xF0 0x10 \b, 8 kbps 937>2 byte&0xF0 0x20 \b, 16 kbps 938>2 byte&0xF0 0x30 \b, 24 kbps 939>2 byte&0xF0 0x40 \b, 32 kbps 940>2 byte&0xF0 0x50 \b, 40 kbps 941>2 byte&0xF0 0x60 \b, 48 kbps 942>2 byte&0xF0 0x70 \b, 56 kbps 943>2 byte&0xF0 0x80 \b, 64 kbps 944>2 byte&0xF0 0x90 \b, 80 kbps 945>2 byte&0xF0 0xA0 \b, 96 kbps 946>2 byte&0xF0 0xB0 \b, 112 kbps 947>2 byte&0xF0 0xC0 \b, 128 kbps 948>2 byte&0xF0 0xD0 \b, 144 kbps 949>2 byte&0xF0 0xE0 \b, 160 kbps 950# timing 951>2 byte&0x0C 0x00 \b, 11.025 kHz 952>2 byte&0x0C 0x04 \b, 12 kHz 953>2 byte&0x0C 0x08 \b, 8 kHz 954# channels/options 955>3 byte&0xC0 0x00 \b, Stereo 956>3 byte&0xC0 0x40 \b, JntStereo 957>3 byte&0xC0 0x80 \b, 2x Monaural 958>3 byte&0xC0 0xC0 \b, Monaural 959#>1 byte ^0x01 \b, Data Verify 960#>2 byte &0x02 \b, Packet Pad 961#>2 byte &0x01 \b, Custom Flag 962#>3 byte &0x08 \b, Copyrighted 963#>3 byte &0x04 \b, Original Source 964#>3 byte&0x03 1 \b, NR: 50/15 ms 965#>3 byte&0x03 3 \b, NR: CCIT J.17 966 967# AAC (aka MPEG-2 NBC audio) and MPEG-4 audio 968 969# Stored AAC streams (instead of the MP4 format) 9700 string ADIF MPEG ADIF, AAC 971!:mime audio/x-hx-aac-adif 972>4 byte &0x80 973>>13 byte &0x10 \b, VBR 974>>13 byte ^0x10 \b, CBR 975>>16 byte&0x1E 0x02 \b, single stream 976>>16 byte&0x1E 0x04 \b, 2 streams 977>>16 byte&0x1E 0x06 \b, 3 streams 978>>16 byte &0x08 \b, 4 or more streams 979>>16 byte &0x10 \b, 8 or more streams 980>>4 byte &0x80 \b, Copyrighted 981>>13 byte &0x40 \b, Original Source 982>>13 byte &0x20 \b, Home Flag 983>4 byte ^0x80 984>>4 byte &0x10 \b, VBR 985>>4 byte ^0x10 \b, CBR 986>>7 byte&0x1E 0x02 \b, single stream 987>>7 byte&0x1E 0x04 \b, 2 streams 988>>7 byte&0x1E 0x06 \b, 3 streams 989>>7 byte &0x08 \b, 4 or more streams 990>>7 byte &0x10 \b, 8 or more streams 991>>4 byte &0x40 \b, Original Stream(s) 992>>4 byte &0x20 \b, Home Source 993 994# Live or stored single AAC stream (used with MPEG-2 systems) 9950 beshort&0xFFF6 0xFFF0 MPEG ADTS, AAC 996!:mime audio/x-hx-aac-adts 997>1 byte &0x08 \b, v2 998>1 byte ^0x08 \b, v4 999# profile 1000>>2 byte &0xC0 \b LTP 1001>2 byte&0xc0 0x00 \b Main 1002>2 byte&0xc0 0x40 \b LC 1003>2 byte&0xc0 0x80 \b SSR 1004# timing 1005>2 byte&0x3c 0x00 \b, 96 kHz 1006>2 byte&0x3c 0x04 \b, 88.2 kHz 1007>2 byte&0x3c 0x08 \b, 64 kHz 1008>2 byte&0x3c 0x0c \b, 48 kHz 1009>2 byte&0x3c 0x10 \b, 44.1 kHz 1010>2 byte&0x3c 0x14 \b, 32 kHz 1011>2 byte&0x3c 0x18 \b, 24 kHz 1012>2 byte&0x3c 0x1c \b, 22.05 kHz 1013>2 byte&0x3c 0x20 \b, 16 kHz 1014>2 byte&0x3c 0x24 \b, 12 kHz 1015>2 byte&0x3c 0x28 \b, 11.025 kHz 1016>2 byte&0x3c 0x2c \b, 8 kHz 1017# channels 1018>2 beshort&0x01c0 0x0040 \b, monaural 1019>2 beshort&0x01c0 0x0080 \b, stereo 1020>2 beshort&0x01c0 0x00c0 \b, stereo + center 1021>2 beshort&0x01c0 0x0100 \b, stereo+center+LFE 1022>2 beshort&0x01c0 0x0140 \b, surround 1023>2 beshort&0x01c0 0x0180 \b, surround + LFE 1024>2 beshort &0x01C0 \b, surround + side 1025#>1 byte ^0x01 \b, Data Verify 1026#>2 byte &0x02 \b, Custom Flag 1027#>3 byte &0x20 \b, Original Stream 1028#>3 byte &0x10 \b, Home Source 1029#>3 byte &0x08 \b, Copyrighted 1030 1031# Live MPEG-4 audio streams (instead of RTP FlexMux) 10320 beshort&0xFFE0 0x56E0 MPEG-4 LOAS 1033!:mime audio/x-mp4a-latm 1034#>1 beshort&0x1FFF x \b, %u byte packet 1035>3 byte&0xE0 0x40 1036>>4 byte&0x3C 0x04 \b, single stream 1037>>4 byte&0x3C 0x08 \b, 2 streams 1038>>4 byte&0x3C 0x0C \b, 3 streams 1039>>4 byte &0x08 \b, 4 or more streams 1040>>4 byte &0x20 \b, 8 or more streams 1041>3 byte&0xC0 0 1042>>4 byte&0x78 0x08 \b, single stream 1043>>4 byte&0x78 0x10 \b, 2 streams 1044>>4 byte&0x78 0x18 \b, 3 streams 1045>>4 byte &0x20 \b, 4 or more streams 1046>>4 byte &0x40 \b, 8 or more streams 1047# This magic isn't strong enough (matches plausible ISO-8859-1 text) 1048#0 beshort 0x4DE1 MPEG-4 LO-EP audio stream 1049#!:mime audio/x-mp4a-latm 1050 1051# Summary: FLI animation format 1052# Created by: Daniel Quinlan <quinlan@yggdrasil.com> 1053# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection) 10544 leshort 0xAF11 1055# standard FLI always has 320x200 resolution and 8 bit color 1056>8 leshort 320 1057>>10 leshort 200 1058>>>12 leshort 8 FLI animation, 320x200x8 1059!:mime video/x-fli 1060>>>>6 leshort x \b, %d frames 1061# frame speed is multiple of 1/70s 1062>>>>16 leshort x \b, %d/70s per frame 1063 1064# Summary: FLC animation format 1065# Created by: Daniel Quinlan <quinlan@yggdrasil.com> 1066# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection) 10674 leshort 0xAF12 1068# standard FLC always use 8 bit color 1069>12 leshort 8 FLC animation 1070!:mime video/x-flc 1071>>8 leshort x \b, %d 1072>>10 leshort x \bx%dx8 1073>>6 uleshort x \b, %d frames 1074>>16 uleshort x \b, %dms per frame 1075 1076# DL animation format 1077# XXX - collision with most `mips' magic 1078# 1079# I couldn't find a real magic number for these, however, this 1080# -appears- to work. Note that it might catch other files, too, so be 1081# careful! 1082# 1083# Note that title and author appear in the two 20-byte chunks 1084# at decimal offsets 2 and 22, respectively, but they are XOR'ed with 1085# 255 (hex FF)! The DL format is really bad. 1086# 1087#0 byte 1 DL version 1, medium format (160x100, 4 images/screen) 1088#!:mime video/x-unknown 1089#>42 byte x - %d screens, 1090#>43 byte x %d commands 1091#0 byte 2 DL version 2 1092#!:mime video/x-unknown 1093#>1 byte 1 - large format (320x200,1 image/screen), 1094#>1 byte 2 - medium format (160x100,4 images/screen), 1095#>1 byte >2 - unknown format, 1096#>42 byte x %d screens, 1097#>43 byte x %d commands 1098# Based on empirical evidence, DL version 3 have several nulls following the 1099# \003. Most of them start with non-null values at hex offset 0x34 or so. 1100#0 string \3\0\0\0\0\0\0\0\0\0\0\0 DL version 3 1101 1102# iso 13818 transport stream 1103# 1104# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1) 1105# syncbyte 8 bit 0x47 1106# error_ind 1 bit - 1107# payload_start 1 bit 1 1108# priority 1 bit - 1109# PID 13 bit 0x0000 1110# scrambling 2 bit - 1111# adaptfld_ctrl 2 bit 1 or 3 1112# conti_count 4 bit - 11130 belong&0xFF5FFF10 0x47400010 1114>188 byte 0x47 MPEG transport stream data 1115 1116# DIF digital video file format <mpruett@sgi.com> 11170 belong&0xffffff00 0x1f070000 DIF 1118>4 byte &0x01 (DVCPRO) movie file 1119>4 byte ^0x01 (DV) movie file 1120>3 byte &0x80 (PAL) 1121>3 byte ^0x80 (NTSC) 1122 1123# Microsoft Advanced Streaming Format (ASF) <mpruett@sgi.com> 11240 belong 0x3026b275 Microsoft ASF 1125!:mime video/x-ms-asf 1126 1127# MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/> 11280 string \x8aMNG MNG video data, 1129!:mime video/x-mng 1130>4 belong !0x0d0a1a0a CORRUPTED, 1131>4 belong 0x0d0a1a0a 1132>>16 belong x %ld x 1133>>20 belong x %ld 1134 1135# JNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/> 11360 string \x8bJNG JNG video data, 1137!:mime video/x-jng 1138>4 belong !0x0d0a1a0a CORRUPTED, 1139>4 belong 0x0d0a1a0a 1140>>16 belong x %ld x 1141>>20 belong x %ld 1142 1143# Vivo video (Wolfram Kleff) 11443 string \x0D\x0AVersion:Vivo Vivo video data 1145 1146# VRML (Virtual Reality Modelling Language) 11470 string/w #VRML\ V1.0\ ascii VRML 1 file 1148!:mime model/vrml 11490 string/w #VRML\ V2.0\ utf8 ISO/IEC 14772 VRML 97 file 1150!:mime model/vrml 1151 1152# X3D (Extensible 3D) [http://www.web3d.org/specifications/x3d-3.0.dtd] 1153# From Michel Briand <michelbriand@free.fr> 11540 string/t \<?xml\ version=" 1155!:strength +1 1156>20 search/1000/cw \<!DOCTYPE\ X3D X3D (Extensible 3D) model xml text 1157!:mime model/x3d 1158 1159#--------------------------------------------------------------------------- 1160# HVQM4: compressed movie format designed by Hudson for Nintendo GameCube 1161# From Mark Sheppard <msheppard@climax.co.uk>, 2002-10-03 1162# 11630 string HVQM4 %s 1164>6 string >\0 v%s 1165>0 byte x GameCube movie, 1166>0x34 ubeshort x %d x 1167>0x36 ubeshort x %d, 1168>0x26 ubeshort x %dus, 1169>0x42 ubeshort 0 no audio 1170>0x42 ubeshort >0 %dHz audio 1171 1172# From: "Stefan A. Haubenthal" <polluks@web.de> 11730 string DVDVIDEO-VTS Video title set, 1174>0x21 byte x v%x 11750 string DVDVIDEO-VMG Video manager, 1176>0x21 byte x v%x 1177 1178# From: Behan Webster <behanw@websterwood.com> 1179# NuppelVideo used by Mythtv (*.nuv) 1180# Note: there are two identical stanzas here differing only in the 1181# initial string matched. It used to be done with a regex, but we're 1182# trying to get rid of those. 11830 string NuppelVideo MythTV NuppelVideo 1184>12 string x v%s 1185>20 lelong x (%d 1186>24 lelong x \bx%d), 1187>36 string P \bprogressive, 1188>36 string I \binterlaced, 1189>40 ledouble x \baspect:%.2f, 1190>48 ledouble x \bfps:%.2f 11910 string MythTV MythTV NuppelVideo 1192>12 string x v%s 1193>20 lelong x (%d 1194>24 lelong x \bx%d), 1195>36 string P \bprogressive, 1196>36 string I \binterlaced, 1197>40 ledouble x \baspect:%.2f, 1198>48 ledouble x \bfps:%.2f 1199 1200# MPEG file 1201# MPEG sequences 1202# FIXME: This section is from the old magic.mime file and needs integrating with the rest 12030 belong 0x000001BA 1204>4 byte &0x40 1205!:mime video/mp2p 1206>4 byte ^0x40 1207!:mime video/mpeg 12080 belong 0x000001BB 1209!:mime video/mpeg 12100 belong 0x000001B0 1211!:mime video/mp4v-es 12120 belong 0x000001B5 1213!:mime video/mp4v-es 12140 belong 0x000001B3 1215!:mime video/mpv 12160 belong&0xFF5FFF10 0x47400010 1217!:mime video/mp2t 12180 belong 0x00000001 1219>4 byte&0x1F 0x07 1220!:mime video/h264 1221 1222# Type: Bink Video 1223# Extension: .bik 1224# URL: http://wiki.multimedia.cx/index.php?title=Bink_Container 1225# From: <hoehle@users.sourceforge.net> 2008-07-18 12260 string BIK Bink Video 1227>3 regex =[a-z] rev.%s 1228#>4 ulelong x size %d 1229>20 ulelong x \b, %d 1230>24 ulelong x \bx%d 1231>8 ulelong x \b, %d frames 1232>32 ulelong x at rate %d/ 1233>28 ulelong >1 \b%d 1234>40 ulelong =0 \b, no audio 1235>40 ulelong !0 \b, %d audio track 1236>>40 ulelong !1 \bs 1237# follow properties of the first audio track only 1238>>48 uleshort x %dHz 1239>>51 byte&0x20 0 mono 1240>>51 byte&0x20 !0 stereo 1241#>>51 byte&0x10 0 FFT 1242#>>51 byte&0x10 !0 DCT 1243 1244# Type: NUT Container 1245# URL: http://wiki.multimedia.cx/index.php?title=NUT 1246# From: Adam Buchbinder <adam.buchbinder@gmail.com> 12470 string nut/multimedia\ container\0 NUT multimedia container 1248 1249# Type: Nullsoft Video (NSV) 1250# URL: http://wiki.multimedia.cx/index.php?title=Nullsoft_Video 1251# From: Mike Melanson <mike@multimedia.cx> 12520 string NSVf Nullsoft Video 1253 1254# Type: REDCode Video 1255# URL: http://www.red.com/ ; http://wiki.multimedia.cx/index.php?title=REDCode 1256# From: Mike Melanson <mike@multimedia.cx> 12574 string RED1 REDCode Video 1258 1259# Type: MTV Multimedia File 1260# URL: http://wiki.multimedia.cx/index.php?title=MTV 1261# From: Mike Melanson <mike@multimedia.cx> 12620 string AMVS MTV Multimedia File 1263 1264# Type: ARMovie 1265# URL: http://wiki.multimedia.cx/index.php?title=ARMovie 1266# From: Mike Melanson <mike@multimedia.cx> 12670 string ARMovie\012 ARMovie 1268 1269# Type: Interplay MVE Movie 1270# URL: http://wiki.multimedia.cx/index.php?title=Interplay_MVE 1271# From: Mike Melanson <mike@multimedia.cx> 12720 string Interplay\040MVE\040File\032 Interplay MVE Movie 1273 1274# Type: Windows Television DVR File 1275# URL: http://wiki.multimedia.cx/index.php?title=WTV 1276# From: Mike Melanson <mike@mutlimedia.cx> 1277# This takes the form of a Windows-style GUID 12780 bequad 0xB7D800203749DA11 1279>8 bequad 0xA64E0007E95EAD8D Windows Television DVR Media 1280 1281# Type: Sega FILM/CPK Multimedia 1282# URL: http://wiki.multimedia.cx/index.php?title=Sega_FILM 1283# From: Mike Melanson <mike@multimedia.cx> 12840 string FILM Sega FILM/CPK Multimedia, 1285>32 belong x %d x 1286>28 belong x %d 1287 1288# Type: Nintendo THP Multimedia 1289# URL: http://wiki.multimedia.cx/index.php?title=THP 1290# From: Mike Melanson <mike@multimedia.cx> 12910 string THP\0 Nintendo THP Multimedia 1292 1293# Type: BBC Dirac Video 1294# URL: http://wiki.multimedia.cx/index.php?title=Dirac 1295# From: Mike Melanson <mike@multimedia.cx> 12960 string BBCD BBC Dirac Video 1297 1298# Type: RAD Game Tools Smacker Multimedia 1299# URL: http://wiki.multimedia.cx/index.php?title=Smacker 1300# From: Mike Melanson <mike@multimedia.cx> 13010 string SMK RAD Game Tools Smacker Multimedia 1302>3 byte x version %c, 1303>4 lelong x %d x 1304>8 lelong x %d, 1305>12 lelong x %d frames 1306 1307#------------------------------------------------------------------------------ 1308# $File: aout,v 1.1 2013/01/09 22:37:23 christos Exp $ 1309# aout: file(1) magic for a.out executable/object/etc entries that 1310# handle executables on multiple platforms. 1311# 1312 1313# 1314# Little-endian 32-bit-int a.out, merged from bsdi (for BSD/OS, from 1315# BSDI), netbsd, and vax (for UNIX/32V and BSD) 1316# 1317# XXX - is there anything we can look at to distinguish BSD/OS 386 from 1318# NetBSD 386 from various VAX binaries? The BSD/OS shared library flag 1319# works only for binaries using shared libraries. Grabbing the entry 1320# point from the a.out header, using it to find the first code executed 1321# in the program, and looking at that might help. 1322# 13230 lelong 0407 a.out little-endian 32-bit executable 1324>16 lelong >0 not stripped 1325>32 byte 0x6a (uses BSD/OS shared libs) 1326 13270 lelong 0410 a.out little-endian 32-bit pure executable 1328>16 lelong >0 not stripped 1329>32 byte 0x6a (uses BSD/OS shared libs) 1330 13310 lelong 0413 a.out little-endian 32-bit demand paged pure executable 1332>16 lelong >0 not stripped 1333>32 byte 0x6a (uses BSD/OS shared libs) 1334 1335# 1336# Big-endian 32-bit-int a.out, merged from sun (for old 68010 SunOS a.out), 1337# mips (for old 68020(!) SGI a.out), and netbsd (for old big-endian a.out). 1338# 1339# XXX - is there anything we can look at to distinguish old SunOS 68010 1340# from old 68020 IRIX from old NetBSD? Again, I guess we could look at 1341# the first instruction or instructions in the program. 1342# 13430 belong 0407 a.out big-endian 32-bit executable 1344>16 belong >0 not stripped 1345 13460 belong 0410 a.out big-endian 32-bit pure executable 1347>16 belong >0 not stripped 1348 13490 belong 0413 a.out big-endian 32-bit demand paged executable 1350>16 belong >0 not stripped 1351 1352 1353#------------------------------------------------------------------------------ 1354# $File: apl,v 1.6 2009/09/19 16:28:07 christos Exp $ 1355# apl: file(1) magic for APL (see also "pdp" and "vax" for other APL 1356# workspaces) 1357# 13580 long 0100554 APL workspace (Ken's original?) 1359 1360#------------------------------------------------------------------------------ 1361# $File: apple,v 1.27 2013/03/09 22:36:00 christos Exp $ 1362# apple: file(1) magic for Apple file formats 1363# 13640 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text 13650 string \x0aGL Binary II (apple ][) data 13660 string \x76\xff Squeezed (apple ][) data 13670 string NuFile NuFile archive (apple ][) data 13680 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data 13690 belong 0x00051600 AppleSingle encoded Macintosh file 13700 belong 0x00051607 AppleDouble encoded Macintosh file 1371 1372# Type: Apple Emulator 2IMG format 1373# From: Radek Vokal <rvokal@redhat.com> 13740 string 2IMG Apple ][ 2IMG Disk Image 1375>4 string XGS! \b, XGS 1376>4 string CTKG \b, Catakig 1377>4 string ShIm \b, Sheppy's ImageMaker 1378>4 string WOOF \b, Sweet 16 1379>4 string B2TR \b, Bernie ][ the Rescue 1380>4 string !nfc \b, ASIMOV2 1381>4 string x \b, Unknown Format 1382>0xc byte 00 \b, DOS 3.3 sector order 1383>>0x10 byte 00 \b, Volume 254 1384>>0x10 byte&0x7f x \b, Volume %u 1385>0xc byte 01 \b, ProDOS sector order 1386>>0x14 short x \b, %u Blocks 1387>0xc byte 02 \b, NIB data 1388 1389# magic for Newton PDA package formats 1390# from Ruda Moura <ruda@helllabs.org> 13910 string package0 Newton package, NOS 1.x, 1392>12 belong &0x80000000 AutoRemove, 1393>12 belong &0x40000000 CopyProtect, 1394>12 belong &0x10000000 NoCompression, 1395>12 belong &0x04000000 Relocation, 1396>12 belong &0x02000000 UseFasterCompression, 1397>16 belong x version %d 1398 13990 string package1 Newton package, NOS 2.x, 1400>12 belong &0x80000000 AutoRemove, 1401>12 belong &0x40000000 CopyProtect, 1402>12 belong &0x10000000 NoCompression, 1403>12 belong &0x04000000 Relocation, 1404>12 belong &0x02000000 UseFasterCompression, 1405>16 belong x version %d 1406 14070 string package4 Newton package, 1408>8 byte 8 NOS 1.x, 1409>8 byte 9 NOS 2.x, 1410>12 belong &0x80000000 AutoRemove, 1411>12 belong &0x40000000 CopyProtect, 1412>12 belong &0x10000000 NoCompression, 1413 1414# The following entries for the Apple II are for files that have 1415# been transferred as raw binary data from an Apple, without having 1416# been encapsulated by any of the above archivers. 1417# 1418# In general, Apple II formats are hard to identify because Apple DOS 1419# and especially Apple ProDOS have strong typing in the file system and 1420# therefore programmers never felt much need to include type information 1421# in the files themselves. 1422# 1423# Eric Fischer <enf@pobox.com> 1424 1425# AppleWorks word processor: 1426# 1427# This matches the standard tab stops for an AppleWorks file, but if 1428# a file has a tab stop set in the first four columns this will fail. 1429# 1430# The "O" is really the magic number, but that's so common that it's 1431# necessary to check the tab stops that follow it to avoid false positives. 1432 14334 string O==== AppleWorks word processor data 1434>85 byte&0x01 >0 \b, zoomed 1435>90 byte&0x01 >0 \b, paginated 1436>92 byte&0x01 >0 \b, with mail merge 1437#>91 byte x \b, left margin %d 1438 1439# AppleWorks database: 1440# 1441# This isn't really a magic number, but it's the closest thing to one 1442# that I could find. The 1 and 2 really mean "order in which you defined 1443# categories" and "left to right, top to bottom," respectively; the D and R 1444# mean that the cursor should move either down or right when you press Return. 1445 1446#30 string \x01D AppleWorks database data 1447#30 string \x02D AppleWorks database data 1448#30 string \x01R AppleWorks database data 1449#30 string \x02R AppleWorks database data 1450 1451# AppleWorks spreadsheet: 1452# 1453# Likewise, this isn't really meant as a magic number. The R or C means 1454# row- or column-order recalculation; the A or M means automatic or manual 1455# recalculation. 1456 1457#131 string RA AppleWorks spreadsheet data 1458#131 string RM AppleWorks spreadsheet data 1459#131 string CA AppleWorks spreadsheet data 1460#131 string CM AppleWorks spreadsheet data 1461 1462# Applesoft BASIC: 1463# 1464# This is incredibly sloppy, but will be true if the program was 1465# written at its usual memory location of 2048 and its first line 1466# number is less than 256. Yuck. 1467# update by Joerg Jenderek at Feb 2013 1468 1469# GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000) 1470#0 belong&0xff00ff 0x80000 Applesoft BASIC program data 14710 belong&0x00ff00ff 0x00080000 1472# assuming that line number must be positive 1473>2 leshort >0 Applesoft BASIC program data, first line number %d 1474#>2 leshort x \b, first line number %d 1475 1476# ORCA/EZ assembler: 1477# 1478# This will not identify ORCA/M source files, since those have 1479# some sort of date code instead of the two zero bytes at 6 and 7 1480# XXX Conflicts with ELF 1481#4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data 1482#>5 byte x \b, build number %d 1483 1484# Broderbund Fantavision 1485# 1486# I don't know what these values really mean, but they seem to recur. 1487# Will they cause too many conflicts? 1488 1489# Probably :-) 1490#2 belong&0xFF00FF 0x040008 Fantavision movie data 1491 1492# Some attempts at images. 1493# 1494# These are actually just bit-for-bit dumps of the frame buffer, so 1495# there's really no reasonably way to distinguish them except for their 1496# address (if preserved) -- 8192 or 16384 -- and their length -- 8192 1497# or, occasionally, 8184. 1498# 1499# Nevertheless this will manage to catch a lot of images that happen 1500# to have a solid-colored line at the bottom of the screen. 1501 1502# GRR: Magic too weak 1503#8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background 1504#8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background 1505#8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background 1506#8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background 1507#8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background 1508 1509# Beagle Bros. Apple Mechanic fonts 1510 15110 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font 1512 1513# Apple Universal Disk Image Format (UDIF) - dmg files. 1514# From Johan Gade. 1515# These entries are disabled for now until we fix the following issues. 1516# 1517# Note there might be some problems with the "VAX COFF executable" 1518# entry. Note this entry should be placed before the mac filesystem section, 1519# particularly the "Apple Partition data" entry. 1520# 1521# The intended meaning of these tests is, that the file is only of the 1522# specified type if both of the lines are correct - i.e. if the first 1523# line matches and the second doesn't then it is not of that type. 1524# 1525#0 long 0x7801730d 1526#>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO) 1527# 1528# Note that this entry is recognized correctly by the "Apple Partition 1529# data" entry - however since this entry is more specific - this 1530# information seems to be more useful. 1531#0 long 0x45520200 1532#>0x410 string disk\ image UDIF read/write image (UDRW) 1533 1534# From: Toby Peterson <toby@apple.com> 15350 string bplist00 Apple binary property list 1536 1537# Apple binary property list (bplist) 1538# Assumes version bytes are hex. 1539# Provides content hints for version 0 files. Assumes that the root 1540# object is the first object (true for CoreFoundation implementation). 1541# From: David Remahl <dremahl@apple.com> 15420 string bplist 1543>6 byte x \bCoreFoundation binary property list data, version 0x%c 1544>>7 byte x \b%c 1545>6 string 00 \b 1546>>8 byte&0xF0 0x00 \b 1547>>>8 byte&0x0F 0x00 \b, root type: null 1548>>>8 byte&0x0F 0x08 \b, root type: false boolean 1549>>>8 byte&0x0F 0x09 \b, root type: true boolean 1550>>8 byte&0xF0 0x10 \b, root type: integer 1551>>8 byte&0xF0 0x20 \b, root type: real 1552>>8 byte&0xF0 0x30 \b, root type: date 1553>>8 byte&0xF0 0x40 \b, root type: data 1554>>8 byte&0xF0 0x50 \b, root type: ascii string 1555>>8 byte&0xF0 0x60 \b, root type: unicode string 1556>>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT) 1557>>8 byte&0xF0 0xa0 \b, root type: array 1558>>8 byte&0xF0 0xd0 \b, root type: dictionary 1559 1560# Apple/NeXT typedstream data 1561# Serialization format used by NeXT and Apple for various 1562# purposes in YellowStep/Cocoa, including some nib files. 1563# From: David Remahl <dremahl@apple.com> 15642 string typedstream NeXT/Apple typedstream data, big endian 1565>0 byte x \b, version %hhd 1566>0 byte <5 \b 1567>>13 byte 0x81 \b 1568>>>14 ubeshort x \b, system %hd 15692 string streamtyped NeXT/Apple typedstream data, little endian 1570>0 byte x \b, version %hhd 1571>0 byte <5 \b 1572>>13 byte 0x81 \b 1573>>>14 uleshort x \b, system %hd 1574 1575#------------------------------------------------------------------------------ 1576# CAF: Apple CoreAudio File Format 1577# 1578# Container format for high-end audio purposes. 1579# From: David Remahl <dremahl@apple.com> 1580# 15810 string caff CoreAudio Format audio file 1582>4 beshort <10 version %d 1583>6 beshort x 1584 1585 1586#------------------------------------------------------------------------------ 1587# Keychain database files 15880 string kych Mac OS X Keychain File 1589 1590#------------------------------------------------------------------------------ 1591# Code Signing related file types 15920 belong 0xfade0c00 Mac OS X Code Requirement 1593>8 belong 1 (opExpr) 1594>4 belong x - %d bytes 1595 15960 belong 0xfade0c01 Mac OS X Code Requirement Set 1597>8 belong >1 containing %d items 1598>4 belong x - %d bytes 1599 16000 belong 0xfade0c02 Mac OS X Code Directory 1601>8 belong x version %x 1602>12 belong >0 flags 0x%x 1603>4 belong x - %d bytes 1604 16050 belong 0xfade0cc0 Mac OS X Detached Code Signature (non-executable) 1606>4 belong x - %d bytes 1607 16080 belong 0xfade0cc1 Mac OS X Detached Code Signature 1609>8 belong >1 (%d elements) 1610>4 belong x - %d bytes 1611 1612# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 1613# .vdi 16144 string innotek\ VirtualBox\ Disk\ Image %s 1615 1616# Apple disk partition stuff, strengthen the magic using byte 4 16170 beshort 0x4552 1618>4 byte 0 Apple Driver Map 1619>>2 beshort x \b, blocksize %d 1620>>4 belong x \b, blockcount %d 1621>>10 beshort x \b, devtype %d 1622>>12 beshort x \b, devid %d 1623>>20 beshort x \b, descriptors %d 1624# Assume 8 partitions each at a multiple of the sector size. 1625# We could glean this from the partition descriptors, but they are empty!?!? 1626>>(2.S*1) indirect \b, contains[@0x%x]: 1627>>(2.S*2) indirect \b, contains[@0x%x]: 1628>>(2.S*3) indirect \b, contains[@0x%x]: 1629>>(2.S*4) indirect \b, contains[@0x%x]: 1630>>(2.S*5) indirect \b, contains[@0x%x]: 1631>>(2.S*6) indirect \b, contains[@0x%x]: 1632>>(2.S*7) indirect \b, contains[@0x%x]: 1633>>(2.S*8) indirect \b, contains[@0x%x]: 1634 1635# Yes, the 3rd and 4th bytes are reserved, but we use them to make the 1636# magic stronger. 16370 belong 0x504d0000 Apple Partition Map 1638>4 belong x \b, map block count %d 1639>8 belong x \b, start block %d 1640>12 belong x \b, block count %d 1641>16 string >0 \b, name %s 1642>48 string >0 \b, type %s 1643>124 string >0 \b, processor %s 1644>140 string >0 \b, boot arguments %s 1645>92 belong & 1 \b, valid 1646>92 belong & 2 \b, allocated 1647>92 belong & 4 \b, in use 1648>92 belong & 8 \b, has boot info 1649>92 belong & 16 \b, readable 1650>92 belong & 32 \b, writable 1651>92 belong & 64 \b, pic boot code 1652>92 belong & 128 \b, chain compatible driver 1653>92 belong & 256 \b, real driver 1654>92 belong & 512 \b, chain driver 1655>92 belong & 1024 \b, mount at startup 1656>92 belong & 2048 \b, is the startup partition 1657 1658#http://wiki.mozilla.org/DS_Store_File_Format` 1659#http://en.wikipedia.org/wiki/.DS_Store 16600 string \0\0\0\1Bud1\0 Apple Desktop Services Store 1661 1662#------------------------------------------------------------------------------ 1663# $File: applix,v 1.5 2009/09/19 16:28:08 christos Exp $ 1664# applix: file(1) magic for Applixware 1665# From: Peter Soos <sp@osb.hu> 1666# 16670 string *BEGIN Applixware 1668>7 string WORDS Words Document 1669>7 string GRAPHICS Graphic 1670>7 string RASTER Bitmap 1671>7 string SPREADSHEETS Spreadsheet 1672>7 string MACRO Macro 1673>7 string BUILDER Builder Object 1674#------------------------------------------------------------------------------ 1675# $File: archive,v 1.81 2014/01/08 22:27:31 christos Exp $ 1676# archive: file(1) magic for archive formats (see also "msdos" for self- 1677# extracting compressed archives) 1678# 1679# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc. 1680# pre-POSIX "tar" archives are handled in the C code. 1681 1682# POSIX tar archives 1683257 string ustar\0 POSIX tar archive 1684!:mime application/x-tar # encoding: posix 1685257 string ustar\040\040\0 GNU tar archive 1686!:mime application/x-tar # encoding: gnu 1687 1688# Incremental snapshot gnu-tar format from: 1689# http://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html 16900 string GNU\ tar- GNU tar incremental snapshot data 1691>&0 regex [0-9]\.[0-9]+-[0-9]+ version %s 1692 1693# cpio archives 1694# 1695# Yes, the top two "cpio archive" formats *are* supposed to just be "short". 1696# The idea is to indicate archives produced on machines with the same 1697# byte order as the machine running "file" with "cpio archive", and 1698# to indicate archives produced on machines with the opposite byte order 1699# from the machine running "file" with "byte-swapped cpio archive". 1700# 1701# The SVR4 "cpio(4)" hints that there are additional formats, but they 1702# are defined as "short"s; I think all the new formats are 1703# character-header formats and thus are strings, not numbers. 17040 short 070707 cpio archive 1705!:mime application/x-cpio 17060 short 0143561 byte-swapped cpio archive 1707!:mime application/x-cpio # encoding: swapped 17080 string 070707 ASCII cpio archive (pre-SVR4 or odc) 17090 string 070701 ASCII cpio archive (SVR4 with no CRC) 17100 string 070702 ASCII cpio archive (SVR4 with CRC) 1711 1712# 1713# Various archive formats used by various versions of the "ar" 1714# command. 1715# 1716 1717# 1718# Original UNIX archive formats. 1719# They were written with binary values in host byte order, and 1720# the magic number was a host "int", which might have been 16 bits 1721# or 32 bits. We don't say "PDP-11" or "VAX", as there might have 1722# been ports to little-endian 16-bit-int or 32-bit-int platforms 1723# (x86?) using some of those formats; if none existed, feel free 1724# to use "PDP-11" for little-endian 16-bit and "VAX" for little-endian 1725# 32-bit. There might have been big-endian ports of that sort as 1726# well. 1727# 17280 leshort 0177555 very old 16-bit-int little-endian archive 17290 beshort 0177555 very old 16-bit-int big-endian archive 17300 lelong 0177555 very old 32-bit-int little-endian archive 17310 belong 0177555 very old 32-bit-int big-endian archive 1732 17330 leshort 0177545 old 16-bit-int little-endian archive 1734>2 string __.SYMDEF random library 17350 beshort 0177545 old 16-bit-int big-endian archive 1736>2 string __.SYMDEF random library 17370 lelong 0177545 old 32-bit-int little-endian archive 1738>4 string __.SYMDEF random library 17390 belong 0177545 old 32-bit-int big-endian archive 1740>4 string __.SYMDEF random library 1741 1742# 1743# From "pdp" (but why a 4-byte quantity?) 1744# 17450 lelong 0x39bed PDP-11 old archive 17460 lelong 0x39bee PDP-11 4.0 archive 1747 1748# 1749# XXX - what flavor of APL used this, and was it a variant of 1750# some ar archive format? It's similar to, but not the same 1751# as, the APL workspace magic numbers in pdp. 1752# 17530 long 0100554 apl workspace 1754 1755# 1756# System V Release 1 portable(?) archive format. 1757# 17580 string =<ar> System V Release 1 ar archive 1759!:mime application/x-archive 1760 1761# 1762# Debian package; it's in the portable archive format, and needs to go 1763# before the entry for regular portable archives, as it's recognized as 1764# a portable archive whose first member has a name beginning with 1765# "debian". 1766# 17670 string =!<arch>\ndebian 1768!:mime application/x-debian-package 1769>8 string debian-split part of multipart Debian package 1770>8 string debian-binary Debian binary package 1771>8 string !debian 1772>68 string >\0 (format %s) 1773# These next two lines do not work, because a bzip2 Debian archive 1774# still uses gzip for the control.tar (first in the archive). Only 1775# data.tar varies, and the location of its filename varies too. 1776# file/libmagic does not current have support for ascii-string based 1777# (offsets) as of 2005-09-15. 1778#>81 string bz2 \b, uses bzip2 compression 1779#>84 string gz \b, uses gzip compression 1780#>136 ledate x created: %s 1781 1782# 1783# MIPS archive; they're in the portable archive format, and need to go 1784# before the entry for regular portable archives, as it's recognized as 1785# a portable archive whose first member has a name beginning with 1786# "__________E". 1787# 17880 string =!<arch>\n__________E MIPS archive 1789!:mime application/x-archive 1790>20 string U with MIPS Ucode members 1791>21 string L with MIPSEL members 1792>21 string B with MIPSEB members 1793>19 string L and an EL hash table 1794>19 string B and an EB hash table 1795>22 string X -- out of date 1796 17970 search/1 -h- Software Tools format archive text 1798 1799# 1800# BSD/SVR2-and-later portable archive formats. 1801# 18020 string =!<arch> current ar archive 1803!:mime application/x-archive 1804>8 string __.SYMDEF random library 1805>68 string __.SYMDEF\ SORTED random library 1806 1807# 1808# "Thin" archive, as can be produced by GNU ar. 1809# 18100 string =!<thin>\n thin archive with 1811>68 belong 0 no symbol entries 1812>68 belong 1 %d symbol entry 1813>68 belong >1 %d symbol entries 1814 1815# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com) 1816# 1817# The first byte is the magic (0x1a), byte 2 is the compression type for 1818# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS 1819# filename of the first file (null terminated). Since some types collide 1820# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%), 1821# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo. 18220 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW 1823!:mime application/x-arc 18240 lelong&0x8080ffff 0x0000091a ARC archive data, squashed 1825!:mime application/x-arc 18260 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed 1827!:mime application/x-arc 18280 lelong&0x8080ffff 0x0000031a ARC archive data, packed 1829!:mime application/x-arc 18300 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed 1831!:mime application/x-arc 18320 lelong&0x8080ffff 0x0000061a ARC archive data, crunched 1833!:mime application/x-arc 1834# [JW] stuff taken from idarc, obviously ARC successors: 18350 lelong&0x8080ffff 0x00000a1a PAK archive data 1836!:mime application/x-arc 18370 lelong&0x8080ffff 0x0000141a ARC+ archive data 1838!:mime application/x-arc 18390 lelong&0x8080ffff 0x0000481a HYP archive data 1840!:mime application/x-arc 1841 1842# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk) 1843# I can't create either SPARK or ArcFS archives so I have not tested this stuff 1844# [GRR: the original entries collide with ARC, above; replaced with combined 1845# version (not tested)] 1846#0 byte 0x1a RISC OS archive (spark format) 18470 string \032archive RISC OS archive (ArcFS format) 18480 string Archive\000 RISC OS archive (ArcFS format) 1849 1850# All these were taken from idarc, many could not be verified. Unfortunately, 1851# there were many low-quality sigs, i.e. easy to trigger false positives. 1852# Please notify me of any real-world fishy/ambiguous signatures and I'll try 1853# to get my hands on the actual archiver and see if I find something better. [JW] 1854# probably many can be enhanced by finding some 0-byte or control char near the start 1855 1856# idarc calls this Crush/Uncompressed... *shrug* 18570 string CRUSH Crush archive data 1858# Squeeze It (.sqz) 18590 string HLSQZ Squeeze It archive data 1860# SQWEZ 18610 string SQWEZ SQWEZ archive data 1862# HPack (.hpk) 18630 string HPAK HPack archive data 1864# HAP 18650 string \x91\x33HF HAP archive data 1866# MD/MDCD 18670 string MDmd MDCD archive data 1868# LIM 18690 string LIM\x1a LIM archive data 1870# SAR 18713 string LH5 SAR archive data 1872# BSArc/BS2 18730 string \212\3SB\020\0 BSArc/BS2 archive data 1874# Bethesda Softworks Archive (Oblivion) 18750 string BSA\0 BSArc archive data 1876>4 lelong x version %d 1877# MAR 18782 string =-ah MAR archive data 1879# ACB 1880#0 belong&0x00f800ff 0x00800000 ACB archive data 1881# CPZ 1882# TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data 1883# JRC 18840 string JRchive JRC archive data 1885# Quantum 18860 string DS\0 Quantum archive data 1887# ReSOF 18880 string PK\3\6 ReSOF archive data 1889# QuArk 18900 string 7\4 QuArk archive data 1891# YAC 189214 string YC YAC archive data 1893# X1 18940 string X1 X1 archive data 18950 string XhDr X1 archive data 1896# CDC Codec (.dqt) 18970 belong&0xffffe000 0x76ff2000 CDC Codec archive data 1898# AMGC 18990 string \xad6" AMGC archive data 1900# NuLIB 19010 string N\xc3\xb5F\xc3\xa9lx\xc3\xa5 NuLIB archive data 1902# PakLeo 19030 string LEOLZW PAKLeo archive data 1904# ChArc 19050 string SChF ChArc archive data 1906# PSA 19070 string PSA PSA archive data 1908# CrossePAC 19090 string DSIGDCC CrossePAC archive data 1910# Freeze 19110 string \x1f\x9f\x4a\x10\x0a Freeze archive data 1912# KBoom 19130 string \xc2\xa8MP\xc2\xa8 KBoom archive data 1914# NSQ, must go after CDC Codec 19150 string \x76\xff NSQ archive data 1916# DPA 19170 string Dirk\ Paehl DPA archive data 1918# BA 1919# TODO: idarc says "bytes 0-2 == bytes 3-5" 1920# TTComp 19210 string \0\6 TTComp archive data 1922# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation? 19230 string ESP ESP archive data 1924# ZPack 19250 string \1ZPK\1 ZPack archive data 1926# Sky 19270 string \xbc\x40 Sky archive data 1928# UFA 19290 string UFA UFA archive data 1930# Dry 19310 string =-H2O DRY archive data 1932# FoxSQZ 19330 string FOXSQZ FoxSQZ archive data 1934# AR7 19350 string ,AR7 AR7 archive data 1936# PPMZ 19370 string PPMZ PPMZ archive data 1938# MS Compress 19394 string \x88\xf0\x27 MS Compress archive data 1940# updated by Joerg Jenderek 1941>9 string \0 1942>>0 string KWAJ 1943>>>7 string \321\003 MS Compress archive data 1944>>>>14 ulong >0 \b, original size: %ld bytes 1945>>>>18 ubyte >0x65 1946>>>>>18 string x \b, was %.8s 1947>>>>>(10.b-4) string x \b.%.3s 1948# MP3 (archiver, not lossy audio compression) 19490 string MP3\x1a MP3-Archiver archive data 1950# ZET 19510 string OZ\xc3\x9d ZET archive data 1952# TSComp 19530 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data 1954# ARQ 19550 string gW\4\1 ARQ archive data 1956# Squash 19573 string OctSqu Squash archive data 1958# Terse 19590 string \5\1\1\0 Terse archive data 1960# PUCrunch 19610 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data 1962# UHarc 19630 string UHA UHarc archive data 1964# ABComp 19650 string \2AB ABComp archive data 19660 string \3AB2 ABComp archive data 1967# CMP 19680 string CO\0 CMP archive data 1969# Splint 19700 string \x93\xb9\x06 Splint archive data 1971# InstallShield 19720 string \x13\x5d\x65\x8c InstallShield Z archive Data 1973# Gather 19741 string GTH Gather archive data 1975# BOA 19760 string BOA BOA archive data 1977# RAX 19780 string ULEB\xa RAX archive data 1979# Xtreme 19800 string ULEB\0 Xtreme archive data 1981# Pack Magic 19820 string @\xc3\xa2\1\0 Pack Magic archive data 1983# BTS 19840 belong&0xfeffffff 0x1a034465 BTS archive data 1985# ELI 5750 19860 string Ora\ ELI 5750 archive data 1987# QFC 19880 string \x1aFC\x1a QFC archive data 19890 string \x1aQF\x1a QFC archive data 1990# PRO-PACK 19910 string RNC PRO-PACK archive data 1992# 777 19930 string 777 777 archive data 1994# LZS221 19950 string sTaC LZS221 archive data 1996# HPA 19970 string HPA HPA archive data 1998# Arhangel 19990 string LG Arhangel archive data 2000# EXP1, uses bzip2 20010 string 0123456789012345BZh EXP1 archive data 2002# IMP 20030 string IMP\xa IMP archive data 2004# NRV 20050 string \x00\x9E\x6E\x72\x76\xFF NRV archive data 2006# Squish 20070 string \x73\xb2\x90\xf4 Squish archive data 2008# Par 20090 string PHILIPP Par archive data 20100 string PAR Par archive data 2011# HIT 20120 string UB HIT archive data 2013# SBX 20140 belong&0xfffff000 0x53423000 SBX archive data 2015# NaShrink 20160 string NSK NaShrink archive data 2017# SAPCAR 20180 string #\ CAR\ archive\ header SAPCAR archive data 20190 string CAR\ 2.00RG SAPCAR archive data 2020# Disintegrator 20210 string DST Disintegrator archive data 2022# ASD 20230 string ASD ASD archive data 2024# InstallShield CAB 20250 string ISc( InstallShield CAB 2026# TOP4 20270 string T4\x1a TOP4 archive data 2028# BatComp left out: sig looks like COM executable 2029# so TODO: get real 4dos batcomp file and find sig 2030# BlakHole 20310 string BH\5\7 BlakHole archive data 2032# BIX 20330 string BIX0 BIX archive data 2034# ChiefLZA 20350 string ChfLZ ChiefLZA archive data 2036# Blink 20370 string Blink Blink archive data 2038# Logitech Compress 20390 string \xda\xfa Logitech Compress archive data 2040# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE) 20411 string (C)\ STEPANYUK ARS-Sfx archive data 2042# AKT/AKT32 20430 string AKT32 AKT32 archive data 20440 string AKT AKT archive data 2045# NPack 20460 string MSTSM NPack archive data 2047# PFT 20480 string \0\x50\0\x14 PFT archive data 2049# SemOne 20500 string SEM SemOne archive data 2051# PPMD 20520 string \x8f\xaf\xac\x84 PPMD archive data 2053# FIZ 20540 string FIZ FIZ archive data 2055# MSXiE 20560 belong&0xfffff0f0 0x4d530000 MSXiE archive data 2057# DeepFreezer 20580 belong&0xfffffff0 0x797a3030 DeepFreezer archive data 2059# DC 20600 string =<DC- DC archive data 2061# TPac 20620 string \4TPAC\3 TPac archive data 2063# Ai 20640 string Ai\1\1\0 Ai archive data 20650 string Ai\1\0\0 Ai archive data 2066# Ai32 20670 string Ai\2\0 Ai32 archive data 20680 string Ai\2\1 Ai32 archive data 2069# SBC 20700 string SBC SBC archive data 2071# Ybs 20720 string YBS Ybs archive data 2073# DitPack 20740 string \x9e\0\0 DitPack archive data 2075# DMS 20760 string DMS! DMS archive data 2077# EPC 20780 string \x8f\xaf\xac\x8c EPC archive data 2079# VSARC 20800 string VS\x1a VSARC archive data 2081# PDZ 20820 string PDZ PDZ archive data 2083# ReDuq 20840 string rdqx ReDuq archive data 2085# GCA 20860 string GCAX GCA archive data 2087# PPMN 20880 string pN PPMN archive data 2089# WinImage 20903 string WINIMAGE WinImage archive data 2091# Compressia 20920 string CMP0CMP Compressia archive data 2093# UHBC 20940 string UHB UHBC archive data 2095# WinHKI 20960 string \x61\x5C\x04\x05 WinHKI archive data 2097# WWPack data file 20980 string WWP WWPack archive data 2099# BSN (BSA, PTS-DOS) 21000 string \xffBSG BSN archive data 21011 string \xffBSG BSN archive data 21023 string \xffBSG BSN archive data 21031 string \0\xae\2 BSN archive data 21041 string \0\xae\3 BSN archive data 21051 string \0\xae\7 BSN archive data 2106# AIN 21070 string \x33\x18 AIN archive data 21080 string \x33\x17 AIN archive data 2109# XPA32 21100 string xpa\0\1 XPA32 archive data 2111# SZip (TODO: doesn't catch all versions) 21120 string SZ\x0a\4 SZip archive data 2113# XPack DiskImage 21140 string jm XPack DiskImage archive data 2115# XPack Data 21160 string xpa XPack archive data 2117# XPack Single Data 21180 string \xc3\x8d\ jm XPack single archive data 2119 2120# TODO: missing due to unknown magic/magic at end of file: 2121#DWC 2122#ARG 2123#ZAR 2124#PC/3270 2125#InstallIt 2126#RKive 2127#RK 2128#XPack Diskimage 2129 2130# These were inspired by idarc, but actually verified 2131# Dzip archiver (.dz) 21320 string DZ Dzip archive data 2133>2 byte x \b, version %i 2134>3 byte x \b.%i 2135# ZZip archiver (.zz) 21360 string ZZ\ \0\0 ZZip archive data 21370 string ZZ0 ZZip archive data 2138# PAQ archiver (.paq) 21390 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data 21400 string PAQ PAQ archive data 2141>3 byte&0xf0 0x30 2142>>3 byte x (v%c) 2143# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP) 21440xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data 21450 string JARCS JAR (ARJ Software, Inc.) archive data 2146 2147# ARJ archiver (jason@jarthur.Claremont.EDU) 21480 leshort 0xea60 ARJ archive data 2149!:mime application/x-arj 2150>5 byte x \b, v%d, 2151>8 byte &0x04 multi-volume, 2152>8 byte &0x10 slash-switched, 2153>8 byte &0x20 backup, 2154>34 string x original name: %s, 2155>7 byte 0 os: MS-DOS 2156>7 byte 1 os: PRIMOS 2157>7 byte 2 os: Unix 2158>7 byte 3 os: Amiga 2159>7 byte 4 os: Macintosh 2160>7 byte 5 os: OS/2 2161>7 byte 6 os: Apple ][ GS 2162>7 byte 7 os: Atari ST 2163>7 byte 8 os: NeXT 2164>7 byte 9 os: VAX/VMS 2165>3 byte >0 %d] 2166# [JW] idarc says this is also possible 21672 leshort 0xea60 ARJ archive data 2168 2169# HA archiver (Greg Roelofs, newt@uchicago.edu) 2170# This is a really bad format. A file containing HAWAII will match this... 2171#0 string HA HA archive data, 2172#>2 leshort =1 1 file, 2173#>2 leshort >1 %u files, 2174#>4 byte&0x0f =0 first is type CPY 2175#>4 byte&0x0f =1 first is type ASC 2176#>4 byte&0x0f =2 first is type HSC 2177#>4 byte&0x0f =0x0e first is type DIR 2178#>4 byte&0x0f =0x0f first is type SPECIAL 2179# suggestion: at least identify small archives (<1024 files) 21800 belong&0xffff00fc 0x48410000 HA archive data 2181>2 leshort =1 1 file, 2182>2 leshort >1 %u files, 2183>4 byte&0x0f =0 first is type CPY 2184>4 byte&0x0f =1 first is type ASC 2185>4 byte&0x0f =2 first is type HSC 2186>4 byte&0x0f =0x0e first is type DIR 2187>4 byte&0x0f =0x0f first is type SPECIAL 2188 2189# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz) 21900 string HPAK HPACK archive data 2191 2192# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net 21930 string \351,\001JAM\ JAM archive, 2194>7 string >\0 version %.4s 2195>0x26 byte =0x27 - 2196>>0x2b string >\0 label %.11s, 2197>>0x27 lelong x serial %08x, 2198>>0x36 string >\0 fstype %.8s 2199 2200# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu) 22012 string -lh0- LHarc 1.x/ARX archive data [lh0] 2202!:mime application/x-lharc 22032 string -lh1- LHarc 1.x/ARX archive data [lh1] 2204!:mime application/x-lharc 22052 string -lz4- LHarc 1.x archive data [lz4] 2206!:mime application/x-lharc 22072 string -lz5- LHarc 1.x archive data [lz5] 2208!:mime application/x-lharc 2209# [never seen any but the last; -lh4- reported in comp.compression:] 22102 string -lzs- LHa/LZS archive data [lzs] 2211!:mime application/x-lha 22122 string -lh\40- LHa 2.x? archive data [lh ] 2213!:mime application/x-lha 22142 string -lhd- LHa 2.x? archive data [lhd] 2215!:mime application/x-lha 22162 string -lh2- LHa 2.x? archive data [lh2] 2217!:mime application/x-lha 22182 string -lh3- LHa 2.x? archive data [lh3] 2219!:mime application/x-lha 22202 string -lh4- LHa (2.x) archive data [lh4] 2221!:mime application/x-lha 22222 string -lh5- LHa (2.x) archive data [lh5] 2223!:mime application/x-lha 22242 string -lh6- LHa (2.x) archive data [lh6] 2225!:mime application/x-lha 22262 string -lh7- LHa (2.x)/LHark archive data [lh7] 2227!:mime application/x-lha 2228>20 byte x - header level %d 2229# taken from idarc [JW] 22302 string -lZ PUT archive data 22312 string -lz LZS archive data 22322 string -sw1- Swag archive data 2233 2234# RAR archiver (Greg Roelofs, newt@uchicago.edu) 22350 string Rar! RAR archive data, 2236!:mime application/x-rar 2237>44 byte x v%0x, 2238>10 byte >0 flags: 2239>>10 byte &0x01 Archive volume, 2240>>10 byte &0x02 Commented, 2241>>10 byte &0x04 Locked, 2242>>10 byte &0x08 Solid, 2243>>10 byte &0x20 Authenticated, 2244>35 byte 0 os: MS-DOS 2245>35 byte 1 os: OS/2 2246>35 byte 2 os: Win32 2247>35 byte 3 os: Unix 2248# some old version? idarc says: 22490 string RE\x7e\x5e RAR archive data 2250 2251# SQUISH archiver (Greg Roelofs, newt@uchicago.edu) 22520 string SQSH squished archive data (Acorn RISCOS) 2253 2254# UC2 archiver (Greg Roelofs, newt@uchicago.edu) 2255# [JW] see exe section for self-extracting version 22560 string UC2\x1a UC2 archive data 2257 2258# PKZIP multi-volume archive 22590 string PK\x07\x08PK\x03\x04 Zip multi-volume archive data, at least PKZIP v2.50 to extract 2260!:mime application/zip 2261 2262# Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 22630 string PK\005\006 Zip archive data (empty) 22640 string PK\003\004 2265 2266# Specialised zip formats which start with a member named 'mimetype' 2267# (stored uncompressed, with no 'extra field') containing the file's MIME type. 2268# Check for have 8-byte name, 0-byte extra field, name "mimetype", and 2269# contents starting with "application/": 2270>26 string \x8\0\0\0mimetypeapplication/ 2271 2272# KOffice / OpenOffice & StarOffice / OpenDocument formats 2273# From: Abel Cheung <abel@oaka.org> 2274 2275# KOffice (1.2 or above) formats 2276# (mimetype contains "application/vnd.kde.<SUBTYPE>") 2277>>50 string vnd.kde. KOffice (>=1.2) 2278>>>58 string karbon Karbon document 2279>>>58 string kchart KChart document 2280>>>58 string kformula KFormula document 2281>>>58 string kivio Kivio document 2282>>>58 string kontour Kontour document 2283>>>58 string kpresenter KPresenter document 2284>>>58 string kspread KSpread document 2285>>>58 string kword KWord document 2286 2287# OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) 2288# (mimetype contains "application/vnd.sun.xml.<SUBTYPE>") 2289>>50 string vnd.sun.xml. OpenOffice.org 1.x 2290>>>62 string writer Writer 2291>>>>68 byte !0x2e document 2292>>>>68 string .template template 2293>>>>68 string .global global document 2294>>>62 string calc Calc 2295>>>>66 byte !0x2e spreadsheet 2296>>>>66 string .template template 2297>>>62 string draw Draw 2298>>>>66 byte !0x2e document 2299>>>>66 string .template template 2300>>>62 string impress Impress 2301>>>>69 byte !0x2e presentation 2302>>>>69 string .template template 2303>>>62 string math Math document 2304>>>62 string base Database file 2305 2306# OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) 2307# http://lists.oasis-open.org/archives/office/200505/msg00006.html 2308# (mimetype contains "application/vnd.oasis.opendocument.<SUBTYPE>") 2309>>50 string vnd.oasis.opendocument. OpenDocument 2310>>>73 string text 2311>>>>77 byte !0x2d Text 2312!:mime application/vnd.oasis.opendocument.text 2313>>>>77 string -template Text Template 2314!:mime application/vnd.oasis.opendocument.text-template 2315>>>>77 string -web HTML Document Template 2316!:mime application/vnd.oasis.opendocument.text-web 2317>>>>77 string -master Master Document 2318!:mime application/vnd.oasis.opendocument.text-master 2319>>>73 string graphics 2320>>>>81 byte !0x2d Drawing 2321!:mime application/vnd.oasis.opendocument.graphics 2322>>>>81 string -template Template 2323!:mime application/vnd.oasis.opendocument.graphics-template 2324>>>73 string presentation 2325>>>>85 byte !0x2d Presentation 2326!:mime application/vnd.oasis.opendocument.presentation 2327>>>>85 string -template Template 2328!:mime application/vnd.oasis.opendocument.presentation-template 2329>>>73 string spreadsheet 2330>>>>84 byte !0x2d Spreadsheet 2331!:mime application/vnd.oasis.opendocument.spreadsheet 2332>>>>84 string -template Template 2333!:mime application/vnd.oasis.opendocument.spreadsheet-template 2334>>>73 string chart 2335>>>>78 byte !0x2d Chart 2336!:mime application/vnd.oasis.opendocument.chart 2337>>>>78 string -template Template 2338!:mime application/vnd.oasis.opendocument.chart-template 2339>>>73 string formula 2340>>>>80 byte !0x2d Formula 2341!:mime application/vnd.oasis.opendocument.formula 2342>>>>80 string -template Template 2343!:mime application/vnd.oasis.opendocument.formula-template 2344>>>73 string database Database 2345!:mime application/vnd.oasis.opendocument.database 2346>>>73 string image 2347>>>>78 byte !0x2d Image 2348!:mime application/vnd.oasis.opendocument.image 2349>>>>78 string -template Template 2350!:mime application/vnd.oasis.opendocument.image-template 2351 2352# EPUB (OEBPS) books using OCF (OEBPS Container Format) 2353# http://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4. 2354# From: Ralf Brown <ralf.brown@gmail.com> 2355>>50 string epub+zip EPUB document 2356!:mime application/epub+zip 2357 2358# Catch other ZIP-with-mimetype formats 2359# In a ZIP file, the bytes immediately after a member's contents are 2360# always "PK". The 2 regex rules here print the "mimetype" member's 2361# contents up to the first 'P'. Luckily, most MIME types don't contain 2362# any capital 'P's. This is a kludge. 2363# (mimetype contains "application/<OTHER>") 2364>>50 string !epub+zip 2365>>>50 string !vnd.oasis.opendocument. 2366>>>>50 string !vnd.sun.xml. 2367>>>>>50 string !vnd.kde. 2368>>>>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?) 2369!:mime application/zip 2370# (mimetype contents other than "application/*") 2371>26 string \x8\0\0\0mimetype 2372>>38 string !application/ 2373>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?) 2374!:mime application/zip 2375 2376# Java Jar files 2377>(26.s+30) leshort 0xcafe Java archive data (JAR) 2378!:mime application/java-archive 2379 2380# Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 2381# Next line excludes specialized formats: 2382>(26.s+30) leshort !0xcafe 2383>>26 string !\x8\0\0\0mimetype Zip archive data 2384!:mime application/zip 2385>>>4 byte 0x09 \b, at least v0.9 to extract 2386>>>4 byte 0x0a \b, at least v1.0 to extract 2387>>>4 byte 0x0b \b, at least v1.1 to extract 2388>>>4 byte 0x14 \b, at least v2.0 to extract 2389>>>4 byte 0x2d \b, at least v3.0 to extract 2390>>>0x161 string WINZIP \b, WinZIP self-extracting 2391 2392# StarView Metafile 2393# From Pierre Ducroquet <pinaraf@pinaraf.info> 23940 string VCLMTF StarView MetaFile 2395>6 beshort x \b, version %d 2396>8 belong x \b, size %d 2397 2398# Zoo archiver 239920 lelong 0xfdc4a7dc Zoo archive data 2400!:mime application/x-zoo 2401>4 byte >48 \b, v%c. 2402>>6 byte >47 \b%c 2403>>>7 byte >47 \b%c 2404>32 byte >0 \b, modify: v%d 2405>>33 byte x \b.%d+ 2406>42 lelong 0xfdc4a7dc \b, 2407>>70 byte >0 extract: v%d 2408>>>71 byte x \b.%d+ 2409 2410# Shell archives 241110 string #\ This\ is\ a\ shell\ archive shell archive text 2412!:mime application/octet-stream 2413 2414# 2415# LBR. NB: May conflict with the questionable 2416# "binary Computer Graphics Metafile" format. 2417# 24180 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data 2419# 2420# PMA (CP/M derivative of LHA) 2421# 24222 string -pm0- PMarc archive data [pm0] 24232 string -pm1- PMarc archive data [pm1] 24242 string -pm2- PMarc archive data [pm2] 24252 string -pms- PMarc SFX archive (CP/M, DOS) 24265 string -pc1- PopCom compressed executable (CP/M) 2427 2428# From Rafael Laboissiere <rafael@laboissiere.net> 2429# The Project Revision Control System (see 2430# http://prcs.sourceforge.net) generates a packaged project 2431# file which is recognized by the following entry: 24320 leshort 0xeb81 PRCS packaged project 2433 2434# Microsoft cabinets 2435# by David Necas (Yeti) <yeti@physics.muni.cz> 2436#0 string MSCF\0\0\0\0 Microsoft cabinet file data, 2437#>25 byte x v%d 2438#>24 byte x \b.%d 2439# MPi: All CABs have version 1.3, so this is pointless. 2440# Better magic in debian-additions. 2441 2442# GTKtalog catalogs 2443# by David Necas (Yeti) <yeti@physics.muni.cz> 24444 string gtktalog\ GTKtalog catalog data, 2445>13 string 3 version 3 2446>>14 beshort 0x677a (gzipped) 2447>>14 beshort !0x677a (not gzipped) 2448>13 string >3 version %s 2449 2450############################################################################ 2451# Parity archive reconstruction file, the 'par' file format now used on Usenet. 24520 string PAR\0 PARity archive data 2453>48 leshort =0 - Index file 2454>48 leshort >0 - file number %d 2455 2456# Felix von Leitner <felix-file@fefe.de> 24570 string d8:announce BitTorrent file 2458!:mime application/x-bittorrent 2459 2460# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi> 24610 beshort 0x0e0f Atari MSA archive data 2462>2 beshort x \b, %d sectors per track 2463>4 beshort 0 \b, 1 sided 2464>4 beshort 1 \b, 2 sided 2465>6 beshort x \b, starting track: %d 2466>8 beshort x \b, ending track: %d 2467 2468# Alternate ZIP string (amc@arwen.cs.berkeley.edu) 24690 string PK00PK\003\004 Zip archive data 2470 2471# ACE archive (from http://www.wotsit.org/download.asp?f=ace) 2472# by Stefan `Sec` Zehl <sec@42.org> 24737 string **ACE** ACE archive data 2474>15 byte >0 version %d 2475>16 byte =0x00 \b, from MS-DOS 2476>16 byte =0x01 \b, from OS/2 2477>16 byte =0x02 \b, from Win/32 2478>16 byte =0x03 \b, from Unix 2479>16 byte =0x04 \b, from MacOS 2480>16 byte =0x05 \b, from WinNT 2481>16 byte =0x06 \b, from Primos 2482>16 byte =0x07 \b, from AppleGS 2483>16 byte =0x08 \b, from Atari 2484>16 byte =0x09 \b, from Vax/VMS 2485>16 byte =0x0A \b, from Amiga 2486>16 byte =0x0B \b, from Next 2487>14 byte x \b, version %d to extract 2488>5 leshort &0x0080 \b, multiple volumes, 2489>>17 byte x \b (part %d), 2490>5 leshort &0x0002 \b, contains comment 2491>5 leshort &0x0200 \b, sfx 2492>5 leshort &0x0400 \b, small dictionary 2493>5 leshort &0x0800 \b, multi-volume 2494>5 leshort &0x1000 \b, contains AV-String 2495>>30 string \x16*UNREGISTERED\x20VERSION* (unregistered) 2496>5 leshort &0x2000 \b, with recovery record 2497>5 leshort &0x4000 \b, locked 2498>5 leshort &0x8000 \b, solid 2499# Date in MS-DOS format (whatever that is) 2500#>18 lelong x Created on 2501 2502# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann 2503# <doj@cubic.org> 25040x1A string sfArk sfArk compressed Soundfont 2505>0x15 string 2 2506>>0x1 string >\0 Version %s 2507>>0x2A string >\0 : %s 2508 2509# DR-DOS 7.03 Packed File *.??_ 25100 string Packed\ File\ Personal NetWare Packed File 2511>12 string x \b, was "%.12s" 2512 2513# EET archive 2514# From: Tilman Sauerbeck <tilman@code-monkey.de> 25150 belong 0x1ee7ff00 EET archive 2516!:mime application/x-eet 2517 2518# rzip archives 25190 string RZIP rzip compressed data 2520>4 byte x - version %d 2521>5 byte x \b.%d 2522>6 belong x (%d bytes) 2523 2524# From: "Robert Dale" <robdale@gmail.com> 25250 belong 123 dar archive, 2526>4 belong x label "%.8x 2527>>8 belong x %.8x 2528>>>12 beshort x %.4x" 2529>14 byte 0x54 end slice 2530>14 beshort 0x4e4e multi-part 2531>14 beshort 0x4e53 multi-part, with -S 2532 2533# Symbian installation files 2534# http://www.thouky.co.uk/software/psifs/sis.html 2535# http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf 25368 lelong 0x10000419 Symbian installation file 2537!:mime application/vnd.symbian.install 2538>4 lelong 0x1000006D (EPOC release 3/4/5) 2539>4 lelong 0x10003A12 (EPOC release 6) 25400 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x) 2541!:mime x-epoc/x-sisx-app 2542 2543# From "Nelson A. de Oliveira" <naoliv@gmail.com> 25440 string MPQ\032 MoPaQ (MPQ) archive 2545 2546# From: Dirk Jagdmann <doj@cubic.org> 2547# xar archive format: http://code.google.com/p/xar/ 25480 string xar! xar archive 2549>6 beshort x - version %ld 2550 2551# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 2552# .kgb 25530 string KGB_arch KGB Archiver file 2554>10 string x with compression level %.1s 2555 2556# xar (eXtensible ARchiver) archive 2557# From: "David Remahl" <dremahl@apple.com> 25580 string xar! xar archive 2559#>4 beshort x header size %d 2560>6 beshort x version %d, 2561#>8 quad x compressed TOC: %d, 2562#>16 quad x uncompressed TOC: %d, 2563>24 belong 0 no checksum 2564>24 belong 1 SHA-1 checksum 2565>24 belong 2 MD5 checksum 2566 2567# Type: Parity Archive 2568# From: Daniel van Eeden <daniel_e@dds.nl> 25690 string PAR2 Parity Archive Volume Set 2570 2571# Bacula volume format. (Volumes always start with a block header.) 2572# URL: http://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html 2573# From: Adam Buchbinder <adam.buchbinder@gmail.com> 257412 string BB02 Bacula volume 2575>20 bedate x \b, started %s 2576 2577# ePub is XHTML + XML inside a ZIP archive. The first member of the 2578# archive must be an uncompressed file called 'mimetype' with contents 2579# 'application/epub+zip' 2580 2581 2582# From: "Michael Gorny" <mgorny@gentoo.org> 2583# ZPAQ: http://mattmahoney.net/dc/zpaq.html 25840 string zPQ ZPAQ stream 2585>3 byte x \b, level %d 2586 2587# BBeB ebook, unencrypted (LRF format) 2588# URL: http://www.sven.de/librie/Librie/LrfFormat 2589# From: Adam Buchbinder <adam.buchbinder@gmail.com> 25900 string L\0R\0F\0\0\0 BBeB ebook data, unencrypted 2591>8 beshort x \b, version %d 2592>36 byte 1 \b, front-to-back 2593>36 byte 16 \b, back-to-front 2594>42 beshort x \b, (%dx, 2595>44 beshort x %d) 2596#------------------------------------------------------------------------------ 2597# $File: assembler,v 1.6 2013/12/11 14:14:20 christos Exp $ 2598# make: file(1) magic for assembler source 2599# 26000 regex \^[\040\t]{0,50}\\.asciiz assembler source text 2601!:mime text/x-asm 26020 regex \^[\040\t]{0,50}\\.byte assembler source text 2603!:mime text/x-asm 26040 regex \^[\040\t]{0,50}\\.even assembler source text 2605!:mime text/x-asm 26060 regex \^[\040\t]{0,50}\\.globl assembler source text 2607!:mime text/x-asm 26080 regex \^[\040\t]{0,50}\\.text assembler source text 2609!:mime text/x-asm 26100 regex \^[\040\t]{0,50}\\.file assembler source text 2611!:mime text/x-asm 26120 regex \^[\040\t]{0,50}\\.type assembler source text 2613!:mime text/x-asm 2614 2615#------------------------------------------------------------------------------ 2616# $File: asterix,v 1.5 2009/09/19 16:28:08 christos Exp $ 2617# asterix: file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character 2618# strings as "long" - we assume they're just strings: 2619# From: guy@netapp.com (Guy Harris) 2620# 26210 string *STA Aster*x 2622>7 string WORD Words Document 2623>7 string GRAP Graphic 2624>7 string SPRE Spreadsheet 2625>7 string MACR Macro 26260 string 2278 Aster*x Version 2 2627>29 byte 0x36 Words Document 2628>29 byte 0x35 Graphic 2629>29 byte 0x32 Spreadsheet 2630>29 byte 0x38 Macro 2631 2632 2633#------------------------------------------------------------------------------ 2634# $File: att3b,v 1.8 2009/09/19 16:28:08 christos Exp $ 2635# att3b: file(1) magic for AT&T 3B machines 2636# 2637# The `versions' should be un-commented if they work for you. 2638# (Was the problem just one of endianness?) 2639# 2640# 3B20 2641# 2642# The 3B20 conflicts with SCCS. 2643#0 beshort 0550 3b20 COFF executable 2644#>12 belong >0 not stripped 2645#>22 beshort >0 - version %ld 2646#0 beshort 0551 3b20 COFF executable (TV) 2647#>12 belong >0 not stripped 2648#>22 beshort >0 - version %ld 2649# 2650# WE32K 2651# 26520 beshort 0560 WE32000 COFF 2653>18 beshort ^00000020 object 2654>18 beshort &00000020 executable 2655>12 belong >0 not stripped 2656>18 beshort ^00010000 N/A on 3b2/300 w/paging 2657>18 beshort &00020000 32100 required 2658>18 beshort &00040000 and MAU hardware required 2659>20 beshort 0407 (impure) 2660>20 beshort 0410 (pure) 2661>20 beshort 0413 (demand paged) 2662>20 beshort 0443 (target shared library) 2663>22 beshort >0 - version %ld 26640 beshort 0561 WE32000 COFF executable (TV) 2665>12 belong >0 not stripped 2666#>18 beshort &00020000 - 32100 required 2667#>18 beshort &00040000 and MAU hardware required 2668#>22 beshort >0 - version %ld 2669# 2670# core file for 3b2 26710 string \000\004\036\212\200 3b2 core file 2672>364 string >\0 of '%s' 2673 2674#------------------------------------------------------------------------------ 2675# $File: audio,v 1.68 2013/12/02 13:32:26 christos Exp $ 2676# audio: file(1) magic for sound formats (see also "iff") 2677# 2678# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com), 2679# and others 2680# 2681 2682# Sun/NeXT audio data 26830 string .snd Sun/NeXT audio data: 2684>12 belong 1 8-bit ISDN mu-law, 2685!:mime audio/basic 2686>12 belong 2 8-bit linear PCM [REF-PCM], 2687!:mime audio/basic 2688>12 belong 3 16-bit linear PCM, 2689!:mime audio/basic 2690>12 belong 4 24-bit linear PCM, 2691!:mime audio/basic 2692>12 belong 5 32-bit linear PCM, 2693!:mime audio/basic 2694>12 belong 6 32-bit IEEE floating point, 2695!:mime audio/basic 2696>12 belong 7 64-bit IEEE floating point, 2697!:mime audio/basic 2698>12 belong 8 Fragmented sample data, 2699>12 belong 10 DSP program, 2700>12 belong 11 8-bit fixed point, 2701>12 belong 12 16-bit fixed point, 2702>12 belong 13 24-bit fixed point, 2703>12 belong 14 32-bit fixed point, 2704>12 belong 18 16-bit linear with emphasis, 2705>12 belong 19 16-bit linear compressed, 2706>12 belong 20 16-bit linear with emphasis and compression, 2707>12 belong 21 Music kit DSP commands, 2708>12 belong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.), 2709!:mime audio/x-adpcm 2710>12 belong 24 compressed (8-bit CCITT G.722 ADPCM) 2711>12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), 2712>12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), 2713>12 belong 27 8-bit A-law (CCITT G.711), 2714>20 belong 1 mono, 2715>20 belong 2 stereo, 2716>20 belong 4 quad, 2717>16 belong >0 %d Hz 2718 2719# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format 2720# that uses little-endian encoding and has a different magic number 27210 lelong 0x0064732E DEC audio data: 2722>12 lelong 1 8-bit ISDN mu-law, 2723!:mime audio/x-dec-basic 2724>12 lelong 2 8-bit linear PCM [REF-PCM], 2725!:mime audio/x-dec-basic 2726>12 lelong 3 16-bit linear PCM, 2727!:mime audio/x-dec-basic 2728>12 lelong 4 24-bit linear PCM, 2729!:mime audio/x-dec-basic 2730>12 lelong 5 32-bit linear PCM, 2731!:mime audio/x-dec-basic 2732>12 lelong 6 32-bit IEEE floating point, 2733!:mime audio/x-dec-basic 2734>12 lelong 7 64-bit IEEE floating point, 2735!:mime audio/x-dec-basic 2736>12 belong 8 Fragmented sample data, 2737>12 belong 10 DSP program, 2738>12 belong 11 8-bit fixed point, 2739>12 belong 12 16-bit fixed point, 2740>12 belong 13 24-bit fixed point, 2741>12 belong 14 32-bit fixed point, 2742>12 belong 18 16-bit linear with emphasis, 2743>12 belong 19 16-bit linear compressed, 2744>12 belong 20 16-bit linear with emphasis and compression, 2745>12 belong 21 Music kit DSP commands, 2746>12 lelong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.), 2747!:mime audio/x-dec-basic 2748>12 belong 24 compressed (8-bit CCITT G.722 ADPCM) 2749>12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), 2750>12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), 2751>12 belong 27 8-bit A-law (CCITT G.711), 2752>20 lelong 1 mono, 2753>20 lelong 2 stereo, 2754>20 lelong 4 quad, 2755>16 lelong >0 %d Hz 2756 2757# Creative Labs AUDIO stuff 27580 string MThd Standard MIDI data 2759!:mime audio/midi 2760>8 beshort x (format %d) 2761>10 beshort x using %d track 2762>10 beshort >1 \bs 2763>12 beshort&0x7fff x at 1/%d 2764>12 beshort&0x8000 >0 SMPTE 2765 27660 string CTMF Creative Music (CMF) data 2767!:mime audio/x-unknown 27680 string SBI SoundBlaster instrument data 2769!:mime audio/x-unknown 27700 string Creative\ Voice\ File Creative Labs voice data 2771!:mime audio/x-unknown 2772# is this next line right? it came this way... 2773>19 byte 0x1A 2774>23 byte >0 - version %d 2775>22 byte >0 \b.%d 2776 2777# first entry is also the string "NTRK" 27780 belong 0x4e54524b MultiTrack sound data 2779>4 belong x - version %ld 2780 2781# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED 2782# [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi] 27830 string EMOD Extended MOD sound data, 2784>4 byte&0xf0 x version %d 2785>4 byte&0x0f x \b.%d, 2786>45 byte x %d instruments 2787>83 byte 0 (module) 2788>83 byte 1 (song) 2789 2790# Real Audio (Magic .ra\0375) 27910 belong 0x2e7261fd RealAudio sound file 2792!:mime audio/x-pn-realaudio 27930 string .RMF\0\0\0 RealMedia file 2794!:mime application/vnd.rn-realmedia 2795#video/x-pn-realvideo 2796#video/vnd.rn-realvideo 2797#application/vnd.rn-realmedia 2798# sigh, there are many mimes for that but the above are the most common. 2799 2800# MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net] 2801# Oct 31, 1995 2802# fixed by <doj@cubic.org> 2003-06-24 2803# Too short... 2804#0 string MTM MultiTracker Module sound file 2805#0 string if Composer 669 Module sound data 2806#0 string JN Composer 669 Module sound data (extended format) 28070 string MAS_U ULT(imate) Module sound data 2808 2809#0 string FAR Module sound data 2810#>4 string >\15 Title: "%s" 2811 28120x2c string SCRM ScreamTracker III Module sound data 2813>0 string >\0 Title: "%s" 2814 2815# Gravis UltraSound patches 2816# From <ache@nagual.ru> 2817 28180 string GF1PATCH110\0ID#000002\0 GUS patch 28190 string GF1PATCH100\0ID#000002\0 Old GUS patch 2820 2821# mime types according to http://www.geocities.com/nevilo/mod.htm: 2822# audio/it .it 2823# audio/x-zipped-it .itz 2824# audio/xm fasttracker modules 2825# audio/x-s3m screamtracker modules 2826# audio/s3m screamtracker modules 2827# audio/x-zipped-mod mdz 2828# audio/mod mod 2829# audio/x-mod All modules (mod, s3m, 669, mtm, med, xm, it, mdz, stm, itz, xmz, s3z) 2830 2831# 2832# Taken from loader code from mikmod version 2.14 2833# by Steve McIntyre (stevem@chiark.greenend.org.uk) 2834# <doj@cubic.org> added title printing on 2003-06-24 28350 string MAS_UTrack_V00 2836>14 string >/0 ultratracker V1.%.1s module sound data 2837!:mime audio/x-mod 2838#audio/x-tracker-module 2839 28400 string UN05 MikMod UNI format module sound data 2841 28420 string Extended\ Module: Fasttracker II module sound data 2843!:mime audio/x-mod 2844#audio/x-tracker-module 2845>17 string >\0 Title: "%s" 2846 284721 string/c =!SCREAM! Screamtracker 2 module sound data 2848!:mime audio/x-mod 2849#audio/x-screamtracker-module 285021 string BMOD2STM Screamtracker 2 module sound data 2851!:mime audio/x-mod 2852#audio/x-screamtracker-module 28531080 string M.K. 4-channel Protracker module sound data 2854!:mime audio/x-mod 2855#audio/x-protracker-module 2856>0 string >\0 Title: "%s" 28571080 string M!K! 4-channel Protracker module sound data 2858!:mime audio/x-mod 2859#audio/x-protracker-module 2860>0 string >\0 Title: "%s" 28611080 string FLT4 4-channel Startracker module sound data 2862!:mime audio/x-mod 2863#audio/x-startracker-module 2864>0 string >\0 Title: "%s" 28651080 string FLT8 8-channel Startracker module sound data 2866!:mime audio/x-mod 2867#audio/x-startracker-module 2868>0 string >\0 Title: "%s" 28691080 string 4CHN 4-channel Fasttracker module sound data 2870!:mime audio/x-mod 2871#audio/x-fasttracker-module 2872>0 string >\0 Title: "%s" 28731080 string 6CHN 6-channel Fasttracker module sound data 2874!:mime audio/x-mod 2875#audio/x-fasttracker-module 2876>0 string >\0 Title: "%s" 28771080 string 8CHN 8-channel Fasttracker module sound data 2878!:mime audio/x-mod 2879#audio/x-fasttracker-module 2880>0 string >\0 Title: "%s" 28811080 string CD81 8-channel Octalyser module sound data 2882!:mime audio/x-mod 2883#audio/x-octalysertracker-module 2884>0 string >\0 Title: "%s" 28851080 string OKTA 8-channel Octalyzer module sound data 2886!:mime audio/x-mod 2887#audio/x-octalysertracker-module 2888>0 string >\0 Title: "%s" 2889# Not good enough. 2890#1082 string CH 2891#>1080 string >/0 %.2s-channel Fasttracker "oktalyzer" module sound data 28921080 string 16CN 16-channel Taketracker module sound data 2893!:mime audio/x-mod 2894#audio/x-taketracker-module 2895>0 string >\0 Title: "%s" 28961080 string 32CN 32-channel Taketracker module sound data 2897!:mime audio/x-mod 2898#audio/x-taketracker-module 2899>0 string >\0 Title: "%s" 2900 2901# TOC sound files -Trevor Johnson <trevor@jpj.net> 2902# 29030 string TOC TOC sound file 2904 2905# sidfiles <pooka@iki.fi> 2906# added name,author,(c) and new RSID type by <doj@cubic.org> 2003-06-24 29070 string SIDPLAY\ INFOFILE Sidplay info file 2908 29090 string PSID PlaySID v2.2+ (AMIGA) sidtune 2910>4 beshort >0 w/ header v%d, 2911>14 beshort =1 single song, 2912>14 beshort >1 %d songs, 2913>16 beshort >0 default song: %d 2914>0x16 string >\0 name: "%s" 2915>0x36 string >\0 author: "%s" 2916>0x56 string >\0 copyright: "%s" 2917 29180 string RSID RSID sidtune PlaySID compatible 2919>4 beshort >0 w/ header v%d, 2920>14 beshort =1 single song, 2921>14 beshort >1 %d songs, 2922>16 beshort >0 default song: %d 2923>0x16 string >\0 name: "%s" 2924>0x36 string >\0 author: "%s" 2925>0x56 string >\0 copyright: "%s" 2926 2927# IRCAM sound files - Michael Pruett <michael@68k.org> 2928# http://www-mmsp.ece.mcgill.ca/documents/AudioFormats/IRCAM/IRCAM.html 29290 belong 0x64a30100 IRCAM file (VAX little-endian) 29300 belong 0x0001a364 IRCAM file (VAX big-endian) 29310 belong 0x64a30200 IRCAM file (Sun big-endian) 29320 belong 0x0002a364 IRCAM file (Sun little-endian) 29330 belong 0x64a30300 IRCAM file (MIPS little-endian) 29340 belong 0x0003a364 IRCAM file (MIPS big-endian) 29350 belong 0x64a30400 IRCAM file (NeXT big-endian) 29360 belong 0x64a30400 IRCAM file (NeXT big-endian) 29370 belong 0x0004a364 IRCAM file (NeXT little-endian) 2938 2939# NIST SPHERE <mpruett@sgi.com> 29400 string NIST_1A\n\ \ \ 1024\n NIST SPHERE file 2941 2942# Sample Vision <mpruett@sgi.com> 29430 string SOUND\ SAMPLE\ DATA\ Sample Vision file 2944 2945# Audio Visual Research <tonigonenstein@users.sourceforge.net> 29460 string 2BIT Audio Visual Research file, 2947>12 beshort =0 mono, 2948>12 beshort =-1 stereo, 2949>14 beshort x %d bits 2950>16 beshort =0 unsigned, 2951>16 beshort =-1 signed, 2952>22 belong&0x00ffffff x %d Hz, 2953>18 beshort =0 no loop, 2954>18 beshort =-1 loop, 2955>21 ubyte <128 note %d, 2956>22 byte =0 replay 5.485 KHz 2957>22 byte =1 replay 8.084 KHz 2958>22 byte =2 replay 10.971 KHz 2959>22 byte =3 replay 16.168 KHz 2960>22 byte =4 replay 21.942 KHz 2961>22 byte =5 replay 32.336 KHz 2962>22 byte =6 replay 43.885 KHz 2963>22 byte =7 replay 47.261 KHz 2964 2965# SGI SoundTrack <mpruett@sgi.com> 29660 string _SGI_SoundTrack SGI SoundTrack project file 2967# ID3 version 2 tags <waschk@informatik.uni-rostock.de> 29680 string ID3 Audio file with ID3 version 2 2969>3 byte x \b.%d 2970>4 byte x \b.%d 2971>>5 byte &0x80 \b, unsynchronized frames 2972>>5 byte &0x40 \b, extended header 2973>>5 byte &0x20 \b, experimental 2974>>5 byte &0x10 \b, footer present 2975>(6.I) indirect x \b, contains: 2976 2977# NSF (NES sound file) magic 29780 string NESM\x1a NES Sound File 2979>14 string >\0 ("%s" by 2980>46 string >\0 %s, copyright 2981>78 string >\0 %s), 2982>5 byte x version %d, 2983>6 byte x %d tracks, 2984>122 byte&0x2 =1 dual PAL/NTSC 2985>122 byte&0x1 =1 PAL 2986>122 byte&0x1 =0 NTSC 2987 2988# Type: SNES SPC700 sound files 2989# From: Josh Triplett <josh@freedesktop.org> 29900 string SNES-SPC700\ Sound\ File\ Data\ v SNES SPC700 sound file 2991>&0 string 0.30 \b, version %s 2992>>0x23 byte 0x1B \b, without ID666 tag 2993>>0x23 byte 0x1A \b, with ID666 tag 2994>>>0x2E string >\0 \b, song "%.32s" 2995>>>0x4E string >\0 \b, game "%.32s" 2996 2997# Impulse tracker module (audio/x-it) 29980 string IMPM Impulse Tracker module sound data - 2999!:mime audio/x-mod 3000>4 string >\0 "%s" 3001>40 leshort !0 compatible w/ITv%x 3002>42 leshort !0 created w/ITv%x 3003 3004# Imago Orpheus module (audio/x-imf) 300560 string IM10 Imago Orpheus module sound data - 3006>0 string >\0 "%s" 3007 3008# From <collver1@attbi.com> 3009# These are the /etc/magic entries to decode modules, instruments, and 3010# samples in Impulse Tracker's native format. 3011 30120 string IMPS Impulse Tracker Sample 3013>18 byte &2 16 bit 3014>18 byte ^2 8 bit 3015>18 byte &4 stereo 3016>18 byte ^4 mono 30170 string IMPI Impulse Tracker Instrument 3018>28 leshort !0 ITv%x 3019>30 byte !0 %d samples 3020 3021# Yamaha TX Wave: file(1) magic for Yamaha TX Wave audio files 3022# From <collver1@attbi.com> 30230 string LM8953 Yamaha TX Wave 3024>22 byte 0x49 looped 3025>22 byte 0xC9 non-looped 3026>23 byte 1 33kHz 3027>23 byte 2 50kHz 3028>23 byte 3 16kHz 3029 3030# scream tracker: file(1) magic for Scream Tracker sample files 3031# 3032# From <collver1@attbi.com> 303376 string SCRS Scream Tracker Sample 3034>0 byte 1 sample 3035>0 byte 2 adlib melody 3036>0 byte >2 adlib drum 3037>31 byte &2 stereo 3038>31 byte ^2 mono 3039>31 byte &4 16bit little endian 3040>31 byte ^4 8bit 3041>30 byte 0 unpacked 3042>30 byte 1 packed 3043 3044# audio 3045# From: Cory Dikkers <cdikkers@swbell.net> 30460 string MMD0 MED music file, version 0 30470 string MMD1 OctaMED Pro music file, version 1 30480 string MMD3 OctaMED Soundstudio music file, version 3 30490 string OctaMEDCmpr OctaMED Soundstudio compressed file 30500 string MED MED_Song 30510 string SymM Symphonie SymMOD music file 3052# 30530 string THX AHX version 3054>3 byte =0 1 module data 3055>3 byte =1 2 module data 3056# 30570 string OKTASONG Oktalyzer module data 3058# 30590 string DIGI\ Booster\ module\0 %s 3060>20 byte >0 %c 3061>>21 byte >0 \b%c 3062>>>22 byte >0 \b%c 3063>>>>23 byte >0 \b%c 3064>610 string >\0 \b, "%s" 3065# 30660 string DBM0 DIGI Booster Pro Module 3067>4 byte >0 V%X. 3068>>5 byte x \b%02X 3069>16 string >\0 \b, "%s" 3070# 30710 string FTMN FaceTheMusic module 3072>16 string >\0d \b, "%s" 3073 3074# From: <doj@cubic.org> 2003-06-24 30750 string AMShdr\32 Velvet Studio AMS Module v2.2 30760 string Extreme Extreme Tracker AMS Module v1.3 30770 string DDMF Xtracker DMF Module 3078>4 byte x v%i 3079>0xD string >\0 Title: "%s" 3080>0x2B string >\0 Composer: "%s" 30810 string DSM\32 Dynamic Studio Module DSM 30820 string SONG DigiTrekker DTM Module 30830 string DMDL DigiTrakker MDL Module 30840 string PSM\32 Protracker Studio PSM Module 308544 string PTMF Poly Tracker PTM Module 3086>0 string >\32 Title: "%s" 30870 string MT20 MadTracker 2.0 Module MT2 30880 string RAD\40by\40REALiTY!! RAD Adlib Tracker Module RAD 30890 string RTMM RTM Module 30900x426 string MaDoKaN96 XMS Adlib Module 3091>0 string >\0 Composer: "%s" 30920 string AMF AMF Module 3093>4 string >\0 Title: "%s" 30940 string MODINFO1 Open Cubic Player Module Inforation MDZ 30950 string Extended\40Instrument: Fast Tracker II Instrument 3096 3097# From: Takeshi Hamasaki <hma@syd.odn.ne.jp> 3098# NOA Nancy Codec file 30990 string \210NOA\015\012\032 NOA Nancy Codec Movie file 3100# Yamaha SMAF format 31010 string MMMD Yamaha SMAF file 3102# Sharp Jisaku Melody format for PDC 31030 string \001Sharp\040JisakuMelody SHARP Cell-Phone ringing Melody 3104>20 string Ver01.00 Ver. 1.00 3105>>32 byte x , %d tracks 3106 3107# Free lossless audio codec <http://flac.sourceforge.net> 3108# From: Przemyslaw Augustyniak <silvathraec@rpg.pl> 31090 string fLaC FLAC audio bitstream data 3110!:mime audio/x-flac 3111>4 byte&0x7f >0 \b, unknown version 3112>4 byte&0x7f 0 \b 3113# some common bits/sample values 3114>>20 beshort&0x1f0 0x030 \b, 4 bit 3115>>20 beshort&0x1f0 0x050 \b, 6 bit 3116>>20 beshort&0x1f0 0x070 \b, 8 bit 3117>>20 beshort&0x1f0 0x0b0 \b, 12 bit 3118>>20 beshort&0x1f0 0x0f0 \b, 16 bit 3119>>20 beshort&0x1f0 0x170 \b, 24 bit 3120>>20 byte&0xe 0x0 \b, mono 3121>>20 byte&0xe 0x2 \b, stereo 3122>>20 byte&0xe 0x4 \b, 3 channels 3123>>20 byte&0xe 0x6 \b, 4 channels 3124>>20 byte&0xe 0x8 \b, 5 channels 3125>>20 byte&0xe 0xa \b, 6 channels 3126>>20 byte&0xe 0xc \b, 7 channels 3127>>20 byte&0xe 0xe \b, 8 channels 3128# some common sample rates 3129>>17 belong&0xfffff0 0x0ac440 \b, 44.1 kHz 3130>>17 belong&0xfffff0 0x0bb800 \b, 48 kHz 3131>>17 belong&0xfffff0 0x07d000 \b, 32 kHz 3132>>17 belong&0xfffff0 0x056220 \b, 22.05 kHz 3133>>17 belong&0xfffff0 0x05dc00 \b, 24 kHz 3134>>17 belong&0xfffff0 0x03e800 \b, 16 kHz 3135>>17 belong&0xfffff0 0x02b110 \b, 11.025 kHz 3136>>17 belong&0xfffff0 0x02ee00 \b, 12 kHz 3137>>17 belong&0xfffff0 0x01f400 \b, 8 kHz 3138>>17 belong&0xfffff0 0x177000 \b, 96 kHz 3139>>17 belong&0xfffff0 0x0fa000 \b, 64 kHz 3140>>21 byte&0xf >0 \b, >4G samples 3141>>21 byte&0xf 0 \b 3142>>>22 belong >0 \b, %u samples 3143>>>22 belong 0 \b, length unknown 3144 3145# (ISDN) VBOX voice message file (Wolfram Kleff) 31460 string VBOX VBOX voice message data 3147 3148# ReBorn Song Files (.rbs) 3149# David J. Singer <doc@deadvirgins.org.uk> 31508 string RB40 RBS Song file 3151>29 string ReBorn created by ReBorn 3152>37 string Propellerhead created by ReBirth 3153 3154# Synthesizer Generator and Kimwitu share their file format 31550 string A#S#C#S#S#L#V#3 Synthesizer Generator or Kimwitu data 3156# Kimwitu++ uses a slightly different magic 31570 string A#S#C#S#S#L#HUB Kimwitu++ data 3158 3159# From "Simon Hosie 31600 string TFMX-SONG TFMX module sound data 3161 3162# Monkey's Audio compressed audio format (.ape) 3163# From danny.milo@gmx.net (Danny Milosavljevic) 3164# New version from Abel Cheung <abel (@) oaka.org> 31650 string MAC\040 Monkey's Audio compressed format 3166!:mime audio/x-ape 3167>4 uleshort >0x0F8B version %d 3168>>(0x08.l) uleshort =1000 with fast compression 3169>>(0x08.l) uleshort =2000 with normal compression 3170>>(0x08.l) uleshort =3000 with high compression 3171>>(0x08.l) uleshort =4000 with extra high compression 3172>>(0x08.l) uleshort =5000 with insane compression 3173>>(0x08.l+18) uleshort =1 \b, mono 3174>>(0x08.l+18) uleshort =2 \b, stereo 3175>>(0x08.l+20) ulelong x \b, sample rate %d 3176>4 uleshort <0x0F8C version %d 3177>>6 uleshort =1000 with fast compression 3178>>6 uleshort =2000 with normal compression 3179>>6 uleshort =3000 with high compression 3180>>6 uleshort =4000 with extra high compression 3181>>6 uleshort =5000 with insane compression 3182>>10 uleshort =1 \b, mono 3183>>10 uleshort =2 \b, stereo 3184>>12 ulelong x \b, sample rate %d 3185 3186# adlib sound files 3187# From Gurkan Sengun <gurkan@linuks.mine.nu>, http://www.linuks.mine.nu 31880 string RAWADATA RdosPlay RAW 3189 31901068 string RoR AMUSIC Adlib Tracker 3191 31920 string JCH EdLib 3193 31940 string mpu401tr MPU-401 Trakker 3195 31960 string SAdT Surprise! Adlib Tracker 3197>4 byte x Version %d 3198 31990 string XAD! eXotic ADlib 3200 32010 string ofTAZ! eXtra Simple Music 3202 3203# Spectrum 128 tunes (.ay files). 3204# From: Emanuel Haupt <ehaupt@critical.ch> 32050 string ZXAYEMUL Spectrum 128 tune 3206 32070 string \0BONK BONK, 3208#>5 byte x version %d 3209>14 byte x %d channel(s), 3210>15 byte =1 lossless, 3211>15 byte =0 lossy, 3212>16 byte x mid-side 3213 3214384 string LockStream LockStream Embedded file (mostly MP3 on old Nokia phones) 3215 3216# format VQF (proprietary codec for sound) 3217# some infos on the header file available at : 3218# http://www.twinvq.org/english/technology_format.html 32190 string TWIN97012000 VQF data 3220>27 short 0 \b, Mono 3221>27 short 1 \b, Stereo 3222>31 short >0 \b, %d kbit/s 3223>35 short >0 \b, %d kHz 3224 3225# Nelson A. de Oliveira (naoliv@gmail.com) 3226# .eqf 32270 string Winamp\ EQ\ library\ file %s 3228# it will match only versions like v<digit>.<digit> 3229# Since I saw only eqf files with version v1.1 I think that it's OK 3230>23 string x \b%.4s 3231# .preset 32320 string [Equalizer\ preset] XMMS equalizer preset 3233# .m3u 32340 search/1 #EXTM3U M3U playlist text 3235# .pls 32360 search/1 [playlist] PLS playlist text 3237# licq.conf 32381 string [licq] LICQ configuration file 3239 3240# Atari ST audio files by Dirk Jagdmann <doj@cubic.org> 32410 string ICE! SNDH Atari ST music 32420 string SC68\ Music-file\ /\ (c)\ (BeN)jami sc68 Atari ST music 3243 3244# musepak support From: "Jiri Pejchal" <jiri.pejchal@gmail.com> 32450 string MP+ Musepack audio 3246!:mime audio/x-musepack 3247>3 byte 255 \b, SV pre8 3248>3 byte&0xF 0x6 \b, SV 6 3249>3 byte&0xF 0x8 \b, SV 8 3250>3 byte&0xF 0x7 \b, SV 7 3251>>3 byte&0xF0 0x0 \b.0 3252>>3 byte&0xF0 0x10 \b.1 3253>>3 byte&0xF0 240 \b.15 3254>>10 byte&0xF0 0x0 \b, no profile 3255>>10 byte&0xF0 0x10 \b, profile 'Unstable/Experimental' 3256>>10 byte&0xF0 0x50 \b, quality 0 3257>>10 byte&0xF0 0x60 \b, quality 1 3258>>10 byte&0xF0 0x70 \b, quality 2 (Telephone) 3259>>10 byte&0xF0 0x80 \b, quality 3 (Thumb) 3260>>10 byte&0xF0 0x90 \b, quality 4 (Radio) 3261>>10 byte&0xF0 0xA0 \b, quality 5 (Standard) 3262>>10 byte&0xF0 0xB0 \b, quality 6 (Xtreme) 3263>>10 byte&0xF0 0xC0 \b, quality 7 (Insane) 3264>>10 byte&0xF0 0xD0 \b, quality 8 (BrainDead) 3265>>10 byte&0xF0 0xE0 \b, quality 9 3266>>10 byte&0xF0 0xF0 \b, quality 10 3267>>27 byte 0x0 \b, Buschmann 1.7.0-9, Klemm 0.90-1.05 3268>>27 byte 102 \b, Beta 1.02 3269>>27 byte 104 \b, Beta 1.04 3270>>27 byte 105 \b, Alpha 1.05 3271>>27 byte 106 \b, Beta 1.06 3272>>27 byte 110 \b, Release 1.1 3273>>27 byte 111 \b, Alpha 1.11 3274>>27 byte 112 \b, Beta 1.12 3275>>27 byte 113 \b, Alpha 1.13 3276>>27 byte 114 \b, Beta 1.14 3277>>27 byte 115 \b, Alpha 1.15 3278 3279# IMY 3280# from http://filext.com/detaillist.php?extdetail=IMY 3281# http://cellphones.about.com/od/cellularfaqs/f/rf_imelody.htm 3282# http://download.ncl.ie/doc/api/ie/ncl/media/music/IMelody.html 3283# http://www.wx800.com/msg/download/irda/iMelody.pdf 32840 string BEGIN:IMELODY iMelody Ringtone Format 3285 3286# From: "Mateus Caruccio" <mateus@caruccio.com> 3287# guitar pro v3,4,5 from http://filext.com/file-extension/gp3 32880 string \030FICHIER\ GUITAR\ PRO\ v3. Guitar Pro Ver. 3 Tablature 3289 3290# From: "Leslie P. Polzer" <leslie.polzer@gmx.net> 329160 string SONG SoundFX Module sound file 3292 3293# Type: Adaptive Multi-Rate Codec 3294# URL: http://filext.com/detaillist.php?extdetail=AMR 3295# From: Russell Coker <russell@coker.com.au> 32960 string #!AMR Adaptive Multi-Rate Codec (GSM telephony) 3297 3298# Type: SuperCollider 3 Synth Definition File Format 3299# From: Mario Lang <mlang@debian.org> 33000 string SCgf SuperCollider3 Synth Definition file, 3301>4 belong x version %d 3302 3303# Type: True Audio Lossless Audio 3304# URL: http://wiki.multimedia.cx/index.php?title=True_Audio 3305# From: Mike Melanson <mike@multimedia.cx> 33060 string TTA1 True Audio Lossless Audio 3307 3308# Type: WavPack Lossless Audio 3309# URL: http://wiki.multimedia.cx/index.php?title=WavPack 3310# From: Mike Melanson <mike@multimedia.cx> 33110 string wvpk WavPack Lossless Audio 3312 3313# From Fábio R. Schmidlin <frs@pop.com.br> 3314# VGM music file 33150 string Vgm\ 3316>9 ubyte >0 VGM Video Game Music dump v 3317>>9 ubyte/16 >0 \b%d 3318>>9 ubyte&0x0F x \b%d 3319>>8 ubyte/16 x \b.%d 3320>>8 ubyte&0x0F >0 \b%d 3321#Get soundchips 3322>>8 ubyte x \b, soundchip(s)= 3323>>0x0C ulelong >0 SN76489, 3324>>0x10 ulelong >0 YM2413, 3325>>0x2C ulelong >0 YM2612, 3326>>0x30 ulelong >0 YM2151, 3327>>0x38 ulelong >0 Sega PCM, 3328>>0x34 ulelong >0xC 3329>>>0x40 ulelong >0 RF5C68, 3330>>0x34 ulelong >0x10 3331>>>0x44 ulelong >0 YM2203, 3332>>0x34 ulelong >0x14 3333>>>0x48 ulelong >0 YM2608, 3334>>0x34 ulelong >0x18 3335>>>0x4C lelong >0 YM2610, 3336>>>0x4C lelong <0 YM2610B, 3337>>0x34 ulelong >0x1C 3338>>>0x50 ulelong >0 YM3812, 3339>>0x34 ulelong >0x20 3340>>>0x54 ulelong >0 YM3526, 3341>>0x34 ulelong >0x24 3342>>>0x58 ulelong >0 Y8950, 3343>>0x34 ulelong >0x28 3344>>>0x5C ulelong >0 YMF262, 3345>>0x34 ulelong >0x2C 3346>>>0x60 ulelong >0 YMF278B, 3347>>0x34 ulelong >0x30 3348>>>0x64 ulelong >0 YMF271, 3349>>0x34 ulelong >0x34 3350>>>0x68 ulelong >0 YMZ280B, 3351>>0x34 ulelong >0x38 3352>>>0x6C ulelong >0 RF5C164, 3353>>0x34 ulelong >0x3C 3354>>>0x70 ulelong >0 PWM, 3355>>0x34 ulelong >0x40 3356>>>0x74 ulelong >0 3357>>>>0x78 ubyte 0x00 AY-3-8910, 3358>>>>0x78 ubyte 0x01 AY-3-8912, 3359>>>>0x78 ubyte 0x02 AY-3-8913, 3360>>>>0x78 ubyte 0x03 AY-3-8930, 3361>>>>0x78 ubyte 0x10 YM2149, 3362>>>>0x78 ubyte 0x11 YM3439, 3363 3364# GVOX Encore file format 3365# Since this is a proprietary file format and there is no publicly available 3366# format specification, this is just based on induction 3367# 33680 string SCOW 3369>4 byte 0xc4 GVOX Encore music, version 5.0 or above 3370>4 byte 0xc2 GVOX Encore music, version < 5.0 3371 33720 string ZBOT 3373>4 byte 0xc5 GVOX Encore music, version < 5.0 3374 3375 3376#---------------------------------------------------------------- 3377# $File: basis,v 1.4 2009/09/19 16:28:08 christos Exp $ 3378# basis: file(1) magic for BBx/Pro5-files 3379# Oliver Dammer <dammer@olida.de> 2005/11/07 3380# http://www.basis.com business-basic-files. 3381# 33820 string \074\074bbx\076\076 BBx 3383>7 string \000 indexed file 3384>7 string \001 serial file 3385>7 string \002 keyed file 3386>>13 short 0 (sort) 3387>7 string \004 program 3388>>18 byte x (LEVEL %d) 3389>>>23 string >\000 psaved 3390>7 string \006 mkeyed file 3391>>13 short 0 (sort) 3392>>8 string \000 (mkey) 3393 3394#------------------------------------------------------------------------------ 3395# $File: bflt,v 1.4 2009/09/19 16:28:08 christos Exp $ 3396# bFLT: file(1) magic for BFLT uclinux binary files 3397# 3398# From Philippe De Muyter <phdm@macqel.be> 3399# 34000 string bFLT BFLT executable 3401>4 belong x - version %ld 3402>4 belong 4 3403>>36 belong&0x1 0x1 ram 3404>>36 belong&0x2 0x2 gotpic 3405>>36 belong&0x4 0x4 gzip 3406>>36 belong&0x8 0x8 gzdata 3407 3408#------------------------------------------------------------------------------ 3409# $File: blackberry,v 1.1 2014/01/31 01:51:32 christos Exp $ 3410# blackberry: file(1) magic for BlackBerry file formats 3411# 34125 belong 0 3413>8 belong 010010010 BlackBerry RIM ETP file 3414>>22 string x \b for %s 3415# Berkeley Lab Checkpoint Restart (BLCR) checkpoint context files 3416# http://ftg.lbl.gov/checkpoint 34170 string C\0\0\0R\0\0\0 BLCR 3418>16 lelong 1 x86 3419>16 lelong 3 alpha 3420>16 lelong 5 x86-64 3421>16 lelong 7 ARM 3422>8 lelong x context data (little endian, version %d) 3423# Uncomment the following only of your "file" program supports "search" 3424#>0 search/1024 VMA\06 for kernel 3425#>>&1 byte x %d. 3426#>>&2 byte x %d. 3427#>>&3 byte x %d 34280 string \0\0\0C\0\0\0R BLCR 3429>16 belong 2 SPARC 3430>16 belong 4 ppc 3431>16 belong 6 ppc64 3432>16 belong 7 ARMEB 3433>16 belong 8 SPARC64 3434>8 belong x context data (big endian, version %d) 3435# Uncomment the following only of your "file" program supports "search" 3436#>0 search/1024 VMA\06 for kernel 3437#>>&1 byte x %d. 3438#>>&2 byte x \b%d. 3439#>>&3 byte x \b%d 3440 3441#------------------------------------------------------------------------------ 3442# $File: blender,v 1.5 2009/09/19 16:28:08 christos Exp $ 3443# blender: file(1) magic for Blender 3D related files 3444# 3445# Native format rule v1.2. For questions use the developers list 3446# http://lists.blender.org/mailman/listinfo/bf-committers 3447# GLOB chunk was moved near start and provides subversion info since 2.42 3448 34490 string =BLENDER Blender3D, 3450>7 string =_ saved as 32-bits 3451>>8 string =v little endian 3452>>>9 byte x with version %c. 3453>>>10 byte x \b%c 3454>>>11 byte x \b%c 3455>>>0x40 string =GLOB \b. 3456>>>>0x58 leshort x \b%.4d 3457>>8 string =V big endian 3458>>>9 byte x with version %c. 3459>>>10 byte x \b%c 3460>>>11 byte x \b%c 3461>>>0x40 string =GLOB \b. 3462>>>>0x58 beshort x \b%.4d 3463>7 string =- saved as 64-bits 3464>>8 string =v little endian 3465>>9 byte x with version %c. 3466>>10 byte x \b%c 3467>>11 byte x \b%c 3468>>0x44 string =GLOB \b. 3469>>>0x60 leshort x \b%.4d 3470>>8 string =V big endian 3471>>>9 byte x with version %c. 3472>>>10 byte x \b%c 3473>>>11 byte x \b%c 3474>>>0x44 string =GLOB \b. 3475>>>>0x60 beshort x \b%.4d 3476 3477# Scripts that run in the embeded Python interpreter 34780 string #!BPY Blender3D BPython script 3479 3480#------------------------------------------------------------------------------ 3481# $File: blit,v 1.8 2009/09/19 16:28:08 christos Exp $ 3482# blit: file(1) magic for 68K Blit stuff as seen from 680x0 machine 3483# 3484# Note that this 0407 conflicts with several other a.out formats... 3485# 3486# XXX - should this be redone with "be" and "le", so that it works on 3487# little-endian machines as well? If so, what's the deal with 3488# "VAX-order" and "VAX-order2"? 3489# 3490#0 long 0407 68K Blit (standalone) executable 3491#0 short 0407 VAX-order2 68K Blit (standalone) executable 34920 short 03401 VAX-order 68K Blit (standalone) executable 34930 long 0406 68k Blit mpx/mux executable 34940 short 0406 VAX-order2 68k Blit mpx/mux executable 34950 short 03001 VAX-order 68k Blit mpx/mux executable 3496# Need more values for WE32 DMD executables. 3497# Note that 0520 is the same as COFF 3498#0 short 0520 tty630 layers executable 3499 3500#------------------------------------------------------------------------------ 3501# $File: bout,v 1.5 2009/09/19 16:28:08 christos Exp $ 3502# i80960 b.out objects and archives 3503# 35040 long 0x10d i960 b.out relocatable object 3505>16 long >0 not stripped 3506# 3507# b.out archive (hp-rt on i960) 35080 string =!<bout> b.out archive 3509>8 string __.SYMDEF random library 3510 3511#------------------------------------------------------------------------------ 3512# $File: bsdi,v 1.6 2013/01/09 22:37:24 christos Exp $ 3513# bsdi: file(1) magic for BSD/OS (from BSDI) objects 3514# Some object/executable formats use the same magic numbers as are used 3515# in other OSes; those are handled by entries in aout. 3516# 3517 35180 lelong 0314 386 compact demand paged pure executable 3519>16 lelong >0 not stripped 3520>32 byte 0x6a (uses shared libs) 3521 3522# same as in SunOS 4.x, except for static shared libraries 35230 belong&077777777 0600413 sparc demand paged 3524>0 byte &0x80 3525>>20 belong <4096 shared library 3526>>20 belong =4096 dynamically linked executable 3527>>20 belong >4096 dynamically linked executable 3528>0 byte ^0x80 executable 3529>16 belong >0 not stripped 3530>36 belong 0xb4100001 (uses shared libs) 3531 35320 belong&077777777 0600410 sparc pure 3533>0 byte &0x80 dynamically linked executable 3534>0 byte ^0x80 executable 3535>16 belong >0 not stripped 3536>36 belong 0xb4100001 (uses shared libs) 3537 35380 belong&077777777 0600407 sparc 3539>0 byte &0x80 dynamically linked executable 3540>0 byte ^0x80 executable 3541>16 belong >0 not stripped 3542>36 belong 0xb4100001 (uses shared libs) 3543# Chiasmus is a encryption standard developed by the German Federal 3544# Office for Information Security (Bundesamt fuer Sicherheit in der 3545# Informationstechnik). 3546 3547# Extension: .xia 35480 string XIA1 Chiasmus encrypted data 3549 3550# Extension: .xis 35510 string XIS Chiasmus key 3552 3553#------------------------------------------------------------------------------ 3554# $File: btsnoop,v 1.5 2009/09/19 16:28:08 christos Exp $ 3555# BTSnoop: file(1) magic for BTSnoop files 3556# 3557# From <marcel@holtmann.org> 35580 string btsnoop\0 BTSnoop 3559>8 belong x version %d, 3560>12 belong 1001 Unencapsulated HCI 3561>12 belong 1002 HCI UART (H4) 3562>12 belong 1003 HCI BCSP 3563>12 belong 1004 HCI Serial (H5) 3564>>12 belong x type %d 3565 3566#------------------------------------------------------------------------------ 3567# $File: c64,v 1.5 2009/09/19 16:28:08 christos Exp $ 3568# c64: file(1) magic for various commodore 64 related files 3569# 3570# From: Dirk Jagdmann <doj@cubic.org> 3571 35720x16500 belong 0x12014100 D64 Image 35730x16500 belong 0x12014180 D71 Image 35740x61800 belong 0x28034400 D81 Image 35750 string C64\40CARTRIDGE CCS C64 Emultar Cartridge Image 35760 belong 0x43154164 X64 Image 3577 35780 string GCR-1541 GCR Image 3579>8 byte x version: %i 3580>9 byte x tracks: %i 3581 35829 string PSUR ARC archive (c64) 35832 string -LH1- LHA archive (c64) 3584 35850 string C64File PC64 Emulator file 3586>8 string >\0 "%s" 35870 string C64Image PC64 Freezer Image 3588 35890 beshort 0x38CD C64 PCLink Image 35900 string CBM\144\0\0 Power 64 C64 Emulator Snapshot 3591 35920 belong 0xFF424CFF WRAptor packer (c64) 3593 35940 string C64S\x20tape\x20file T64 tape Image 3595>32 leshort x Version:0x%x 3596>36 leshort !0 Entries:%i 3597>40 string x Name:%.24s 3598 35990 string C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image 3600>32 leshort x Version:0x%x 3601>36 leshort !0 Entries:%i 3602>40 string x Name:%.24s 3603 36040 string C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image 3605>32 leshort x Version:0x%x 3606>36 leshort !0 Entries:%i 3607>40 string x Name:%.24s 3608 3609#------------------------------------------------------------------------------ 3610# $File: cad,v 1.12 2013/07/04 15:24:37 christos Exp $ 3611# autocad: file(1) magic for cad files 3612# 3613 3614# Microstation DGN/CIT Files (www.bentley.com) 3615# Last updated July 29, 2005 by Lester Hightower 3616# DGN is the default file extension of Microstation/Intergraph CAD files. 3617# CIT is the proprietary raster format (similar to TIFF) used to attach 3618# raster underlays to Microstation DGN (vector) drawings. 3619# 3620# http://www.wotsit.org/search.asp 3621# http://filext.com/detaillist.php?extdetail=DGN 3622# http://filext.com/detaillist.php?extdetail=CIT 3623# 3624# http://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2 3625# 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928 3626# http://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682 3627# 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F 36280 string \010\011\376 Microstation 3629>3 string \002 3630>>30 string \026\105 DGNFile 3631>>30 string \034\105 DGNFile 3632>>30 string \073\107 DGNFile 3633>>30 string \073\110 DGNFile 3634>>30 string \106\107 DGNFile 3635>>30 string \110\103 DGNFile 3636>>30 string \120\104 DGNFile 3637>>30 string \172\104 DGNFile 3638>>30 string \172\105 DGNFile 3639>>30 string \172\106 DGNFile 3640>>30 string \234\106 DGNFile 3641>>30 string \273\105 DGNFile 3642>>30 string \306\106 DGNFile 3643>>30 string \310\104 DGNFile 3644>>30 string \341\104 DGNFile 3645>>30 string \372\103 DGNFile 3646>>30 string \372\104 DGNFile 3647>>30 string \372\106 DGNFile 3648>>30 string \376\103 DGNFile 3649>4 string \030\000\000 CITFile 3650>4 string \030\000\003 CITFile 3651 3652# AutoCAD 3653# Merge of the different contributions and updates from http://en.wikipedia.org/wiki/Dwg 3654# and http://www.iana.org/assignments/media-types/image/vnd.dwg 36550 string MC0.0 DWG AutoDesk AutoCAD Release 1.0 3656!:mime image/vnd.dwg 36570 string AC1.2 DWG AutoDesk AutoCAD Release 1.2 3658!:mime image/vnd.dwg 36590 string AC1.3 DWG AutoDesk AutoCAD Release 1.3 3660!:mime image/vnd.dwg 36610 string AC1.40 DWG AutoDesk AutoCAD Release 1.40 3662!:mime image/vnd.dwg 36630 string AC1.50 DWG AutoDesk AutoCAD Release 2.05 3664!:mime image/vnd.dwg 36650 string AC2.10 DWG AutoDesk AutoCAD Release 2.10 3666!:mime image/vnd.dwg 36670 string AC2.21 DWG AutoDesk AutoCAD Release 2.21 3668!:mime image/vnd.dwg 36690 string AC2.22 DWG AutoDesk AutoCAD Release 2.22 3670!:mime image/vnd.dwg 36710 string AC1001 DWG AutoDesk AutoCAD Release 2.22 3672!:mime image/vnd.dwg 36730 string AC1002 DWG AutoDesk AutoCAD Release 2.50 3674!:mime image/vnd.dwg 36750 string AC1003 DWG AutoDesk AutoCAD Release 2.60 3676!:mime image/vnd.dwg 36770 string AC1004 DWG AutoDesk AutoCAD Release 9 3678!:mime image/vnd.dwg 36790 string AC1006 DWG AutoDesk AutoCAD Release 10 3680!:mime image/vnd.dwg 36810 string AC1009 DWG AutoDesk AutoCAD Release 11/12 3682!:mime image/vnd.dwg 3683# AutoCAD DWG versions R13/R14 (www.autodesk.com) 3684# Written December 01, 2003 by Lester Hightower 3685# Based on the DWG File Format Specifications at http://www.opendwg.org/ 3686# AutoCad, from Nahuel Greco 3687# AutoCAD DWG versions R12/R13/R14 (www.autodesk.com) 36880 string AC1012 DWG AutoDesk AutoCAD Release 13 3689!:mime image/vnd.dwg 36900 string AC1014 DWG AutoDesk AutoCAD Release 14 3691!:mime image/vnd.dwg 36920 string AC1015 DWG AutoDesk AutoCAD 2000/2002 3693!:mime image/vnd.dwg 3694 3695# A new version of AutoCAD DWG 3696# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru, 3697# ICQ 358572321) 3698# From various sources like: 3699# http://autodesk.blogs.com/between_the_lines/autocad-release-history.html 37000 string AC1018 DWG AutoDesk AutoCAD 2004/2005/2006 3701!:mime image/vnd.dwg 37020 string AC1021 DWG AutoDesk AutoCAD 2007/2008/2009 3703!:mime image/vnd.dwg 37040 string AC1024 DWG AutoDesk AutoCAD 2010/2011/2012 3705!:mime image/vnd.dwg 37060 string AC1027 DWG AutoDesk AutoCAD 2013/2014 3707!:mime image/vnd.dwg 3708 3709# KOMPAS 2D drawing from ASCON 3710# This is KOMPAS 2D drawing or fragment of drawing but is not detailed nor 3711# gathered nor specification 3712# ASCON http://ascon.net/main/ in English, 3713# http://ascon.ru/ main site in Russian 3714# Extension is CDW for drawing and FRW for fragment of drawing 3715# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru, 3716# ICQ 358572321, http://vkontakte.ru/id16076543) 3717# From: 3718# http://sd.ascon.ru/otrs/customer.pl?Action=CustomerFAQ&CategoryID=4&ItemID=292 3719# (in russian) and my experiments 37200 string KF 3721>2 belong 0x4E00000C Kompas drawing 12.0 SP1 3722>2 belong 0x4D00000C Kompas drawing 12.0 3723>2 belong 0x3200000B Kompas drawing 11.0 SP1 3724>2 belong 0x3100000B Kompas drawing 11.0 3725>2 belong 0x2310000A Kompas drawing 10.0 SP1 3726>2 belong 0x2110000A Kompas drawing 10.0 3727>2 belong 0x08000009 Kompas drawing 9.0 SP1 3728>2 belong 0x05000009 Kompas drawing 9.0 3729>2 belong 0x33010008 Kompas drawing 8+ 3730>2 belong 0x1A000008 Kompas drawing 8.0 3731>2 belong 0x2C010107 Kompas drawing 7+ 3732>2 belong 0x05000007 Kompas drawing 7.0 3733>2 belong 0x32000006 Kompas drawing 6+ 3734>2 belong 0x09000006 Kompas drawing 6.0 3735>2 belong 0x5C009005 Kompas drawing 5.11R03 3736>2 belong 0x54009005 Kompas drawing 5.11R02 3737>2 belong 0x51009005 Kompas drawing 5.11R01 3738>2 belong 0x22009005 Kompas drawing 5.10R03 3739>2 belong 0x22009005 Kompas drawing 5.10R02 mar 3740>2 belong 0x21009005 Kompas drawing 5.10R02 febr 3741>2 belong 0x19009005 Kompas drawing 5.10R01 3742>2 belong 0xF4008005 Kompas drawing 5.9R01.003 3743>2 belong 0x1C008005 Kompas drawing 5.9R01.002 3744>2 belong 0x11008005 Kompas drawing 5.8R01.003 3745 3746# CAD: file(1) magic for computer aided design files 3747# Phillip Griffith <phillip dot griffith at gmail dot com> 3748# AutoCAD magic taken from the Open Design Alliance's OpenDWG specifications. 3749# 37500 belong 0x08051700 Bentley/Intergraph MicroStation DGN cell library 37510 belong 0x0809fe02 Bentley/Intergraph MicroStation DGN vector CAD 37520 belong 0xc809fe02 Bentley/Intergraph MicroStation DGN vector CAD 37530 beshort 0x0809 Bentley/Intergraph MicroStation 3754>0x02 byte 0xfe 3755>>0x04 beshort 0x1800 CIT raster CAD 3756 3757# 3DS (3d Studio files) Conflicts with diff output 0x3d '=' 3758#16 beshort 0x3d3d image/x-3ds 3759 3760#------------------------------------------------------------------------------ 3761# $File: cafebabe,v 1.14 2013/02/27 16:59:59 christos Exp $ 3762# Cafe Babes unite! 3763# 3764# Since Java bytecode and Mach-O universal binaries have the same magic number, 3765# the test must be performed in the same "magic" sequence to get both right. 3766# The long at offset 4 in a Mach-O universal binary tells the number of 3767# architectures; the short at offset 4 in a Java bytecode file is the JVM minor 3768# version and the short at offset 6 is the JVM major version. Since there are only 3769# only 18 labeled Mach-O architectures at current, and the first released 3770# Java class format was version 43.0, we can safely choose any number 3771# between 18 and 39 to test the number of architectures against 3772# (and use as a hack). Let's not use 18, because the Mach-O people 3773# might add another one or two as time goes by... 3774# 3775### JAVA START ### 37760 belong 0xcafebabe 3777!:mime application/x-java-applet 3778>4 belong >30 compiled Java class data, 3779>>6 beshort x version %d. 3780>>4 beshort x \b%d 3781# Which is which? 3782#>>4 belong 0x032d (Java 1.0) 3783#>>4 belong 0x032d (Java 1.1) 3784>>4 belong 0x002e (Java 1.2) 3785>>4 belong 0x002f (Java 1.3) 3786>>4 belong 0x0030 (Java 1.4) 3787>>4 belong 0x0031 (Java 1.5) 3788>>4 belong 0x0032 (Java 1.6) 3789 37900 belong 0xcafed00d JAR compressed with pack200, 3791>5 byte x version %d. 3792>4 byte x \b%d 3793!:mime application/x-java-pack200 3794 3795 37960 belong 0xcafed00d JAR compressed with pack200, 3797>5 byte x version %d. 3798>4 byte x \b%d 3799!:mime application/x-java-pack200 3800 3801### JAVA END ### 3802### MACH-O START ### 3803 38040 name mach-o \b [ 3805>0 use mach-o-cpu \b 3806>&(8.L) indirect \b: 3807>0 belong x \b] 3808 38090 belong 0xcafebabe 3810>4 belong 1 Mach-O universal binary with 1 architecture: 3811>>8 use mach-o \b 3812>4 belong >1 3813>>4 belong <20 Mach-O universal binary with %ld architectures: 3814>>>8 use mach-o \b 3815>>>28 use mach-o \b 3816>>4 belong >2 3817>>>48 use mach-o \b 3818>>4 belong >3 3819>>>68 use mach-o \b 3820 3821### MACH-O END ### 3822 3823#------------------------------------------------------------------------------ 3824# $File: cddb,v 1.4 2009/09/19 16:28:08 christos Exp $ 3825# CDDB: file(1) magic for CDDB(tm) format CD text data files 3826# 3827# From <steve@gracenote.com> 3828# 3829# This is the /etc/magic entry to decode datafiles as used by 3830# CDDB-enabled CD player applications. 3831# 3832 38330 search/1/w #\040xmcd CDDB(tm) format CD text data 3834 3835#------------------------------------------------------------------------------ 3836# $File: chord,v 1.5 2010/09/20 19:19:16 rrt Exp $ 3837# chord: file(1) magic for Chord music sheet typesetting utility input files 3838# 3839# From Philippe De Muyter <phdm@macqel.be> 3840# File format is actually free, but many distributed files begin with `{title' 3841# 38420 string {title Chord text file 3843 3844# Type: PowerTab file format 3845# URL: http://www.power-tab.net/ 3846# From: Jelmer Vernooij <jelmer@samba.org> 38470 string ptab\003\000 Power-Tab v3 Tablature File 38480 string ptab\004\000 Power-Tab v4 Tablature File 3849 3850#------------------------------------------------------------------------------ 3851# $File: cisco,v 1.4 2009/09/19 16:28:08 christos Exp $ 3852# cisco: file(1) magic for cisco Systems routers 3853# 3854# Most cisco file-formats are covered by the generic elf code 3855# 3856# Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha. 38570 belong&0xffffff00 0x85011400 cisco IOS microcode 3858>7 string >\0 for '%s' 38590 belong&0xffffff00 0x8501cb00 cisco IOS experimental microcode 3860>7 string >\0 for '%s' 3861 3862#------------------------------------------------------------------------------ 3863# $File: citrus,v 1.4 2009/09/19 16:28:08 christos Exp $ 3864# citrus locale declaration 3865# 3866 38670 string RuneCT Citrus locale declaration for LC_CTYPE 3868 3869#------------------------------------------------------------------------------ 3870# $File: c-lang,v 1.18 2013/08/14 13:06:43 christos Exp $ 3871# c-lang: file(1) magic for C and related languages programs 3872# 3873 3874# BCPL 38750 search/8192 "libhdr" BCPL source text 3876!:mime text/x-bcpl 38770 search/8192 "LIBHDR" BCPL source text 3878!:mime text/x-bcpl 3879 3880# C 38810 regex \^#include C source text 3882!:mime text/x-c 38830 regex \^char[\ \t\n]+ C source text 3884!:mime text/x-c 38850 regex \^double[\ \t\n]+ C source text 3886!:mime text/x-c 38870 regex \^extern[\ \t\n]+ C source text 3888!:mime text/x-c 38890 regex \^float[\ \t\n]+ C source text 3890!:mime text/x-c 38910 regex \^struct[\ \t\n]+ C source text 3892!:mime text/x-c 38930 regex \^union[\ \t\n]+ C source text 3894!:mime text/x-c 38950 search/8192 main( C source text 3896!:mime text/x-c 3897 3898# C++ 3899# The strength of these rules is increased so they beat the C rules above 39000 regex \^template[\ \t\n]+ C++ source text 3901!:strength + 5 3902!:mime text/x-c++ 39030 regex \^virtual[\ \t\n]+ C++ source text 3904!:strength + 5 3905!:mime text/x-c++ 39060 regex \^class[\ \t\n]+ C++ source text 3907!:strength + 5 3908!:mime text/x-c++ 39090 regex \^public: C++ source text 3910!:strength + 5 3911!:mime text/x-c++ 39120 regex \^private: C++ source text 3913!:strength + 5 3914!:mime text/x-c++ 3915 3916# From: Mikhail Teterin <mi@aldan.algebra.com> 39170 string cscope cscope reference data 3918>7 string x version %.2s 3919# We skip the path here, because it is often long (so file will 3920# truncate it) and mostly redundant. 3921# The inverted index functionality was added some time between 3922# versions 11 and 15, so look for -q if version is above 14: 3923>7 string >14 3924>>10 search/100 \ -q\ with inverted index 3925>10 search/100 \ -c\ text (non-compressed) 3926 3927#------------------------------------------------------------------------------ 3928# $File: clarion,v 1.4 2009/09/19 16:28:08 christos Exp $ 3929# clarion: file(1) magic for # Clarion Personal/Professional Developer 3930# (v2 and above) 3931# From: Julien Blache <jb@jblache.org> 3932 3933# Database files 3934# signature 39350 leshort 0x3343 Clarion Developer (v2 and above) data file 3936# attributes 3937>2 leshort &0x0001 \b, locked 3938>2 leshort &0x0004 \b, encrypted 3939>2 leshort &0x0008 \b, memo file exists 3940>2 leshort &0x0010 \b, compressed 3941>2 leshort &0x0040 \b, read only 3942# number of records 3943>5 lelong x \b, %ld records 3944 3945# Memo files 39460 leshort 0x334d Clarion Developer (v2 and above) memo data 3947 3948# Key/Index files 3949# No magic? :( 3950 3951# Help files 39520 leshort 0x49e0 Clarion Developer (v2 and above) help data 3953 3954#------------------------------------------------------------------------------ 3955# $File: claris,v 1.6 2012/06/20 21:19:05 christos Exp $ 3956# claris: file(1) magic for claris 3957# "H. Nanosecond" <aldomel@ix.netcom.com> 3958# Claris Works a word processor, etc. 3959# Version 3.0 3960 3961# .pct claris works clip art files 3962#0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 3963#* 3964#0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000 3965#null to byte 1000 octal 3966514 string \377\377\377\377\000 3967>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 Claris clip art 3968514 string \377\377\377\377\001 3969>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 Claris clip art 3970 3971# Claris works files 3972# .cwk 39730 string \002\000\210\003\102\117\102\117\000\001\206 Claris works document 3974# .plt 39750 string \020\341\000\000\010\010 Claris Works palette files .plt 3976 3977# .msp a dictionary file I am not sure about this I have only one .msp file 39780 string \002\271\262\000\040\002\000\164 Claris works dictionary 3979 3980# .usp are user dictionary bits 3981# I am not sure about a magic header: 3982#0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151 3983# soh S p f 8 U D sp ^ S cr nl p o d i 3984#0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043 3985# a t r i s t sp ^ S cr nl d i v sp # 3986 3987# .mth Thesaurus 3988# starts with \0 but no magic header 3989 3990# .chy Hyphenation file 3991# I am not sure: 000 210 034 000 000 3992 3993# other claris files 3994#./windows/claris/useng.ndx: data 3995#./windows/claris/xtndtran.l32: data 3996#./windows/claris/xtndtran.lst: data 3997#./windows/claris/clworks.lbl: data 3998#./windows/claris/clworks.prf: data 3999#./windows/claris/userd.spl: data 4000 4001#------------------------------------------------------------------------------ 4002# $File: clipper,v 1.6 2009/09/19 16:28:08 christos Exp $ 4003# clipper: file(1) magic for Intergraph (formerly Fairchild) Clipper. 4004# 4005# XXX - what byte order does the Clipper use? 4006# 4007# XXX - what's the "!" stuff: 4008# 4009# >18 short !074000,000000 C1 R1 4010# >18 short !074000,004000 C2 R1 4011# >18 short !074000,010000 C3 R1 4012# >18 short !074000,074000 TEST 4013# 4014# I shall assume it's ANDing the field with the first value and 4015# comparing it with the second, and rewrite it as: 4016# 4017# >18 short&074000 000000 C1 R1 4018# >18 short&074000 004000 C2 R1 4019# >18 short&074000 010000 C3 R1 4020# >18 short&074000 074000 TEST 4021# 4022# as SVR3.1's "file" doesn't support anything of the "!074000,000000" 4023# sort, nor does SunOS 4.x, so either it's something Intergraph added 4024# in CLIX, or something AT&T added in SVR3.2 or later, or something 4025# somebody else thought was a good idea; it's not documented in the 4026# man page for this version of "magic", nor does it appear to be 4027# implemented (at least not after I blew off the bogus code to turn 4028# old-style "&"s into new-style "&"s, which just didn't work at all). 4029# 40300 short 0575 CLIPPER COFF executable (VAX #) 4031>20 short 0407 (impure) 4032>20 short 0410 (5.2 compatible) 4033>20 short 0411 (pure) 4034>20 short 0413 (demand paged) 4035>20 short 0443 (target shared library) 4036>12 long >0 not stripped 4037>22 short >0 - version %ld 40380 short 0577 CLIPPER COFF executable 4039>18 short&074000 000000 C1 R1 4040>18 short&074000 004000 C2 R1 4041>18 short&074000 010000 C3 R1 4042>18 short&074000 074000 TEST 4043>20 short 0407 (impure) 4044>20 short 0410 (pure) 4045>20 short 0411 (separate I&D) 4046>20 short 0413 (paged) 4047>20 short 0443 (target shared library) 4048>12 long >0 not stripped 4049>22 short >0 - version %ld 4050>48 long&01 01 alignment trap enabled 4051>52 byte 1 -Ctnc 4052>52 byte 2 -Ctsw 4053>52 byte 3 -Ctpw 4054>52 byte 4 -Ctcb 4055>53 byte 1 -Cdnc 4056>53 byte 2 -Cdsw 4057>53 byte 3 -Cdpw 4058>53 byte 4 -Cdcb 4059>54 byte 1 -Csnc 4060>54 byte 2 -Cssw 4061>54 byte 3 -Cspw 4062>54 byte 4 -Cscb 40634 string pipe CLIPPER instruction trace 40644 string prof CLIPPER instruction profile 4065 4066#------------------------------------------------------------------------------ 4067# $File: commands,v 1.46 2013/03/25 14:06:55 christos Exp $ 4068# commands: file(1) magic for various shells and interpreters 4069# 4070#0 string/w : shell archive or script for antique kernel text 40710 string/wt #!\ /bin/sh POSIX shell script text executable 4072!:mime text/x-shellscript 40730 string/wt #!\ /bin/csh C shell script text executable 4074!:mime text/x-shellscript 4075# korn shell magic, sent by George Wu, gwu@clyde.att.com 40760 string/wt #!\ /bin/ksh Korn shell script text executable 4077!:mime text/x-shellscript 40780 string/wt #!\ /bin/tcsh Tenex C shell script text executable 4079!:mime text/x-shellscript 40800 string/wt #!\ /usr/bin/tcsh Tenex C shell script text executable 4081!:mime text/x-shellscript 40820 string/wt #!\ /usr/local/tcsh Tenex C shell script text executable 4083!:mime text/x-shellscript 40840 string/wt #!\ /usr/local/bin/tcsh Tenex C shell script text executable 4085!:mime text/x-shellscript 4086 4087# 4088# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson) 40890 string/wt #!\ /bin/zsh Paul Falstad's zsh script text executable 4090!:mime text/x-shellscript 40910 string/wt #!\ /usr/bin/zsh Paul Falstad's zsh script text executable 4092!:mime text/x-shellscript 40930 string/wt #!\ /usr/local/bin/zsh Paul Falstad's zsh script text executable 4094!:mime text/x-shellscript 40950 string/wt #!\ /usr/local/bin/ash Neil Brown's ash script text executable 4096!:mime text/x-shellscript 40970 string/wt #!\ /usr/local/bin/ae Neil Brown's ae script text executable 4098!:mime text/x-shellscript 40990 string/wt #!\ /bin/nawk new awk script text executable 4100!:mime text/x-nawk 41010 string/wt #!\ /usr/bin/nawk new awk script text executable 4102!:mime text/x-nawk 41030 string/wt #!\ /usr/local/bin/nawk new awk script text executable 4104!:mime text/x-nawk 41050 string/wt #!\ /bin/gawk GNU awk script text executable 4106!:mime text/x-gawk 41070 string/wt #!\ /usr/bin/gawk GNU awk script text executable 4108!:mime text/x-gawk 41090 string/wt #!\ /usr/local/bin/gawk GNU awk script text executable 4110!:mime text/x-gawk 4111# 41120 string/wt #!\ /bin/awk awk script text executable 4113!:mime text/x-awk 41140 string/wt #!\ /usr/bin/awk awk script text executable 4115!:mime text/x-awk 41160 regex =^\\s{0,100}BEGIN\\s{0,100}[{] awk script text 4117 4118# AT&T Bell Labs' Plan 9 shell 41190 string/wt #!\ /bin/rc Plan 9 rc shell script text executable 4120 4121# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de) 41220 string/wt #!\ /bin/bash Bourne-Again shell script text executable 4123!:mime text/x-shellscript 41240 string/wt #!\ /usr/bin/bash Bourne-Again shell script text executable 4125!:mime text/x-shellscript 41260 string/wt #!\ /usr/local/bash Bourne-Again shell script text executable 4127!:mime text/x-shellscript 41280 string/wt #!\ /usr/local/bin/bash Bourne-Again shell script text executable 4129!:mime text/x-shellscript 4130 4131# PHP scripts 4132# Ulf Harnhammar <ulfh@update.uu.se> 41330 search/1/c =<?php PHP script text 4134!:strength + 10 4135!:mime text/x-php 41360 search/1 =<?\n PHP script text 4137!:mime text/x-php 41380 search/1 =<?\r PHP script text 4139!:mime text/x-php 41400 search/1/w #!\ /usr/local/bin/php PHP script text executable 4141!:strength + 10 4142!:mime text/x-php 41430 search/1/w #!\ /usr/bin/php PHP script text executable 4144!:strength + 10 4145!:mime text/x-php 4146# Smarty compiled template, http://www.smarty.net/ 4147# Elan Ruusamae <glen@delfi.ee> 41480 string =<?php\ /*\ Smarty\ version Smarty compiled template 4149>24 regex [0-9.]+ \b, version %s 4150!:mime text/x-php 4151 41520 string Zend\x00 PHP script Zend Optimizer data 4153 41540 string/t $! DCL command file 4155 4156# Type: Pdmenu 4157# URL: http://packages.debian.org/pdmenu 4158# From: Edward Betts <edward@debian.org> 41590 string #!/usr/bin/pdmenu Pdmenu configuration file text 4160 4161#---------------------------------------------------------------------------- 4162# $File: communications,v 1.5 2009/09/19 16:28:08 christos Exp $ 4163# communication 4164 4165# TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3. 4166# It is used for conformance testing of communication protocols. 4167# Added by W. Borgert <debacle@debian.org>. 41680 string $Suite TTCN Abstract Test Suite 4169>&1 string $SuiteId 4170>>&1 string >\n %s 4171>&2 string $SuiteId 4172>>&1 string >\n %s 4173>&3 string $SuiteId 4174>>&1 string >\n %s 4175 4176# MSC (message sequence charts) are a formal description technique, 4177# described in ITU-T Z.120, mainly used for communication protocols. 4178# Added by W. Borgert <debacle@debian.org>. 41790 string mscdocument Message Sequence Chart (document) 41800 string msc Message Sequence Chart (chart) 41810 string submsc Message Sequence Chart (subchart) 4182#------------------------------------------------------------------------------ 4183# $File: compress,v 1.53 2014/01/05 15:55:21 christos Exp $ 4184# compress: file(1) magic for pure-compression formats (no archives) 4185# 4186# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc. 4187# 4188# Formats for various forms of compressed data 4189# Formats for "compress" proper have been moved into "compress.c", 4190# because it tries to uncompress it to figure out what's inside. 4191 4192# standard unix compress 41930 string \037\235 compress'd data 4194!:mime application/x-compress 4195!:apple LZIVZIVU 4196>2 byte&0x80 >0 block compressed 4197>2 byte&0x1f x %d bits 4198 4199# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver) 4200# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002 4201# * Original filename is only at offset 10 if "extra field" absent 4202# * Produce shorter output - notably, only report compression methods 4203# other than 8 ("deflate", the only method defined in RFC 1952). 42040 string \037\213 gzip compressed data 4205!:mime application/x-gzip 4206!:strength * 2 4207>2 byte <8 \b, reserved method 4208>2 byte >8 \b, unknown method 4209>3 byte &0x01 \b, ASCII 4210>3 byte &0x02 \b, has CRC 4211>3 byte &0x04 \b, extra field 4212>3 byte&0xC =0x08 4213>>10 string x \b, was "%s" 4214>3 byte &0x10 \b, has comment 4215>3 byte &0x20 \b, encrypted 4216>4 ledate >0 \b, last modified: %s 4217>8 byte 2 \b, max compression 4218>8 byte 4 \b, max speed 4219>9 byte =0x00 \b, from FAT filesystem (MS-DOS, OS/2, NT) 4220>9 byte =0x01 \b, from Amiga 4221>9 byte =0x02 \b, from VMS 4222>9 byte =0x03 \b, from Unix 4223>9 byte =0x04 \b, from VM/CMS 4224>9 byte =0x05 \b, from Atari 4225>9 byte =0x06 \b, from HPFS filesystem (OS/2, NT) 4226>9 byte =0x07 \b, from MacOS 4227>9 byte =0x08 \b, from Z-System 4228>9 byte =0x09 \b, from CP/M 4229>9 byte =0x0A \b, from TOPS/20 4230>9 byte =0x0B \b, from NTFS filesystem (NT) 4231>9 byte =0x0C \b, from QDOS 4232>9 byte =0x0D \b, from Acorn RISCOS 4233 4234# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis 42350 string \037\036 packed data 4236!:mime application/octet-stream 4237>2 belong >1 \b, %d characters originally 4238>2 belong =1 \b, %d character originally 4239# 4240# This magic number is byte-order-independent. 42410 short 0x1f1f old packed data 4242!:mime application/octet-stream 4243 4244# XXX - why *two* entries for "compacted data", one of which is 4245# byte-order independent, and one of which is byte-order dependent? 4246# 42470 short 0x1fff compacted data 4248!:mime application/octet-stream 4249# This string is valid for SunOS (BE) and a matching "short" is listed 4250# in the Ultrix (LE) magic file. 42510 string \377\037 compacted data 4252!:mime application/octet-stream 42530 short 0145405 huf output 4254!:mime application/octet-stream 4255 4256# bzip2 42570 string BZh bzip2 compressed data 4258!:mime application/x-bzip2 4259>3 byte >47 \b, block size = %c00k 4260 4261# lzip 42620 string LZIP lzip compressed data 4263!:mime application/x-lzip 4264>4 byte x \b, version: %d 4265 4266# squeeze and crunch 4267# Michael Haardt <michael@cantor.informatik.rwth-aachen.de> 42680 beshort 0x76FF squeezed data, 4269>4 string x original name %s 42700 beshort 0x76FE crunched data, 4271>2 string x original name %s 42720 beshort 0x76FD LZH compressed data, 4273>2 string x original name %s 4274 4275# Freeze 42760 string \037\237 frozen file 2.1 42770 string \037\236 frozen file 1.0 (or gzip 0.5) 4278 4279# SCO compress -H (LZH) 42800 string \037\240 SCO compress -H (LZH) data 4281 4282# European GSM 06.10 is a provisional standard for full-rate speech 4283# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse 4284# excitation/long term prediction) coding at 13 kbit/s. 4285# 4286# There's only a magic nibble (4 bits); that nibble repeats every 33 4287# bytes. This isn't suited for use, but maybe we can use it someday. 4288# 4289# This will cause very short GSM files to be declared as data and 4290# mismatches to be declared as data too! 4291#0 byte&0xF0 0xd0 data 4292#>33 byte&0xF0 0xd0 4293#>66 byte&0xF0 0xd0 4294#>99 byte&0xF0 0xd0 4295#>132 byte&0xF0 0xd0 GSM 06.10 compressed audio 4296 4297# bzip a block-sorting file compressor 4298# by Julian Seward <sewardj@cs.man.ac.uk> and others 4299# 4300#0 string BZ bzip compressed data 4301#>2 byte x \b, version: %c 4302#>3 string =1 \b, compression block size 100k 4303#>3 string =2 \b, compression block size 200k 4304#>3 string =3 \b, compression block size 300k 4305#>3 string =4 \b, compression block size 400k 4306#>3 string =5 \b, compression block size 500k 4307#>3 string =6 \b, compression block size 600k 4308#>3 string =7 \b, compression block size 700k 4309#>3 string =8 \b, compression block size 800k 4310#>3 string =9 \b, compression block size 900k 4311 4312# lzop from <markus.oberhumer@jk.uni-linz.ac.at> 43130 string \x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a lzop compressed data 4314>9 beshort <0x0940 4315>>9 byte&0xf0 =0x00 - version 0. 4316>>9 beshort&0x0fff x \b%03x, 4317>>13 byte 1 LZO1X-1, 4318>>13 byte 2 LZO1X-1(15), 4319>>13 byte 3 LZO1X-999, 4320## >>22 bedate >0 last modified: %s, 4321>>14 byte =0x00 os: MS-DOS 4322>>14 byte =0x01 os: Amiga 4323>>14 byte =0x02 os: VMS 4324>>14 byte =0x03 os: Unix 4325>>14 byte =0x05 os: Atari 4326>>14 byte =0x06 os: OS/2 4327>>14 byte =0x07 os: MacOS 4328>>14 byte =0x0A os: Tops/20 4329>>14 byte =0x0B os: WinNT 4330>>14 byte =0x0E os: Win32 4331>9 beshort >0x0939 4332>>9 byte&0xf0 =0x00 - version 0. 4333>>9 byte&0xf0 =0x10 - version 1. 4334>>9 byte&0xf0 =0x20 - version 2. 4335>>9 beshort&0x0fff x \b%03x, 4336>>15 byte 1 LZO1X-1, 4337>>15 byte 2 LZO1X-1(15), 4338>>15 byte 3 LZO1X-999, 4339## >>25 bedate >0 last modified: %s, 4340>>17 byte =0x00 os: MS-DOS 4341>>17 byte =0x01 os: Amiga 4342>>17 byte =0x02 os: VMS 4343>>17 byte =0x03 os: Unix 4344>>17 byte =0x05 os: Atari 4345>>17 byte =0x06 os: OS/2 4346>>17 byte =0x07 os: MacOS 4347>>17 byte =0x0A os: Tops/20 4348>>17 byte =0x0B os: WinNT 4349>>17 byte =0x0E os: Win32 4350 4351# 4.3BSD-Quasijarus Strong Compression 4352# http://minnie.tuhs.org/Quasijarus/compress.html 43530 string \037\241 Quasijarus strong compressed data 4354 4355# From: Cory Dikkers <cdikkers@swbell.net> 43560 string XPKF Amiga xpkf.library compressed data 43570 string PP11 Power Packer 1.1 compressed data 43580 string PP20 Power Packer 2.0 compressed data, 4359>4 belong 0x09090909 fast compression 4360>4 belong 0x090A0A0A mediocre compression 4361>4 belong 0x090A0B0B good compression 4362>4 belong 0x090A0C0C very good compression 4363>4 belong 0x090A0C0D best compression 4364 4365# 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at) 4366# http://www.7-zip.org or DOC/7zFormat.txt 4367# 43680 string 7z\274\257\047\034 7-zip archive data, 4369>6 byte x version %d 4370>7 byte x \b.%d 4371!:mime application/x-7z-compressed 4372 4373# Type: LZMA 43740 lelong&0xffffff =0x5d 4375!:mime application/x-lzma 4376>12 leshort 0xff LZMA compressed data, 4377>>5 lequad =0xffffffffffffffff streamed 4378>>5 lequad !0xffffffffffffffff non-streamed, size %lld 4379>12 leshort 0 LZMA compressed data, 4380>>5 lequad =0xffffffffffffffff streamed 4381>>5 lequad !0xffffffffffffffff non-streamed, size %lld 4382 4383# http://tukaani.org/xz/xz-file-format.txt 43840 ustring \xFD7zXZ\x00 XZ compressed data 4385!:mime application/x-xz 4386 4387# https://github.com/ckolivas/lrzip/blob/master/doc/magic.header.txt 43880 string LRZI LRZIP compressed data 4389>4 byte x - version %d 4390>5 byte x \b.%d 4391!:mime application/x-lrzip 4392 4393# http://fastcompression.blogspot.fi/2013/04/lz4-streaming-format-final.html 43940 lelong 0x184d2204 LZ4 compressed data 4395!:mime application/x-lz4 43960 lelong 0x184c2102 LZ4 compressed data, legacy format 4397!:mime application/x-lz4 4398 4399# AFX compressed files (Wolfram Kleff) 44002 string -afx- AFX compressed file data 4401 4402# Supplementary magic data for the file(1) command to support 4403# rzip(1). The format is described in magic(5). 4404# 4405# Copyright (C) 2003 by Andrew Tridgell. You may do whatever you want with 4406# this file. 4407# 44080 string RZIP rzip compressed data 4409>4 byte x - version %d 4410>5 byte x \b.%d 4411>6 belong x (%d bytes) 4412 44130 string ArC\x01 FreeArc archive <http://freearc.org> 4414 4415# Type: DACT compressed files 44160 long 0x444354C3 DACT compressed data 4417>4 byte >-1 (version %i. 4418>5 byte >-1 %i. 4419>6 byte >-1 %i) 4420>7 long >0 , original size: %i bytes 4421>15 long >30 , block size: %i bytes 4422 4423# Valve Pack (VPK) files 44240 lelong 0x55aa1234 Valve Pak file 4425>0x4 lelong x \b, version %u 4426>0x8 lelong x \b, %u entries 4427 4428 4429#------------------------------------------------------------------------------ 4430# $File: console,v 1.19 2013/02/06 14:18:52 christos Exp $ 4431# Console game magic 4432# Toby Deshane <hac@shoelace.digivill.net> 4433# ines: file(1) magic for Marat's iNES Nintendo Entertainment System 4434# ROM dump format 4435 44360 string NES\032 iNES ROM dump, 4437>4 byte x %dx16k PRG 4438>5 byte x \b, %dx8k CHR 4439>6 byte&0x01 =0x1 \b, [Vert.] 4440>6 byte&0x01 =0x0 \b, [Horiz.] 4441>6 byte&0x02 =0x2 \b, [SRAM] 4442>6 byte&0x04 =0x4 \b, [Trainer] 4443>6 byte&0x04 =0x8 \b, [4-Scr] 4444 4445#------------------------------------------------------------------------------ 4446# game boy: file(1) magic for the Nintendo (Color) Game Boy raw ROM format 4447# 44480x104 belong 0xCEED6666 Game Boy ROM: 4449>0x134 string >\0 "%.16s" 4450>0x146 byte 0x03 \b,[SGB] 4451>0x147 byte 0x00 \b, [ROM ONLY] 4452>0x147 byte 0x01 \b, [ROM+MBC1] 4453>0x147 byte 0x02 \b, [ROM+MBC1+RAM] 4454>0x147 byte 0x03 \b, [ROM+MBC1+RAM+BATT] 4455>0x147 byte 0x05 \b, [ROM+MBC2] 4456>0x147 byte 0x06 \b, [ROM+MBC2+BATTERY] 4457>0x147 byte 0x08 \b, [ROM+RAM] 4458>0x147 byte 0x09 \b, [ROM+RAM+BATTERY] 4459>0x147 byte 0x0B \b, [ROM+MMM01] 4460>0x147 byte 0x0C \b, [ROM+MMM01+SRAM] 4461>0x147 byte 0x0D \b, [ROM+MMM01+SRAM+BATT] 4462>0x147 byte 0x0F \b, [ROM+MBC3+TIMER+BATT] 4463>0x147 byte 0x10 \b, [ROM+MBC3+TIMER+RAM+BATT] 4464>0x147 byte 0x11 \b, [ROM+MBC3] 4465>0x147 byte 0x12 \b, [ROM+MBC3+RAM] 4466>0x147 byte 0x13 \b, [ROM+MBC3+RAM+BATT] 4467>0x147 byte 0x19 \b, [ROM+MBC5] 4468>0x147 byte 0x1A \b, [ROM+MBC5+RAM] 4469>0x147 byte 0x1B \b, [ROM+MBC5+RAM+BATT] 4470>0x147 byte 0x1C \b, [ROM+MBC5+RUMBLE] 4471>0x147 byte 0x1D \b, [ROM+MBC5+RUMBLE+SRAM] 4472>0x147 byte 0x1E \b, [ROM+MBC5+RUMBLE+SRAM+BATT] 4473>0x147 byte 0x1F \b, [Pocket Camera] 4474>0x147 byte 0xFD \b, [Bandai TAMA5] 4475>0x147 byte 0xFE \b, [Hudson HuC-3] 4476>0x147 byte 0xFF \b, [Hudson HuC-1] 4477 4478>0x148 byte 0 \b, ROM: 256Kbit 4479>0x148 byte 1 \b, ROM: 512Kbit 4480>0x148 byte 2 \b, ROM: 1Mbit 4481>0x148 byte 3 \b, ROM: 2Mbit 4482>0x148 byte 4 \b, ROM: 4Mbit 4483>0x148 byte 5 \b, ROM: 8Mbit 4484>0x148 byte 6 \b, ROM: 16Mbit 4485>0x148 byte 0x52 \b, ROM: 9Mbit 4486>0x148 byte 0x53 \b, ROM: 10Mbit 4487>0x148 byte 0x54 \b, ROM: 12Mbit 4488 4489>0x149 byte 1 \b, RAM: 16Kbit 4490>0x149 byte 2 \b, RAM: 64Kbit 4491>0x149 byte 3 \b, RAM: 128Kbit 4492>0x149 byte 4 \b, RAM: 1Mbit 4493 4494#>0x14e long x \b, CRC: %x 4495 4496#------------------------------------------------------------------------------ 4497# genesis: file(1) magic for the Sega MegaDrive/Genesis raw ROM format 4498# 44990x100 string SEGA Sega MegaDrive/Genesis raw ROM dump 4500>0x120 string >\0 Name: "%.16s" 4501>0x110 string >\0 %.16s 4502>0x1B0 string RA with SRAM 4503 4504#------------------------------------------------------------------------------ 4505# genesis: file(1) magic for the Super MegaDrive ROM dump format 4506# 45070x280 string EAGN Super MagicDrive ROM dump 4508>0 byte x %dx16k blocks 4509>2 byte 0 \b, last in series or standalone 4510>2 byte >0 \b, split ROM 4511>8 byte 0xAA 4512>9 byte 0xBB 4513 4514#------------------------------------------------------------------------------ 4515# genesis: file(1) alternate magic for the Super MegaDrive ROM dump format 4516# 45170x280 string EAMG Super MagicDrive ROM dump 4518>0 byte x %dx16k blocks 4519>2 byte x \b, last in series or standalone 4520>8 byte 0xAA 4521>9 byte 0xBB 4522 4523#------------------------------------------------------------------------------ 4524# smsgg: file(1) magic for Sega Master System and Game Gear ROM dumps 4525# 4526# Does not detect all images. Very preliminary guesswork. Need more data 4527# on format. 4528# 4529# FIXME: need a little more info...;P 4530# 4531#0 byte 0xF3 4532#>1 byte 0xED Sega Master System/Game Gear ROM dump 4533#>1 byte 0x31 Sega Master System/Game Gear ROM dump 4534#>1 byte 0xDB Sega Master System/Game Gear ROM dump 4535#>1 byte 0xAF Sega Master System/Game Gear ROM dump 4536#>1 byte 0xC3 Sega Master System/Game Gear ROM dump 4537 4538#------------------------------------------------------------------------------ 4539# dreamcast: file(1) uncertain magic for the Sega Dreamcast VMU image format 4540# 45410 belong 0x21068028 Sega Dreamcast VMU game image 45420 string LCDi Dream Animator file 4543 4544#------------------------------------------------------------------------------ 4545# v64: file(1) uncertain magic for the V64 format N64 ROM dumps 4546# 45470 belong 0x37804012 V64 Nintendo 64 ROM dump 4548 4549# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 4550# Nintendo .nds 4551192 string \044\377\256Qi\232 Nintendo DS Game ROM Image 4552# Nintendo .gba 45530 string \056\000\000\352$\377\256Qi Nintendo Game Boy Advance ROM Image 4554 4555#------------------------------------------------------------------------------ 4556# msx: file(1) magic for MSX game cartridge dumps 4557# Too simple - MPi 4558#0 beshort 0x4142 MSX game cartridge dump 4559 4560#------------------------------------------------------------------------------ 4561# Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) : 45620 string PS-X\ EXE Sony Playstation executable 4563# Area: 4564>113 string x (%s) 4565 4566#------------------------------------------------------------------------------ 4567# Microsoft Xbox executables .xbe (Esa Hyytia <ehyytia@cc.hut.fi>) 45680 string XBEH XBE, Microsoft Xbox executable 4569# probabilistic checks whether signed or not 4570>0x0004 ulelong =0x0 4571>>&2 ulelong =0x0 4572>>>&2 ulelong =0x0 \b, not signed 4573>0x0004 ulelong >0 4574>>&2 ulelong >0 4575>>>&2 ulelong >0 \b, signed 4576# expect base address of 0x10000 4577>0x0104 ulelong =0x10000 4578>>(0x0118-0x0FF60) ulelong&0x80000007 0x80000007 \b, all regions 4579>>(0x0118-0x0FF60) ulelong&0x80000007 !0x80000007 4580>>>(0x0118-0x0FF60) ulelong >0 (regions: 4581>>>>(0x0118-0x0FF60) ulelong &0x00000001 NA 4582>>>>(0x0118-0x0FF60) ulelong &0x00000002 Japan 4583>>>>(0x0118-0x0FF60) ulelong &0x00000004 Rest_of_World 4584>>>>(0x0118-0x0FF60) ulelong &0x80000000 Manufacturer 4585>>>(0x0118-0x0FF60) ulelong >0 \b) 4586 4587# -------------------------------- 4588# Microsoft Xbox data file formats 45890 string XIP0 XIP, Microsoft Xbox data 45900 string XTF0 XTF, Microsoft Xbox data 4591 4592# Atari Lynx cartridge dump (EXE/BLL header) 4593# From: "Stefan A. Haubenthal" <polluks@web.de> 4594 4595# Double-check that the image type matches too, 0x8008 conflicts with 4596# 8 character OMF-86 object file headers. 45970 beshort 0x8008 4598>6 string BS93 Lynx homebrew cartridge 4599>>2 beshort x \b, RAM start $%04x 4600>6 string LYNX Lynx cartridge 4601>>2 beshort x \b, RAM start $%04x 4602 4603# Opera file system that is used on the 3DO console 4604# From: Serge van den Boom <svdb@stack.nl> 46050 string \x01ZZZZZ\x01 3DO "Opera" file system 4606 4607# From Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu 46080 string GBS Nintendo Game Boy Music/Audio Data 460912 string GameBoy\ Music\ Module Nintendo Game Boy Music Module 4610 4611# Playstations Patch Files from: From: Thomas Klausner <tk@giga.or.at> 46120 string PPF30 Playstation Patch File version 3.0 4613>5 byte 0 \b, PPF 1.0 patch 4614>5 byte 1 \b, PPF 2.0 patch 4615>5 byte 2 \b, PPF 3.0 patch 4616>>56 byte 0 \b, Imagetype BIN (any) 4617>>56 byte 1 \b, Imagetype GI (PrimoDVD) 4618>>57 byte 0 \b, Blockcheck disabled 4619>>57 byte 1 \b, Blockcheck enabled 4620>>58 byte 0 \b, Undo data not available 4621>>58 byte 1 \b, Undo data available 4622>6 string x \b, description: %s 4623 46240 string PPF20 Playstation Patch File version 2.0 4625>5 byte 0 \b, PPF 1.0 patch 4626>5 byte 1 \b, PPF 2.0 patch 4627>>56 lelong >0 \b, size of file to patch %d 4628>6 string x \b, description: %s 4629 46300 string PPF10 Playstation Patch File version 1.0 4631>5 byte 0 \b, Simple Encoding 4632>6 string x \b, description: %s 4633 4634# From: Daniel Dawson <ddawson@icehouse.net> 4635# SNES9x .smv "movie" file format. 46360 string SMV\x1A SNES9x input recording 4637>0x4 lelong x \b, version %d 4638# version 4 is latest so far 4639>0x4 lelong <5 4640>>0x8 ledate x \b, recorded at %s 4641>>0xc lelong >0 \b, rerecorded %d times 4642>>0x10 lelong x \b, %d frames long 4643>>0x14 byte >0 \b, data for controller(s): 4644>>>0x14 byte &0x1 #1 4645>>>0x14 byte &0x2 #2 4646>>>0x14 byte &0x4 #3 4647>>>0x14 byte &0x8 #4 4648>>>0x14 byte &0x10 #5 4649>>0x15 byte ^0x1 \b, begins from snapshot 4650>>0x15 byte &0x1 \b, begins from reset 4651>>0x15 byte ^0x2 \b, NTSC standard 4652>>0x15 byte &0x2 \b, PAL standard 4653>>0x17 byte &0x1 \b, settings: 4654# WIP1Timing not used as of version 4 4655>>>0x4 lelong <4 4656>>>>0x17 byte &0x2 WIP1Timing 4657>>>0x17 byte &0x4 Left+Right 4658>>>0x17 byte &0x8 VolumeEnvX 4659>>>0x17 byte &0x10 FakeMute 4660>>>0x17 byte &0x20 SyncSound 4661# New flag as of version 4 4662>>>0x4 lelong >3 4663>>>>0x17 byte &0x80 NoCPUShutdown 4664>>0x4 lelong <4 4665>>>0x18 lelong >0x23 4666>>>>0x20 leshort !0 4667>>>>>0x20 lestring16 x \b, metadata: "%s" 4668>>0x4 lelong >3 4669>>>0x24 byte >0 \b, port 1: 4670>>>>0x24 byte 1 joypad 4671>>>>0x24 byte 2 mouse 4672>>>>0x24 byte 3 SuperScope 4673>>>>0x24 byte 4 Justifier 4674>>>>0x24 byte 5 multitap 4675>>>0x24 byte >0 \b, port 2: 4676>>>>0x25 byte 1 joypad 4677>>>>0x25 byte 2 mouse 4678>>>>0x25 byte 3 SuperScope 4679>>>>0x25 byte 4 Justifier 4680>>>>0x25 byte 5 multitap 4681>>>0x18 lelong >0x43 4682>>>>0x40 leshort !0 4683>>>>>0x40 lestring16 x \b, metadata: "%s" 4684>>0x17 byte &0x40 \b, ROM: 4685>>>(0x18.l-26) lelong x CRC32 0x%08x 4686>>>(0x18.l-23) string x "%s" 4687 4688# Type: scummVM savegame files 4689# From: Sven Hartge <debian@ds9.argh.org> 46900 string SCVM ScummVM savegame 4691>12 string >\0 "%s" 4692 4693#------------------------------------------------------------------------------ 4694# $File: convex,v 1.8 2012/10/03 23:44:43 christos Exp $ 4695# convex: file(1) magic for Convex boxes 4696# 4697# Convexes are big-endian. 4698# 4699# /*\ 4700# * Below are the magic numbers and tests added for Convex. 4701# * Added at beginning, because they are expected to be used most. 4702# \*/ 47030 belong 0507 Convex old-style object 4704>16 belong >0 not stripped 47050 belong 0513 Convex old-style demand paged executable 4706>16 belong >0 not stripped 47070 belong 0515 Convex old-style pre-paged executable 4708>16 belong >0 not stripped 47090 belong 0517 Convex old-style pre-paged, non-swapped executable 4710>16 belong >0 not stripped 47110 belong 0x011257 Core file 4712# 4713# The following are a series of dump format magic numbers. Each one 4714# corresponds to a drastically different dump format. The first on is 4715# the original dump format on a 4.1 BSD or earlier file system. The 4716# second marks the change between the 4.1 file system and the 4.2 file 4717# system. The Third marks the changing of the block size from 1K 4718# to 2K to be compatible with an IDC file system. The fourth indicates 4719# a dump that is dependent on Convex Storage Manager, because data in 4720# secondary storage is not physically contained within the dump. 4721# The restore program uses these number to determine how the data is 4722# to be extracted. 4723# 472424 belong =60013 dump format, 4.2 or 4.3 BSD (IDC compatible) 472524 belong =60014 dump format, Convex Storage Manager by-reference dump 4726# 4727# what follows is a bunch of bit-mask checks on the flags field of the opthdr. 4728# If there is no `=' sign, assume just checking for whether the bit is set? 4729# 47300 belong 0601 Convex SOFF 4731>88 belong&0x000f0000 =0x00000000 c1 4732>88 belong &0x00010000 c2 4733>88 belong &0x00020000 c2mp 4734>88 belong &0x00040000 parallel 4735>88 belong &0x00080000 intrinsic 4736>88 belong &0x00000001 demand paged 4737>88 belong &0x00000002 pre-paged 4738>88 belong &0x00000004 non-swapped 4739>88 belong &0x00000008 POSIX 4740# 4741>84 belong &0x80000000 executable 4742>84 belong &0x40000000 object 4743>84 belong&0x20000000 =0 not stripped 4744>84 belong&0x18000000 =0x00000000 native fpmode 4745>84 belong&0x18000000 =0x10000000 ieee fpmode 4746>84 belong&0x18000000 =0x18000000 undefined fpmode 4747# 47480 belong 0605 Convex SOFF core 4749# 47500 belong 0607 Convex SOFF checkpoint 4751>88 belong&0x000f0000 =0x00000000 c1 4752>88 belong &0x00010000 c2 4753>88 belong &0x00020000 c2mp 4754>88 belong &0x00040000 parallel 4755>88 belong &0x00080000 intrinsic 4756>88 belong &0x00000008 POSIX 4757# 4758>84 belong&0x18000000 =0x00000000 native fpmode 4759>84 belong&0x18000000 =0x10000000 ieee fpmode 4760>84 belong&0x18000000 =0x18000000 undefined fpmode 4761 4762#------------------------------------------------------------------------------ 4763# $File: cracklib,v 1.7 2009/09/19 16:28:08 christos Exp $ 4764# cracklib: file (1) magic for cracklib v2.7 4765 47660 lelong 0x70775631 Cracklib password index, little endian 4767>4 long >0 (%i words) 4768>4 long 0 ("64-bit") 4769>>8 long >-1 (%i words) 47700 belong 0x70775631 Cracklib password index, big endian 4771>4 belong >-1 (%i words) 4772# really bellong 0x0000000070775631 47730 search/1 \0\0\0\0pwV1 Cracklib password index, big endian ("64-bit") 4774>12 belong >0 (%i words) 4775 4776# ---------------------------------------------------------------------------- 4777# $File: ctags,v 1.6 2009/09/19 16:28:08 christos Exp $ 4778# ctags: file (1) magic for Exuberant Ctags files 4779# From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de> 47800 search/1 =!_TAG Exuberant Ctags tag file text 4781 4782#-------------------------------------------------------------- 4783# ctf: file(1) magic for CTF (Common Trace Format) trace files 4784# 4785# Specs. available here: <http://www.efficios.com/ctf> 4786#-------------------------------------------------------------- 4787 4788# CTF trace data 47890 lelong 0xc1fc1fc1 Common Trace Format (CTF) trace data (LE) 47900 belong 0xc1fc1fc1 Common Trace Format (CTF) trace data (BE) 4791 4792# CTF metadata (packetized) 47930 lelong 0x75d11d57 Common Trace Format (CTF) packetized metadata (LE) 4794>35 byte x \b, v%d 4795>36 byte x \b.%d 47960 belong 0x75d11d57 Common Trace Format (CTF) packetized metadata (BE) 4797>35 byte x \b, v%d 4798>36 byte x \b.%d 4799 4800# CTF metadata (plain text) 48010 string /*\x20CTF\x20 Common Trace Format (CTF) plain text metadata 4802!:strength + 5 # this is to make sure we beat C 4803>&0 regex [0-9]+\.[0-9]+ \b, v%s 4804 4805#------------------------------------------------------------------------------ 4806# $File: cubemap,v 1.1 2012/06/06 13:03:20 christos Exp $ 4807# file(1) magic(5) data for cubemaps Martin Erik Werner <martinerikwerner@gmail.com> 4808# 48090 string ACMP Map file for the AssaultCube FPS game 48100 string CUBE Map file for cube and cube2 engine games 48110 string MAPZ) Map file for the Blood Frontier/Red Eclipse FPS games 4812 4813#------------------------------------------------------------------------------ 4814# $File: cups,v 1.2 2012/11/02 21:50:29 christos Exp $ 4815# Cups: file(1) magic for the cups raster file format 4816# From: Laurent Martelli <martellilaurent@gmail.com> 4817# http://www.cups.org/documentation.php/spec-raster.html 4818# 4819 48200 name cups-be 4821>280 lelong x \b, %d 4822>284 lelong x \bx%d dpi 4823>376 lelong x \b, %dx 4824>380 lelong x \b%d pixels 4825>388 lelong x %d bits/color 4826>392 lelong x %d bits/pixel 4827>400 lelong 0 ColorOrder=Chunky 4828>400 lelong 1 ColorOrder=Banded 4829>400 lelong 2 ColorOrder=Planar 4830>404 lelong 0 ColorSpace=gray 4831>404 lelong 1 ColorSpace=RGB 4832>404 lelong 2 ColorSpace=RGBA 4833>404 lelong 3 ColorSpace=black 4834>404 lelong 4 ColorSpace=CMY 4835>404 lelong 5 ColorSpace=YMC 4836>404 lelong 6 ColorSpace=CMYK 4837>404 lelong 7 ColorSpace=YMCK 4838>404 lelong 8 ColorSpace=KCMY 4839>404 lelong 9 ColorSpace=KCMYcm 4840>404 lelong 10 ColorSpace=GMCK 4841>404 lelong 11 ColorSpace=GMCS 4842>404 lelong 12 ColorSpace=WHITE 4843>404 lelong 13 ColorSpace=GOLD 4844>404 lelong 14 ColorSpace=SILVER 4845>404 lelong 15 ColorSpace=CIE XYZ 4846>404 lelong 16 ColorSpace=CIE Lab 4847>404 lelong 17 ColorSpace=RGBW 4848>404 lelong 18 ColorSpace=sGray 4849>404 lelong 19 ColorSpace=sRGB 4850>404 lelong 20 ColorSpace=AdobeRGB 4851 4852# Cups Raster image format, Big Endian 48530 string RaS 4854>3 string t Cups Raster version 1, Big Endian 4855>3 string 2 Cups Raster version 2, Big Endian 4856>3 string 3 Cups Raster version 3, Big Endian 4857!:mime application/vnd.cups-raster 4858>0 use ^cups-be 4859 4860 4861# Cups Raster image format, Little Endian 48621 string SaR 4863>0 string t Cups Raster version 1, Little Endian 4864>0 string 2 Cups Raster version 2, Little Endian 4865>0 string 3 Cups Raster version 3, Little Endian 4866!:mime application/vnd.cups-raster 4867>0 use \^cups-be 4868 4869#------------------------------------------------------------------------------ 4870# $File: dact,v 1.4 2009/09/19 16:28:08 christos Exp $ 4871# dact: file(1) magic for DACT compressed files 4872# 48730 long 0x444354C3 DACT compressed data 4874>4 byte >-1 (version %i. 4875>5 byte >-1 $BS%i. 4876>6 byte >-1 $BS%i) 4877>7 long >0 $BS, original size: %i bytes 4878>15 long >30 $BS, block size: %i bytes 4879 4880#------------------------------------------------------------------------------ 4881# $File: database,v 1.36 2013/12/09 20:31:53 christos Exp $ 4882# database: file(1) magic for various databases 4883# 4884# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk) 4885# 4886# 4887# GDBM magic numbers 4888# Will be maintained as part of the GDBM distribution in the future. 4889# <downsj@teeny.org> 48900 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian 4891!:mime application/x-gdbm 48920 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian 4893!:mime application/x-gdbm 48940 string GDBM GNU dbm 2.x database 4895!:mime application/x-gdbm 4896# 4897# Berkeley DB 4898# 4899# Ian Darwin's file /etc/magic files: big/little-endian version. 4900# 4901# Hash 1.85/1.86 databases store metadata in network byte order. 4902# Btree 1.85/1.86 databases store the metadata in host byte order. 4903# Hash and Btree 2.X and later databases store the metadata in host byte order. 4904 49050 long 0x00061561 Berkeley DB 4906!:mime application/x-dbm 4907>8 belong 4321 4908>>4 belong >2 1.86 4909>>4 belong <3 1.85 4910>>4 belong >0 (Hash, version %d, native byte-order) 4911>8 belong 1234 4912>>4 belong >2 1.86 4913>>4 belong <3 1.85 4914>>4 belong >0 (Hash, version %d, little-endian) 4915 49160 belong 0x00061561 Berkeley DB 4917>8 belong 4321 4918>>4 belong >2 1.86 4919>>4 belong <3 1.85 4920>>4 belong >0 (Hash, version %d, big-endian) 4921>8 belong 1234 4922>>4 belong >2 1.86 4923>>4 belong <3 1.85 4924>>4 belong >0 (Hash, version %d, native byte-order) 4925 49260 long 0x00053162 Berkeley DB 1.85/1.86 4927>4 long >0 (Btree, version %d, native byte-order) 49280 belong 0x00053162 Berkeley DB 1.85/1.86 4929>4 belong >0 (Btree, version %d, big-endian) 49300 lelong 0x00053162 Berkeley DB 1.85/1.86 4931>4 lelong >0 (Btree, version %d, little-endian) 4932 493312 long 0x00061561 Berkeley DB 4934>16 long >0 (Hash, version %d, native byte-order) 493512 belong 0x00061561 Berkeley DB 4936>16 belong >0 (Hash, version %d, big-endian) 493712 lelong 0x00061561 Berkeley DB 4938>16 lelong >0 (Hash, version %d, little-endian) 4939 494012 long 0x00053162 Berkeley DB 4941>16 long >0 (Btree, version %d, native byte-order) 494212 belong 0x00053162 Berkeley DB 4943>16 belong >0 (Btree, version %d, big-endian) 494412 lelong 0x00053162 Berkeley DB 4945>16 lelong >0 (Btree, version %d, little-endian) 4946 494712 long 0x00042253 Berkeley DB 4948>16 long >0 (Queue, version %d, native byte-order) 494912 belong 0x00042253 Berkeley DB 4950>16 belong >0 (Queue, version %d, big-endian) 495112 lelong 0x00042253 Berkeley DB 4952>16 lelong >0 (Queue, version %d, little-endian) 4953 4954# From Max Bowsher. 495512 long 0x00040988 Berkeley DB 4956>16 long >0 (Log, version %d, native byte-order) 495712 belong 0x00040988 Berkeley DB 4958>16 belong >0 (Log, version %d, big-endian) 495912 lelong 0x00040988 Berkeley DB 4960>16 lelong >0 (Log, version %d, little-endian) 4961 4962# 4963# 4964# Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch> 49650 string/b RRD\0 RRDTool DB 4966>4 string/b x version %s 4967 4968>>10 short !0 16bit aligned 4969>>>10 bedouble 8.642135e+130 big-endian 4970>>>>18 short x 32bit long (m68k) 4971 4972>>10 short 0 4973>>>12 long !0 32bit aligned 4974>>>>12 bedouble 8.642135e+130 big-endian 4975>>>>>20 long 0 64bit long 4976>>>>>20 long !0 32bit long 4977>>>>12 ledouble 8.642135e+130 little-endian 4978>>>>>24 long 0 64bit long 4979>>>>>24 long !0 32bit long (i386) 4980>>>>12 string \x43\x2b\x1f\x5b\x2f\x25\xc0\xc7 middle-endian 4981>>>>>24 short !0 32bit long (arm) 4982 4983>>8 quad 0 64bit aligned 4984>>>16 bedouble 8.642135e+130 big-endian 4985>>>>24 long 0 64bit long (s390x) 4986>>>>24 long !0 32bit long (hppa/mips/ppc/s390/sparc) 4987>>>16 ledouble 8.642135e+130 little-endian 4988>>>>28 long 0 64bit long (alpha/amd64/ia64) 4989>>>>28 long !0 32bit long (armel/mipsel) 4990 4991#---------------------------------------------------------------------- 4992# ROOT: file(1) magic for ROOT databases 4993# 49940 string root\0 ROOT file 4995>4 belong x Version %d 4996>33 belong x (Compression: %d) 4997 4998# XXX: Weak magic. 4999# Alex Ott <ott@jet.msk.su> 5000## Paradox file formats 5001#2 leshort 0x0800 Paradox 5002#>0x39 byte 3 v. 3.0 5003#>0x39 byte 4 v. 3.5 5004#>0x39 byte 9 v. 4.x 5005#>0x39 byte 10 v. 5.x 5006#>0x39 byte 11 v. 5.x 5007#>0x39 byte 12 v. 7.x 5008#>>0x04 byte 0 indexed .DB data file 5009#>>0x04 byte 1 primary index .PX file 5010#>>0x04 byte 2 non-indexed .DB data file 5011#>>0x04 byte 3 non-incrementing secondary index .Xnn file 5012#>>0x04 byte 4 secondary index .Ynn file 5013#>>0x04 byte 5 incrementing secondary index .Xnn file 5014#>>0x04 byte 6 non-incrementing secondary index .XGn file 5015#>>0x04 byte 7 secondary index .YGn file 5016#>>>0x04 byte 8 incrementing secondary index .XGn file 5017 5018## XBase database files 5019# updated by Joerg Jenderek at Feb 2013 5020# http://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm 5021# http://www.clicketyclick.dk/databases/xbase/format/dbf.html 5022# http://home.f1.htw-berlin.de/scheibl/db/intern/dBase.htm 5023# inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31 50240 ubelong&0x0000FFFF <0x00000C20 5025# skip Infocom game Z-machine 5026>2 ubyte >0 5027# skip Androids *.xml 5028>>3 ubyte >0 5029>>>3 ubyte <32 5030# 1 < version VV 5031>>>>0 ubyte >1 5032# skip HELP.CA3 by test for reserved byte ( NULL ) 5033>>>>>27 ubyte 0 5034# reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF) 5035#>>>>>30 ubeshort x 30NULL?%x 5036# possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL) 5037>>>>>>24 ubelong&0xffFFFFff >0x01302000 5038# .DBF or .MDX 5039>>>>>>24 ubelong&0xffFFFFff <0x01302001 5040# for Xbase Database file (*.DBF) reserved (NULL) for multi-user 5041>>>>>>>24 ubelong&0xffFFFFff =0 5042# test for 2 reserved NULL bytes,transaction and encryption byte flag 5043>>>>>>>>12 ubelong&0xFFFFfEfE 0 5044# test for MDX flag 5045>>>>>>>>>28 ubyte x 5046>>>>>>>>>28 ubyte&0xf8 0 5047# header size >= 32 5048>>>>>>>>>>8 uleshort >31 5049# skip PIC15736.PCX by test for language driver name or field name 5050>>>>>>>>>>>32 ubyte >0 5051!:mime application/x-dbf 5052#!:mime application/x-dbf; charset=unknown-8bit ?? 5053#!:mime application/x-dbase 5054>>>>>>>>>>>>0 use xbase-type 5055# database file 5056>>>>>>>>>>>>0 ubyte x \b DBF 5057>>>>>>>>>>>>4 lelong 0 \b, no records 5058>>>>>>>>>>>>4 lelong >0 \b, %ld record 5059# plural s appended 5060>>>>>>>>>>>>>4 lelong >1 \bs 5061# http://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF 5062# 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000) 5063>>>>>>>>>>>>10 uleshort x * %d 5064# file size = records * record size + header size 5065>>>>>>>>>>>>1 ubyte x \b, update-date 5066>>>>>>>>>>>>1 use xbase-date 5067# http://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx 5068#>>>>>>>>>>>>29 ubyte =0 \b, codepage ID=0x%x 5069# 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ? 5070>>>>>>>>>>>>29 ubyte >0 \b, codepage ID=0x%x 5071#>>>>>>>>>>>>28 ubyte&0x01 0 \b, no index file 5072>>>>>>>>>>>>28 ubyte&0x01 1 \b, with index file .MDX 5073>>>>>>>>>>>>28 ubyte&0x02 2 \b, with memo .FPT 5074>>>>>>>>>>>>28 ubyte&0x04 4 \b, DataBaseContainer 5075# 1st record offset + 1 = header size 5076>>>>>>>>>>>>8 uleshort >0 5077>>>>>>>>>>>>(8.s+1) ubyte >0 5078>>>>>>>>>>>>>8 uleshort >0 \b, at offset %d 5079>>>>>>>>>>>>>(8.s+1) ubyte >0 5080>>>>>>>>>>>>>>&-1 string >\0 1st record "%s" 5081# for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserverd (NULL) 5082>>>>>>>24 ubelong&0x0133f7ff >0 5083# test for reserved NULL byte 5084>>>>>>>>47 ubyte x 5085# test for valid TAG key format (0x10 or 0) 5086>>>>>>>>>559 ubyte&0xeF 0 5087# test MM <= 12 5088>>>>>>>>>45 ubeshort <0x0C20 5089>>>>>>>>>>45 ubyte >0 5090>>>>>>>>>>>46 ubyte <32 5091>>>>>>>>>>>>46 ubyte >0 5092#!:mime application/x-mdx 5093>>>>>>>>>>>>>0 use xbase-type 5094>>>>>>>>>>>>>0 ubyte x \b MDX 5095>>>>>>>>>>>>>1 ubyte x \b, creation-date 5096>>>>>>>>>>>>>1 use xbase-date 5097>>>>>>>>>>>>>44 ubyte x \b, update-date 5098>>>>>>>>>>>>>44 use xbase-date 5099# No.of tags in use (1,2,5,12) 5100>>>>>>>>>>>>>28 uleshort x \b, %d 5101# No. of entries in tag (0x30) 5102>>>>>>>>>>>>>25 ubyte x \b/%d tags 5103# Length of tag 5104>>>>>>>>>>>>>26 ubyte x * %d 5105# 1st tag name_ 5106>>>>>>>>>>>>>548 string x \b, 1st tag "%.11s" 5107# 2nd tag name 5108#>>>>>>>>>>>>(26.b+548) string x \b, 2nd tag "%.11s" 5109# 5110# Print the xBase names of different version variants 51110 name xbase-type 5112>0 ubyte <2 5113# 1 < version 5114>0 ubyte >1 5115>>0 ubyte 0x02 FoxBase 5116# FoxBase+/dBaseIII+, no memo 5117>>0 ubyte 0x03 FoxBase+/dBase III 5118# dBASE IV no memo file 5119>>0 ubyte 0x04 dBase IV 5120# dBASE V no memo file 5121>>0 ubyte 0x05 dBase V 5122>>0 ubyte 0x30 Visual FoxPro 5123>>0 ubyte 0x31 Visual FoxPro, autoincrement 5124# Visual FoxPro, with field type Varchar or Varbinary 5125>>0 ubyte 0x32 Visual FoxPro, with field type Varchar 5126# dBASE IV SQL, no memo;dbv memo var size (Flagship) 5127>>0 ubyte 0x43 dBase IV, with SQL table 5128# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 5129#>>0 ubyte 0x62 dBase IV, with SQL table 5130# dBASE IV, with memo!! 5131>>0 ubyte 0x7b dBase IV, with memo 5132# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 5133#>>0 ubyte 0x82 dBase IV, with SQL system 5134# FoxBase+/dBaseIII+ with memo .DBT! 5135>>0 ubyte 0x83 FoxBase+/dBase III, with memo .DBT 5136# VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file 5137>>0 ubyte 0x87 VISUAL OBJECTS, with memo file 5138# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 5139#>>0 ubyte 0x8A FoxBase+/dBase III, with memo .DBT 5140# dBASE IV with memo! 5141>>0 ubyte 0x8B dBase IV, with memo .DBT 5142# dBase IV with SQL Table,no memo? 5143>>0 ubyte 0x8E dBase IV, with SQL table 5144# .dbv and .dbt memo (Flagship)? 5145>>0 ubyte 0xB3 Flagship 5146# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 5147#>>0 ubyte 0xCA dBase IV with memo .DBT 5148# dBASE IV with SQL table, with memo .DBT 5149>>0 ubyte 0xCB dBase IV with SQL table, with memo .DBT 5150# HiPer-Six format;Clipper SIX, with SMT memo file 5151>>0 ubyte 0xE5 Clipper SIX with memo 5152# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 5153#>>0 ubyte 0xF4 dBase IV, with SQL table, with memo 5154>>0 ubyte 0xF5 FoxPro with memo 5155# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 5156#>>0 ubyte 0xFA FoxPro 2.x, with memo 5157# unkown version (should not happen) 5158>>0 default x xBase 5159>>>0 ubyte x (0x%x) 5160# flags in version byte 5161# DBT flag (with dBASE III memo .DBT)!! 5162# >>0 ubyte&0x80 >0 DBT_FLAG=%x 5163# memo flag ?? 5164# >>0 ubyte&0x08 >0 MEMO_FLAG=%x 5165# SQL flag ?? 5166# >>0 ubyte&0x70 >0 SQL_FLAG=%x 5167# test and print the date of xBase .DBF .MDX 51680 name xbase-date 5169# inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31 5170>0 ubelong x 5171>1 ubyte <13 5172>>1 ubyte >0 5173>>>2 ubyte >0 5174>>>>2 ubyte <32 5175>>>>>0 ubyte x 5176# YY is interpreted as 20YY or 19YY 5177>>>>>>0 ubyte <100 \b %.2d 5178# YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY 5179>>>>>>0 ubyte >99 \b %d 5180>>>>>1 ubyte x \b-%d 5181>>>>>2 ubyte x \b-%d 5182 5183# dBase memo files .DBT or .FPT 5184# http://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx 518516 ubyte <4 5186>16 ubyte !2 5187>>16 ubyte !1 5188# next free block index is positive 5189>>>0 ulelong >0 5190# skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size 5191>>>>17 ubelong&0xFFfdFE00 0x00000000 5192# skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h 5193>>>>>20 ubelong&0xFF01209B 0x00000000 5194# dBASE III 5195>>>>>>16 ubyte 3 5196# dBASE III DBT 5197>>>>>>>0 use xbase-memo-print 5198# dBASE IV DBT , FoxPro FPT or many PNG , ZIP , DBF garbage 5199>>>>>>16 ubyte 0 5200# dBASE IV DBT with DBF name or DBF garbage 5201>>>>>>>8 ubelong >0x40000000 5202# skip DBF and catch dBASE IV DBT with DBF name and with non big index of next free block 5203>>>>>>>>0 ulelong <0x01010002 5204>>>>>>>>>0 use xbase-memo-print 5205>>>>>>>8 ubelong 0 5206# skip MM*DD*.bin by test for for reserved NULL byte 5207>>>>>>>>508 ubelong 0 5208# real memo files should contain text here 5209>>>>>>>>>520 ubelong >0x20202019 5210>>>>>>>>>>520 ubelong <0xFEFEFEFF 5211>>>>>>>>>>>0 use xbase-memo-print 5212# garbage PCX , ZIP , JAR , XPI 5213>>>>>>>8 default x 5214 5215# Print the information of dBase DBT or FoxPro FPT memo files 52160 name xbase-memo-print 5217>0 ubyte x 5218# test version 5219# memo file 5220>>16 ubyte 3 dBase III DBT 5221>>16 ubyte 0 5222>>>512 ubelong <0x00000003 FoxPro FPT 5223# Size of blocks for FoxPro 5224>>>>6 ubeshort x \b, blocks size %lu 5225# Number of next available block for appending data for FoxPro 5226>>>>0 ubelong =0 \b, next free block index %lu 5227>>>>0 ubelong !0 \b, next free block index %lu 5228>>>512 default x dBase IV DBT 5229# DBF file name without extention 5230>>>>8 string >\0 \b of %-.8s.DBF 5231# size of blocks ; not reliable 0x2020204C 5232#>>>>4 ulelong =0 \b, blocks size %lu 5233>>>>4 ulelong !0 \b, blocks size %lu 5234# Block length found 0 , 512 5235#>>>>20 uleshort =0 \b, block length %u 5236>>>>20 uleshort !0 \b, block length %u 5237# Number of next available block for appending data 5238>>>>0 ulelong =0 \b, next free block index %lu 5239>>>>0 ulelong !0 \b, next free block index %lu 5240>>512 ubelong x 5241>>>512 ubelong =0xFFFF0800 5242>>>>520 string >\0 \b, 1st used item "%s" 5243# FoxPro 5244>>>512 ubelong <3 5245# FoxPro memo 5246>>>>512 ubelong =1 5247>>>>520 string >\0 \b, 1st used item "%s" 5248>>>512 default x 5249# may be deleted memo field 5250>>>>512 string >\0 \b, 1st item "%s" 5251 5252# TODO: 5253# DBASE index file *.NDX 5254# DBASE Compound Index file *.CDX 5255# dBASE IV Printer Driver *.PRF 5256## End of XBase database stuff 5257 5258# MS Access database 52594 string Standard\ Jet\ DB Microsoft Access Database 5260!:mime application/x-msaccess 52614 string Standard\ ACE\ DB Microsoft Access Database 5262!:mime application/x-msaccess 5263 5264# TDB database from Samba et al - Martin Pool <mbp@samba.org> 52650 string TDB\ file TDB database 5266>32 lelong 0x2601196D version 6, little-endian 5267>>36 lelong x hash size %d bytes 5268 5269# SE Linux policy database 52700 lelong 0xf97cff8c SE Linux policy 5271>16 lelong x v%d 5272>20 lelong 1 MLS 5273>24 lelong x %d symbols 5274>28 lelong x %d ocons 5275 5276# ICE authority file data (Wolfram Kleff) 52772 string ICE ICE authority data 5278 5279# X11 Xauthority file (Wolfram Kleff) 528010 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 528111 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 528212 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 528313 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 528414 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 528515 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 528616 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 528717 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 528818 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 5289 5290# From: Maxime Henrion <mux@FreeBSD.org> 5291# PostgreSQL's custom dump format, Maxime Henrion <mux@FreeBSD.org> 52920 string PGDMP PostgreSQL custom database dump 5293>5 byte x - v%d 5294>6 byte x \b.%d 5295>5 beshort <0x101 \b-0 5296>5 beshort >0x100 5297>>7 byte x \b-%d 5298 5299# Type: Advanced Data Format (ADF) database 5300# URL: http://www.grc.nasa.gov/WWW/cgns/adf/ 5301# From: Nicolas Chauvat <nicolas.chauvat@logilab.fr> 53020 string @(#)ADF\ Database CGNS Advanced Data Format 5303 5304# Tokyo Cabinet magic data 5305# http://tokyocabinet.sourceforge.net/index.html 53060 string ToKyO\ CaBiNeT\n Tokyo Cabinet 5307>14 string x \b (%s) 5308>32 byte 0 \b, Hash 5309!:mime application/x-tokyocabinet-hash 5310>32 byte 1 \b, B+ tree 5311!:mime application/x-tokyocabinet-btree 5312>32 byte 2 \b, Fixed-length 5313!:mime application/x-tokyocabinet-fixed 5314>32 byte 3 \b, Table 5315!:mime application/x-tokyocabinet-table 5316>33 byte &1 \b, [open] 5317>33 byte &2 \b, [fatal] 5318>34 byte x \b, apow=%d 5319>35 byte x \b, fpow=%d 5320>36 byte &0x01 \b, [large] 5321>36 byte &0x02 \b, [deflate] 5322>36 byte &0x04 \b, [bzip] 5323>36 byte &0x08 \b, [tcbs] 5324>36 byte &0x10 \b, [excodec] 5325>40 lequad x \b, bnum=%lld 5326>48 lequad x \b, rnum=%lld 5327>56 lequad x \b, fsiz=%lld 5328 5329# Type: QDBM Quick Database Manager 5330# From: Benoit Sibaud <bsibaud@april.org> 53310 string \\[depot\\]\n\f Quick Database Manager, little endian 53320 string \\[DEPOT\\]\n\f Quick Database Manager, big endian 5333 5334# Type: TokyoCabinet database 5335# URL: http://tokyocabinet.sourceforge.net/ 5336# From: Benoit Sibaud <bsibaud@april.org> 53370 string ToKyO\ CaBiNeT\n TokyoCabinet database 5338>14 string x (version %s) 5339 5340# From: Stephane Blondon http://www.yaal.fr 5341# Database file for Zope (done by FileStorage) 53420 string FS21 Zope Object Database File Storage (data) 5343# Cache file for the database of Zope (done by ClientStorage) 53440 string ZEC3 Zope Object Database Client Cache File (data) 5345 5346# IDA (Interactive Disassembler) database 53470 string IDA1 IDA (Interactive Disassembler) database 5348 5349#------------------------------------------------------------------------------ 5350# $File: diamond,v 1.7 2009/09/19 16:28:08 christos Exp $ 5351# diamond: file(1) magic for Diamond system 5352# 5353# ... diamond is a multi-media mail and electronic conferencing system.... 5354# 5355# XXX - I think it was either renamed Slate, or replaced by Slate.... 5356# 5357# The full deal is too long... 5358#0 string <list>\n<protocol\ bbn-multimedia-format> Diamond Multimedia Document 53590 string =<list>\n<protocol\ bbn-m Diamond Multimedia Document 5360 5361#------------------------------------------------------------------------------ 5362# $File: diff,v 1.14 2012/09/16 23:08:54 christos Exp $ 5363# diff: file(1) magic for diff(1) output 5364# 53650 search/1 diff\ diff output text 5366!:mime text/x-diff 53670 search/1 ***\ diff output text 5368!:mime text/x-diff 53690 search/1 Only\ in\ diff output text 5370!:mime text/x-diff 53710 search/1 Common\ subdirectories:\ diff output text 5372!:mime text/x-diff 5373 53740 search/1 Index: RCS/CVS diff output text 5375!:mime text/x-diff 5376 5377# bsdiff: file(1) magic for bsdiff(1) output 53780 string/b BSDIFF40 bsdiff(1) patch file 5379 5380 5381# unified diff 53820 search/4096 ---\ 5383>&0 search/1024 \n 5384>>&0 search/1 +++\ 5385>>>&0 search/1024 \n 5386>>>>&0 search/1 @@ unified diff output text 5387!:mime text/x-diff 5388!:strength + 90 5389 5390# librsync -- the library for network deltas 5391# 5392# Copyright (C) 2001 by Martin Pool. You may do whatever you want with 5393# this file. 5394# 53950 belong 0x72730236 rdiff network-delta data 5396 53970 belong 0x72730136 rdiff network-delta signature data 5398>4 belong x (block length=%d, 5399>8 belong x signature strength=%d) 5400 5401#------------------------------------------------------------------------------ 5402# $File: digital,v 1.11 2013/01/11 16:45:23 christos Exp $ 5403# Digital UNIX - Info 5404# 54050 string =!<arch>\n________64E Alpha archive 5406>22 string X -- out of date 5407# 5408 54090 leshort 0603 5410>24 leshort 0410 COFF format alpha pure 5411>24 leshort 0413 COFF format alpha demand paged 5412>>22 leshort&030000 !020000 executable 5413>>22 leshort&020000 !0 dynamically linked 5414>>16 lelong !0 not stripped 5415>>16 lelong 0 stripped 5416>>27 byte x - version %d 5417>>26 byte x \b.%d 5418>>28 byte x \b-%d 5419>24 leshort 0407 COFF format alpha object 5420>>22 leshort&030000 020000 shared library 5421>>27 byte x - version %d 5422>>26 byte x \b.%d 5423>>28 byte x \b-%d 5424 5425# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk> 5426# 5427# The actual magic number is just "Core", followed by a 2-byte version 5428# number; however, treating any file that begins with "Core" as a Digital 5429# UNIX core dump file may produce too many false hits, so we include one 5430# byte of the version number as well; DU 5.0 appears only to be up to 5431# version 2. 5432# 54330 string Core\001 Alpha COFF format core dump (Digital UNIX) 5434>24 string >\0 \b, from '%s' 54350 string Core\002 Alpha COFF format core dump (Digital UNIX) 5436>24 string >\0 \b, from '%s' 5437# 5438# The next is incomplete, we could tell more about this format, 5439# but its not worth it. 54400 leshort 0x188 Alpha compressed COFF 54410 leshort 0x18f Alpha u-code object 5442# 5443# 5444# Some other interesting Digital formats, 54450 string \377\377\177 ddis/ddif 54460 string \377\377\174 ddis/dots archive 54470 string \377\377\176 ddis/dtif table data 54480 string \033c\033 LN03 output 54490 long 04553207 X image 5450# 54510 string =!<PDF>!\n profiling data file 5452# 5453# Locale data tables (MIPS and Alpha). 5454# 54550 short 0x0501 locale data table 5456>6 short 0x24 for MIPS 5457>6 short 0x40 for Alpha 5458 5459#------------------------------------------------------------------------------ 5460# $File: dolby,v 1.7 2014/01/08 22:37:23 christos Exp $ 5461# ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at> 5462# from http://www.atsc.org/standards/a_52a.pdf 5463# corrections, additions, etc. are always welcome! 5464# 5465# syncword 54660 beshort 0x0b77 ATSC A/52 aka AC-3 aka Dolby Digital stream, 5467# Proposed audio/ac3 RFC/4184 5468!:mime audio/vnd.dolby.dd-raw 5469# fscod 5470>4 byte&0xc0 = 0x00 48 kHz, 5471>4 byte&0xc0 = 0x40 44.1 kHz, 5472>4 byte&0xc0 = 0x80 32 kHz, 5473# is this one used for 96 kHz? 5474>4 byte&0xc0 = 0xc0 reserved frequency, 5475# 5476>5 byte&0x07 = 0x00 \b, complete main (CM) 5477>5 byte&0x07 = 0x01 \b, music and effects (ME) 5478>5 byte&0x07 = 0x02 \b, visually impaired (VI) 5479>5 byte&0x07 = 0x03 \b, hearing impaired (HI) 5480>5 byte&0x07 = 0x04 \b, dialogue (D) 5481>5 byte&0x07 = 0x05 \b, commentary (C) 5482>5 byte&0x07 = 0x06 \b, emergency (E) 5483>5 beshort&0x07e0 0x0720 \b, voiceover (VO) 5484>5 beshort&0x07e0 >0x0720 \b, karaoke 5485# acmod 5486>6 byte&0xe0 = 0x00 1+1 front, 5487>>6 byte&0x10 = 0x10 LFE on, 5488>6 byte&0xe0 = 0x20 1 front/0 rear, 5489>>6 byte&0x10 = 0x10 LFE on, 5490>6 byte&0xe0 = 0x40 2 front/0 rear, 5491# dsurmod (for stereo only) 5492>>6 byte&0x18 = 0x00 Dolby Surround not indicated 5493>>6 byte&0x18 = 0x08 not Dolby Surround encoded 5494>>6 byte&0x18 = 0x10 Dolby Surround encoded 5495>>6 byte&0x18 = 0x18 reserved Dolby Surround mode 5496>>6 byte&0x04 = 0x04 LFE on, 5497>6 byte&0xe0 = 0x60 3 front/0 rear, 5498>>6 byte&0x04 = 0x04 LFE on, 5499>6 byte&0xe0 = 0x80 2 front/1 rear, 5500>>6 byte&0x04 = 0x04 LFE on, 5501>6 byte&0xe0 = 0xa0 3 front/1 rear, 5502>>6 byte&0x01 = 0x01 LFE on, 5503>6 byte&0xe0 = 0xc0 2 front/2 rear, 5504>>6 byte&0x04 = 0x04 LFE on, 5505>6 byte&0xe0 = 0xe0 3 front/2 rear, 5506>>6 byte&0x01 = 0x01 LFE on, 5507# 5508>4 byte&0x3e = 0x00 \b, 32 kbit/s 5509>4 byte&0x3e = 0x02 \b, 40 kbit/s 5510>4 byte&0x3e = 0x04 \b, 48 kbit/s 5511>4 byte&0x3e = 0x06 \b, 56 kbit/s 5512>4 byte&0x3e = 0x08 \b, 64 kbit/s 5513>4 byte&0x3e = 0x0a \b, 80 kbit/s 5514>4 byte&0x3e = 0x0c \b, 96 kbit/s 5515>4 byte&0x3e = 0x0e \b, 112 kbit/s 5516>4 byte&0x3e = 0x10 \b, 128 kbit/s 5517>4 byte&0x3e = 0x12 \b, 160 kbit/s 5518>4 byte&0x3e = 0x14 \b, 192 kbit/s 5519>4 byte&0x3e = 0x16 \b, 224 kbit/s 5520>4 byte&0x3e = 0x18 \b, 256 kbit/s 5521>4 byte&0x3e = 0x1a \b, 320 kbit/s 5522>4 byte&0x3e = 0x1c \b, 384 kbit/s 5523>4 byte&0x3e = 0x1e \b, 448 kbit/s 5524>4 byte&0x3e = 0x20 \b, 512 kbit/s 5525>4 byte&0x3e = 0x22 \b, 576 kbit/s 5526>4 byte&0x3e = 0x24 \b, 640 kbit/s 5527 5528#------------------------------------------------------------------------------ 5529# $File: dump,v 1.12 2012/11/01 04:26:40 christos Exp $ 5530# dump: file(1) magic for dump file format--for new and old dump filesystems 5531# 5532# We specify both byte orders in order to recognize byte-swapped dumps. 5533# 55340 name new-dump-be 5535>4 bedate x Previous dump %s, 5536>8 bedate x This dump %s, 5537>12 belong >0 Volume %ld, 5538>692 belong 0 Level zero, type: 5539>692 belong >0 Level %d, type: 5540>0 belong 1 tape header, 5541>0 belong 2 beginning of file record, 5542>0 belong 3 map of inodes on tape, 5543>0 belong 4 continuation of file record, 5544>0 belong 5 end of volume, 5545>0 belong 6 map of inodes deleted, 5546>0 belong 7 end of medium (for floppy), 5547>676 string >\0 Label %s, 5548>696 string >\0 Filesystem %s, 5549>760 string >\0 Device %s, 5550>824 string >\0 Host %s, 5551>888 belong >0 Flags %x 5552 55530 name old-dump-be 5554#>4 bedate x Previous dump %s, 5555#>8 bedate x This dump %s, 5556>12 belong >0 Volume %ld, 5557>692 belong 0 Level zero, type: 5558>692 belong >0 Level %d, type: 5559>0 belong 1 tape header, 5560>0 belong 2 beginning of file record, 5561>0 belong 3 map of inodes on tape, 5562>0 belong 4 continuation of file record, 5563>0 belong 5 end of volume, 5564>0 belong 6 map of inodes deleted, 5565>0 belong 7 end of medium (for floppy), 5566>676 string >\0 Label %s, 5567>696 string >\0 Filesystem %s, 5568>760 string >\0 Device %s, 5569>824 string >\0 Host %s, 5570>888 belong >0 Flags %x 5571 55720 name ufs2-dump-be 5573>896 beqdate x Previous dump %s, 5574>904 beqdate x This dump %s, 5575>12 belong >0 Volume %ld, 5576>692 belong 0 Level zero, type: 5577>692 belong >0 Level %d, type: 5578>0 belong 1 tape header, 5579>0 belong 2 beginning of file record, 5580>0 belong 3 map of inodes on tape, 5581>0 belong 4 continuation of file record, 5582>0 belong 5 end of volume, 5583>0 belong 6 map of inodes deleted, 5584>0 belong 7 end of medium (for floppy), 5585>676 string >\0 Label %s, 5586>696 string >\0 Filesystem %s, 5587>760 string >\0 Device %s, 5588>824 string >\0 Host %s, 5589>888 belong >0 Flags %x 5590 559124 belong 60012 new-fs dump file (big endian), 5592>0 use new-dump-be 5593 559424 belong 60011 old-fs dump file (big endian), 5595>0 use old-dump-be 5596 559724 lelong 60012 new-fs dump file (little endian), 5598>0 use \^new-dump-be 5599 560024 lelong 60011 old-fs dump file (little endian), 5601>0 use \^old-dump-be 5602 5603 560424 belong 0x19540119 new-fs dump file (ufs2, big endian), 5605>0 use ufs2-dump-be 5606 560724 lelong 0x19540119 new-fs dump file (ufs2, little endian), 5608>0 use \^ufs2-dump-be 5609 561018 leshort 60011 old-fs dump file (16-bit, assuming PDP-11 endianness), 5611>2 medate x Previous dump %s, 5612>6 medate x This dump %s, 5613>10 leshort >0 Volume %ld, 5614>0 leshort 1 tape header. 5615>0 leshort 2 beginning of file record. 5616>0 leshort 3 map of inodes on tape. 5617>0 leshort 4 continuation of file record. 5618>0 leshort 5 end of volume. 5619>0 leshort 6 map of inodes deleted. 5620>0 leshort 7 end of medium (for floppy). 5621 5622#------------------------------------------------------------------------------ 5623# $File: dyadic,v 1.5 2010/09/20 18:55:20 rrt Exp $ 5624# Dyadic: file(1) magic for Dyalog APL. 5625# 56260 byte 0xaa 5627>1 byte <4 Dyalog APL 5628>>1 byte 0x00 incomplete workspace 5629>>1 byte 0x01 component file 5630>>1 byte 0x02 external variable 5631>>1 byte 0x03 workspace 5632>>2 byte x version %d 5633>>3 byte x .%d 5634 56350 beshort 0xaa03 Dyalog APL 5636>2 byte x workspace type %d 5637>3 byte x subtype %d 5638>7 byte&0x28 0x00 32-bit 5639>7 byte&0x28 0x20 64-bit 5640>7 byte&0x0c 0x00 classic 5641>7 byte&0x0c 0x04 unicode 5642>7 byte&0x88 0x00 big-endian 5643>7 byte&0x88 0x80 little-endian 5644 56450 byte 0xaa Dyalog APL 5646>1 byte 0x00 aplcore 5647>1 byte 0x01 component file 32-bit non-journaled non-checksummed 5648>1 byte 0x02 external variable exclusive 5649>1 byte 0x06 external variable shared 5650>1 byte 0x07 session 5651>1 byte 0x08 mapped file 32-bit 5652>1 byte 0x09 component file 64-bit non-journaled non-checksummed 5653>1 byte 0x0a mapped file 64-bit 5654>1 byte 0x0b component file 32-bit level 1 journaled non-checksummed 5655>1 byte 0x0c component file 64-bit level 1 journaled non-checksummed 5656>1 byte 0x0d component file 32-bit level 1 journaled checksummed 5657>1 byte 0x0e component file 64-bit level 1 journaled checksummed 5658>1 byte 0x0f component file 32-bit level 2 journaled checksummed 5659>1 byte 0x10 component file 64-bit level 2 journaled checksummed 5660>1 byte 0x11 component file 32-bit level 3 journaled checksummed 5661>1 byte 0x12 component file 64-bit level 3 journaled checksummed 5662>1 byte 0x13 component file 32-bit non-journaled checksummed 5663>1 byte 0x14 component file 64-bit non-journaled checksummed 5664>1 byte 0x80 DDB 5665 56660 short 0x6060 Dyalog APL transfer 5667 5668#------------------------------------------------------------------------------ 5669# $File: ebml,v 1.1 2010/07/02 00:07:03 christos Exp $ 5670# ebml: file(1) magic for various Extensible Binary Meta Language 5671# http://www.matroska.org/technical/specs/index.html#track 56720 belong 0x1a45dfa3 EBML file 5673>4 search/b/100 \102\202 5674>>&1 string x \b, creator %.8s 5675 5676#------------------------------------------------------------------------------ 5677# $File: editors,v 1.8 2009/09/19 16:28:09 christos Exp $ 5678# T602 editor documents 5679# by David Necas <yeti@physics.muni.cz> 56800 string @CT\ T602 document data, 5681>4 string 0 Kamenicky 5682>4 string 1 CP 852 5683>4 string 2 KOI8-CS 5684>4 string >2 unknown encoding 5685 5686# Vi IMproved Encrypted file 5687# by David Necas <yeti@physics.muni.cz> 56880 string VimCrypt~ Vim encrypted file data 5689# Vi IMproved Swap file 5690# by Sven Wegener <swegener@gentoo.org> 56910 string b0VIM\ Vim swap file 5692>&0 string >\0 \b, version %s 5693 5694#------------------------------------------------------------------------------ 5695# $File: efi,v 1.4 2009/09/19 16:28:09 christos Exp $ 5696# efi: file(1) magic for Universal EFI binaries 5697 56980 lelong 0x0ef1fab9 5699>4 lelong 1 Universal EFI binary with 1 architecture 5700>>&0 lelong 7 \b, i386 5701>>&0 lelong 0x01000007 \b, x86_64 5702>4 lelong 2 Universal EFI binary with 2 architectures 5703>>&0 lelong 7 \b, i386 5704>>&0 lelong 0x01000007 \b, x86_64 5705>>&20 lelong 7 \b, i386 5706>>&20 lelong 0x01000007 \b, x86_64 5707>4 lelong >2 Universal EFI binary with %ld architectures 5708 5709#------------------------------------------------------------------------------ 5710# $File: elf,v 1.64 2013/08/04 09:31:47 christos Exp $ 5711# elf: file(1) magic for ELF executables 5712# 5713# We have to check the byte order flag to see what byte order all the 5714# other stuff in the header is in. 5715# 5716# What're the correct byte orders for the nCUBE and the Fujitsu VPP500? 5717# 5718# Created by: unknown 5719# Modified by (1): Daniel Quinlan <quinlan@yggdrasil.com> 5720# Modified by (2): Peter Tobias <tobias@server.et-inf.fho-emden.de> (core support) 5721# Modified by (3): Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> (fix of core support) 5722# Modified by (4): <gerardo.cacciari@gmail.com> (VMS Itanium) 5723# Modified by (5): Matthias Urlichs <smurf@debian.org> (Listing of many architectures) 5724 57250 name elf-le 5726>16 leshort 0 no file type, 5727!:mime application/octet-stream 5728>16 leshort 1 relocatable, 5729!:mime application/x-object 5730>16 leshort 2 executable, 5731!:mime application/x-executable 5732>16 leshort 3 shared object, 5733!:mime application/x-sharedlib 5734>16 leshort 4 core file 5735!:mime application/x-coredump 5736# Core file detection is not reliable. 5737#>>>(0x38+0xcc) string >\0 of '%s' 5738#>>>(0x38+0x10) lelong >0 (signal %d), 5739>16 leshort &0xff00 processor-specific, 5740>18 clear x 5741>18 leshort 0 no machine, 5742>18 leshort 1 AT&T WE32100 5743>18 leshort 2 SPARC 5744>18 leshort 3 Intel 80386, 5745>18 leshort 4 Motorola 5746>>4 byte 1 5747>>>36 lelong &0x01000000 68000, 5748>>>36 lelong &0x00810000 CPU32, 5749>>>36 lelong 0 68020, 5750>18 leshort 5 Motorola 88000, 5751>18 leshort 6 Intel 80486, 5752>18 leshort 7 Intel 80860, 5753# The official e_machine number for MIPS is now #8, regardless of endianness. 5754# The second number (#10) will be deprecated later. For now, we still 5755# say something if #10 is encountered, but only gory details for #8. 5756>18 leshort 8 MIPS, 5757>>4 byte 1 5758>>>36 lelong &0x20 N32 5759>18 leshort 10 MIPS, 5760>>4 byte 1 5761>>>36 lelong &0x20 N32 5762>18 leshort 8 5763# only for 32-bit 5764>>4 byte 1 5765>>>36 lelong&0xf0000000 0x00000000 MIPS-I 5766>>>36 lelong&0xf0000000 0x10000000 MIPS-II 5767>>>36 lelong&0xf0000000 0x20000000 MIPS-III 5768>>>36 lelong&0xf0000000 0x30000000 MIPS-IV 5769>>>36 lelong&0xf0000000 0x40000000 MIPS-V 5770>>>36 lelong&0xf0000000 0x50000000 MIPS32 5771>>>36 lelong&0xf0000000 0x60000000 MIPS64 5772>>>36 lelong&0xf0000000 0x70000000 MIPS32 rel2 5773>>>36 lelong&0xf0000000 0x80000000 MIPS64 rel2 5774# only for 64-bit 5775>>4 byte 2 5776>>>48 lelong&0xf0000000 0x00000000 MIPS-I 5777>>>48 lelong&0xf0000000 0x10000000 MIPS-II 5778>>>48 lelong&0xf0000000 0x20000000 MIPS-III 5779>>>48 lelong&0xf0000000 0x30000000 MIPS-IV 5780>>>48 lelong&0xf0000000 0x40000000 MIPS-V 5781>>>48 lelong&0xf0000000 0x50000000 MIPS32 5782>>>48 lelong&0xf0000000 0x60000000 MIPS64 5783>>>48 lelong&0xf0000000 0x70000000 MIPS32 rel2 5784>>>48 lelong&0xf0000000 0x80000000 MIPS64 rel2 5785>18 leshort 9 Amdahl, 5786>18 leshort 10 MIPS (deprecated), 5787>18 leshort 11 RS6000, 5788>18 leshort 15 PA-RISC, 5789# only for 32-bit 5790>>4 byte 1 5791>>>38 leshort 0x0214 2.0 5792>>>36 leshort &0x0008 (LP64) 5793# only for 64-bit 5794>>4 byte 2 5795>>>50 leshort 0x0214 2.0 5796>>>48 leshort &0x0008 (LP64) 5797>18 leshort 16 nCUBE, 5798>18 leshort 17 Fujitsu VPP500, 5799>18 leshort 18 SPARC32PLUS, 5800# only for 32-bit 5801>>4 byte 1 5802>>>36 lelong&0xffff00 0x000100 V8+ Required, 5803>>>36 lelong&0xffff00 0x000200 Sun UltraSPARC1 Extensions Required, 5804>>>36 lelong&0xffff00 0x000400 HaL R1 Extensions Required, 5805>>>36 lelong&0xffff00 0x000800 Sun UltraSPARC3 Extensions Required, 5806>18 leshort 20 PowerPC or cisco 4500, 5807>18 leshort 21 64-bit PowerPC or cisco 7500, 5808>18 leshort 22 IBM S/390, 5809>18 leshort 23 Cell SPU, 5810>18 leshort 24 cisco SVIP, 5811>18 leshort 25 cisco 7200, 5812>18 leshort 36 NEC V800 or cisco 12000, 5813>18 leshort 37 Fujitsu FR20, 5814>18 leshort 38 TRW RH-32, 5815>18 leshort 39 Motorola RCE, 5816>18 leshort 40 ARM, 5817>>4 byte 1 5818>>>36 lelong&0xff000000 0x04000000 EABI4 5819>>>36 lelong&0xff000000 0x05000000 EABI5 5820>>>36 lelong &0x00800000 BE8 5821>>>36 lelong &0x00400000 LE8 5822>18 leshort 41 Alpha, 5823>18 leshort 0xa390 IBM S/390 (obsolete), 5824>18 leshort 42 Renesas SH, 5825>18 leshort 43 SPARC V9, 5826>>4 byte 2 5827>>>48 lelong&0xffff00 0x000200 Sun UltraSPARC1 Extensions Required, 5828>>>48 lelong&0xffff00 0x000400 HaL R1 Extensions Required, 5829>>>48 lelong&0xffff00 0x000800 Sun UltraSPARC3 Extensions Required, 5830>>>48 lelong&0x3 0 total store ordering, 5831>>>48 lelong&0x3 1 partial store ordering, 5832>>>48 lelong&0x3 2 relaxed memory ordering, 5833>18 leshort 44 Siemens Tricore Embedded Processor, 5834>18 leshort 45 Argonaut RISC Core, Argonaut Technologies Inc., 5835>18 leshort 46 Renesas H8/300, 5836>18 leshort 47 Renesas H8/300H, 5837>18 leshort 48 Renesas H8S, 5838>18 leshort 49 Renesas H8/500, 5839>18 leshort 50 IA-64, 5840>18 leshort 51 Stanford MIPS-X, 5841>18 leshort 52 Motorola Coldfire, 5842>18 leshort 53 Motorola M68HC12, 5843>18 leshort 54 Fujitsu MMA, 5844>18 leshort 55 Siemens PCP, 5845>18 leshort 56 Sony nCPU, 5846>18 leshort 57 Denso NDR1, 5847>18 leshort 58 Start*Core, 5848>18 leshort 59 Toyota ME16, 5849>18 leshort 60 ST100, 5850>18 leshort 61 Tinyj emb., 5851>18 leshort 62 x86-64, 5852>18 leshort 63 Sony DSP, 5853>18 leshort 66 FX66, 5854>18 leshort 67 ST9+ 8/16 bit, 5855>18 leshort 68 ST7 8 bit, 5856>18 leshort 69 MC68HC16, 5857>18 leshort 70 MC68HC11, 5858>18 leshort 71 MC68HC08, 5859>18 leshort 72 MC68HC05, 5860>18 leshort 73 SGI SVx or Cray NV1, 5861>18 leshort 74 ST19 8 bit, 5862>18 leshort 75 Digital VAX, 5863>18 leshort 76 Axis cris, 5864>18 leshort 77 Infineon 32-bit embedded, 5865>18 leshort 78 Element 14 64-bit DSP, 5866>18 leshort 79 LSI Logic 16-bit DSP, 5867>18 leshort 80 MMIX, 5868>18 leshort 81 Harvard machine-independent, 5869>18 leshort 82 SiTera Prism, 5870>18 leshort 83 Atmel AVR 8-bit, 5871>18 leshort 84 Fujitsu FR30, 5872>18 leshort 85 Mitsubishi D10V, 5873>18 leshort 86 Mitsubishi D30V, 5874>18 leshort 87 NEC v850, 5875>18 leshort 88 Renesas M32R, 5876>18 leshort 89 Matsushita MN10300, 5877>18 leshort 90 Matsushita MN10200, 5878>18 leshort 91 picoJava, 5879>18 leshort 92 OpenRISC, 5880>18 leshort 93 ARC Cores Tangent-A5, 5881>18 leshort 94 Tensilica Xtensa, 5882>18 leshort 97 NatSemi 32k, 5883>18 leshort 106 Analog Devices Blackfin, 5884>18 leshort 113 Altera Nios II, 5885>18 beshort 138 LatticeMico32, 5886>18 leshort 174 META, 5887>18 leshort 183 ARM aarch64, 5888>18 leshort 187 Tilera TILE64, 5889>18 leshort 188 Tilera TILEPro, 5890>18 leshort 191 Tilera TILE-Gx, 5891>18 leshort 0x3426 OpenRISC (obsolete), 5892>18 leshort 0x8472 OpenRISC (obsolete), 5893>18 leshort 0x9026 Alpha (unofficial), 5894>18 default x 5895>>18 leshort x *unknown arch 0x%x* 5896>20 lelong 0 invalid version 5897>20 lelong 1 version 1 5898 58990 string \177ELF ELF 5900!:strength *2 5901>4 byte 0 invalid class 5902>4 byte 1 32-bit 5903>4 byte 2 64-bit 5904>5 byte 0 invalid byte order 5905>5 byte 1 LSB 5906>>0 use elf-le 5907>5 byte 2 MSB 5908>>0 use \^elf-le 5909# Up to now only 0, 1 and 2 are defined; I've seen a file with 0x83, it seemed 5910# like proper ELF, but extracting the string had bad results. 5911>4 byte <0x80 5912>>8 string >\0 (%s) 5913>8 string \0 5914>>7 byte 0 (SYSV) 5915>>7 byte 1 (HP-UX) 5916>>7 byte 2 (NetBSD) 5917>>7 byte 3 (GNU/Linux) 5918>>7 byte 4 (GNU/Hurd) 5919>>7 byte 5 (86Open) 5920>>7 byte 6 (Solaris) 5921>>7 byte 7 (Monterey) 5922>>7 byte 8 (IRIX) 5923>>7 byte 9 (FreeBSD) 5924>>7 byte 10 (Tru64) 5925>>7 byte 11 (Novell Modesto) 5926>>7 byte 12 (OpenBSD) 5927>8 string \2 5928>>7 byte 13 (OpenVMS) 5929>>7 byte 97 (ARM) 5930>>7 byte 255 (embedded) 5931 5932#------------------------------------------------------------------------------ 5933# $File: encore,v 1.6 2009/09/19 16:28:09 christos Exp $ 5934# encore: file(1) magic for Encore machines 5935# 5936# XXX - needs to have the byte order specified (NS32K was little-endian, 5937# dunno whether they run the 88K in little-endian mode or not). 5938# 59390 short 0x154 Encore 5940>20 short 0x107 executable 5941>20 short 0x108 pure executable 5942>20 short 0x10b demand-paged executable 5943>20 short 0x10f unsupported executable 5944>12 long >0 not stripped 5945>22 short >0 - version %ld 5946>22 short 0 - 5947#>4 date x stamp %s 59480 short 0x155 Encore unsupported executable 5949>12 long >0 not stripped 5950>22 short >0 - version %ld 5951>22 short 0 - 5952#>4 date x stamp %s 5953 5954#------------------------------------------------------------------------------ 5955# $File: epoc,v 1.9 2013/12/21 14:28:15 christos Exp $ 5956# EPOC : file(1) magic for EPOC documents [Psion Series 5/Osaris/Geofox 1] 5957# Stefan Praszalowicz <hpicollo@worldnet.fr> and Peter Breitenlohner <peb@mppmu.mpg.de> 5958# Useful information for improving this file can be found at: 5959# http://software.frodo.looijaard.name/psiconv/formats/Index.html 5960#------------------------------------------------------------------------------ 59610 lelong 0x10000037 Psion Series 5 5962>4 lelong 0x10000039 font file 5963>4 lelong 0x1000003A printer driver 5964>4 lelong 0x1000003B clipboard 5965>4 lelong 0x10000042 multi-bitmap image 5966!:mime image/x-epoc-mbm 5967>4 lelong 0x1000006A application information file 5968>4 lelong 0x1000006D 5969>>8 lelong 0x1000007D Sketch image 5970!:mime image/x-epoc-sketch 5971>>8 lelong 0x1000007E voice note 5972>>8 lelong 0x1000007F Word file 5973!:mime application/x-epoc-word 5974>>8 lelong 0x10000085 OPL program (TextEd) 5975!:mime application/x-epoc-opl 5976>>8 lelong 0x10000087 Comms settings 5977>>8 lelong 0x10000088 Sheet file 5978!:mime application/x-epoc-sheet 5979>>8 lelong 0x100001C4 EasyFax initialisation file 5980>4 lelong 0x10000073 OPO module 5981!:mime application/x-epoc-opo 5982>4 lelong 0x10000074 OPL application 5983!:mime application/x-epoc-app 5984>4 lelong 0x1000008A exported multi-bitmap image 5985>4 lelong 0x1000016D 5986>>8 lelong 0x10000087 Comms names 5987 59880 lelong 0x10000041 Psion Series 5 ROM multi-bitmap image 5989 59900 lelong 0x10000050 Psion Series 5 5991>4 lelong 0x1000006D database 5992>>8 lelong 0x10000084 Agenda file 5993!:mime application/x-epoc-agenda 5994>>8 lelong 0x10000086 Data file 5995!:mime application/x-epoc-data 5996>>8 lelong 0x10000CEA Jotter file 5997!:mime application/x-epoc-jotter 5998>4 lelong 0x100000E4 ini file 5999 60000 lelong 0x10000079 Psion Series 5 binary: 6001>4 lelong 0x00000000 DLL 6002>4 lelong 0x10000049 comms hardware library 6003>4 lelong 0x1000004A comms protocol library 6004>4 lelong 0x1000005D OPX 6005>4 lelong 0x1000006C application 6006>4 lelong 0x1000008D DLL 6007>4 lelong 0x100000AC logical device driver 6008>4 lelong 0x100000AD physical device driver 6009>4 lelong 0x100000E5 file transfer protocol 6010>4 lelong 0x100000E5 file transfer protocol 6011>4 lelong 0x10000140 printer definition 6012>4 lelong 0x10000141 printer definition 6013 60140 lelong 0x1000007A Psion Series 5 executable 6015 6016#------------------------------------------------------------------------------ 6017# $File: erlang,v 1.6 2010/09/20 19:19:17 rrt Exp $ 6018# erlang: file(1) magic for Erlang JAM and BEAM files 6019# URL: http://www.erlang.org/faq/x779.html#AEN812 6020 6021# OTP R3-R4 60220 string \0177BEAM! Old Erlang BEAM file 6023>6 short >0 - version %d 6024 6025# OTP R5 and onwards 60260 string FOR1 6027>8 string BEAM Erlang BEAM file 6028 6029# 4.2 version may have a copyright notice! 60304 string Tue\ Jan\ 22\ 14:32:44\ MET\ 1991 Erlang JAM file - version 4.2 603179 string Tue\ Jan\ 22\ 14:32:44\ MET\ 1991 Erlang JAM file - version 4.2 6032 60334 string 1.0\ Fri\ Feb\ 3\ 09:55:56\ MET\ 1995 Erlang JAM file - version 4.3 6034 60350 bequad 0x0000000000ABCDEF Erlang DETS file 6036 6037#------------------------------------------------------------------------------ 6038# $File: esri,v 1.4 2009/09/19 16:28:09 christos Exp $ 6039# ESRI Shapefile format (.shp .shx .dbf=DBaseIII) 6040# Based on info from 6041# <URL:http://www.esri.com/library/whitepapers/pdfs/shapefile.pdf> 60420 belong 9994 ESRI Shapefile 6043>4 belong =0 6044>8 belong =0 6045>12 belong =0 6046>16 belong =0 6047>20 belong =0 6048>28 lelong x version %d 6049>24 belong x length %d 6050>32 lelong =0 type Null Shape 6051>32 lelong =1 type Point 6052>32 lelong =3 type PolyLine 6053>32 lelong =5 type Polygon 6054>32 lelong =8 type MultiPoint 6055>32 lelong =11 type PointZ 6056>32 lelong =13 type PolyLineZ 6057>32 lelong =15 type PolygonZ 6058>32 lelong =18 type MultiPointZ 6059>32 lelong =21 type PointM 6060>32 lelong =23 type PolyLineM 6061>32 lelong =25 type PolygonM 6062>32 lelong =28 type MultiPointM 6063>32 lelong =31 type MultiPatch 6064 6065#------------------------------------------------------------------------------ 6066# $File: fcs,v 1.4 2009/09/19 16:28:09 christos Exp $ 6067# fcs: file(1) magic for FCS (Flow Cytometry Standard) data files 6068# From Roger Leigh <roger@whinlatter.uklinux.net> 60690 string FCS1.0 Flow Cytometry Standard (FCS) data, version 1.0 60700 string FCS2.0 Flow Cytometry Standard (FCS) data, version 2.0 60710 string FCS3.0 Flow Cytometry Standard (FCS) data, version 3.0 6072 6073#------------------------------------------------------------------------------ 6074# $File: filesystems,v 1.85 2013/11/19 23:54:05 christos Exp $ 6075# filesystems: file(1) magic for different filesystems 6076# 60770 name partid 6078>0 ubyte 0x00 Unused 6079>0 ubyte 0x01 12-bit FAT 6080>0 ubyte 0x02 XENIX / 6081>0 ubyte 0x03 XENIX /usr 6082>0 ubyte 0x04 16-bit FAT, less than 32M 6083>0 ubyte 0x05 extended partition 6084>0 ubyte 0x06 16-bit FAT, more than 32M 6085>0 ubyte 0x07 OS/2 HPFS, NTFS, QNX2, Adv. UNIX 6086>0 ubyte 0x08 AIX or os, or etc. 6087>0 ubyte 0x09 AIX boot partition or Coherent 6088>0 ubyte 0x0a O/2 boot manager or Coherent swap 6089>0 ubyte 0x0b 32-bit FAT 6090>0 ubyte 0x0c 32-bit FAT, LBA-mapped 6091>0 ubyte 0x0d 7XXX, LBA-mapped 6092>0 ubyte 0x0e 16-bit FAT, LBA-mapped 6093>0 ubyte 0x0f extended partition, LBA-mapped 6094>0 ubyte 0x10 OPUS 6095>0 ubyte 0x11 OS/2 DOS 12-bit FAT 6096>0 ubyte 0x12 Compaq diagnostics 6097>0 ubyte 0x14 OS/2 DOS 16-bit FAT <32M 6098>0 ubyte 0x16 OS/2 DOS 16-bit FAT >=32M 6099>0 ubyte 0x17 OS/2 hidden IFS 6100>0 ubyte 0x18 AST Windows swapfile 6101>0 ubyte 0x19 Willowtech Photon coS 6102>0 ubyte 0x1b hidden win95 fat 32 6103>0 ubyte 0x1c hidden win95 fat 32 lba 6104>0 ubyte 0x1d hidden win95 fat 16 lba 6105>0 ubyte 0x20 Willowsoft OFS1 6106>0 ubyte 0x21 reserved 6107>0 ubyte 0x23 reserved 6108>0 ubyte 0x24 NEC DOS 6109>0 ubyte 0x26 reserved 6110>0 ubyte 0x31 reserved 6111>0 ubyte 0x32 Alien Internet Services NOS 6112>0 ubyte 0x33 reserved 6113>0 ubyte 0x34 reserved 6114>0 ubyte 0x35 JFS on OS2 6115>0 ubyte 0x36 reserved 6116>0 ubyte 0x38 Theos 6117>0 ubyte 0x39 Plan 9, or Theos spanned 6118>0 ubyte 0x3a Theos ver 4 4gb partition 6119>0 ubyte 0x3b Theos ve 4 extended partition 6120>0 ubyte 0x3c PartitionMagic recovery 6121>0 ubyte 0x3d Hidden Netware 6122>0 ubyte 0x40 VENIX 286 or LynxOS 6123>0 ubyte 0x41 PReP 6124>0 ubyte 0x42 linux swap sharing DRDOS disk 6125>0 ubyte 0x43 linux sharing DRDOS disk 6126>0 ubyte 0x44 GoBack change utility 6127>0 ubyte 0x45 Boot US Boot manager 6128>0 ubyte 0x46 EUMEL/Elan or Ergos 3 6129>0 ubyte 0x47 EUMEL/Elan or Ergos 3 6130>0 ubyte 0x48 EUMEL/Elan or Ergos 3 6131>0 ubyte 0x4a ALFX/THIN filesystem for DOS 6132>0 ubyte 0x4c Oberon partition 6133>0 ubyte 0x4d QNX4.x 6134>0 ubyte 0x4e QNX4.x 2nd part 6135>0 ubyte 0x4f QNX4.x 3rd part 6136>0 ubyte 0x50 DM (disk manager) 6137>0 ubyte 0x51 DM6 Aux1 (or Novell) 6138>0 ubyte 0x52 CP/M or Microport SysV/AT 6139>0 ubyte 0x53 DM6 Aux3 6140>0 ubyte 0x54 DM6 DDO 6141>0 ubyte 0x55 EZ-Drive (disk manager) 6142>0 ubyte 0x56 Golden Bow (disk manager) 6143>0 ubyte 0x57 Drive PRO 6144>0 ubyte 0x5c Priam Edisk (disk manager) 6145>0 ubyte 0x61 SpeedStor 6146>0 ubyte 0x63 GNU HURD or Mach or Sys V/386 6147>0 ubyte 0x64 Novell Netware 2.xx or Speedstore 6148>0 ubyte 0x65 Novell Netware 3.xx 6149>0 ubyte 0x66 Novell 386 Netware 6150>0 ubyte 0x67 Novell 6151>0 ubyte 0x68 Novell 6152>0 ubyte 0x69 Novell 6153>0 ubyte 0x70 DiskSecure Multi-Boot 6154>0 ubyte 0x71 reserved 6155>0 ubyte 0x73 reserved 6156>0 ubyte 0x74 reserved 6157>0 ubyte 0x75 PC/IX 6158>0 ubyte 0x76 reserved 6159>0 ubyte 0x77 M2FS/M2CS partition 6160>0 ubyte 0x78 XOSL boot loader filesystem 6161>0 ubyte 0x80 MINIX until 1.4a 6162>0 ubyte 0x81 MINIX since 1.4b 6163>0 ubyte 0x82 Linux swap or Solaris 6164>0 ubyte 0x83 Linux native 6165>0 ubyte 0x84 OS/2 hidden C: drive 6166>0 ubyte 0x85 Linux extended partition 6167>0 ubyte 0x86 NT FAT volume set 6168>0 ubyte 0x87 NTFS volume set or HPFS mirrored 6169>0 ubyte 0x8a Linux Kernel AiR-BOOT partition 6170>0 ubyte 0x8b Legacy Fault tolerant FAT32 6171>0 ubyte 0x8c Legacy Fault tolerant FAT32 ext 6172>0 ubyte 0x8d Hidden free FDISK FAT12 6173>0 ubyte 0x8e Linux Logical Volume Manager 6174>0 ubyte 0x90 Hidden free FDISK FAT16 6175>0 ubyte 0x91 Hidden free FDISK DOS EXT 6176>0 ubyte 0x92 Hidden free FDISK FAT16 Big 6177>0 ubyte 0x93 Amoeba filesystem 6178>0 ubyte 0x94 Amoeba bad block table 6179>0 ubyte 0x95 MIT EXOPC native partitions 6180>0 ubyte 0x97 Hidden free FDISK FAT32 6181>0 ubyte 0x98 Datalight ROM-DOS Super-Boot 6182>0 ubyte 0x99 Mylex EISA SCSI 6183>0 ubyte 0x9a Hidden free FDISK FAT16 LBA 6184>0 ubyte 0x9b Hidden free FDISK EXT LBA 6185>0 ubyte 0x9f BSDI? 6186>0 ubyte 0xa0 IBM Thinkpad hibernation 6187>0 ubyte 0xa1 HP Volume expansion (SpeedStor) 6188>0 ubyte 0xa3 HP Volume expansion (SpeedStor) 6189>0 ubyte 0xa4 HP Volume expansion (SpeedStor) 6190>0 ubyte 0xa5 386BSD partition type 6191>0 ubyte 0xa6 OpenBSD partition type 6192>0 ubyte 0xa7 NeXTSTEP 486 6193>0 ubyte 0xa8 Apple UFS 6194>0 ubyte 0xa9 NetBSD partition type 6195>0 ubyte 0xaa Olivetty Fat12 1.44MB Service part 6196>0 ubyte 0xab Apple Boot 6197>0 ubyte 0xae SHAG OS filesystem 6198>0 ubyte 0xaf Apple HFS 6199>0 ubyte 0xb0 BootStar Dummy 6200>0 ubyte 0xb1 reserved 6201>0 ubyte 0xb3 reserved 6202>0 ubyte 0xb4 reserved 6203>0 ubyte 0xb6 reserved 6204>0 ubyte 0xb7 BSDI BSD/386 filesystem 6205>0 ubyte 0xb8 BSDI BSD/386 swap 6206>0 ubyte 0xbb Boot Wizard Hidden 6207>0 ubyte 0xbe Solaris 8 partition type 6208>0 ubyte 0xbf Solaris partition type 6209>0 ubyte 0xc0 CTOS 6210>0 ubyte 0xc1 DRDOS/sec (FAT-12) 6211>0 ubyte 0xc2 Hidden Linux 6212>0 ubyte 0xc3 Hidden Linux swap 6213>0 ubyte 0xc4 DRDOS/sec (FAT-16, < 32M) 6214>0 ubyte 0xc5 DRDOS/sec (EXT) 6215>0 ubyte 0xc6 DRDOS/sec (FAT-16, >= 32M) 6216>0 ubyte 0xc7 Syrinx (Cyrnix?) or HPFS disabled 6217>0 ubyte 0xc8 Reserved for DR-DOS 8.0+ 6218>0 ubyte 0xc9 Reserved for DR-DOS 8.0+ 6219>0 ubyte 0xca Reserved for DR-DOS 8.0+ 6220>0 ubyte 0xcb DR-DOS 7.04+ Secured FAT32 CHS 6221>0 ubyte 0xcc DR-DOS 7.04+ Secured FAT32 LBA 6222>0 ubyte 0xcd CTOS Memdump 6223>0 ubyte 0xce DR-DOS 7.04+ FAT16X LBA 6224>0 ubyte 0xcf DR-DOS 7.04+ EXT LBA 6225>0 ubyte 0xd0 REAL/32 secure big partition 6226>0 ubyte 0xd1 Old Multiuser DOS FAT12 6227>0 ubyte 0xd4 Old Multiuser DOS FAT16 Small 6228>0 ubyte 0xd5 Old Multiuser DOS Extended 6229>0 ubyte 0xd6 Old Multiuser DOS FAT16 Big 6230>0 ubyte 0xd8 CP/M 86 6231>0 ubyte 0xdb CP/M or Concurrent CP/M 6232>0 ubyte 0xdd Hidden CTOS Memdump 6233>0 ubyte 0xde Dell PowerEdge Server utilities 6234>0 ubyte 0xdf DG/UX virtual disk manager 6235>0 ubyte 0xe0 STMicroelectronics ST AVFS 6236>0 ubyte 0xe1 DOS access or SpeedStor 12-bit 6237>0 ubyte 0xe3 DOS R/O or Storage Dimensions 6238>0 ubyte 0xe4 SpeedStor 16-bit FAT < 1024 cyl. 6239>0 ubyte 0xe5 reserved 6240>0 ubyte 0xe6 reserved 6241>0 ubyte 0xeb BeOS 6242>0 ubyte 0xee GPT Protective MBR 6243>0 ubyte 0xef EFI system partition 6244>0 ubyte 0xf0 Linux PA-RISC boot loader 6245>0 ubyte 0xf1 SpeedStor or Storage Dimensions 6246>0 ubyte 0xf2 DOS 3.3+ Secondary 6247>0 ubyte 0xf3 reserved 6248>0 ubyte 0xf4 SpeedStor large partition 6249>0 ubyte 0xf5 Prologue multi-volumen partition 6250>0 ubyte 0xf6 reserved 6251>0 ubyte 0xf9 pCache: ext2/ext3 persistent cache 6252>0 ubyte 0xfa Bochs x86 emulator 6253>0 ubyte 0xfb VMware File System 6254>0 ubyte 0xfc VMware Swap 6255>0 ubyte 0xfd Linux RAID partition persistent sb 6256>0 ubyte 0xfe LANstep or IBM PS/2 IML 6257>0 ubyte 0xff Xenix Bad Block Table 6258 62590 string \366\366\366\366 PC formatted floppy with no filesystem 6260# Sun disk labels 6261# From /usr/include/sun/dklabel.h: 62620774 beshort 0xdabe 6263# modified by Joerg Jenderek, because original test 6264# succeeds for Cabinet archive dao360.dl_ with negative blocks 6265>0770 long >0 Sun disk label 6266>>0 string x '%s 6267>>>31 string >\0 \b%s 6268>>>>63 string >\0 \b%s 6269>>>>>95 string >\0 \b%s 6270>>0 string x \b' 6271>>0734 short >0 %d rpm, 6272>>0736 short >0 %d phys cys, 6273>>0740 short >0 %d alts/cyl, 6274>>0746 short >0 %d interleave, 6275>>0750 short >0 %d data cyls, 6276>>0752 short >0 %d alt cyls, 6277>>0754 short >0 %d heads/partition, 6278>>0756 short >0 %d sectors/track, 6279>>0764 long >0 start cyl %ld, 6280>>0770 long x %ld blocks 6281# Is there a boot block written 1 sector in? 6282>512 belong&077777777 0600407 \b, boot block present 6283 6284# Joerg Jenderek: Smart Boot Manager backup file is 25 (MSDOS) or 41 (LINUX) byte header + first sectors of disk 6285# (http://btmgr.sourceforge.net/docs/user-guide-3.html) 62860 string SBMBAKUP_ Smart Boot Manager backup file 6287>9 string x \b, version %-5.5s 6288>>14 string =_ 6289>>>15 string x %-.1s 6290>>>>16 string =_ \b. 6291>>>>>17 string x \b%-.1s 6292>>>>>>18 string =_ \b. 6293>>>>>>>19 string x \b%-.1s 6294>>>22 ubyte 0 6295>>>>21 ubyte x \b, from drive 0x%x 6296>>>22 ubyte >0 6297>>>>21 string x \b, from drive %s 6298>>>535 search/17 \x55\xAA 6299>>>>&-512 indirect x \b; contains 6300 6301# updated by Joerg Jenderek at Nov 2012 6302# DOS Emulator image is 128 byte, null right padded header + harddisc image 63030 string DOSEMU\0 6304>0x27E leshort 0xAA55 6305#offset is 128 6306>>19 ubyte 128 6307>>>(19.b-1) ubyte 0x0 DOS Emulator image 6308>>>>7 ulelong >0 \b, %u heads 6309>>>>11 ulelong >0 \b, %d sectors/track 6310>>>>15 ulelong >0 \b, %d cylinders 6311>>>>128 indirect x \b; contains 6312 6313# added by Joerg Jenderek at Nov 2012 6314# http://www.thenakedpc.com/articles/v04/08/0408-05.html 6315# Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data 63160 string PNCIHISK\0 Norton Utilities disc image data 6317# real x86 boot sector with jump instruction 6318>509 search/1026 \x55\xAA\xeb 6319>>&-1 indirect x \b; contains 6320# http://file-extension.net/seeker/file_extension_dat 63210 string PNCIUNDO Norton Disk Doctor UnDo file 6322# 6323 6324# DOS/MBR boot sector updated by Joerg Jenderek at Sep 2007,May 2011 6325# for any allowed sector sizes 632630 search/481 \x55\xAA 6327# to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111) 6328# DOS BPB information (70) and after DOS floppy (120) like in previous file version 6329!:strength +72 6330# for sector sizes < 512 Bytes 6331>11 uleshort <512 6332>>(11.s-2) uleshort 0xAA55 DOS/MBR boot sector 6333# for sector sizes with 512 or more Bytes 6334>0x1FE leshort 0xAA55 DOS/MBR boot sector 6335# keep old DOS/MBR boot sector as dummy for mbr and bootloader displaying 6336# only for sector sizes with 512 or more Bytes 63370x1FE leshort 0xAA55 DOS/MBR boot sector 6338!:strength +72 6339# to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version 6340#!:strength +21 6341>2 string OSBS \b, OS/BS MBR 6342# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/ 6343# and http://en.wikipedia.org/wiki/Master_Boot_Record 6344# test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by 6345# characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00 6346>0 search/2 \x33\xc0\x8e\xd0\xbc\x00\x7c MS-MBR 6347# Microsoft Windows 95A and early ( http://thestarman.pcministry.com/asm/mbr/STDMBR.htm ) 6348# assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld 6349>>8 ubequad 0x8bf45007501ffbfc 6350# http://thestarman.pcministry.com/asm/mbr/200MBR.htm 6351>>>0x16 ubyte 0xF3 \b,DOS 2 6352>>>>219 regex Author\ -\ Author: 6353# found "David Litton" , "A Pehrsson " 6354>>>>>&0 string x "%s" 6355>>>0x16 ubyte 0xF2 6356# NEC MS-DOS 3.30 Rev. 3 . See http://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm 6357# assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz 6358>>>>0x22 ubequad 0xbf7c07813d5aa575 \b,NEC 3.3 6359# version MS-DOS 3.30 til MS-Windows 95A (WinVer=4.00.1111) 6360>>>>0x22 default x \b,D0S version 3.3-7.0 6361# error messages are printed by assembler instructions: mov si,06nn;...;int 10 (0xBEnn06;...) 6362# where nn is string offset varying for different languages 6363# "Invalid partition table" nn=0x8b for english version 6364>>>>>(0x49.b) string Invalid\ partition\ table english 6365>>>>>(0x49.b) string Ung\201ltige\ Partitionstabelle german 6366>>>>>(0x49.b) string Table\ de\ partition\ invalide french 6367>>>>>(0x49.b) string Tabela\ de\ parti\207ao\ inv\240lida portuguese 6368>>>>>(0x49.b) string Tabla\ de\ partici\242n\ no\ v\240lida spanish 6369>>>>>(0x49.b) string Tavola\ delle\ partizioni\ non\ valida italian 6370>>>>>0x49 ubyte >0 at offset 0x%x 6371>>>>>>(0x49.b) string >\0 "%s" 6372# "Error loading operating system" nn=0xa3 for english version 6373# "Fehler beim Laden des Betriebssystems" nn=0xa7 for german version 6374# "Erreur en chargeant syst\212me d'exploitation" nn=0xa7 for french version 6375# "Erro na inicializa\207ao do sistema operacional" nn=0xa7 for portuguese Brazilian version 6376# "Error al cargar sistema operativo" nn=0xa8 for spanish version 6377# "Errore durante il caricamento del sistema operativo" nn=0xae for italian version 6378>>>>>0x74 ubyte >0 at offset 0x%x 6379>>>>>>(0x74.b) string >\0 "%s" 6380# "Missing operating system" nn=0xc2 for english version 6381# "Betriebssystem fehlt" nn=0xcd for german version 6382# "Syst\212me d'exploitation absent" nn=0xd2 for french version 6383# "Sistema operacional nao encontrado" nn=0xd4 for portuguese Brazilian version 6384# "Falta sistema operativo" nn=0xca for spanish version 6385# "Sistema operativo mancante" nn=0xe2 for italian version 6386>>>>>0x79 ubyte >0 at offset 0x%x 6387>>>>>>(0x79.b) string >\0 "%s" 6388# Microsoft Windows 95B to XP (http://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm) 6389# assembler instructions: push ax;pop es;push ax;pop ds;cld;mov si,7c1b 6390>>8 ubequad 0x5007501ffcbe1b7c 6391# assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04 6392>>>24 ubequad 0xf3a4cbbebe07b104 9M 6393# "Invalid partition table" nn=0x10F for english version 6394# "Ungültige Partitionstabelle" nn=0x10F for german version 6395# "Table de partition erronée" nn=0x10F for french version 6396# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x10F for russian version 6397>>>>(0x3C.b+0x0FF) string Invalid\ partition\ table english 6398>>>>(0x3C.b+0x0FF) string Ung\201ltige\ Partitionstabelle german 6399>>>>(0x3C.b+0x0FF) string Table\ de\ partition\ erron\202e french 6400>>>>(0x3C.b+0x0FF) string \215\245\257\340\240\242\250\253\354\255\240\357\ \342\240\241\253\250\346\240 russian 6401>>>>0x3C ubyte x at offset 0x%x+0xFF 6402>>>>(0x3C.b+0x0FF) string >\0 "%s" 6403# "Error loading operating system" nn=0x127 for english version 6404# "Fehler beim Laden des Betriebssystems" nn=0x12b for german version 6405# "Erreur lors du chargement du système d'exploitation" nn=0x12a for french version 6406# "\216\350\250\241\252\240 \257\340\250 \247\240\243\340\343\247\252\245 \256\257\245\340\240\346\250\256\255\255\256\251 \341\250\341\342\245\254\353" nn=0x12d for russian version 6407>>>>0xBD ubyte x at offset 0x1%x 6408>>>>(0xBD.b+0x100) string >\0 "%s" 6409# "Missing operating system" nn=0x146 for english version 6410# "Betriebssystem fehlt" nn=0x151 for german version 6411# "Système d'exploitation manquant" nn=0x15e for french version 6412# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x156 for russian version 6413>>>>0xA9 ubyte x at offset 0x1%x 6414>>>>(0xA9.b+0x100) string >\0 "%s" 6415# http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm 6416# assembler instructions: rep;movsb;retf;mov BP,07be;mov cl,04 6417>>>24 ubequad 0xf3a4cbbdbe07b104 XP 6418# where xxyyzz are lower bits from offsets of error messages varying for different languages 6419>>>>0x1B4 ubelong&0x00FFFFFF 0x002c4463 english 6420>>>>0x1B4 ubelong&0x00FFFFFF 0x002c486e german 6421# "Invalid partition table" xx=0x12C for english version 6422# "Ungültige Partitionstabelle" xx=0x12C for german version 6423>>>>0x1b5 ubyte >0 at offset 0x1%x 6424>>>>(0x1b5.b+0x100) string >\0 "%s" 6425# "Error loading operating system" yy=0x144 for english version 6426# "Fehler beim Laden des Betriebssystems" yy=0x148 for german version 6427>>>>0x1b6 ubyte >0 at offset 0x1%x 6428>>>>(0x1b6.b+0x100) string >\0 "%s" 6429# "Missing operating system" zz=0x163 for english version 6430# "Betriebssystem nicht vorhanden" zz=0x16e for german version 6431>>>>0x1b7 ubyte >0 at offset 0x1%x 6432>>>>(0x1b7.b+0x100) string >\0 "%s" 6433# Microsoft Windows Vista or 7 6434# assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00 6435>>8 ubequad 0xc08ed8be007cbf00 6436# Microsoft Windows Vista (http://thestarman.pcministry.com/asm/mbr/VistaMBR.htm) 6437# assembler instructions: jnz 0729;cmp ebx,"TCPA" 6438>>>0xEC ubequad 0x753b6681fb544350 Vista 6439# where xxyyzz are lower bits from offsets of error messages varying for different languages 6440>>>>0x1B4 ubelong&0x00FFFFFF 0x00627a99 english 6441#>>>>0x1B4 ubelong&0x00FFFFFF ? german 6442# "Invalid partition table" xx=0x162 for english version 6443# "Ungültige Partitionstabelle" xx=0x1?? for german version 6444>>>>0x1b5 ubyte >0 at offset 0x1%x 6445>>>>(0x1b5.b+0x100) string >\0 "%s" 6446# "Error loading operating system" yy=0x17a for english version 6447# "Fehler beim Laden des Betriebssystems" yy= 0x1?? for german version 6448>>>>0x1b6 ubyte >0 at offset 0x1%x 6449>>>>(0x1b6.b+0x100) string >\0 "%s" 6450# "Missing operating system" zz=0x199 for english version 6451# "Betriebssystem nicht vorhanden" zz=0x1?? for german version 6452>>>>0x1b7 ubyte >0 at offset 0x1%x 6453>>>>(0x1b7.b+0x100) string >\0 "%s" 6454# Microsoft Windows 7 (http://thestarman.pcministry.com/asm/mbr/W7MBR.htm) 6455# assembler instructions: cmp ebx,"TCPA";cmp 6456>>>0xEC ubequad 0x6681fb5443504175 Windows 7 6457# where xxyyzz are lower bits from offsets of error messages varying for different languages 6458>>>>0x1B4 ubelong&0x00FFFFFF 0x00637b9a english 6459#>>>>0x1B4 ubelong&0x00FFFFFF ? german 6460# "Invalid partition table" xx=0x163 for english version 6461# "Ungültige Partitionstabelle" xx=0x1?? for german version 6462>>>>0x1b5 ubyte >0 at offset 0x1%x 6463>>>>(0x1b5.b+0x100) string >\0 "%s" 6464# "Error loading operating system" yy=0x17b for english version 6465# "Fehler beim Laden des Betriebssystems" yy=0x1?? for german version 6466>>>>0x1b6 ubyte >0 at offset 0x1%x 6467>>>>(0x1b6.b+0x100) string >\0 "%s" 6468# "Missing operating system" zz=0x19a for english version 6469# "Betriebssystem nicht vorhanden" zz=0x1?? for german version 6470>>>>0x1b7 ubyte >0 at offset 0x1%x 6471>>>>(0x1b7.b+0x100) string >\0 "%s" 6472# http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs 6473# http://en.wikipedia.org/wiki/MBR_disk_signature#ID 6474>>0x1b8 ulelong >0 \b, disk signature 0x%-.4x 6475# driveID/timestamp for Win 95B,98,98SE and ME. See http://thestarman.pcministry.com/asm/mbr/mystery.htm 6476>>0xDA uleshort 0 6477>>>0xDC ulelong >0 \b, created 6478# physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive 6479>>>>0xDC ubyte x with driveID 0x%x 6480# hours, minutes and seconds 6481>>>>0xDf ubyte x at %x 6482>>>>0xDe ubyte x \b:%x 6483>>>>0xDd ubyte x \b:%x 6484# special case for Microsoft MS-DOS 3.21 spanish 6485# assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov 6486>0 ubequad 0xfab830008ed0bc00 6487# assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov 6488>>8 ubequad 0x1fbfcb800008ed8 MS-MBR,D0S version 3.21 spanish 6489# Microsoft MBR IPL end 6490 6491# dr-dos with some upper-, lowercase variants 6492>0x9D string Invalid\ partition\ table$ 6493>>181 string No\ Operating\ System$ 6494>>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 6495>0x9D string Invalid\ partition\ table$ 6496>>181 string No\ operating\ system$ 6497>>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 6498>342 string Invalid\ partition\ table$ 6499>>366 string No\ operating\ system$ 6500>>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03 6501>295 string NEWLDR\0 6502>>302 string Bad\ PT\ $ 6503>>>310 string No\ OS\ $ 6504>>>>317 string OS\ load\ err$ 6505>>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r 6506>>>>>>358 string Press\ any\ key\ to\ continue.\n\r$ 6507>>>>>>>387 string Copyright\ (c)\ 1984,1998 6508>>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR) 6509# 6510# tests for different MS-DOS Master Boot Records (MBR) moved and merged 6511# 6512#>0x145 string Default:\ F \b, FREE-DOS MBR 6513#>0x14B string Default:\ F \b, FREE-DOS 1.0 MBR 6514>0x145 search/7 Default:\ F \b, FREE-DOS MBR 6515#>>313 string F0\ .\ .\ . 6516#>>>322 string disk\ 1 6517#>>>>382 string FAT3 6518>64 string no\ active\ partition\ found 6519>>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR 6520# Ranish Partition Manager http://www.ranish.com/part/ 6521>387 search/4 \0\ Error!\r 6522>>378 search/7 Virus! 6523>>>397 search/4 Booting\ 6524>>>>408 search/4 HD1/\0 \b, Ranish MBR ( 6525>>>>>416 string Writing\ changes... \b2.37 6526>>>>>>438 ubyte x \b,0x%x dots 6527>>>>>>440 ubyte >0 \b,virus check 6528>>>>>>441 ubyte >0 \b,partition %c 6529#2.38,2.42,2.44 6530>>>>>416 string !Writing\ changes... \b 6531>>>>>>418 ubyte 1 \bvirus check, 6532>>>>>>419 ubyte x \b0x%x seconds 6533>>>>>>420 ubyte&0x0F >0 \b,partition 6534>>>>>>>420 ubyte&0x0F <5 \b %x 6535>>>>>>>420 ubyte&0x0F 0Xf \b ask 6536>>>>>420 ubyte x \b) 6537# 6538# SYSLINUX MBR moved 6539# http://www.acronis.de/ 6540>362 string MBR\ Error\ \0\r 6541>>376 string ress\ any\ key\ to\ 6542>>>392 string boot\ from\ floppy...\0 \b, Acronis MBR 6543# added by Joerg Jenderek 6544# http://www.visopsys.org/ 6545# http://partitionlogic.org.uk/ 6546>309 string No\ bootable\ partition\ found\r 6547>>339 string I/O\ Error\ reading\ boot\ sector\r \b, Visopsys MBR 6548>349 string No\ bootable\ partition\ found\r 6549>>379 string I/O\ Error\ reading\ boot\ sector\r \b, simple Visopsys MBR 6550# bootloader, bootmanager 6551>0x40 string SBML 6552# label with 11 characters of FAT 12 bit filesystem 6553>>43 string SMART\ BTMGR 6554>>>430 string SBMK\ Bad!\r \b, Smart Boot Manager 6555# OEM-ID not always "SBM" 6556#>>>>3 strings SBM 6557>>>>6 string >\0 \b, version %s 6558>382 string XOSLLOADXCF \b, eXtended Operating System Loader 6559>6 string LILO \b, LInux i386 boot LOader 6560>>120 string LILO \b, version 22.3.4 SuSe 6561>>172 string LILO \b, version 22.5.8 Debian 6562# updated by Joerg Jenderek at Oct 2008 6563# variables according to grub-0.97/stage1/stage1.S or 6564# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data 6565# usual values are marked with comments to get only informations of strange GRUB loaders 6566>342 search/60 \0Geom\0 6567#>0 ulelong x %x=0x009048EB , 0x2a9048EB 0 6568>>0x41 ubyte <2 6569>>>0x3E ubyte >2 \b; GRand Unified Bootloader 6570# 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90 6571>>>>0x3E ubyte x \b, stage1 version 0x%x 6572#If it is 0xFF, use a drive passed by BIOS 6573>>>>0x40 ubyte <0xFF \b, boot drive 0x%x 6574# in most case 0,1,0x2e for GRUB 0.5.95 6575>>>>0x41 ubyte >0 \b, LBA flag 0x%x 6576>>>>0x42 uleshort <0x8000 \b, stage2 address 0x%x 6577#>>>>0x42 uleshort =0x8000 \b, stage2 address 0x%x (usual) 6578>>>>0x42 uleshort >0x8000 \b, stage2 address 0x%x 6579#>>>>0x44 ulelong =1 \b, 1st sector stage2 0x%x (default) 6580>>>>0x44 ulelong >1 \b, 1st sector stage2 0x%x 6581>>>>0x48 uleshort <0x800 \b, stage2 segment 0x%x 6582#>>>>0x48 uleshort =0x800 \b, stage2 segment 0x%x (usual) 6583>>>>0x48 uleshort >0x800 \b, stage2 segment 0x%x 6584>>>>402 string Geom\0Hard\ Disk\0Read\0\ Error\0 6585>>>>>394 string stage1 \b, GRUB version 0.5.95 6586>>>>382 string Geom\0Hard\ Disk\0Read\0\ Error\0 6587>>>>>376 string GRUB\ \0 \b, GRUB version 0.93 or 1.94 6588>>>>383 string Geom\0Hard\ Disk\0Read\0\ Error\0 6589>>>>>377 string GRUB\ \0 \b, GRUB version 0.94 6590>>>>385 string Geom\0Hard\ Disk\0Read\0\ Error\0 6591>>>>>379 string GRUB\ \0 \b, GRUB version 0.95 or 0.96 6592>>>>391 string Geom\0Hard\ Disk\0Read\0\ Error\0 6593>>>>>385 string GRUB\ \0 \b, GRUB version 0.97 6594#unkown version 6595>>>343 string Geom\0Read\0\ Error\0 6596>>>>321 string Loading\ stage1.5 \b, GRUB version x.y 6597>>>380 string Geom\0Hard\ Disk\0Read\0\ Error\0 6598>>>>374 string GRUB\ \0 \b, GRUB version n.m 6599# SYSLINUX bootloader moved 6600>395 string chksum\0\ ERROR!\0 \b, Gujin bootloader 6601# http://www.bcdwb.de/bcdw/index_e.htm 6602>3 string BCDL 6603>>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z) 6604# mbr partition table entries updated by Joerg Jenderek at Sep 2013 6605# skip Norton Utilities disc image data 6606>3 string !IHISK 6607# skip Linux style boot sector starting with assember instructions mov 0x7c0,ax; 6608>>0 belong !0xb8c0078e 6609# not Linux kernel 6610>>>514 string !HdrS 6611# not BeOS 6612>>>>422 string !Be\ Boot\ Loader 6613# jump over BPB instruction implies DOS bootsector or AdvanceMAME mbr 6614>>>>>0 ubelong&0xFD000000 =0xE9000000 6615# AdvanceMAME mbr 6616>>>>>>(1.b+2) ubequad 0xfa31c08ed88ec08e 6617>>>>>>>446 use partition-table 6618# mbr, Norton Utilities disc image data, or 2nd,etc. sector of x86 bootloader 6619>>>>>0 ubelong&0xFD000000 !0xE9000000 6620# skip FSInfosector 6621>>>>>>0 string !RRaA 6622# skip 3rd sector of MS x86 bootloader with assember instructions cli;MOVZX EAX,BYTE PTR [BP+10];MOV ECX, 6623# http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm 6624>>>>>>>0 ubequad !0xfa660fb64610668b 6625# skip 13rd sector of MS x86 bootloader 6626>>>>>>>>0 ubequad !0x660fb64610668b4e 6627# skip sector starting with DOS new line 6628>>>>>>>>>0 string !\r\n 6629# allowed active flag 0,80h-FFh 6630>>>>>>>>>>446 ubyte 0 6631>>>>>>>>>>>446 use partition-table 6632>>>>>>>>>>446 ubyte >0x7F 6633>>>>>>>>>>>446 use partition-table 6634# TODO: test for extended bootrecord (ebr) moved and merged with mbr partition table entries 6635# mbr partition table entries end 6636# http://www.acronis.de/ 6637#FAT label=ACRONIS\ SZ 6638#OEM-ID=BOOTWIZ0 6639>442 string Non-system\ disk,\ 6640>>459 string press\ any\ key...\x7\0 \b, Acronis Startup Recovery Loader 6641# updated by Joerg Jenderek at Nov 2012 6642# DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes 6643>>>477 ubyte&0xDF >0 6644>>>>477 string x \b %-.3s 6645>>>>>480 ubyte&0xDF >0 6646>>>>>>480 string x \b%-.4s 6647>>>>>>>484 ubyte&0xDF >0 6648>>>>>>>>484 string x \b%-.1s 6649>>>>485 ubyte&0xDF >0 6650>>>>>485 string x \b.%-.3s 6651# 6652>185 string FDBOOT\ Version\ 6653>>204 string \rNo\ Systemdisk.\ 6654>>>220 string Booting\ from\ harddisk.\n\r 6655>>>245 string Cannot\ load\ from\ harddisk.\n\r 6656>>>>273 string Insert\ Systemdisk\ 6657>>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader 6658>>>>>>200 string >\0 \b, version %-3s 6659>242 string Bootsector\ from\ C.H.\ Hochst\204 6660# http://freecode.com/projects/dosfstools dosfstools-n.m/src/mkdosfs.c 6661# updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string 6662# skip name "C.H. Hochstaetter" partly because it is sometimes written without umlaut 6663>242 search/127 Bootsector\ from\ C.H.\ Hochst 6664>>278 search/127 No\ Systemdisk.\ Booting\ from\ harddisk 6665# followed by variants with point,CR-NL or NL-CR 6666>>>208 search/261 Cannot\ load\ from\ harddisk. 6667# followed by variants CR-NL or NL-CR 6668>>>>236 search/235 Insert\ Systemdisk\ and\ press\ any\ key. 6669# followed by variants with point,CR-NL or NL-CR 6670>>>>>180 search/96 Disk\ formatted\ with\ WinImage\ \b, WinImage harddisk Bootloader 6671# followed by string like "6.50 (c) 1993-2004 Gilles Vollant" 6672>>>>>>&0 string x \b, version %-4.4s 6673>(1.b+2) ubyte 0xe 6674>>(1.b+3) ubyte 0x1f 6675>>>(1.b+4) ubyte 0xbe 6676# message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others 6677>>>>(1.b+5) ubyte&0xd3 0x53 6678>>>>>(1.b+6) ubyte 0x7c 6679# assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah, 6680>>>>>>(1.b+7) ubyte 0xac 6681>>>>>>>(1.b+8) ubyte 0x22 6682>>>>>>>>(1.b+9) ubyte 0xc0 6683>>>>>>>>>(1.b+10) ubyte 0x74 6684>>>>>>>>>>(1.b+11) ubyte 0x0b 6685>>>>>>>>>>>(1.b+12) ubyte 0x56 6686>>>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display 6687# FAT1X version 6688>>>>>>>>>>>>>(1.b+5) ubyte 0x5b 6689>>>>>>>>>>>>>>0x5b string >\0 "%-s" 6690# FAT32 version 6691>>>>>>>>>>>>>(1.b+5) ubyte 0x77 6692>>>>>>>>>>>>>>0x77 string >\0 "%-s" 6693>214 string Please\ try\ to\ install\ FreeDOS\ \b, DOS Emulator boot message display 6694#>>244 string from\ dosemu-freedos-*-bin.tgz\r 6695#>>>170 string Sorry,\ could\ not\ load\ an\ 6696#>>>>195 string operating\ system.\r\n 6697# 6698>103 string This\ is\ not\ a\ bootable\ disk.\ 6699>>132 string Please\ insert\ a\ bootable\ 6700>>>157 string floppy\ and\r\n 6701>>>>169 string press\ any\ key\ to\ try\ again...\r \b, FREE-DOS message display 6702# 6703>66 string Solaris\ Boot\ Sector 6704>>99 string Incomplete\ MDBoot\ load. 6705>>>89 string Version \b, Sun Solaris Bootloader 6706>>>>97 byte x version %c 6707# 6708>408 string OS/2\ !!\ SYS01475\r\0 6709>>429 string OS/2\ !!\ SYS02025\r\0 6710>>>450 string OS/2\ !!\ SYS02027\r\0 6711>>>469 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp bootloader 6712# 6713>409 string OS/2\ !!\ SYS01475\r\0 6714>>430 string OS/2\ !!\ SYS02025\r\0 6715>>>451 string OS/2\ !!\ SYS02027\r\0 6716>>>470 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp Bootloader 6717>112 string This\ disk\ is\ not\ bootable\r 6718>>142 string If\ you\ wish\ to\ make\ it\ bootable 6719>>>176 string run\ the\ DOS\ program\ SYS\ 6720>>>200 string after\ the\r 6721>>>>216 string system\ has\ been\ loaded\r\n 6722>>>>>242 string Please\ insert\ a\ DOS\ diskette\ 6723>>>>>271 string into\r\n\ the\ drive\ and\ 6724>>>>>>292 string strike\ any\ key...\0 \b, IBM OS/2 Warp message display 6725# XP 6726>430 string NTLDR\ is\ missing\xFF\r\n 6727>>449 string Disk\ error\xFF\r\n 6728>>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader 6729# DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes 6730>>>>417 ubyte&0xDF >0 6731>>>>>417 string x %-.5s 6732>>>>>>422 ubyte&0xDF >0 6733>>>>>>>422 string x \b%-.3s 6734>>>>>425 ubyte&0xDF >0 6735>>>>>>425 string >\ \b.%-.3s 6736# 6737>>>>371 ubyte >0x20 6738>>>>>368 ubyte&0xDF >0 6739>>>>>>368 string x %-.5s 6740>>>>>>>373 ubyte&0xDF >0 6741>>>>>>>>373 string x \b%-.3s 6742>>>>>>376 ubyte&0xDF >0 6743>>>>>>>376 string x \b.%-.3s 6744# 6745>430 string NTLDR\ nicht\ gefunden\xFF\r\n 6746>>453 string Datentr\204gerfehler\xFF\r\n 6747>>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german) 6748>>>>417 ubyte&0xDF >0 6749>>>>>417 string x %-.5s 6750>>>>>>422 ubyte&0xDF >0 6751>>>>>>>422 string x \b%-.3s 6752>>>>>425 ubyte&0xDF >0 6753>>>>>>425 string >\ \b.%-.3s 6754# offset variant 6755>>>>379 string \0 6756>>>>>368 ubyte&0xDF >0 6757>>>>>>368 string x %-.5s 6758>>>>>>>373 ubyte&0xDF >0 6759>>>>>>>>373 string x \b%-.3s 6760# 6761>430 string NTLDR\ fehlt\xFF\r\n 6762>>444 string Datentr\204gerfehler\xFF\r\n 6763>>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german) 6764>>>>417 ubyte&0xDF >0 6765>>>>>417 string x %-.5s 6766>>>>>>422 ubyte&0xDF >0 6767>>>>>>>422 string x \b%-.3s 6768>>>>>425 ubyte&0xDF >0 6769>>>>>>425 string >\ \b.%-.3s 6770# variant 6771>>>>371 ubyte >0x20 6772>>>>>368 ubyte&0xDF >0 6773>>>>>>368 string x %-.5s 6774>>>>>>>373 ubyte&0xDF >0 6775>>>>>>>>373 string x \b%-.3s 6776>>>>>>376 ubyte&0xDF >0 6777>>>>>>>376 string x \b.%-.3s 6778# 6779>430 string NTLDR\ fehlt\xFF\r\n 6780>>444 string Medienfehler\xFF\r\n 6781>>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german) 6782>>>>371 ubyte >0x20 6783>>>>>368 ubyte&0xDF >0 6784>>>>>>368 string x %-.5s 6785>>>>>>>373 ubyte&0xDF >0 6786>>>>>>>>373 string x \b%-.3s 6787>>>>>>376 ubyte&0xDF >0 6788>>>>>>>376 string x \b.%-.3s 6789# variant 6790>>>>417 ubyte&0xDF >0 6791>>>>>417 string x %-.5s 6792>>>>>>422 ubyte&0xDF >0 6793>>>>>>>422 string x \b%-.3s 6794>>>>>425 ubyte&0xDF >0 6795>>>>>>425 string >\ \b.%-.3s 6796# 6797>430 string Datentr\204ger\ entfernen\xFF\r\n 6798>>454 string Medienfehler\xFF\r\n 6799>>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german) 6800>>>>379 string \0 6801>>>>>368 ubyte&0xDF >0 6802>>>>>>368 string x %-.5s 6803>>>>>>>373 ubyte&0xDF >0 6804>>>>>>>>373 string x \b%-.3s 6805>>>>>>376 ubyte&0xDF >0 6806>>>>>>>376 string x \b.%-.3s 6807# variant 6808>>>>417 ubyte&0xDF >0 6809>>>>>417 string x %-.5s 6810>>>>>>422 ubyte&0xDF >0 6811>>>>>>>422 string x \b%-.3s 6812>>>>>425 ubyte&0xDF >0 6813>>>>>>425 string >\ \b.%-.3s 6814# 6815 6816#>3 string NTFS\ \ \ \ 6817>389 string Fehler\ beim\ Lesen\ 6818>>407 string des\ Datentr\204gers 6819>>>426 string NTLDR\ fehlt 6820>>>>440 string NTLDR\ ist\ komprimiert 6821>>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german) 6822#>3 string NTFS\ \ \ \ 6823>313 string A\ disk\ read\ error\ occurred.\r 6824>>345 string A\ kernel\ file\ is\ missing\ 6825>>>370 string from\ the\ disk.\r 6826>>>>484 string NTLDR\ is\ compressed 6827>>>>>429 string Insert\ a\ system\ diskette\ 6828>>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS 6829# DOS loader variants different languages,offsets 6830>472 ubyte&0xDF >0 6831>>389 string Invalid\ system\ disk\xFF\r\n 6832>>>411 string Disk\ I/O\ error 6833>>>>428 string Replace\ the\ disk,\ and\ 6834>>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader 6835#IO.SYS 6836>>>>>>472 ubyte&0xDF >0 6837>>>>>>>472 string x \b %-.2s 6838>>>>>>>>474 ubyte&0xDF >0 6839>>>>>>>>>474 string x \b%-.5s 6840>>>>>>>>>>479 ubyte&0xDF >0 6841>>>>>>>>>>>479 string x \b%-.1s 6842>>>>>>>480 ubyte&0xDF >0 6843>>>>>>>>480 string x \b.%-.3s 6844#MSDOS.SYS 6845>>>>>>>483 ubyte&0xDF >0 \b+ 6846>>>>>>>>483 string x \b%-.5s 6847>>>>>>>>>488 ubyte&0xDF >0 6848>>>>>>>>>>488 string x \b%-.3s 6849>>>>>>>>491 ubyte&0xDF >0 6850>>>>>>>>>491 string x \b.%-.3s 6851# 6852>>390 string Invalid\ system\ disk\xFF\r\n 6853>>>412 string Disk\ I/O\ error\xFF\r\n 6854>>>>429 string Replace\ the\ disk,\ and\ 6855>>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader 6856>>388 string Ungueltiges\ System\ \xFF\r\n 6857>>>410 string E/A-Fehler\ \ \ \ \xFF\r\n 6858>>>>427 string Datentraeger\ wechseln\ und\ 6859>>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german) 6860#WINBOOT.SYS only not spaces (0xDF) 6861>>>>>>497 ubyte&0xDF >0 6862>>>>>>>497 string x %-.5s 6863>>>>>>>>502 ubyte&0xDF >0 6864>>>>>>>>>502 string x \b%-.1s 6865>>>>>>>>>>503 ubyte&0xDF >0 6866>>>>>>>>>>>503 string x \b%-.1s 6867>>>>>>>>>>>>504 ubyte&0xDF >0 6868>>>>>>>>>>>>>504 string x \b%-.1s 6869>>>>>>505 ubyte&0xDF >0 6870>>>>>>>505 string x \b.%-.3s 6871#IO.SYS 6872>>>>>>472 ubyte&0xDF >0 or 6873>>>>>>>472 string x \b %-.2s 6874>>>>>>>>474 ubyte&0xDF >0 6875>>>>>>>>>474 string x \b%-.5s 6876>>>>>>>>>>479 ubyte&0xDF >0 6877>>>>>>>>>>>479 string x \b%-.1s 6878>>>>>>>480 ubyte&0xDF >0 6879>>>>>>>>480 string x \b.%-.3s 6880#MSDOS.SYS 6881>>>>>>>483 ubyte&0xDF >0 \b+ 6882>>>>>>>>483 string x \b%-.5s 6883>>>>>>>>>488 ubyte&0xDF >0 6884>>>>>>>>>>488 string x \b%-.3s 6885>>>>>>>>491 ubyte&0xDF >0 6886>>>>>>>>>491 string x \b.%-.3s 6887# 6888>>390 string Ungueltiges\ System\ \xFF\r\n 6889>>>412 string E/A-Fehler\ \ \ \ \xFF\r\n 6890>>>>429 string Datentraeger\ wechseln\ und\ 6891>>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German) 6892#WINBOOT.SYS only not spaces (0xDF) 6893>>>>>>497 ubyte&0xDF >0 6894>>>>>>>497 string x %-.7s 6895>>>>>>>>504 ubyte&0xDF >0 6896>>>>>>>>>504 string x \b%-.1s 6897>>>>>>505 ubyte&0xDF >0 6898>>>>>>>505 string x \b.%-.3s 6899#IO.SYS 6900>>>>>>472 ubyte&0xDF >0 or 6901>>>>>>>472 string x \b %-.2s 6902>>>>>>>>474 ubyte&0xDF >0 6903>>>>>>>>>474 string x \b%-.6s 6904>>>>>>>480 ubyte&0xDF >0 6905>>>>>>>>480 string x \b.%-.3s 6906#MSDOS.SYS 6907>>>>>>>483 ubyte&0xDF >0 \b+ 6908>>>>>>>>483 string x \b%-.5s 6909>>>>>>>>>488 ubyte&0xDF >0 6910>>>>>>>>>>488 string x \b%-.3s 6911>>>>>>>>491 ubyte&0xDF >0 6912>>>>>>>>>491 string x \b.%-.3s 6913# 6914>>389 string Ungueltiges\ System\ \xFF\r\n 6915>>>411 string E/A-Fehler\ \ \ \ \xFF\r\n 6916>>>>428 string Datentraeger\ wechseln\ und\ 6917>>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN) 6918# DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes 6919>>>>>>472 string x %-.2s 6920>>>>>>>474 ubyte&0xDF >0 6921>>>>>>>>474 string x \b%-.5s 6922>>>>>>>>479 ubyte&0xDF >0 6923>>>>>>>>>479 string x \b%-.1s 6924>>>>>>480 ubyte&0xDF >0 6925>>>>>>>480 string x \b.%-.3s 6926>>>>>>483 ubyte&0xDF >0 \b+ 6927>>>>>>>483 string x \b%-.5s 6928>>>>>>>488 ubyte&0xDF >0 6929>>>>>>>>488 string x \b%-.2s 6930>>>>>>>>490 ubyte&0xDF >0 6931>>>>>>>>>490 string x \b%-.1s 6932>>>>>>>491 ubyte&0xDF >0 6933>>>>>>>>491 string x \b.%-.3s 6934>479 ubyte&0xDF >0 6935>>416 string Kein\ System\ oder\ 6936>>>433 string Laufwerksfehler 6937>>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german) 6938#IO.SYS 6939>>>>>479 string x \b %-.2s 6940>>>>>>481 ubyte&0xDF >0 6941>>>>>>>481 string x \b%-.6s 6942>>>>>487 ubyte&0xDF >0 6943>>>>>>487 string x \b.%-.3s 6944#MSDOS.SYS 6945>>>>>>490 ubyte&0xDF >0 \b+ 6946>>>>>>>490 string x \b%-.5s 6947>>>>>>>>495 ubyte&0xDF >0 6948>>>>>>>>>495 string x \b%-.3s 6949>>>>>>>498 ubyte&0xDF >0 6950>>>>>>>>498 string x \b.%-.3s 6951# 6952>376 search/41 Non-System\ disk\ or\ 6953>>395 search/41 disk\ error\r 6954>>>407 search/41 Replace\ and\ 6955>>>>419 search/41 press\ \b, 6956>>>>419 search/41 strike\ \b, old 6957>>>>426 search/41 any\ key\ when\ ready\r MS or PC-DOS bootloader 6958#449 Disk\ Boot\ failure\r MS 3.21 6959#466 Boot\ Failure\r MS 3.30 6960>>>>>468 search/18 \0 6961#IO.SYS,IBMBIO.COM 6962>>>>>>&0 string x \b %-.2s 6963>>>>>>>&-20 ubyte&0xDF >0 6964>>>>>>>>&-1 string x \b%-.4s 6965>>>>>>>>>&-16 ubyte&0xDF >0 6966>>>>>>>>>>&-1 string x \b%-.2s 6967>>>>>>&8 ubyte&0xDF >0 \b. 6968>>>>>>>&-1 string x \b%-.3s 6969#MSDOS.SYS,IBMDOS.COM 6970>>>>>>&11 ubyte&0xDF >0 \b+ 6971>>>>>>>&-1 string x \b%-.5s 6972>>>>>>>>&-6 ubyte&0xDF >0 6973>>>>>>>>>&-1 string x \b%-.1s 6974>>>>>>>>>>&-5 ubyte&0xDF >0 6975>>>>>>>>>>>&-1 string x \b%-.2s 6976>>>>>>>&7 ubyte&0xDF >0 \b. 6977>>>>>>>>&-1 string x \b%-.3s 6978>441 string Cannot\ load\ from\ harddisk.\n\r 6979>>469 string Insert\ Systemdisk\ 6980>>>487 string and\ press\ any\ key.\n\r \b, MS (2.11) DOS bootloader 6981#>43 string \224R-LOADER\ \ SYS =label 6982>54 string SYS 6983>>324 string VASKK 6984>>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS) 6985# 6986>98 string Press\ a\ key\ to\ retry\0\r 6987>>120 string Cannot\ find\ file\ \0\r 6988>>>139 string Disk\ read\ error\0\r 6989>>>>156 string Loading\ ...\0 \b, DR-DOS (3.41) Bootloader 6990#DRBIOS.SYS 6991>>>>>44 ubyte&0xDF >0 6992>>>>>>44 string x \b %-.6s 6993>>>>>>>50 ubyte&0xDF >0 6994>>>>>>>>50 string x \b%-.2s 6995>>>>>>52 ubyte&0xDF >0 6996>>>>>>>52 string x \b.%-.3s 6997# 6998>70 string IBMBIO\ \ COM 6999>>472 string Cannot\ load\ DOS!\ 7000>>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader 7001>>471 string Cannot\ load\ DOS\ 7002>>487 string press\ key\ to\ retry \b, Open-DOS Bootloader 7003#?? 7004>444 string KERNEL\ \ SYS 7005>>314 string BOOT\ error! \b, FREE-DOS Bootloader 7006>499 string KERNEL\ \ SYS 7007>>305 string BOOT\ err!\0 \b, Free-DOS Bootloader 7008>449 string KERNEL\ \ SYS 7009>>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader 7010# 7011>449 string Loading\ FreeDOS 7012>>0x1AF ulelong >0 \b, FREE-DOS 0.95,1.0 Bootloader 7013>>>497 ubyte&0xDF >0 7014>>>>497 string x \b %-.6s 7015>>>>>503 ubyte&0xDF >0 7016>>>>>>503 string x \b%-.1s 7017>>>>>>>504 ubyte&0xDF >0 7018>>>>>>>>504 string x \b%-.1s 7019>>>>505 ubyte&0xDF >0 7020>>>>>505 string x \b.%-.3s 7021# 7022>331 string Error!.0 \b, FREE-DOS 1.0 bootloader 7023# 7024>125 string Loading\ FreeDOS...\r 7025>>311 string BOOT\ error!\r \b, FREE-DOS bootloader 7026>>>441 ubyte&0xDF >0 7027>>>>441 string x \b %-.6s 7028>>>>>447 ubyte&0xDF >0 7029>>>>>>447 string x \b%-.1s 7030>>>>>>>448 ubyte&0xDF >0 7031>>>>>>>>448 string x \b%-.1s 7032>>>>449 ubyte&0xDF >0 7033>>>>>449 string x \b.%-.3s 7034>124 string FreeDOS\0 7035>>331 string \ err\0 \b, FREE-DOS BETa 0.9 Bootloader 7036# DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes 7037>>>497 ubyte&0xDF >0 7038>>>>497 string x \b %-.6s 7039>>>>>503 ubyte&0xDF >0 7040>>>>>>503 string x \b%-.1s 7041>>>>>>>504 ubyte&0xDF >0 7042>>>>>>>>504 string x \b%-.1s 7043>>>>505 ubyte&0xDF >0 7044>>>>>505 string x \b.%-.3s 7045>>333 string \ err\0 \b, FREE-DOS BEta 0.9 Bootloader 7046>>>497 ubyte&0xDF >0 7047>>>>497 string x \b %-.6s 7048>>>>>503 ubyte&0xDF >0 7049>>>>>>503 string x \b%-.1s 7050>>>>>>>504 ubyte&0xDF >0 7051>>>>>>>>504 string x \b%-.1s 7052>>>>505 ubyte&0xDF >0 7053>>>>>505 string x \b.%-.3s 7054>>334 string \ err\0 \b, FREE-DOS Beta 0.9 Bootloader 7055>>>497 ubyte&0xDF >0 7056>>>>497 string x \b %-.6s 7057>>>>>503 ubyte&0xDF >0 7058>>>>>>503 string x \b%-.1s 7059>>>>>>>504 ubyte&0xDF >0 7060>>>>>>>>504 string x \b%-.1s 7061>>>>505 ubyte&0xDF >0 7062>>>>>505 string x \b.%-.3s 7063>336 string Error!\ 7064>>343 string Hit\ a\ key\ to\ reboot. \b, FREE-DOS Beta 0.9sr1 Bootloader 7065>>>497 ubyte&0xDF >0 7066>>>>497 string x \b %-.6s 7067>>>>>503 ubyte&0xDF >0 7068>>>>>>503 string x \b%-.1s 7069>>>>>>>504 ubyte&0xDF >0 7070>>>>>>>>504 string x \b%-.1s 7071>>>>505 ubyte&0xDF >0 7072>>>>>505 string x \b.%-.3s 7073# added by Joerg Jenderek 7074# http://www.visopsys.org/ 7075# http://partitionlogic.org.uk/ 7076# OEM-ID=Visopsys 7077>478 ulelong 0 7078>>(1.b+326) string I/O\ Error\ reading\ 7079>>>(1.b+344) string Visopsys\ loader\r 7080>>>>(1.b+361) string Press\ any\ key\ to\ continue.\r \b, Visopsys loader 7081# http://alexfru.chat.ru/epm.html#bootprog 7082>494 ubyte >0x4D 7083>>495 string >E 7084>>>495 string <S 7085#OEM-ID is not reliable 7086>>>>3 string BootProg 7087# It just looks for a program file name at the root directory 7088# and loads corresponding file with following execution. 7089# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes 7090>>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader 7091>>>>>499 string x \b %-.1s 7092>>>>>>500 ubyte&0xDF >0 7093>>>>>>>500 string x \b%-.1s 7094>>>>>>>>501 ubyte&0xDF >0 7095>>>>>>>>>501 string x \b%-.1s 7096>>>>>>>>>>502 ubyte&0xDF >0 7097>>>>>>>>>>>502 string x \b%-.1s 7098>>>>>>>>>>>>503 ubyte&0xDF >0 7099>>>>>>>>>>>>>503 string x \b%-.1s 7100>>>>>>>>>>>>>>504 ubyte&0xDF >0 7101>>>>>>>>>>>>>>>504 string x \b%-.1s 7102>>>>>>>>>>>>>>>>505 ubyte&0xDF >0 7103>>>>>>>>>>>>>>>>>505 string x \b%-.1s 7104>>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0 7105>>>>>>>>>>>>>>>>>>>506 string x \b%-.1s 7106#name extension 7107>>>>>507 ubyte&0xDF >0 \b. 7108>>>>>>507 string x \b%-.1s 7109>>>>>>>508 ubyte&0xDF >0 7110>>>>>>>>508 string x \b%-.1s 7111>>>>>>>>>509 ubyte&0xDF >0 7112>>>>>>>>>>509 string x \b%-.1s 7113#If the boot sector fails to read any other sector, 7114#it prints a very short message ("RE") to the screen and hangs the computer. 7115#If the boot sector fails to find needed program in the root directory, 7116#it also hangs with another message ("NF"). 7117>>>>>492 string RENF \b, FAT (12 bit) 7118>>>>>495 string RENF \b, FAT (16 bit) 7119# http://alexfru.chat.ru/epm.html#bootprog 7120>494 ubyte >0x4D 7121>>495 string >E 7122>>>495 string <S 7123#OEM-ID is not reliable 7124>>>>3 string BootProg 7125# It just looks for a program file name at the root directory 7126# and loads corresponding file with following execution. 7127# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes 7128>>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader 7129>>>>>499 string x \b %-.1s 7130>>>>>>500 ubyte&0xDF >0 7131>>>>>>>500 string x \b%-.1s 7132>>>>>>>>501 ubyte&0xDF >0 7133>>>>>>>>>501 string x \b%-.1s 7134>>>>>>>>>>502 ubyte&0xDF >0 7135>>>>>>>>>>>502 string x \b%-.1s 7136>>>>>>>>>>>>503 ubyte&0xDF >0 7137>>>>>>>>>>>>>503 string x \b%-.1s 7138>>>>>>>>>>>>>>504 ubyte&0xDF >0 7139>>>>>>>>>>>>>>>504 string x \b%-.1s 7140>>>>>>>>>>>>>>>>505 ubyte&0xDF >0 7141>>>>>>>>>>>>>>>>>505 string x \b%-.1s 7142>>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0 7143>>>>>>>>>>>>>>>>>>>506 string x \b%-.1s 7144#name extension 7145>>>>>507 ubyte&0xDF >0 \b. 7146>>>>>>507 string x \b%-.1s 7147>>>>>>>508 ubyte&0xDF >0 7148>>>>>>>>508 string x \b%-.1s 7149>>>>>>>>>509 ubyte&0xDF >0 7150>>>>>>>>>>509 string x \b%-.1s 7151#If the boot sector fails to read any other sector, 7152#it prints a very short message ("RE") to the screen and hangs the computer. 7153#If the boot sector fails to find needed program in the root directory, 7154#it also hangs with another message ("NF"). 7155>>>>>492 string RENF \b, FAT (12 bit) 7156>>>>>495 string RENF \b, FAT (16 bit) 7157# x86 bootloader end 7158 7159# by Joerg Jenderek at Apr 2013 7160# Print the DOS filenames from directory entry form with 8 right space padded bytes + 3 bytes for extension 7161# like IO.SYS. MSDOS.SYS , KERNEL.SYS , DRBIO.SYS 71620 name DOS-filename 7163# space=0x20 (00100000b) means empty 7164>0 ubyte&0xDF >0 7165>>0 ubyte x \b%c 7166>>>1 ubyte&0xDF >0 7167>>>>1 ubyte x \b%c 7168>>>>>2 ubyte&0xDF >0 7169>>>>>>2 ubyte x \b%c 7170>>>>>>>3 ubyte&0xDF >0 7171>>>>>>>>3 ubyte x \b%c 7172>>>>>>>>>4 ubyte&0xDF >0 7173>>>>>>>>>>4 ubyte x \b%c 7174>>>>>>>>>>>5 ubyte&0xDF >0 7175>>>>>>>>>>>>5 ubyte x \b%c 7176>>>>>>>>>>>>>6 ubyte&0xDF >0 7177>>>>>>>>>>>>>>6 ubyte x \b%c 7178>>>>>>>>>>>>>>>7 ubyte&0xDF >0 7179>>>>>>>>>>>>>>>>7 ubyte x \b%c 7180# DOS filename extension 7181>>8 ubyte&0xDF >0 \b. 7182>>>8 ubyte x \b%c 7183>>>>9 ubyte&0xDF >0 7184>>>>>9 ubyte x \b%c 7185>>>>>>10 ubyte&0xDF >0 7186>>>>>>>10 ubyte x \b%c 7187# Print 2 following DOS filenames from directory entry form 7188# like IO.SYS+MSDOS.SYS or ibmbio.com+ibmdos.com 71890 name 2xDOS-filename 7190# display 1 space 7191>0 ubyte x \b 7192>0 use DOS-filename 7193>11 ubyte x \b+ 7194>11 use DOS-filename 7195 7196# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO 7197# and http://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector 7198>0 string RRaA 7199>>0x1E4 string rrAa \b, FSInfosector 7200#>>0x1FC uleshort =0 SHOULD BE ZERO 7201>>>0x1E8 ulelong <0xffffffff \b, %u free clusters 7202>>>0x1EC ulelong <0xffffffff \b, last allocated cluster %u 7203 7204# updated by Joerg Jenderek at Sep 2007 7205>3 ubyte 0 7206#no active flag 7207>>446 ubyte 0 7208# partition 1 not empty 7209>>>450 ubyte >0 7210# partitions 3,4 empty 7211>>>>482 ubyte 0 7212>>>>>498 ubyte 0 7213# partition 2 ID=0,5,15 7214>>>>>>466 ubyte <0x10 7215>>>>>>>466 ubyte 0x05 \b, extended partition table 7216>>>>>>>466 ubyte 0x0F \b, extended partition table (LBA) 7217>>>>>>>466 ubyte 0x0 \b, extended partition table (last) 7218 7219# DOS x86 sector separated and moved from "DOS/MBR boot sector" by Joerg Jenderek at May 2011 7220 7221>0x200 lelong 0x82564557 \b, BSD disklabel 7222 7223# http://en.wikipedia.org/wiki/Master_boot_record#PTE 7224# display standard partition table 72250 name partition-table 7226#>0 ubyte x PARTITION-TABLE 7227# test and display 1st til 4th partition table entry 7228>0 use partition-entry-test 7229>16 use partition-entry-test 7230>32 use partition-entry-test 7231>48 use partition-entry-test 7232# test for entry of partition table 72330 name partition-entry-test 7234# partition type ID > 0 7235>4 ubyte >0 7236# active flag 0 7237>>0 ubyte 0 7238>>>0 use partition-entry 7239# active flag 0x80, 0x81, ... 7240>>0 ubyte >0x7F 7241>>>0 use partition-entry 7242# Print entry of partition table 72430 name partition-entry 7244# partition type ID > 0 7245>4 ubyte >0 \b; partition 7246>>64 leshort 0xAA55 1 7247>>48 leshort 0xAA55 2 7248>>32 leshort 0xAA55 3 7249>>16 leshort 0xAA55 4 7250>>4 ubyte x : ID=0x%x 7251>>0 ubyte&0x80 0x80 \b, active 7252>>0 ubyte >0x80 0x%x 7253>>1 ubyte x \b, start-CHS ( 7254>>1 use partition-chs 7255>>5 ubyte x \b), end-CHS ( 7256>>5 use partition-chs 7257>>8 ulelong x \b), startsector %u 7258>>12 ulelong x \b, %u sectors 7259# Print cylinder,head,sector (CHS) of partition entry 72600 name partition-chs 7261# cylinder 7262>1 ubyte x \b0x 7263>1 ubyte&0xC0 0x40 \b1 7264>1 ubyte&0xC0 0x80 \b2 7265>1 ubyte&0xC0 0xC0 \b3 7266>2 ubyte x \b%x 7267# head 7268>0 ubyte x \b,%u 7269# sector 7270>1 ubyte&0x3F x \b,%u 7271 7272# FATX 72730 string FATX FATX filesystem data 7274 7275# romfs filesystems - Juan Cespedes <cespedes@debian.org> 72760 string -rom1fs- romfs filesystem, version 1 7277>8 belong x %d bytes, 7278>16 string x named %s. 7279 7280# netboot image - Juan Cespedes <cespedes@debian.org> 72810 lelong 0x1b031336L Netboot image, 7282>4 lelong&0xFFFFFF00 0 7283>>4 lelong&0x100 0x000 mode 2 7284>>4 lelong&0x100 0x100 mode 3 7285>4 lelong&0xFFFFFF00 !0 unknown mode 7286 72870x18b string OS/2 OS/2 Boot Manager 7288 7289# updated by Joerg Jenderek at Oct 2008 and Sep 2012 7290# http://syslinux.zytor.com/iso.php 7291# tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05 7292# assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop 72930 ulequad&0x909000007cc0eafa 0x909000007c40eafa 7294>631 search/689 ISOLINUX\ isolinux Loader 7295>>&0 string x (version %-4.4s) 7296# http://syslinux.zytor.com/pxe.php 7297# assembler instructions: jmp 7C05 72980 ulelong 0x007c05ea pxelinux loader (version 2.13 or older) 7299# assembler instructions: pushfd;pushad 73000 ulelong 0x60669c66 pxelinux loader 7301# assembler instructions: jmp 05 73020 ulelong 0xc00005ea pxelinux loader (version 3.70 or newer) 7303# http://syslinux.zytor.com/wiki/index.php/SYSLINUX 73040 string LDLINUX\ SYS\ SYSLINUX loader 7305>12 string x (older version %-4.4s) 73060 string \r\nSYSLINUX\ SYSLINUX loader 7307>11 string x (version %-4.4s) 7308# syslinux updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012 7309# assembler instructions: jmp yy (yy=0x3c,0x58);nop;"SYSLINUX" 73100 ulelong&0x80909bEB 0x009018EB 7311# OEM-ID not always "SYSLINUX" 7312>434 search/47 Boot\ failed 7313# followed by \r\n\0 or :\ 7314>>482 search/132 \0LDLINUX\ SYS Syslinux bootloader (version 2.13 or older) 7315>>1 ubyte 0x58 Syslinux bootloader (version 3.0-3.9) 7316>459 search/30 Boot\ error\r\n\0 7317>>1 ubyte 0x58 Syslinux bootloader (version 3.10 or newer) 7318# SYSLINUX MBR updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012 7319# assembler instructions: mov di,0600h;mov cx,0100h 732016 search/4 \xbf\x00\x06\xb9\x00\x01 7321# to display SYSLINUX MBR (36) before old DOS/MBR boot sector one with partition table (strength=50+21) 7322!:strength +36 7323>94 search/249 Missing\ operating\ system 7324# followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other 7325# skip Ranish MBR 7326>>408 search/4 HD1/\0 7327>>408 default x 7328>>>250 search/118 \0Operating\ system\ load SYSLINUX MBR 7329# followed by "ing " or space 7330>>>>292 search/98 error 7331>>>>>&0 string \r (version 3.35 or older) 7332>>>>>&0 string .\r (version 3.52 or newer) 7333>>>>>&0 default x (version 3.36-3.51 ) 7334>368 search/106 \0Disk\ error\ on\ boot\r\n SYSLINUX GPT-MBR 7335>>156 search/10 \0Boot\ partition\ not\ found\r\n 7336>>>270 search/10 \0OS\ not\ bootable\r\n (version 3.86 or older) 7337>>174 search/10 \0Missing\ OS\r\n 7338>>>189 search/10 \0Multiple\ active\ partitions\r\n (version 4.00 or newer) 7339# SYSLINUX END 7340 7341# NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012 7342# assembler instructions: xor ax,ax;mov ax,ss;mov sp,0x7c00;mov ax, 73430 ubequad 0x31c08ed0bc007c8e 7344# mbr_bootsel magic before partition table not reliable with small ipl fragments 7345#>444 uleshort 0xb5e1 7346>0004 uleshort x 7347# ERRorTeXT 7348>>181 search/166 Error\ \0\r\n NetBSD mbr 7349# NT Drive Serial Number http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS 7350>>>0x1B8 ubelong >0 \b,Serial 0x%-.8x 7351# BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx 7352>>>0xbb search/71 \xcd\x13\x5a\x52\x52 \b,bootselector 7353# BOOT_EXTENDED definitions contains assembler instructions: 7354# xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13 7355>>>0x96 search/1 \x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13 \b,boot extended 7356# COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al 7357>>>0x130 search/55 \xee\x80\xc2\x05\xec\xa8\x40 \b,serial IO 7358# not TERSE_ERROR 7359>>>196 search/106 No\ active\ partition\0 7360>>>>&0 string Disk\ read\ error\0 7361>>>>>&0 string No\ operating\ system\0 \b,verbose 7362# not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13 7363>>>0x7d search/7 \x5a\x52\xb4\x08\xcd\x13 \b,CHS 7364# not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop dx;push dx;int 0x13 7365>>>0xa4 search/84 \xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13 \b,LBA-check 7366# assembler instructions: movw nametab,bx 7367>>>0x26 search/21 \xBB\x94\x07 7368# not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf 7369>>>>&-9 ubequad&0xBE00f0E800febb94 0xBE0000E80000bb94 7370>>>>>181 search/166 Error\ \0 7371# "a: disk" , "Fn: diskn" or "NetBSD MBR boot" 7372>>>>>>&3 string x \b,"%s" 7373# Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html 7374# added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4 7375# assembler instructions: jmp short 0x58;nop;ASCII 73760 ubequad&0xeb58908000000000 0xeb58900000000000 7377# assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss, 7378>(1.b+2) ubequad 0xfa31c08ed88ec08e 7379# Error messages at end of code 7380>>376 string No\ operating\ system\r\n\0 7381>>>398 string Disk\ error\r\n\0FDD\0HDD\0 7382>>>>419 string \ EBIOS\r\n\0 AdvanceMAME mbr 7383 7384# Neil Turton mbr loader variant of http://www.chiark.greenend.org.uk/~neilt/mbr/ 7385# added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11 7386# for 1st version assembler instructions: cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI, 7387# or cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS, 73880 ulequad&0xcE1b40D48EC031FC 0x8E0000D08EC031FC 7389# pointer to the data starting with Neil Turton signature string 7390>(0x1BC.s) string NDTmbr 7391>>&-14 string 1234F\0 Turton mbr ( 7392# parameters also viewed by install-mbr --list 7393>>>(0x1BC.s+7) ubyte x \b%u<= 7394>>>(0x1BC.s+9) ubyte x \bVersion<=%u 7395#>>>(0x1BC.s+8) ubyte x asm_flag_%x 7396>>>(0x1BC.s+8) ubyte&1 1 \b,Y2K-Fix 7397# variant used by testdisk of http://www.cgsecurity.org/wiki/Menu_MBRCode 7398>>>(0x1BC.s+8) ubyte&2 2 \b,TestDisk 7399#0x1~1,..,0x8~4,0x10~F,0x80~A enabled 7400#>>>(0x1BC.s+10) ubyte x \b,flags 0x%x 7401#0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot 7402#>>>(0x1BC.s+11) ubyte x \b,cfg_def 0x%x 7403# for older versions 7404>>>(0x1BC.s+9) ubyte <2 7405#>>>>(0x1BC.s+12) ubyte 18 \b,%u/18 seconds 7406>>>>(0x1BC.s+12) ubyte !18 \b,%u/18 seconds 7407# floppy A: or B: 7408>>>>(0x1BC.s+13) ubyte <2 \b,floppy 0x%x 7409>>>>(0x1BC.s+13) ubyte >1 7410# 1st hard disc 7411#>>>>>(0x1BC.s+13) ubyte 0x80 \b,drive 0x%x 7412# not 1st hard disc 7413>>>>>(0x1BC.s+13) ubyte !0x80 \b,drive 0x%x 7414# for version >= 2 maximal timeout can be 65534 7415>>>(0x1BC.s+9) ubyte >1 7416#>>>>(0x1BC.s+12) uleshort 18 \b,%u/18 seconds 7417>>>>(0x1BC.s+12) uleshort !18 \b,%u/18 seconds 7418# floppy A: or B: 7419>>>>(0x1BC.s+14) ubyte <2 \b,floppy 0x%x 7420>>>>(0x1BC.s+14) ubyte >1 7421# 1st hard disc 7422#>>>>>(0x1BC.s+14) ubyte 0x80 \b,drive 0x%x 7423# not 1st hard disc 7424>>>>>(0x1BC.s+14) ubyte !0x80 \b,drive 0x%x 7425>>>0 ubyte x \b) 7426 7427# added by Joerg Jenderek 7428# In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or 7429# grub-1.94/kern/i386/pc/startup.S 7430# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data 7431# usual values are marked with comments to get only informations of strange GRUB loaders 74320x200 uleshort 0x70EA 7433# found only version 3.{1,2} 7434>0x206 ubeshort >0x0300 7435# GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00" 7436>>0x212 ubyte >0x29 7437>>>0x213 ubyte >0x29 7438# not iso9660_stage1_5 7439#>>>0 ulelong&0x00BE5652 0x00BE5652 7440>>>>0x213 ubyte >0x29 GRand Unified Bootloader 7441# config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2" 7442>>>>0x217 ubyte 0xFF stage1_5 7443>>>>0x217 ubyte <0xFF stage2 7444>>>>0x206 ubyte x \b version %u 7445>>>>0x207 ubyte x \b.%u 7446# module_size for 1.94 7447>>>>0x208 ulelong <0xffffff \b, installed partition %u 7448#>>>>0x208 ulelong =0xffffff \b, %u (default) 7449>>>>0x208 ulelong >0xffffff \b, installed partition %u 7450# GRUB 0.5.95 unofficial 7451>>>>0x20C ulelong&0x2E300000 0x2E300000 7452# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 7453>>>>>0x20C ubyte x \b, identifier 0x%x 7454#>>>>>0x20D ubyte =0 \b, LBA flag 0x%x (default) 7455>>>>>0x20D ubyte >0 \b, LBA flag 0x%x 7456# GRUB version as string 7457>>>>>0x20E string >\0 \b, GRUB version %-s 7458# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default 7459>>>>>>0x215 ulong 0xffffffff 7460>>>>>>>0x219 string >\0 \b, configuration file %-s 7461>>>>>>0x215 ulong !0xffffffff 7462>>>>>>>0x215 string >\0 \b, configuration file %-s 7463# newer GRUB versions 7464>>>>0x20C ulelong&0x2E300000 !0x2E300000 7465##>>>>>0x20C ulelong =0 \b, saved entry %d (usual) 7466>>>>>0x20C ulelong >0 \b, saved entry %d 7467# for 1.94 contains kernel image size 7468# for 0.93,0.94,0.96,0.97 7469# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2 7470>>>>>0x210 ubyte x \b, identifier 0x%x 7471# The flag for LBA forcing is in most cases 0 7472#>>>>>0x211 ubyte =0 \b, LBA flag 0x%x (default) 7473>>>>>0x211 ubyte >0 \b, LBA flag 0x%x 7474# GRUB version as string 7475>>>>>0x212 string >\0 \b, GRUB version %-s 7476# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default 7477>>>>>0x217 ulong 0xffffffff 7478>>>>>>0x21b string >\0 \b, configuration file %-s 7479>>>>>0x217 ulong !0xffffffff 7480>>>>>>0x217 string >\0 \b, configuration file %-s 7481 7482# DOS x86 sector updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at May 2011 7483# JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90 7484# over BIOS parameter block (BPB) 7485# http://thestarman.pcministry.com/asm/2bytejumps.htm#FWD 7486# older drives may use Near JuMP instruction E9 xx xx 7487# minimal short forward jump found 0x29 for bootloaders or 0x0 7488# maximal short forward jump is 0x7f 7489# OEM-ID is empty or contain readable bytes 74900 ulelong&0x804000E9 0x000000E9 7491# mtools-3.9.8/msdos.h 7492# usual values are marked with comments to get only informations of strange FAT systems 7493# valid sectorsize must be a power of 2 from 32 to 32768 7494>11 uleshort&0xf001f 0 7495>>11 uleshort <32769 7496>>>11 uleshort >31 7497>>>>21 ubyte&0xf0 0xF0 7498>>>>>0 ubyte 0xEB 7499>>>>>>1 ubyte x \b, code offset 0x%x+2 7500>>>>>0 ubyte 0xE9 7501>>>>>>1 uleshort x \b, code offset 0x%x+2 7502>>>>>3 string >\0 \b, OEM-ID "%-.8s" 7503#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC 7504>>>>>>8 string IHC \b cached by Windows 9M 7505>>>>>11 uleshort >512 \b, Bytes/sector %u 7506#>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual) 7507>>>>>11 uleshort <512 \b, Bytes/sector %u 7508>>>>>13 ubyte >1 \b, sectors/cluster %u 7509#>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies) 7510>>>>>82 string FAT32 7511>>>>>>14 uleshort !32 \b, reserved sectors %u 7512#>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32) 7513>>>>>82 string !FAT32 7514>>>>>>14 uleshort >1 \b, reserved sectors %u 7515#>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16) 7516#>>>>>>14 uleshort 0 \b, reserved sectors %u (usual NTFS) 7517>>>>>16 ubyte >2 \b, FATs %u 7518#>>>>>16 ubyte =2 \b, FATs %u (usual) 7519>>>>>16 ubyte =1 \b, FAT %u 7520>>>>>16 ubyte >0 7521>>>>>17 uleshort >0 \b, root entries %u 7522#>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32) 7523>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB) 7524#>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32) 7525>>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x 7526#>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy) 7527>>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x 7528>>>>>22 uleshort >0 \b, sectors/FAT %u 7529#>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32) 7530>>>>>24 uleshort x \b, sectors/track %u 7531>>>>>26 ubyte >2 \b, heads %u 7532#>>>>>26 ubyte =2 \b, heads %u (usual floppy) 7533>>>>>26 ubyte =1 \b, heads %u 7534# valid only for sector sizes with more then 32 Bytes 7535>>>>>11 uleshort >32 7536# skip for Digital Research DOS (version 3.41) 1440 kB Bootdisk 7537>>>>>>38 ubyte !0x70 7538>>>>>>>28 ulelong >0 \b, hidden sectors %u 7539#>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy) 7540>>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB) 7541#>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB) 7542# FAT<32 bit specific 7543>>>>>>>82 string !FAT32 7544#>>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk) 7545#>>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy) 7546>>>>>>>>36 ubyte !0x80 7547>>>>>>>>>36 ubyte !0 \b, physical drive 0x%x 7548>>>>>>>>37 ubyte >0 \b, reserved 0x%x 7549#>>>>>>>>37 ubyte =0 \b, reserved 0x%x 7550# value is 0x80 for NTFS 7551>>>>>>>>38 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x) 7552>>>>>>>>38 ubyte =0x29 7553>>>>>>>>>39 ulelong x \b, serial number 0x%x 7554>>>>>>>>>43 string <NO\ NAME \b, label: "%11.11s" 7555>>>>>>>>>43 string >NO\ NAME \b, label: "%11.11s" 7556>>>>>>>>>43 string =NO\ NAME \b, unlabeled 7557# there exist some old floppies without word FAT at offset 54 7558# a word like "FATnm " is only a hint for a FAT size on nm-bits 7559# Normally the number of clusters is calculated by the values of BPP. 7560# if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit, 7561# otherwise FAT is 16 bit. 7562# http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html 7563>>>>>>54 string FAT \b, FAT 7564>>>>>>>54 string FAT12 \b (12 bit) 7565>>>>>>>54 string FAT16 \b (16 bit) 7566# FAT32 bit specific 7567>>>>>82 string FAT32 \b, FAT (32 bit) 7568>>>>>>36 ulelong x \b, sectors/FAT %u 7569# http://technet.microsoft.com/en-us/library/cc977221.aspx 7570>>>>>>40 uleshort >0 \b, extension flags 0x%x 7571#>>>>>>40 uleshort =0 \b, extension flags %u 7572>>>>>>42 uleshort >0 \b, fsVersion %u 7573#>>>>>>42 uleshort =0 \b, fsVersion %u (usual) 7574>>>>>>44 ulelong >2 \b, rootdir cluster %u 7575#>>>>>>44 ulelong =2 \b, rootdir cluster %u 7576#>>>>>>44 ulelong =1 \b, rootdir cluster %u 7577>>>>>>48 uleshort >1 \b, infoSector %u 7578#>>>>>>48 uleshort =1 \b, infoSector %u (usual) 7579>>>>>>48 uleshort <1 \b, infoSector %u 7580>>>>>>50 uleshort >6 \b, Backup boot sector %u 7581#>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual) 7582>>>>>>50 uleshort <6 \b, Backup boot sector %u 7583# corrected by Joerg Jenderek at Feb 2011 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO 7584>>>>>>52 ulelong >0 \b, reserved1 0x%x 7585>>>>>>56 ulelong >0 \b, reserved2 0x%x 7586>>>>>>60 ulelong >0 \b, reserved3 0x%x 7587# same structure as FAT1X 7588#>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk) 7589#>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy) 7590>>>>>>64 ubyte !0x80 7591>>>>>>>64 ubyte >0 \b, physical drive 0x%x 7592# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too 7593>>>>>>65 ubyte >0 \b, reserved 0x%x 7594>>>>>>66 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x) 7595>>>>>>66 ubyte =0x29 7596>>>>>>>67 ulelong x \b, serial number 0x%x 7597>>>>>>>71 string <NO\ NAME \b, label: "%11.11s" 7598>>>>>>>71 string >NO\ NAME \b, label: "%11.11s" 7599>>>>>>>71 string =NO\ NAME \b, unlabeled 7600# additional tests for floppy image added by Joerg Jenderek 7601# no fixed disk 7602>>>>>21 ubyte !0xF8 7603# floppy media with 12 bit FAT 7604>>>>>>54 string !FAT16 7605# test for FAT after bootsector 7606>>>>>>>(11.s) ulelong&0x00ffffF0 0x00ffffF0 \b, followed by FAT 7607# floppy image 7608!:mime application/x-ima 7609# NTFS specific added by Joerg Jenderek at Mar 2011 according to http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm 7610# and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html 7611# 0 FATs 7612>>>>>16 ubyte =0 7613# 0 root entries 7614>>>>>>17 uleshort =0 7615# 0 DOS sectors 7616>>>>>>>19 uleshort =0 7617# 0 sectors/FAT 7618# dos < 4.0 BootSector value found is 0x80 7619#38 ubyte =0x80 \b, dos < 4.0 BootSector (0x%x) 7620>>>>>>>>22 uleshort =0 \b; NTFS 7621>>>>>>>>>24 uleshort >0 \b, sectors/track %u 7622>>>>>>>>>36 ulelong !0x800080 \b, physical drive 0x%x 7623>>>>>>>>>40 ulequad >0 \b, sectors %lld 7624>>>>>>>>>48 ulequad >0 \b, $MFT start cluster %lld 7625>>>>>>>>>56 ulequad >0 \b, $MFTMirror start cluster %lld 7626# Values 0 to 127 represent MFT record sizes of 0 to 127 clusters. 7627# Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes. 7628>>>>>>>>>64 lelong <256 7629>>>>>>>>>>64 lelong <128 \b, clusters/RecordSegment %d 7630>>>>>>>>>>64 ubyte >127 \b, bytes/RecordSegment 2^(-1*%hhi) 7631# Values 0 to 127 represent index block sizes of 0 to 127 clusters. 7632# Values 128 to 255 represent index block sizes of 2^(256-N) byte 7633>>>>>>>>>68 ulelong <256 7634>>>>>>>>>>68 ulelong <128 \b, clusters/index block %d 7635#>>>>>>>>>>68 ulelong >127 \b, bytes/index block 2^(256-%d) 7636>>>>>>>>>>68 ubyte >127 \b, bytes/index block 2^(-1*%hhi) 7637>>>>>>>>>72 ulequad x \b, serial number 0%llx 7638>>>>>>>>>80 ulelong >0 \b, checksum 0x%x 7639#>>>>>>>>>80 ulelong =0 \b, checksum 0x%x=0 (usual) 7640>>>>>>>>>0x258 ulelong&0x00009090 =0x00009090 7641>>>>>>>>>>&-92 indirect x \b; contains 7642# For 2nd NTFS sector added by Joerg Jenderek at Jan 2013 7643# http://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm 7644# unused assembler instructions JMP y2;NOP;NOP 76450x056 ulelong&0xFFFF0FFF 0x909002EB 7646# unicode loadername terminated by CTRL-D 7647>(0.s*2) ulelong&0xFFFFFF00 0x00040000 7648# loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR 7649>>0x002 lestring16 x Microsoft Windows XP/VISTA bootloader %-5.5s 7650>>0x12 string $ 7651>>>0x0c lestring16 x \b%-2.2s 7652### DOS,NTFS boot sectors end 7653 76549564 lelong 0x00011954 Unix Fast File system [v1] (little-endian), 7655>8404 string x last mounted on %s, 7656#>9504 ledate x last checked at %s, 7657>8224 ledate x last written at %s, 7658>8401 byte x clean flag %d, 7659>8228 lelong x number of blocks %d, 7660>8232 lelong x number of data blocks %d, 7661>8236 lelong x number of cylinder groups %d, 7662>8240 lelong x block size %d, 7663>8244 lelong x fragment size %d, 7664>8252 lelong x minimum percentage of free blocks %d, 7665>8256 lelong x rotational delay %dms, 7666>8260 lelong x disk rotational speed %drps, 7667>8320 lelong 0 TIME optimization 7668>8320 lelong 1 SPACE optimization 7669 767042332 lelong 0x19540119 Unix Fast File system [v2] (little-endian) 7671>&-1164 string x last mounted on %s, 7672>&-696 string >\0 volume name %s, 7673>&-304 leqldate x last written at %s, 7674>&-1167 byte x clean flag %d, 7675>&-1168 byte x readonly flag %d, 7676>&-296 lequad x number of blocks %lld, 7677>&-288 lequad x number of data blocks %lld, 7678>&-1332 lelong x number of cylinder groups %d, 7679>&-1328 lelong x block size %d, 7680>&-1324 lelong x fragment size %d, 7681>&-180 lelong x average file size %d, 7682>&-176 lelong x average number of files in dir %d, 7683>&-272 lequad x pending blocks to free %lld, 7684>&-264 lelong x pending inodes to free %ld, 7685>&-664 lequad x system-wide uuid %0llx, 7686>&-1316 lelong x minimum percentage of free blocks %d, 7687>&-1248 lelong 0 TIME optimization 7688>&-1248 lelong 1 SPACE optimization 7689 769066908 lelong 0x19540119 Unix Fast File system [v2] (little-endian) 7691>&-1164 string x last mounted on %s, 7692>&-696 string >\0 volume name %s, 7693>&-304 leqldate x last written at %s, 7694>&-1167 byte x clean flag %d, 7695>&-1168 byte x readonly flag %d, 7696>&-296 lequad x number of blocks %lld, 7697>&-288 lequad x number of data blocks %lld, 7698>&-1332 lelong x number of cylinder groups %d, 7699>&-1328 lelong x block size %d, 7700>&-1324 lelong x fragment size %d, 7701>&-180 lelong x average file size %d, 7702>&-176 lelong x average number of files in dir %d, 7703>&-272 lequad x pending blocks to free %lld, 7704>&-264 lelong x pending inodes to free %ld, 7705>&-664 lequad x system-wide uuid %0llx, 7706>&-1316 lelong x minimum percentage of free blocks %d, 7707>&-1248 lelong 0 TIME optimization 7708>&-1248 lelong 1 SPACE optimization 7709 77109564 belong 0x00011954 Unix Fast File system [v1] (big-endian), 7711>7168 belong 0x4c41424c Apple UFS Volume 7712>>7186 string x named %s, 7713>>7176 belong x volume label version %d, 7714>>7180 bedate x created on %s, 7715>8404 string x last mounted on %s, 7716#>9504 bedate x last checked at %s, 7717>8224 bedate x last written at %s, 7718>8401 byte x clean flag %d, 7719>8228 belong x number of blocks %d, 7720>8232 belong x number of data blocks %d, 7721>8236 belong x number of cylinder groups %d, 7722>8240 belong x block size %d, 7723>8244 belong x fragment size %d, 7724>8252 belong x minimum percentage of free blocks %d, 7725>8256 belong x rotational delay %dms, 7726>8260 belong x disk rotational speed %drps, 7727>8320 belong 0 TIME optimization 7728>8320 belong 1 SPACE optimization 7729 773042332 belong 0x19540119 Unix Fast File system [v2] (big-endian) 7731>&-1164 string x last mounted on %s, 7732>&-696 string >\0 volume name %s, 7733>&-304 beqldate x last written at %s, 7734>&-1167 byte x clean flag %d, 7735>&-1168 byte x readonly flag %d, 7736>&-296 bequad x number of blocks %lld, 7737>&-288 bequad x number of data blocks %lld, 7738>&-1332 belong x number of cylinder groups %d, 7739>&-1328 belong x block size %d, 7740>&-1324 belong x fragment size %d, 7741>&-180 belong x average file size %d, 7742>&-176 belong x average number of files in dir %d, 7743>&-272 bequad x pending blocks to free %lld, 7744>&-264 belong x pending inodes to free %ld, 7745>&-664 bequad x system-wide uuid %0llx, 7746>&-1316 belong x minimum percentage of free blocks %d, 7747>&-1248 belong 0 TIME optimization 7748>&-1248 belong 1 SPACE optimization 7749 775066908 belong 0x19540119 Unix Fast File system [v2] (big-endian) 7751>&-1164 string x last mounted on %s, 7752>&-696 string >\0 volume name %s, 7753>&-304 beqldate x last written at %s, 7754>&-1167 byte x clean flag %d, 7755>&-1168 byte x readonly flag %d, 7756>&-296 bequad x number of blocks %lld, 7757>&-288 bequad x number of data blocks %lld, 7758>&-1332 belong x number of cylinder groups %d, 7759>&-1328 belong x block size %d, 7760>&-1324 belong x fragment size %d, 7761>&-180 belong x average file size %d, 7762>&-176 belong x average number of files in dir %d, 7763>&-272 bequad x pending blocks to free %lld, 7764>&-264 belong x pending inodes to free %ld, 7765>&-664 bequad x system-wide uuid %0llx, 7766>&-1316 belong x minimum percentage of free blocks %d, 7767>&-1248 belong 0 TIME optimization 7768>&-1248 belong 1 SPACE optimization 7769 7770# ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca> 7771# ext4 filesystem - Eric Sandeen <sandeen@sandeen.net> 7772# volume label and UUID Russell Coker 7773# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/ 77740x438 leshort 0xEF53 Linux 7775>0x44c lelong x rev %d 7776>0x43e leshort x \b.%d 7777# No journal? ext2 7778>0x45c lelong ^0x0000004 ext2 filesystem data 7779>>0x43a leshort ^0x0000001 (mounted or unclean) 7780# Has a journal? ext3 or ext4 7781>0x45c lelong &0x0000004 7782# and small INCOMPAT? 7783>>0x460 lelong <0x0000040 7784# and small RO_COMPAT? 7785>>>0x464 lelong <0x0000008 ext3 filesystem data 7786# else large RO_COMPAT? 7787>>>0x464 lelong >0x0000007 ext4 filesystem data 7788# else large INCOMPAT? 7789>>0x460 lelong >0x000003f ext4 filesystem data 7790>0x468 belong x \b, UUID=%08x 7791>0x46c beshort x \b-%04x 7792>0x46e beshort x \b-%04x 7793>0x470 beshort x \b-%04x 7794>0x472 belong x \b-%08x 7795>0x476 beshort x \b%04x 7796>0x478 string >0 \b, volume name "%s" 7797# General flags for any ext* fs 7798>0x460 lelong &0x0000004 (needs journal recovery) 7799>0x43a leshort &0x0000002 (errors) 7800# INCOMPAT flags 7801>0x460 lelong &0x0000001 (compressed) 7802#>0x460 lelong &0x0000002 (filetype) 7803#>0x460 lelong &0x0000010 (meta bg) 7804>0x460 lelong &0x0000040 (extents) 7805>0x460 lelong &0x0000080 (64bit) 7806#>0x460 lelong &0x0000100 (mmp) 7807#>0x460 lelong &0x0000200 (flex bg) 7808# RO_INCOMPAT flags 7809#>0x464 lelong &0x0000001 (sparse super) 7810>0x464 lelong &0x0000002 (large files) 7811>0x464 lelong &0x0000008 (huge files) 7812#>0x464 lelong &0x0000010 (gdt checksum) 7813#>0x464 lelong &0x0000020 (many subdirs) 7814#>0x463 lelong &0x0000040 (extra isize) 7815 7816# Minix filesystems - Juan Cespedes <cespedes@debian.org> 78170x410 leshort 0x137f 7818!:strength / 2 7819>0x402 beshort < 100 7820>0x402 beshort > -1 Minix filesystem, V1, %d zones 7821>0x1e string minix \b, bootable 78220x410 beshort 0x137f 7823!:strength / 2 7824>0x402 beshort < 100 7825>0x402 beshort > -1 Minix filesystem, V1 (big endian), %d zones 7826>0x1e string minix \b, bootable 78270x410 leshort 0x138f 7828!:strength / 2 7829>0x402 beshort < 100 7830>0x402 beshort > -1 Minix filesystem, V1, 30 char names, %d zones 7831>0x1e string minix \b, bootable 78320x410 beshort 0x138f 7833!:strength / 2 7834>0x402 beshort < 100 7835>0x402 beshort > -1 Minix filesystem, V1, 30 char names (big endian), %d zones 7836>0x1e string minix \b, bootable 78370x410 leshort 0x2468 7838>0x402 beshort < 100 7839>>0x402 beshort > -1 Minix filesystem, V2, %d zones 7840>0x1e string minix \b, bootable 78410x410 beshort 0x2468 7842>0x402 beshort < 100 7843>0x402 beshort > -1 Minix filesystem, V2 (big endian), %d zones 7844>0x1e string minix \b, bootable 7845 78460x410 leshort 0x2478 7847>0x402 beshort < 100 7848>0x402 beshort > -1 Minix filesystem, V2, 30 char names, %d zones 7849>0x1e string minix \b, bootable 78500x410 leshort 0x2478 7851>0x402 beshort < 100 7852>0x402 beshort > -1 Minix filesystem, V2, 30 char names, %d zones 7853>0x1e string minix \b, bootable 78540x410 beshort 0x2478 7855>0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian), %d zones 7856>0x1e string minix \b, bootable 78570x410 leshort 0x4d5a 7858>0x402 beshort !0 Minix filesystem, V3, %d zones 7859>0x1e string minix \b, bootable 7860 7861# SGI disk labels - Nathan Scott <nathans@debian.org> 78620 belong 0x0BE5A941 SGI disk label (volume header) 7863 7864# SGI XFS filesystem - Nathan Scott <nathans@debian.org> 78650 belong 0x58465342 SGI XFS filesystem data 7866>0x4 belong x (blksz %d, 7867>0x68 beshort x inosz %d, 7868>0x64 beshort ^0x2004 v1 dirs) 7869>0x64 beshort &0x2004 v2 dirs) 7870 7871############################################################################ 7872# Minix-ST kernel floppy 78730x800 belong 0x46fc2700 Atari-ST Minix kernel image 7874# http://en.wikipedia.org/wiki/BIOS_parameter_block 7875# floppies with valid BPB and any instruction at beginning 7876>19 string \240\005\371\005\0\011\0\2\0 \b, 720k floppy 7877>19 string \320\002\370\005\0\011\0\1\0 \b, 360k floppy 7878 7879############################################################################ 7880# Hmmm, is this a better way of detecting _standard_ floppy images ? 788119 string \320\002\360\003\0\011\0\1\0 DOS floppy 360k 7882>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 788319 string \240\005\371\003\0\011\0\2\0 DOS floppy 720k 7884>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 788519 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k 7886>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 7887 788819 string \240\005\371\005\0\011\0\2\0 DOS floppy 720k, IBM 7889>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 789019 string \100\013\371\005\0\011\0\2\0 DOS floppy 1440k, mkdosfs 7891>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 7892 789319 string \320\002\370\005\0\011\0\1\0 Atari-ST floppy 360k 789419 string \240\005\371\005\0\011\0\2\0 Atari-ST floppy 720k 7895# | | | | | 7896# | | | | heads 7897# | | | sectors/track 7898# | | sectors/FAT 7899# | media descriptor 7900# BPB: sectors 7901 7902# Valid media descriptor bytes for MS-DOS: 7903# 7904# Byte Capacity Media Size and Type 7905# ------------------------------------------------- 7906# 7907# F0 2.88 MB 3.5-inch, 2-sided, 36-sector 7908# F0 1.44 MB 3.5-inch, 2-sided, 18-sector 7909# F9 720K 3.5-inch, 2-sided, 9-sector 7910# F9 1.2 MB 5.25-inch, 2-sided, 15-sector 7911# FD 360K 5.25-inch, 2-sided, 9-sector 7912# FF 320K 5.25-inch, 2-sided, 8-sector 7913# FC 180K 5.25-inch, 1-sided, 9-sector 7914# FE 160K 5.25-inch, 1-sided, 8-sector 7915# FE 250K 8-inch, 1-sided, single-density 7916# FD 500K 8-inch, 2-sided, single-density 7917# FE 1.2 MB 8-inch, 2-sided, double-density 7918# F8 ----- Fixed disk 7919# 7920# FC xxxK Apricot 70x1x9 boot disk. 7921# 7922# Originally a bitmap: 7923# xxxxxxx0 Not two sided 7924# xxxxxxx1 Double sided 7925# xxxxxx0x Not 8 SPT 7926# xxxxxx1x 8 SPT 7927# xxxxx0xx Not Removable drive 7928# xxxxx1xx Removable drive 7929# 11111xxx Must be one. 7930# 7931# But now it's rather random: 7932# 111111xx Low density disk 7933# 00 SS, Not 8 SPT 7934# 01 DS, Not 8 SPT 7935# 10 SS, 8 SPT 7936# 11 DS, 8 SPT 7937# 7938# 11111001 Double density 3 1/2 floppy disk, high density 5 1/4 7939# 11110000 High density 3 1/2 floppy disk 7940# 11111000 Hard disk any format 7941# 7942 7943# all FAT12 (strength=70) floppies with sectorsize 512 added by Joerg Jenderek at Jun 2013 7944# http://en.wikipedia.org/wiki/File_Allocation_Table#Exceptions 7945512 ubelong&0xE0ffff00 0xE0ffff00 7946# without valid Media descriptor in place of BPB, cases with are done at other places 7947>21 ubyte <0xE5 floppy with old FAT filesystem 7948# but valid Media descriptor at begin of FAT 7949#>>512 ubyte =0xed 720k 7950#>>512 ubyte =0xf0 1440k 7951#>>512 ubyte =0xf8 720k 7952#>>512 ubyte =0xf9 1220k 7953#>>512 ubyte =0xfa 320k 7954#>>512 ubyte =0xfb 640k 7955>>512 ubyte =0xfc 180k 7956# look like an an old DOS directory entry 7957>>>0xA0E ubequad 0 7958>>>>0xA00 ubequad !0 7959!:mime application/x-ima 7960>>512 ubyte =0xfd 7961# look for 2nd FAT at different location to distinguish between 360k and 500k 7962>>>0x600 ubelong&0xE0ffff00 0xE0ffff00 360k 7963#>>>0x500 ubelong&0xE0ffff00 0xE0ffff00 500k 7964>>>0xA0E ubequad 0 7965!:mime application/x-ima 7966>>512 ubyte =0xfe 7967>>>0x400 ubelong&0xE0ffff00 0xE0ffff00 160k 7968>>>>0x60E ubequad 0 7969>>>>>0x600 ubequad !0 7970!:mime application/x-ima 7971#>>>0xC00 ubelong&0xE0ffff00 0xE0ffff00 1200k 7972>>512 ubyte =0xff 320k 7973>>>0x60E ubequad 0 7974>>>>0x600 ubequad !0 7975!:mime application/x-ima 7976>>512 ubyte x \b, Media descriptor 0x%x 7977# without x86 jump instruction 7978>>0 ulelong&0x804000E9 !0x000000E9 7979# assembler instructions: CLI;MOV SP,1E7;MOV AX;07c0;MOV 7980>>>0 ubequad 0xfabce701b8c0078e \b, MS-DOS 1.12 bootloader 7981# IOSYS.COM+MSDOS.COM 7982>>>>0xc4 use 2xDOS-filename 7983>>0 ulelong&0x804000E9 =0x000000E9 7984# only x86 short jump instruction found 7985>>>0 ubyte =0xEB 7986>>>>1 ubyte x \b, code offset 0x%x+2 7987# http://thestarman.pcministry.com/DOS/ibm100/Boot.htm 7988# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;MOV DX,0 7989>>>>(1.b+2) ubequad 0xfa8cc88ed8ba0000 \b, PC-DOS 1.0 bootloader 7990# ibmbio.com+ibmdos.com 7991>>>>>0x176 use DOS-filename 7992>>>>>0x181 ubyte x \b+ 7993>>>>>0x182 use DOS-filename 7994# http://thestarman.pcministry.com/DOS/ibm110/Boot.htm 7995# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;XOR DX,DX;MOV 7996>>>>(1.b+2) ubequad 0xfa8cc88ed833d28e \b, PC-DOS 1.1 bootloader 7997# ibmbio.com+ibmdos.com 7998>>>>>0x18b use DOS-filename 7999>>>>>0x196 ubyte x \b+ 8000>>>>>0x197 use DOS-filename 8001# http://en.wikipedia.org/wiki/Zenith_Data_Systems 8002# assembler instructions: MOV BX,07c0;MOV SS,BX;MOV SP,01c6 8003>>>>(1.b+2) ubequad 0xbbc0078ed3bcc601 \b, Zenith Data Systems MS-DOS 1.25 bootloader 8004# IO.SYS+MSDOS.SYS 8005>>>>>0x20 use 2xDOS-filename 8006# http://en.wikipedia.org/wiki/Corona_Data_Systems 8007# assembler instructions: MOV AX,CS;MOV DS,AX;CLI;MOV SS,AX; 8008>>>>(1.b+2) ubequad 0x8cc88ed8fa8ed0bc \b, MS-DOS 1.25 bootloader 8009# IO.SYS+MSDOS.SYS 8010>>>>>0x69 use 2xDOS-filename 8011# assembler instructions: CLI;PUSH CS;POP SS;MOV SP,7c00; 8012>>>>(1.b+2) ubequad 0xfa0e17bc007cb860 \b, MS-DOS 2.11 bootloader 8013# defect IO.SYS+MSDOS.SYS ? 8014#>>>>>0x162 use 2xDOS-filename 8015 8016# CDROM Filesystems 8017# Modified for UDF by gerardo.cacciari@gmail.com 801832769 string CD001 # 8019!:mime application/x-iso9660-image 8020>38913 string !NSR0 ISO 9660 CD-ROM filesystem data 8021>38913 string NSR0 UDF filesystem data 8022>>38917 string 1 (version 1.0) 8023>>38917 string 2 (version 1.5) 8024>>38917 string 3 (version 2.0) 8025>>38917 byte >0x33 (unknown version, ID 0x%X) 8026>>38917 byte <0x31 (unknown version, ID 0x%X) 8027# "application id" which appears to be used as a volume label 8028>32808 string/T >\0 '%s' 8029>34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable) 803037633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors) 8031!:mime application/x-iso9660-image 803232777 string CDROM High Sierra CD-ROM filesystem data 8033 8034# .cso files 80350 string CISO Compressed ISO CD image 8036 8037# cramfs filesystem - russell@coker.com.au 80380 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian 8039>4 lelong x size %lu 8040>8 lelong &1 version #2 8041>8 lelong &2 sorted_dirs 8042>8 lelong &4 hole_support 8043>32 lelong x CRC 0x%x, 8044>36 lelong x edition %lu, 8045>40 lelong x %lu blocks, 8046>44 lelong x %lu files 8047 80480 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian 8049>4 belong x size %lu 8050>8 belong &1 version #2 8051>8 belong &2 sorted_dirs 8052>8 belong &4 hole_support 8053>32 belong x CRC 0x%x, 8054>36 belong x edition %lu, 8055>40 belong x %lu blocks, 8056>44 belong x %lu files 8057 8058# reiserfs - russell@coker.com.au 80590x10034 string ReIsErFs ReiserFS V3.5 80600x10034 string ReIsEr2Fs ReiserFS V3.6 80610x10034 string ReIsEr3Fs ReiserFS V3.6.19 8062>0x1002c leshort x block size %d 8063>0x10032 leshort &2 (mounted or unclean) 8064>0x10000 lelong x num blocks %d 8065>0x10040 lelong 1 tea hash 8066>0x10040 lelong 2 yura hash 8067>0x10040 lelong 3 r5 hash 8068 8069# JFFS - russell@coker.com.au 80700 lelong 0x34383931 Linux Journalled Flash File system, little endian 80710 belong 0x34383931 Linux Journalled Flash File system, big endian 8072 8073# EST flat binary format (which isn't, but anyway) 8074# From: Mark Brown <broonie@sirena.org.uk> 80750 string ESTFBINR EST flat binary 8076 8077# Aculab VoIP firmware 8078# From: Mark Brown <broonie@sirena.org.uk> 80790 string VoIP\ Startup\ and Aculab VoIP firmware 8080>35 string x format %s 8081 8082# From: Mark Brown <broonie@sirena.org.uk> [old] 8083# From: Behan Webster <behanw@websterwood.com> 80840 belong 0x27051956 u-boot legacy uImage, 8085>32 string x %s, 8086>28 byte 0 Invalid os/ 8087>28 byte 1 OpenBSD/ 8088>28 byte 2 NetBSD/ 8089>28 byte 3 FreeBSD/ 8090>28 byte 4 4.4BSD/ 8091>28 byte 5 Linux/ 8092>28 byte 6 SVR4/ 8093>28 byte 7 Esix/ 8094>28 byte 8 Solaris/ 8095>28 byte 9 Irix/ 8096>28 byte 10 SCO/ 8097>28 byte 11 Dell/ 8098>28 byte 12 NCR/ 8099>28 byte 13 LynxOS/ 8100>28 byte 14 VxWorks/ 8101>28 byte 15 pSOS/ 8102>28 byte 16 QNX/ 8103>28 byte 17 Firmware/ 8104>28 byte 18 RTEMS/ 8105>28 byte 19 ARTOS/ 8106>28 byte 20 Unity OS/ 8107>28 byte 21 INTEGRITY/ 8108>29 byte 0 \bInvalid CPU, 8109>29 byte 1 \bAlpha, 8110>29 byte 2 \bARM, 8111>29 byte 3 \bIntel x86, 8112>29 byte 4 \bIA64, 8113>29 byte 5 \bMIPS, 8114>29 byte 6 \bMIPS 64-bit, 8115>29 byte 7 \bPowerPC, 8116>29 byte 8 \bIBM S390, 8117>29 byte 9 \bSuperH, 8118>29 byte 10 \bSparc, 8119>29 byte 11 \bSparc 64-bit, 8120>29 byte 12 \bM68K, 8121>29 byte 13 \bNios-32, 8122>29 byte 14 \bMicroBlaze, 8123>29 byte 15 \bNios-II, 8124>29 byte 16 \bBlackfin, 8125>29 byte 17 \bAVR32, 8126>29 byte 18 \bSTMicroelectronics ST200, 8127>30 byte 0 Invalid Image 8128>30 byte 1 Standalone Program 8129>30 byte 2 OS Kernel Image 8130>30 byte 3 RAMDisk Image 8131>30 byte 4 Multi-File Image 8132>30 byte 5 Firmware Image 8133>30 byte 6 Script File 8134>30 byte 7 Filesystem Image (any type) 8135>30 byte 8 Binary Flat Device Tree BLOB 8136>31 byte 0 (Not compressed), 8137>31 byte 1 (gzip), 8138>31 byte 2 (bzip2), 8139>31 byte 3 (lzma), 8140>12 belong x %d bytes, 8141>8 bedate x %s, 8142>16 belong x Load Address: 0x%08X, 8143>20 belong x Entry Point: 0x%08X, 8144>4 belong x Header CRC: 0x%08X, 8145>24 belong x Data CRC: 0x%08X 8146 8147# JFFS2 file system 81480 leshort 0x1984 Linux old jffs2 filesystem data little endian 81490 leshort 0x1985 Linux jffs2 filesystem data little endian 8150 8151# Squashfs 81520 string sqsh Squashfs filesystem, big endian, 8153>28 beshort x version %d. 8154>30 beshort x \b%d, 8155>28 beshort <3 8156>>8 belong x %d bytes, 8157>28 beshort >2 8158>>28 beshort <4 8159>>>63 bequad x %lld bytes, 8160>>28 beshort >3 8161>>>40 bequad x %lld bytes, 8162#>>67 belong x %d bytes, 8163>4 belong x %d inodes, 8164>28 beshort <2 8165>>32 beshort x blocksize: %d bytes, 8166>28 beshort >1 8167>>28 beshort <4 8168>>>51 belong x blocksize: %d bytes, 8169>>28 beshort >3 8170>>>12 belong x blocksize: %d bytes, 8171>28 beshort <4 8172>>39 bedate x created: %s 8173>28 beshort >3 8174>>8 bedate x created: %s 81750 string hsqs Squashfs filesystem, little endian, 8176>28 leshort x version %d. 8177>30 leshort x \b%d, 8178>28 leshort <3 8179>>8 lelong x %d bytes, 8180>28 leshort >2 8181>>28 leshort <4 8182>>>63 lequad x %lld bytes, 8183>>28 leshort >3 8184>>>40 lequad x %lld bytes, 8185#>>63 lelong x %d bytes, 8186>4 lelong x %d inodes, 8187>28 leshort <2 8188>>32 leshort x blocksize: %d bytes, 8189>28 leshort >1 8190>>28 leshort <4 8191>>>51 lelong x blocksize: %d bytes, 8192>>28 leshort >3 8193>>>12 lelong x blocksize: %d bytes, 8194>28 leshort <4 8195>>39 ledate x created: %s 8196>28 leshort >3 8197>>8 ledate x created: %s 8198 8199# AFS Dump Magic 8200# From: Ty Sarna <tsarna@sarna.org> 82010 string \x01\xb3\xa1\x13\x22 AFS Dump 8202>&0 belong x (v%d) 8203>>&0 byte 0x76 8204>>>&0 belong x Vol %d, 8205>>>>&0 byte 0x6e 8206>>>>>&0 string x %s 8207>>>>>>&1 byte 0x74 8208>>>>>>>&0 beshort 2 8209>>>>>>>>&4 bedate x on: %s 8210>>>>>>>>&0 bedate =0 full dump 8211>>>>>>>>&0 bedate !0 incremental since: %s 8212 8213#---------------------------------------------------------- 8214#delta ISO Daniel Novotny (dnovotny@redhat.com) 82150 string DISO Delta ISO data 8216>4 belong x version %d 8217 8218# VMS backup savesets - gerardo.cacciari@gmail.com 8219# 82204 string \x01\x00\x01\x00\x01\x00 8221>(0.s+16) string \x01\x01 8222>>&(&0.b+8) byte 0x42 OpenVMS backup saveset data 8223>>>40 lelong x (block size %d, 8224>>>49 string >\0 original name '%s', 8225>>>2 short 1024 VAX generated) 8226>>>2 short 2048 AXP generated) 8227>>>2 short 4096 I64 generated) 8228 8229# Summary: Oracle Clustered Filesystem 8230# Created by: Aaron Botsis <redhat@digitalmafia.org> 82318 string OracleCFS Oracle Clustered Filesystem, 8232>4 long x rev %d 8233>0 long x \b.%d, 8234>560 string x label: %.64s, 8235>136 string x mountpoint: %.128s 8236 8237# Summary: Oracle ASM tagged volume 8238# Created by: Aaron Botsis <redhat@digitalmafia.org> 823932 string ORCLDISK Oracle ASM Volume, 8240>40 string x Disk Name: %0.12s 824132 string ORCLCLRD Oracle ASM Volume (cleared), 8242>40 string x Disk Name: %0.12s 8243 8244# Oracle Clustered Filesystem - Aaron Botsis <redhat@digitalmafia.org> 82458 string OracleCFS Oracle Clustered Filesystem, 8246>4 long x rev %d 8247>0 long x \b.%d, 8248>560 string x label: %.64s, 8249>136 string x mountpoint: %.128s 8250 8251# Oracle ASM tagged volume - Aaron Botsis <redhat@digitalmafia.org> 825232 string ORCLDISK Oracle ASM Volume, 8253>40 string x Disk Name: %0.12s 825432 string ORCLCLRD Oracle ASM Volume (cleared), 8255>40 string x Disk Name: %0.12s 8256 8257# Compaq/HP RILOE floppy image 8258# From: Dirk Jagdmann <doj@cubic.org> 82590 string CPQRFBLO Compaq/HP RILOE floppy image 8260 8261#------------------------------------------------------------------------------ 8262# Files-11 On-Disk Structure (File system for various RSX-11 and VMS flavours). 8263# These bits come from LBN 1 (home block) of ODS-1, ODS-2 and ODS-5 volumes, 8264# which is mapped to VBN 2 of [000000]INDEXF.SYS;1 - gerardo.cacciari@gmail.com 8265# 82661008 string DECFILE11 Files-11 On-Disk Structure 8267>525 byte x Level %d 8268>525 byte x (ODS-%d); 8269>1017 string A RSX-11, VAX/VMS or OpenVMS VAX file system; 8270>1017 string B 8271>>525 byte 2 VAX/VMS or OpenVMS file system; 8272>>525 byte 5 OpenVMS Alpha or Itanium file system; 8273>984 string x volume label is '%-12.12s' 8274 8275# From: Thomas Klausner <wiz@NetBSD.org> 8276# http://filext.com/file-extension/DAA 8277# describes the daa file format. The magic would be: 82780 string DAA\x0\x0\x0\x0\x0 PowerISO Direct-Access-Archive 8279 8280# From Albert Cahalan <acahalan@gmail.com> 8281# really le32 operation,destination,payloadsize (but quite predictable) 8282# 01 00 00 00 00 00 00 c0 00 02 00 00 82830 string \1\0\0\0\0\0\0\300\0\2\0\0 Marvell Libertas firmware 8284 8285# From Eric Sandeen 8286# GFS2 82870x10000 belong 0x01161970 8288>0x10018 belong 0x0000051d GFS1 Filesystem 8289>>0x10024 belong x (blocksize %d, 8290>>0x10060 string >\0 lockproto %s) 8291>0x10018 belong 0x00000709 GFS2 Filesystem 8292>>0x10024 belong x (blocksize %d, 8293>>0x10060 string >\0 lockproto %s) 8294 8295# BTRFS 82960x10040 string _BHRfS_M BTRFS Filesystem 8297>0x1012b string >\0 (label "%s", 8298>0x10090 lelong x sectorsize %d, 8299>0x10094 lelong x nodesize %d, 8300>0x10098 lelong x leafsize %d) 8301 8302 8303# dvdisaster's .ecc 8304# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 83050 string *dvdisaster* dvdisaster error correction file 8306 8307# xfs metadump image 8308# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog 8309# but can we do the << ? For now it's always 512 (0x200) anyway. 83100 string XFSM 8311>0x200 string XFSB XFS filesystem metadump image 8312 8313# Type: CROM filesystem 8314# From: Werner Fink <werner@suse.de> 83150 string CROMFS CROMFS 8316>6 string >\0 \b version %2.2s, 8317>8 ulequad >0 \b block data at %lld, 8318>16 ulequad >0 \b fblock table at %lld, 8319>24 ulequad >0 \b inode table at %lld, 8320>32 ulequad >0 \b root at %lld, 8321>40 ulelong >0 \b fblock size = %ld, 8322>44 ulelong >0 \b block size = %ld, 8323>48 ulequad >0 \b bytes = %lld 8324 8325# Type: xfs metadump image 8326# From: Daniel Novotny <dnovotny@redhat.com> 8327# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog 8328# but can we do the << ? For now it's always 512 (0x200) anyway. 83290 string XFSM 8330>0x200 string XFSB XFS filesystem metadump image 8331 8332# Type: delta ISO 8333# From: Daniel Novotny <dnovotny@redhat.com> 83340 string DISO Delta ISO data, 8335>4 belong x version %d 8336 8337# JFS2 (Journaling File System) image. (Old JFS1 has superblock at 0x1000.) 8338# See linux/fs/jfs/jfs_superblock.h for layout; see jfs_filsys.h for flags. 8339# From: Adam Buchbinder <adam.buchbinder@gmail.com> 83400x8000 string JFS1 8341# Because it's text-only magic, check a binary value (version) to be sure. 8342# Should always be 2, but mkfs.jfs writes it as 1. Needs to be 2 or 1 to be 8343# mountable. 8344>&0 lelong <3 JFS2 filesystem image 8345# Label is followed by a UUID; we have to limit string length to avoid 8346# appending the UUID in the case of a 16-byte label. 8347>>&144 regex [\x20-\x7E]{1,16} (label "%s") 8348>>&0 lequad x \b, %lld blocks 8349>>&8 lelong x \b, blocksize %d 8350>>&32 lelong&0x00000006 >0 (dirty) 8351>>&36 lelong >0 (compressed) 8352 8353# LFS 83540 lelong 0x070162 LFS filesystem image 8355>4 lelong 1 version 1, 8356>>8 lelong x \b blocks %u, 8357>>12 lelong x \b blocks per segment %u, 8358>4 lelong 2 version 2, 8359>>8 lelong x \b fragments %u, 8360>>12 lelong x \b bytes per segment %u, 8361>16 lelong x \b disk blocks %u, 8362>20 lelong x \b block size %u, 8363>24 lelong x \b fragment size %u, 8364>28 lelong x \b fragments per block %u, 8365>32 lelong x \b start for free list %u, 8366>36 lelong x \b number of free blocks %d, 8367>40 lelong x \b number of files %u, 8368>44 lelong x \b blocks available for writing %d, 8369>48 lelong x \b inodes in cache %d, 8370>52 lelong x \b inode file disk address 0x%x, 8371>56 lelong x \b inode file inode number %u, 8372>60 lelong x \b address of last segment written 0x%x, 8373>64 lelong x \b address of next segment to write 0x%x, 8374>68 lelong x \b address of current segment written 0x%x 8375 83760 string td\000 floppy image data (TeleDisk, compressed) 83770 string TD\000 floppy image data (TeleDisk) 8378 83790 string CQ\024 floppy image data (CopyQM, 8380>16 leshort x %d sectors, 8381>18 leshort x %d heads.) 8382 83830 string ACT\020Apricot\020disk\020image\032\004 floppy image data (ApriDisk) 8384 83850 beshort 0xAA58 floppy image data (IBM SaveDskF, old) 83860 beshort 0xAA59 floppy image data (IBM SaveDskF) 83870 beshort 0xAA5A floppy image data (IBM SaveDskF, compressed) 8388 83890 string \074CPM_Disk\076 disk image data (YAZE) 8390 8391# ReFS 8392# Richard W.M. Jones <rjones@redhat.com> 83930 string \0\0\0ReFS\0 ReFS filesystem image 8394 8395# EFW encase image file format: 8396# Gregoire Passault 8397# http://www.forensicswiki.org/wiki/Encase_image_file_format 83980 string EVF\x09\x0d\x0a\xff\x00 EWF/Expert Witness/EnCase image file format 8399 8400#------------------------------------------------------------------------------ 8401# $File: flash,v 1.9 2009/11/08 01:30:01 christos Exp $ 8402# flash: file(1) magic for Macromedia Flash file format 8403# 8404# See 8405# 8406# http://www.macromedia.com/software/flash/open/ 8407# 84080 string FWS Macromedia Flash data, 8409>3 byte x version %d 8410!:mime application/x-shockwave-flash 84110 string CWS Macromedia Flash data (compressed), 8412!:mime application/x-shockwave-flash 8413>3 byte x version %d 8414# From: Cal Peake <cp@absolutedigital.net> 84150 string FLV Macromedia Flash Video 8416!:mime video/x-flv 8417 8418# 8419# Yosu Gomez 84200 string AGD2\xbe\xb8\xbb\xcd\x00 Macromedia Freehand 7 Document 84210 string AGD3\xbe\xb8\xbb\xcc\x00 Macromedia Freehand 8 Document 8422# From Dave Wilson 84230 string AGD4\xbe\xb8\xbb\xcb\x00 Macromedia Freehand 9 Document 8424 8425#------------------------------------------------------------------------------ 8426# $File: fonts,v 1.26 2013/03/09 22:36:00 christos Exp $ 8427# fonts: file(1) magic for font data 8428# 84290 search/1 FONT ASCII vfont text 84300 short 0436 Berkeley vfont data 84310 short 017001 byte-swapped Berkeley vfont data 8432 8433# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com 84340 string %!PS-AdobeFont-1. PostScript Type 1 font text 8435>20 string >\0 (%s) 84366 string %!PS-AdobeFont-1. PostScript Type 1 font program data 84370 string %!FontType1 PostScript Type 1 font program data 84386 string %!FontType1 PostScript Type 1 font program data 84390 string %!PS-Adobe-3.0\ Resource-Font PostScript Type 1 font text 8440 8441# X11 font files in SNF (Server Natural Format) format 8442# updated by Joerg Jenderek at Feb 2013 8443# http://computer-programming-forum.com/51-perl/8f22fb96d2e34bab.htm 84440 belong 00000004 X11 SNF font data, MSB first 8445#>104 belong 00000004 X11 SNF font data, MSB first 8446!:mime application/x-font-sfn 8447# GRR: line below too general as it catches also Xbase index file t3-CHAR.NDX 84480 lelong 00000004 8449>104 lelong 00000004 X11 SNF font data, LSB first 8450!:mime application/x-font-sfn 8451 8452# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com) 84530 search/1 STARTFONT\ X11 BDF font text 8454 8455# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com) 8456# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides) 84570 string \001fcp X11 Portable Compiled Font data 8458>12 byte 0x02 \b, LSB first 8459>12 byte 0x0a \b, MSB first 84600 string D1.0\015 X11 Speedo font data 8461 8462#------------------------------------------------------------------------------ 8463# FIGlet fonts and controlfiles 8464# From figmagic supplied with Figlet version 2.2 8465# "David E. O'Brien" <obrien@FreeBSD.ORG> 84660 string flf FIGlet font 8467>3 string >2a version %-2.2s 84680 string flc FIGlet controlfile 8469>3 string >2a version %-2.2s 8470 8471# libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu) 8472# Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++ 84730 belong 0x14025919 libGrx font data, 8474>8 leshort x %dx 8475>10 leshort x \b%d 8476>40 string x %s 8477# Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu) 84780 belong 0xff464f4e DOS code page font data collection 84797 belong 0x00454741 DOS code page font data 84807 belong 0x00564944 DOS code page font data (from Linux?) 84814098 string DOSFONT DOSFONT2 encrypted font data 8482 8483# downloadable fonts for browser (prints type) anthon@mnt.org 84840 string PFR1 PFR1 font 8485>102 string >0 \b: %s 8486 8487# True Type fonts 84880 string \000\001\000\000\000 TrueType font data 8489!:mime application/x-font-ttf 8490 84910 string \007\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font 84920 string \012\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font 8493 8494# TrueType/OpenType font collections (.ttc) 8495# http://www.microsoft.com/typography/otspec/otff.htm 84960 string ttcf TrueType font collection data 8497>4 belong 0x00010000 \b, 1.0 8498>>8 belong >0 \b, %d fonts 8499>4 belong 0x00020000 \b, 2.0 8500>>8 belong >0 \b, %d fonts 8501# 0x44454947 = 'DSIG' 8502>>>16 belong 0x44534947 \b, digitally signed 8503 8504# Opentype font data from Avi Bercovich 85050 string OTTO OpenType font data 8506!:mime application/vnd.ms-opentype 8507 8508# Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu 85090 string SplineFontDB: Spline Font Database 8510!:mime application/vnd.font-fontforge-sfd 8511>14 string x version %s 8512 8513# EOT 851434 string LP Embedded OpenType (EOT) 8515!:mime application/vnd.ms-fontobject 8516 8517# Web Open Font Format (.woff) 8518# http://www.w3.org/TR/WOFF/ 85190 string wOFF Web Open Font Format 8520>4 belong x \b, flavor %d 8521>8 belong x \b, length %d 8522>20 beshort x \b, version %hd 8523>22 beshort x \b.%hd 8524 8525#------------------------------------------------------------------------------ 8526# $File: fortran,v 1.7 2012/06/21 01:55:02 christos Exp $ 8527# FORTRAN source 85280 regex/100 \^[Cc][\ \t] FORTRAN program 8529!:mime text/x-fortran 8530!:strength - 5 8531 8532#------------------------------------------------------------------------------ 8533# $File: frame,v 1.12 2009/09/19 16:28:09 christos Exp $ 8534# frame: file(1) magic for FrameMaker files 8535# 8536# This stuff came on a FrameMaker demo tape, most of which is 8537# copyright, but this file is "published" as witness the following: 8538# 8539# Note that this is the Framemaker Maker Interchange Format, not the 8540# Normal format which would be application/vnd.framemaker. 8541# 85420 string \<MakerFile FrameMaker document 8543!:mime application/x-mif 8544>11 string 5.5 (5.5 8545>11 string 5.0 (5.0 8546>11 string 4.0 (4.0 8547>11 string 3.0 (3.0 8548>11 string 2.0 (2.0 8549>11 string 1.0 (1.0 8550>14 byte x %c) 85510 string \<MIFFile FrameMaker MIF (ASCII) file 8552!:mime application/x-mif 8553>9 string 4.0 (4.0) 8554>9 string 3.0 (3.0) 8555>9 string 2.0 (2.0) 8556>9 string 1.0 (1.x) 85570 search/1 \<MakerDictionary FrameMaker Dictionary text 8558!:mime application/x-mif 8559>17 string 3.0 (3.0) 8560>17 string 2.0 (2.0) 8561>17 string 1.0 (1.x) 85620 string \<MakerScreenFont FrameMaker Font file 8563!:mime application/x-mif 8564>17 string 1.01 (%s) 85650 string \<MML FrameMaker MML file 8566!:mime application/x-mif 85670 string \<BookFile FrameMaker Book file 8568!:mime application/x-mif 8569>10 string 3.0 (3.0 8570>10 string 2.0 (2.0 8571>10 string 1.0 (1.0 8572>13 byte x %c) 8573# XXX - this book entry should be verified, if you find one, uncomment this 8574#0 string \<Book\ FrameMaker Book (ASCII) file 8575#!:mime application/x-mif 8576#>6 string 3.0 (3.0) 8577#>6 string 2.0 (2.0) 8578#>6 string 1.0 (1.0) 85790 string \<Maker Intermediate Print File FrameMaker IPL file 8580!:mime application/x-mif 8581 8582#------------------------------------------------------------------------------ 8583# $File: freebsd,v 1.7 2009/09/19 16:28:09 christos Exp $ 8584# freebsd: file(1) magic for FreeBSD objects 8585# 8586# All new-style FreeBSD magic numbers are in host byte order (i.e., 8587# little-endian on x86). 8588# 8589# XXX - this comes from the file "freebsd" in a recent FreeBSD version of 8590# "file"; it, and the NetBSD stuff in "netbsd", appear to use different 8591# schemes for distinguishing between executable images, shared libraries, 8592# and object files. 8593# 8594# FreeBSD says: 8595# 8596# Regardless of whether it's pure, demand-paged, or none of the 8597# above: 8598# 8599# if the entry point is < 4096, then it's a shared library if 8600# the "has run-time loader information" bit is set, and is 8601# position-independent if the "is position-independent" bit 8602# is set; 8603# 8604# if the entry point is >= 4096 (or >4095, same thing), then it's 8605# an executable, and is dynamically-linked if the "has run-time 8606# loader information" bit is set. 8607# 8608# On x86, NetBSD says: 8609# 8610# If it's neither pure nor demand-paged: 8611# 8612# if it has the "has run-time loader information" bit set, it's 8613# a dynamically-linked executable; 8614# 8615# if it doesn't have that bit set, then: 8616# 8617# if it has the "is position-independent" bit set, it's 8618# position-independent; 8619# 8620# if the entry point is non-zero, it's an executable, otherwise 8621# it's an object file. 8622# 8623# If it's pure: 8624# 8625# if it has the "has run-time loader information" bit set, it's 8626# a dynamically-linked executable, otherwise it's just an 8627# executable. 8628# 8629# If it's demand-paged: 8630# 8631# if it has the "has run-time loader information" bit set, 8632# then: 8633# 8634# if the entry point is < 4096, it's a shared library; 8635# 8636# if the entry point is = 4096 or > 4096 (i.e., >= 4096), 8637# it's a dynamically-linked executable); 8638# 8639# if it doesn't have the "has run-time loader information" bit 8640# set, then it's just an executable. 8641# 8642# (On non-x86, NetBSD does much the same thing, except that it uses 8643# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K 8644# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's 8645# had 8K pages; dunno about MIPS.) 8646# 8647# I suspect the two will differ only in perverse and uninteresting cases 8648# ("shared" libraries that aren't demand-paged and whose pages probably 8649# won't actually be shared, executables with entry points <4096). 8650# 8651# I leave it to those more familiar with FreeBSD and NetBSD to figure out 8652# what the right answer is (although using ">4095", FreeBSD-style, is 8653# probably better than separately checking for "=4096" and ">4096", 8654# NetBSD-style). (The old "netbsd" file analyzed FreeBSD demand paged 8655# executables using the NetBSD technique.) 8656# 86570 lelong&0377777777 041400407 FreeBSD/i386 8658>20 lelong <4096 8659>>3 byte&0xC0 &0x80 shared library 8660>>3 byte&0xC0 0x40 PIC object 8661>>3 byte&0xC0 0x00 object 8662>20 lelong >4095 8663>>3 byte&0x80 0x80 dynamically linked executable 8664>>3 byte&0x80 0x00 executable 8665>16 lelong >0 not stripped 8666 86670 lelong&0377777777 041400410 FreeBSD/i386 pure 8668>20 lelong <4096 8669>>3 byte&0xC0 &0x80 shared library 8670>>3 byte&0xC0 0x40 PIC object 8671>>3 byte&0xC0 0x00 object 8672>20 lelong >4095 8673>>3 byte&0x80 0x80 dynamically linked executable 8674>>3 byte&0x80 0x00 executable 8675>16 lelong >0 not stripped 8676 86770 lelong&0377777777 041400413 FreeBSD/i386 demand paged 8678>20 lelong <4096 8679>>3 byte&0xC0 &0x80 shared library 8680>>3 byte&0xC0 0x40 PIC object 8681>>3 byte&0xC0 0x00 object 8682>20 lelong >4095 8683>>3 byte&0x80 0x80 dynamically linked executable 8684>>3 byte&0x80 0x00 executable 8685>16 lelong >0 not stripped 8686 86870 lelong&0377777777 041400314 FreeBSD/i386 compact demand paged 8688>20 lelong <4096 8689>>3 byte&0xC0 &0x80 shared library 8690>>3 byte&0xC0 0x40 PIC object 8691>>3 byte&0xC0 0x00 object 8692>20 lelong >4095 8693>>3 byte&0x80 0x80 dynamically linked executable 8694>>3 byte&0x80 0x00 executable 8695>16 lelong >0 not stripped 8696 8697# XXX gross hack to identify core files 8698# cores start with a struct tss; we take advantage of the following: 8699# byte 7: highest byte of the kernel stack pointer, always 0xfe 8700# 8/9: kernel (ring 0) ss value, always 0x0010 8701# 10 - 27: ring 1 and 2 ss/esp, unused, thus always 0 8702# 28: low order byte of the current PTD entry, always 0 since the 8703# PTD is page-aligned 8704# 87057 string \357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 FreeBSD/i386 a.out core file 8706>1039 string >\0 from '%s' 8707 8708# /var/run/ld.so.hints 8709# What are you laughing about? 87100 lelong 011421044151 ld.so hints file (Little Endian 8711>4 lelong >0 \b, version %d) 8712>4 belong <1 \b) 87130 belong 011421044151 ld.so hints file (Big Endian 8714>4 belong >0 \b, version %d) 8715>4 belong <1 \b) 8716 8717# 8718# Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities 8719# 87200 string SCRSHOT_ scrshot(1) screenshot, 8721>8 byte x version %d, 8722>9 byte 2 %d bytes in header, 8723>>10 byte x %d chars wide by 8724>>11 byte x %d chars high 8725 8726#------------------------------------------------------------------------------ 8727# $File: fsav,v 1.13 2013/03/25 17:18:47 christos Exp $ 8728# fsav: file(1) magic for datafellows fsav virus definition files 8729# Anthon van der Neut (anthon@mnt.org) 8730 8731# ftp://ftp.f-prot.com/pub/{macrdef2.zip,nomacro.def} 87320 beshort 0x1575 fsav macro virus signatures 8733>8 leshort >0 (%d- 8734>11 byte >0 \b%02d- 8735>10 byte >0 \b%02d) 8736# ftp://ftp.f-prot.com/pub/sign.zip 8737#10 ubyte <12 8738#>9 ubyte <32 8739#>>8 ubyte 0x0a 8740#>>>12 ubyte 0x07 8741#>>>>11 uleshort >0 fsav DOS/Windows virus signatures (%d- 8742#>>>>10 byte 0 \b01- 8743#>>>>10 byte 1 \b02- 8744#>>>>10 byte 2 \b03- 8745#>>>>10 byte 3 \b04- 8746#>>>>10 byte 4 \b05- 8747#>>>>10 byte 5 \b06- 8748#>>>>10 byte 6 \b07- 8749#>>>>10 byte 7 \b08- 8750#>>>>10 byte 8 \b09- 8751#>>>>10 byte 9 \b10- 8752#>>>>10 byte 10 \b11- 8753#>>>>10 byte 11 \b12- 8754#>>>>9 ubyte >0 \b%02d) 8755# ftp://ftp.f-prot.com/pub/sign2.zip 8756#0 ubyte 0x62 8757#>1 ubyte 0xF5 8758#>>2 ubyte 0x1 8759#>>>3 ubyte 0x1 8760#>>>>4 ubyte 0x0e 8761#>>>>>13 ubyte >0 fsav virus signatures 8762#>>>>>>11 ubyte x size 0x%02x 8763#>>>>>>12 ubyte x \b%02x 8764#>>>>>>13 ubyte x \b%02x bytes 8765 8766# Joerg Jenderek: joerg dot jenderek at web dot de 8767# http://www.clamav.net/doc/latest/html/node45.html 8768# .cvd files start with a 512 bytes colon separated header 8769# ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime 8770# + gzipped tarball files 87710 string ClamAV-VDB: 8772>11 string >\0 Clam AntiVirus database %-.23s 8773>>34 string : 8774>>>35 string !: \b, version 8775>>>>35 string x \b%-.1s 8776>>>>>36 string !: 8777>>>>>>36 string x \b%-.1s 8778>>>>>>>37 string !: 8779>>>>>>>>37 string x \b%-.1s 8780>>>>>>>>>38 string !: 8781>>>>>>>>>>38 string x \b%-.1s 8782>512 string \037\213 \b, gzipped 8783>769 string ustar\0 \b, tarred 8784 8785# Type: Grisoft AVG AntiVirus 8786# From: David Newgas <david@newgas.net> 87870 string AVG7_ANTIVIRUS_VAULT_FILE AVG 7 Antivirus vault file data 8788 87890 string X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR 8790>33 string -STANDARD-ANTIVIRUS-TEST-FILE!$H+H* EICAR virus test files 8791 8792#------------------------------------------------------------------------------ 8793# $File: fusecompress,v 1.2 2011/08/08 09:05:55 christos Exp $ 8794# fusecompress: file(1) magic for fusecompress 87950 string \037\135\211 FuseCompress(ed) data 8796>3 byte 0x00 (none format) 8797>3 byte 0x01 (bz2 format) 8798>3 byte 0x02 (gz format) 8799>3 byte 0x03 (lzo format) 8800>3 byte 0x04 (xor format) 8801>3 byte >0x04 (unknown format) 8802>4 long x uncompressed size: %d 8803 8804#------------------------------------------------------------------------------ 8805# $File: games,v 1.13 2012/02/13 22:50:50 christos Exp $ 8806# games: file(1) for games 8807 8808# Fabio Bonelli <fabiobonelli@libero.it> 8809# Quake II - III data files 88100 string IDP2 Quake II 3D Model file, 8811>20 long x %lu skin(s), 8812>8 long x (%lu x 8813>12 long x %lu), 8814>40 long x %lu frame(s), 8815>16 long x Frame size %lu bytes, 8816>24 long x %lu vertices/frame, 8817>28 long x %lu texture coordinates, 8818>32 long x %lu triangles/frame 8819 88200 string IBSP Quake 8821>4 long 0x26 II Map file (BSP) 8822>4 long 0x2E III Map file (BSP) 8823 88240 string IDS2 Quake II SP2 sprite file 8825 8826#--------------------------------------------------------------------------- 8827# Doom and Quake 8828# submitted by Nicolas Patrois 8829 88300 string \xcb\x1dBoom\xe6\xff\x03\x01 Boom or linuxdoom demo 8831# some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01 8832 883324 string LxD\ 203 Linuxdoom save 8834>0 string x , name=%s 8835>44 string x , world=%s 8836 8837# Quake 8838 88390 string PACK Quake I or II world or extension 8840>8 lelong >0 \b, %d entries 8841 8842#0 string -1\x0a Quake I demo 8843#>30 string x version %.4s 8844#>61 string x level %s 8845 8846#0 string 5\x0a Quake I save 8847 8848# The levels 8849 8850# Quake 1 8851 88520 string 5\x0aIntroduction Quake I save: start Introduction 88530 string 5\x0athe_Slipgate_Complex Quake I save: e1m1 The slipgate complex 88540 string 5\x0aCastle_of_the_Damned Quake I save: e1m2 Castle of the damned 88550 string 5\x0athe_Necropolis Quake I save: e1m3 The necropolis 88560 string 5\x0athe_Grisly_Grotto Quake I save: e1m4 The grisly grotto 88570 string 5\x0aZiggurat_Vertigo Quake I save: e1m8 Ziggurat vertigo (secret) 88580 string 5\x0aGloom_Keep Quake I save: e1m5 Gloom keep 88590 string 5\x0aThe_Door_To_Chthon Quake I save: e1m6 The door to Chthon 88600 string 5\x0aThe_House_of_Chthon Quake I save: e1m7 The house of Chthon 88610 string 5\x0athe_Installation Quake I save: e2m1 The installation 88620 string 5\x0athe_Ogre_Citadel Quake I save: e2m2 The ogre citadel 88630 string 5\x0athe_Crypt_of_Decay Quake I save: e2m3 The crypt of decay (dopefish lives!) 88640 string 5\x0aUnderearth Quake I save: e2m7 Underearth (secret) 88650 string 5\x0athe_Ebon_Fortress Quake I save: e2m4 The ebon fortress 88660 string 5\x0athe_Wizard's_Manse Quake I save: e2m5 The wizard's manse 88670 string 5\x0athe_Dismal_Oubliette Quake I save: e2m6 The dismal oubliette 88680 string 5\x0aTermination_Central Quake I save: e3m1 Termination central 88690 string 5\x0aVaults_of_Zin Quake I save: e3m2 Vaults of Zin 88700 string 5\x0athe_Tomb_of_Terror Quake I save: e3m3 The tomb of terror 88710 string 5\x0aSatan's_Dark_Delight Quake I save: e3m4 Satan's dark delight 88720 string 5\x0athe_Haunted_Halls Quake I save: e3m7 The haunted halls (secret) 88730 string 5\x0aWind_Tunnels Quake I save: e3m5 Wind tunnels 88740 string 5\x0aChambers_of_Torment Quake I save: e3m6 Chambers of torment 88750 string 5\x0athe_Sewage_System Quake I save: e4m1 The sewage system 88760 string 5\x0aThe_Tower_of_Despair Quake I save: e4m2 The tower of despair 88770 string 5\x0aThe_Elder_God_Shrine Quake I save: e4m3 The elder god shrine 88780 string 5\x0athe_Palace_of_Hate Quake I save: e4m4 The palace of hate 88790 string 5\x0aHell's_Atrium Quake I save: e4m5 Hell's atrium 88800 string 5\x0athe_Nameless_City Quake I save: e4m8 The nameless city (secret) 88810 string 5\x0aThe_Pain_Maze Quake I save: e4m6 The pain maze 88820 string 5\x0aAzure_Agony Quake I save: e4m7 Azure agony 88830 string 5\x0aShub-Niggurath's_Pit Quake I save: end Shub-Niggurath's pit 8884 8885# Quake DeathMatch levels 8886 88870 string 5\x0aPlace_of_Two_Deaths Quake I save: dm1 Place of two deaths 88880 string 5\x0aClaustrophobopolis Quake I save: dm2 Claustrophobopolis 88890 string 5\x0aThe_Abandoned_Base Quake I save: dm3 The abandoned base 88900 string 5\x0aThe_Bad_Place Quake I save: dm4 The bad place 88910 string 5\x0aThe_Cistern Quake I save: dm5 The cistern 88920 string 5\x0aThe_Dark_Zone Quake I save: dm6 The dark zone 8893 8894# Scourge of Armagon 8895 88960 string 5\x0aCommand_HQ Quake I save: start Command HQ 88970 string 5\x0aThe_Pumping_Station Quake I save: hip1m1 The pumping station 88980 string 5\x0aStorage_Facility Quake I save: hip1m2 Storage facility 88990 string 5\x0aMilitary_Complex Quake I save: hip1m5 Military complex (secret) 89000 string 5\x0athe_Lost_Mine Quake I save: hip1m3 The lost mine 89010 string 5\x0aResearch_Facility Quake I save: hip1m4 Research facility 89020 string 5\x0aAncient_Realms Quake I save: hip2m1 Ancient realms 89030 string 5\x0aThe_Gremlin's_Domain Quake I save: hip2m6 The gremlin's domain (secret) 89040 string 5\x0aThe_Black_Cathedral Quake I save: hip2m2 The black cathedral 89050 string 5\x0aThe_Catacombs Quake I save: hip2m3 The catacombs 89060 string 5\x0athe_Crypt__ Quake I save: hip2m4 The crypt 89070 string 5\x0aMortum's_Keep Quake I save: hip2m5 Mortum's keep 89080 string 5\x0aTur_Torment Quake I save: hip3m1 Tur torment 89090 string 5\x0aPandemonium Quake I save: hip3m2 Pandemonium 89100 string 5\x0aLimbo Quake I save: hip3m3 Limbo 89110 string 5\x0athe_Edge_of_Oblivion Quake I save: hipdm1 The edge of oblivion (secret) 89120 string 5\x0aThe_Gauntlet Quake I save: hip3m4 The gauntlet 89130 string 5\x0aArmagon's_Lair Quake I save: hipend Armagon's lair 8914 8915# Malice 8916 89170 string 5\x0aThe_Academy Quake I save: start The academy 89180 string 5\x0aThe_Lab Quake I save: d1 The lab 89190 string 5\x0aArea_33 Quake I save: d1b Area 33 89200 string 5\x0aSECRET_MISSIONS Quake I save: d3b Secret missions 89210 string 5\x0aThe_Hospital Quake I save: d10 The hospital (secret) 89220 string 5\x0aThe_Genetics_Lab Quake I save: d11 The genetics lab (secret) 89230 string 5\x0aBACK_2_MALICE Quake I save: d4b Back to Malice 89240 string 5\x0aArea44 Quake I save: d1c Area 44 89250 string 5\x0aTakahiro_Towers Quake I save: d2 Takahiro towers 89260 string 5\x0aA_Rat's_Life Quake I save: d3 A rat's life 89270 string 5\x0aInto_The_Flood Quake I save: d4 Into the flood 89280 string 5\x0aThe_Flood Quake I save: d5 The flood 89290 string 5\x0aNuclear_Plant Quake I save: d6 Nuclear plant 89300 string 5\x0aThe_Incinerator_Plant Quake I save: d7 The incinerator plant 89310 string 5\x0aThe_Foundry Quake I save: d7b The foundry 89320 string 5\x0aThe_Underwater_Base Quake I save: d8 The underwater base 89330 string 5\x0aTakahiro_Base Quake I save: d9 Takahiro base 89340 string 5\x0aTakahiro_Laboratories Quake I save: d12 Takahiro laboratories 89350 string 5\x0aStayin'_Alive Quake I save: d13 Stayin' alive 89360 string 5\x0aB.O.S.S._HQ Quake I save: d14 B.O.S.S. HQ 89370 string 5\x0aSHOWDOWN! Quake I save: d15 Showdown! 8938 8939# Malice DeathMatch levels 8940 89410 string 5\x0aThe_Seventh_Precinct Quake I save: ddm1 The seventh precinct 89420 string 5\x0aSub_Station Quake I save: ddm2 Sub station 89430 string 5\x0aCrazy_Eights! Quake I save: ddm3 Crazy eights! 89440 string 5\x0aEast_Side_Invertationa Quake I save: ddm4 East side invertationa 89450 string 5\x0aSlaughterhouse Quake I save: ddm5 Slaughterhouse 89460 string 5\x0aDOMINO Quake I save: ddm6 Domino 89470 string 5\x0aSANDRA'S_LADDER Quake I save: ddm7 Sandra's ladder 8948 8949 89500 string MComprHD MAME CHD compressed hard disk image, 8951>12 belong x version %lu 8952 8953# doom - submitted by Jon Dowland 8954 89550 string =IWAD doom main IWAD data 8956>4 lelong x containing %d lumps 89570 string =PWAD doom patch PWAD data 8958>4 lelong x containing %d lumps 8959 8960# Build engine group files (Duke Nukem, Shadow Warrior, ...) 8961# Extension: .grp 8962# Created by: "Ganael Laplanche" <ganael.laplanche@martymac.org> 89630 string KenSilverman Build engine group file 8964>12 lelong x containing %d files 8965 8966# Summary: Warcraft 3 save 8967# Extension: .w3g 8968# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com> 89690 string Warcraft\ III\ recorded\ game %s 8970 8971 8972# Summary: Warcraft 3 map 8973# Extension: .w3m 8974# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com> 89750 string HM3W Warcraft III map file 8976 8977 8978# Summary: SGF Smart Game Format 8979# Extension: .sgf 8980# Reference: http://www.red-bean.com/sgf/ 8981# Created by: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar> 8982# Modified by (1): Abel Cheung (regex, more game format) 8983# FIXME: Some games don't have GM (game type) 89840 regex \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format 8985>2 search/0x200/b GM[ 8986>>&0 string 1] (Go) 8987>>&0 string 2] (Othello) 8988>>&0 string 3] (chess) 8989>>&0 string 4] (Gomoku+Renju) 8990>>&0 string 5] (Nine Men's Morris) 8991>>&0 string 6] (Backgammon) 8992>>&0 string 7] (Chinese chess) 8993>>&0 string 8] (Shogi) 8994>>&0 string 9] (Lines of Action) 8995>>&0 string 10] (Ataxx) 8996>>&0 string 11] (Hex) 8997>>&0 string 12] (Jungle) 8998>>&0 string 13] (Neutron) 8999>>&0 string 14] (Philosopher's Football) 9000>>&0 string 15] (Quadrature) 9001>>&0 string 16] (Trax) 9002>>&0 string 17] (Tantrix) 9003>>&0 string 18] (Amazons) 9004>>&0 string 19] (Octi) 9005>>&0 string 20] (Gess) 9006>>&0 string 21] (Twixt) 9007>>&0 string 22] (Zertz) 9008>>&0 string 23] (Plateau) 9009>>&0 string 24] (Yinsh) 9010>>&0 string 25] (Punct) 9011>>&0 string 26] (Gobblet) 9012>>&0 string 27] (hive) 9013>>&0 string 28] (Exxit) 9014>>&0 string 29] (Hnefatal) 9015>>&0 string 30] (Kuba) 9016>>&0 string 31] (Tripples) 9017>>&0 string 32] (Chase) 9018>>&0 string 33] (Tumbling Down) 9019>>&0 string 34] (Sahara) 9020>>&0 string 35] (Byte) 9021>>&0 string 36] (Focus) 9022>>&0 string 37] (Dvonn) 9023>>&0 string 38] (Tamsk) 9024>>&0 string 39] (Gipf) 9025>>&0 string 40] (Kropki) 9026 9027############################################## 9028# NetImmerse/Gamebryo game engine entries 9029 9030# Summary: Gamebryo game engine file 9031# Extension: .nif, .kf 9032# Created by: Abel Cheung <abelcheung@gmail.com> 90330 string Gamebryo\ File\ Format,\ Version\ Gamebryo game engine file 9034>&0 regex [0-9a-z.]+ \b, version %s 9035 9036# Summary: Gamebryo game engine file 9037# Extension: .kfm 9038# Created by: Abel Cheung <abelcheung@gmail.com> 90390 string ;Gamebryo\ KFM\ File\ Version\ Gamebryo game engine animation File 9040>&0 regex [0-9a-z.]+ \b, version %s 9041 9042# Summary: NetImmerse game engine file 9043# Extension .nif 9044# Created by: Abel Cheung <abelcheung@gmail.com> 90450 string NetImmerse\ File\ Format,\ Versio 9046>&0 string n\ NetImmerse game engine file 9047>>&0 regex [0-9a-z.]+ \b, version %s 9048 9049# Type: SGF Smart Game Format 9050# URL: http://www.red-bean.com/sgf/ 9051# From: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar> 90522 regex/c \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format 9053>2 regex/c GM\\[1\\] - Go Game 9054>2 regex/c GM\\[6\\] - BackGammon Game 9055>2 regex/c GM\\[11\\] - Hex Game 9056>2 regex/c GM\\[18\\] - Amazons Game 9057>2 regex/c GM\\[19\\] - Octi Game 9058>2 regex/c GM\\[20\\] - Gess Game 9059>2 regex/c GM\\[21\\] - twix Game 9060 9061# Epic Games/Unreal Engine Package 9062# 90630 lelong 0x9E2A83C1 Unreal Engine Package, 9064>4 leshort x version: %i 9065>12 lelong !0 \b, names: %i 9066>28 lelong !0 \b, imports: %i 9067>20 lelong !0 \b, exports: %i 9068 9069#------------------------------------------------------------------------------ 9070# $File: gcc,v 1.4 2009/09/19 16:28:09 christos Exp $ 9071# gcc: file(1) magic for GCC special files 9072# 90730 string gpch GCC precompiled header 9074 9075# The version field is annoying. It's 3 characters, not zero-terminated. 9076>5 byte x (version %c 9077>6 byte x \b%c 9078>7 byte x \b%c) 9079 9080# 67 = 'C', 111 = 'o', 43 = '+', 79 = 'O' 9081>4 byte 67 for C 9082>4 byte 111 for Objective C 9083>4 byte 43 for C++ 9084>4 byte 79 for Objective C++ 9085 9086#------------------------------------------------------------------------------ 9087# $File: geo,v 1.3 2013/01/04 00:47:02 christos Exp $ 9088# Geo- files from Kurt Schwehr <schwehr@ccom.unh.edu> 9089 9090###################################################################### 9091# 9092# Acoustic Doppler Current Profilers (ADCP) 9093# 9094###################################################################### 9095 90960 beshort 0x7f7f RDI Acoustic Doppler Current Profiler (ADCP) 9097 9098###################################################################### 9099# 9100# Metadata 9101# 9102###################################################################### 9103 91040 string Identification_Information FGDC ASCII metadata 9105 9106###################################################################### 9107# 9108# Seimsic / Subbottom 9109# 9110###################################################################### 9111 9112# Knudsen subbottom chirp profiler - Binary File Format: B9 9113# KEB D409-03167 V1.75 Huffman 91140 string KEB\ Knudsen seismic KEL binary (KEB) - 9115>4 regex [-A-Z0-9]* Software: %s 9116>>&1 regex V[0-9]*\.[0-9]* version %s 9117 9118###################################################################### 9119# 9120# LIDAR - Laser altimetry or bathy 9121# 9122###################################################################### 9123 9124 9125# Caris LIDAR format for LADS comes as two parts... ascii location file and binary waveform data 91260 string HCA LADS Caris Ascii Format (CAF) bathymetric lidar 9127>4 regex [0-9]*\.[0-9]* version %s 9128 91290 string HCB LADS Caris Binary Format (CBF) bathymetric lidar waveform data 9130>3 byte x version %d . 9131>4 byte x %d 9132 9133 9134###################################################################### 9135# 9136# MULTIBEAM SONARS http://www.ldeo.columbia.edu/res/pi/MB-System/formatdoc/ 9137# 9138###################################################################### 9139 9140# GeoAcoustics - GeoSwath Plus 91414 beshort 0x2002 GeoSwath RDF 91420 string Start:- GeoSwatch auf text file 9143 9144# Seabeam 2100 9145# mbsystem code mb41 91460 string SB2100 SeaBeam 2100 multibeam sonar 91470 string SB2100DR SeaBeam 2100 DR multibeam sonar 91480 string SB2100PR SeaBeam 2100 PR multibeam sonar 9149 9150# This corresponds to MB-System format 94, L-3/ELAC/SeaBeam XSE vendor 9151# format. It is the format of our upgraded SeaBeam 2112 on R/V KNORR. 91520 string $HSF XSE multibeam 9153 9154# mb121 http://www.saic.com/maritime/gsf/ 91558 string GSF-v SAIC generic sensor format (GSF) sonar data, 9156>&0 regex [0-9]*\.[0-9]* version %s 9157 9158# MGD77 - http://www.ngdc.noaa.gov/mgg/dat/geodas/docs/mgd77.htm 9159# mb161 91609 string MGD77 MGD77 Header, Marine Geophysical Data Exchange Format 9161 9162# MBSystem processing caches the mbinfo output 91631 string Swath\ Data\ File: mbsystem info cache 9164 9165# Caris John Hughes Clark format 91660 string HDCS Caris multibeam sonar related data 91671 string Start/Stop\ parameter\ header: Caris ASCII project summary 9168 9169###################################################################### 9170# 9171# Visualization and 3D modeling 9172# 9173###################################################################### 9174 9175# IVS - IVS3d.com Tagged Data Represetation 91760 string %%\ TDR\ 2.0 IVS Fledermaus TDR file 9177 9178# http://www.ecma-international.org/publications/standards/Ecma-363.htm 9179# 3D in PDFs 91800 string U3D ECMA-363, Universal 3D 9181 9182###################################################################### 9183# 9184# Support files 9185# 9186###################################################################### 9187 9188# https://midas.psi.ch/elog/ 91890 string $@MID@$ elog journal entry 9190 9191# Geospatial Designs http://www.geospatialdesigns.com/surfer6_format.htm 91920 string DSBB Surfer 6 binary grid file 9193>4 leshort x \b, %d 9194>6 leshort x \bx%d 9195>8 ledouble x \b, minx=%g 9196>16 ledouble x \b, maxx=%g 9197>24 ledouble x \b, miny=%g 9198>32 ledouble x \b, maxy=%g 9199>40 ledouble x \b, minz=%g 9200>48 ledouble x \b, maxz=%g 9201 9202 9203#------------------------------------------------------------------------------ 9204# $File: geos,v 1.4 2009/09/19 16:28:09 christos Exp $ 9205# GEOS files (Vidar Madsen, vidar@gimp.org) 9206# semi-commonly used in embedded and handheld systems. 92070 belong 0xc745c153 GEOS 9208>40 byte 1 executable 9209>40 byte 2 VMFile 9210>40 byte 3 binary 9211>40 byte 4 directory label 9212>40 byte <1 unknown 9213>40 byte >4 unknown 9214>4 string >\0 \b, name "%s" 9215#>44 short x \b, version %d 9216#>46 short x \b.%d 9217#>48 short x \b, rev %d 9218#>50 short x \b.%d 9219#>52 short x \b, proto %d 9220#>54 short x \br%d 9221#>168 string >\0 \b, copyright "%s" 9222 9223#------------------------------------------------------------------------------ 9224# $File: gimp,v 1.8 2013/12/21 14:29:45 christos Exp $ 9225# GIMP Gradient: file(1) magic for the GIMP's gradient data files (.ggr) 9226# by Federico Mena <federico@nuclecu.unam.mx> 9227 92280 string/t GIMP\ Gradient GIMP gradient data 9229 9230# GIMP palette (.gpl) 9231# From: Markus Heidelberg <markus.heidelberg@web.de> 92320 string/t GIMP\ Palette GIMP palette data 9233 9234#------------------------------------------------------------------------------ 9235# XCF: file(1) magic for the XCF image format used in the GIMP (.xcf) developed 9236# by Spencer Kimball and Peter Mattis 9237# ('Bucky' LaDieu, nega@vt.edu) 9238 92390 string gimp\ xcf GIMP XCF image data, 9240!:mime image/x-xcf 9241>9 string file version 0, 9242>9 string v version 9243>>10 string >\0 %s, 9244>14 belong x %lu x 9245>18 belong x %lu, 9246>22 belong 0 RGB Color 9247>22 belong 1 Greyscale 9248>22 belong 2 Indexed Color 9249>22 belong >2 Unknown Image Type. 9250 9251#------------------------------------------------------------------------------ 9252# XCF: file(1) magic for the patterns used in the GIMP (.pat), developed 9253# by Spencer Kimball and Peter Mattis 9254# ('Bucky' LaDieu, nega@vt.edu) 9255 925620 string GPAT GIMP pattern data, 9257>24 string x %s 9258 9259#------------------------------------------------------------------------------ 9260# XCF: file(1) magic for the brushes used in the GIMP (.gbr), developed 9261# by Spencer Kimball and Peter Mattis 9262# ('Bucky' LaDieu, nega@vt.edu) 9263 926420 string GIMP GIMP brush data 9265 9266# GIMP Curves File 9267# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 92680 string #\040GIMP\040Curves\040File GIMP curve file 9269 9270#------------------------------------------------------------------------------ 9271# $File: gnome,v 1.3 2013/02/05 15:20:47 christos Exp $ 9272# GNOME related files 9273 9274# Contributed by Josh Triplett 9275# FIXME: Could be simplified if pstring supported two-byte counts 92760 string GnomeKeyring\n\r\0\n GNOME keyring 9277>&0 ubyte 0 \b, major version 0 9278>>&0 ubyte 0 \b, minor version 0 9279>>>&0 ubyte 0 \b, crypto type 0 (AES) 9280>>>&0 ubyte >0 \b, crypto type %hhu (unknown) 9281>>>&1 ubyte 0 \b, hash type 0 (MD5) 9282>>>&1 ubyte >0 \b, hash type %hhu (unknown) 9283>>>&2 ubelong 0xFFFFFFFF \b, name NULL 9284>>>&2 ubelong !0xFFFFFFFF 9285>>>>&-4 ubelong >255 \b, name too long for file's pstring type 9286>>>>&-4 ubelong <256 9287>>>>>&-1 pstring x \b, name "%s" 9288>>>>>>&0 ubeqdate x \b, last modified %s 9289>>>>>>&8 ubeqdate x \b, created %s 9290>>>>>>&16 ubelong &1 9291>>>>>>>&0 ubelong x \b, locked if idle for %u seconds 9292>>>>>>&16 ubelong ^1 \b, not locked if idle 9293>>>>>>&24 ubelong x \b, hash iterations %u 9294>>>>>>&28 ubequad x \b, salt %llu 9295>>>>>>&52 ubelong x \b, %u item(s) 9296 9297# From: Alex Beregszaszi <alex@fsn.hu> 92984 string gtktalog GNOME Catalogue (gtktalog) 9299>13 string >\0 version %s 9300 9301# Summary: GStreamer binary registry 9302# Extension: .bin 9303# Submitted by: Josh Triplett <josh@joshtriplett.org> 93040 belong 0xc0def00d GStreamer binary registry 9305>4 string x \b, version %s 9306 9307# GVariant Database file 9308# By Elan Ruusamae <glen@delfi.ee> 9309# https://github.com/GNOME/gvdb/blob/master/gvdb-format.h 9310# It's always "GVariant", it's byte swapped on incompatible archs 9311# See https://github.com/GNOME/gvdb/blob/master/gvdb-builder.c 9312# file_builder_serialise() 9313# http://developer.gnome.org/glib/2.34/glib-GVariant.html#GVariant 93140 string GVariant GVariant Database file, 9315# version is never filled. probably future extension 9316>8 lelong x version %d 9317# not sure are these usable, so commented out 9318#>>16 lelong x start %d, 9319#>>>20 lelong x end %d 9320 9321# G-IR database made by gobject-introspect toolset, 9322# http://live.gnome.org/GObjectIntrospection 93230 string GOBJ\nMETADATA\r\n\032 G-IR binary database 9324>16 byte x \b, v%d 9325>17 byte x \b.%d 9326>20 leshort x \b, %d entries 9327>22 leshort x \b/%d local 9328 9329#------------------------------------------------------------------------------ 9330# $File: gnu,v 1.15 2014/02/06 14:21:02 christos Exp $ 9331# gnu: file(1) magic for various GNU tools 9332# 9333# GNU nlsutils message catalog file format 9334# 9335# GNU message catalog (.mo and .gmo files) 9336 93370 string \336\22\4\225 GNU message catalog (little endian), 9338>6 leshort x revision %d. 9339>4 leshort >0 \b%d, 9340>>8 lelong x %d messages, 9341>>36 lelong x %d sysdep messages 9342>4 leshort =0 \b%d, 9343>>8 lelong x %d messages 9344 93450 string \225\4\22\336 GNU message catalog (big endian), 9346>4 beshort x revision %d. 9347>6 beshort >0 \b%d, 9348>>8 belong x %d messages, 9349>>36 belong x %d sysdep messages 9350>6 beshort =0 \b%d, 9351>>8 belong x %d messages 9352 9353 9354# GnuPG 9355# The format is very similar to pgp 93560 string \001gpg GPG key trust database 9357>4 byte x version %d 9358# Note: magic.mime had 0x8501 for the next line instead of 0x8502 93590 beshort 0x8502 GPG encrypted data 9360!:mime text/PGP # encoding: data 9361 9362# This magic is not particularly good, as the keyrings don't have true 9363# magic. Nevertheless, it covers many keyrings. 93640 beshort 0x9901 GPG key public ring 9365!:mime application/x-gnupg-keyring 9366 9367# Symmetric encryption 93680 leshort 0x0d8c 9369>4 leshort 0x0203 9370>>2 leshort 0x0204 GPG symmetrically encrypted data (3DES cipher) 9371>>2 leshort 0x0304 GPG symmetrically encrypted data (CAST5 cipher) 9372>>2 leshort 0x0404 GPG symmetrically encrypted data (BLOWFISH cipher) 9373>>2 leshort 0x0704 GPG symmetrically encrypted data (AES cipher) 9374>>2 leshort 0x0804 GPG symmetrically encrypted data (AES192 cipher) 9375>>2 leshort 0x0904 GPG symmetrically encrypted data (AES256 cipher) 9376>>2 leshort 0x0a04 GPG symmetrically encrypted data (TWOFISH cipher) 9377>>2 leshort 0x0b04 GPG symmetrically encrypted data (CAMELLIA128 cipher) 9378>>2 leshort 0x0c04 GPG symmetrically encrypted data (CAMELLIA192 cipher) 9379>>2 leshort 0x0d04 GPG symmetrically encrypted data (CAMELLIA256 cipher) 9380 9381 9382# GnuPG Keybox file 9383# <http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=kbx/keybox-blob.c;hb=HEAD> 9384# From: Philipp Hahn <hahn@univention.de> 93850 belong 32 9386>4 byte 1 9387>>8 string KBXf GPG keybox database 9388>>>5 byte 1 version %d 9389>>>16 bedate x \b, created-at %s 9390>>>20 bedate x \b, last-maintained %s 9391 9392 9393# Gnumeric spreadsheet 9394# This entry is only semi-helpful, as Gnumeric compresses its files, so 9395# they will ordinarily reported as "compressed", but at least -z helps 939639 string =<gmr:Workbook Gnumeric spreadsheet 9397 9398# From: James Youngman <jay@gnu.org> 9399# gnu find magic 94000 string \0LOCATE GNU findutils locate database data 9401>7 string >\0 \b, format %s 9402>7 string 02 \b (frcode) 9403 9404# Files produced by GNU gettext 94050 long 0xDE120495 GNU-format message catalog data 94060 long 0x950412DE GNU-format message catalog data 9407 9408# gettext message catalogue 94090 regex \^msgid\ GNU gettext message catalogue text 9410!:mime text/x-po 9411 9412#------------------------------------------------------------------------------ 9413# $File: gnumeric,v 1.4 2009/09/19 16:28:09 christos Exp $ 9414# gnumeric: file(1) magic for Gnumeric spreadsheet 9415# This entry is only semi-helpful, as Gnumeric compresses its files, so 9416# they will ordinarily reported as "compressed", but at least -z helps 941739 string =<gmr:Workbook Gnumeric spreadsheet 9418!:mime application/x-gnumeric 9419 9420#------------------------------------------------------------------------------ 9421# $File: gpt,v 1.1 2013/02/18 18:31:09 christos Exp $ 9422# 9423# GPT Partition table patterns. 9424# Author: Rogier Goossens (goossens.rogier@gmail.com) 9425# Note that a GPT-formatted disk must contain an MBR as well. 9426# 9427 9428# The initial segment (up to >>>>>>>>422) was copied from the X86 9429# partition table code (aka MBR). 9430# This is kept separate, so that MBR partitions are not reported as well. 9431# (use -k if you do want them as well) 9432 9433# First, detect the MBR partiton table 9434# If more than one GPT protective MBR partition exists, don't print anything 9435# (the other MBR detection code will then just print the MBR partition table) 94360x1FE leshort 0xAA55 9437>3 string !MS 9438>>3 string !SYSLINUX 9439>>>3 string !MTOOL 9440>>>>3 string !NEWLDR 9441>>>>>5 string !DOS 9442# not FAT (32 bit) 9443>>>>>>82 string !FAT32 9444#not Linux kernel 9445>>>>>>>514 string !HdrS 9446#not BeOS 9447>>>>>>>>422 string !Be\ Boot\ Loader 9448# GPT with protective MBR entry in partition 1 (only) 9449>>>>>>>>>450 ubyte 0xee 9450>>>>>>>>>>466 ubyte !0xee 9451>>>>>>>>>>>482 ubyte !0xee 9452>>>>>>>>>>>>498 ubyte !0xee 9453#>>>>>>>>>>>>>446 use gpt-mbr-partition 9454>>>>>>>>>>>>>(454.l*8192) string EFI\ PART GPT partition table 9455>>>>>>>>>>>>>>0 use gpt-mbr-type 9456>>>>>>>>>>>>>>&-8 use gpt-table 9457>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 9458>>>>>>>>>>>>>(454.l*8192) string !EFI\ PART 9459>>>>>>>>>>>>>>(454.l*4096) string EFI\ PART GPT partition table 9460>>>>>>>>>>>>>>>0 use gpt-mbr-type 9461>>>>>>>>>>>>>>>&-8 use gpt-table 9462>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 9463>>>>>>>>>>>>>>(454.l*4096) string !EFI\ PART 9464>>>>>>>>>>>>>>>(454.l*2048) string EFI\ PART GPT partition table 9465>>>>>>>>>>>>>>>>0 use gpt-mbr-type 9466>>>>>>>>>>>>>>>>&-8 use gpt-table 9467>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 9468>>>>>>>>>>>>>>>(454.l*2048) string !EFI\ PART 9469>>>>>>>>>>>>>>>>(454.l*1024) string EFI\ PART GPT partition table 9470>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 9471>>>>>>>>>>>>>>>>>&-8 use gpt-table 9472>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 9473>>>>>>>>>>>>>>>>(454.l*1024) string !EFI\ PART 9474>>>>>>>>>>>>>>>>>(454.l*512) string EFI\ PART GPT partition table 9475>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 9476>>>>>>>>>>>>>>>>>>&-8 use gpt-table 9477>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 9478# GPT with protective MBR entry in partition 2 (only) 9479>>>>>>>>>450 ubyte !0xee 9480>>>>>>>>>>466 ubyte 0xee 9481>>>>>>>>>>>482 ubyte !0xee 9482>>>>>>>>>>>>498 ubyte !0xee 9483#>>>>>>>>>>>>>462 use gpt-mbr-partition 9484>>>>>>>>>>>>>(470.l*8192) string EFI\ PART GPT partition table 9485>>>>>>>>>>>>>>0 use gpt-mbr-type 9486>>>>>>>>>>>>>>&-8 use gpt-table 9487>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 9488>>>>>>>>>>>>>(470.l*8192) string !EFI\ PART 9489>>>>>>>>>>>>>>(470.l*4096) string EFI\ PART GPT partition table 9490>>>>>>>>>>>>>>>0 use gpt-mbr-type 9491>>>>>>>>>>>>>>>&-8 use gpt-table 9492>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 9493>>>>>>>>>>>>>>(470.l*4096) string !EFI\ PART 9494>>>>>>>>>>>>>>>(470.l*2048) string EFI\ PART GPT partition table 9495>>>>>>>>>>>>>>>>0 use gpt-mbr-type 9496>>>>>>>>>>>>>>>>&-8 use gpt-table 9497>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 9498>>>>>>>>>>>>>>>(470.l*2048) string !EFI\ PART 9499>>>>>>>>>>>>>>>>(470.l*1024) string EFI\ PART GPT partition table 9500>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 9501>>>>>>>>>>>>>>>>>&-8 use gpt-table 9502>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 9503>>>>>>>>>>>>>>>>(470.l*1024) string !EFI\ PART 9504>>>>>>>>>>>>>>>>>(470.l*512) string EFI\ PART GPT partition table 9505>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 9506>>>>>>>>>>>>>>>>>>&-8 use gpt-table 9507>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 9508# GPT with protective MBR entry in partition 3 (only) 9509>>>>>>>>>450 ubyte !0xee 9510>>>>>>>>>>466 ubyte !0xee 9511>>>>>>>>>>>482 ubyte 0xee 9512>>>>>>>>>>>>498 ubyte !0xee 9513#>>>>>>>>>>>>>478 use gpt-mbr-partition 9514>>>>>>>>>>>>>(486.l*8192) string EFI\ PART GPT partition table 9515>>>>>>>>>>>>>>0 use gpt-mbr-type 9516>>>>>>>>>>>>>>&-8 use gpt-table 9517>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 9518>>>>>>>>>>>>>(486.l*8192) string !EFI\ PART 9519>>>>>>>>>>>>>>(486.l*4096) string EFI\ PART GPT partition table 9520>>>>>>>>>>>>>>>0 use gpt-mbr-type 9521>>>>>>>>>>>>>>>&-8 use gpt-table 9522>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 9523>>>>>>>>>>>>>>(486.l*4096) string !EFI\ PART 9524>>>>>>>>>>>>>>>(486.l*2048) string EFI\ PART GPT partition table 9525>>>>>>>>>>>>>>>>0 use gpt-mbr-type 9526>>>>>>>>>>>>>>>>&-8 use gpt-table 9527>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 9528>>>>>>>>>>>>>>>(486.l*2048) string !EFI\ PART 9529>>>>>>>>>>>>>>>>(486.l*1024) string EFI\ PART GPT partition table 9530>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 9531>>>>>>>>>>>>>>>>>&-8 use gpt-table 9532>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 9533>>>>>>>>>>>>>>>>(486.l*1024) string !EFI\ PART 9534>>>>>>>>>>>>>>>>>(486.l*512) string EFI\ PART GPT partition table 9535>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 9536>>>>>>>>>>>>>>>>>>&-8 use gpt-table 9537>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 9538# GPT with protective MBR entry in partition 4 (only) 9539>>>>>>>>>450 ubyte !0xee 9540>>>>>>>>>>466 ubyte !0xee 9541>>>>>>>>>>>482 ubyte !0xee 9542>>>>>>>>>>>>498 ubyte 0xee 9543#>>>>>>>>>>>>>494 use gpt-mbr-partition 9544>>>>>>>>>>>>>(502.l*8192) string EFI\ PART GPT partition table 9545>>>>>>>>>>>>>>0 use gpt-mbr-type 9546>>>>>>>>>>>>>>&-8 use gpt-table 9547>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 9548>>>>>>>>>>>>>(502.l*8192) string !EFI\ PART 9549>>>>>>>>>>>>>>(502.l*4096) string EFI\ PART GPT partition table 9550>>>>>>>>>>>>>>>0 use gpt-mbr-type 9551>>>>>>>>>>>>>>>&-8 use gpt-table 9552>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 9553>>>>>>>>>>>>>>(502.l*4096) string !EFI\ PART 9554>>>>>>>>>>>>>>>(502.l*2048) string EFI\ PART GPT partition table 9555>>>>>>>>>>>>>>>>0 use gpt-mbr-type 9556>>>>>>>>>>>>>>>>&-8 use gpt-table 9557>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 9558>>>>>>>>>>>>>>>(502.l*2048) string !EFI\ PART 9559>>>>>>>>>>>>>>>>(502.l*1024) string EFI\ PART GPT partition table 9560>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 9561>>>>>>>>>>>>>>>>>&-8 use gpt-table 9562>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 9563>>>>>>>>>>>>>>>>(502.l*1024) string !EFI\ PART 9564>>>>>>>>>>>>>>>>>(502.l*512) string EFI\ PART GPT partition table 9565>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 9566>>>>>>>>>>>>>>>>>>&-8 use gpt-table 9567>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 9568 9569# The following code does GPT detection and processing, including 9570# sector size detection. 9571# It has to be duplicated above because the top-level pattern 9572# (i.e. not called using 'use') must print *something* for file 9573# to count it as a match. Text only printed in named patterns is 9574# not counted, and causes file to continue, and try and match 9575# other patterns. 9576# 9577# Unfortunately, when assuming sector sizes >=16k, if the sector size 9578# happens to be 512 instead, we may find confusing data after the GPT 9579# table... If the GPT table has less than 128 entries, this may even 9580# happen for assumed sector sizes as small as 4k 9581# This could be solved by checking for the presence of the backup GPT 9582# header as well, but that makes the logic extremely complex 9583##0 name gpt-mbr-partition 9584##>(8.l*8192) string EFI\ PART 9585##>>(8.l*8192) use gpt-mbr-type 9586##>>&-8 use gpt-table 9587##>>0 ubyte x of 8192 bytes 9588##>(8.l*8192) string !EFI\ PART 9589##>>(8.l*4096) string EFI\ PART GPT partition table 9590##>>>0 use gpt-mbr-type 9591##>>>&-8 use gpt-table 9592##>>>0 ubyte x of 4096 bytes 9593##>>(8.l*4096) string !EFI\ PART 9594##>>>(8.l*2048) string EFI\ PART GPT partition table 9595##>>>>0 use gpt-mbr-type 9596##>>>>&-8 use gpt-table 9597##>>>>0 ubyte x of 2048 bytes 9598##>>>(8.l*2048) string !EFI\ PART 9599##>>>>(8.l*1024) string EFI\ PART GPT partition table 9600##>>>>>0 use gpt-mbr-type 9601##>>>>>&-8 use gpt-table 9602##>>>>>0 ubyte x of 1024 bytes 9603##>>>>(8.l*1024) string !EFI\ PART 9604##>>>>>(8.l*512) string EFI\ PART GPT partition table 9605##>>>>>>0 use gpt-mbr-type 9606##>>>>>>&-8 use gpt-table 9607##>>>>>>0 ubyte x of 512 bytes 9608 9609# Print details of MBR type for a GPT-disk 9610# Calling code ensures that there is only one 0xee partition. 96110 name gpt-mbr-type 9612# GPT with protective MBR entry in partition 1 9613>450 ubyte 0xee 9614>>454 ulelong 1 9615>>>462 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 9616>>454 ulelong !1 \b (nonstandard: not at LBA 1) 9617# GPT with protective MBR entry in partition 2 9618>466 ubyte 0xee 9619>>470 ulelong 1 9620>>>478 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 9621>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 9622>>>478 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 9623>>470 ulelong !1 \b (nonstandard: not at LBA 1) 9624# GPT with protective MBR entry in partition 3 9625>482 ubyte 0xee 9626>>486 ulelong 1 9627>>>494 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 9628>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 9629>>>494 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 9630>>486 ulelong !1 \b (nonstandard: not at LBA 1) 9631# GPT with protective MBR entry in partition 4 9632>498 ubyte 0xee 9633>>502 ulelong 1 9634>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 9635>>502 ulelong !1 \b (nonstandard: not at LBA 1) 9636 9637# Print the information from a GPT partition table structure 96380 name gpt-table 9639>10 uleshort x \b, version %u 9640>8 uleshort x \b.%u 9641# a GUID is just like a UUID, except it's displayed mixed-endian. 9642>56 ulelong x \b, GUID: %08x 9643>60 uleshort x \b-%04x 9644>62 uleshort x \b-%04x 9645>64 ubeshort x \b-%04x 9646>66 ubeshort x \b-%04x 9647>68 ubelong x \b%08x 9648#>80 uleshort x \b, %d partition entries 9649>32 ulequad+1 x \b, disk size: %lld sectors 9650 9651# In case a GPT data-structure is at LBA 0, report it as well 9652# This covers systems which are not GPT-aware, and which show 9653# and allow access to the protective partition. This code will 9654# detect the contents of such a partition. 96550 string EFI\ PART GPT data structure (nonstandard: at LBA 0) 9656>0 use gpt-table 9657>0 ubyte x (sector size unknown) 9658 9659 9660 9661#------------------------------------------------------------------------------ 9662# $File: grace,v 1.4 2009/09/19 16:28:09 christos Exp $ 9663# ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE 9664# 9665# ACE/gr binary 96660 string \000\000\0001\000\000\0000\000\000\0000\000\000\0002\000\000\0000\000\000\0000\000\000\0003 old ACE/gr binary file 9667>39 byte >0 - version %c 9668# ACE/gr ascii 96690 string #\ xvgr\ parameter\ file ACE/gr ascii file 96700 string #\ xmgr\ parameter\ file ACE/gr ascii file 96710 string #\ ACE/gr\ parameter\ file ACE/gr ascii file 9672# Grace projects 96730 string #\ Grace\ project\ file Grace project file 9674>23 string @version\ (version 9675>>32 byte >0 %c 9676>>33 string >\0 \b.%.2s 9677>>35 string >\0 \b.%.2s) 9678# ACE/gr fit description files 96790 string #\ ACE/gr\ fit\ description\ ACE/gr fit description file 9680# end of ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE 9681 9682#------------------------------------------------------------------------------ 9683# $File: graphviz,v 1.7 2009/09/19 16:28:09 christos Exp $ 9684# graphviz: file(1) magic for http://www.graphviz.org/ 9685 9686# FIXME: These patterns match too generally. For example, the first 9687# line matches a LaTeX file containing the word "graph" (with a { 9688# following later) and the second line matches this file. 9689#0 regex/100 [\r\n\t\ ]*graph[\r\n\t\ ]+.*\\{ graphviz graph text 9690#!:mime text/vnd.graphviz 9691#0 regex/100 [\r\n\t\ ]*digraph[\r\n\t\ ]+.*\\{ graphviz digraph text 9692#!:mime text/vnd.graphviz 9693 9694#------------------------------------------------------------------------------ 9695# $File: gringotts,v 1.5 2009/09/19 16:28:09 christos Exp $ 9696# gringotts: file(1) magic for Gringotts 9697# http://devel.pluto.linux.it/projects/Gringotts/ 9698# author: Germano Rizzo <mano@pluto.linux.it> 9699#GRG3????Y 97000 string GRG Gringotts data file 9701#file format 1 9702>3 string 1 v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9 9703#file format 2 9704>3 string 2 v.2, MCRYPT S2K, 9705>>8 byte&0x70 0x00 RIJNDAEL-128 crypt, 9706>>8 byte&0x70 0x10 SERPENT crypt, 9707>>8 byte&0x70 0x20 TWOFISH crypt, 9708>>8 byte&0x70 0x30 CAST-256 crypt, 9709>>8 byte&0x70 0x40 SAFER+ crypt, 9710>>8 byte&0x70 0x50 LOKI97 crypt, 9711>>8 byte&0x70 0x60 3DES crypt, 9712>>8 byte&0x70 0x70 RIJNDAEL-256 crypt, 9713>>8 byte&0x08 0x00 SHA1 hash, 9714>>8 byte&0x08 0x08 RIPEMD-160 hash, 9715>>8 byte&0x04 0x00 ZLib 9716>>8 byte&0x04 0x04 BZip2 9717>>8 byte&0x03 0x00 lvl.0 9718>>8 byte&0x03 0x01 lvl.3 9719>>8 byte&0x03 0x02 lvl.6 9720>>8 byte&0x03 0x03 lvl.9 9721#file format 3 9722>3 string 3 v.3, OpenPGP S2K, 9723>>8 byte&0x70 0x00 RIJNDAEL-128 crypt, 9724>>8 byte&0x70 0x10 SERPENT crypt, 9725>>8 byte&0x70 0x20 TWOFISH crypt, 9726>>8 byte&0x70 0x30 CAST-256 crypt, 9727>>8 byte&0x70 0x40 SAFER+ crypt, 9728>>8 byte&0x70 0x50 LOKI97 crypt, 9729>>8 byte&0x70 0x60 3DES crypt, 9730>>8 byte&0x70 0x70 RIJNDAEL-256 crypt, 9731>>8 byte&0x08 0x00 SHA1 hash, 9732>>8 byte&0x08 0x08 RIPEMD-160 hash, 9733>>8 byte&0x04 0x00 ZLib 9734>>8 byte&0x04 0x04 BZip2 9735>>8 byte&0x03 0x00 lvl.0 9736>>8 byte&0x03 0x01 lvl.3 9737>>8 byte&0x03 0x02 lvl.6 9738>>8 byte&0x03 0x03 lvl.9 9739#file format >3 9740>3 string >3 v.%.1s (unknown details) 9741 9742#------------------------------------------------------------------------------ 9743# $File: guile,v 1.1 2011/12/16 17:44:33 christos Exp $ 9744# Guile file magic from <dalepsmith@gmail.com> 9745# http://www.gnu.org/s/guile/ 9746# http://git.savannah.gnu.org/gitweb/?p=guile.git;f=libguile/_scm.h;hb=HEAD#l250 9747 97480 string GOOF---- Guile Object 9749>8 string LE \b, little endian 9750>8 string BE \b, big endian 9751>11 string 4 \b, 32bit 9752>11 string 8 \b, 64bit 9753>13 regex .\.. \b, bytecode v%s 9754 9755#------------------------------------------------------------------------------ 9756# $File: hitachi-sh,v 1.6 2013/01/29 19:31:33 christos Exp $ 9757# hitach-sh: file(1) magic for Hitachi Super-H 9758# 9759# Super-H COFF 9760# 9761# below test line conflicts with 2nd NTFS filesystem sector 97620 beshort 0x0500 Hitachi SH big-endian COFF 9763# 2nd NTFS filesystem sector often starts with 0x05004e00 for unicode string 5 NTLDR 9764#0 ubelong&0xFFFFNMPQ 0x0500NMPQ Hitachi SH big-endian COFF 9765>18 beshort&0x0002 =0x0000 object 9766>18 beshort&0x0002 =0x0002 executable 9767>18 beshort&0x0008 =0x0008 \b, stripped 9768>18 beshort&0x0008 =0x0000 \b, not stripped 9769# 97700 leshort 0x0550 Hitachi SH little-endian COFF 9771>18 leshort&0x0002 =0x0000 object 9772>18 leshort&0x0002 =0x0002 executable 9773>18 leshort&0x0008 =0x0008 \b, stripped 9774>18 leshort&0x0008 =0x0000 \b, not stripped 9775 9776 9777#------------------------------------------------------------------------------ 9778# $File: hp,v 1.23 2009/09/19 16:28:09 christos Exp $ 9779# hp: file(1) magic for Hewlett Packard machines (see also "printer") 9780# 9781# XXX - somebody should figure out whether any byte order needs to be 9782# applied to the "TML" stuff; I'm assuming the Apollo stuff is 9783# big-endian as it was mostly 68K-based. 9784# 9785# I think the 500 series was the old stack-based machines, running a 9786# UNIX environment atop the "SUN kernel"; dunno whether it was 9787# big-endian or little-endian. 9788# 9789# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based; 9790# hp300 are 68020+68881 based; hp400 are also 68k. The following basic 9791# HP magic is useful for reference, but using "long" magic is a better 9792# practice in order to avoid collisions. 9793# 9794# Guy Harris (guy@netapp.com): some additions to this list came from 9795# HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1, 9796# 1.2, and 2.0). The 1.2 and 2.0 stuff isn't in the HP-UX 10.0 9797# "/etc/magic", though, except for the "archive file relocatable library" 9798# stuff, and the 68030 and 68040 stuff isn't there at all - are they not 9799# used in executables, or have they just not yet updated "/etc/magic" 9800# completely? 9801# 9802# 0 beshort 200 hp200 (68010) BSD binary 9803# 0 beshort 300 hp300 (68020+68881) BSD binary 9804# 0 beshort 0x20c hp200/300 HP-UX binary 9805# 0 beshort 0x20d hp400 (68030) HP-UX binary 9806# 0 beshort 0x20e hp400 (68040?) HP-UX binary 9807# 0 beshort 0x20b PA-RISC1.0 HP-UX binary 9808# 0 beshort 0x210 PA-RISC1.1 HP-UX binary 9809# 0 beshort 0x211 PA-RISC1.2 HP-UX binary 9810# 0 beshort 0x214 PA-RISC2.0 HP-UX binary 9811 9812# 9813# The "misc" stuff needs a byte order; the archives look suspiciously 9814# like the old 177545 archives (0xff65 = 0177545). 9815# 9816#### Old Apollo stuff 98170 beshort 0627 Apollo m68k COFF executable 9818>18 beshort ^040000 not stripped 9819>22 beshort >0 - version %ld 98200 beshort 0624 apollo a88k COFF executable 9821>18 beshort ^040000 not stripped 9822>22 beshort >0 - version %ld 98230 long 01203604016 TML 0123 byte-order format 98240 long 01702407010 TML 1032 byte-order format 98250 long 01003405017 TML 2301 byte-order format 98260 long 01602007412 TML 3210 byte-order format 9827#### PA-RISC 1.1 98280 belong 0x02100106 PA-RISC1.1 relocatable object 98290 belong 0x02100107 PA-RISC1.1 executable 9830>168 belong &0x00000004 dynamically linked 9831>(144) belong 0x054ef630 dynamically linked 9832>96 belong >0 - not stripped 9833 98340 belong 0x02100108 PA-RISC1.1 shared executable 9835>168 belong&0x4 0x4 dynamically linked 9836>(144) belong 0x054ef630 dynamically linked 9837>96 belong >0 - not stripped 9838 98390 belong 0x0210010b PA-RISC1.1 demand-load executable 9840>168 belong&0x4 0x4 dynamically linked 9841>(144) belong 0x054ef630 dynamically linked 9842>96 belong >0 - not stripped 9843 98440 belong 0x0210010e PA-RISC1.1 shared library 9845>96 belong >0 - not stripped 9846 98470 belong 0x0210010d PA-RISC1.1 dynamic load library 9848>96 belong >0 - not stripped 9849 9850#### PA-RISC 2.0 98510 belong 0x02140106 PA-RISC2.0 relocatable object 9852 98530 belong 0x02140107 PA-RISC2.0 executable 9854>168 belong &0x00000004 dynamically linked 9855>(144) belong 0x054ef630 dynamically linked 9856>96 belong >0 - not stripped 9857 98580 belong 0x02140108 PA-RISC2.0 shared executable 9859>168 belong &0x00000004 dynamically linked 9860>(144) belong 0x054ef630 dynamically linked 9861>96 belong >0 - not stripped 9862 98630 belong 0x0214010b PA-RISC2.0 demand-load executable 9864>168 belong &0x00000004 dynamically linked 9865>(144) belong 0x054ef630 dynamically linked 9866>96 belong >0 - not stripped 9867 98680 belong 0x0214010e PA-RISC2.0 shared library 9869>96 belong >0 - not stripped 9870 98710 belong 0x0214010d PA-RISC2.0 dynamic load library 9872>96 belong >0 - not stripped 9873 9874#### 800 98750 belong 0x020b0106 PA-RISC1.0 relocatable object 9876 98770 belong 0x020b0107 PA-RISC1.0 executable 9878>168 belong&0x4 0x4 dynamically linked 9879>(144) belong 0x054ef630 dynamically linked 9880>96 belong >0 - not stripped 9881 98820 belong 0x020b0108 PA-RISC1.0 shared executable 9883>168 belong&0x4 0x4 dynamically linked 9884>(144) belong 0x054ef630 dynamically linked 9885>96 belong >0 - not stripped 9886 98870 belong 0x020b010b PA-RISC1.0 demand-load executable 9888>168 belong&0x4 0x4 dynamically linked 9889>(144) belong 0x054ef630 dynamically linked 9890>96 belong >0 - not stripped 9891 98920 belong 0x020b010e PA-RISC1.0 shared library 9893>96 belong >0 - not stripped 9894 98950 belong 0x020b010d PA-RISC1.0 dynamic load library 9896>96 belong >0 - not stripped 9897 98980 belong 0x213c6172 archive file 9899>68 belong 0x020b0619 - PA-RISC1.0 relocatable library 9900>68 belong 0x02100619 - PA-RISC1.1 relocatable library 9901>68 belong 0x02110619 - PA-RISC1.2 relocatable library 9902>68 belong 0x02140619 - PA-RISC2.0 relocatable library 9903 9904#### 500 99050 long 0x02080106 HP s500 relocatable executable 9906>16 long >0 - version %ld 9907 99080 long 0x02080107 HP s500 executable 9909>16 long >0 - version %ld 9910 99110 long 0x02080108 HP s500 pure executable 9912>16 long >0 - version %ld 9913 9914#### 200 99150 belong 0x020c0108 HP s200 pure executable 9916>4 beshort >0 - version %ld 9917>8 belong &0x80000000 save fp regs 9918>8 belong &0x40000000 dynamically linked 9919>8 belong &0x20000000 debuggable 9920>36 belong >0 not stripped 9921 99220 belong 0x020c0107 HP s200 executable 9923>4 beshort >0 - version %ld 9924>8 belong &0x80000000 save fp regs 9925>8 belong &0x40000000 dynamically linked 9926>8 belong &0x20000000 debuggable 9927>36 belong >0 not stripped 9928 99290 belong 0x020c010b HP s200 demand-load executable 9930>4 beshort >0 - version %ld 9931>8 belong &0x80000000 save fp regs 9932>8 belong &0x40000000 dynamically linked 9933>8 belong &0x20000000 debuggable 9934>36 belong >0 not stripped 9935 99360 belong 0x020c0106 HP s200 relocatable executable 9937>4 beshort >0 - version %ld 9938>6 beshort >0 - highwater %d 9939>8 belong &0x80000000 save fp regs 9940>8 belong &0x20000000 debuggable 9941>8 belong &0x10000000 PIC 9942 99430 belong 0x020a0108 HP s200 (2.x release) pure executable 9944>4 beshort >0 - version %ld 9945>36 belong >0 not stripped 9946 99470 belong 0x020a0107 HP s200 (2.x release) executable 9948>4 beshort >0 - version %ld 9949>36 belong >0 not stripped 9950 99510 belong 0x020c010e HP s200 shared library 9952>4 beshort >0 - version %ld 9953>6 beshort >0 - highwater %d 9954>36 belong >0 not stripped 9955 99560 belong 0x020c010d HP s200 dynamic load library 9957>4 beshort >0 - version %ld 9958>6 beshort >0 - highwater %d 9959>36 belong >0 not stripped 9960 9961#### MISC 99620 long 0x0000ff65 HP old archive 99630 long 0x020aff65 HP s200 old archive 99640 long 0x020cff65 HP s200 old archive 99650 long 0x0208ff65 HP s500 old archive 9966 99670 long 0x015821a6 HP core file 9968 99690 long 0x4da7eee8 HP-WINDOWS font 9970>8 byte >0 - version %ld 99710 string Bitmapfile HP Bitmapfile 9972 99730 string IMGfile CIS compimg HP Bitmapfile 9974# XXX - see "lif" 9975#0 short 0x8000 lif file 99760 long 0x020c010c compiled Lisp 9977 99780 string msgcat01 HP NLS message catalog, 9979>8 long >0 %d messages 9980 9981# Summary: HP-48/49 calculator 9982# Created by: phk@data.fls.dk 9983# Modified by (1): AMAKAWA Shuhei <sa264@cam.ac.uk> 9984# Modified by (2): Samuel Thibault <samuel.thibault@ens-lyon.org> (HP49 support) 99850 string HPHP HP 9986>4 string 48 48 binary 9987>4 string 49 49 binary 9988>7 byte >64 - Rev %c 9989>8 leshort 0x2911 (ADR) 9990>8 leshort 0x2933 (REAL) 9991>8 leshort 0x2955 (LREAL) 9992>8 leshort 0x2977 (COMPLX) 9993>8 leshort 0x299d (LCOMPLX) 9994>8 leshort 0x29bf (CHAR) 9995>8 leshort 0x29e8 (ARRAY) 9996>8 leshort 0x2a0a (LNKARRAY) 9997>8 leshort 0x2a2c (STRING) 9998>8 leshort 0x2a4e (HXS) 9999>8 leshort 0x2a74 (LIST) 10000>8 leshort 0x2a96 (DIR) 10001>8 leshort 0x2ab8 (ALG) 10002>8 leshort 0x2ada (UNIT) 10003>8 leshort 0x2afc (TAGGED) 10004>8 leshort 0x2b1e (GROB) 10005>8 leshort 0x2b40 (LIB) 10006>8 leshort 0x2b62 (BACKUP) 10007>8 leshort 0x2b88 (LIBDATA) 10008>8 leshort 0x2d9d (PROG) 10009>8 leshort 0x2dcc (CODE) 10010>8 leshort 0x2e48 (GNAME) 10011>8 leshort 0x2e6d (LNAME) 10012>8 leshort 0x2e92 (XLIB) 10013 100140 string %%HP: HP text 10015>6 string T(0) - T(0) 10016>6 string T(1) - T(1) 10017>6 string T(2) - T(2) 10018>6 string T(3) - T(3) 10019>10 string A(D) A(D) 10020>10 string A(R) A(R) 10021>10 string A(G) A(G) 10022>14 string F(.) F(.); 10023>14 string F(,) F(,); 10024 10025 10026# Summary: HP-38/39 calculator 10027# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org> 100280 string HP3 10029>3 string 8 HP 38 10030>3 string 9 HP 39 10031>4 string Bin binary 10032>4 string Asc ASCII 10033>7 string A (Directory List) 10034>7 string B (Zaplet) 10035>7 string C (Note) 10036>7 string D (Program) 10037>7 string E (Variable) 10038>7 string F (List) 10039>7 string G (Matrix) 10040>7 string H (Library) 10041>7 string I (Target List) 10042>7 string J (ASCII Vector specification) 10043>7 string K (wildcard) 10044 10045# Summary: HP-38/39 calculator 10046# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org> 100470 string HP3 10048>3 string 8 HP 38 10049>3 string 9 HP 39 10050>4 string Bin binary 10051>4 string Asc ASCII 10052>7 string A (Directory List) 10053>7 string B (Zaplet) 10054>7 string C (Note) 10055>7 string D (Program) 10056>7 string E (Variable) 10057>7 string F (List) 10058>7 string G (Matrix) 10059>7 string H (Library) 10060>7 string I (Target List) 10061>7 string J (ASCII Vector specification) 10062>7 string K (wildcard) 10063 10064# hpBSD magic numbers 100650 beshort 200 hp200 (68010) BSD 10066>2 beshort 0407 impure binary 10067>2 beshort 0410 read-only binary 10068>2 beshort 0413 demand paged binary 100690 beshort 300 hp300 (68020+68881) BSD 10070>2 beshort 0407 impure binary 10071>2 beshort 0410 read-only binary 10072>2 beshort 0413 demand paged binary 10073# 10074# From David Gero <dgero@nortelnetworks.com> 10075# HP-UX 10.20 core file format from /usr/include/sys/core.h 10076# Unfortunately, HP-UX uses corehead blocks without specifying the order 10077# There are four we care about: 10078# CORE_KERNEL, which starts with the string "HP-UX" 10079# CORE_EXEC, which contains the name of the command 10080# CORE_PROC, which contains the signal number that caused the core dump 10081# CORE_FORMAT, which contains the version of the core file format (== 1) 10082# The only observed order in real core files is KERNEL, EXEC, FORMAT, PROC 10083# but we include all 6 variations of the order of the first 3, and 10084# assume that PROC will always be last 10085# Order 1: KERNEL, EXEC, FORMAT, PROC 100860x10 string HP-UX 10087>0 belong 2 10088>>0xC belong 0x3C 10089>>>0x4C belong 0x100 10090>>>>0x58 belong 0x44 10091>>>>>0xA0 belong 1 10092>>>>>>0xAC belong 4 10093>>>>>>>0xB0 belong 1 10094>>>>>>>>0xB4 belong 4 core file 10095>>>>>>>>>0x90 string >\0 from '%s' 10096>>>>>>>>>0xC4 belong 3 - received SIGQUIT 10097>>>>>>>>>0xC4 belong 4 - received SIGILL 10098>>>>>>>>>0xC4 belong 5 - received SIGTRAP 10099>>>>>>>>>0xC4 belong 6 - received SIGABRT 10100>>>>>>>>>0xC4 belong 7 - received SIGEMT 10101>>>>>>>>>0xC4 belong 8 - received SIGFPE 10102>>>>>>>>>0xC4 belong 10 - received SIGBUS 10103>>>>>>>>>0xC4 belong 11 - received SIGSEGV 10104>>>>>>>>>0xC4 belong 12 - received SIGSYS 10105>>>>>>>>>0xC4 belong 33 - received SIGXCPU 10106>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 10107# Order 2: KERNEL, FORMAT, EXEC, PROC 10108>>>0x4C belong 1 10109>>>>0x58 belong 4 10110>>>>>0x5C belong 1 10111>>>>>>0x60 belong 0x100 10112>>>>>>>0x6C belong 0x44 10113>>>>>>>>0xB4 belong 4 core file 10114>>>>>>>>>0xA4 string >\0 from '%s' 10115>>>>>>>>>0xC4 belong 3 - received SIGQUIT 10116>>>>>>>>>0xC4 belong 4 - received SIGILL 10117>>>>>>>>>0xC4 belong 5 - received SIGTRAP 10118>>>>>>>>>0xC4 belong 6 - received SIGABRT 10119>>>>>>>>>0xC4 belong 7 - received SIGEMT 10120>>>>>>>>>0xC4 belong 8 - received SIGFPE 10121>>>>>>>>>0xC4 belong 10 - received SIGBUS 10122>>>>>>>>>0xC4 belong 11 - received SIGSEGV 10123>>>>>>>>>0xC4 belong 12 - received SIGSYS 10124>>>>>>>>>0xC4 belong 33 - received SIGXCPU 10125>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 10126# Order 3: FORMAT, KERNEL, EXEC, PROC 101270x24 string HP-UX 10128>0 belong 1 10129>>0xC belong 4 10130>>>0x10 belong 1 10131>>>>0x14 belong 2 10132>>>>>0x20 belong 0x3C 10133>>>>>>0x60 belong 0x100 10134>>>>>>>0x6C belong 0x44 10135>>>>>>>>0xB4 belong 4 core file 10136>>>>>>>>>0xA4 string >\0 from '%s' 10137>>>>>>>>>0xC4 belong 3 - received SIGQUIT 10138>>>>>>>>>0xC4 belong 4 - received SIGILL 10139>>>>>>>>>0xC4 belong 5 - received SIGTRAP 10140>>>>>>>>>0xC4 belong 6 - received SIGABRT 10141>>>>>>>>>0xC4 belong 7 - received SIGEMT 10142>>>>>>>>>0xC4 belong 8 - received SIGFPE 10143>>>>>>>>>0xC4 belong 10 - received SIGBUS 10144>>>>>>>>>0xC4 belong 11 - received SIGSEGV 10145>>>>>>>>>0xC4 belong 12 - received SIGSYS 10146>>>>>>>>>0xC4 belong 33 - received SIGXCPU 10147>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 10148# Order 4: EXEC, KERNEL, FORMAT, PROC 101490x64 string HP-UX 10150>0 belong 0x100 10151>>0xC belong 0x44 10152>>>0x54 belong 2 10153>>>>0x60 belong 0x3C 10154>>>>>0xA0 belong 1 10155>>>>>>0xAC belong 4 10156>>>>>>>0xB0 belong 1 10157>>>>>>>>0xB4 belong 4 core file 10158>>>>>>>>>0x44 string >\0 from '%s' 10159>>>>>>>>>0xC4 belong 3 - received SIGQUIT 10160>>>>>>>>>0xC4 belong 4 - received SIGILL 10161>>>>>>>>>0xC4 belong 5 - received SIGTRAP 10162>>>>>>>>>0xC4 belong 6 - received SIGABRT 10163>>>>>>>>>0xC4 belong 7 - received SIGEMT 10164>>>>>>>>>0xC4 belong 8 - received SIGFPE 10165>>>>>>>>>0xC4 belong 10 - received SIGBUS 10166>>>>>>>>>0xC4 belong 11 - received SIGSEGV 10167>>>>>>>>>0xC4 belong 12 - received SIGSYS 10168>>>>>>>>>0xC4 belong 33 - received SIGXCPU 10169>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 10170# Order 5: FORMAT, EXEC, KERNEL, PROC 101710x78 string HP-UX 10172>0 belong 1 10173>>0xC belong 4 10174>>>0x10 belong 1 10175>>>>0x14 belong 0x100 10176>>>>>0x20 belong 0x44 10177>>>>>>0x68 belong 2 10178>>>>>>>0x74 belong 0x3C 10179>>>>>>>>0xB4 belong 4 core file 10180>>>>>>>>>0x58 string >\0 from '%s' 10181>>>>>>>>>0xC4 belong 3 - received SIGQUIT 10182>>>>>>>>>0xC4 belong 4 - received SIGILL 10183>>>>>>>>>0xC4 belong 5 - received SIGTRAP 10184>>>>>>>>>0xC4 belong 6 - received SIGABRT 10185>>>>>>>>>0xC4 belong 7 - received SIGEMT 10186>>>>>>>>>0xC4 belong 8 - received SIGFPE 10187>>>>>>>>>0xC4 belong 10 - received SIGBUS 10188>>>>>>>>>0xC4 belong 11 - received SIGSEGV 10189>>>>>>>>>0xC4 belong 12 - received SIGSYS 10190>>>>>>>>>0xC4 belong 33 - received SIGXCPU 10191>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 10192# Order 6: EXEC, FORMAT, KERNEL, PROC 10193>0 belong 0x100 10194>>0xC belong 0x44 10195>>>0x54 belong 1 10196>>>>0x60 belong 4 10197>>>>>0x64 belong 1 10198>>>>>>0x68 belong 2 10199>>>>>>>0x74 belong 0x2C 10200>>>>>>>>0xB4 belong 4 core file 10201>>>>>>>>>0x44 string >\0 from '%s' 10202>>>>>>>>>0xC4 belong 3 - received SIGQUIT 10203>>>>>>>>>0xC4 belong 4 - received SIGILL 10204>>>>>>>>>0xC4 belong 5 - received SIGTRAP 10205>>>>>>>>>0xC4 belong 6 - received SIGABRT 10206>>>>>>>>>0xC4 belong 7 - received SIGEMT 10207>>>>>>>>>0xC4 belong 8 - received SIGFPE 10208>>>>>>>>>0xC4 belong 10 - received SIGBUS 10209>>>>>>>>>0xC4 belong 11 - received SIGSEGV 10210>>>>>>>>>0xC4 belong 12 - received SIGSYS 10211>>>>>>>>>0xC4 belong 33 - received SIGXCPU 10212>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 10213 10214 10215 10216#------------------------------------------------------------------------------ 10217# $File: human68k,v 1.5 2009/09/19 16:28:09 christos Exp $ 10218# human68k: file(1) magic for Human68k (X680x0 DOS) binary formats 10219# Magic too short! 10220#0 string HU Human68k 10221#>68 string LZX LZX compressed 10222#>>72 string >\0 (version %s) 10223#>(8.L+74) string LZX LZX compressed 10224#>>(8.L+78) string >\0 (version %s) 10225#>60 belong >0 binded 10226#>(8.L+66) string #HUPAIR hupair 10227#>0 string HU X executable 10228#>(8.L+74) string #LIBCV1 - linked PD LIBC ver 1 10229#>4 belong >0 - base address 0x%x 10230#>28 belong >0 not stripped 10231#>32 belong >0 with debug information 10232#0 beshort 0x601a Human68k Z executable 10233#0 beshort 0x6000 Human68k object file 10234#0 belong 0xd1000000 Human68k ar binary archive 10235#0 belong 0xd1010000 Human68k ar ascii archive 10236#0 beshort 0x0068 Human68k lib archive 10237#4 string LZX Human68k LZX compressed 10238#>8 string >\0 (version %s) 10239#>4 string LZX R executable 10240#2 string #HUPAIR Human68k hupair R executable 10241 10242#------------------------------------------------------------------------------ 10243# $File: ibm370,v 1.8 2009/09/19 16:28:09 christos Exp $ 10244# ibm370: file(1) magic for IBM 370 and compatibles. 10245# 10246# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable". 10247# What the heck *is* "USS/370"? 10248# AIX 4.1's "/etc/magic" has 10249# 10250# 0 short 0535 370 sysV executable 10251# >12 long >0 not stripped 10252# >22 short >0 - version %d 10253# >30 long >0 - 5.2 format 10254# 0 short 0530 370 sysV pure executable 10255# >12 long >0 not stripped 10256# >22 short >0 - version %d 10257# >30 long >0 - 5.2 format 10258# 10259# instead of the "USS/370" versions of the same magic numbers. 10260# 102610 beshort 0537 370 XA sysV executable 10262>12 belong >0 not stripped 10263>22 beshort >0 - version %d 10264>30 belong >0 - 5.2 format 102650 beshort 0532 370 XA sysV pure executable 10266>12 belong >0 not stripped 10267>22 beshort >0 - version %d 10268>30 belong >0 - 5.2 format 102690 beshort 054001 370 sysV pure executable 10270>12 belong >0 not stripped 102710 beshort 055001 370 XA sysV pure executable 10272>12 belong >0 not stripped 102730 beshort 056401 370 sysV executable 10274>12 belong >0 not stripped 102750 beshort 057401 370 XA sysV executable 10276>12 belong >0 not stripped 102770 beshort 0531 SVR2 executable (Amdahl-UTS) 10278>12 belong >0 not stripped 10279>24 belong >0 - version %ld 102800 beshort 0534 SVR2 pure executable (Amdahl-UTS) 10281>12 belong >0 not stripped 10282>24 belong >0 - version %ld 102830 beshort 0530 SVR2 pure executable (USS/370) 10284>12 belong >0 not stripped 10285>24 belong >0 - version %ld 102860 beshort 0535 SVR2 executable (USS/370) 10287>12 belong >0 not stripped 10288>24 belong >0 - version %ld 10289 10290#------------------------------------------------------------------------------ 10291# $File: ibm6000,v 1.12 2013/09/16 15:12:42 christos Exp $ 10292# ibm6000: file(1) magic for RS/6000 and the RT PC. 10293# 102940 beshort 0x01df executable (RISC System/6000 V3.1) or obj module 10295>12 belong >0 not stripped 10296# Breaks sun4 statically linked execs. 10297#0 beshort 0x0103 executable (RT Version 2) or obj module 10298#>2 byte 0x50 pure 10299#>28 belong >0 not stripped 10300#>6 beshort >0 - version %ld 103010 beshort 0x0104 shared library 103020 beshort 0x0105 ctab data 103030 beshort 0xfe04 structured file 103040 string 0xabcdef AIX message catalog 103050 belong 0x000001f9 AIX compiled message catalog 103060 string \<aiaff> archive 103070 string \<bigaf> archive (big format) 10308 103090 beshort 0x01f7 64-bit XCOFF executable or object module 10310>20 belong 0 not stripped 10311# GRR: this test is still too general as it catches also many FATs of DOS filesystems 103124 belong &0x0feeddb0 10313# real core dump could not be 32-bit and 64-bit together 10314>7 byte&0x03 !3 AIX core file 10315>>1 byte &0x01 fulldump 10316>>7 byte &0x01 32-bit 10317>>>0x6e0 string >\0 \b, %s 10318>>7 byte &0x02 64-bit 10319>>>0x524 string >\0 \b, %s 10320 10321#------------------------------------------------------------------------------ 10322# $File: icc,v 1.1 2013/01/08 01:43:18 christos Exp $ 10323# icc: file(1) magic for International Color Consortium file formats 10324 10325# 10326# Color profiles as per the ICC's "Image technology colour management - 10327# Architecture, profile format, and data structure" specification. 10328# See 10329# 10330# http://www.color.org/specification/ICC1v43_2010-12.pdf 10331# 10332# for Specification ICC.1:2010 (Profile version 4.3.0.0). 10333# 10334# Bytes 36 to 39 contain a generic profile file signature of "acsp"; 10335# bytes 40 to 43 "may be used to identify the primary platform/operating 10336# system framework for which the profile was created". 10337# 10338# There are other fields that might be worth dumping as well. 10339# 10340 10341# This appears to be what's used for Apple ColorSync profiles. 10342# Instead of adding that, Apple just changed the generic "acsp" entry 10343# to be for "ColorSync ICC Color Profile" rather than "Kodak Color 10344# Management System, ICC Profile". 10345# Yes, it's "APPL", not "AAPL"; see the spec. 1034636 string acspAPPL ColorSync ICC Profile 10347!:mime application/vnd.iccprofile 10348 10349# Microsoft ICM color profile 1035036 string acspMSFT Microsoft ICM Color Profile 10351!:mime application/vnd.iccprofile 10352 10353# Yes, that's a blank after "SGI". 1035436 string acspSGI\ SGI ICC Profile 10355!:mime application/vnd.iccprofile 10356 10357# XXX - is this what's used for the Sun KCMS or not? The standard file 10358# uses just "acsp" for that, but Apple's file uses it for "ColorSync", 10359# and there *is* an identified "primary platform" value of SUNW. 1036036 string acspSUNW Sun KCMS ICC Profile 10361!:mime application/vnd.iccprofile 10362 10363# Any other profile. 10364# XXX - should we use "acsp\0\0\0\0" for "no primary platform" profiles, 10365# and use "acsp" for everything else and dump the "primary platform" 10366# string in those cases? 1036736 string acsp ICC Profile 10368!:mime application/vnd.iccprofile 10369 10370 10371 10372#------------------------------------------------------------------------------ 10373# $File: iff,v 1.13 2011/09/06 11:00:06 christos Exp $ 10374# iff: file(1) magic for Interchange File Format (see also "audio" & "images") 10375# 10376# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic 10377# Arts for file interchange. It has also been used by Apple, SGI, and 10378# especially Commodore-Amiga. 10379# 10380# IFF files begin with an 8 byte FORM header, followed by a 4 character 10381# FORM type, which is followed by the first chunk in the FORM. 10382 103830 string FORM IFF data 10384#>4 belong x \b, FORM is %d bytes long 10385# audio formats 10386>8 string AIFF \b, AIFF audio 10387!:mime audio/x-aiff 10388>8 string AIFC \b, AIFF-C compressed audio 10389!:mime audio/x-aiff 10390>8 string 8SVX \b, 8SVX 8-bit sampled sound voice 10391!:mime audio/x-aiff 10392>8 string 16SV \b, 16SV 16-bit sampled sound voice 10393>8 string SAMP \b, SAMP sampled audio 10394>8 string MAUD \b, MAUD MacroSystem audio 10395>8 string SMUS \b, SMUS simple music 10396>8 string CMUS \b, CMUS complex music 10397# image formats 10398>8 string ILBMBMHD \b, ILBM interleaved image 10399>>20 beshort x \b, %d x 10400>>22 beshort x %d 10401>8 string RGBN \b, RGBN 12-bit RGB image 10402>8 string RGB8 \b, RGB8 24-bit RGB image 10403>8 string DEEP \b, DEEP TVPaint/XiPaint image 10404>8 string DR2D \b, DR2D 2-D object 10405>8 string TDDD \b, TDDD 3-D rendering 10406>8 string LWOB \b, LWOB 3-D object 10407>8 string LWO2 \b, LWO2 3-D object, v2 10408>8 string LWLO \b, LWLO 3-D layered object 10409>8 string REAL \b, REAL Real3D rendering 10410>8 string MC4D \b, MC4D MaxonCinema4D rendering 10411>8 string ANIM \b, ANIM animation 10412>8 string YAFA \b, YAFA animation 10413>8 string SSA\ \b, SSA super smooth animation 10414>8 string ACBM \b, ACBM continuous image 10415>8 string FAXX \b, FAXX fax image 10416# other formats 10417>8 string FTXT \b, FTXT formatted text 10418>8 string CTLG \b, CTLG message catalog 10419>8 string PREF \b, PREF preferences 10420>8 string DTYP \b, DTYP datatype description 10421>8 string PTCH \b, PTCH binary patch 10422>8 string AMFF \b, AMFF AmigaMetaFile format 10423>8 string WZRD \b, WZRD StormWIZARD resource 10424>8 string DOC\ \b, DOC desktop publishing document 10425>8 string WVQA \b, Westwood Studios VQA Multimedia, 10426>>24 leshort x %d video frames, 10427>>26 leshort x %d x 10428>>28 leshort x %d 10429>8 string MOVE \b, Wing Commander III Video 10430>>12 string _PC_ \b, PC version 10431>>12 string 3DO_ \b, 3DO version 10432 10433# These go at the end of the iff rules 10434# 10435# I don't see why these might collide with anything else. 10436# 10437# Interactive Fiction related formats 10438# 10439>8 string IFRS \b, Blorb Interactive Fiction 10440>>24 string Exec with executable chunk 10441>8 string IFZS \b, Z-machine or Glulx saved game file (Quetzal) 10442 10443#------------------------------------------------------------------------------ 10444# $File: images,v 1.87 2013/12/11 14:14:20 christos Exp $ 10445# images: file(1) magic for image formats (see also "iff", and "c-lang" for 10446# XPM bitmaps) 10447# 10448# originally from jef@helios.ee.lbl.gov (Jef Poskanzer), 10449# additions by janl@ifi.uio.no as well as others. Jan also suggested 10450# merging several one- and two-line files into here. 10451# 10452# little magic: PCX (first byte is 0x0a) 10453 10454# Targa - matches `povray', `ppmtotga' and `xv' outputs 10455# by Philippe De Muyter <phdm@macqel.be> 10456# at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11 10457# at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise 10458# at 3, leshort Index is 0 for povray, ppmtotga and xv outputs 10459# `xv' recognizes only a subset of the following (RGB with pixelsize = 24) 10460# `tgatoppm' recognizes a superset (Index may be anything) 104611 belong&0xfff7ffff 0x01010000 Targa image data - Map 10462>2 byte&8 8 - RLE 10463>12 leshort >0 %hd x 10464>14 leshort >0 %hd 104651 belong&0xfff7ffff 0x00020000 Targa image data - RGB 10466>2 byte&8 8 - RLE 10467>12 leshort >0 %hd x 10468>14 leshort >0 %hd 104691 belong&0xfff7ffff 0x00030000 Targa image data - Mono 10470>2 byte&8 8 - RLE 10471>12 leshort >0 %hd x 10472>14 leshort >0 %hd 10473 10474# PBMPLUS images 10475# The next byte following the magic is always whitespace. 10476# strength is changed to try these patterns before "x86 boot sector" 104770 search/1 P1 10478>3 regex =[0-9]{0,50}\ [0-9]{0,50} Netpbm PBM image text 10479>3 regex =[0-9]{1,50}\ \b, size = %sx 10480>>3 regex =\ [0-9]{1,50} \b%s 10481!:strength + 45 10482!:mime image/x-portable-bitmap 104830 search/1 P2 10484>3 regex =[0-9]{0,50}\ [0-9]{0,50} Netpbm PGM image text 10485>3 regex =[0-9]{1,50}\ \b, size = %sx 10486>>3 regex =\ [0-9]{1,50} \b%s 10487!:strength + 45 10488!:mime image/x-portable-greymap 104890 search/1 P3 10490>3 regex =[0-9]{0,50}\ [0-9]{0,50} Netpbm PPM image text 10491>3 regex =[0-9]{1,50}\ \b, size = %sx 10492>>3 regex =\ [0-9]{1,50} \b%s 10493!:strength + 45 10494!:mime image/x-portable-pixmap 104950 string P4 10496>3 regex =[0-9]{0,50}\ [0-9]{0,50} Netpbm PBM "rawbits" image data 10497>3 regex =[0-9]{1,50}\ \b, size = %sx 10498>>3 regex =\ [0-9]{1,50} \b%s 10499!:strength + 45 10500!:mime image/x-portable-bitmap 105010 string P5 10502>3 regex =[0-9]{0,50}\ [0-9]{0,50} Netpbm PGM "rawbits" image data 10503>3 regex =[0-9]{1,50}\ \b, size = %sx 10504>>3 regex =\ [0-9]{1,50} \b%s 10505!:strength + 45 10506!:mime image/x-portable-greymap 105070 string P6 10508>3 regex =[0-9]{0,50}\ [0-9]{0,50} Netpbm PPM "rawbits" image data 10509>3 regex =[0-9]{1,50}\ \b, size = %sx 10510>>3 regex =\ [0-9]{1,50} \b%s 10511!:strength + 45 10512!:mime image/x-portable-pixmap 105130 string P7 Netpbm PAM image file 10514!:mime image/x-portable-pixmap 10515 10516# From: bryanh@giraffe-data.com (Bryan Henderson) 105170 string \117\072 Solitaire Image Recorder format 10518>4 string \013 MGI Type 11 10519>4 string \021 MGI Type 17 105200 string .MDA MicroDesign data 10521>21 byte 48 version 2 10522>21 byte 51 version 3 105230 string .MDP MicroDesign page data 10524>21 byte 48 version 2 10525>21 byte 51 version 3 10526 10527# NIFF (Navy Interchange File Format, a modification of TIFF) images 10528# [GRR: this *must* go before TIFF] 105290 string IIN1 NIFF image data 10530!:mime image/x-niff 10531 10532# Canon RAW version 1 (CRW) files are a type of Canon Image File Format 10533# (CIFF) file. These are apparently all little-endian. 10534# From: Adam Buchbinder <adam.buchbinder@gmail.com> 10535# URL: http://www.sno.phy.queensu.ca/~phil/exiftool/canon_raw.html 105360 string II\x1a\0\0\0HEAPCCDR Canon CIFF raw image data 10537!:mime image/x-canon-crw 10538>16 leshort x \b, version %d. 10539>14 leshort x \b%d 10540 10541# Canon RAW version 2 (CR2) files are a kind of TIFF with an extra magic 10542# number. Put this above the TIFF test to make sure we detect them. 10543# These are apparently all little-endian. 10544# From: Adam Buchbinder <adam.buchbinder@gmail.com> 10545# URL: http://libopenraw.freedesktop.org/wiki/Canon_CR2 105460 string II\x2a\0\x10\0\0\0CR Canon CR2 raw image data 10547!:mime image/x-canon-cr2 10548>10 byte x \b, version %d. 10549>11 byte x \b%d 10550 10551# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com) 10552# The second word of TIFF files is the TIFF version number, 42, which has 10553# never changed. The TIFF specification recommends testing for it. 105540 string MM\x00\x2a TIFF image data, big-endian 10555!:mime image/tiff 105560 string II\x2a\x00 TIFF image data, little-endian 10557!:mime image/tiff 10558 105590 string MM\x00\x2b Big TIFF image data, big-endian 10560!:mime image/tiff 105610 string II\x2b\x00 Big TIFF image data, little-endian 10562!:mime image/tiff 10563 10564# PNG [Portable Network Graphics, or "PNG's Not GIF"] images 10565# (Greg Roelofs, newt@uchicago.edu) 10566# (Albert Cahalan, acahalan@cs.uml.edu) 10567# 10568# 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ... 10569# 105700 string \x89PNG\x0d\x0a\x1a\x0a PNG image data 10571!:mime image/png 10572>16 belong x \b, %ld x 10573>20 belong x %ld, 10574>24 byte x %d-bit 10575>25 byte 0 grayscale, 10576>25 byte 2 \b/color RGB, 10577>25 byte 3 colormap, 10578>25 byte 4 gray+alpha, 10579>25 byte 6 \b/color RGBA, 10580#>26 byte 0 deflate/32K, 10581>28 byte 0 non-interlaced 10582>28 byte 1 interlaced 10583 10584# possible GIF replacements; none yet released! 10585# (Greg Roelofs, newt@uchicago.edu) 10586# 10587# GRR 950115: this was mine ("Zip GIF"): 105880 string GIF94z ZIF image (GIF+deflate alpha) 10589!:mime image/x-unknown 10590# 10591# GRR 950115: this is Jeremy Wohl's Free Graphics Format (better): 10592# 105930 string FGF95a FGF image (GIF+deflate beta) 10594!:mime image/x-unknown 10595# 10596# GRR 950115: this is Thomas Boutell's Portable Bitmap Format proposal 10597# (best; not yet implemented): 10598# 105990 string PBF PBF image (deflate compression) 10600!:mime image/x-unknown 10601 10602# GIF 106030 string GIF8 GIF image data 10604!:mime image/gif 10605!:apple 8BIMGIFf 10606>4 string 7a \b, version 8%s, 10607>4 string 9a \b, version 8%s, 10608>6 leshort >0 %hd x 10609>8 leshort >0 %hd 10610#>10 byte &0x80 color mapped, 10611#>10 byte&0x07 =0x00 2 colors 10612#>10 byte&0x07 =0x01 4 colors 10613#>10 byte&0x07 =0x02 8 colors 10614#>10 byte&0x07 =0x03 16 colors 10615#>10 byte&0x07 =0x04 32 colors 10616#>10 byte&0x07 =0x05 64 colors 10617#>10 byte&0x07 =0x06 128 colors 10618#>10 byte&0x07 =0x07 256 colors 10619 10620# ITC (CMU WM) raster files. It is essentially a byte-reversed Sun raster, 10621# 1 plane, no encoding. 106220 string \361\0\100\273 CMU window manager raster image data 10623>4 lelong >0 %d x 10624>8 lelong >0 %d, 10625>12 lelong >0 %d-bit 10626 10627# Magick Image File Format 106280 string id=ImageMagick MIFF image data 10629 10630# Artisan 106310 long 1123028772 Artisan image data 10632>4 long 1 \b, rectangular 24-bit 10633>4 long 2 \b, rectangular 8-bit with colormap 10634>4 long 3 \b, rectangular 32-bit (24-bit with matte) 10635 10636# FIG (Facility for Interactive Generation of figures), an object-based format 106370 search/1 #FIG FIG image text 10638>5 string x \b, version %.3s 10639 10640# PHIGS 106410 string ARF_BEGARF PHIGS clear text archive 106420 string @(#)SunPHIGS SunPHIGS 10643# version number follows, in the form m.n 10644>40 string SunBin binary 10645>32 string archive archive 10646 10647# GKS (Graphics Kernel System) 106480 string GKSM GKS Metafile 10649>24 string SunGKS \b, SunGKS 10650 10651# CGM image files 106520 string BEGMF clear text Computer Graphics Metafile 10653 10654# MGR bitmaps (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de) 106550 string yz MGR bitmap, modern format, 8-bit aligned 106560 string zz MGR bitmap, old format, 1-bit deep, 16-bit aligned 106570 string xz MGR bitmap, old format, 1-bit deep, 32-bit aligned 106580 string yx MGR bitmap, modern format, squeezed 10659 10660# Fuzzy Bitmap (FBM) images 106610 string %bitmap\0 FBM image data 10662>30 long 0x31 \b, mono 10663>30 long 0x33 \b, color 10664 10665# facsimile data 106661 string PC\ Research,\ Inc group 3 fax data 10667>29 byte 0 \b, normal resolution (204x98 DPI) 10668>29 byte 1 \b, fine resolution (204x196 DPI) 10669# From: Herbert Rosmanith <herp@wildsau.idv.uni.linz.at> 106700 string Sfff structured fax file 10671 10672# From: Joerg Jenderek <joerg.jen.der.ek@gmx.net> 10673# most files with the extension .EPA and some with .BMP 106740 string \x11\x06 Award BIOS Logo, 136 x 84 10675!:mime image/x-award-bioslogo 106760 string \x11\x09 Award BIOS Logo, 136 x 126 10677!:mime image/x-award-bioslogo 10678#0 string \x07\x1f BIOS Logo corrupted? 10679# http://www.blackfiveservices.co.uk/awbmtools.shtml 10680# http://biosgfx.narod.ru/v3/ 10681# http://biosgfx.narod.ru/abr-2/ 106820 string AWBM 10683>4 leshort <1981 Award BIOS bitmap 10684!:mime image/x-award-bmp 10685# image width is a multiple of 4 10686>>4 leshort&0x0003 0 10687>>>4 leshort x \b, %d 10688>>>6 leshort x x %d 10689>>4 leshort&0x0003 >0 \b, 10690>>>4 leshort&0x0003 =1 10691>>>>4 leshort x %d+3 10692>>>4 leshort&0x0003 =2 10693>>>>4 leshort x %d+2 10694>>>4 leshort&0x0003 =3 10695>>>>4 leshort x %d+1 10696>>>6 leshort x x %d 10697# at offset 8 starts imagedata followed by "RGB " marker 10698 10699# PC bitmaps (OS/2, Windows BMP files) (Greg Roelofs, newt@uchicago.edu) 10700# http://en.wikipedia.org/wiki/BMP_file_format#DIB_header_.\ 10701# 28bitmap_information_header.29 107020 string BM 10703>14 leshort 12 PC bitmap, OS/2 1.x format 10704!:mime image/x-ms-bmp 10705>>18 leshort x \b, %d x 10706>>20 leshort x %d 10707>14 leshort 64 PC bitmap, OS/2 2.x format 10708!:mime image/x-ms-bmp 10709>>18 leshort x \b, %d x 10710>>20 leshort x %d 10711>14 leshort 40 PC bitmap, Windows 3.x format 10712!:mime image/x-ms-bmp 10713>>18 lelong x \b, %d x 10714>>22 lelong x %d x 10715>>28 leshort x %d 10716>14 leshort 124 PC bitmap, Windows 98/2000 and newer format 10717!:mime image/x-ms-bmp 10718>>18 lelong x \b, %d x 10719>>22 lelong x %d x 10720>>28 leshort x %d 10721>14 leshort 108 PC bitmap, Windows 95/NT4 and newer format 10722!:mime image/x-ms-bmp 10723>>18 lelong x \b, %d x 10724>>22 lelong x %d x 10725>>28 leshort x %d 10726>14 leshort 128 PC bitmap, Windows NT/2000 format 10727!:mime image/x-ms-bmp 10728>>18 lelong x \b, %d x 10729>>22 lelong x %d x 10730>>28 leshort x %d 10731# Too simple - MPi 10732#0 string IC PC icon data 10733#0 string PI PC pointer image data 10734#0 string CI PC color icon data 10735#0 string CP PC color pointer image data 10736# Conflicts with other entries [BABYL] 10737#0 string BA PC bitmap array data 10738 10739# XPM icons (Greg Roelofs, newt@uchicago.edu) 107400 search/1 /*\ XPM\ */ X pixmap image text 10741!:mime image/x-xpmi 10742 10743# Utah Raster Toolkit RLE images (janl@ifi.uio.no) 107440 leshort 0xcc52 RLE image data, 10745>6 leshort x %d x 10746>8 leshort x %d 10747>2 leshort >0 \b, lower left corner: %d 10748>4 leshort >0 \b, lower right corner: %d 10749>10 byte&0x1 =0x1 \b, clear first 10750>10 byte&0x2 =0x2 \b, no background 10751>10 byte&0x4 =0x4 \b, alpha channel 10752>10 byte&0x8 =0x8 \b, comment 10753>11 byte >0 \b, %d color channels 10754>12 byte >0 \b, %d bits per pixel 10755>13 byte >0 \b, %d color map channels 10756 10757# image file format (Robert Potter, potter@cs.rochester.edu) 107580 string Imagefile\ version- iff image data 10759# this adds the whole header (inc. version number), informative but longish 10760>10 string >\0 %s 10761 10762# Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com) 107630 belong 0x59a66a95 Sun raster image data 10764>4 belong >0 \b, %d x 10765>8 belong >0 %d, 10766>12 belong >0 %d-bit, 10767#>16 belong >0 %d bytes long, 10768>20 belong 0 old format, 10769#>20 belong 1 standard, 10770>20 belong 2 compressed, 10771>20 belong 3 RGB, 10772>20 belong 4 TIFF, 10773>20 belong 5 IFF, 10774>20 belong 0xffff reserved for testing, 10775>24 belong 0 no colormap 10776>24 belong 1 RGB colormap 10777>24 belong 2 raw colormap 10778#>28 belong >0 colormap is %d bytes long 10779 10780# SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com) 10781# 10782# See 10783# http://reality.sgi.com/grafica/sgiimage.html 10784# 107850 beshort 474 SGI image data 10786#>2 byte 0 \b, verbatim 10787>2 byte 1 \b, RLE 10788#>3 byte 1 \b, normal precision 10789>3 byte 2 \b, high precision 10790>4 beshort x \b, %d-D 10791>6 beshort x \b, %d x 10792>8 beshort x %d 10793>10 beshort x \b, %d channel 10794>10 beshort !1 \bs 10795>80 string >0 \b, "%s" 10796 107970 string IT01 FIT image data 10798>4 belong x \b, %d x 10799>8 belong x %d x 10800>12 belong x %d 10801# 108020 string IT02 FIT image data 10803>4 belong x \b, %d x 10804>8 belong x %d x 10805>12 belong x %d 10806# 108072048 string PCD_IPI Kodak Photo CD image pack file 10808>0xe02 byte&0x03 0x00 , landscape mode 10809>0xe02 byte&0x03 0x01 , portrait mode 10810>0xe02 byte&0x03 0x02 , landscape mode 10811>0xe02 byte&0x03 0x03 , portrait mode 108120 string PCD_OPA Kodak Photo CD overview pack file 10813 10814# FITS format. Jeff Uphoff <juphoff@tarsier.cv.nrao.edu> 10815# FITS is the Flexible Image Transport System, the de facto standard for 10816# data and image transfer, storage, etc., for the astronomical community. 10817# (FITS floating point formats are big-endian.) 108180 string SIMPLE\ \ = FITS image data 10819>109 string 8 \b, 8-bit, character or unsigned binary integer 10820>108 string 16 \b, 16-bit, two's complement binary integer 10821>107 string \ 32 \b, 32-bit, two's complement binary integer 10822>107 string -32 \b, 32-bit, floating point, single precision 10823>107 string -64 \b, 64-bit, floating point, double precision 10824 10825# other images 108260 string This\ is\ a\ BitMap\ file Lisp Machine bit-array-file 10827 10828# From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image 10829# stuff. 10830# 108310 beshort 0x1010 PEX Binary Archive 10832 10833# DICOM medical imaging data 10834128 string DICM DICOM medical imaging data 10835!:mime application/dicom 10836 10837# XWD - X Window Dump file. 10838# As described in /usr/X11R6/include/X11/XWDFile.h 10839# used by the xwd program. 10840# Bradford Castalia, idaeim, 1/01 10841# updated by Adam Buchbinder, 2/09 10842# The following assumes version 7 of the format; the first long is the length 10843# of the header, which is at least 25 4-byte longs, and the one at offset 8 10844# is a constant which is always either 1 or 2. Offset 12 is the pixmap depth, 10845# which is a maximum of 32. 108460 belong >100 10847>8 belong <3 10848>>12 belong <33 10849>>>4 belong 7 XWD X Window Dump image data 10850!:mime image/x-xwindowdump 10851>>>>100 string >\0 \b, "%s" 10852>>>>16 belong x \b, %dx 10853>>>>20 belong x \b%dx 10854>>>>12 belong x \b%d 10855 10856# PDS - Planetary Data System 10857# These files use Parameter Value Language in the header section. 10858# Unfortunately, there is no certain magic, but the following 10859# strings have been found to be most likely. 108600 string NJPL1I00 PDS (JPL) image data 108612 string NJPL1I PDS (JPL) image data 108620 string CCSD3ZF PDS (CCSD) image data 108632 string CCSD3Z PDS (CCSD) image data 108640 string PDS_ PDS image data 108650 string LBLSIZE= PDS (VICAR) image data 10866 10867# pM8x: ATARI STAD compressed bitmap format 10868# 10869# from Oskar Schirmer <schirmer@scara.com> Feb 2, 2001 10870# p M 8 5/6 xx yy zz data... 10871# Atari ST STAD bitmap is always 640x400, bytewise runlength compressed. 10872# bytes either run horizontally (pM85) or vertically (pM86). yy is the 10873# most frequent byte, xx and zz are runlength escape codes, where xx is 10874# used for runs of yy. 10875# 108760 string pM85 Atari ST STAD bitmap image data (hor) 10877>5 byte 0x00 (white background) 10878>5 byte 0xFF (black background) 108790 string pM86 Atari ST STAD bitmap image data (vert) 10880>5 byte 0x00 (white background) 10881>5 byte 0xFF (black background) 10882 10883# Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu 10884# http://www.atarimax.com/jindroush.atari.org/afmtatr.html 108850 leshort 0x0296 Atari ATR image 10886 10887# XXX: 10888# This is bad magic 0x5249 == 'RI' conflicts with RIFF and other 10889# magic. 10890# SGI RICE image file <mpruett@sgi.com> 10891#0 beshort 0x5249 RICE image 10892#>2 beshort x v%d 10893#>4 beshort x (%d x 10894#>6 beshort x %d) 10895#>8 beshort 0 8 bit 10896#>8 beshort 1 10 bit 10897#>8 beshort 2 12 bit 10898#>8 beshort 3 13 bit 10899#>10 beshort 0 4:2:2 10900#>10 beshort 1 4:2:2:4 10901#>10 beshort 2 4:4:4 10902#>10 beshort 3 4:4:4:4 10903#>12 beshort 1 RGB 10904#>12 beshort 2 CCIR601 10905#>12 beshort 3 RP175 10906#>12 beshort 4 YUV 10907 10908# PCX image files 10909# From: Dan Fandrich <dan@coneharvesters.com> 10910# updated by Joerg Jenderek at Feb 2013 by http://de.wikipedia.org/wiki/PCX 10911# http://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt 10912# GRR: original test was still too general as it catches xbase examples T5.DBT,T6.DBT with 0xa000000 10913# test for bytes 0x0a,version byte (0,2,3,4,5),compression byte flag(0,1), bit depth (>0) of PCX or T5.DBT,T6.DBT 109140 ubelong&0xffF8fe00 0x0a000000 10915# for PCX bit depth > 0 10916>3 ubyte >0 10917# test for valid versions 10918>>1 ubyte <6 10919>>>1 ubyte !1 PCX 10920!:mime image/x-pcx 10921#!:mime image/pcx 10922>>>>1 ubyte 0 ver. 2.5 image data 10923>>>>1 ubyte 2 ver. 2.8 image data, with palette 10924>>>>1 ubyte 3 ver. 2.8 image data, without palette 10925>>>>1 ubyte 4 for Windows image data 10926>>>>1 ubyte 5 ver. 3.0 image data 10927>>>>4 uleshort x bounding box [%hd, 10928>>>>6 uleshort x %d] - 10929>>>>8 uleshort x [%d, 10930>>>>10 uleshort x %d], 10931>>>>65 ubyte >1 %d planes each of 10932>>>>3 ubyte x %d-bit 10933>>>>68 byte 1 colour, 10934>>>>68 byte 2 grayscale, 10935# this should not happen 10936>>>>68 default x image, 10937>>>>12 leshort >0 %d x 10938>>>>>14 uleshort x %d dpi, 10939>>>>2 byte 0 uncompressed 10940>>>>2 byte 1 RLE compressed 10941 10942# Adobe Photoshop 10943# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 109440 string 8BPS Adobe Photoshop Image 10945!:mime image/vnd.adobe.photoshop 10946>4 beshort 2 (PSB) 10947>18 belong x \b, %d x 10948>14 belong x %d, 10949>24 beshort 0 bitmap 10950>24 beshort 1 grayscale 10951>>12 beshort 2 with alpha 10952>24 beshort 2 indexed 10953>24 beshort 3 RGB 10954>>12 beshort 4 \bA 10955>24 beshort 4 CMYK 10956>>12 beshort 5 \bA 10957>24 beshort 7 multichannel 10958>24 beshort 8 duotone 10959>24 beshort 9 lab 10960>12 beshort > 1 10961>>12 beshort x \b, %dx 10962>12 beshort 1 \b, 10963>22 beshort x %d-bit channel 10964>12 beshort > 1 \bs 10965 10966# XV thumbnail indicator (ThMO) 109670 string P7\ 332 XV thumbnail image data 10968 10969# NITF is defined by United States MIL-STD-2500A 109700 string NITF National Imagery Transmission Format 10971>25 string >\0 dated %.14s 10972 10973# GEM Image: Version 1, Headerlen 8 (Wolfram Kleff) 109740 belong 0x00010008 GEM Image data 10975>12 beshort x %d x 10976>14 beshort x %d, 10977>4 beshort x %d planes, 10978>8 beshort x %d x 10979>10 beshort x %d pixelsize 10980 10981# GEM Metafile (Wolfram Kleff) 109820 lelong 0x0018FFFF GEM Metafile data 10983>4 leshort x version %d 10984 10985# 10986# SMJPEG. A custom Motion JPEG format used by Loki Entertainment 10987# Software Torbjorn Andersson <d91tan@Update.UU.SE>. 10988# 109890 string \0\nSMJPEG SMJPEG 10990>8 belong x %d.x data 10991# According to the specification you could find any number of _TXT 10992# headers here, but I can't think of any way of handling that. None of 10993# the SMJPEG files I tried it on used this feature. Even if such a 10994# file is encountered the output should still be reasonable. 10995>16 string _SND \b, 10996>>24 beshort >0 %d Hz 10997>>26 byte 8 8-bit 10998>>26 byte 16 16-bit 10999>>28 string NONE uncompressed 11000# >>28 string APCM ADPCM compressed 11001>>27 byte 1 mono 11002>>28 byte 2 stereo 11003# Help! Isn't there any way to avoid writing this part twice? 11004>>32 string _VID \b, 11005# >>>48 string JFIF JPEG 11006>>>40 belong >0 %d frames 11007>>>44 beshort >0 (%d x 11008>>>46 beshort >0 %d) 11009>16 string _VID \b, 11010# >>32 string JFIF JPEG 11011>>24 belong >0 %d frames 11012>>28 beshort >0 (%d x 11013>>30 beshort >0 %d) 11014 110150 string Paint\ Shop\ Pro\ Image\ File Paint Shop Pro Image File 11016 11017# "thumbnail file" (icon) 11018# descended from "xv", but in use by other applications as well (Wolfram Kleff) 110190 string P7\ 332 XV "thumbnail file" (icon) data 11020 11021# taken from fkiss: (<yav@mte.biglobe.ne.jp> ?) 110220 string KiSS KISS/GS 11023>4 byte 16 color 11024>>5 byte x %d bit 11025>>8 leshort x %d colors 11026>>10 leshort x %d groups 11027>4 byte 32 cell 11028>>5 byte x %d bit 11029>>8 leshort x %d x 11030>>10 leshort x %d 11031>>12 leshort x +%d 11032>>14 leshort x +%d 11033 11034# Webshots (www.webshots.com), by John Harrison 110350 string C\253\221g\230\0\0\0 Webshots Desktop .wbz file 11036 11037# Hercules DASD image files 11038# From Jan Jaeger <jj@septa.nl> 110390 string CKD_P370 Hercules CKD DASD image file 11040>8 long x \b, %d heads per cylinder 11041>12 long x \b, track size %d bytes 11042>16 byte x \b, device type 33%2.2X 11043 110440 string CKD_C370 Hercules compressed CKD DASD image file 11045>8 long x \b, %d heads per cylinder 11046>12 long x \b, track size %d bytes 11047>16 byte x \b, device type 33%2.2X 11048 110490 string CKD_S370 Hercules CKD DASD shadow file 11050>8 long x \b, %d heads per cylinder 11051>12 long x \b, track size %d bytes 11052>16 byte x \b, device type 33%2.2X 11053 11054# Squeak images and programs - etoffi@softhome.net 110550 string \146\031\0\0 Squeak image data 110560 search/1 'From\040Squeak Squeak program text 11057 11058# partimage: file(1) magic for PartImage files (experimental, incomplete) 11059# Author: Hans-Joachim Baader <hjb@pro-linux.de> 110600 string PaRtImAgE-VoLuMe PartImage 11061>0x0020 string 0.6.1 file version %s 11062>>0x0060 lelong >-1 volume %ld 11063#>>0x0064 8 byte identifier 11064#>>0x007c reserved 11065>>0x0200 string >\0 type %s 11066>>0x1400 string >\0 device %s, 11067>>0x1600 string >\0 original filename %s, 11068# Some fields omitted 11069>>0x2744 lelong 0 not compressed 11070>>0x2744 lelong 1 gzip compressed 11071>>0x2744 lelong 2 bzip2 compressed 11072>>0x2744 lelong >2 compressed with unknown algorithm 11073>0x0020 string >0.6.1 file version %s 11074>0x0020 string <0.6.1 file version %s 11075 11076# DCX is multi-page PCX, using a simple header of up to 1024 11077# offsets for the respective PCX components. 11078# From: Joerg Wunsch <joerg_wunsch@uriah.heep.sax.de> 110790 lelong 987654321 DCX multi-page PCX image data 11080 11081# Simon Walton <simonw@matteworld.com> 11082# Kodak Cineon format for scanned negatives 11083# http://www.kodak.com/US/en/motion/support/dlad/ 110840 lelong 0xd75f2a80 Cineon image data 11085>200 belong >0 \b, %ld x 11086>204 belong >0 %ld 11087 11088 11089# Bio-Rad .PIC is an image format used by microscope control systems 11090# and related image processing software used by biologists. 11091# From: Vebjorn Ljosa <vebjorn@ljosa.com> 11092# BOOL values are two-byte integers; use them to rule out false positives. 11093# http://web.archive.org/web/20050317223257/www.cs.ubc.ca/spider/ladic/text/biorad.txt 11094# Samples: http://www.loci.wisc.edu/software/sample-data 1109514 leshort <2 11096>62 leshort <2 11097>>54 leshort 12345 Bio-Rad .PIC Image File 11098>>>0 leshort >0 %hd x 11099>>>2 leshort >0 %hd, 11100>>>4 leshort =1 1 image in file 11101>>>4 leshort >1 %hd images in file 11102 11103# From Jan "Yenya" Kasprzak <kas@fi.muni.cz> 11104# The description of *.mrw format can be found at 11105# http://www.dalibor.cz/minolta/raw_file_format.htm 111060 string \000MRM Minolta Dimage camera raw image data 11107 11108# Summary: DjVu image / document 11109# Extension: .djvu 11110# Reference: http://djvu.org/docs/DjVu3Spec.djvu 11111# Submitted by: Stephane Loeuillet <stephane.loeuillet@tiscali.fr> 11112# Modified by (1): Abel Cheung <abelcheung@gmail.com> 111130 string AT&TFORM 11114>12 string DJVM DjVu multiple page document 11115!:mime image/vnd.djvu 11116>12 string DJVU DjVu image or single page document 11117!:mime image/vnd.djvu 11118>12 string DJVI DjVu shared document 11119!:mime image/vnd.djvu 11120>12 string THUM DjVu page thumbnails 11121!:mime image/vnd.djvu 11122 11123# Originally by Marc Espie 11124# Modified by Robert Minsk <robertminsk at yahoo.com> 11125# http://www.openexr.com/openexrfilelayout.pdf 111260 lelong 20000630 OpenEXR image data, 11127!:mime image/x-exr 11128>4 lelong&0x000000ff x version %d, 11129>4 lelong ^0x00000200 storage: scanline 11130>4 lelong &0x00000200 storage: tiled 11131>8 search/0x1000 compression\0 \b, compression: 11132>>&16 byte 0 none 11133>>&16 byte 1 rle 11134>>&16 byte 2 zips 11135>>&16 byte 3 zip 11136>>&16 byte 4 piz 11137>>&16 byte 5 pxr24 11138>>&16 byte 6 b44 11139>>&16 byte 7 b44a 11140>>&16 byte >7 unknown 11141>8 search/0x1000 dataWindow\0 \b, dataWindow: 11142>>&10 lelong x (%d 11143>>&14 lelong x %d)- 11144>>&18 lelong x \b(%d 11145>>&22 lelong x %d) 11146>8 search/0x1000 displayWindow\0 \b, displayWindow: 11147>>&10 lelong x (%d 11148>>&14 lelong x %d)- 11149>>&18 lelong x \b(%d 11150>>&22 lelong x %d) 11151>8 search/0x1000 lineOrder\0 \b, lineOrder: 11152>>&14 byte 0 increasing y 11153>>&14 byte 1 decreasing y 11154>>&14 byte 2 random y 11155>>&14 byte >2 unknown 11156 11157# SMPTE Digital Picture Exchange Format, SMPTE DPX 11158# 11159# ANSI/SMPTE 268M-1994, SMPTE Standard for File Format for Digital 11160# Moving-Picture Exchange (DPX), v1.0, 18 February 1994 11161# Robert Minsk <robertminsk at yahoo.com> 111620 string SDPX DPX image data, big-endian, 11163!:mime image/x-dpx 11164>768 beshort <4 11165>>772 belong x %dx 11166>>776 belong x \b%d, 11167>768 beshort >3 11168>>776 belong x %dx 11169>>772 belong x \b%d, 11170>768 beshort 0 left to right/top to bottom 11171>768 beshort 1 right to left/top to bottom 11172>768 beshort 2 left to right/bottom to top 11173>768 beshort 3 right to left/bottom to top 11174>768 beshort 4 top to bottom/left to right 11175>768 beshort 5 top to bottom/right to left 11176>768 leshort 6 bottom to top/left to right 11177>768 leshort 7 bottom to top/right to left 11178 11179# From: Tom Hilinski <tom.hilinski@comcast.net> 11180# http://www.unidata.ucar.edu/packages/netcdf/ 111810 string CDF\001 NetCDF Data Format data 11182 11183#----------------------------------------------------------------------- 11184# Hierarchical Data Format, used to facilitate scientific data exchange 11185# specifications at http://hdf.ncsa.uiuc.edu/ 111860 belong 0x0e031301 Hierarchical Data Format (version 4) data 11187!:mime application/x-hdf 111880 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) data 11189!:mime application/x-hdf 11190512 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 512 bytes user block 11191!:mime application/x-hdf 111921024 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 1k user block 11193!:mime application/x-hdf 111942048 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 2k user block 11195!:mime application/x-hdf 111964096 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 4k user block 11197!:mime application/x-hdf 11198 11199 11200# From: Tobias Burnus <burnus@net-b.de> 11201# Xara (for a while: Corel Xara) is a graphic package, see 11202# http://www.xara.com/ for Windows and as GPL application for Linux 112030 string XARA\243\243 Xara graphics file 11204 11205# http://www.cartesianinc.com/Tech/ 112060 string CPC\262 Cartesian Perceptual Compression image 11207!:mime image/x-cpi 11208 11209# From Albert Cahalan <acahalan@gmail.com> 11210# puredigital used it for the CVS disposable camcorder 11211#8 lelong 4 ZBM bitmap image data 11212#>4 leshort x %u x 11213#>6 leshort x %u 11214 11215# From Albert Cahalan <acahalan@gmail.com> 11216# uncompressed 5:6:5 HighColor image for OLPC XO firmware icons 112170 string C565 OLPC firmware icon image data 11218>4 leshort x %u x 11219>6 leshort x %u 11220 11221# Applied Images - Image files from Cytovision 11222# Gustavo Junior Alves <gjalves@gjalves.com.br> 112230 string \xce\xda\xde\xfa Cytovision Metaphases file 112240 string \xed\xad\xef\xac Cytovision Karyotype file 112250 string \x0b\x00\x03\x00 Cytovision FISH Probe file 112260 string \xed\xfe\xda\xbe Cytovision FLEX file 112270 string \xed\xab\xed\xfe Cytovision FLEX file 112280 string \xad\xfd\xea\xad Cytovision RATS file 11229 11230# Wavelet Scalar Quantization format used in gray-scale fingerprint images 11231# From Tano M Fotang <mfotang@quanteq.com> 112320 string \xff\xa0\xff\xa8\x00 Wavelet Scalar Quantization image data 11233 11234# Type: PCO B16 image files 11235# URL: http://www.pco.de/fileadmin/user_upload/db/download/MA_CWDCOPIE_0412b.pdf 11236# From: Florian Philipp <florian.philipp@binarywings.net> 11237# Extension: .b16 11238# Description: Pixel image format produced by PCO Camware, typically used 11239# together with PCO cameras. 11240# Note: Different versions exist for e.g. 8 bit and 16 bit images. 11241# Documentation is incomplete. 112420 string/b PCO- PCO B16 image data 11243>12 lelong x \b, %dx 11244>16 lelong x \b%d 11245>20 lelong 0 \b, short header 11246>20 lelong -1 \b, extended header 11247>>24 lelong 0 \b, grayscale 11248>>>36 lelong 0 linear LUT 11249>>>36 lelong 1 logarithmic LUT 11250>>>28 lelong x [%d 11251>>>32 lelong x \b,%d] 11252>>24 lelong 1 \b, color 11253>>>64 lelong 0 linear LUT 11254>>>64 lelong 1 logarithmic LUT 11255>>>40 lelong x r[%d 11256>>>44 lelong x \b,%d] 11257>>>48 lelong x g[%d 11258>>>52 lelong x \b,%d] 11259>>>56 lelong x b[%d 11260>>>60 lelong x \b,%d] 11261 11262# Polar Monitor Bitmap (.pmb) used as logo for Polar Electro watches 11263# From: Markus Heidelberg <markus.heidelberg at web.de> 112640 string/t [BitmapInfo2] Polar Monitor Bitmap text 11265!:mime image/x-polar-monitor-bitmap 11266 11267# From: Rick Richardson <rick.richardson@comcast.net> 112680 string GARMIN\ BITMAP\ 01 Garmin Bitmap file 11269 11270# Type: Ulead Photo Explorer5 (.pe5) 11271# URL: http://www.jisyo.com/cgibin/view.cgi?EXT=pe5 (Japanese) 11272# From: Simon Horman <horms@debian.org> 112730 string IIO2H Ulead Photo Explorer5 11274 11275# Type: X11 cursor 11276# URL: http://webcvs.freedesktop.org/mime/shared-mime-info/freedesktop.org.xml.in?view=markup 11277# From: Mathias Brodala <info@noctus.net> 112780 string Xcur X11 cursor 11279 11280# Type: Olympus ORF raw images. 11281# URL: http://libopenraw.freedesktop.org/wiki/Olympus_ORF 11282# From: Adam Buchbinder <adam.buchbinder@gmail.com> 112830 string MMOR Olympus ORF raw image data, big-endian 11284!:mime image/x-olympus-orf 112850 string IIRO Olympus ORF raw image data, little-endian 11286!:mime image/x-olympus-orf 112870 string IIRS Olympus ORF raw image data, little-endian 11288!:mime image/x-olympus-orf 11289 11290# Type: files used in modern AVCHD camcoders to store clip information 11291# Extension: .cpi 11292# From: Alexander Danilov <alexander.a.danilov@gmail.com> 112930 string HDMV0100 AVCHD Clip Information 11294 11295# From: Adam Buchbinder <adam.buchbinder@gmail.com> 11296# URL: http://local.wasp.uwa.edu.au/~pbourke/dataformats/pic/ 11297# Radiance HDR; usually has .pic or .hdr extension. 112980 string #?RADIANCE\n Radiance HDR image data 11299#!mime image/vnd.radiance 11300 11301# From: Adam Buchbinder <adam.buchbinder@gmail.com> 11302# URL: http://www.mpi-inf.mpg.de/resources/pfstools/pfs_format_spec.pdf 11303# Used by the pfstools packages. The regex matches for the image size could 11304# probably use some work. The MIME type is made up; if there's one in 11305# actual common use, it should replace the one below. 113060 string PFS1\x0a PFS HDR image data 11307#!mime image/x-pfs 11308>1 regex [0-9]*\ \b, %s 11309>>1 regex \ [0-9]{4} \bx%s 11310 11311# Type: Foveon X3F 11312# URL: http://www.photofo.com/downloads/x3f-raw-format.pdf 11313# From: Adam Buchbinder <adam.buchbinder@gmail.com> 11314# Note that the MIME type isn't defined anywhere that I can find; if 11315# there's a canonical type for this format, it should replace this one. 113160 string FOVb Foveon X3F raw image data 11317!:mime image/x-x3f 11318>6 leshort x \b, version %d. 11319>4 leshort x \b%d 11320>28 lelong x \b, %dx 11321>32 lelong x \b%d 11322 11323# Paint.NET file 11324# From Adam Buchbinder <adam.buchbinder@gmail.com> 113250 string PDN3 Paint.NET image data 11326!:mime image/x-paintnet 11327 11328# Not really an image. 11329# From: "Tano M. Fotang" <mfotang@quanteq.com> 113300 string \x46\x4d\x52\x00 ISO/IEC 19794-2 Format Minutiae Record (FMR) 11331 11332# WEBP https://developers.google.com/speed/webp/docs/riff_container 113330 string RIFF 11334>8 string WEBP Web/P image data 11335>>4 lelong x \b, %d bytes 11336 11337#------------------------------------------------------------------------------ 11338# $File: inform,v 1.5 2009/09/19 16:28:09 christos Exp $ 11339# inform: file(1) magic for Inform interactive fiction language 11340 11341# URL: http://www.inform-fiction.org/ 11342# From: Reuben Thomas <rrt@sc3d.org> 11343 113440 search/100/cW constant\ story Inform source text 11345 11346#------------------------------------------------------------------------------ 11347# $File: intel,v 1.11 2013/02/06 14:18:52 christos Exp $ 11348# intel: file(1) magic for x86 Unix 11349# 11350# Various flavors of x86 UNIX executable/object (other than Xenix, which 11351# is in "microsoft"). DOS is in "msdos"; the ambitious soul can do 11352# Windows as well. 11353# 11354# Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and 11355# whatever comes next (HP-PA Hummingbird?). OS/2 may also go elsewhere 11356# as well, if, as, and when IBM makes it portable. 11357# 11358# The `versions' should be un-commented if they work for you. 11359# (Was the problem just one of endianness?) 11360# 113610 leshort 0502 basic-16 executable 11362>12 lelong >0 not stripped 11363#>22 leshort >0 - version %ld 113640 leshort 0503 basic-16 executable (TV) 11365>12 lelong >0 not stripped 11366#>22 leshort >0 - version %ld 113670 leshort 0510 x86 executable 11368>12 lelong >0 not stripped 113690 leshort 0511 x86 executable (TV) 11370>12 lelong >0 not stripped 113710 leshort =0512 iAPX 286 executable small model (COFF) 11372>12 lelong >0 not stripped 11373#>22 leshort >0 - version %ld 113740 leshort =0522 iAPX 286 executable large model (COFF) 11375>12 lelong >0 not stripped 11376#>22 leshort >0 - version %ld 11377# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan 113780 leshort =0514 80386 COFF executable 11379>12 lelong >0 not stripped 11380>22 leshort >0 - version %ld 11381 11382# rom: file(1) magic for BIOS ROM Extensions found in intel machines 11383# mapped into memory between 0xC0000 and 0xFFFFF 11384# From Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu 113850 beshort 0x55AA BIOS (ia32) ROM Ext. 11386>5 string USB USB 11387>7 string LDR UNDI image 11388>30 string IBM IBM comp. Video 11389>26 string Adaptec Adaptec 11390>28 string Adaptec Adaptec 11391>42 string PROMISE Promise 11392>2 byte x (%d*512) 11393 11394# Flash descriptors for Intel SPI flash roms. 11395# From Dr. Jesus <j@hug.gs> 113960 lelong 0x0ff0a55a Intel serial flash for ICH/PCH ROM <= 5 or 3400 series A-step 1139716 lelong 0x0ff0a55a Intel serial flash for PCH ROM 11398 11399#------------------------------------------------------------------------------ 11400# $File: interleaf,v 1.10 2009/09/19 16:28:10 christos Exp $ 11401# interleaf: file(1) magic for InterLeaf TPS: 11402# 114030 string =\210OPS Interleaf saved data 114040 string =<!OPS Interleaf document text 11405>5 string ,\ Version\ = \b, version 11406>>17 string >\0 %.3s 11407 11408#------------------------------------------------------------------------------ 11409# $File: island,v 1.5 2009/09/19 16:28:10 christos Exp $ 11410# island: file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1 11411# "/etc/magic": 11412# From: guy@netapp.com (Guy Harris) 11413# 114144 string pgscriptver IslandWrite document 1141513 string DrawFile IslandDraw document 11416 11417 11418#------------------------------------------------------------------------------ 11419# $File: ispell,v 1.8 2009/09/19 16:28:10 christos Exp $ 11420# ispell: file(1) magic for ispell 11421# 11422# Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602. This magic 11423# will match 0x9600 through 0x9603 in *both* little endian and big endian. 11424# (No other current magic entries collide.) 11425# 11426# Updated by Daniel Quinlan (quinlan@yggdrasil.com) 11427# 114280 leshort&0xFFFC 0x9600 little endian ispell 11429>0 byte 0 hash file (?), 11430>0 byte 1 3.0 hash file, 11431>0 byte 2 3.1 hash file, 11432>0 byte 3 hash file (?), 11433>2 leshort 0x00 8-bit, no capitalization, 26 flags 11434>2 leshort 0x01 7-bit, no capitalization, 26 flags 11435>2 leshort 0x02 8-bit, capitalization, 26 flags 11436>2 leshort 0x03 7-bit, capitalization, 26 flags 11437>2 leshort 0x04 8-bit, no capitalization, 52 flags 11438>2 leshort 0x05 7-bit, no capitalization, 52 flags 11439>2 leshort 0x06 8-bit, capitalization, 52 flags 11440>2 leshort 0x07 7-bit, capitalization, 52 flags 11441>2 leshort 0x08 8-bit, no capitalization, 128 flags 11442>2 leshort 0x09 7-bit, no capitalization, 128 flags 11443>2 leshort 0x0A 8-bit, capitalization, 128 flags 11444>2 leshort 0x0B 7-bit, capitalization, 128 flags 11445>2 leshort 0x0C 8-bit, no capitalization, 256 flags 11446>2 leshort 0x0D 7-bit, no capitalization, 256 flags 11447>2 leshort 0x0E 8-bit, capitalization, 256 flags 11448>2 leshort 0x0F 7-bit, capitalization, 256 flags 11449>4 leshort >0 and %d string characters 114500 beshort&0xFFFC 0x9600 big endian ispell 11451>1 byte 0 hash file (?), 11452>1 byte 1 3.0 hash file, 11453>1 byte 2 3.1 hash file, 11454>1 byte 3 hash file (?), 11455>2 beshort 0x00 8-bit, no capitalization, 26 flags 11456>2 beshort 0x01 7-bit, no capitalization, 26 flags 11457>2 beshort 0x02 8-bit, capitalization, 26 flags 11458>2 beshort 0x03 7-bit, capitalization, 26 flags 11459>2 beshort 0x04 8-bit, no capitalization, 52 flags 11460>2 beshort 0x05 7-bit, no capitalization, 52 flags 11461>2 beshort 0x06 8-bit, capitalization, 52 flags 11462>2 beshort 0x07 7-bit, capitalization, 52 flags 11463>2 beshort 0x08 8-bit, no capitalization, 128 flags 11464>2 beshort 0x09 7-bit, no capitalization, 128 flags 11465>2 beshort 0x0A 8-bit, capitalization, 128 flags 11466>2 beshort 0x0B 7-bit, capitalization, 128 flags 11467>2 beshort 0x0C 8-bit, no capitalization, 256 flags 11468>2 beshort 0x0D 7-bit, no capitalization, 256 flags 11469>2 beshort 0x0E 8-bit, capitalization, 256 flags 11470>2 beshort 0x0F 7-bit, capitalization, 256 flags 11471>4 beshort >0 and %d string characters 11472# ispell 4.0 hash files kromJx <kromJx@crosswinds.net> 11473# Ispell 4.0 114740 string ISPL ispell 11475>4 long x hash file version %d, 11476>8 long x lexletters %d, 11477>12 long x lexsize %d, 11478>16 long x hashsize %d, 11479>20 long x stblsize %d 11480 11481#------------------------------------------------------------------------------ 11482# $File: isz,v 1.1 2010/03/27 16:17:09 christos Exp $ 11483# ISO Zipped file format 11484# http://www.ezbsystems.com/isz/iszspec.txt 114850 string IsZ! ISO Zipped file 11486>4 byte x \b, header size %u 11487>5 byte x \b, version %u 11488>8 lelong x \b, serial %u 11489#12 leshort x \b, sector size %u 11490#>16 lelong x \b, total sectors %u 11491>17 byte >0 \b, password protected 11492#>24 lequad x \b, segment size %llu 11493#>32 lelong x \b, blocks %u 11494#>36 lelong x \b, block size %u 11495 11496#------------------------------------------------------------ 11497# $File: java,v 1.16 2013/09/24 20:22:03 christos Exp $ 11498# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the 11499# same magic number, 0xcafebabe, so they are both handled 11500# in the entry called "cafebabe". 11501#------------------------------------------------------------ 11502# Java serialization 11503# From Martin Pool (m.pool@pharos.com.au) 115040 beshort 0xaced Java serialization data 11505>2 beshort >0x0004 \b, version %d 11506 115070 belong 0xfeedfeed Java KeyStore 11508!:mime application/x-java-keystore 115090 belong 0xcececece Java JCE KeyStore 11510!:mime application/x-java-jce-keystore 11511 11512# Java source 115130 regex ^import.*;$ Java source 11514!:mime text/x-java 11515 11516#------------------------------------------------------------------------------ 11517# $File: javascript,v 1.1 2012/06/16 13:30:36 christos Exp $ 11518# javascript: magic for javascript and node.js scripts. 11519# 115200 search/1/w #!/bin/node Node.js script text executable 11521!:mime application/javascript 115220 search/1/w #!/usr/bin/node Node.js script text executable 11523!:mime application/javascript 115240 search/1/w #!/bin/nodejs Node.js script text executable 11525!:mime application/javascript 115260 search/1/w #!/usr/bin/nodejs Node.js script text executable 11527!:mime application/javascript 115280 search/1 #!/usr/bin/env\ node Node.js script text executable 11529!:mime application/javascript 115300 search/1 #!/usr/bin/env\ nodejs Node.js script text executable 11531!:mime application/javascript 11532 11533#------------------------------------------------------------------------------ 11534# $File: jpeg,v 1.19 2013/02/04 15:50:03 christos Exp $ 11535# JPEG images 11536# SunOS 5.5.1 had 11537# 11538# 0 string \377\330\377\340 JPEG file 11539# 0 string \377\330\377\356 JPG file 11540# 11541# both of which turn into "JPEG image data" here. 11542# 115430 beshort 0xffd8 JPEG image data 11544!:mime image/jpeg 11545!:apple 8BIMJPEG 11546!:strength +2 11547>6 string JFIF \b, JFIF standard 11548# The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06 11549# in a vain attempt to add image size reporting for JFIF. Note that these 11550# tests are not fool-proof since some perfectly valid JPEGs are currently 11551# impossible to specify in magic(4) format. 11552# First, a little JFIF version info: 11553>>11 byte x \b %d. 11554>>12 byte x \b%02d 11555# Next, the resolution or aspect ratio of the image: 11556#>>13 byte 0 \b, aspect ratio 11557#>>13 byte 1 \b, resolution (DPI) 11558#>>13 byte 2 \b, resolution (DPCM) 11559#>>4 beshort x \b, segment length %d 11560# Next, show thumbnail info, if it exists: 11561>>18 byte !0 \b, thumbnail %dx 11562>>>19 byte x \b%d 11563 11564# EXIF moved down here to avoid reporting a bogus version number, 11565# and EXIF version number printing added. 11566# - Patrik R=E5dman <patrik+file-magic@iki.fi> 11567>6 string Exif \b, EXIF standard 11568# Look for EXIF IFD offset in IFD 0, and then look for EXIF version tag in EXIF IFD. 11569# All possible combinations of entries have to be enumerated, since no looping 11570# is possible. And both endians are possible... 11571# The combinations included below are from real-world JPEGs. 11572# Little-endian 11573>>12 string II 11574# IFD 0 Entry #5: 11575>>>70 leshort 0x8769 11576# EXIF IFD Entry #1: 11577>>>>(78.l+14) leshort 0x9000 11578>>>>>(78.l+23) byte x %c 11579>>>>>(78.l+24) byte x \b.%c 11580>>>>>(78.l+25) byte !0x30 \b%c 11581# IFD 0 Entry #9: 11582>>>118 leshort 0x8769 11583# EXIF IFD Entry #3: 11584>>>>(126.l+38) leshort 0x9000 11585>>>>>(126.l+47) byte x %c 11586>>>>>(126.l+48) byte x \b.%c 11587>>>>>(126.l+49) byte !0x30 \b%c 11588# IFD 0 Entry #10 11589>>>130 leshort 0x8769 11590# EXIF IFD Entry #3: 11591>>>>(138.l+38) leshort 0x9000 11592>>>>>(138.l+47) byte x %c 11593>>>>>(138.l+48) byte x \b.%c 11594>>>>>(138.l+49) byte !0x30 \b%c 11595# EXIF IFD Entry #4: 11596>>>>(138.l+50) leshort 0x9000 11597>>>>>(138.l+59) byte x %c 11598>>>>>(138.l+60) byte x \b.%c 11599>>>>>(138.l+61) byte !0x30 \b%c 11600# EXIF IFD Entry #5: 11601>>>>(138.l+62) leshort 0x9000 11602>>>>>(138.l+71) byte x %c 11603>>>>>(138.l+72) byte x \b.%c 11604>>>>>(138.l+73) byte !0x30 \b%c 11605# IFD 0 Entry #11 11606>>>142 leshort 0x8769 11607# EXIF IFD Entry #3: 11608>>>>(150.l+38) leshort 0x9000 11609>>>>>(150.l+47) byte x %c 11610>>>>>(150.l+48) byte x \b.%c 11611>>>>>(150.l+49) byte !0x30 \b%c 11612# EXIF IFD Entry #4: 11613>>>>(150.l+50) leshort 0x9000 11614>>>>>(150.l+59) byte x %c 11615>>>>>(150.l+60) byte x \b.%c 11616>>>>>(150.l+61) byte !0x30 \b%c 11617# EXIF IFD Entry #5: 11618>>>>(150.l+62) leshort 0x9000 11619>>>>>(150.l+71) byte x %c 11620>>>>>(150.l+72) byte x \b.%c 11621>>>>>(150.l+73) byte !0x30 \b%c 11622# Big-endian 11623>>12 string MM 11624# IFD 0 Entry #9: 11625>>>118 beshort 0x8769 11626# EXIF IFD Entry #1: 11627>>>>(126.L+14) beshort 0x9000 11628>>>>>(126.L+23) byte x %c 11629>>>>>(126.L+24) byte x \b.%c 11630>>>>>(126.L+25) byte !0x30 \b%c 11631# EXIF IFD Entry #3: 11632>>>>(126.L+38) beshort 0x9000 11633>>>>>(126.L+47) byte x %c 11634>>>>>(126.L+48) byte x \b.%c 11635>>>>>(126.L+49) byte !0x30 \b%c 11636# IFD 0 Entry #10 11637>>>130 beshort 0x8769 11638# EXIF IFD Entry #3: 11639>>>>(138.L+38) beshort 0x9000 11640>>>>>(138.L+47) byte x %c 11641>>>>>(138.L+48) byte x \b.%c 11642>>>>>(138.L+49) byte !0x30 \b%c 11643# EXIF IFD Entry #5: 11644>>>>(138.L+62) beshort 0x9000 11645>>>>>(138.L+71) byte x %c 11646>>>>>(138.L+72) byte x \b.%c 11647>>>>>(138.L+73) byte !0x30 \b%c 11648# IFD 0 Entry #11 11649>>>142 beshort 0x8769 11650# EXIF IFD Entry #4: 11651>>>>(150.L+50) beshort 0x9000 11652>>>>>(150.L+59) byte x %c 11653>>>>>(150.L+60) byte x \b.%c 11654>>>>>(150.L+61) byte !0x30 \b%c 11655# Here things get sticky. We can do ONE MORE marker segment with 11656# indirect addressing, and that's all. It would be great if we could 11657# do pointer arithemetic like in an assembler language. Christos? 11658# And if there was some sort of looping construct to do searches, plus a few 11659# named accumulators, it would be even more effective... 11660# At least we can show a comment if no other segments got inserted before: 11661>(4.S+5) byte 0xFE \b, comment: 11662>>(4.S+6) pstring/HJ x "%s" 11663# Or, we can show the encoding type (I've included only the three most common) 11664# and image dimensions if we are lucky and the SOFn (image segment) is here: 11665>(4.S+5) byte 0xC0 \b, baseline 11666>>(4.S+6) byte x \b, precision %d 11667>>(4.S+7) beshort x \b, %dx 11668>>(4.S+9) beshort x \b%d 11669>(4.S+5) byte 0xC1 \b, extended sequential 11670>>(4.S+6) byte x \b, precision %d 11671>>(4.S+7) beshort x \b, %dx 11672>>(4.S+9) beshort x \b%d 11673>(4.S+5) byte 0xC2 \b, progressive 11674>>(4.S+6) byte x \b, precision %d 11675>>(4.S+7) beshort x \b, %dx 11676>>(4.S+9) beshort x \b%d 11677# I've commented-out quantisation table reporting. I doubt anyone cares yet. 11678#>(4.S+5) byte 0xDB \b, quantisation table 11679#>>(4.S+6) beshort x \b length=%d 11680#>14 beshort x \b, %d x 11681#>16 beshort x \b %d 11682 11683# HSI is Handmade Software's proprietary JPEG encoding scheme 116840 string hsi1 JPEG image data, HSI proprietary 11685 11686# From: David Santinoli <david@santinoli.com> 116870 string \x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A JPEG 2000 11688# From: Johan van der Knijff <johan.vanderknijff@kb.nl> 11689# Added sub-entries for JP2, JPX, JPM and MJ2 formats; added mimetypes 11690# https://github.com/bitsgalore/jp2kMagic 11691# 11692# Now read value of 'Brand' field, which yields a few possibilities: 11693>20 string \x6a\x70\x32\x20 Part 1 (JP2) 11694!:mime image/jp2 11695>20 string \x6a\x70\x78\x20 Part 2 (JPX) 11696!:mime image/jpx 11697>20 string \x6a\x70\x6d\x20 Part 6 (JPM) 11698!:mime image/jpm 11699>20 string \x6d\x6a\x70\x32 Part 3 (MJ2) 11700!:mime video/mj2 11701 11702# Type: JPEG 2000 codesream 11703# From: Mathieu Malaterre <mathieu.malaterre@gmail.com> 117040 belong 0xff4fff51 JPEG 2000 codestream 1170545 beshort 0xff52 11706 11707#------------------------------------------------------------------------------ 11708# $File: karma,v 1.6 2009/09/19 16:28:10 christos Exp $ 11709# karma: file(1) magic for Karma data files 11710# 11711# From <rgooch@atnf.csiro.au> 11712 117130 string KarmaRHD Version Karma Data Structure Version 11714>16 belong x %lu 11715 11716#------------------------------------------------------------------------------ 11717# $File: kde,v 1.5 2010/11/25 15:00:12 christos Exp $ 11718# kde: file(1) magic for KDE 11719 117200 string/t [KDE\ Desktop\ Entry] KDE desktop entry 11721!:mime application/x-kdelnk 117220 string/t #\ KDE\ Config\ File KDE config file 11723!:mime application/x-kdelnk 117240 string/t #\ xmcd xmcd database file for kscd 11725!:mime text/x-xmcd 11726 11727#------------------------------------------------------------------------------ 11728# $File: keepass,v 1.1 2012/12/24 22:14:56 christos Exp $ 11729# keepass: file(1) magic for KeePass file 11730# 11731# Keepass Password Safe: 11732# * original one: http://keepass.info/ 11733# * *nix port: http://www.keepassx.org/ 11734# * android port: http://code.google.com/p/keepassdroid/ 11735 117360 lelong 0x9AA2D903 Keepass password database 11737>4 lelong 0xB54BFB65 1.x KDB 11738>>48 lelong >0 \b, %d groups 11739>>52 lelong >0 \b, %d entries 11740>>8 lelong&0x0f 1 \b, SHA-256 11741>>8 lelong&0x0f 2 \b, AES 11742>>8 lelong&0x0f 4 \b, RC4 11743>>8 lelong&0x0f 8 \b, Twofish 11744>>120 lelong >0 \b, %d key transformation rounds 11745>4 lelong 0xB54BFB67 2.x KDBX 11746 11747#------------------------------------------------------------------------------ 11748# $File: kml,v 1.3 2010/11/25 15:00:12 christos Exp $ 11749# Type: Google KML, formerly Keyhole Markup Language 11750# Future development of this format has been handed 11751# over to the Open Geospatial Consortium. 11752# http://www.opengeospatial.org/standards/kml/ 11753# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 117540 string/t \<?xml 11755>20 search/400 \ xmlns= 11756>>&0 regex ['"]http://earth.google.com/kml Google KML document 11757!:mime application/vnd.google-earth.kml+xml 11758>>>&1 string 2.0' \b, version 2.0 11759>>>&1 string 2.1' \b, version 2.1 11760>>>&1 string 2.2' \b, version 2.2 11761 11762#------------------------------------------------------------------------------ 11763# Type: OpenGIS KML, formerly Keyhole Markup Language 11764# This standard is maintained by the 11765# Open Geospatial Consortium. 11766# http://www.opengeospatial.org/standards/kml/ 11767# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 11768>>&0 regex ['"]http://www.opengis.net/kml OpenGIS KML document 11769!:mime application/vnd.google-earth.kml+xml 11770>>>&1 string/t 2.2 \b, version 2.2 11771 11772#------------------------------------------------------------------------------ 11773# Type: Google KML Archive (ZIP based) 11774# http://code.google.com/apis/kml/documentation/kml_tut.html 11775# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 117760 string PK\003\004 11777>4 byte 0x14 11778>>30 string doc.kml Compressed Google KML Document, including resources. 11779!:mime application/vnd.google-earth.kmz 11780 11781#------------------------------------------------------------------------------ 11782# $File: lecter,v 1.4 2009/09/19 16:28:10 christos Exp $ 11783# DEC SRC Virtual Paper: Lectern files 11784# Karl M. Hegbloom <karlheg@inetarena.com> 117850 string lect DEC SRC Virtual Paper Lectern file 11786 11787#------------------------------------------------------------------------------ 11788# $File: lex,v 1.6 2009/09/19 16:28:10 christos Exp $ 11789# lex: file(1) magic for lex 11790# 11791# derived empirically, your offsets may vary! 117920 search/100 yyprevious C program text (from lex) 11793>3 search/1 >\0 for %s 11794# C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com> 117950 search/100 generated\ by\ flex C program text (from flex) 11796# lex description file, from Daniel Quinlan <quinlan@yggdrasil.com> 117970 search/1 %{ lex description text 11798 11799#------------------------------------------------------------------------------ 11800# $File: lif,v 1.8 2009/09/19 16:28:10 christos Exp $ 11801# lif: file(1) magic for lif 11802# 11803# (Daniel Quinlan <quinlan@yggdrasil.com>) 11804# 118050 beshort 0x8000 lif file 11806 11807#------------------------------------------------------------------------------ 11808# $File: linux,v 1.53 2014/01/08 22:26:12 christos Exp $ 11809# linux: file(1) magic for Linux files 11810# 11811# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com> 11812# The following basic Linux magic is useful for reference, but using 11813# "long" magic is a better practice in order to avoid collisions. 11814# 11815# 2 leshort 100 Linux/i386 11816# >0 leshort 0407 impure executable (OMAGIC) 11817# >0 leshort 0410 pure executable (NMAGIC) 11818# >0 leshort 0413 demand-paged executable (ZMAGIC) 11819# >0 leshort 0314 demand-paged executable (QMAGIC) 11820# 118210 lelong 0x00640107 Linux/i386 impure executable (OMAGIC) 11822>16 lelong 0 \b, stripped 118230 lelong 0x00640108 Linux/i386 pure executable (NMAGIC) 11824>16 lelong 0 \b, stripped 118250 lelong 0x0064010b Linux/i386 demand-paged executable (ZMAGIC) 11826>16 lelong 0 \b, stripped 118270 lelong 0x006400cc Linux/i386 demand-paged executable (QMAGIC) 11828>16 lelong 0 \b, stripped 11829# 118300 string \007\001\000 Linux/i386 object file 11831>20 lelong >0x1020 \b, DLL library 11832# Linux-8086 stuff: 118330 string \01\03\020\04 Linux-8086 impure executable 11834>28 long !0 not stripped 118350 string \01\03\040\04 Linux-8086 executable 11836>28 long !0 not stripped 11837# 118380 string \243\206\001\0 Linux-8086 object file 11839# 118400 string \01\03\020\20 Minix-386 impure executable 11841>28 long !0 not stripped 118420 string \01\03\040\20 Minix-386 executable 11843>28 long !0 not stripped 118440 string \01\03\04\20 Minix-386 NSYM/GNU executable 11845>28 long !0 not stripped 11846# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov> 11847216 lelong 0421 Linux/i386 core file 11848>220 string >\0 of '%s' 11849>200 lelong >0 (signal %d) 11850# 11851# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com> 11852# this can be overridden by the DOS executable (COM) entry 118532 string LILO Linux/i386 LILO boot/chain loader 11854# 11855# Linux make config build file, from Ole Aamot <oka@oka.no> 11856# Updated by Ken Sharp 1185728 string make\ config Linux make config build file (old) 1185849 search/70 Kernel\ Configuration Linux make config build file 11859 11860# 11861# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com> 11862# Updated by Adam Buchbinder <adam.buchbinder@gmail.com> 11863# See: http://www.win.tue.nl/~aeb/linux/kbd/font-formats-1.html 118640 leshort 0x0436 Linux/i386 PC Screen Font v1 data, 11865>2 byte&0x01 0 256 characters, 11866>2 byte&0x01 !0 512 characters, 11867>2 byte&0x02 0 no directory, 11868>2 byte&0x02 !0 Unicode directory, 11869>3 byte >0 8x%d 118700 string \x72\xb5\x4a\x86\x00\x00 Linux/i386 PC Screen Font v2 data, 11871>16 lelong x %d characters, 11872>12 lelong&0x01 0 no directory, 11873>12 lelong&0x01 !0 Unicode directory, 11874>24 lelong x %d 11875>28 lelong x \bx%d 11876 11877# Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com> 118784086 string SWAP-SPACE Linux/i386 swap file 11879# From: Jeff Bailey <jbailey@ubuntu.com> 11880# Linux swap file with swsusp1 image, from Jeff Bailey <jbailey@ubuntu.com> 118814076 string SWAPSPACE2S1SUSPEND Linux/i386 swap file (new style) with SWSUSP1 image 11882# From: James Hunt <james.hunt@ubuntu.com> 118834076 string SWAPSPACE2LINHIB0001 Linux/i386 swap file (new style) (compressed hibernate) 11884# according to man page of mkswap (8) March 1999 11885# volume label and UUID Russell Coker 11886# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/ 118874086 string SWAPSPACE2 Linux/i386 swap file (new style), 11888>0x400 long x version %d (4K pages), 11889>0x404 long x size %d pages, 11890>1052 string \0 no label, 11891>1052 string >\0 LABEL=%s, 11892>0x40c belong x UUID=%08x 11893>0x410 beshort x \b-%04x 11894>0x412 beshort x \b-%04x 11895>0x414 beshort x \b-%04x 11896>0x416 belong x \b-%08x 11897>0x41a beshort x \b%04x 11898# From Daniel Novotny <dnovotny@redhat.com> 11899# swap file for PowerPC 1190065526 string SWAPSPACE2 Linux/ppc swap file 1190116374 string SWAPSPACE2 Linux/ia64 swap file 11902# 11903# Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu> 11904# and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de> 11905# and Nicolas Lichtmaier <nick@debian.org> 11906# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29 11907# Linux kernel boot images (i386 arch) (Wolfram Kleff) 11908514 string HdrS Linux kernel 11909!:strength + 55 11910>510 leshort 0xAA55 x86 boot executable 11911>>518 leshort >0x1ff 11912>>>529 byte 0 zImage, 11913>>>529 byte 1 bzImage, 11914>>>526 lelong >0 11915>>>>(526.s+0x200) string >\0 version %s, 11916>>498 leshort 1 RO-rootFS, 11917>>498 leshort 0 RW-rootFS, 11918>>508 leshort >0 root_dev 0x%X, 11919>>502 leshort >0 swap_dev 0x%X, 11920>>504 leshort >0 RAMdisksize %u KB, 11921>>506 leshort 0xFFFF Normal VGA 11922>>506 leshort 0xFFFE Extended VGA 11923>>506 leshort 0xFFFD Prompt for Videomode 11924>>506 leshort >0 Video mode %d 11925# This also matches new kernels, which were caught above by "HdrS". 119260 belong 0xb8c0078e Linux kernel 11927>0x1e3 string Loading version 1.3.79 or older 11928>0x1e9 string Loading from prehistoric times 11929 11930# System.map files - Nicolas Lichtmaier <nick@debian.org> 119318 search/1 \ A\ _text Linux kernel symbol map text 11932 11933# LSM entries - Nicolas Lichtmaier <nick@debian.org> 119340 search/1 Begin3 Linux Software Map entry text 119350 search/1 Begin4 Linux Software Map entry text (new format) 11936 11937# From Matt Zimmerman, enhanced for v3 by Matthew Palmer 119380 belong 0x4f4f4f4d User-mode Linux COW file 11939>4 belong <3 \b, version %d 11940>>8 string >\0 \b, backing file %s 11941>4 belong >2 \b, version %d 11942>>32 string >\0 \b, backing file %s 11943 11944############################################################################ 11945# Linux kernel versions 11946 119470 string \xb8\xc0\x07\x8e\xd8\xb8\x00\x90 Linux 11948>497 leshort 0 x86 boot sector 11949>>514 belong 0x8e of a kernel from the dawn of time! 11950>>514 belong 0x908ed8b4 version 0.99-1.1.42 11951>>514 belong 0x908ed8b8 for memtest86 11952 11953>497 leshort !0 x86 kernel 11954>>504 leshort >0 RAMdisksize=%u KB 11955>>502 leshort >0 swap=0x%X 11956>>508 leshort >0 root=0x%X 11957>>>498 leshort 1 \b-ro 11958>>>498 leshort 0 \b-rw 11959>>506 leshort 0xFFFF vga=normal 11960>>506 leshort 0xFFFE vga=extended 11961>>506 leshort 0xFFFD vga=ask 11962>>506 leshort >0 vga=%d 11963>>514 belong 0x908ed881 version 1.1.43-1.1.45 11964>>514 belong 0x15b281cd 11965>>>0xa8e belong 0x55AA5a5a version 1.1.46-1.2.13,1.3.0 11966>>>0xa99 belong 0x55AA5a5a version 1.3.1,2 11967>>>0xaa3 belong 0x55AA5a5a version 1.3.3-1.3.30 11968>>>0xaa6 belong 0x55AA5a5a version 1.3.31-1.3.41 11969>>>0xb2b belong 0x55AA5a5a version 1.3.42-1.3.45 11970>>>0xaf7 belong 0x55AA5a5a version 1.3.46-1.3.72 11971>>514 string HdrS 11972>>>518 leshort >0x1FF 11973>>>>529 byte 0 \b, zImage 11974>>>>529 byte 1 \b, bzImage 11975>>>>(526.s+0x200) string >\0 \b, version %s 11976 11977# Linux boot sector thefts. 119780 belong 0xb8c0078e Linux 11979>0x1e6 belong 0x454c4b53 ELKS Kernel 11980>0x1e6 belong !0x454c4b53 style boot sector 11981 11982############################################################################ 11983# Linux S390 kernel image 11984# Created by: Jan Kaluza <jkaluza@redhat.com> 119858 string \x02\x00\x00\x18\x60\x00\x00\x50\x02\x00\x00\x68\x60\x00\x00\x50\x40\x40\x40\x40\x40\x40\x40\x40 Linux S390 11986>0x00010000 search/b/4096 \x00\x0a\x00\x00\x8b\xad\xcc\xcc 11987# 64bit 11988>>&0 string \xc1\x00\xef\xe3\xf0\x68\x00\x00 Z10 64bit kernel 11989>>&0 string \xc1\x00\xef\xc3\x00\x00\x00\x00 Z9-109 64bit kernel 11990>>&0 string \xc0\x00\x20\x00\x00\x00\x00\x00 Z990 64bit kernel 11991>>&0 string \x00\x00\x00\x00\x00\x00\x00\x00 Z900 64bit kernel 11992# 32bit 11993>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z10 32bit kernel 11994>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z9-109 32bit kernel 11995>>&0 string \x80\x00\x20\x00\x00\x00\x00\x00 Z990 32bit kernel 11996>>&0 string \x80\x00\x00\x00\x00\x00\x00\x00 Z900 32bit kernel 11997 11998# Linux ARM compressed kernel image 11999# From: Kevin Cernekee <cernekee@gmail.com> 1200036 lelong 0x016f2818 Linux kernel ARM boot executable zImage (little-endian) 1200136 belong 0x016f2818 Linux kernel ARM boot executable zImage (big-endian) 12002 12003############################################################################ 12004# Linux 8086 executable 120050 lelong&0xFF0000FF 0xC30000E9 Linux-Dev86 executable, headerless 12006>5 string . 12007>>4 string >\0 \b, libc version %s 12008 120090 lelong&0xFF00FFFF 0x4000301 Linux-8086 executable 12010>2 byte&0x01 !0 \b, unmapped zero page 12011>2 byte&0x20 0 \b, impure 12012>2 byte&0x20 !0 12013>>2 byte&0x10 !0 \b, A_EXEC 12014>2 byte&0x02 !0 \b, A_PAL 12015>2 byte&0x04 !0 \b, A_NSYM 12016>2 byte&0x08 !0 \b, A_STAND 12017>2 byte&0x40 !0 \b, A_PURE 12018>2 byte&0x80 !0 \b, A_TOVLY 12019>28 long !0 \b, not stripped 12020>37 string . 12021>>36 string >\0 \b, libc version %s 12022 12023# 0 lelong&0xFF00FFFF 0x10000301 ld86 I80386 executable 12024# 0 lelong&0xFF00FFFF 0xB000301 ld86 M68K executable 12025# 0 lelong&0xFF00FFFF 0xC000301 ld86 NS16K executable 12026# 0 lelong&0xFF00FFFF 0x17000301 ld86 SPARC executable 12027 12028# SYSLINUX boot logo files (from 'ppmtolss16' sources) 12029# http://www.syslinux.org/wiki/index.php/SYSLINUX#Display_graphic_from_filename: 12030# file extension .lss .16 120310 lelong =0x1413f33d SYSLINUX' LSS16 image data 12032# syslinux-4.05/mime/image/x-lss16.xml 12033!:mime image/x-lss16 12034>4 leshort x \b, width %d 12035>6 leshort x \b, height %d 12036 120370 string OOOM User-Mode-Linux's Copy-On-Write disk image 12038>4 belong x version %d 12039 12040# SE Linux policy database 12041# From: Mike Frysinger <vapier@gentoo.org> 120420 lelong 0xf97cff8c SE Linux policy 12043>16 lelong x v%d 12044>20 lelong 1 MLS 12045>24 lelong x %d symbols 12046>28 lelong x %d ocons 12047 12048# Linux Logical Volume Manager (LVM) 12049# Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net> 12050# 12051# System ID, UUID and volume group name are 128 bytes long 12052# but they should never be full and initialized with zeros... 12053# 12054# LVM1 12055# 120560x0 string HM\001 LVM1 (Linux Logical Volume Manager), version 1 12057>0x12c string >\0 , System ID: %s 12058 120590x0 string HM\002 LVM1 (Linux Logical Volume Manager), version 2 12060>0x12c string >\0 , System ID: %s 12061 12062# LVM2 12063# 12064# It seems that the label header can be in one the four first sector 12065# of the disk... (from _find_labeller in lib/label/label.c of LVM2) 12066# 12067# 0x200 seems to be the common case 12068 120690x218 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 12070# read the offset to add to the start of the header, and the header 12071# start in 0x200 12072>&(&-12.l-0x21) byte x 12073# display UUID in LVM format + display all 32 bytes (instead of max string length: 31) 12074>>&0x0 string >\x2f \b, UUID: %.6s 12075>>&0x6 string >\x2f \b-%.4s 12076>>&0xa string >\x2f \b-%.4s 12077>>&0xe string >\x2f \b-%.4s 12078>>&0x12 string >\x2f \b-%.4s 12079>>&0x16 string >\x2f \b-%.4s 12080>>&0x1a string >\x2f \b-%.6s 12081>>&0x20 lequad x \b, size: %lld 12082 120830x018 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 12084>&(&-12.l-0x21) byte x 12085# display UUID in LVM format + display all 32 bytes (instead of max string length: 31) 12086>>&0x0 string >\x2f \b, UUID: %.6s 12087>>&0x6 string >\x2f \b-%.4s 12088>>&0xa string >\x2f \b-%.4s 12089>>&0xe string >\x2f \b-%.4s 12090>>&0x12 string >\x2f \b-%.4s 12091>>&0x16 string >\x2f \b-%.4s 12092>>&0x1a string >\x2f \b-%.6s 12093>>&0x20 lequad x \b, size: %lld 12094 120950x418 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 12096>&(&-12.l-0x21) byte x 12097# display UUID in LVM format + display all 32 bytes (instead of max string length: 31) 12098>>&0x0 string >\x2f \b, UUID: %.6s 12099>>&0x6 string >\x2f \b-%.4s 12100>>&0xa string >\x2f \b-%.4s 12101>>&0xe string >\x2f \b-%.4s 12102>>&0x12 string >\x2f \b-%.4s 12103>>&0x16 string >\x2f \b-%.4s 12104>>&0x1a string >\x2f \b-%.6s 12105>>&0x20 lequad x \b, size: %lld 12106 121070x618 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 12108>&(&-12.l-0x21) byte x 12109# display UUID in LVM format + display all 32 bytes (instead of max string length: 31) 12110>>&0x0 string >\x2f \b, UUID: %.6s 12111>>&0x6 string >\x2f \b-%.4s 12112>>&0xa string >\x2f \b-%.4s 12113>>&0xe string >\x2f \b-%.4s 12114>>&0x12 string >\x2f \b-%.4s 12115>>&0x16 string >\x2f \b-%.4s 12116>>&0x1a string >\x2f \b-%.6s 12117>>&0x20 lequad x \b, size: %lld 12118 12119# LVM snapshot 12120# from Jason Farrel 121210 string SnAp LVM Snapshot (CopyOnWrite store) 12122>4 lelong !0 - valid, 12123>4 lelong 0 - invalid, 12124>8 lelong x version %d, 12125>12 lelong x chunk_size %d 12126 12127# SE Linux policy database 121280 lelong 0xf97cff8c SE Linux policy 12129>16 lelong x v%d 12130>20 lelong 1 MLS 12131>24 lelong x %d symbols 12132>28 lelong x %d ocons 12133 12134# LUKS: Linux Unified Key Setup, On-Disk Format, http://luks.endorphin.org/spec 12135# Anthon van der Neut (anthon@mnt.org) 121360 string LUKS\xba\xbe LUKS encrypted file, 12137>6 beshort x ver %d 12138>8 string x [%s, 12139>40 string x %s, 12140>72 string x %s] 12141>168 string x UUID: %s 12142 12143 12144# Summary: Xen saved domain file 12145# Created by: Radek Vokal <rvokal@redhat.com> 121460 string LinuxGuestRecord Xen saved domain 12147>20 search/256 (name 12148>>&1 string x (name %s) 12149 12150# Type: Xen, the virtual machine monitor 12151# From: Radek Vokal <rvokal@redhat.com> 121520 string LinuxGuestRecord Xen saved domain 12153#>2 regex \(name\ [^)]*\) %s 12154>20 search/256 (name (name 12155>>&1 string x %s...) 12156 12157# Systemd journald files 12158# See http://www.freedesktop.org/wiki/Software/systemd/journal-files/. 12159# From: Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl> 12160 12161# check magic 121620 string LPKSHHRH 12163# check that state is one of known values 12164>16 ubyte&252 0 12165# check that each half of three unique id128s is non-zero 12166>>24 ubequad >0 12167>>>32 ubequad >0 12168>>>>40 ubequad >0 12169>>>>>48 ubequad >0 12170>>>>>>56 ubequad >0 12171>>>>>>>64 ubequad >0 Journal file 12172!:mime application/octet-stream 12173# provide more info 12174>>>>>>>>184 leqdate 0 empty 12175>>>>>>>>16 ubyte 0 \b, offline 12176>>>>>>>>16 ubyte 1 \b, online 12177>>>>>>>>16 ubyte 2 \b, archived 12178>>>>>>>>8 ulelong&1 1 \b, sealed 12179>>>>>>>>12 ulelong&1 1 \b, compressed 12180 12181# BCache backing and cache devices 12182# From: Gabriel de Perthuis <g2p.code@gmail.com> 121830x1008 lequad 8 12184>0x1018 string \xc6\x85\x73\xf6\x4e\x1a\x45\xca\x82\x65\xf5\x7f\x48\xba\x6d\x81 BCache 12185>>0x1010 ulequad 0 cache device 12186>>0x1010 ulequad 1 backing device 12187>>0x1010 ulequad 3 cache device 12188>>0x1010 ulequad 4 backing device 12189>>0x1048 string >0 \b, label "%.32s" 12190>>0x1028 ubelong x \b, uuid %08x 12191>>0x102c ubeshort x \b-%04x 12192>>0x102e ubeshort x \b-%04x 12193>>0x1030 ubeshort x \b-%04x 12194>>0x1032 ubelong x \b-%08x 12195>>0x1036 ubeshort x \b%04x 12196>>0x1038 ubelong x \b, set uuid %08x 12197>>0x103c ubeshort x \b-%04x 12198>>0x103e ubeshort x \b-%04x 12199>>0x1040 ubeshort x \b-%04x 12200>>0x1042 ubelong x \b-%08x 12201>>0x1046 ubeshort x \b%04x 12202 12203 12204#------------------------------------------------------------------------------ 12205# $File: lisp,v 1.23 2009/09/19 16:28:10 christos Exp $ 12206# lisp: file(1) magic for lisp programs 12207# 12208# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com) 12209 12210# updated by Joerg Jenderek 12211# GRR: This lot is too weak 12212#0 string ;; 12213# windows INF files often begin with semicolon and use CRLF as line end 12214# lisp files are mainly created on unix system with LF as line end 12215#>2 search/4096 !\r Lisp/Scheme program text 12216#>2 search/4096 \r Windows INF file 12217 122180 search/4096 (setq\ Lisp/Scheme program text 12219!:mime text/x-lisp 122200 search/4096 (defvar\ Lisp/Scheme program text 12221!:mime text/x-lisp 122220 search/4096 (defparam\ Lisp/Scheme program text 12223!:mime text/x-lisp 122240 search/4096 (defun\ Lisp/Scheme program text 12225!:mime text/x-lisp 122260 search/4096 (autoload\ Lisp/Scheme program text 12227!:mime text/x-lisp 122280 search/4096 (custom-set-variables\ Lisp/Scheme program text 12229!:mime text/x-lisp 12230 12231# Emacs 18 - this is always correct, but not very magical. 122320 string \012( Emacs v18 byte-compiled Lisp data 12233!:mime application/x-elc 12234# Emacs 19+ - ver. recognition added by Ian Springer 12235# Also applies to XEmacs 19+ .elc files; could tell them apart with regexs 12236# - Chris Chittleborough <cchittleborough@yahoo.com.au> 122370 string ;ELC 12238>4 byte >18 12239>4 byte <32 Emacs/XEmacs v%d byte-compiled Lisp data 12240!:mime application/x-elc 12241 12242# Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr> 122430 string (SYSTEM::VERSION\040' CLISP byte-compiled Lisp program (pre 2004-03-27) 122440 string (|SYSTEM|::|VERSION|\040' CLISP byte-compiled Lisp program text 12245 122460 long 0x70768BD2 CLISP memory image data 122470 long 0xD28B7670 CLISP memory image data, other endian 12248 12249#.com and .bin for MIT scheme 122500 string \372\372\372\372 MIT scheme (library?) 12251 12252# From: David Allouche <david@allouche.net> 122530 search/1 \<TeXmacs| TeXmacs document text 12254!:mime text/texmacs 12255 12256#------------------------------------------------------------------------------ 12257# $File: llvm,v 1.8 2013/01/12 03:09:51 christos Exp $ 12258# llvm: file(1) magic for LLVM byte-codes 12259# URL: http://llvm.org/docs/BitCodeFormat.html 12260# From: Al Stone <ahs3@fc.hp.com> 12261 122620 string llvm LLVM byte-codes, uncompressed 122630 string llvc0 LLVM byte-codes, null compression 122640 string llvc1 LLVM byte-codes, gzip compression 122650 string llvc2 LLVM byte-codes, bzip2 compression 12266 122670 lelong 0x0b17c0de LLVM bitcode, wrapper 12268# Are these Mach-O ABI values? They appear to be. 12269>16 lelong 0x01000007 x86_64 12270>16 lelong 0x00000007 i386 12271>16 lelong 0x00000012 ppc 12272>16 lelong 0x01000012 ppc64 12273>16 lelong 0x0000000c arm 12274 122750 string BC\xc0\xde LLVM IR bitcode 12276 12277#------------------------------------------------------------------------------ 12278# $File: lua,v 1.6 2013/01/09 16:23:17 christos Exp $ 12279# lua: file(1) magic for Lua scripting language 12280# URL: http://www.lua.org/ 12281# From: Reuben Thomas <rrt@sc3d.org>, Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr> 12282 12283# Lua scripts 122840 search/1/w #!\ /usr/bin/lua Lua script text executable 12285!:mime text/x-lua 122860 search/1/w #!\ /usr/local/bin/lua Lua script text executable 12287!:mime text/x-lua 122880 search/1 #!/usr/bin/env\ lua Lua script text executable 12289!:mime text/x-lua 122900 search/1 #!\ /usr/bin/env\ lua Lua script text executable 12291!:mime text/x-lua 12292 12293# Lua bytecode 122940 string \033Lua Lua bytecode, 12295>4 byte 0x50 version 5.0 12296>4 byte 0x51 version 5.1 12297>4 byte 0x52 version 5.2 12298 12299#------------------------------------------------------------------------------ 12300# $File: luks,v 1.4 2009/09/19 16:28:10 christos Exp $ 12301# luks: file(1) magic for Linux Unified Key Setup 12302# URL: http://luks.endorphin.org/spec 12303# From: Anthon van der Neut <anthon@mnt.org> 12304 123050 string LUKS\xba\xbe LUKS encrypted file, 12306>6 beshort x ver %d 12307>8 string x [%s, 12308>40 string x %s, 12309>72 string x %s] 12310>168 string x UUID: %s 12311#------------------------------------------------------------------------------ 12312# $File: m4,v 1.1 2011/12/08 12:12:46 rrt Exp $ 12313# make: file(1) magic for M4 scripts 12314# 123150 regex \^dnl\ M4 macro processor script text 12316!:mime text/x-m4 12317 12318#------------------------------------------------------------ 12319# $File: mach,v 1.17 2013/03/07 02:22:52 christos Exp $ 12320# Mach has two magic numbers, 0xcafebabe and 0xfeedface. 12321# Unfortunately the first, cafebabe, is shared with 12322# Java ByteCode, so they are both handled in the file "cafebabe". 12323# The "feedface" ones are handled herein. 12324#------------------------------------------------------------ 12325# if set, it's for the 64-bit version of the architecture 12326# yes, this is separate from the low-order magic number bit 12327# it's also separate from the "64-bit libraries" bit in the 12328# upper 8 bits of the CPU subtype 12329 123300 name mach-o-cpu 12331>0 belong&0x01000000 0 12332# 12333# 32-bit ABIs. 12334# 12335# 1 vax 12336>>0 belong&0x00ffffff 1 12337>>>4 belong&0x00ffffff 0 vax 12338>>>4 belong&0x00ffffff 1 vax11/780 12339>>>4 belong&0x00ffffff 2 vax11/785 12340>>>4 belong&0x00ffffff 3 vax11/750 12341>>>4 belong&0x00ffffff 4 vax11/730 12342>>>4 belong&0x00ffffff 5 uvaxI 12343>>>4 belong&0x00ffffff 6 uvaxII 12344>>>4 belong&0x00ffffff 7 vax8200 12345>>>4 belong&0x00ffffff 8 vax8500 12346>>>4 belong&0x00ffffff 9 vax8600 12347>>>4 belong&0x00ffffff 10 vax8650 12348>>>4 belong&0x00ffffff 11 vax8800 12349>>>4 belong&0x00ffffff 12 uvaxIII 12350>>>4 belong&0x00ffffff >12 vax subarchitecture=%ld 12351>>0 belong&0x00ffffff 2 romp 12352>>0 belong&0x00ffffff 3 architecture=3 12353>>0 belong&0x00ffffff 4 ns32032 12354>>0 belong&0x00ffffff 5 ns32332 12355>>0 belong&0x00ffffff 6 m68k 12356# 7 x86 12357>>0 belong&0x00ffffff 7 12358>>>4 belong&0x0000000f 3 i386 12359>>>4 belong&0x0000000f 4 i486 12360>>>>4 belong&0x00fffff0 0 12361>>>>4 belong&0x00fffff0 0x80 \bsx 12362>>>4 belong&0x0000000f 5 i586 12363>>>4 belong&0x0000000f 6 12364>>>>4 belong&0x00fffff0 0 p6 12365>>>>4 belong&0x00fffff0 0x10 pentium_pro 12366>>>>4 belong&0x00fffff0 0x20 pentium_2_m0x20 12367>>>>4 belong&0x00fffff0 0x30 pentium_2_m3 12368>>>>4 belong&0x00fffff0 0x40 pentium_2_m0x40 12369>>>>4 belong&0x00fffff0 0x50 pentium_2_m5 12370>>>>4 belong&0x00fffff0 >0x50 pentium_2_m0x%lx 12371>>>4 belong&0x0000000f 7 celeron 12372>>>>4 belong&0x00fffff0 0x00 \b_m0x%lx 12373>>>>4 belong&0x00fffff0 0x10 \b_m0x%lx 12374>>>>4 belong&0x00fffff0 0x20 \b_m0x%lx 12375>>>>4 belong&0x00fffff0 0x30 \b_m0x%lx 12376>>>>4 belong&0x00fffff0 0x40 \b_m0x%lx 12377>>>>4 belong&0x00fffff0 0x50 \b_m0x%lx 12378>>>>4 belong&0x00fffff0 0x60 12379>>>>4 belong&0x00fffff0 0x70 \b_mobile 12380>>>>4 belong&0x00fffff0 >0x70 \b_m0x%lx 12381>>>4 belong&0x0000000f 8 pentium_3 12382>>>>4 belong&0x00fffff0 0x00 12383>>>>4 belong&0x00fffff0 0x10 \b_m 12384>>>>4 belong&0x00fffff0 0x20 \b_xeon 12385>>>>4 belong&0x00fffff0 >0x20 \b_m0x%lx 12386>>>4 belong&0x0000000f 9 pentiumM 12387>>>>4 belong&0x00fffff0 0x00 12388>>>>4 belong&0x00fffff0 >0x00 \b_m0x%lx 12389>>>4 belong&0x0000000f 10 pentium_4 12390>>>>4 belong&0x00fffff0 0x00 12391>>>>4 belong&0x00fffff0 0x10 \b_m 12392>>>>4 belong&0x00fffff0 >0x10 \b_m0x%lx 12393>>>4 belong&0x0000000f 11 itanium 12394>>>>4 belong&0x00fffff0 0x00 12395>>>>4 belong&0x00fffff0 0x10 \b_2 12396>>>>4 belong&0x00fffff0 >0x10 \b_m0x%lx 12397>>>4 belong&0x0000000f 12 xeon 12398>>>>4 belong&0x00fffff0 0x00 12399>>>>4 belong&0x00fffff0 0x10 \b_mp 12400>>>>4 belong&0x00fffff0 >0x10 \b_m0x%lx 12401>>>4 belong&0x0000000f >12 ia32 family=%ld 12402>>>>4 belong&0x00fffff0 0x00 12403>>>>4 belong&0x00fffff0 >0x00 model=%lx 12404>>0 belong&0x00ffffff 8 mips 12405>>>4 belong&0x00ffffff 1 R2300 12406>>>4 belong&0x00ffffff 2 R2600 12407>>>4 belong&0x00ffffff 3 R2800 12408>>>4 belong&0x00ffffff 4 R2000a 12409>>>4 belong&0x00ffffff 5 R2000 12410>>>4 belong&0x00ffffff 6 R3000a 12411>>>4 belong&0x00ffffff 7 R3000 12412>>>4 belong&0x00ffffff >7 subarchitecture=%ld 12413>>0 belong&0x00ffffff 9 ns32532 12414>>0 belong&0x00ffffff 10 mc98000 12415>>0 belong&0x00ffffff 11 hppa 12416>>>4 belong&0x00ffffff 0 7100 12417>>>4 belong&0x00ffffff 1 7100LC 12418>>>4 belong&0x00ffffff >1 subarchitecture=%ld 12419>>0 belong&0x00ffffff 12 arm 12420>>>4 belong&0x00ffffff 0 12421>>>4 belong&0x00ffffff 1 subarchitecture=%ld 12422>>>4 belong&0x00ffffff 2 subarchitecture=%ld 12423>>>4 belong&0x00ffffff 3 subarchitecture=%ld 12424>>>4 belong&0x00ffffff 4 subarchitecture=%ld 12425>>>4 belong&0x00ffffff 5 \b_v4t 12426>>>4 belong&0x00ffffff 6 \b_v6 12427>>>4 belong&0x00ffffff 7 \b_v5tej 12428>>>4 belong&0x00ffffff 8 \b_xscale 12429>>>4 belong&0x00ffffff 9 \b_v7 12430>>>4 belong&0x00ffffff 10 \b_v7f 12431>>>4 belong&0x00ffffff 11 subarchitecture=%ld 12432>>>4 belong&0x00ffffff 12 \b_v7k 12433>>>4 belong&0x00ffffff >12 subarchitecture=%ld 12434# 13 m88k 12435>>0 belong&0x00ffffff 13 12436>>>4 belong&0x00ffffff 0 mc88000 12437>>>4 belong&0x00ffffff 1 mc88100 12438>>>4 belong&0x00ffffff 2 mc88110 12439>>>4 belong&0x00ffffff >2 mc88000 subarchitecture=%ld 12440>>0 belong&0x00ffffff 14 sparc 12441>>0 belong&0x00ffffff 15 i860g 12442>>0 belong&0x00ffffff 16 alpha 12443>>0 belong&0x00ffffff 17 rs6000 12444>>0 belong&0x00ffffff 18 ppc 12445>>>4 belong&0x00ffffff 0 12446>>>4 belong&0x00ffffff 1 \b_601 12447>>>4 belong&0x00ffffff 2 \b_602 12448>>>4 belong&0x00ffffff 3 \b_603 12449>>>4 belong&0x00ffffff 4 \b_603e 12450>>>4 belong&0x00ffffff 5 \b_603ev 12451>>>4 belong&0x00ffffff 6 \b_604 12452>>>4 belong&0x00ffffff 7 \b_604e 12453>>>4 belong&0x00ffffff 8 \b_620 12454>>>4 belong&0x00ffffff 9 \b_650 12455>>>4 belong&0x00ffffff 10 \b_7400 12456>>>4 belong&0x00ffffff 11 \b_7450 12457>>>4 belong&0x00ffffff 100 \b_970 12458>>>4 belong&0x00ffffff >100 subarchitecture=%ld 12459>>0 belong&0x00ffffff >18 architecture=%ld 12460>0 belong&0x01000000 0x01000000 12461# 12462# 64-bit ABIs. 12463# 12464>>0 belong&0x00ffffff 0 64-bit architecture=%ld 12465>>0 belong&0x00ffffff 1 64-bit architecture=%ld 12466>>0 belong&0x00ffffff 2 64-bit architecture=%ld 12467>>0 belong&0x00ffffff 3 64-bit architecture=%ld 12468>>0 belong&0x00ffffff 4 64-bit architecture=%ld 12469>>0 belong&0x00ffffff 5 64-bit architecture=%ld 12470>>0 belong&0x00ffffff 6 64-bit architecture=%ld 12471>>0 belong&0x00ffffff 7 x86_64 12472>>>4 belong&0x00ffffff 0 subarchitecture=%ld 12473>>>4 belong&0x00ffffff 1 subarchitecture=%ld 12474>>>4 belong&0x00ffffff 2 subarchitecture=%ld 12475>>>4 belong&0x00ffffff 3 12476>>>4 belong&0x00ffffff 4 \b_arch1 12477>>>4 belong&0x00ffffff >4 subarchitecture=%ld 12478>>0 belong&0x00ffffff 8 64-bit architecture=%ld 12479>>0 belong&0x00ffffff 9 64-bit architecture=%ld 12480>>0 belong&0x00ffffff 10 64-bit architecture=%ld 12481>>0 belong&0x00ffffff 11 64-bit architecture=%ld 12482>>0 belong&0x00ffffff 12 64-bit architecture=%ld 12483>>0 belong&0x00ffffff 13 64-bit architecture=%ld 12484>>0 belong&0x00ffffff 14 64-bit architecture=%ld 12485>>0 belong&0x00ffffff 15 64-bit architecture=%ld 12486>>0 belong&0x00ffffff 16 64-bit architecture=%ld 12487>>0 belong&0x00ffffff 17 64-bit architecture=%ld 12488>>0 belong&0x00ffffff 18 ppc64 12489>>>4 belong&0x00ffffff 0 12490>>>4 belong&0x00ffffff 1 \b_601 12491>>>4 belong&0x00ffffff 2 \b_602 12492>>>4 belong&0x00ffffff 3 \b_603 12493>>>4 belong&0x00ffffff 4 \b_603e 12494>>>4 belong&0x00ffffff 5 \b_603ev 12495>>>4 belong&0x00ffffff 6 \b_604 12496>>>4 belong&0x00ffffff 7 \b_604e 12497>>>4 belong&0x00ffffff 8 \b_620 12498>>>4 belong&0x00ffffff 9 \b_650 12499>>>4 belong&0x00ffffff 10 \b_7400 12500>>>4 belong&0x00ffffff 11 \b_7450 12501>>>4 belong&0x00ffffff 100 \b_970 12502>>>4 belong&0x00ffffff >100 subarchitecture=%ld 12503>>0 belong&0x00ffffff >18 64-bit architecture=%ld 12504 12505 125060 name mach-o-be 12507>0 byte 0xcf 64-bit 12508>4 use mach-o-cpu 12509>12 belong 1 object 12510>12 belong 2 executable 12511>12 belong 3 fixed virtual memory shared library 12512>12 belong 4 core 12513>12 belong 5 preload executable 12514>12 belong 6 dynamically linked shared library 12515>12 belong 7 dynamic linker 12516>12 belong 8 bundle 12517>12 belong 9 dynamically linked shared library stub 12518>12 belong 10 dSYM companion file 12519>12 belong 11 kext bundle 12520>12 belong >11 12521>>12 belong x filetype=%ld 12522 12523# 125240 lelong&0xfffffffe 0xfeedface Mach-O 12525!:strength +1 12526>0 use \^mach-o-be 12527 125280 belong&0xfffffffe 0xfeedface Mach-O 12529!:strength +1 12530>0 use mach-o-be 12531 12532#------------------------------------------------------------------------------ 12533# $File: macintosh,v 1.23 2013/11/19 18:47:58 christos Exp $ 12534# macintosh description 12535# 12536# BinHex is the Macintosh ASCII-encoded file format (see also "apple") 12537# Daniel Quinlan, quinlan@yggdrasil.com 1253811 string must\ be\ converted\ with\ BinHex BinHex binary text 12539!:mime application/mac-binhex40 12540>41 string x \b, version %.3s 12541 12542# Stuffit archives are the de facto standard of compression for Macintosh 12543# files obtained from most archives. (franklsm@tuns.ca) 125440 string SIT! StuffIt Archive (data) 12545!:mime application/x-stuffit 12546!:apple SIT!SIT! 12547>2 string x : %s 125480 string SITD StuffIt Deluxe (data) 12549>2 string x : %s 125500 string Seg StuffIt Deluxe Segment (data) 12551>2 string x : %s 12552 12553# Newer StuffIt archives (grant@netbsd.org) 125540 string StuffIt StuffIt Archive 12555!:mime application/x-stuffit 12556!:apple SIT!SIT! 12557#>162 string >0 : %s 12558 12559# Macintosh Applications and Installation binaries (franklsm@tuns.ca) 12560# GRR: Too weak 12561#0 string APPL Macintosh Application (data) 12562#>2 string x \b: %s 12563 12564# Macintosh System files (franklsm@tuns.ca) 12565# GRR: Too weak 12566#0 string zsys Macintosh System File (data) 12567#0 string FNDR Macintosh Finder (data) 12568#0 string libr Macintosh Library (data) 12569#>2 string x : %s 12570#0 string shlb Macintosh Shared Library (data) 12571#>2 string x : %s 12572#0 string cdev Macintosh Control Panel (data) 12573#>2 string x : %s 12574#0 string INIT Macintosh Extension (data) 12575#>2 string x : %s 12576#0 string FFIL Macintosh Truetype Font (data) 12577#>2 string x : %s 12578#0 string LWFN Macintosh Postscript Font (data) 12579#>2 string x : %s 12580 12581# Additional Macintosh Files (franklsm@tuns.ca) 12582# GRR: Too weak 12583#0 string PACT Macintosh Compact Pro Archive (data) 12584#>2 string x : %s 12585#0 string ttro Macintosh TeachText File (data) 12586#>2 string x : %s 12587#0 string TEXT Macintosh TeachText File (data) 12588#>2 string x : %s 12589#0 string PDF Macintosh PDF File (data) 12590#>2 string x : %s 12591 12592# MacBinary format (Eric Fischer, enf@pobox.com) 12593# 12594# Unfortunately MacBinary doesn't really have a magic number prior 12595# to the MacBinary III format. The checksum is really the way to 12596# do it, but the magic file format isn't up to the challenge. 12597# 12598# 0 byte 0 12599# 1 byte # filename length 12600# 2 string # filename 12601# 65 string # file type 12602# 69 string # file creator 12603# 73 byte # Finder flags 12604# 74 byte 0 12605# 75 beshort # vertical posn in window 12606# 77 beshort # horiz posn in window 12607# 79 beshort # window or folder ID 12608# 81 byte # protected? 12609# 82 byte 0 12610# 83 belong # length of data segment 12611# 87 belong # length of resource segment 12612# 91 belong # file creation date 12613# 95 belong # file modification date 12614# 99 beshort # length of comment after resource 12615# 101 byte # new Finder flags 12616# 102 string mBIN # (only in MacBinary III) 12617# 106 byte # char. code of file name 12618# 107 byte # still more Finder flags 12619# 116 belong # total file length 12620# 120 beshort # length of add'l header 12621# 122 byte 129 # for MacBinary II 12622# 122 byte 130 # for MacBinary III 12623# 123 byte 129 # minimum version that can read fmt 12624# 124 beshort # checksum 12625# 12626# This attempts to use the version numbers as a magic number, requiring 12627# that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second 12628# be 0x81. This works for the files I have, but maybe not for everyone's. 12629 12630# Unfortunately, this magic is quite weak - MPi 12631#122 beshort&0xFCFF 0x8081 Macintosh MacBinary data 12632 12633# MacBinary I doesn't have the version number field at all, but MacBinary II 12634# has been in use since 1987 so I hope there aren't many really old files 12635# floating around that this will miss. The original spec calls for using 12636# the nulls in 0, 74, and 82 as the magic number. 12637# 12638# Another possibility, that would also work for MacBinary I, is to use 12639# the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will 12640# have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset, 12641# and that 74 will be 0. So something like 12642# 12643# 71 belong&0x80804EFF 0x00000000 Macintosh MacBinary data 12644# 12645# >73 byte&0x01 0x01 \b, inited 12646# >73 byte&0x02 0x02 \b, changed 12647# >73 byte&0x04 0x04 \b, busy 12648# >73 byte&0x08 0x08 \b, bozo 12649# >73 byte&0x10 0x10 \b, system 12650# >73 byte&0x10 0x20 \b, bundle 12651# >73 byte&0x10 0x40 \b, invisible 12652# >73 byte&0x10 0x80 \b, locked 12653 12654#>65 string x \b, type "%4.4s" 12655 12656#>65 string 8BIM (PhotoShop) 12657#>65 string ALB3 (PageMaker 3) 12658#>65 string ALB4 (PageMaker 4) 12659#>65 string ALT3 (PageMaker 3) 12660#>65 string APPL (application) 12661#>65 string AWWP (AppleWorks word processor) 12662#>65 string CIRC (simulated circuit) 12663#>65 string DRWG (MacDraw) 12664#>65 string EPSF (Encapsulated PostScript) 12665#>65 string FFIL (font suitcase) 12666#>65 string FKEY (function key) 12667#>65 string FNDR (Macintosh Finder) 12668#>65 string GIFf (GIF image) 12669#>65 string Gzip (GNU gzip) 12670#>65 string INIT (system extension) 12671#>65 string LIB\ (library) 12672#>65 string LWFN (PostScript font) 12673#>65 string MSBC (Microsoft BASIC) 12674#>65 string PACT (Compact Pro archive) 12675#>65 string PDF\ (Portable Document Format) 12676#>65 string PICT (picture) 12677#>65 string PNTG (MacPaint picture) 12678#>65 string PREF (preferences) 12679#>65 string PROJ (Think C project) 12680#>65 string QPRJ (Think Pascal project) 12681#>65 string SCFL (Defender scores) 12682#>65 string SCRN (startup screen) 12683#>65 string SITD (StuffIt Deluxe) 12684#>65 string SPn3 (SuperPaint) 12685#>65 string STAK (HyperCard stack) 12686#>65 string Seg\ (StuffIt segment) 12687#>65 string TARF (Unix tar archive) 12688#>65 string TEXT (ASCII) 12689#>65 string TIFF (TIFF image) 12690#>65 string TOVF (Eudora table of contents) 12691#>65 string WDBN (Microsoft Word word processor) 12692#>65 string WORD (MacWrite word processor) 12693#>65 string XLS\ (Microsoft Excel) 12694#>65 string ZIVM (compress (.Z)) 12695#>65 string ZSYS (Pre-System 7 system file) 12696#>65 string acf3 (Aldus FreeHand) 12697#>65 string cdev (control panel) 12698#>65 string dfil (Desk Acessory suitcase) 12699#>65 string libr (library) 12700#>65 string nX^d (WriteNow word processor) 12701#>65 string nX^w (WriteNow dictionary) 12702#>65 string rsrc (resource) 12703#>65 string scbk (Scrapbook) 12704#>65 string shlb (shared library) 12705#>65 string ttro (SimpleText read-only) 12706#>65 string zsys (system file) 12707 12708#>69 string x \b, creator "%4.4s" 12709 12710# Somewhere, Apple has a repository of registered Creator IDs. These are 12711# just the ones that I happened to have files from and was able to identify. 12712 12713#>69 string 8BIM (Adobe Photoshop) 12714#>69 string ALD3 (PageMaker 3) 12715#>69 string ALD4 (PageMaker 4) 12716#>69 string ALFA (Alpha editor) 12717#>69 string APLS (Apple Scanner) 12718#>69 string APSC (Apple Scanner) 12719#>69 string BRKL (Brickles) 12720#>69 string BTFT (BitFont) 12721#>69 string CCL2 (Common Lisp 2) 12722#>69 string CCL\ (Common Lisp) 12723#>69 string CDmo (The Talking Moose) 12724#>69 string CPCT (Compact Pro) 12725#>69 string CSOm (Eudora) 12726#>69 string DMOV (Font/DA Mover) 12727#>69 string DSIM (DigSim) 12728#>69 string EDIT (Macintosh Edit) 12729#>69 string ERIK (Macintosh Finder) 12730#>69 string EXTR (self-extracting archive) 12731#>69 string Gzip (GNU gzip) 12732#>69 string KAHL (Think C) 12733#>69 string LWFU (LaserWriter Utility) 12734#>69 string LZIV (compress) 12735#>69 string MACA (MacWrite) 12736#>69 string MACS (Macintosh operating system) 12737#>69 string MAcK (MacKnowledge terminal emulator) 12738#>69 string MLND (Defender) 12739#>69 string MPNT (MacPaint) 12740#>69 string MSBB (Microsoft BASIC (binary)) 12741#>69 string MSWD (Microsoft Word) 12742#>69 string NCSA (NCSA Telnet) 12743#>69 string PJMM (Think Pascal) 12744#>69 string PSAL (Hunt the Wumpus) 12745#>69 string PSI2 (Apple File Exchange) 12746#>69 string R*ch (BBEdit) 12747#>69 string RMKR (Resource Maker) 12748#>69 string RSED (Resource Editor) 12749#>69 string Rich (BBEdit) 12750#>69 string SIT! (StuffIt) 12751#>69 string SPNT (SuperPaint) 12752#>69 string Unix (NeXT Mac filesystem) 12753#>69 string VIM! (Vim editor) 12754#>69 string WILD (HyperCard) 12755#>69 string XCEL (Microsoft Excel) 12756#>69 string aCa2 (Fontographer) 12757#>69 string aca3 (Aldus FreeHand) 12758#>69 string dosa (Macintosh MS-DOS file system) 12759#>69 string movr (Font/DA Mover) 12760#>69 string nX^n (WriteNow) 12761#>69 string pdos (Apple ProDOS file system) 12762#>69 string scbk (Scrapbook) 12763#>69 string ttxt (SimpleText) 12764#>69 string ufox (Foreign File Access) 12765 12766# Just in case... 12767 12768102 string mBIN MacBinary III data with surprising version number 12769 12770# sas magic from Bruce Foster (bef@nwu.edu) 12771# 12772#0 string SAS SAS 12773#>8 string x %s 127740 string SAS SAS 12775>24 string DATA data file 12776>24 string CATALOG catalog 12777>24 string INDEX data file index 12778>24 string VIEW data view 12779# sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com) 12780# 127810x54 string SAS SAS 7+ 12782>0x9C string DATA data file 12783>0x9C string CATALOG catalog 12784>0x9C string INDEX data file index 12785>0x9C string VIEW data view 12786 12787# spss magic for SPSS system and portable files, 12788# from Bruce Foster (bef@nwu.edu). 12789 127900 long 0xc1e2c3c9 SPSS Portable File 12791>40 string x %s 12792 127930 string $FL2 SPSS System File 12794>24 string x %s 12795 127960 string $FL3 SPSS System File 12797>24 string x %s 12798 12799# Macintosh filesystem data 12800# From "Tom N Harris" <telliamed@mac.com> 12801# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net> 12802# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these 12803# entries depend on the data arithmetic added after v.35 12804# There's also some Pascal strings in here, ditto... 12805 12806# The boot block signature, according to IM:Files, is 12807# "for HFS volumes, this field always contains the value 0x4C4B." 12808# But if this is true for MFS or HFS+ volumes, I don't know. 12809# Alternatively, the boot block is supposed to be zeroed if it's 12810# unused, so a simply >0 should suffice. 12811 128120x400 beshort 0xD2D7 Macintosh MFS data 12813>0 beshort 0x4C4B (bootable) 12814>0x40a beshort &0x8000 (locked) 12815>0x402 beldate-0x7C25B080 x created: %s, 12816>0x406 beldate-0x7C25B080 >0 last backup: %s, 12817>0x414 belong x block size: %d, 12818>0x412 beshort x number of blocks: %d, 12819>0x424 pstring x volume name: %s 12820 12821# "BD" gives many false positives 12822#0x400 beshort 0x4244 Macintosh HFS data 12823#>0 beshort 0x4C4B (bootable) 12824#>0x40a beshort &0x8000 (locked) 12825#>0x40a beshort ^0x0100 (mounted) 12826#>0x40a beshort &0x0200 (spared blocks) 12827#>0x40a beshort &0x0800 (unclean) 12828#>0x47C beshort 0x482B (Embedded HFS+ Volume) 12829#>0x402 beldate-0x7C25B080 x created: %s, 12830#>0x406 beldate-0x7C25B080 x last modified: %s, 12831#>0x440 beldate-0x7C25B080 >0 last backup: %s, 12832#>0x414 belong x block size: %d, 12833#>0x412 beshort x number of blocks: %d, 12834#>0x424 pstring x volume name: %s 12835 128360x400 beshort 0x482B Macintosh HFS Extended 12837>&0 beshort x version %d data 12838>0 beshort 0x4C4B (bootable) 12839>0x404 belong ^0x00000100 (mounted) 12840>&2 belong &0x00000200 (spared blocks) 12841>&2 belong &0x00000800 (unclean) 12842>&2 belong &0x00008000 (locked) 12843>&6 string x last mounted by: '%.4s', 12844# really, that should be treated as a belong and we print a string 12845# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1" 12846>&14 beldate-0x7C25B080 x created: %s, 12847# only the creation date is local time, all other timestamps in HFS+ are UTC. 12848>&18 bedate-0x7C25B080 x last modified: %s, 12849>&22 bedate-0x7C25B080 >0 last backup: %s, 12850>&26 bedate-0x7C25B080 >0 last checked: %s, 12851>&38 belong x block size: %d, 12852>&42 belong x number of blocks: %d, 12853>&46 belong x free blocks: %d 12854 12855# I don't think this is really necessary since it doesn't do much and 12856# anything with a valid driver descriptor will also have a valid 12857# partition map 12858#0 beshort 0x4552 Apple Device Driver data 12859#>&24 beshort =1 \b, MacOS 12860 12861# Is that the partition type a cstring or a pstring? Well, IM says "strings 12862# shorter than 32 bytes must be terminated with NULL" so I'll treat it as a 12863# cstring. Of course, partitions can contain more than four entries, but 12864# what're you gonna do? 12865# GRR: This magic is too weak, it is just "PM" 12866#0x200 beshort 0x504D Apple Partition data 12867#>0x2 beshort x (block size: %d): 12868#>0x230 string x first type: %s, 12869#>0x210 string x name: %s, 12870#>0x254 belong x number of blocks: %d, 12871#>0x400 beshort 0x504D 12872#>>0x430 string x second type: %s, 12873#>>0x410 string x name: %s, 12874#>>0x454 belong x number of blocks: %d, 12875#>>0x600 beshort 0x504D 12876#>>>0x630 string x third type: %s, 12877#>>>0x610 string x name: %s, 12878#>>>0x654 belong x number of blocks: %d, 12879#>>0x800 beshort 0x504D 12880#>>>0x830 string x fourth type: %s, 12881#>>>0x810 string x name: %s, 12882#>>>0x854 belong x number of blocks: %d, 12883#>>>0xa00 beshort 0x504D 12884#>>>>0xa30 string x fifth type: %s, 12885#>>>>0xa10 string x name: %s, 12886#>>>>0xa54 belong x number of blocks: %d 12887#>>>0xc00 beshort 0x504D 12888#>>>>0xc30 string x sixth type: %s, 12889#>>>>0xc10 string x name: %s, 12890#>>>>0xc54 belong x number of blocks: %d 12891## AFAIK, only the signature is different 12892#0x200 beshort 0x5453 Apple Old Partition data 12893#>0x2 beshort x block size: %d, 12894#>0x230 string x first type: %s, 12895#>0x210 string x name: %s, 12896#>0x254 belong x number of blocks: %d, 12897#>0x400 beshort 0x504D 12898#>>0x430 string x second type: %s, 12899#>>0x410 string x name: %s, 12900#>>0x454 belong x number of blocks: %d, 12901#>>0x800 beshort 0x504D 12902#>>>0x830 string x third type: %s, 12903#>>>0x810 string x name: %s, 12904#>>>0x854 belong x number of blocks: %d, 12905#>>>0xa00 beshort 0x504D 12906#>>>>0xa30 string x fourth type: %s, 12907#>>>>0xa10 string x name: %s, 12908#>>>>0xa54 belong x number of blocks: %d 12909 12910# From: Remi Mommsen <mommsen@slac.stanford.edu> 129110 string BOMStore Mac OS X bill of materials (BOM) file 12912 12913# From: Adam Buchbinder <adam.buchbinder@gmail.com> 12914# URL: http://en.wikipedia.org/wiki/Datafork_TrueType 12915# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is 12916# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I 12917# don't know what they mean. 129180 belong 0x100 12919>(0x4.L+24) beshort x 12920>>&4 belong 0x73666e74 Mac OSX datafork font, TrueType 12921>>&4 belong 0x464f4e54 Mac OSX datafork font, 'FONT' 12922>>&4 belong 0x4e464e54 Mac OSX datafork font, 'NFNT' 12923>>&4 belong 0x504f5354 Mac OSX datafork font, PostScript 12924 12925#------------------------------------------------------------------------------ 12926# $File: macos,v 1.1 2012/12/21 16:41:07 christos Exp $ 12927# MacOS files 12928# 12929 129300 string book\0\0\0\0mark\0\0\0\0 MacOS Alias file 12931 12932#------------------------------------------------------------------------------ 12933# $File: magic,v 1.10 2010/11/25 15:00:12 christos Exp $ 12934# magic: file(1) magic for magic files 12935# 129360 string/t #\ Magic magic text file for file(1) cmd 129370 lelong 0xF11E041C magic binary file for file(1) cmd 12938>4 lelong x (version %d) (little endian) 129390 belong 0xF11E041C magic binary file for file(1) cmd 12940>4 belong x (version %d) (big endian) 12941#------------------------------------------------------------------------------ 12942# $File: mail.news,v 1.22 2013/01/04 14:22:07 christos Exp $ 12943# mail.news: file(1) magic for mail and news 12944# 12945# Unfortunately, saved netnews also has From line added in some news software. 12946#0 string From mail text 129470 string/t Relay-Version: old news text 12948!:mime message/rfc822 129490 string/t #!\ rnews batched news text 12950!:mime message/rfc822 129510 string/t N#!\ rnews mailed, batched news text 12952!:mime message/rfc822 129530 string/t Forward\ to mail forwarding text 12954!:mime message/rfc822 129550 string/t Pipe\ to mail piping text 12956!:mime message/rfc822 129570 string/tc delivered-to: SMTP mail text 12958!:mime message/rfc822 129590 string/tc return-path: SMTP mail text 12960!:mime message/rfc822 129610 string/t Path: news text 12962!:mime message/news 129630 string/t Xref: news text 12964!:mime message/news 129650 string/t From: news or mail text 12966!:mime message/rfc822 129670 string/t Article saved news text 12968!:mime message/news 129690 string/t BABYL Emacs RMAIL text 129700 string/t Received: RFC 822 mail text 12971!:mime message/rfc822 129720 string/t MIME-Version: MIME entity text 12973#0 string/t Content- MIME entity text 12974 12975# TNEF files... 129760 lelong 0x223E9F78 Transport Neutral Encapsulation Format 12977!:mime application/vnd.ms-tnef 12978 12979# From: Kevin Sullivan <ksulliva@psc.edu> 129800 string *mbx* MBX mail folder 12981 12982# From: Simon Matter <simon.matter@invoca.ch> 129830 string \241\002\213\015skiplist\ file\0\0\0 Cyrus skiplist DB 12984 12985# JAM(mbp) Fidonet message area databases 12986# JHR file 129870 string JAM\0 JAM message area header file 12988>12 leshort >0 (%d messages) 12989 12990# Squish Fidonet message area databases 12991# SQD file (requires at least one message in the area) 12992# XXX: Weak magic 12993#256 leshort 0xAFAE4453 Squish message area data file 12994#>4 leshort >0 (%d messages) 12995 12996#0 string \<!--\ MHonArc text/html; x-type=mhonarc 12997 12998# Cyrus: file(1) magic for compiled Cyrus sieve scripts 12999# URL: http://www.cyrusimap.org/docs/cyrus-imapd/2.4.6/internal/bytecode.php 13000# URL: http://git.cyrusimap.org/cyrus-imapd/tree/sieve/bytecode.h?h=master 13001# From: Philipp Hahn <hahn@univention.de> 13002 13003# Compiled Cyrus sieve script 130040 string CyrSBytecode Cyrus sieve bytecode data, 13005>12 belong =1 version 1, big-endian 13006>12 lelong =1 version 1, little-endian 13007>12 belong x version %d, network-endian 13008#------------------------------------------------------------------------------ 13009# $File: make,v 1.1 2011/12/08 12:12:46 rrt Exp $ 13010# make: file(1) magic for makefiles 13011# 130120 regex \^CFLAGS makefile script text 13013!:mime text/x-makefile 130140 regex \^LDFLAGS makefile script text 13015!:mime text/x-makefile 130160 regex \^all: makefile script text 13017!:mime text/x-makefile 130180 regex \^.PRECIOUS makefile script text 13019!:mime text/x-makefile 13020 130210 regex \^SUBDIRS automake makefile script text 13022!:mime text/x-makefile 13023 13024#------------------------------------------------------------------------------ 13025# $File: maple,v 1.7 2013/01/11 16:45:23 christos Exp $ 13026# maple: file(1) magic for maple files 13027# "H. Nanosecond" <aldomel@ix.netcom.com> 13028# Maple V release 4, a multi-purpose math program 13029# 13030 13031# maple library .lib 130320 string \000MVR4\nI MapleVr4 library 13033 13034# .ind 13035# no magic for these :-( 13036# they are compiled indexes for maple files 13037 13038# .hdb 130390 string \000\004\000\000 Maple help database 13040 13041# .mhp 13042# this has the form <PACKAGE=name> 130430 string \<PACKAGE= Maple help file 130440 string \<HELP\ NAME= Maple help file 130450 string \n\<HELP\ NAME= Maple help file with extra carriage return at start (yuck) 13046#0 string #\ Newton Maple help file, old style 130470 string #\ daub Maple help file, old style 13048#0 string #=========== Maple help file, old style 13049 13050# .mws 130510 string \000\000\001\044\000\221 Maple worksheet 13052#this is anomalous 130530 string WriteNow\000\002\000\001\000\000\000\000\100\000\000\000\000\000 Maple worksheet, but weird 13054# this has the form {VERSION 2 3 "IBM INTEL NT" "2.3" }\n 13055# that is {VERSION major_version miunor_version computer_type version_string} 130560 string {VERSION\ Maple worksheet 13057>9 string >\0 version %.1s. 13058>>11 string >\0 %.1s 13059 13060# .mps 130610 string \0\0\001$ Maple something 13062# from byte 4 it is either 'nul E' or 'soh R' 13063# I think 'nul E' means a file that was saved as a different name 13064# a sort of revision marking 13065# 'soh R' means new 13066>4 string \000\105 An old revision 13067>4 string \001\122 The latest save 13068 13069# .mpl 13070# some of these are the same as .mps above 13071#0000000 000 000 001 044 000 105 same as .mps 13072#0000000 000 000 001 044 001 122 same as .mps 13073 130740 string #\n##\ <SHAREFILE= Maple something 130750 string \n#\n##\ <SHAREFILE= Maple something 130760 string ##\ <SHAREFILE= Maple something 130770 string #\r##\ <SHAREFILE= Maple something 130780 string \r#\r##\ <SHAREFILE= Maple something 130790 string #\ \r##\ <DESCRIBE> Maple something anomalous. 13080#-------------------------------------------- 13081# marc21: file(1) magic for MARC 21 Format 13082# 13083# Kevin Ford (kefo@loc.gov) 13084# 13085# MARC21 formats are for the representation and communication 13086# of bibliographic and related information in machine-readable 13087# form. For more info, see http://www.loc.gov/marc/ 13088 13089 13090# leader position 20-21 must be 45 1309120 string 45 13092 13093# leader starts with 5 digits, followed by codes specific to MARC format 13094>0 regex/1 (^[0-9]{5})[acdnp][^bhlnqsu-z] MARC21 Bibliographic 13095!:mime application/marc 13096>0 regex/1 (^[0-9]{5})[acdnosx][z] MARC21 Authority 13097!:mime application/marc 13098>0 regex/1 (^[0-9]{5})[cdn][uvxy] MARC21 Holdings 13099!:mime application/marc 131000 regex/1 (^[0-9]{5})[acdn][w] MARC21 Classification 13101!:mime application/marc 13102>0 regex/1 (^[0-9]{5})[cdn][q] MARC21 Community 13103!:mime application/marc 13104 13105# leader position 22-23, should be "00" but is it? 13106>0 regex/1 (^.{21})([^0]{2}) (non-conforming) 13107!:mime application/marc 13108 13109#------------------------------------------------------------------------------ 13110# $File: mathcad,v 1.5 2009/09/19 16:28:10 christos Exp $ 13111# mathcad: file(1) magic for Mathcad documents 13112# URL: http://www.mathsoft.com/ 13113# From: Josh Triplett <josh@freedesktop.org> 13114 131150 string .MCAD\t Mathcad document 13116 13117#------------------------------------------------------------------------------ 13118# $File: mathematica,v 1.7 2009/09/19 16:28:10 christos Exp $ 13119# mathematica: file(1) magic for mathematica files 13120# "H. Nanosecond" <aldomel@ix.netcom.com> 13121# Mathematica a multi-purpose math program 13122# versions 2.2 and 3.0 13123 13124#mathematica .mb 131250 string \064\024\012\000\035\000\000\000 Mathematica version 2 notebook 131260 string \064\024\011\000\035\000\000\000 Mathematica version 2 notebook 13127 13128# .ma 13129# multiple possibilites: 13130 131310 string (*^\n\n::[\011frontEndVersion\ =\ Mathematica notebook 13132#>41 string >\0 %s 13133 13134#0 string (*^\n\n::[\011palette Mathematica notebook version 2.x 13135 13136#0 string (*^\n\n::[\011Information Mathematica notebook version 2.x 13137#>675 string >\0 %s #doesn't work well 13138 13139# there may be 'cr' instread of 'nl' in some does this matter? 13140 13141# generic: 131420 string (*^\r\r::[\011 Mathematica notebook version 2.x 131430 string (*^\r\n\r\n::[\011 Mathematica notebook version 2.x 131440 string (*^\015 Mathematica notebook version 2.x 131450 string (*^\n\r\n\r::[\011 Mathematica notebook version 2.x 131460 string (*^\r::[\011 Mathematica notebook version 2.x 131470 string (*^\r\n::[\011 Mathematica notebook version 2.x 131480 string (*^\n\n::[\011 Mathematica notebook version 2.x 131490 string (*^\n::[\011 Mathematica notebook version 2.x 13150 13151 13152# Mathematica .mx files 13153 13154#0 string (*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*) Mathematica binary file 131550 string (*This\ is\ a\ Mathematica\ binary\ Mathematica binary file 13156#>71 string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000 13157# >71... is optional 13158>88 string >\0 from %s 13159 13160 13161# Mathematica files PBF: 13162# 115 115 101 120 102 106 000 001 000 000 000 203 000 001 000 131630 string MMAPBF\000\001\000\000\000\203\000\001\000 Mathematica PBF (fonts I think) 13164 13165# .ml files These are menu resources I think 13166# these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\ 13167# how to put that into a magic rule? 131684 string \ A~ MAthematica .ml file 13169 13170# .nb files 13171#too long 0 string (***********************************************************************\n\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Mathematica-Compatible Notebook Mathematica 3.0 notebook 131720 string (*********************** Mathematica 3.0 notebook 13173 13174# other (* matches it is a comment start in these langs 13175# GRR: Too weak; also matches other languages e.g. ML 13176#0 string (* Mathematica, or Pascal, Modula-2 or 3 code text 13177 13178######################### 13179# MatLab v5 131800 string MATLAB Matlab v5 mat-file 13181>126 short 0x494d (big endian) 13182>>124 beshort x version 0x%04x 13183>126 short 0x4d49 (little endian) 13184>>124 leshort x version 0x%04x 13185 13186 13187#------------------------------------------------------------------------------ 13188# $File: matroska,v 1.8 2013/02/08 17:25:16 christos Exp $ 13189# matroska: file(1) magic for Matroska files 13190# 13191# See http://www.matroska.org/ 13192# 13193 13194# EBML id: 131950 belong 0x1a45dfa3 13196# DocType id: 13197>4 search/4096 \x42\x82 13198# DocType contents: 13199>>&1 string webm WebM 13200!:mime video/webm 13201>>&1 string matroska Matroska data 13202!:mime video/x-matroska 13203 13204#------------------------------------------------------------------------------ 13205# $File: mcrypt,v 1.5 2009/09/19 16:28:10 christos Exp $ 13206# Mavroyanopoulos Nikos <nmav@hellug.gr> 13207# mcrypt: file(1) magic for mcrypt 2.2.x; 132080 string \0m\3 mcrypt 2.5 encrypted data, 13209>4 string >\0 algorithm: %s, 13210>>&1 leshort >0 keysize: %d bytes, 13211>>>&0 string >\0 mode: %s, 13212 132130 string \0m\2 mcrypt 2.2 encrypted data, 13214>3 byte 0 algorithm: blowfish-448, 13215>3 byte 1 algorithm: DES, 13216>3 byte 2 algorithm: 3DES, 13217>3 byte 3 algorithm: 3-WAY, 13218>3 byte 4 algorithm: GOST, 13219>3 byte 6 algorithm: SAFER-SK64, 13220>3 byte 7 algorithm: SAFER-SK128, 13221>3 byte 8 algorithm: CAST-128, 13222>3 byte 9 algorithm: xTEA, 13223>3 byte 10 algorithm: TWOFISH-128, 13224>3 byte 11 algorithm: RC2, 13225>3 byte 12 algorithm: TWOFISH-192, 13226>3 byte 13 algorithm: TWOFISH-256, 13227>3 byte 14 algorithm: blowfish-128, 13228>3 byte 15 algorithm: blowfish-192, 13229>3 byte 16 algorithm: blowfish-256, 13230>3 byte 100 algorithm: RC6, 13231>3 byte 101 algorithm: IDEA, 13232>4 byte 0 mode: CBC, 13233>4 byte 1 mode: ECB, 13234>4 byte 2 mode: CFB, 13235>4 byte 3 mode: OFB, 13236>4 byte 4 mode: nOFB, 13237>5 byte 0 keymode: 8bit 13238>5 byte 1 keymode: 4bit 13239>5 byte 2 keymode: SHA-1 hash 13240>5 byte 3 keymode: MD5 hash 13241 13242#------------------------------------------------------------------------------ 13243# $File: mercurial,v 1.4 2009/09/19 16:28:10 christos Exp $ 13244# mercurial: file(1) magic for Mercurial changeset bundles 13245# http://www.selenic.com/mercurial/wiki/ 13246# 13247# Jesse Glick (jesse.glick@sun.com) 13248# 13249 132500 string HG10 Mercurial changeset bundle 13251>4 string UN (uncompressed) 13252>4 string GZ (gzip compressed) 13253>4 string BZ (bzip2 compressed) 13254 13255#------------------------------------------------------------------------------ 13256# $File: metastore,v 1.1 2011/04/06 12:37:44 christos Exp $ 13257# metastore: file(1) magic for metastore files 13258# From: Thomas Wissen 13259# see http://david.hardeman.nu/software.php#metastore 132600 string MeTaSt00r3 Metastore data file, 13261>10 bequad x version %0llx 13262 13263#------------------------------------------------------------------------------ 13264# $File: mime,v 1.6 2010/11/25 15:00:12 christos Exp $ 13265# mime: file(1) magic for MIME encoded files 13266# 132670 string/t Content-Type:\ 13268>14 string >\0 %s 132690 string/t Content-Type: 13270>13 string >\0 %s 13271 13272#------------------------------------------------------------------------------ 13273# $File: mips,v 1.9 2013/01/12 03:09:51 christos Exp $ 13274# mips: file(1) magic for MIPS ECOFF and Ucode, as used in SGI IRIX 13275# and DEC Ultrix 13276# 132770 beshort 0x0160 MIPSEB ECOFF executable 13278>20 beshort 0407 (impure) 13279>20 beshort 0410 (swapped) 13280>20 beshort 0413 (paged) 13281>8 belong >0 not stripped 13282>8 belong 0 stripped 13283>22 byte x - version %ld 13284>23 byte x \b.%ld 13285# 132860 beshort 0x0162 MIPSEL-BE ECOFF executable 13287>20 beshort 0407 (impure) 13288>20 beshort 0410 (swapped) 13289>20 beshort 0413 (paged) 13290>8 belong >0 not stripped 13291>8 belong 0 stripped 13292>23 byte x - version %d 13293>22 byte x \b.%ld 13294# 132950 beshort 0x6001 MIPSEB-LE ECOFF executable 13296>20 beshort 03401 (impure) 13297>20 beshort 04001 (swapped) 13298>20 beshort 05401 (paged) 13299>8 belong >0 not stripped 13300>8 belong 0 stripped 13301>23 byte x - version %d 13302>22 byte x \b.%ld 13303# 133040 beshort 0x6201 MIPSEL ECOFF executable 13305>20 beshort 03401 (impure) 13306>20 beshort 04001 (swapped) 13307>20 beshort 05401 (paged) 13308>8 belong >0 not stripped 13309>8 belong 0 stripped 13310>23 byte x - version %ld 13311>22 byte x \b.%ld 13312# 13313# MIPS 2 additions 13314# 133150 beshort 0x0163 MIPSEB MIPS-II ECOFF executable 13316>20 beshort 0407 (impure) 13317>20 beshort 0410 (swapped) 13318>20 beshort 0413 (paged) 13319>8 belong >0 not stripped 13320>8 belong 0 stripped 13321>22 byte x - version %ld 13322>23 byte x \b.%ld 13323# 133240 beshort 0x0166 MIPSEL-BE MIPS-II ECOFF executable 13325>20 beshort 0407 (impure) 13326>20 beshort 0410 (swapped) 13327>20 beshort 0413 (paged) 13328>8 belong >0 not stripped 13329>8 belong 0 stripped 13330>22 byte x - version %ld 13331>23 byte x \b.%ld 13332# 133330 beshort 0x6301 MIPSEB-LE MIPS-II ECOFF executable 13334>20 beshort 03401 (impure) 13335>20 beshort 04001 (swapped) 13336>20 beshort 05401 (paged) 13337>8 belong >0 not stripped 13338>8 belong 0 stripped 13339>23 byte x - version %ld 13340>22 byte x \b.%ld 13341# 133420 beshort 0x6601 MIPSEL MIPS-II ECOFF executable 13343>20 beshort 03401 (impure) 13344>20 beshort 04001 (swapped) 13345>20 beshort 05401 (paged) 13346>8 belong >0 not stripped 13347>8 belong 0 stripped 13348>23 byte x - version %ld 13349>22 byte x \b.%ld 13350# 13351# MIPS 3 additions 13352# 133530 beshort 0x0140 MIPSEB MIPS-III ECOFF executable 13354>20 beshort 0407 (impure) 13355>20 beshort 0410 (swapped) 13356>20 beshort 0413 (paged) 13357>8 belong >0 not stripped 13358>8 belong 0 stripped 13359>22 byte x - version %ld 13360>23 byte x \b.%ld 13361# 133620 beshort 0x0142 MIPSEL-BE MIPS-III ECOFF executable 13363>20 beshort 0407 (impure) 13364>20 beshort 0410 (swapped) 13365>20 beshort 0413 (paged) 13366>8 belong >0 not stripped 13367>8 belong 0 stripped 13368>22 byte x - version %ld 13369>23 byte x \b.%ld 13370# 133710 beshort 0x4001 MIPSEB-LE MIPS-III ECOFF executable 13372>20 beshort 03401 (impure) 13373>20 beshort 04001 (swapped) 13374>20 beshort 05401 (paged) 13375>8 belong >0 not stripped 13376>8 belong 0 stripped 13377>23 byte x - version %ld 13378>22 byte x \b.%ld 13379# 133800 beshort 0x4201 MIPSEL MIPS-III ECOFF executable 13381>20 beshort 03401 (impure) 13382>20 beshort 04001 (swapped) 13383>20 beshort 05401 (paged) 13384>8 belong >0 not stripped 13385>8 belong 0 stripped 13386>23 byte x - version %ld 13387>22 byte x \b.%ld 13388# 133890 beshort 0x180 MIPSEB Ucode 133900 beshort 0x182 MIPSEL-BE Ucode 13391 13392#------------------------------------------------------------------------------ 13393# $File: mirage,v 1.7 2009/09/19 16:28:10 christos Exp $ 13394# mirage: file(1) magic for Mirage executables 13395# 13396# XXX - byte order? 13397# 133980 long 31415 Mirage Assembler m.out executable 13399 13400#----------------------------------------------------------------------------- 13401# $File: misctools,v 1.13 2013/01/16 13:53:10 christos Exp $ 13402# misctools: file(1) magic for miscellaneous UNIX tools. 13403# 134040 search/1 %%!! X-Post-It-Note text 134050 string/c BEGIN:VCALENDAR vCalendar calendar file 13406!:mime text/calendar 134070 string/c BEGIN:VCARD vCard visiting card 13408!:mime text/x-vcard 13409 13410# Summary: Libtool library file 13411# Extension: .la 13412# Submitted by: Tomasz Trojanowski <tomek@uninet.com.pl> 134130 search/80 .la\ -\ a\ libtool\ library\ file libtool library file 13414 13415# Summary: Libtool object file 13416# Extension: .lo 13417# Submitted by: Abel Cheung <abelcheung@gmail.com> 134180 search/80 .lo\ -\ a\ libtool\ object\ file libtool object file 13419 13420# From: Daniel Novotny <dnovotny@redhat.com> 134210 string MDMP\x93\xA7 MDMP crash report data 13422 13423#------------------------------------------------------------------------------ 13424# $File: mkid,v 1.6 2009/09/19 16:28:10 christos Exp $ 13425# mkid: file(1) magic for mkid(1) databases 13426# 13427# ID is the binary tags database produced by mkid(1). 13428# 13429# XXX - byte order? 13430# 134310 string \311\304 ID tags data 13432>2 short >0 version %d 13433 13434#------------------------------------------------------------------------------ 13435# $File: mlssa,v 1.4 2009/09/19 16:28:10 christos Exp $ 13436# mlssa: file(1) magic for MLSSA datafiles 13437# 134380 lelong 0xffffabcd MLSSA datafile, 13439>4 leshort x algorithm %d, 13440>10 lelong x %d samples 13441 13442#------------------------------------------------------------------------------ 13443# $File: mmdf,v 1.6 2009/09/19 16:28:10 christos Exp $ 13444# mmdf: file(1) magic for MMDF mail files 13445# 134460 string \001\001\001\001 MMDF mailbox 13447 13448#------------------------------------------------------------------------------ 13449# $File: modem,v 1.5 2010/09/20 18:55:20 rrt Exp $ 13450# modem: file(1) magic for modem programs 13451# 13452# From: Florian La Roche <florian@knorke.saar.de> 134531 string PC\ Research,\ Inc Digifax-G3-File 13454>29 byte 1 \b, fine resolution 13455>29 byte 0 \b, normal resolution 13456 134570 short 0x0100 raw G3 data, byte-padded 134580 short 0x1400 raw G3 data 13459# 13460# Magic data for vgetty voice formats 13461# (Martin Seine & Marc Eberhard) 13462 13463# 13464# raw modem data version 1 13465# 134660 string RMD1 raw modem data 13467>4 string >\0 (%s / 13468>20 short >0 compression type 0x%04x) 13469 13470# 13471# portable voice format 1 13472# 134730 string PVF1\n portable voice format 13474>5 string >\0 (binary %s) 13475 13476# 13477# portable voice format 2 13478# 134790 string PVF2\n portable voice format 13480>5 string >\0 (ascii %s) 13481 13482 13483#------------------------------------------------------------------------------ 13484# $File: motorola,v 1.10 2009/09/19 16:28:11 christos Exp $ 13485# motorola: file(1) magic for Motorola 68K and 88K binaries 13486# 13487# 68K 13488# 134890 beshort 0520 mc68k COFF 13490>18 beshort ^00000020 object 13491>18 beshort &00000020 executable 13492>12 belong >0 not stripped 13493>168 string .lowmem Apple toolbox 13494>20 beshort 0407 (impure) 13495>20 beshort 0410 (pure) 13496>20 beshort 0413 (demand paged) 13497>20 beshort 0421 (standalone) 134980 beshort 0521 mc68k executable (shared) 13499>12 belong >0 not stripped 135000 beshort 0522 mc68k executable (shared demand paged) 13501>12 belong >0 not stripped 13502# 13503# Motorola/UniSoft 68K Binary Compatibility Standard (BCS) 13504# 135050 beshort 0554 68K BCS executable 13506# 13507# 88K 13508# 13509# Motorola/88Open BCS 13510# 135110 beshort 0555 88K BCS executable 13512# 13513# Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de> 135140 string S0 Motorola S-Record; binary data in text format 13515 13516# ATARI ST relocatable PRG 13517# 13518# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 13519# (according to Roland Waldi, Oct 21, 1987) 13520# besides the magic 0x601a, the text segment size is checked to be 13521# not larger than 1 MB (which is a lot on ST). 13522# The additional 0x601b distinction I took from Doug Lee's magic. 135230 belong&0xFFFFFFF0 0x601A0000 Atari ST M68K contiguous executable 13524>2 belong x (txt=%ld, 13525>6 belong x dat=%ld, 13526>10 belong x bss=%ld, 13527>14 belong x sym=%ld) 135280 belong&0xFFFFFFF0 0x601B0000 Atari ST M68K non-contig executable 13529>2 belong x (txt=%ld, 13530>6 belong x dat=%ld, 13531>10 belong x bss=%ld, 13532>14 belong x sym=%ld) 13533 13534# Atari ST/TT... program format (sent by Wolfram Kleff <kleff@cs.uni-bonn.de>) 135350 beshort 0x601A Atari 68xxx executable, 13536>2 belong x text len %lu, 13537>6 belong x data len %lu, 13538>10 belong x BSS len %lu, 13539>14 belong x symboltab len %lu, 13540>18 belong 0 13541>22 belong &0x01 fastload flag, 13542>22 belong &0x02 may be loaded to alternate RAM, 13543>22 belong &0x04 malloc may be from alternate RAM, 13544>22 belong x flags: 0x%lX, 13545>26 beshort 0 no relocation tab 13546>26 beshort !0 + relocation tab 13547>30 string SFX [Self-Extracting LZH SFX archive] 13548>38 string SFX [Self-Extracting LZH SFX archive] 13549>44 string ZIP! [Self-Extracting ZIP SFX archive] 13550 135510 beshort 0x0064 Atari 68xxx CPX file 13552>8 beshort x (version %04lx) 13553 13554#------------------------------------------------------------------------------ 13555# $File: mozilla,v 1.4 2009/09/19 16:28:11 christos Exp $ 13556# mozilla: file(1) magic for Mozilla XUL fastload files 13557# (XUL.mfasl and XPC.mfasl) 13558# URL: http://www.mozilla.org/ 13559# From: Josh Triplett <josh@freedesktop.org> 13560 135610 string XPCOM\nMozFASL\r\n\x1A Mozilla XUL fastload data 13562 13563#------------------------------------------------------------------------------ 13564# $File: msdos,v 1.86 2014/01/08 22:10:18 christos Exp $ 13565# msdos: file(1) magic for MS-DOS files 13566# 13567 13568# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com) 13569# updated by Joerg Jenderek at Oct 2008,Apr 2011 135700 string/t @ 13571>1 string/cW \ echo\ off DOS batch file text 13572!:mime text/x-msdos-batch 13573>1 string/cW echo\ off DOS batch file text 13574!:mime text/x-msdos-batch 13575>1 string/cW rem DOS batch file text 13576!:mime text/x-msdos-batch 13577>1 string/cW set\ DOS batch file text 13578!:mime text/x-msdos-batch 13579 13580 13581# OS/2 batch files are REXX. the second regex is a bit generic, oh well 13582# the matched commands seem to be common in REXX and uncommon elsewhere 13583100 search/0xffff rxfuncadd 13584>100 regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc OS/2 REXX batch file text 13585100 search/0xffff say 13586>100 regex/c =^[\ \t]{0,10}say\ ['"] OS/2 REXX batch file text 13587 135880 leshort 0x14c MS Windows COFF Intel 80386 object file 13589#>4 ledate x stamp %s 135900 leshort 0x166 MS Windows COFF MIPS R4000 object file 13591#>4 ledate x stamp %s 135920 leshort 0x184 MS Windows COFF Alpha object file 13593#>4 ledate x stamp %s 135940 leshort 0x268 MS Windows COFF Motorola 68000 object file 13595#>4 ledate x stamp %s 135960 leshort 0x1f0 MS Windows COFF PowerPC object file 13597#>4 ledate x stamp %s 135980 leshort 0x290 MS Windows COFF PA-RISC object file 13599#>4 ledate x stamp %s 13600 13601# Tests for various EXE types. 13602# 13603# Many of the compressed formats were extraced from IDARC 1.23 source code. 13604# 136050 string/b MZ 13606!:mime application/x-dosexec 13607# All non-DOS EXE extensions have the relocation table more than 0x40 bytes into the file. 13608>0x18 leshort <0x40 MS-DOS executable 13609# These traditional tests usually work but not always. When test quality support is 13610# implemented these can be turned on. 13611#>>0x18 leshort 0x1c (Borland compiler) 13612#>>0x18 leshort 0x1e (MS compiler) 13613 13614# If the relocation table is 0x40 or more bytes into the file, it's definitely 13615# not a DOS EXE. 13616>0x18 leshort >0x3f 13617 13618# Maybe it's a PE? 13619>>(0x3c.l) string PE\0\0 PE 13620>>>(0x3c.l+24) leshort 0x010b \b32 executable 13621>>>(0x3c.l+24) leshort 0x020b \b32+ executable 13622>>>(0x3c.l+24) leshort 0x0107 ROM image 13623>>>(0x3c.l+24) default x Unknown PE signature 13624>>>>&0 leshort x 0x%x 13625>>>(0x3c.l+22) leshort&0x2000 >0 (DLL) 13626>>>(0x3c.l+92) leshort 1 (native) 13627>>>(0x3c.l+92) leshort 2 (GUI) 13628>>>(0x3c.l+92) leshort 3 (console) 13629>>>(0x3c.l+92) leshort 7 (POSIX) 13630>>>(0x3c.l+92) leshort 9 (Windows CE) 13631>>>(0x3c.l+92) leshort 10 (EFI application) 13632>>>(0x3c.l+92) leshort 11 (EFI boot service driver) 13633>>>(0x3c.l+92) leshort 12 (EFI runtime driver) 13634>>>(0x3c.l+92) leshort 13 (EFI ROM) 13635>>>(0x3c.l+92) leshort 14 (XBOX) 13636>>>(0x3c.l+92) leshort 15 (Windows boot application) 13637>>>(0x3c.l+92) default x (Unknown subsystem 13638>>>>&0 leshort x 0x%x) 13639>>>(0x3c.l+4) leshort 0x14c Intel 80386 13640>>>(0x3c.l+4) leshort 0x166 MIPS R4000 13641>>>(0x3c.l+4) leshort 0x168 MIPS R10000 13642>>>(0x3c.l+4) leshort 0x184 Alpha 13643>>>(0x3c.l+4) leshort 0x1a2 Hitachi SH3 13644>>>(0x3c.l+4) leshort 0x1a6 Hitachi SH4 13645>>>(0x3c.l+4) leshort 0x1c0 ARM 13646>>>(0x3c.l+4) leshort 0x1c2 ARM Thumb 13647>>>(0x3c.l+4) leshort 0x1c4 ARMv7 Thumb 13648>>>(0x3c.l+4) leshort 0x1f0 PowerPC 13649>>>(0x3c.l+4) leshort 0x200 Intel Itanium 13650>>>(0x3c.l+4) leshort 0x266 MIPS16 13651>>>(0x3c.l+4) leshort 0x268 Motorola 68000 13652>>>(0x3c.l+4) leshort 0x290 PA-RISC 13653>>>(0x3c.l+4) leshort 0x366 MIPSIV 13654>>>(0x3c.l+4) leshort 0x466 MIPS16 with FPU 13655>>>(0x3c.l+4) leshort 0xebc EFI byte code 13656>>>(0x3c.l+4) leshort 0x8664 x86-64 13657>>>(0x3c.l+4) leshort 0xc0ee MSIL 13658>>>(0x3c.l+4) default x Unknown processor type 13659>>>>&0 leshort x 0x%x 13660>>>(0x3c.l+22) leshort&0x0200 >0 (stripped to external PDB) 13661>>>(0x3c.l+22) leshort&0x1000 >0 system file 13662>>>(0x3c.l+24) leshort 0x010b 13663>>>>(0x3c.l+232) lelong >0 Mono/.Net assembly 13664>>>(0x3c.l+24) leshort 0x020b 13665>>>>(0x3c.l+248) lelong >0 Mono/.Net assembly 13666 13667# hooray, there's a DOS extender using the PE format, with a valid PE 13668# executable inside (which just prints a message and exits if run in win) 13669>>>(8.s*16) string 32STUB \b, 32rtm DOS extender 13670>>>(8.s*16) string !32STUB \b, for MS Windows 13671>>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed 13672>>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed 13673>>>(0x3c.l+0xf8) search/0x140 UPX2 13674>>>>(&0x10.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) 13675>>>(0x3c.l+0xf8) search/0x140 .idata 13676>>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) 13677>>>>(&0xe.l+(-4)) string ZZ0 \b, ZZip self-extracting archive 13678>>>>(&0xe.l+(-4)) string ZZ1 \b, ZZip self-extracting archive 13679>>>(0x3c.l+0xf8) search/0x140 .rsrc 13680>>>>(&0x0f.l+(-4)) string a\\\4\5 \b, WinHKI self-extracting archive 13681>>>>(&0x0f.l+(-4)) string Rar! \b, RAR self-extracting archive 13682>>>>(&0x0f.l+(-4)) search/0x3000 MSCF \b, InstallShield self-extracting archive 13683>>>>(&0x0f.l+(-4)) search/32 Nullsoft \b, Nullsoft Installer self-extracting archive 13684>>>(0x3c.l+0xf8) search/0x140 .data 13685>>>>(&0x0f.l) string WEXTRACT \b, MS CAB-Installer self-extracting archive 13686>>>(0x3c.l+0xf8) search/0x140 .petite\0 \b, Petite compressed 13687>>>>(0x3c.l+0xf7) byte x 13688>>>>>(&0x104.l+(-4)) string =!sfx! \b, ACE self-extracting archive 13689>>>(0x3c.l+0xf8) search/0x140 .WISE \b, WISE installer self-extracting archive 13690>>>(0x3c.l+0xf8) search/0x140 .dz\0\0\0 \b, Dzip self-extracting archive 13691>>>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip) 13692>>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive 13693>>>0x30 string Inno \b, InnoSetup self-extracting archive 13694 13695# Hmm, not a PE but the relocation table is too high for a traditional DOS exe, 13696# must be one of the unusual subformats. 13697>>(0x3c.l) string !PE\0\0 MS-DOS executable 13698 13699>>(0x3c.l) string NE \b, NE 13700>>>(0x3c.l+0x36) byte 1 for OS/2 1.x 13701>>>(0x3c.l+0x36) byte 2 for MS Windows 3.x 13702>>>(0x3c.l+0x36) byte 3 for MS-DOS 13703>>>(0x3c.l+0x36) byte 4 for Windows 386 13704>>>(0x3c.l+0x36) byte 5 for Borland Operating System Services 13705>>>(0x3c.l+0x36) default x 13706>>>>(0x3c.l+0x36) byte x (unknown OS %x) 13707>>>(0x3c.l+0x36) byte 0x81 for MS-DOS, Phar Lap DOS extender 13708>>>(0x3c.l+0x0c) leshort&0x8003 0x8002 (DLL) 13709>>>(0x3c.l+0x0c) leshort&0x8003 0x8001 (driver) 13710>>>&(&0x24.s-1) string ARJSFX \b, ARJ self-extracting archive 13711>>>(0x3c.l+0x70) search/0x80 WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip) 13712 13713>>(0x3c.l) string LX\0\0 \b, LX 13714>>>(0x3c.l+0x0a) leshort <1 (unknown OS) 13715>>>(0x3c.l+0x0a) leshort 1 for OS/2 13716>>>(0x3c.l+0x0a) leshort 2 for MS Windows 13717>>>(0x3c.l+0x0a) leshort 3 for DOS 13718>>>(0x3c.l+0x0a) leshort >3 (unknown OS) 13719>>>(0x3c.l+0x10) lelong&0x28000 =0x8000 (DLL) 13720>>>(0x3c.l+0x10) lelong&0x20000 >0 (device driver) 13721>>>(0x3c.l+0x10) lelong&0x300 0x300 (GUI) 13722>>>(0x3c.l+0x10) lelong&0x28300 <0x300 (console) 13723>>>(0x3c.l+0x08) leshort 1 i80286 13724>>>(0x3c.l+0x08) leshort 2 i80386 13725>>>(0x3c.l+0x08) leshort 3 i80486 13726>>>(8.s*16) string emx \b, emx 13727>>>>&1 string x %s 13728>>>&(&0x54.l-3) string arjsfx \b, ARJ self-extracting archive 13729 13730# MS Windows system file, supposedly a collection of LE executables 13731>>(0x3c.l) string W3 \b, W3 for MS Windows 13732 13733>>(0x3c.l) string LE\0\0 \b, LE executable 13734>>>(0x3c.l+0x0a) leshort 1 13735# some DOS extenders use LE files with OS/2 header 13736>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender 13737>>>>0x240 search/0x200 WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender 13738>>>>0x440 search/0x100 CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender 13739>>>>0x40 search/0x40 PMODE/W for MS-DOS, PMODE/W DOS extender 13740>>>>0x40 search/0x40 STUB/32A for MS-DOS, DOS/32A DOS extender (stub) 13741>>>>0x40 search/0x80 STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub) 13742>>>>0x40 search/0x80 DOS/32A for MS-DOS, DOS/32A DOS extender (embedded) 13743# this is a wild guess; hopefully it is a specific signature 13744>>>>&0x24 lelong <0x50 13745>>>>>(&0x4c.l) string \xfc\xb8WATCOM 13746>>>>>>&0 search/8 3\xdbf\xb9 \b, 32Lite compressed 13747# another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP 13748#>>>>(0x3c.l+0x1c) lelong >0x10000 for OS/2 13749# fails with DOS-Extenders. 13750>>>(0x3c.l+0x0a) leshort 2 for MS Windows 13751>>>(0x3c.l+0x0a) leshort 3 for DOS 13752>>>(0x3c.l+0x0a) leshort 4 for MS Windows (VxD) 13753>>>(&0x7c.l+0x26) string UPX \b, UPX compressed 13754>>>&(&0x54.l-3) string UNACE \b, ACE self-extracting archive 13755 13756# looks like ASCII, probably some embedded copyright message. 13757# and definitely not NE/LE/LX/PE 13758>>0x3c lelong >0x20000000 13759>>>(4.s*512) leshort !0x014c \b, MZ for MS-DOS 13760# header data too small for extended executable 13761>2 long !0 13762>>0x18 leshort <0x40 13763>>>(4.s*512) leshort !0x014c 13764 13765>>>>&(2.s-514) string !LE 13766>>>>>&-2 string !BW \b, MZ for MS-DOS 13767>>>>&(2.s-514) string LE \b, LE 13768>>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender 13769# educated guess since indirection is still not capable enough for complex offset 13770# calculations (next embedded executable would be at &(&2*512+&0-2) 13771# I suspect there are only LE executables in these multi-exe files 13772>>>>&(2.s-514) string BW 13773>>>>>0x240 search/0x100 DOS/4G ,\b LE for MS-DOS, DOS4GW DOS extender (embedded) 13774>>>>>0x240 search/0x100 !DOS/4G ,\b BW collection for MS-DOS 13775 13776# This sequence skips to the first COFF segment, usually .text 13777>(4.s*512) leshort 0x014c \b, COFF 13778>>(8.s*16) string go32stub for MS-DOS, DJGPP go32 DOS extender 13779>>(8.s*16) string emx 13780>>>&1 string x for DOS, Win or OS/2, emx %s 13781>>&(&0x42.l-3) byte x 13782>>>&0x26 string UPX \b, UPX compressed 13783# and yet another guess: small .text, and after large .data is unusal, could be 32lite 13784>>&0x2c search/0xa0 .text 13785>>>&0x0b lelong <0x2000 13786>>>>&0 lelong >0x6000 \b, 32lite compressed 13787 13788>(8.s*16) string $WdX \b, WDos/X DOS extender 13789 13790# By now an executable type should have been printed out. The executable 13791# may be a self-uncompressing archive, so look for evidence of that and 13792# print it out. 13793# 13794# Some signatures below from Greg Roelofs, newt@uchicago.edu. 13795# 13796>0x35 string \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed 13797>0xe7 string LH/2\ Self-Extract \b, %s 13798>0x1c string UC2X \b, UCEXE compressed 13799>0x1c string WWP\ \b, WWPACK compressed 13800>0x1c string RJSX \b, ARJ self-extracting archive 13801>0x1c string diet \b, diet compressed 13802>0x1c string LZ09 \b, LZEXE v0.90 compressed 13803>0x1c string LZ91 \b, LZEXE v0.91 compressed 13804>0x1c string tz \b, TinyProg compressed 13805>0x1e string Copyright\ 1989-1990\ PKWARE\ Inc. Self-extracting PKZIP archive 13806!:mime application/zip 13807# Yes, this really is "Copr", not "Corp." 13808>0x1e string PKLITE\ Copr. Self-extracting PKZIP archive 13809!:mime application/zip 13810# winarj stores a message in the stub instead of the sig in the MZ header 13811>0x20 search/0xe0 aRJsfX \b, ARJ self-extracting archive 13812>0x20 string AIN 13813>>0x23 string 2 \b, AIN 2.x compressed 13814>>0x23 string <2 \b, AIN 1.x compressed 13815>>0x23 string >2 \b, AIN 1.x compressed 13816>0x24 string LHa's\ SFX \b, LHa self-extracting archive 13817!:mime application/x-lha 13818>0x24 string LHA's\ SFX \b, LHa self-extracting archive 13819!:mime application/x-lha 13820>0x24 string \ $ARX \b, ARX self-extracting archive 13821>0x24 string \ $LHarc \b, LHarc self-extracting archive 13822>0x20 string SFX\ by\ LARC \b, LARC self-extracting archive 13823>0x40 string aPKG \b, aPackage self-extracting archive 13824>0x64 string W\ Collis\0\0 \b, Compack compressed 13825>0x7a string Windows\ self-extracting\ ZIP \b, ZIP self-extracting archive 13826>>&0xf4 search/0x140 \x0\x40\x1\x0 13827>>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive 13828>1638 string -lh5- \b, LHa self-extracting archive v2.13S 13829>0x17888 string Rar! \b, RAR self-extracting archive 13830 13831# Skip to the end of the EXE. This will usually work fine in the PE case 13832# because the MZ image is hardcoded into the toolchain and almost certainly 13833# won't match any of these signatures. 13834>(4.s*512) long x 13835>>&(2.s-517) byte x 13836>>>&0 string PK\3\4 \b, ZIP self-extracting archive 13837>>>&0 string Rar! \b, RAR self-extracting archive 13838>>>&0 string =!\x11 \b, AIN 2.x self-extracting archive 13839>>>&0 string =!\x12 \b, AIN 2.x self-extracting archive 13840>>>&0 string =!\x17 \b, AIN 1.x self-extracting archive 13841>>>&0 string =!\x18 \b, AIN 1.x self-extracting archive 13842>>>&7 search/400 **ACE** \b, ACE self-extracting archive 13843>>>&0 search/0x480 UC2SFX\ Header \b, UC2 self-extracting archive 13844 13845# a few unknown ZIP sfxes, no idea if they are needed or if they are 13846# already captured by the generic patterns above 13847>(8.s*16) search/0x20 PKSFX \b, ZIP self-extracting archive (PKZIP) 13848# TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive 13849# 13850 13851# TELVOX Teleinformatica CODEC self-extractor for OS/2: 13852>49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21 13853>>49824 leshort =1 \b, 1 file 13854>>49824 leshort >1 \b, %u files 13855 13856# added by Joerg Jenderek of http://www.freedos.org/software/?prog=kc 13857# and http://www.freedos.org/software/?prog=kpdos 13858# for FreeDOS files like KEYBOARD.SYS, KEYBRD2.SYS, KEYBRD3.SYS, *.KBD 138590 string/b KCF FreeDOS KEYBoard Layout collection 13860# only version=0x100 found 13861>3 uleshort x \b, version 0x%x 13862# length of string containing author,info and special characters 13863>6 ubyte >0 13864#>>6 pstring x \b, name=%s 13865>>7 string >\0 \b, author=%-.14s 13866>>7 search/254 \xff \b, info= 13867#>>>&0 string x \b%-s 13868>>>&0 string x \b%-.15s 13869# for FreeDOS *.KL files 138700 string/b KLF FreeDOS KEYBoard Layout file 13871# only version=0x100 or 0x101 found 13872>3 uleshort x \b, version 0x%x 13873# stringlength 13874>5 ubyte >0 13875>>8 string x \b, name=%-.2s 138760 string \xffKEYB\ \ \ \0\0\0\0 13877>12 string \0\0\0\0`\004\360 MS-DOS KEYBoard Layout file 13878 13879# .COM formats (Daniel Quinlan, quinlan@yggdrasil.com) 13880# Uncommenting only the first two lines will cover about 2/3 of COM files, 13881# but it isn't feasible to match all COM files since there must be at least 13882# two dozen different one-byte "magics". 13883# test too generic ? 138840 byte 0xe9 DOS executable (COM) 13885>0x1FE leshort 0xAA55 \b, boot code 13886>6 string SFX\ of\ LHarc (%s) 13887 13888# DOS device driver updated by Joerg Jenderek at May 2011 13889# http://maben.homeip.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009 138900 ulequad&0x07a0ffffffff 0xffffffff DOS executable ( 13891>40 search/7 UPX! \bUPX compressed 13892# DOS device driver attributes 13893>4 uleshort&0x8000 0x0000 \bblock device driver 13894# character device 13895>4 uleshort&0x8000 0x8000 \b 13896>>4 uleshort&0x0008 0x0008 \bclock 13897# fast video output by int 29h 13898>>4 uleshort&0x0010 0x0010 \bfast 13899# standard input/output device 13900>>4 uleshort&0x0003 >0 \bstandard 13901>>>4 uleshort&0x0001 0x0001 \binput 13902>>>4 uleshort&0x0003 0x0003 \b/ 13903>>>4 uleshort&0x0002 0x0002 \boutput 13904>>4 uleshort&0x8000 0x8000 \bcharacter device driver 13905>0 ubyte x 13906# upx compressed device driver has garbage instead of real in name field of header 13907>>40 search/7 UPX! 13908>>40 default x 13909# leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped 13910>>>12 ubyte >0x27 \b 13911>>>>10 ubyte >0x20 13912>>>>>10 ubyte !0x2E 13913>>>>>>10 ubyte !0x2A \b%c 13914>>>>11 ubyte >0x20 13915>>>>>11 ubyte !0x2E \b%c 13916>>>>12 ubyte >0x20 13917>>>>>12 ubyte !0x39 13918>>>>>>12 ubyte !0x2E \b%c 13919>>>13 ubyte >0x20 13920>>>>13 ubyte !0x2E \b%c 13921>>>>14 ubyte >0x20 13922>>>>>14 ubyte !0x2E \b%c 13923>>>>15 ubyte >0x20 13924>>>>>15 ubyte !0x2E \b%c 13925>>>>16 ubyte >0x20 13926>>>>>16 ubyte !0x2E 13927>>>>>>16 ubyte <0xCB \b%c 13928>>>>17 ubyte >0x20 13929>>>>>17 ubyte !0x2E 13930>>>>>>17 ubyte <0x90 \b%c 13931# some character device drivers like ASPICD.SYS, btcdrom.sys and Cr_atapi.sys contain only spaces or points in name field 13932>>>4 uleshort&0x8000 0x8000 13933>>>>12 ubyte <0x2F 13934# they have their real name at offset 22 13935>>>>>22 string >\0 \b%-.5s 13936>4 uleshort&0x8000 0x0000 13937# 32 bit sector adressing ( > 32 MB) for block devices 13938>>4 uleshort&0x0002 0x0002 \b,32-bit sector- 13939# support by driver functions 13h, 17h, 18h 13940>4 uleshort&0x0040 0x0040 \b,IOCTL- 13941# open, close, removable media support by driver functions 0Dh, 0Eh, 0Fh 13942>4 uleshort&0x0800 0x0800 \b,close media- 13943# output until busy support by int 10h for character device driver 13944>4 uleshort&0x8000 0x8000 13945>>4 uleshort&0x2000 0x2000 \b,until busy- 13946# direct read/write support by driver functions 03h,0Ch 13947>4 uleshort&0x4000 0x4000 \b,control strings- 13948>4 uleshort&0x8000 0x8000 13949>>4 uleshort&0x6840 >0 \bsupport 13950>4 uleshort&0x8000 0x0000 13951>>4 uleshort&0x4842 >0 \bsupport 13952>0 ubyte x \b) 13953# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header 13954# Too weak, matches files that only contain 0's 13955#0 ulequad&0x000007a0ffffffed 0x0000000000000000 DOS-executable ( 13956#>4 uleshort&0x8000 0x8000 \bcharacter device driver 13957#>>10 string x %-.8s 13958#>4 uleshort&0x4000 0x4000 \b,control strings-support) 13959 13960# test too generic ? 139610 byte 0x8c DOS executable (COM) 13962# updated by Joerg Jenderek at Oct 2008 139630 ulelong 0xffff10eb DR-DOS executable (COM) 13964# byte 0xeb conflicts with "sequent" magic leshort 0xn2eb 139650 ubeshort&0xeb8d >0xeb00 13966# DR-DOS STACKER.COM SCREATE.SYS missed 13967>0 byte 0xeb 13968>>0x1FE leshort 0xAA55 DOS executable (COM), boot code 13969>>85 string UPX DOS executable (COM), UPX compressed 13970>>4 string \ $ARX DOS executable (COM), ARX self-extracting archive 13971>>4 string \ $LHarc DOS executable (COM), LHarc self-extracting archive 13972>>0x20e string SFX\ by\ LARC DOS executable (COM), LARC self-extracting archive 13973# updated by Joerg Jenderek at Oct 2008 13974#0 byte 0xb8 COM executable 139750 uleshort&0x80ff 0x00b8 13976# modified by Joerg Jenderek 13977>1 lelong !0x21cd4cff COM executable for DOS 13978# http://syslinux.zytor.com/comboot.php 13979# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode 13980# start with assembler instructions mov eax,21cd4cffh 139810 uleshort&0xc0ff 0xc0b8 13982>1 lelong 0x21cd4cff COM executable (32-bit COMBOOT) 13983# syslinux:doc/comboot.txt 13984# A COM32R program must start with the byte sequence B8 FE 4C CD 21 (mov 13985# eax,21cd4cfeh) as a magic number. 139860 string/b \xb8\xfe\x4c\xcd\x21 COM executable (COM32R) 13987# start with assembler instructions mov eax,21cd4cfeh 139880 uleshort&0xc0ff 0xc0b8 13989>1 lelong 0x21cd4cfe COM executable (32-bit COMBOOT, relocatable) 139900 string/b \x81\xfc 13991>4 string \x77\x02\xcd\x20\xb9 13992>>36 string UPX! FREE-DOS executable (COM), UPX compressed 13993252 string Must\ have\ DOS\ version DR-DOS executable (COM) 13994# added by Joerg Jenderek at Oct 2008 13995# GRR search is not working 13996#34 search/2 UPX! FREE-DOS executable (COM), UPX compressed 1399734 string UPX! FREE-DOS executable (COM), UPX compressed 1399835 string UPX! FREE-DOS executable (COM), UPX compressed 13999# GRR search is not working 14000#2 search/28 \xcd\x21 COM executable for MS-DOS 14001#WHICHFAT.cOM 140022 string \xcd\x21 COM executable for DOS 14003#DELTREE.cOM DELTREE2.cOM 140044 string \xcd\x21 COM executable for DOS 14005#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM 140065 string \xcd\x21 COM executable for DOS 14007#DELTMP.COm HASFAT32.cOM 140087 string \xcd\x21 14009>0 byte !0xb8 COM executable for DOS 14010#COMP.cOM MORE.COm 1401110 string \xcd\x21 14012>5 string !\xcd\x21 COM executable for DOS 14013#comecho.com 1401413 string \xcd\x21 COM executable for DOS 14015#HELP.COm EDIT.coM 1401618 string \xcd\x21 COM executable for MS-DOS 14017#NWRPLTRM.COm 1401823 string \xcd\x21 COM executable for MS-DOS 14019#LOADFIX.cOm LOADFIX.cOm 1402030 string \xcd\x21 COM executable for MS-DOS 14021#syslinux.com 3.11 1402270 string \xcd\x21 COM executable for DOS 14023# many compressed/converted COMs start with a copy loop instead of a jump 140240x6 search/0xa \xfc\x57\xf3\xa5\xc3 COM executable for MS-DOS 140250x6 search/0xa \xfc\x57\xf3\xa4\xc3 COM executable for DOS 14026>0x18 search/0x10 \x50\xa4\xff\xd5\x73 \b, aPack compressed 140270x3c string W\ Collis\0\0 COM executable for MS-DOS, Compack compressed 14028# FIXME: missing diet .com compression 14029 14030# miscellaneous formats 140310 string/b LZ MS-DOS executable (built-in) 14032#0 byte 0xf0 MS-DOS program library data 14033# 14034 14035# AAF files: 14036# <stuartc@rd.bbc.co.uk> Stuart Cunningham 140370 string/b \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage 14038>30 byte 9 (512B sectors) 14039>30 byte 12 (4kB sectors) 140400 string/b \320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001 AAF file using MS Structured Storage 14041>30 byte 9 (512B sectors) 14042>30 byte 12 (4kB sectors) 14043 14044# Popular applications 140452080 string Microsoft\ Word\ 6.0\ Document %s 14046!:mime application/msword 140472080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data 14048!:mime application/msword 14049# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word) 140502112 string MSWordDoc Microsoft Word document data 14051!:mime application/msword 14052# 140530 belong 0x31be0000 Microsoft Word Document 14054!:mime application/msword 14055# 140560 string/b PO^Q` Microsoft Word 6.0 Document 14057!:mime application/msword 14058# 140590 string/b \376\067\0\043 Microsoft Office Document 14060!:mime application/msword 140610 string/b \333\245-\0\0\0 Microsoft Office Document 14062!:mime application/msword 14063512 string/b \354\245\301 Microsoft Word Document 14064!:mime application/msword 14065 14066# 140670 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document 14068!:mime application/msword 14069# 140702080 string Microsoft\ Excel\ 5.0\ Worksheet %s 14071!:mime application/vnd.ms-excel 14072# 140730 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document 14074!:mime application/msword 14075 140762080 string Foglio\ di\ lavoro\ Microsoft\ Exce %s 14077!:mime application/vnd.ms-excel 14078# 14079# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel) 140802114 string Biff5 Microsoft Excel 5.0 Worksheet 14081!:mime application/vnd.ms-excel 14082# Italian MS-Excel 140832121 string Biff5 Microsoft Excel 5.0 Worksheet 14084!:mime application/vnd.ms-excel 140850 string/b \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet 14086!:mime application/vnd.ms-excel 14087# 140880 belong 0x00001a00 Lotus 1-2-3 14089!:mime application/x-123 14090>4 belong 0x00100400 wk3 document data 14091>4 belong 0x02100400 wk4 document data 14092>4 belong 0x07800100 fm3 or fmb document data 14093>4 belong 0x07800000 fm3 or fmb document data 14094# 140950 belong 0x00000200 Lotus 1-2-3 14096!:mime application/x-123 14097>4 belong 0x06040600 wk1 document data 14098>4 belong 0x06800200 fmt document data 140990 string/b WordPro\0 Lotus WordPro 14100!:mime application/vnd.lotus-wordpro 141010 string/b WordPro\r\373 Lotus WordPro 14102!:mime application/vnd.lotus-wordpro 14103 14104 14105# Summary: Script used by InstallScield to uninstall applications 14106# Extension: .isu 14107# Submitted by: unknown 14108# Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry) 141090 string \x71\xa8\x00\x00\x01\x02 14110>12 string Stirling\ Technologies, InstallShield Uninstall Script 14111 14112# Winamp .avs 14113#0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player 141140 string/b Nullsoft\ AVS\ Preset\ Winamp plug in 14115 14116# Windows Metafont .WMF 141170 string/b \327\315\306\232 ms-windows metafont .wmf 141180 string/b \002\000\011\000 ms-windows metafont .wmf 141190 string/b \001\000\011\000 ms-windows metafont .wmf 14120 14121#tz3 files whatever that is (MS Works files) 141220 string/b \003\001\001\004\070\001\000\000 tz3 ms-works file 141230 string/b \003\002\001\004\070\001\000\000 tz3 ms-works file 141240 string/b \003\003\001\004\070\001\000\000 tz3 ms-works file 14125 14126# PGP sig files .sig 14127#0 string \211\000\077\003\005\000\063\237\127 065 to \027\266\151\064\005\045\101\233\021\002 PGP sig 141280 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig 141290 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig 141300 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig 141310 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig 141320 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig 141330 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig 14134 14135# windows zips files .dmf 141360 string/b MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file 14137 14138 14139#ico files 141400 string/b \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for MS Windows 14141 14142# Windows icons (Ian Springer <ips@fpk.hp.com>) 141430 string/b \000\000\001\000 MS Windows icon resource 14144!:mime image/x-icon 14145>4 byte 1 - 1 icon 14146>4 byte >1 - %d icons 14147>>6 byte >0 \b, %dx 14148>>>7 byte >0 \b%d 14149>>8 byte 0 \b, 256-colors 14150>>8 byte >0 \b, %d-colors 14151 14152 14153# .chr files 141540 string/b PK\010\010BGI Borland font 14155>4 string >\0 %s 14156# then there is a copyright notice 14157 14158 14159# .bgi files 141600 string/b pk\010\010BGI Borland device 14161>4 string >\0 %s 14162# then there is a copyright notice 14163 14164 14165# Windows Recycle Bin record file (named INFO2) 14166# By Abel Cheung (abelcheung AT gmail dot com) 14167# Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes 14168# Since Vista uses another structure, INFO2 structure probably won't change 14169# anymore. Detailed analysis in: 14170# http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf 141710 lelong 0x00000004 14172>12 lelong 0x00000118 Windows Recycle Bin INFO2 file (Win98 or below) 14173 141740 lelong 0x00000005 14175>12 lelong 0x00000320 Windows Recycle Bin INFO2 file (Win2k - WinXP) 14176 14177 14178##### put in Either Magic/font or Magic/news 14179# Acroread or something files wrongly identified as G3 .pfm 14180# these have the form \000 \001 any? \002 \000 \000 14181# or \000 \001 any? \022 \000 \000 141820 belong&0xffff00ff 0x00010012 PFM data 14183>4 string \000\000 14184>6 string >\060 - %s 14185 141860 belong&0xffff00ff 0x00010002 PFM data 14187>4 string \000\000 14188>6 string >\060 - %s 14189#0 string \000\001 pfm? 14190#>3 string \022\000\000Copyright\ yes 14191#>3 string \002\000\000Copyright\ yes 14192#>3 string >\0 oops, not a font file. Cancel that. 14193#it clashes with ttf files so put it lower down. 14194 14195# From Doug Lee via a FreeBSD pr 141969 string GERBILDOC First Choice document 141979 string GERBILDB First Choice database 141989 string GERBILCLIP First Choice database 141990 string GERBIL First Choice device file 142009 string RABBITGRAPH RabbitGraph file 142010 string DCU1 Borland Delphi .DCU file 142020 string =!<spell> MKS Spell hash list (old format) 142030 string =!<spell2> MKS Spell hash list 14204# Too simple - MPi 14205#0 string AH Halo(TM) bitmapped font file 142060 lelong 0x08086b70 TurboC BGI file 142070 lelong 0x08084b50 TurboC Font file 14208 14209# tests for DBase files moved, updated and merged to database 14210 142110 string PMCC Windows 3.x .GRP file 142121 string RDC-meg MegaDots 14213>8 byte >0x2F version %c 14214>9 byte >0x2F \b.%c file 142150 lelong 0x4C 14216>4 lelong 0x00021401 Windows shortcut file 14217 14218# .PIF files added by Joerg Jenderek from http://smsoft.ru/en/pifdoc.htm 14219# only for windows versions equal or greater 3.0 142200x171 string MICROSOFT\ PIFEX\0 Windows Program Information File 14221!:mime application/x-dosexec 14222#>2 string >\0 \b, Title:%.30s 14223>0x24 string >\0 \b for %.63s 14224>0x65 string >\0 \b, directory=%.64s 14225>0xA5 string >\0 \b, parameters=%.64s 14226#>0x181 leshort x \b, offset %x 14227#>0x183 leshort x \b, offsetdata %x 14228#>0x185 leshort x \b, section length %x 14229>0x187 search/0xB55 WINDOWS\ VMM\ 4.0\0 14230>>&0x5e ubyte >0 14231>>>&-1 string <PIFMGR.DLL \b, icon=%s 14232#>>>&-1 string PIFMGR.DLL \b, icon=%s 14233>>>&-1 string >PIFMGR.DLL \b, icon=%s 14234>>&0xF0 ubyte >0 14235>>>&-1 string <Terminal \b, font=%.32s 14236#>>>&-1 string =Terminal \b, font=%.32s 14237>>>&-1 string >Terminal \b, font=%.32s 14238>>&0x110 ubyte >0 14239>>>&-1 string <Lucida\ Console \b, TrueTypeFont=%.32s 14240#>>>&-1 string =Lucida\ Console \b, TrueTypeFont=%.32s 14241>>>&-1 string >Lucida\ Console \b, TrueTypeFont=%.32s 14242#>0x187 search/0xB55 WINDOWS\ 286\ 3.0\0 \b, Windows 3.X standard mode-style 14243#>0x187 search/0xB55 WINDOWS\ 386\ 3.0\0 \b, Windows 3.X enhanced mode-style 14244>0x187 search/0xB55 WINDOWS\ NT\ \ 3.1\0 \b, Windows NT-style 14245#>0x187 search/0xB55 WINDOWS\ NT\ \ 4.0\0 \b, Windows NT-style 14246>0x187 search/0xB55 CONFIG\ \ SYS\ 4.0\0 \b +CONFIG.SYS 14247#>>&06 string x \b:%s 14248>0x187 search/0xB55 AUTOEXECBAT\ 4.0\0 \b +AUTOEXEC.BAT 14249#>>&06 string x \b:%s 14250 14251# DOS EPS Binary File Header 14252# From: Ed Sznyter <ews@Black.Market.NET> 142530 belong 0xC5D0D3C6 DOS EPS Binary File 14254>4 long >0 Postscript starts at byte %d 14255>>8 long >0 length %d 14256>>>12 long >0 Metafile starts at byte %d 14257>>>>16 long >0 length %d 14258>>>20 long >0 TIFF starts at byte %d 14259>>>>24 long >0 length %d 14260 14261# TNEF magic From "Joomy" <joomy@se-ed.net> 14262# Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF) 142630 leshort 0x223e9f78 TNEF 14264!:mime application/vnd.ms-tnef 14265 14266# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS 14267# of http://www.4dos.info/ 14268# pointer,HelpID[8]=4DHnnnmm 142690 ulelong 0x48443408 4DOS help file 14270>4 string x \b, version %-4.4s 14271 14272# old binary Microsoft (.HLP) files added by Joerg Jenderek from http://file-extension.net/seeker/file_extension_hlp 142730 ulequad 0x3a000000024e4c MS Advisor help file 14274 14275# HtmlHelp files (.chm) 142760 string/b ITSF\003\000\000\000\x60\000\000\000\001\000\000\000 MS Windows HtmlHelp Data 14277 14278# GFA-BASIC (Wolfram Kleff) 142792 string/b GFA-BASIC3 GFA-BASIC 3 data 14280 14281#------------------------------------------------------------------------------ 14282# From Stuart Caie <kyzer@4u.net> (developer of cabextract) 14283# Microsoft Cabinet files 142840 string/b MSCF\0\0\0\0 Microsoft Cabinet archive data 14285!:mime application/vnd.ms-cab-compressed 14286>8 lelong x \b, %u bytes 14287>28 leshort 1 \b, 1 file 14288>28 leshort >1 \b, %u files 14289 14290# InstallShield Cabinet files 142910 string/b ISc( InstallShield Cabinet archive data 14292>5 byte&0xf0 =0x60 version 6, 14293>5 byte&0xf0 !0x60 version 4/5, 14294>(12.l+40) lelong x %u files 14295 14296# Windows CE package files 142970 string/b MSCE\0\0\0\0 Microsoft WinCE install header 14298>20 lelong 0 \b, architecture-independent 14299>20 lelong 103 \b, Hitachi SH3 14300>20 lelong 104 \b, Hitachi SH4 14301>20 lelong 0xA11 \b, StrongARM 14302>20 lelong 4000 \b, MIPS R4000 14303>20 lelong 10003 \b, Hitachi SH3 14304>20 lelong 10004 \b, Hitachi SH3E 14305>20 lelong 10005 \b, Hitachi SH4 14306>20 lelong 70001 \b, ARM 7TDMI 14307>52 leshort 1 \b, 1 file 14308>52 leshort >1 \b, %u files 14309>56 leshort 1 \b, 1 registry entry 14310>56 leshort >1 \b, %u registry entries 14311 14312 14313# Windows Enhanced Metafile (EMF) 14314# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp 14315# for further information. 143160 ulelong 1 14317>40 string \ EMF Windows Enhanced Metafile (EMF) image data 14318>>44 ulelong x version 0x%x 14319 14320# From: Alex Beregszaszi <alex@fsn.hu> 143210 string/b COWD VMWare3 14322>4 byte 3 disk image 14323>>32 lelong x (%d/ 14324>>36 lelong x \b%d/ 14325>>40 lelong x \b%d) 14326>4 byte 2 undoable disk image 14327>>32 string >\0 (%s) 14328 143290 string/b VMDK VMware4 disk image 143300 string/b KDMV VMware4 disk image 14331 14332#-------------------------------------------------------------------- 14333# Qemu Emulator Images 14334# Lines written by Friedrich Schwittay (f.schwittay@yousable.de) 14335# Updated by Adam Buchbinder (adam.buchbinder@gmail.com) 14336# Made by reading sources, reading documentation, and doing trial and error 14337# on existing QCOW files 143380 string/b QFI\xFB QEMU QCOW Image 14339 14340# Uncomment the following line to display Magic (only used for debugging 14341# this magic number) 14342#>0 string/b x , Magic: %s 14343 14344# There are currently 2 Versions: "1" and "2". 14345# http://www.gnome.org/~markmc/qcow-image-format-version-1.html 14346>4 belong 1 (v1) 14347 14348# Using the existence of the Backing File Offset to determine whether 14349# to read Backing File Information 14350>>12 belong >0 \b, has backing file ( 14351# Note that this isn't a null-terminated string; the length is actually 14352# (16.L). Assuming a null-terminated string happens to work usually, but it 14353# may spew junk until it reaches a \0 in some cases. 14354>>>(12.L) string >\0 \bpath %s 14355 14356# Modification time of the Backing File 14357# Really useful if you want to know if your backing 14358# file is still usable together with this image 14359>>>>20 bedate >0 \b, mtime %s) 14360>>>>20 default x \b) 14361 14362# Size is stored in bytes in a big-endian u64. 14363>>24 bequad x \b, %lld bytes 14364 14365# 1 for AES encryption, 0 for none. 14366>>36 belong 1 \b, AES-encrypted 14367 14368# http://www.gnome.org/~markmc/qcow-image-format.html 14369>4 belong 2 (v2) 14370# Using the existence of the Backing File Offset to determine whether 14371# to read Backing File Information 14372>>8 bequad >0 \b, has backing file 14373# Note that this isn't a null-terminated string; the length is actually 14374# (16.L). Assuming a null-terminated string happens to work usually, but it 14375# may spew junk until it reaches a \0 in some cases. Also, since there's no 14376# .Q modifier, we just use the bottom four bytes as an offset. Note that if 14377# the file is over 4G, and the backing file path is stored after the first 4G, 14378# the wrong filename will be printed. (This should be (8.Q), when that syntax 14379# is introduced.) 14380>>>(12.L) string >\0 (path %s) 14381>>24 bequad x \b, %lld bytes 14382>>32 belong 1 \b, AES-encrypted 14383 14384>4 belong 3 (v3) 14385# Using the existence of the Backing File Offset to determine whether 14386# to read Backing File Information 14387>>8 bequad >0 \b, has backing file 14388# Note that this isn't a null-terminated string; the length is actually 14389# (16.L). Assuming a null-terminated string happens to work usually, but it 14390# may spew junk until it reaches a \0 in some cases. Also, since there's no 14391# .Q modifier, we just use the bottom four bytes as an offset. Note that if 14392# the file is over 4G, and the backing file path is stored after the first 4G, 14393# the wrong filename will be printed. (This should be (8.Q), when that syntax 14394# is introduced.) 14395>>>(12.L) string >\0 (path %s) 14396>>24 bequad x \b, %lld bytes 14397>>32 belong 1 \b, AES-encrypted 14398 14399>4 default x (unknown version) 14400 144010 string/b QEVM QEMU suspend to disk image 14402 14403# QEMU QED Image 14404# http://wiki.qemu.org/Features/QED/Specification 144050 string/b QED\0 QEMU QED Image 14406 14407# VDI Image 1440864 string/b \x7f\x10\xda\xbe VDI Image 14409>68 string/b \x01\x00\x01\x00 version 1.1 14410>0 string >\0 (%s) 14411>368 lequad x \b, %lld bytes 14412 144130 string/b Bochs\ Virtual\ HD\ Image Bochs disk image, 14414>32 string x type %s, 14415>48 string x subtype %s 14416 144170 lelong 0x02468ace Bochs Sparse disk image 14418 14419# from http://filext.com by Derek M Jones <derek@knosof.co.uk> 14420# False positive with PPT (also currently this string is too long) 14421#0 string/b \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF\x09\x00\x06 Microsoft Installer 144220 string/b \320\317\021\340\241\261\032\341 Microsoft Office Document 14423#>48 byte 0x1B Excel Document 14424#!:mime application/vnd.ms-excel 14425>546 string bjbj Microsoft Word Document 14426!:mime application/msword 14427>546 string jbjb Microsoft Word Document 14428!:mime application/msword 14429 144300 string/b \224\246\056 Microsoft Word Document 14431!:mime application/msword 14432 14433512 string R\0o\0o\0t\0\ \0E\0n\0t\0r\0y Microsoft Word Document 14434!:mime application/msword 14435 14436# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 14437# Magic type for Dell's BIOS .hdr files 14438# Dell's .hdr 144390 string/b $RBU 14440>23 string Dell %s system BIOS 14441>5 byte 2 14442>>48 byte x version %d. 14443>>49 byte x \b%d. 14444>>50 byte x \b%d 14445>5 byte <2 14446>>48 string x version %.3s 14447 14448# Type: Microsoft DirectDraw Surface 14449# URL: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp 14450# From: Morten Hustveit <morten@debian.org> 144510 string/b DDS\040\174\000\000\000 Microsoft DirectDraw Surface (DDS), 14452>16 lelong >0 %hd x 14453>12 lelong >0 %hd, 14454>84 string x %.4s 14455 14456# Type: Microsoft Document Imaging Format (.mdi) 14457# URL: http://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format 14458# From: Daniele Sempione <scrows@oziosi.org> 144590 short 0x5045 Microsoft Document Imaging Format 14460 14461# MS eBook format (.lit) 144620 string/b ITOLITLS Microsoft Reader eBook Data 14463>8 lelong x \b, version %u 14464!:mime application/x-ms-reader 14465 14466# Windows CE Binary Image Data Format 14467# From: Dr. Jesus <j@hug.gs> 144680 string/b B000FF\n Windows Embedded CE binary image 14469 14470# Windows Imaging (WIM) Image 144710 string/b MSWIM\000\000\000 Windows imaging (WIM) image 14472 14473# The second byte of these signatures is a file version; I don't know what, 14474# if anything, produced files with version numbers 0-2. 14475# From: John Elliott <johne@seasip.demon.co.uk> 144760 string \xfc\x03\x00 Mallard BASIC program data (v1.11) 144770 string \xfc\x04\x00 Mallard BASIC program data (v1.29+) 144780 string \xfc\x03\x01 Mallard BASIC protected program data (v1.11) 144790 string \xfc\x04\x01 Mallard BASIC protected program data (v1.29+) 14480 144810 string MIOPEN Mallard BASIC Jetsam data 144820 string Jetsam0 Mallard BASIC Jetsam index data 14483 14484 14485#------------------------------------------------------------------------------ 14486# $File: msooxml,v 1.4 2014/01/06 18:16:24 rrt Exp $ 14487# msooxml: file(1) magic for Microsoft Office XML 14488# From: Ralf Brown <ralf.brown@gmail.com> 14489 14490# .docx, .pptx, and .xlsx are XML plus other files inside a ZIP 14491# archive. The first member file is normally "[Content_Types].xml". 14492# but some libreoffice generated files put this later. Perhaps skip 14493# the "[Content_Types].xml" test? 14494# Since MSOOXML doesn't have anything like the uncompressed "mimetype" 14495# file of ePub or OpenDocument, we'll have to scan for a filename 14496# which can distinguish between the three types 14497 14498# start by checking for ZIP local file header signature 144990 string PK\003\004 14500!:strength +10 14501# make sure the first file is correct 14502>0x1E regex \[Content_Types\]\.xml|_rels/\.rels 14503# skip to the second local file header 14504# since some documents include a 520-byte extra field following the file 14505# header, we need to scan for the next header 14506>>(18.l+49) search/2000 PK\003\004 14507# now skip to the *third* local file header; again, we need to scan due to a 14508# 520-byte extra field following the file header 14509>>>&26 search/1000 PK\003\004 14510# and check the subdirectory name to determine which type of OOXML 14511# file we have. Correct the mimetype with the registered ones: 14512# http://technet.microsoft.com/en-us/library/cc179224.aspx 14513>>>>&26 string word/ Microsoft Word 2007+ 14514!:mime application/vnd.openxmlformats-officedocument.wordprocessingml.document 14515>>>>&26 string ppt/ Microsoft PowerPoint 2007+ 14516!:mime application/vnd.openxmlformats-officedocument.presentationml.presentation 14517>>>>&26 string xl/ Microsoft Excel 2007+ 14518!:mime application/vnd.openxmlformats-officedocument.spreadsheetml.sheet 14519>>>>&26 default x Microsoft OOXML 14520 14521#------------------------------------------------------------------------------ 14522# $File: msvc,v 1.5 2009/09/19 16:28:11 christos Exp $ 14523# msvc: file(1) magic for msvc 14524# "H. Nanosecond" <aldomel@ix.netcom.com> 14525# Microsoft visual C 14526# 14527# I have version 1.0 14528 14529# .aps 145300 string HWB\000\377\001\000\000\000 Microsoft Visual C .APS file 14531 14532# .ide 14533#too long 0 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157\152\145\143\164\040\106\151\154\145\012\000\032\000\002\000\262\000\272\276\372\316 MSVC .ide 145340 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157 MSVC .ide 14535 14536# .res 145370 string \000\000\000\000\040\000\000\000\377 MSVC .res 145380 string \377\003\000\377\001\000\020\020\350 MSVC .res 145390 string \377\003\000\377\001\000\060\020\350 MSVC .res 14540 14541#.lib 145420 string \360\015\000\000 Microsoft Visual C library 145430 string \360\075\000\000 Microsoft Visual C library 145440 string \360\175\000\000 Microsoft Visual C library 14545 14546#.pch 145470 string DTJPCH0\000\022\103\006\200 Microsoft Visual C .pch 14548 14549# .pdb 14550# too long 0 string Microsoft\ C/C++\ program\ database\ 145510 string Microsoft\ C/C++\ MSVC program database 14552>18 string program\ database\ 14553>33 string >\0 ver %s 14554 14555#.sbr 145560 string \000\002\000\007\000 MSVC .sbr 14557>5 string >\0 %s 14558 14559#.bsc 145600 string \002\000\002\001 MSVC .bsc 14561 14562#.wsp 145630 string 1.00\ .0000.0000\000\003 MSVC .wsp version 1.0000.0000 14564# these seem to start with the version and contain menus 14565 14566#------------------------------------------------------------------------------ 14567# msx: file(1) magic for the MSX Home Computer 14568# v1.1 14569# Fábio R. Schmidlin <sd-snatcher@users.sourceforge.net> 14570 14571############## MSX Music file formats ############## 14572 14573# Gigamix MGSDRV music file 145740 string MGS MSX Gigamix MGSDRV3 music file, 14575>6 ubeshort 0x0D0A 14576>>3 byte x \bv%c 14577>>4 byte x \b.%c 14578>>5 byte x \b%c 14579>>8 string >\0 \b, title: %s 14580 145811 string mgs2\ MSX Gigamix MGSDRV2 music file 14582>6 uleshort 0x80 14583>>0x2E uleshort 0 14584>>>0x30 string >\0 \b, title: %s 14585 14586# KSS music file 145870 string KSCC KSS music file v1.03 14588>0xE byte 0 14589>>0xF byte&0x02 0 \b, soundchips: AY-3-8910, SCC(+) 14590>>0xF byte&0x02 2 \b, soundchip(s): SN76489 14591>>>0xF byte&0x04 4 stereo 14592>>0xF byte&0x01 1 \b, YM2413 14593>>0xF byte&0x08 8 \b, Y8950 14594 145950 string KSSX KSS music file v1.20 14596>0xE byte&0xEF 0 14597>>0xF byte&0x40 0x00 \b, 60Hz 14598>>0xF byte&0x40 0x40 \b, 50Hz 14599>>0xF byte&0x02 0 \b, soundchips: AY-3-8910, SCC(+) 14600>>0xF byte&0x02 0x02 \b, soundchips: SN76489 14601>>>0xF byte&0x04 0x04 stereo 14602>>0xF byte&0x01 0x01 \b, 14603>>>0xF byte&0x18 0x00 \bYM2413 14604>>>0xF byte&0x18 0x08 \bYM2413, Y8950 14605>>>0xF byte&0x18 0x18 \bYM2413+Y8950 pseudostereo 14606>>0xF byte&0x18 0x10 \b, Majyutsushi DAC 14607 14608# Moonblaster for Moonsound 146090 string MBMS 14610>4 byte 0x10 MSX Moonblaster for MoonSound music 14611 14612# Music Player K-kaz 146130 string MPK MSX Music Player K-kaz song 14614>6 ubeshort 0x0D0A 14615>>3 byte x v%c 14616>>4 byte x \b.%c 14617>>5 byte x \b%c 14618 14619# I don't know why these don't work 14620#0 search/0xFFFF \r\n.FM9 14621#>0 search/0xFFFF \r\n#FORMAT MSX Music Player K-kaz source MML file 14622#0 search/0xFFFF \r\nFM1\ \= 14623#>0 search/0xFFFF \r\nPSG1\= 14624#>>0 search/0xFFFF \r\nSCC1\= MSX MuSiCa MML source file 14625 14626# OPX Music file 146270x35 beshort 0x0d0a 14628>0x7B beshort 0x0d0a 14629>>0x7D byte 0x1a 14630>>>0x87 uleshort 0 MSX OPX Music file 14631>>>>0x86 byte 0 v1.5 14632>>>>>0 string >\32 \b, title: %s 14633>>>>0x86 byte 1 v2.4 14634>>>>>0 string >\32 \b, title: %s 14635 14636# SCMD music file 146370x8B string SCMD 14638>0xCE uleshort 0 MSX SCMD Music file 14639#>>-2 uleshort 0x6a71 ; The file must end with this value. How to code this here? 14640>>0x8F string >\0 \b, title: %s 14641 146420 search/0xFFFF \r\n@title 14643>&0 search/0xFFFF \r\n@m=[ MSX SCMD source MML file 14644 14645 14646############## MSX image file formats ############## 14647 14648# MSX raw VRAM dump 146490 ubyte 0xFE 14650>1 uleshort 0 14651>>5 uleshort 0 14652>>>3 uleshort 0x37FF MSX SC2/GRP raw image 14653>>>3 uleshort 0x6A00 MSX Graph Saurus SR5 raw image 14654>>>3 uleshort >0x769E 14655>>>>3 uleshort <0x8000 MSX GE5/GE6 raw image 14656>>>>>3 uleshort 0x7FFF \b, with sprite patterns 14657>>>3 uleshort 0xD3FF MSX screen 7-12 raw image 14658>>>3 uleshort 0xD400 MSX Graph Saurus SR7/SR8/SRS raw image 14659 14660# Graph Saurus compressed images 146610 ubyte 0xFD 14662>1 uleshort 0 14663>>5 uleshort 0 14664>>>3 uleshort >0x013D MSX Graph Saurus compressed image 14665 14666# Maki-chan Graphic format 146670 string MAKI02\ \ Maki-chan image, 14668>8 byte x system ID: %c 14669>9 byte x \b%c 14670>10 byte x \b%c 14671>11 byte x \b%c, 14672>13 search/0x200 \x1A 14673# >>&3 ubyte 0 , video mode: PC-98 400 lines, 16 analog colors 14674# >>&3 ubyte 1 , video mode: MSX SC7, 16 analog colors 14675# >>&3 ubyte 2 , video mode: VM-98 400 lines, 8 analog colors 14676# >>&3 ubyte 3 , video mode: PC-88 analog, 200 lines, 8 analog colors 14677# >>&3 ubyte 4 , video mode: 400 lines, 16 digital colors 14678# >>&3 ubyte 5 , video mode: 200 lines, 16 digital colors 14679# >>&3 ubyte 6 , video mode: old PC-98 digital 400 lines, 8 colors 14680# >>&3 ubyte 7 , video mode: PC-88 400 lines, 8 digital colors 14681>>&8 uleshort+1 x %dx 14682>>&10 uleshort+1 x \b%d, 14683>>&3 ubyte&0x82 0x80 256 colors 14684>>&3 ubyte&0x82 0x00 16 colors 14685>>&3 ubyte&0x82 0x01 8 colors 14686>>&3 ubyte&0x04 4 digital 14687>>&3 ubyte&0x04 0 analog 14688>>&3 ubyte&0x01 1 \b, 2:1 dot aspect ratio 14689 14690# Japanese PIC file 146910 string PIC\x1A 14692>4 lelong 0 Japanese PIC image file 14693 14694# MSX G9B image file 146950 string G9B 14696>1 uleshort 11 14697>>3 uleshort >10 14698>>>5 ubyte >0 MSX G9B image, depth=%d 14699>>>>8 uleshort x \b, %dx 14700>>>>10 uleshort x \b%d 14701>>>>5 ubyte <9 14702>>>>>6 ubyte 0 14703>>>>>>7 ubyte x \b, codec=%d RGB color palettes 14704>>>>>6 ubyte 64 \b, codec=RGB fixed color 14705>>>>>6 ubyte 128 \b, codec=YJK 14706>>>>>6 ubyte 192 \b, codec=YUV 14707>>>>5 ubyte >8 codec=RGB fixed color 14708>>>>12 ubyte 0 \b, raw 14709>>>>12 ubyte 1 \b, bitbuster compression 14710 14711############## Other MSX file formats ############## 14712 14713# MSX ROMs 147140 string AB 14715>2 uleshort 0x0010 MSX ROM 14716>>2 uleshort x \b, init=0x%4x 14717>>4 uleshort >0 \b, stat=0x%4x 14718>>6 uleshort >0 \b, dev=0x%4x 14719>>8 uleshort >0 \b, bas=0x%4x 14720>2 uleshort 0x4010 MSX ROM 14721>>2 uleshort x \b, init=0x%04x 14722>>4 uleshort >0 \b, stat=0x%04x 14723>>6 uleshort >0 \b, dev=0x%04x 14724>>8 uleshort >0 \b, bas=0x%04x 14725>2 uleshort 0x8010 MSX ROM 14726>>2 uleshort x \b, init=0x%04x 14727>>4 uleshort >0 \b, stat=0x%04x 14728>>6 uleshort >0 \b, dev=0x%04x 14729>>8 uleshort >0 \b, bas=0x%04x 14730 147310 string AB 14732#>2 string 5JSuperLAYDOCK MSX Super Laydock ROM 14733#>3 string @HYDLIDE3MSX MSX Hydlide-3 ROM 14734#>3 string @3\x80IA862 Golvellius MSX1 ROM 14735>2 uleshort >10 14736>>10 string \0\0\0\0\0\0 MSX ROM 14737>>>0x10 string YZ\0\0\0\0 Konami Game Master 2 MSX ROM 14738>>>0x10 string CD \b, Konami RC- 14739>>>>0x12 ubyte x \b%d 14740>>>>0x13 ubyte/16 x \b%d 14741>>>>0x13 ubyte&0xF x \b%d 14742>>>0x10 string EF \b, Konami RC- 14743>>>>0x12 ubyte x \b%d 14744>>>>0x13 ubyte/16 x \b%d 14745>>>>0x13 ubyte&0xF x \b%d 14746>>>2 uleshort x \b, init=0x%04x 14747>>>4 uleshort >0 \b, stat=0x%04x 14748>>>6 uleshort >0 \b, dev=0x%04x 14749>>>8 uleshort >0 \b, bas=0x%04x 14750>2 uleshort 0 14751>>4 uleshort 0 14752>>>6 uleshort 0 14753>>>>8 uleshort >0 MSX BASIC program in ROM, bas=0x%04x 14754 147550x4000 string AB 14756>0x4002 uleshort >0x4010 14757>>0x400A string \0\0\0\0\0\0 MSX MegaROM with nonstandard page order 14758>>0x4002 uleshort x \b, init=0x%04x 14759>>0x4004 uleshort >0 \b, stat=0x%04x 14760>>0x4006 uleshort >0 \b, dev=0x%04x 14761>>0x4008 uleshort >0 \b, bas=0x%04x 14762 147630x8000 string AB 14764>0x8002 uleshort >0x4010 14765>>0x800A string \0\0\0\0\0\0 MSX MegaROM with nonstandard page order 14766>>0x8002 uleshort x \b, init=0x%04x 14767>>0x8004 uleshort >0 \b, stat=0x%04x 14768>>0x8006 uleshort >0 \b, dev=0x%04x 14769>>0x8008 uleshort >0 \b, bas=0x%04x 14770 14771 147720x3C000 string AB 14773>0x3C008 string \0\0\0\0\0\0\0\0 MSX MegaROM with nonstandard page order 14774>>0x3C002 uleshort x \b, init=0x%04x 14775>>0x3C004 uleshort >0 \b, stat=0x%04x 14776>>0x3C006 uleshort >0 \b, dev=0x%04x 14777>>0x3C008 uleshort >0 \b, bas=0x%04x 14778 14779# MSX BIN file 14780#0 byte 0xFE 14781#>1 uleshort >0x8000 14782#>>3 uleshort >0x8004 14783#>>>5 uleshort >0x8000 MSX BIN file 14784 14785# MSX-BASIC file 147860 byte 0xFF 14787>3 uleshort 0x000A 14788>>1 uleshort >0x8000 MSX-BASIC program 14789 14790# MSX .CAS file 147910 string \x1F\xA6\xDE\xBA\xCC\x13\x7D\x74 MSX cassette archive 14792 14793# Mega-Assembler file 147940 byte 0xFE 14795>1 uleshort 0x0001 14796>>5 uleshort 0xffff 14797>>>6 byte 0x0A MSX Mega-Assembler source 14798 14799# Execrom Patchfile 148000 string ExecROM\ patchfile\x1A MSX ExecROM patchfile 14801>0x12 ubyte/16 x v%d 14802>0x12 ubyte&0xF x \b.%d 14803>0x13 ubyte x \b, contains %d patches 14804 14805# Konami's King's Valley-2 custom stage (ELG file) 148064 uleshort 0x0900 14807>0xF byte 1 14808>>0x14 byte 0 14809>>>0x1E string \ \ \ 14810>>>>0x23 byte 1 14811>>>>>0x25 byte 0 14812>>>>>>0x15 string >\x30 14813>>>>>>>0x15 string <\x5A Konami King's Valley-2 custom stage, title: "%-8.8s" 14814>>>>>>>>0x1D byte <32 \b, theme: %d 14815 14816# Metal Gear 1 savegame 14817#0x4F string \x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF 14818#>>0x60 string \xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF 14819#>>>0x7B string \0x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\x00 Metal Gear 1 savegame 14820 14821# ------------------------------------------------------------------------ 14822# $File: mup,v 1.4 2009/09/19 16:28:11 christos Exp $ 14823# mup: file(1) magic for Mup (Music Publisher) input file. 14824# 14825# From: Abel Cheung <abel (@) oaka.org> 14826# 14827# NOTE: This header is mainly proposed in the Arkkra mailing list, 14828# and is not a mandatory header because of old mup input file 14829# compatibility. Noteedit also use mup format, but is not forcing 14830# user to use any header as well. 14831# 148320 search/1 //!Mup Mup music publication program input text 14833>6 string -Arkkra (Arkkra) 14834>>13 string - 14835>>>16 string . 14836>>>>14 string x \b, need V%.4s 14837>>>15 string . 14838>>>>14 string x \b, need V%.3s 14839>6 string - 14840>>9 string . 14841>>>7 string x \b, need V%.4s 14842>>8 string . 14843>>>7 string x \b, need V%.3s 14844#------------------------------------------------------------------------------ 14845# $File: music,v 1.1 2011/11/25 03:28:17 christos Exp $ 14846# music: file (1) magic for music formats 14847 14848# BWW format used by Bagpipe Music Writer Gold by Robert MacNeil Musicworks 14849# and Bagpipe Writer by Doug Wickstrom 14850# 148510 string Bagpipe Bagpipe 14852>8 string Reader Reader 14853>>15 string >\0 (version %.3s) 14854>8 string Music\ Writer Music Writer 14855>>20 string : 14856>>>21 string >\0 (version %.3s) 14857>>21 string Gold Gold 14858>>>25 string : 14859>>>>26 string >\0 (version %.3s) 14860 14861 14862#----------------------------------------------------------------------------- 14863# $File: natinst,v 1.5 2013/02/06 14:18:52 christos Exp $ 14864# natinst: file(1) magic for National Instruments Code Files 14865 14866# 14867# From <egamez@fcfm.buap.mx> Enrique Gamez-Flores 14868# version 1 14869# Many formats still missing, we use, for the moment LabVIEW 14870# We guess VXI format file. VISA, LabWindowsCVI, BridgeVIEW, etc, are missing 14871# 148720 string RSRC National Instruments, 14873# Check if it's a LabVIEW File 14874>8 string LV LabVIEW File, 14875# Check wich kind of file is 14876>>10 string SB Code Resource File, data 14877>>10 string IN Virtual Instrument Program, data 14878>>10 string AR VI Library, data 14879# This is for Menu Libraries 14880>8 string LMNULBVW Portable File Names, data 14881# This is for General Resources 14882>8 string rsc Resources File, data 14883# This is for VXI Package 148840 string VMAP National Instruments, VXI File, data 14885 14886#------------------------------------------------------------------------------ 14887# $File: ncr,v 1.7 2009/09/19 16:28:11 christos Exp $ 14888# ncr: file(1) magic for NCR Tower objects 14889# 14890# contributed by 14891# Michael R. Wayne *** TMC & Associates *** INTERNET: wayne@ford-vax.arpa 14892# uucp: {philabs | pyramid} !fmsrl7!wayne OR wayne@fmsrl7.UUCP 14893# 148940 beshort 000610 Tower/XP rel 2 object 14895>12 belong >0 not stripped 14896>20 beshort 0407 executable 14897>20 beshort 0410 pure executable 14898>22 beshort >0 - version %ld 148990 beshort 000615 Tower/XP rel 2 object 14900>12 belong >0 not stripped 14901>20 beshort 0407 executable 14902>20 beshort 0410 pure executable 14903>22 beshort >0 - version %ld 149040 beshort 000620 Tower/XP rel 3 object 14905>12 belong >0 not stripped 14906>20 beshort 0407 executable 14907>20 beshort 0410 pure executable 14908>22 beshort >0 - version %ld 149090 beshort 000625 Tower/XP rel 3 object 14910>12 belong >0 not stripped 14911>20 beshort 0407 executable 14912>20 beshort 0410 pure executable 14913>22 beshort >0 - version %ld 149140 beshort 000630 Tower32/600/400 68020 object 14915>12 belong >0 not stripped 14916>20 beshort 0407 executable 14917>20 beshort 0410 pure executable 14918>22 beshort >0 - version %ld 149190 beshort 000640 Tower32/800 68020 14920>18 beshort &020000 w/68881 object 14921>18 beshort &040000 compatible object 14922>18 beshort &060000 object 14923>20 beshort 0407 executable 14924>20 beshort 0413 pure executable 14925>12 belong >0 not stripped 14926>22 beshort >0 - version %ld 149270 beshort 000645 Tower32/800 68010 14928>18 beshort &040000 compatible object 14929>18 beshort &060000 object 14930>20 beshort 0407 executable 14931>20 beshort 0413 pure executable 14932>12 belong >0 not stripped 14933>22 beshort >0 - version %ld 14934 14935#------------------------------------------------------------------------------ 14936# $File: netbsd,v 1.20 2013/01/09 22:37:24 christos Exp $ 14937# netbsd: file(1) magic for NetBSD objects 14938# 14939# All new-style magic numbers are in network byte order. 14940# The old-style magic numbers are indistinguishable from the same magic 14941# numbers used in other systems, and are handled, for all those systems, 14942# in aout. 14943# 14944 149450 belong&0377777777 041400413 a.out NetBSD/i386 demand paged 14946>0 byte &0x80 14947>>20 lelong <4096 shared library 14948>>20 lelong =4096 dynamically linked executable 14949>>20 lelong >4096 dynamically linked executable 14950>0 byte ^0x80 executable 14951>16 lelong >0 not stripped 149520 belong&0377777777 041400410 a.out NetBSD/i386 pure 14953>0 byte &0x80 dynamically linked executable 14954>0 byte ^0x80 executable 14955>16 lelong >0 not stripped 149560 belong&0377777777 041400407 a.out NetBSD/i386 14957>0 byte &0x80 dynamically linked executable 14958>0 byte ^0x80 14959>>0 byte &0x40 position independent 14960>>20 lelong !0 executable 14961>>20 lelong =0 object file 14962>16 lelong >0 not stripped 149630 belong&0377777777 041400507 a.out NetBSD/i386 core 14964>12 string >\0 from '%s' 14965>32 lelong !0 (signal %d) 14966 149670 belong&0377777777 041600413 a.out NetBSD/m68k demand paged 14968>0 byte &0x80 14969>>20 belong <8192 shared library 14970>>20 belong =8192 dynamically linked executable 14971>>20 belong >8192 dynamically linked executable 14972>0 byte ^0x80 executable 14973>16 belong >0 not stripped 149740 belong&0377777777 041600410 a.out NetBSD/m68k pure 14975>0 byte &0x80 dynamically linked executable 14976>0 byte ^0x80 executable 14977>16 belong >0 not stripped 149780 belong&0377777777 041600407 a.out NetBSD/m68k 14979>0 byte &0x80 dynamically linked executable 14980>0 byte ^0x80 14981>>0 byte &0x40 position independent 14982>>20 belong !0 executable 14983>>20 belong =0 object file 14984>16 belong >0 not stripped 149850 belong&0377777777 041600507 a.out NetBSD/m68k core 14986>12 string >\0 from '%s' 14987>32 belong !0 (signal %d) 14988 149890 belong&0377777777 042000413 a.out NetBSD/m68k4k demand paged 14990>0 byte &0x80 14991>>20 belong <4096 shared library 14992>>20 belong =4096 dynamically linked executable 14993>>20 belong >4096 dynamically linked executable 14994>0 byte ^0x80 executable 14995>16 belong >0 not stripped 149960 belong&0377777777 042000410 a.out NetBSD/m68k4k pure 14997>0 byte &0x80 dynamically linked executable 14998>0 byte ^0x80 executable 14999>16 belong >0 not stripped 150000 belong&0377777777 042000407 a.out NetBSD/m68k4k 15001>0 byte &0x80 dynamically linked executable 15002>0 byte ^0x80 15003>>0 byte &0x40 position independent 15004>>20 belong !0 executable 15005>>20 belong =0 object file 15006>16 belong >0 not stripped 150070 belong&0377777777 042000507 a.out NetBSD/m68k4k core 15008>12 string >\0 from '%s' 15009>32 belong !0 (signal %d) 15010 150110 belong&0377777777 042200413 a.out NetBSD/ns32532 demand paged 15012>0 byte &0x80 15013>>20 lelong <4096 shared library 15014>>20 lelong =4096 dynamically linked executable 15015>>20 lelong >4096 dynamically linked executable 15016>0 byte ^0x80 executable 15017>16 lelong >0 not stripped 150180 belong&0377777777 042200410 a.out NetBSD/ns32532 pure 15019>0 byte &0x80 dynamically linked executable 15020>0 byte ^0x80 executable 15021>16 lelong >0 not stripped 150220 belong&0377777777 042200407 a.out NetBSD/ns32532 15023>0 byte &0x80 dynamically linked executable 15024>0 byte ^0x80 15025>>0 byte &0x40 position independent 15026>>20 lelong !0 executable 15027>>20 lelong =0 object file 15028>16 lelong >0 not stripped 150290 belong&0377777777 042200507 a.out NetBSD/ns32532 core 15030>12 string >\0 from '%s' 15031>32 lelong !0 (signal %d) 15032 150330 belong&0377777777 045200507 a.out NetBSD/powerpc core 15034>12 string >\0 from '%s' 15035 150360 belong&0377777777 042400413 a.out NetBSD/sparc demand paged 15037>0 byte &0x80 15038>>20 belong <8192 shared library 15039>>20 belong =8192 dynamically linked executable 15040>>20 belong >8192 dynamically linked executable 15041>0 byte ^0x80 executable 15042>16 belong >0 not stripped 150430 belong&0377777777 042400410 a.out NetBSD/sparc pure 15044>0 byte &0x80 dynamically linked executable 15045>0 byte ^0x80 executable 15046>16 belong >0 not stripped 150470 belong&0377777777 042400407 a.out NetBSD/sparc 15048>0 byte &0x80 dynamically linked executable 15049>0 byte ^0x80 15050>>0 byte &0x40 position independent 15051>>20 belong !0 executable 15052>>20 belong =0 object file 15053>16 belong >0 not stripped 150540 belong&0377777777 042400507 a.out NetBSD/sparc core 15055>12 string >\0 from '%s' 15056>32 belong !0 (signal %d) 15057 150580 belong&0377777777 042600413 a.out NetBSD/pmax demand paged 15059>0 byte &0x80 15060>>20 lelong <4096 shared library 15061>>20 lelong =4096 dynamically linked executable 15062>>20 lelong >4096 dynamically linked executable 15063>0 byte ^0x80 executable 15064>16 lelong >0 not stripped 150650 belong&0377777777 042600410 a.out NetBSD/pmax pure 15066>0 byte &0x80 dynamically linked executable 15067>0 byte ^0x80 executable 15068>16 lelong >0 not stripped 150690 belong&0377777777 042600407 a.out NetBSD/pmax 15070>0 byte &0x80 dynamically linked executable 15071>0 byte ^0x80 15072>>0 byte &0x40 position independent 15073>>20 lelong !0 executable 15074>>20 lelong =0 object file 15075>16 lelong >0 not stripped 150760 belong&0377777777 042600507 a.out NetBSD/pmax core 15077>12 string >\0 from '%s' 15078>32 lelong !0 (signal %d) 15079 150800 belong&0377777777 043000413 a.out NetBSD/vax 1k demand paged 15081>0 byte &0x80 15082>>20 lelong <4096 shared library 15083>>20 lelong =4096 dynamically linked executable 15084>>20 lelong >4096 dynamically linked executable 15085>0 byte ^0x80 executable 15086>16 lelong >0 not stripped 150870 belong&0377777777 043000410 a.out NetBSD/vax 1k pure 15088>0 byte &0x80 dynamically linked executable 15089>0 byte ^0x80 executable 15090>16 lelong >0 not stripped 150910 belong&0377777777 043000407 a.out NetBSD/vax 1k 15092>0 byte &0x80 dynamically linked executable 15093>0 byte ^0x80 15094>>0 byte &0x40 position independent 15095>>20 lelong !0 executable 15096>>20 lelong =0 object file 15097>16 lelong >0 not stripped 150980 belong&0377777777 043000507 a.out NetBSD/vax 1k core 15099>12 string >\0 from '%s' 15100>32 lelong !0 (signal %d) 15101 151020 belong&0377777777 045400413 a.out NetBSD/vax 4k demand paged 15103>0 byte &0x80 15104>>20 lelong <4096 shared library 15105>>20 lelong =4096 dynamically linked executable 15106>>20 lelong >4096 dynamically linked executable 15107>0 byte ^0x80 executable 15108>16 lelong >0 not stripped 151090 belong&0377777777 045400410 a.out NetBSD/vax 4k pure 15110>0 byte &0x80 dynamically linked executable 15111>0 byte ^0x80 executable 15112>16 lelong >0 not stripped 151130 belong&0377777777 045400407 a.out NetBSD/vax 4k 15114>0 byte &0x80 dynamically linked executable 15115>0 byte ^0x80 15116>>0 byte &0x40 position independent 15117>>20 lelong !0 executable 15118>>20 lelong =0 object file 15119>16 lelong >0 not stripped 151200 belong&0377777777 045400507 a.out NetBSD/vax 4k core 15121>12 string >\0 from '%s' 15122>32 lelong !0 (signal %d) 15123 15124# NetBSD/alpha does not support (and has never supported) a.out objects, 15125# so no rules are provided for them. NetBSD/alpha ELF objects are 15126# dealt with in "elf". 151270 lelong 0x00070185 ECOFF NetBSD/alpha binary 15128>10 leshort 0x0001 not stripped 15129>10 leshort 0x0000 stripped 151300 belong&0377777777 043200507 a.out NetBSD/alpha core 15131>12 string >\0 from '%s' 15132>32 lelong !0 (signal %d) 15133 151340 belong&0377777777 043400413 a.out NetBSD/mips demand paged 15135>0 byte &0x80 15136>>20 belong <8192 shared library 15137>>20 belong =8192 dynamically linked executable 15138>>20 belong >8192 dynamically linked executable 15139>0 byte ^0x80 executable 15140>16 belong >0 not stripped 151410 belong&0377777777 043400410 a.out NetBSD/mips pure 15142>0 byte &0x80 dynamically linked executable 15143>0 byte ^0x80 executable 15144>16 belong >0 not stripped 151450 belong&0377777777 043400407 a.out NetBSD/mips 15146>0 byte &0x80 dynamically linked executable 15147>0 byte ^0x80 15148>>0 byte &0x40 position independent 15149>>20 belong !0 executable 15150>>20 belong =0 object file 15151>16 belong >0 not stripped 151520 belong&0377777777 043400507 a.out NetBSD/mips core 15153>12 string >\0 from '%s' 15154>32 belong !0 (signal %d) 15155 151560 belong&0377777777 043600413 a.out NetBSD/arm32 demand paged 15157>0 byte &0x80 15158>>20 lelong <4096 shared library 15159>>20 lelong =4096 dynamically linked executable 15160>>20 lelong >4096 dynamically linked executable 15161>0 byte ^0x80 executable 15162>16 lelong >0 not stripped 151630 belong&0377777777 043600410 a.out NetBSD/arm32 pure 15164>0 byte &0x80 dynamically linked executable 15165>0 byte ^0x80 executable 15166>16 lelong >0 not stripped 151670 belong&0377777777 043600407 a.out NetBSD/arm32 15168>0 byte &0x80 dynamically linked executable 15169>0 byte ^0x80 15170>>0 byte &0x40 position independent 15171>>20 lelong !0 executable 15172>>20 lelong =0 object file 15173>16 lelong >0 not stripped 15174# NetBSD/arm26 has always used ELF objects, but it shares a core file 15175# format with NetBSD/arm32. 151760 belong&0377777777 043600507 a.out NetBSD/arm core 15177>12 string >\0 from '%s' 15178>32 lelong !0 (signal %d) 15179 15180# Kernel core dump format 151810 belong&0x0000ffff 0x00008fca NetBSD kernel core file 15182>0 belong&0x03ff0000 0x00000000 \b, Unknown 15183>0 belong&0x03ff0000 0x00001000 \b, sun 68010/68020 15184>0 belong&0x03ff0000 0x00020000 \b, sun 68020 15185>0 belong&0x03ff0000 0x00640000 \b, 386 PC 15186>0 belong&0x03ff0000 0x00860000 \b, i386 BSD 15187>0 belong&0x03ff0000 0x00870000 \b, m68k BSD (8K pages) 15188>0 belong&0x03ff0000 0x00880000 \b, m68k BSD (4K pages) 15189>0 belong&0x03ff0000 0x00890000 \b, ns32532 BSD 15190>0 belong&0x03ff0000 0x008a0000 \b, sparc/32 BSD 15191>0 belong&0x03ff0000 0x008b0000 \b, pmax BSD 15192>0 belong&0x03ff0000 0x008c0000 \b, vax BSD (1K pages) 15193>0 belong&0x03ff0000 0x008d0000 \b, alpha BSD 15194>0 belong&0x03ff0000 0x008e0000 \b, mips BSD (Big Endian) 15195>0 belong&0x03ff0000 0x008f0000 \b, arm6 BSD 15196>0 belong&0x03ff0000 0x00900000 \b, m68k BSD (2K pages) 15197>0 belong&0x03ff0000 0x00910000 \b, sh3 BSD 15198>0 belong&0x03ff0000 0x00920000 \b, ppc BSD (Big Endian) 15199>0 belong&0x03ff0000 0x00930000 \b, vax BSD (4K pages) 15200>0 belong&0x03ff0000 0x00940000 \b, mips1 BSD 15201>0 belong&0x03ff0000 0x00950000 \b, mips2 BSD 15202>0 belong&0x03ff0000 0x00960000 \b, parisc BSD 15203>0 belong&0x03ff0000 0x00970000 \b, sh5/64 BSD 15204>0 belong&0x03ff0000 0x00980000 \b, sparc/64 BSD 15205>0 belong&0x03ff0000 0x00990000 \b, amd64 BSD 15206>0 belong&0x03ff0000 0x009a0000 \b, hp200 (68010) BSD 15207>0 belong&0x03ff0000 0x009b0000 \b, hp300 (68020+68881) BSD 15208>0 belong&0x03ff0000 0x009b0000 \b, hp300 (68020+68881) BSD 15209>0 belong&0x03ff0000 0x00c80000 \b, hp200 15210>0 belong&0x03ff0000 0x020b0000 \b, hp300 (68020+68881) HP-UX 15211>0 belong&0x03ff0000 0x020c0000 \b, hp300 (68020+68881) HP-UX 15212>0 belong&0xfc000000 0x04000000 \b, CPU 15213>0 belong&0xfc000000 0x08000000 \b, DATA 15214>0 belong&0xfc000000 0x10000000 \b, STACK 15215>4 leshort x \b, (headersize = %d 15216>6 leshort x \b, segmentsize = %d 15217>6 lelong x \b, segments = %d) 15218 15219#------------------------------------------------------------------------------ 15220# $File: netscape,v 1.6 2009/09/19 16:28:11 christos Exp $ 15221# netscape: file(1) magic for Netscape files 15222# "H. Nanosecond" <aldomel@ix.netcom.com> 15223# version 3 and 4 I think 15224# 15225 15226# Netscape Address book .nab 152270 string \000\017\102\104\000\000\000\000\000\000\001\000\000\000\000\002\000\000\000\002\000\000\004\000 Netscape Address book 15228 15229# Netscape Communicator address book 152300 string \000\017\102\111 Netscape Communicator address book 15231 15232# .snm Caches 152330 string #\ Netscape\ folder\ cache Netscape folder cache 152340 string \000\036\204\220\000 Netscape folder cache 15235# .n2p 15236# Net 2 Phone 15237#0 string 123\130\071\066\061\071\071\071\060\070\061\060\061\063\060 152380 string SX961999 Net2phone 15239 15240# 15241#This is files ending in .art, FIXME add more rules 152420 string JG\004\016\0\0\0\0 ART 15243 15244#------------------------------------------------------------------------------ 15245# $File: netware,v 1.4 2009/09/19 16:28:11 christos Exp $ 15246# netware: file(1) magic for NetWare Loadable Modules (NLMs) 15247# From: Mads Martin Joergensen <mmj@suse.de> 15248 152490 string NetWare\ Loadable\ Module NetWare Loadable Module 15250 15251#------------------------------------------------------------------------------ 15252# $File: news,v 1.6 2009/09/19 16:28:11 christos Exp $ 15253# news: file(1) magic for SunOS NeWS fonts (not "news" as in "netnews") 15254# 152550 string StartFontMetrics ASCII font metrics 152560 string StartFont ASCII font bits 152570 belong 0x137A2944 NeWS bitmap font 152580 belong 0x137A2947 NeWS font family 152590 belong 0x137A2950 scalable OpenFont binary 152600 belong 0x137A2951 encrypted scalable OpenFont binary 152618 belong 0x137A2B45 X11/NeWS bitmap font 152628 belong 0x137A2B48 X11/NeWS font family 15263 15264#------------------------------------------------------------------------------ 15265# $File: nitpicker,v 1.4 2009/09/19 16:28:11 christos Exp $ 15266# nitpicker: file(1) magic for Flowfiles. 15267# From: Christian Jachmann <C.Jachmann@gmx.net> http://www.nitpicker.de 152680 string NPFF NItpicker Flow File 15269>4 byte x V%d. 15270>5 byte x %d 15271>6 bedate x started: %s 15272>10 bedate x stopped: %s 15273>14 belong x Bytes: %u 15274>18 belong x Bytes1: %u 15275>22 belong x Flows: %u 15276>26 belong x Pkts: %u 15277 15278#------------------------------------------------------------------------------ 15279# $File: oasis,v 1.1 2011/03/15 02:09:38 christos Exp $ 15280# OASIS 15281# Summary: OASIS stream file 15282# Long description: Open Artwork System Interchange Standard 15283# File extension: .oas 15284# Full name: Ben Cowley (bcowley@broadcom.com) 15285# Philip Dixon (pdixon@broadcom.com) 15286# Reference: http://www.wrcad.com/oasis/oasis-3626-042303-draft.pdf 15287# (see page 3) 152880 string %SEMI-OASIS\r\n OASIS Stream file 15289 15290#------------------------------------------------------------------------------ 15291# $File: ocaml,v 1.5 2010/09/20 18:55:20 rrt Exp $ 15292# ocaml: file(1) magic for Objective Caml files. 152930 string Caml1999 OCaml 15294>8 string X exec file 15295>8 string I interface file (.cmi) 15296>8 string O object file (.cmo) 15297>8 string A library file (.cma) 15298>8 string Y native object file (.cmx) 15299>8 string Z native library file (.cmxa) 15300>8 string M abstract syntax tree implementation file 15301>8 string N abstract syntax tree interface file 15302>9 string >\0 (Version %3.3s) 15303 15304#------------------------------------------------------------------------------ 15305# $File: octave,v 1.4 2009/09/19 16:28:11 christos Exp $ 15306# octave binary data file(1) magic, from Dirk Eddelbuettel <edd@debian.org> 153070 string Octave-1-L Octave binary data (little endian) 153080 string Octave-1-B Octave binary data (big endian) 15309 15310#------------------------------------------------------------------------------ 15311# $File: ole2compounddocs,v 1.4 2009/09/19 16:28:11 christos Exp $ 15312# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured 15313# storage (http://en.wikipedia.org/wiki/Structured_Storage) 15314# Additional tests for OLE 2 Compound Documents should be under this recipe. 15315 153160 string \320\317\021\340\241\261\032\341 OLE 2 Compound Document 15317# - Microstation V8 DGN files (www.bentley.com) 15318# Last update on 10/23/2006 by Lester Hightower 15319> 0x480 string D\000g\000n\000~\000H : Microstation V8 DGN 15320# - Visio documents 15321# Last update on 10/23/2006 by Lester Hightower 15322> 0x480 string V\000i\000s\000i\000o\000D\000o\000c : Visio Document 15323 15324#------------------------------------------------------------------------------ 15325# $File: olf,v 1.4 2009/09/19 16:28:11 christos Exp $ 15326# olf: file(1) magic for OLF executables 15327# 15328# We have to check the byte order flag to see what byte order all the 15329# other stuff in the header is in. 15330# 15331# MIPS R3000 may also be for MIPS R2000. 15332# What're the correct byte orders for the nCUBE and the Fujitsu VPP500? 15333# 15334# Created by Erik Theisen <etheisen@openbsd.org> 15335# Based on elf from Daniel Quinlan <quinlan@yggdrasil.com> 153360 string \177OLF OLF 15337>4 byte 0 invalid class 15338>4 byte 1 32-bit 15339>4 byte 2 64-bit 15340>7 byte 0 invalid os 15341>7 byte 1 OpenBSD 15342>7 byte 2 NetBSD 15343>7 byte 3 FreeBSD 15344>7 byte 4 4.4BSD 15345>7 byte 5 Linux 15346>7 byte 6 SVR4 15347>7 byte 7 esix 15348>7 byte 8 Solaris 15349>7 byte 9 Irix 15350>7 byte 10 SCO 15351>7 byte 11 Dell 15352>7 byte 12 NCR 15353>5 byte 0 invalid byte order 15354>5 byte 1 LSB 15355>>16 leshort 0 no file type, 15356>>16 leshort 1 relocatable, 15357>>16 leshort 2 executable, 15358>>16 leshort 3 shared object, 15359# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de> 15360# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> 15361>>16 leshort 4 core file 15362>>>(0x38+0xcc) string >\0 of '%s' 15363>>>(0x38+0x10) lelong >0 (signal %d), 15364>>16 leshort &0xff00 processor-specific, 15365>>18 leshort 0 no machine, 15366>>18 leshort 1 AT&T WE32100 - invalid byte order, 15367>>18 leshort 2 SPARC - invalid byte order, 15368>>18 leshort 3 Intel 80386, 15369>>18 leshort 4 Motorola 68000 - invalid byte order, 15370>>18 leshort 5 Motorola 88000 - invalid byte order, 15371>>18 leshort 6 Intel 80486, 15372>>18 leshort 7 Intel 80860, 15373>>18 leshort 8 MIPS R3000_BE - invalid byte order, 15374>>18 leshort 9 Amdahl - invalid byte order, 15375>>18 leshort 10 MIPS R3000_LE, 15376>>18 leshort 11 RS6000 - invalid byte order, 15377>>18 leshort 15 PA-RISC - invalid byte order, 15378>>18 leshort 16 nCUBE, 15379>>18 leshort 17 VPP500, 15380>>18 leshort 18 SPARC32PLUS, 15381>>18 leshort 20 PowerPC, 15382>>18 leshort 0x9026 Alpha, 15383>>20 lelong 0 invalid version 15384>>20 lelong 1 version 1 15385>>36 lelong 1 MathCoPro/FPU/MAU Required 15386>8 string >\0 (%s) 15387>5 byte 2 MSB 15388>>16 beshort 0 no file type, 15389>>16 beshort 1 relocatable, 15390>>16 beshort 2 executable, 15391>>16 beshort 3 shared object, 15392>>16 beshort 4 core file, 15393>>>(0x38+0xcc) string >\0 of '%s' 15394>>>(0x38+0x10) belong >0 (signal %d), 15395>>16 beshort &0xff00 processor-specific, 15396>>18 beshort 0 no machine, 15397>>18 beshort 1 AT&T WE32100, 15398>>18 beshort 2 SPARC, 15399>>18 beshort 3 Intel 80386 - invalid byte order, 15400>>18 beshort 4 Motorola 68000, 15401>>18 beshort 5 Motorola 88000, 15402>>18 beshort 6 Intel 80486 - invalid byte order, 15403>>18 beshort 7 Intel 80860, 15404>>18 beshort 8 MIPS R3000_BE, 15405>>18 beshort 9 Amdahl, 15406>>18 beshort 10 MIPS R3000_LE - invalid byte order, 15407>>18 beshort 11 RS6000, 15408>>18 beshort 15 PA-RISC, 15409>>18 beshort 16 nCUBE, 15410>>18 beshort 17 VPP500, 15411>>18 beshort 18 SPARC32PLUS, 15412>>18 beshort 20 PowerPC or cisco 4500, 15413>>18 beshort 21 cisco 7500, 15414>>18 beshort 24 cisco SVIP, 15415>>18 beshort 25 cisco 7200, 15416>>18 beshort 36 cisco 12000, 15417>>18 beshort 0x9026 Alpha, 15418>>20 belong 0 invalid version 15419>>20 belong 1 version 1 15420>>36 belong 1 MathCoPro/FPU/MAU Required 15421 15422#------------------------------------------------------------------------------ 15423# $File: os2,v 1.7 2009/09/19 16:28:11 christos Exp $ 15424# os2: file(1) magic for OS/2 files 15425# 15426 15427# Provided 1998/08/22 by 15428# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net> 154291 search/1 InternetShortcut MS Windows 95 Internet shortcut text 15430>24 search/1 >\ (URL=<%s>) 15431 15432# OS/2 URL objects 15433# Provided 1998/08/22 by 15434# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net> 15435#0 string http: OS/2 URL object text 15436#>5 string >\ (WWW) <http:%s> 15437#0 string mailto: OS/2 URL object text 15438#>7 string >\ (email) <%s> 15439#0 string news: OS/2 URL object text 15440#>5 string >\ (Usenet) <%s> 15441#0 string ftp: OS/2 URL object text 15442#>4 string >\ (FTP) <ftp:%s> 15443#0 string file: OS/2 URL object text 15444#>5 string >\ (Local file) <%s> 15445 15446# >>>>> OS/2 INF/HLP <<<<< (source: Daniel Dissett ddissett@netcom.com) 15447# Carl Hauser (chauser.parc@xerox.com) and 15448# Marcus Groeber (marcusg@ph-cip.uni-koeln.de) 15449# list the following header format in inf02a.doc: 15450# 15451# int16 ID; // ID magic word (5348h = "HS") 15452# int8 unknown1; // unknown purpose, could be third letter of ID 15453# int8 flags; // probably a flag word... 15454# // bit 0: set if INF style file 15455# // bit 4: set if HLP style file 15456# // patching this byte allows reading HLP files 15457# // using the VIEW command, while help files 15458# // seem to work with INF settings here as well. 15459# int16 hdrsize; // total size of header 15460# int16 unknown2; // unknown purpose 15461# 154620 string HSP\x01\x9b\x00 OS/2 INF 15463>107 string >0 (%s) 154640 string HSP\x10\x9b\x00 OS/2 HLP 15465>107 string >0 (%s) 15466 15467# OS/2 INI (this is a guess) 154680 string \xff\xff\xff\xff\x14\0\0\0 OS/2 INI 15469 15470#------------------------------------------------------------------------------ 15471# $File: os400,v 1.5 2009/09/19 16:28:11 christos Exp $ 15472# os400: file(1) magic for IBM OS/400 files 15473# 15474# IBM OS/400 (i5/OS) Save file (SAVF) - gerardo.cacciari@gmail.com 15475# In spite of its quite variable format (due to internal memory page 15476# length differences between CISC and RISC versions of the OS) the 15477# SAVF structure hasn't suitable offsets to identify the catalog 15478# header in the first descriptor where there are some useful infos, 15479# so we must search in a somewhat large area for a particular string 15480# that represents the EBCDIC encoding of 'QSRDSSPC' (save/restore 15481# descriptor space) preceded by a two byte constant. 15482# 154831090 search/7393 \x19\xDB\xD8\xE2\xD9\xC4\xE2\xE2\xD7\xC3 IBM OS/400 save file data 15484>&212 byte 0x01 \b, created with SAVOBJ 15485>&212 byte 0x02 \b, created with SAVLIB 15486>&212 byte 0x07 \b, created with SAVCFG 15487>&212 byte 0x08 \b, created with SAVSECDTA 15488>&212 byte 0x0A \b, created with SAVSECDTA 15489>&212 byte 0x0B \b, created with SAVDLO 15490>&212 byte 0x0D \b, created with SAVLICPGM 15491>&212 byte 0x11 \b, created with SAVCHGOBJ 15492>&213 byte 0x44 \b, at least V5R4 to open 15493>&213 byte 0x43 \b, at least V5R3 to open 15494>&213 byte 0x42 \b, at least V5R2 to open 15495>&213 byte 0x41 \b, at least V5R1 to open 15496>&213 byte 0x40 \b, at least V4R5 to open 15497>&213 byte 0x3F \b, at least V4R4 to open 15498>&213 byte 0x3E \b, at least V4R3 to open 15499>&213 byte 0x3C \b, at least V4R2 to open 15500>&213 byte 0x3D \b, at least V4R1M4 to open 15501>&213 byte 0x3B \b, at least V4R1 to open 15502>&213 byte 0x3A \b, at least V3R7 to open 15503>&213 byte 0x35 \b, at least V3R6 to open 15504>&213 byte 0x36 \b, at least V3R2 to open 15505>&213 byte 0x34 \b, at least V3R1 to open 15506>&213 byte 0x31 \b, at least V3R0M5 to open 15507>&213 byte 0x30 \b, at least V2R3 to open 15508 15509#------------------------------------------------------------------------------ 15510# $File: os9,v 1.7 2011/05/13 22:15:54 christos Exp $ 15511# 15512# Copyright (c) 1996 Ignatios Souvatzis. All rights reserved. 15513# 15514# Redistribution and use in source and binary forms, with or without 15515# modification, are permitted provided that the following conditions 15516# are met: 15517# 1. Redistributions of source code must retain the above copyright 15518# notice, this list of conditions and the following disclaimer. 15519# 2. Redistributions in binary form must reproduce the above copyright 15520# notice, this list of conditions and the following disclaimer in the 15521# documentation and/or other materials provided with the distribution. 15522# 15523# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 15524# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 15525# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 15526# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 15527# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, 15528# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; 15529# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, 15530# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR 15531# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF 15532# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 15533# 15534# 15535# 15536# OS9/6809 module descriptions: 15537# 155380 beshort 0x87CD OS9/6809 module: 15539# 15540>6 byte&0x0f 0x00 non-executable 15541>6 byte&0x0f 0x01 machine language 15542>6 byte&0x0f 0x02 BASIC I-code 15543>6 byte&0x0f 0x03 Pascal P-code 15544>6 byte&0x0f 0x04 C I-code 15545>6 byte&0x0f 0x05 COBOL I-code 15546>6 byte&0x0f 0x06 Fortran I-code 15547# 15548>6 byte&0xf0 0x10 program executable 15549>6 byte&0xf0 0x20 subroutine 15550>6 byte&0xf0 0x30 multi-module 15551>6 byte&0xf0 0x40 data module 15552# 15553>6 byte&0xf0 0xC0 system module 15554>6 byte&0xf0 0xD0 file manager 15555>6 byte&0xf0 0xE0 device driver 15556>6 byte&0xf0 0xF0 device descriptor 15557# 15558# OS9/m68k stuff (to be continued) 15559# 155600 beshort 0x4AFC OS9/68K module: 15561# 15562# attr 15563>0x14 byte&0x80 0x80 re-entrant 15564>0x14 byte&0x40 0x40 ghost 15565>0x14 byte&0x20 0x20 system-state 15566# 15567# lang: 15568# 15569>0x13 byte 1 machine language 15570>0x13 byte 2 BASIC I-code 15571>0x13 byte 3 Pascal P-code 15572>0x13 byte 4 C I-code 15573>0x13 byte 5 COBOL I-code 15574>0x13 byte 6 Fortran I-code 15575# 15576# 15577# type: 15578# 15579>0x12 byte 1 program executable 15580>0x12 byte 2 subroutine 15581>0x12 byte 3 multi-module 15582>0x12 byte 4 data module 15583>0x12 byte 11 trap library 15584>0x12 byte 12 system module 15585>0x12 byte 13 file manager 15586>0x12 byte 14 device driver 15587>0x12 byte 15 device descriptor 15588 15589#------------------------------------------------------------------------------ 15590# $File: osf1,v 1.7 2009/09/19 16:28:11 christos Exp $ 15591# 15592# Mach magic number info 15593# 155940 long 0xefbe OSF/Rose object 15595# I386 magic number info 15596# 155970 short 0565 i386 COFF object 15598 15599#------------------------------------------------------------------------------ 15600# $File: palm,v 1.11 2013/12/31 19:18:02 christos Exp $ 15601# palm: file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks 15602# 15603# Brian Lalor <blalor@hcirisc.cs.binghamton.edu> 15604 15605# These are weak, byte 59 is not guaranteed to be 0 and there are 15606# 8 character identifiers at byte 60, one I found for appl is BIGb. 15607# What are the possibilities and where is this documented? 15608 15609# The common header format for PalmOS .pdb/.prc files is 15610# { 15611# char name[ 32 ]; 15612# Word attributes; 15613# Word version; 15614# DWord creationDate; 15615# DWord modificationDate; 15616# DWord lastBackupDate; 15617# DWord modificationNumber; 15618# DWord appInfoID; 15619# DWord sortInfoID; 15620# char type[4]; 15621# char creator[4]; 15622# DWord uniqueIDSeed; 15623# RecordListType recordList; 15624# }; 15625# 15626# Datestamps are unsigned seconds since the MacOS epoch (Jan 1, 1904), 15627# or Unix/POSIX time + 2082844800. 15628 156290 name aportisdoc 15630# date is supposed to be big-endian seconds since 1 Jan 1904, but many 15631# files contain the timestamp in little-endian or a completely 15632# nonsensical value... 15633#>36 bedate-2082844800 >0 \b, created %s 15634# compression: 1=uncomp, 2=orig, 0x4448=HuffDic 15635>(78.L) beshort =1 \b, uncompressed 15636# compressed 15637>(78.L) beshort >1 15638>>(78.L+4) belong x \b, %d bytes uncompressed 15639 15640# appl 15641#60 string appl PalmOS application 15642#>0 string >\0 "%s" 15643 15644# HACK 15645#60 string HACK HackMaster hack 15646#>0 string >\0 "%s" 15647 15648# iSiloX e-book 1564960 string SDocSilX iSiloX E-book 15650>0 string >\0 "%s" 15651 15652# Mobipocket (www.mobipocket.com), donated by Carl Witty 15653# expanded by Ralf Brown 1565460 string BOOKMOBI Mobipocket E-book 15655# MobiPocket stores a full title, pointed at by the belong at offset 15656# 0x54 in its header at (78.L), with length given by the belong at 15657# offset 0x58. 15658# there's no guarantee that the title string is null-terminated, but 15659# we currently can't specify a variable-length string where the length 15660# field is not at the start of the string; in practice, the data 15661# following the string always seems to start with a zero byte 15662>(78.L) belong x 15663>>&(&0x50.L-4) string >\0 "%s" 15664>0 use aportisdoc 15665>>(78.L+0x68) belong >0 \b, version %d 15666>>(78.L+0x1C) belong !0 \b, codepage %d 15667>>(78.L+0x0C) beshort >0 \b, encrypted (type %d) 15668 15669# AportisDoc/PalmDOC 1567060 string TEXtREAd AportisDoc/PalmDOC E-book 15671>0 string >\0 "%s" 15672>0 use aportisdoc 15673 15674# Variety of PalmOS document types 15675# Michael-John Turner <mj@debian.org> 15676# Thanks to Hasan Umit Ezerce <humit@tr-net.net.tr> for his DocType 1567760 string BVokBDIC BDicty PalmOS document 15678>0 string >\0 "%s" 1567960 string DB99DBOS DB PalmOS document 15680>0 string >\0 "%s" 1568160 string vIMGView FireViewer/ImageViewer PalmOS document 15682>0 string >\0 "%s" 1568360 string PmDBPmDB HanDBase PalmOS document 15684>0 string >\0 "%s" 1568560 string InfoINDB InfoView PalmOS document 15686>0 string >\0 "%s" 1568760 string ToGoToGo iSilo PalmOS document 15688>0 string >\0 "%s" 1568960 string JfDbJBas JFile PalmOS document 15690>0 string >\0 "%s" 1569160 string JfDbJFil JFile Pro PalmOS document 15692>0 string >\0 "%s" 1569360 string DATALSdb List PalmOS document 15694>0 string >\0 "%s" 1569560 string Mdb1Mdb1 MobileDB PalmOS document 15696>0 string >\0 "%s" 1569760 string PNRdPPrs PeanutPress PalmOS document 15698>0 string >\0 "%s" 1569960 string DataPlkr Plucker PalmOS document 15700>0 string >\0 "%s" 1570160 string DataSprd QuickSheet PalmOS document 15702>0 string >\0 "%s" 1570360 string SM01SMem SuperMemo PalmOS document 15704>0 string >\0 "%s" 1570560 string TEXtTlDc TealDoc PalmOS document 15706>0 string >\0 "%s" 1570760 string InfoTlIf TealInfo PalmOS document 15708>0 string >\0 "%s" 1570960 string DataTlMl TealMeal PalmOS document 15710>0 string >\0 "%s" 1571160 string DataTlPt TealPaint PalmOS document 15712>0 string >\0 "%s" 1571360 string dataTDBP ThinkDB PalmOS document 15714>0 string >\0 "%s" 1571560 string TdatTide Tides PalmOS document 15716>0 string >\0 "%s" 1571760 string ToRaTRPW TomeRaider PalmOS document 15718>0 string >\0 "%s" 15719 15720# A GutenPalm zTXT etext for use on Palm Pilots (http://gutenpalm.sf.net) 15721# For version 1.xx zTXTs, outputs version and numbers of bookmarks and 15722# annotations. 15723# For other versions, just outputs version. 15724# 1572560 string zTXT A GutenPalm zTXT e-book 15726>0 string >\0 "%s" 15727>(0x4E.L) byte 0 15728>>(0x4E.L+1) byte x (v0.%02d) 15729>(0x4E.L) byte 1 15730>>(0x4E.L+1) byte x (v1.%02d) 15731>>>(0x4E.L+10) beshort >0 15732>>>>(0x4E.L+10) beshort <2 - 1 bookmark 15733>>>>(0x4E.L+10) beshort >1 - %d bookmarks 15734>>>(0x4E.L+14) beshort >0 15735>>>>(0x4E.L+14) beshort <2 - 1 annotation 15736>>>>(0x4E.L+14) beshort >1 - %d annotations 15737>(0x4E.L) byte >1 (v%d. 15738>>(0x4E.L+1) byte x %02d) 15739 15740# Palm OS .prc file types 1574160 string libr Palm OS dynamic library data 15742>0 string >\0 "%s" 1574360 string ptch Palm OS operating system patch data 15744>0 string >\0 "%s" 15745 15746# Mobipocket (www.mobipocket.com), donated by Carl Witty 1574760 string BOOKMOBI Mobipocket E-book 15748>0 string >\0 "%s" 15749 15750#------------------------------------------------------------------------------ 15751# $File: parix,v 1.4 2009/09/19 16:28:11 christos Exp $ 15752# 15753# Parix COFF executables 15754# From: Ignatios Souvatzis <ignatios@cs.uni-bonn.de> 15755# 157560 beshort&0xfff 0xACE PARIX 15757>0 byte&0xf0 0x80 T800 15758>0 byte&0xf0 0x90 T9000 15759>19 byte&0x02 0x02 executable 15760>19 byte&0x02 0x00 object 15761>19 byte&0x0c 0x00 not stripped 15762#------------------------------------------------------------------------------ 15763# $File: parrot,v 1.1 2010/07/08 20:18:40 christos Exp $ 15764# parrot: file(1) magic for Parrot Virtual Machine 15765# URL: http://www.lua.org/ 15766# From: Lubomir Rintel <lkundrak@v3.sk> 15767 15768# Compiled Parrot byte code 157690 string \376PBC\r\n\032\n Parrot bytecode 15770>64 byte x %d. 15771>72 byte x \b%d, 15772>8 byte >0 %d byte words, 15773>16 byte 0 little-endian, 15774>16 byte 1 big-endian, 15775>32 byte 0 IEEE-754 8 byte double floats, 15776>32 byte 1 x86 12 byte long double floats, 15777>32 byte 2 IEEE-754 16 byte long double floats, 15778>32 byte 3 MIPS 16 byte long double floats, 15779>32 byte 4 AIX 16 byte long double floats, 15780>32 byte 5 4-byte floats, 15781>40 byte x Parrot %d. 15782>48 byte x \b%d. 15783>56 byte x \b%d 15784#------------------------------------------------------------------------------ 15785# $File: pascal,v 1.1 2011/12/08 12:12:46 rrt Exp $ 15786# pascal: file(1) magic for Pascal source 15787# 157880 search/8192 (input, Pascal source text 15789!:mime text/x-pascal 157900 regex \^program Pascal source text 15791!:mime text/x-pascal 157920 regex \^record Pascal source text 15793!:mime text/x-pascal 15794 15795#------------------------------------------------------------------------------ 15796# $File: pbf,v 1.1 2013/12/21 14:27:24 christos Exp $ 15797# file(1) magic(5) data for OpenStreetMap 15798 15799# OpenStreetMap Protocolbuffer Binary Format (.osm.pbf) 15800# http://wiki.openstreetmap.org/wiki/PBF_Format 15801# From: Markus Heidelberg <markus.heidelberg@web.de> 158020 belong 0x0000000D 15803>4 beshort 0x0A09 15804>>6 string OSMHeader OpenStreetMap Protocolbuffer Binary Format 15805 15806#------------------------------------------------------------------------------ 15807# $File: pbm,v 1.6 2009/09/19 16:28:11 christos Exp $ 15808# pbm: file(1) magic for Portable Bitmap files 15809# 15810# XXX - byte order? 15811# 158120 short 0x2a17 "compact bitmap" format (Poskanzer) 15813 15814#------------------------------------------------------------------------------ 15815# $File: pdf,v 1.7 2013/08/22 07:47:26 christos Exp $ 15816# pdf: file(1) magic for Portable Document Format 15817# 15818 158190 string %PDF- PDF document 15820!:mime application/pdf 15821>5 byte x \b, version %c 15822>7 byte x \b.%c 15823 15824# From: Nick Schmalenberger <nick@schmalenberger.us> 15825# Forms Data Format 158260 string %FDF- FDF document 15827!:mime application/vnd.fdf 15828>5 byte x \b, version %c 15829>7 byte x \b.%c 15830 15831#------------------------------------------------------------------------------ 15832# $File: pdp,v 1.9 2013/04/19 20:11:43 christos Exp $ 15833# pdp: file(1) magic for PDP-11 executable/object and APL workspace 15834# 158350 lelong 0101555 PDP-11 single precision APL workspace 158360 lelong 0101554 PDP-11 double precision APL workspace 15837# 15838# PDP-11 a.out 15839# 158400 leshort 0407 PDP-11 executable 15841>8 leshort >0 not stripped 15842>15 byte >0 - version %ld 15843 15844# updated by Joerg Jenderek at Mar 2013 15845# GRR: line below too general as it catches also Windows precompiled setup information *.PNF 158460 leshort 0401 15847# skip *.PNF with WinDirPathOffset 58h 15848>68 ulelong !0x00000058 PDP-11 UNIX/RT ldp 15849# skip *.PNF with high byte of InfVersionDatumCount zero 15850#>>15 byte !0 PDP-11 UNIX/RT ldp 158510 leshort 0405 PDP-11 old overlay 15852 158530 leshort 0410 PDP-11 pure executable 15854>8 leshort >0 not stripped 15855>15 byte >0 - version %ld 15856 158570 leshort 0411 PDP-11 separate I&D executable 15858>8 leshort >0 not stripped 15859>15 byte >0 - version %ld 15860 158610 leshort 0437 PDP-11 kernel overlay 15862 15863# These last three are derived from 2.11BSD file(1) 158640 leshort 0413 PDP-11 demand-paged pure executable 15865>8 leshort >0 not stripped 15866 158670 leshort 0430 PDP-11 overlaid pure executable 15868>8 leshort >0 not stripped 15869 158700 leshort 0431 PDP-11 overlaid separate executable 15871>8 leshort >0 not stripped 15872#------------------------------------------------------------------------------ 15873# $File: perl,v 1.21 2013/12/08 23:33:18 christos Exp $ 15874# perl: file(1) magic for Larry Wall's perl language. 15875# 15876# The `eval' lines recognizes an outrageously clever hack. 15877# Keith Waclena <keith@cerberus.uchicago.edu> 15878# Send additions to <perl5-porters@perl.org> 158790 search/1 eval\ "exec\ /bin/perl Perl script text 15880!:mime text/x-perl 158810 search/1 eval\ "exec\ /usr/bin/perl Perl script text 15882!:mime text/x-perl 158830 search/1 eval\ "exec\ /usr/local/bin/perl Perl script text 15884!:mime text/x-perl 158850 search/1 eval\ '(exit\ $?0)'\ &&\ eval\ 'exec Perl script text 15886!:mime text/x-perl 158870 search/1 #!/usr/bin/env\ perl Perl script text executable 15888!:mime text/x-perl 158890 search/1 #!\ /usr/bin/env\ perl Perl script text executable 15890!:mime text/x-perl 158910 search/1 #! 15892>0 regex \^#!.*/bin/perl$ Perl script text executable 15893!:mime text/x-perl 15894 15895# by Dmitry V. Levin and Alexey Tourbin 15896# check the first line 158970 search/1 package 15898>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; Perl5 module source text 15899!:strength + 10 15900# not 'p', check other lines 159010 search/1 !p 15902>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; 15903>>0 regex \^1\ *;|\^(use|sub|my)\ .*[(;{=] Perl5 module source text 15904!:strength + 10 15905 15906# Perl POD documents 15907# From: Tom Hukins <tom@eborcom.com> 159080 search/1/W \=pod\n Perl POD document text 159090 search/1/W \n\=pod\n Perl POD document text 159100 search/1/W \=head1\ Perl POD document text 159110 search/1/W \n\=head1\ Perl POD document text 159120 search/1/W \=head2\ Perl POD document text 159130 search/1/W \n\=head2\ Perl POD document text 159140 search/1/W \=encoding\ Perl POD document text 159150 search/1/W \n\=encoding\ Perl POD document text 15916 15917 15918# Perl Storable data files. 159190 string perl-store perl Storable (v0.6) data 15920>4 byte >0 (net-order %d) 15921>>4 byte &01 (network-ordered) 15922>>4 byte =3 (major 1) 15923>>4 byte =2 (major 1) 15924 159250 string pst0 perl Storable (v0.7) data 15926>4 byte >0 15927>>4 byte &01 (network-ordered) 15928>>4 byte =5 (major 2) 15929>>4 byte =4 (major 2) 15930>>5 byte >0 (minor %d) 15931 15932#------------------------------------------------------------------------------ 15933# $File: pgp,v 1.9 2009/09/19 16:28:11 christos Exp $ 15934# pgp: file(1) magic for Pretty Good Privacy 15935# see http://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html 15936# 159370 beshort 0x9900 PGP key public ring 15938!:mime application/x-pgp-keyring 159390 beshort 0x9501 PGP key security ring 15940!:mime application/x-pgp-keyring 159410 beshort 0x9500 PGP key security ring 15942!:mime application/x-pgp-keyring 159430 beshort 0xa600 PGP encrypted data 15944#!:mime application/pgp-encrypted 15945#0 string -----BEGIN\040PGP text/PGP armored data 15946!:mime text/PGP # encoding: armored data 15947#>15 string PUBLIC\040KEY\040BLOCK- public key block 15948#>15 string MESSAGE- message 15949#>15 string SIGNED\040MESSAGE- signed message 15950#>15 string PGP\040SIGNATURE- signature 15951 159522 string ---BEGIN\ PGP\ PUBLIC\ KEY\ BLOCK- PGP public key block 15953!:mime application/pgp-keys 159540 string -----BEGIN\040PGP\40MESSAGE- PGP message 15955!:mime application/pgp 159560 string -----BEGIN\040PGP\40SIGNATURE- PGP signature 15957!:mime application/pgp-signature 15958 15959#------------------------------------------------------------------------------ 15960# $File: pkgadd,v 1.6 2009/09/19 16:28:11 christos Exp $ 15961# pkgadd: file(1) magic for SysV R4 PKG Datastreams 15962# 159630 string #\ PaCkAgE\ DaTaStReAm pkg Datastream (SVR4) 15964!:mime application/x-svr4-package 15965 15966#------------------------------------------------------------------------------ 15967# $File: plan9,v 1.5 2009/09/19 16:28:11 christos Exp $ 15968# plan9: file(1) magic for AT&T Bell Labs' Plan 9 executables 15969# From: "Stefan A. Haubenthal" <polluks@web.de> 15970# 159710 belong 0x00000107 Plan 9 executable, Motorola 68k 159720 belong 0x000001EB Plan 9 executable, Intel 386 159730 belong 0x00000247 Plan 9 executable, Intel 960 159740 belong 0x000002AB Plan 9 executable, SPARC 159750 belong 0x00000407 Plan 9 executable, MIPS R3000 159760 belong 0x0000048B Plan 9 executable, AT&T DSP 3210 159770 belong 0x00000517 Plan 9 executable, MIPS R4000 BE 159780 belong 0x000005AB Plan 9 executable, AMD 29000 159790 belong 0x00000647 Plan 9 executable, ARM 7-something 159800 belong 0x000006EB Plan 9 executable, PowerPC 159810 belong 0x00000797 Plan 9 executable, MIPS R4000 LE 159820 belong 0x0000084B Plan 9 executable, DEC Alpha 15983 15984#------------------------------------------------------------------------------ 15985# $File: plus5,v 1.6 2009/09/19 16:28:11 christos Exp $ 15986# plus5: file(1) magic for Plus Five's UNIX MUMPS 15987# 15988# XXX - byte order? Paging Hokey.... 15989# 159900 short 0x259 mumps avl global 15991>2 byte >0 (V%d) 15992>6 byte >0 with %d byte name 15993>7 byte >0 and %d byte data cells 159940 short 0x25a mumps blt global 15995>2 byte >0 (V%d) 15996>8 short >0 - %d byte blocks 15997>15 byte 0x00 - P/D format 15998>15 byte 0x01 - P/K/D format 15999>15 byte 0x02 - K/D format 16000>15 byte >0x02 - Bad Flags 16001 16002#------------------------------------------------------------------------------ 16003# $File: printer,v 1.25 2011/05/20 23:31:46 christos Exp $ 16004# printer: file(1) magic for printer-formatted files 16005# 16006 16007# PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com) 160080 string %! PostScript document text 16009!:mime application/postscript 16010!:apple ASPSTEXT 16011>2 string PS-Adobe- conforming 16012>>11 string >\0 DSC level %.3s 16013>>>15 string EPS \b, type %s 16014>>>15 string Query \b, type %s 16015>>>15 string ExitServer \b, type %s 16016>>>15 search/1000 %%LanguageLevel:\ 16017>>>>&0 string >\0 \b, Level %s 16018# Some PCs have the annoying habit of adding a ^D as a document separator 160190 string \004%! PostScript document text 16020!:mime application/postscript 16021!:apple ASPSTEXT 16022>3 string PS-Adobe- conforming 16023>>12 string >\0 DSC level %.3s 16024>>>16 string EPS \b, type %s 16025>>>16 string Query \b, type %s 16026>>>16 string ExitServer \b, type %s 16027>>>16 search/1000 %%LanguageLevel:\ 16028>>>>&0 string >\0 \b, Level %s 160290 string \033%-12345X%!PS PostScript document 16030 16031# DOS EPS Binary File Header 16032# From: Ed Sznyter <ews@Black.Market.NET> 160330 belong 0xC5D0D3C6 DOS EPS Binary File 16034>4 long >0 Postscript starts at byte %d 16035>>8 long >0 length %d 16036>>>12 long >0 Metafile starts at byte %d 16037>>>>16 long >0 length %d 16038>>>20 long >0 TIFF starts at byte %d 16039>>>>24 long >0 length %d 16040 16041# Summary: Adobe's PostScript Printer Description File 16042# Extension: .ppd 16043# Reference: http://partners.adobe.com/public/developer/en/ps/5003.PPD_Spec_v4.3.pdf, Section 3.8 16044# Submitted by: Yves Arrouye <arrouye@marin.fdn.fr> 16045# 160460 string *PPD-Adobe:\x20 PPD file 16047>&0 string x \b, version %s 16048 16049# HP Printer Job Language 160500 string \033%-12345X@PJL HP Printer Job Language data 16051# HP Printer Job Language 16052# The header found on Win95 HP plot files is the "Silliest Thing possible" 16053# (TM) 16054# Every driver puts the language at some random position, with random case 16055# (LANGUAGE and Language) 16056# For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10 16057# From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de> 16058# 160590 string \033%-12345X@PJL HP Printer Job Language data 16060>&0 string >\0 %s 16061>>&0 string >\0 %s 16062>>>&0 string >\0 %s 16063>>>>&0 string >\0 %s 16064#>15 string \ ENTER\ LANGUAGE\ = 16065#>31 string PostScript PostScript 16066 16067# From: Stefan Thurner <thurners@nicsys.de> 160680 string \033%-12345X@PJL 16069>&0 search/10000 %! PJL encapsulated PostScript document text 16070 16071# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com) 160720 string \033E\033 HP PCL printer data 16073>3 string \&l0A - default page size 16074>3 string \&l1A - US executive page size 16075>3 string \&l2A - US letter page size 16076>3 string \&l3A - US legal page size 16077>3 string \&l26A - A4 page size 16078>3 string \&l80A - Monarch envelope size 16079>3 string \&l81A - No. 10 envelope size 16080>3 string \&l90A - Intl. DL envelope size 16081>3 string \&l91A - Intl. C5 envelope size 16082>3 string \&l100A - Intl. B5 envelope size 16083>3 string \&l-81A - No. 10 envelope size (landscape) 16084>3 string \&l-90A - Intl. DL envelope size (landscape) 16085 16086# IMAGEN printer-ready files: 160870 string @document( Imagen printer 16088# this only works if "language xxx" is first item in Imagen header. 16089>10 string language\ impress (imPRESS data) 16090>10 string language\ daisy (daisywheel text) 16091>10 string language\ diablo (daisywheel text) 16092>10 string language\ printer (line printer emulation) 16093>10 string language\ tektronix (Tektronix 4014 emulation) 16094# Add any other languages that your Imagen uses - remember 16095# to keep the word `text' if the file is human-readable. 16096# [GRR 950115: missing "postscript" or "ultrascript" (whatever it was called)] 16097# 16098# Now magic for IMAGEN font files... 160990 string Rast RST-format raster font data 16100>45 string >0 face %s 16101# From Jukka Ukkonen 161020 string \033[K\002\0\0\017\033(a\001\0\001\033(g Canon Bubble Jet BJC formatted data 16103 16104# From <mike@flyn.org> 16105# These are the /etc/magic entries to decode data sent to an Epson printer. 161060 string \x1B\x40\x1B\x28\x52\x08\x00\x00REMOTE1P Epson Stylus Color 460 data 16107 16108 16109#------------------------------------------------------------------------------ 16110# zenographics: file(1) magic for Zenographics ZjStream printer data 16111# Rick Richardson rickr@mn.rr.com 161120 string JZJZ 16113>0x12 string ZZ Zenographics ZjStream printer data (big-endian) 161140 string ZJZJ 16115>0x12 string ZZ Zenographics ZjStream printer data (little-endian) 16116 16117 16118#------------------------------------------------------------------------------ 16119# Oak Technologies printer stream 16120# Rick Richardson <rickr@mn.rr.com> 161210 string OAK 16122>0x07 byte 0 16123>0x0b byte 0 Oak Technologies printer stream 16124 16125# This would otherwise be recognized as PostScript - nick@debian.org 161260 string %!VMF SunClock's Vector Map Format data 16127 16128#------------------------------------------------------------------------------ 16129# HP LaserJet 1000 series downloadable firmware file 161300 string \xbe\xefABCDEFGH HP LaserJet 1000 series downloadable firmware 16131 16132# From: Paolo <oopla@users.sf.net> 16133# Epson ESC/Page, ESC/PageColor 161340 string \x1b\x01@EJL Epson ESC/Page language printer data 16135 16136#------------------------------------------------------------------------------ 16137# $File: project,v 1.4 2009/09/19 16:28:11 christos Exp $ 16138# project: file(1) magic for Project management 16139# 16140# Magic strings for ftnchek project files. Alexander Mai 161410 string FTNCHEK_\ P project file for ftnchek 16142>10 string 1 version 2.7 16143>10 string 2 version 2.8 to 2.10 16144>10 string 3 version 2.11 or later 16145 16146#------------------------------------------------------------------------------ 16147# $File: psdbms,v 1.6 2009/09/19 16:28:11 christos Exp $ 16148# psdbms: file(1) magic for psdatabase 16149# 161500 belong&0xff00ffff 0x56000000 ps database 16151>1 string >\0 version %s 16152>4 string >\0 from kernel %s 16153 16154#------------------------------------------------------------------------------ 16155# $File: pulsar,v 1.5 2009/09/19 16:28:12 christos Exp $ 16156# pulsar: file(1) magic for Pulsar POP3 daemon binary files 16157# 16158# http://pulsar.sourceforge.net 16159# mailto:rok.papez@lugos.si 16160# 16161 161620 belong 0x1ee7f11e Pulsar POP3 daemon mailbox cache file. 16163>4 ubelong x Version: %d. 16164>8 ubelong x \b%d 16165 16166 16167#------------------------------------------------------------------------------ 16168# $File: pwsafe,v 1.1 2012/10/25 00:12:19 christos Exp $ 16169# pwsafe: file(1) magic for passwordsafe file 16170# 16171# Password Safe 16172# http://passwordsafe.sourceforge.net/ 16173# file format specs 16174# http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV3.txt 16175# V2 http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV2.txt 16176# V1 http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/notes.txt 16177# V2 and V1 have no easy identifier that I can find 16178# .psafe3 161790 string PWS3 Password Safe V3 database 16180 16181#------------------------------------------------------------------------------ 16182# $File: pyramid,v 1.7 2009/09/19 16:28:12 christos Exp $ 16183# pyramid: file(1) magic for Pyramids 16184# 16185# XXX - byte order? 16186# 161870 long 0x50900107 Pyramid 90x family executable 161880 long 0x50900108 Pyramid 90x family pure executable 16189>16 long >0 not stripped 161900 long 0x5090010b Pyramid 90x family demand paged pure executable 16191>16 long >0 not stripped 16192 16193#------------------------------------------------------------------------------ 16194# $File: python,v 1.23 2013/12/11 14:14:20 christos Exp $ 16195# python: file(1) magic for python 16196# 16197# Outlook puts """ too for urgent messages 16198# From: David Necas <yeti@physics.muni.cz> 16199# often the module starts with a multiline string 162000 string/t """ Python script text executable 16201# MAGIC as specified in Python/import.c (1.5 to 2.7a0 and 3.1a0, assuming 16202# that Py_UnicodeFlag is off for Python 2) 16203# 20121 ( YEAR - 1995 ) + MONTH + DAY (little endian followed by "\r\n" 162040 belong 0x994e0d0a python 1.5/1.6 byte-compiled 162050 belong 0x87c60d0a python 2.0 byte-compiled 162060 belong 0x2aeb0d0a python 2.1 byte-compiled 162070 belong 0x2ded0d0a python 2.2 byte-compiled 162080 belong 0x3bf20d0a python 2.3 byte-compiled 162090 belong 0x6df20d0a python 2.4 byte-compiled 162100 belong 0xb3f20d0a python 2.5 byte-compiled 162110 belong 0xd1f20d0a python 2.6 byte-compiled 162120 belong 0x03f30d0a python 2.7 byte-compiled 162130 belong 0x3b0c0d0a python 3.0 byte-compiled 162140 belong 0x4f0c0d0a python 3.1 byte-compiled 162150 belong 0x6c0c0d0a python 3.2 byte-compiled 162160 belong 0x9e0c0d0a python 3.3 byte-compiled 16217 162180 search/1/w #!\ /usr/bin/python Python script text executable 16219!:mime text/x-python 162200 search/1/w #!\ /usr/local/bin/python Python script text executable 16221!:mime text/x-python 162220 search/1 #!/usr/bin/env\ python Python script text executable 16223!:mime text/x-python 162240 search/1 #!\ /usr/bin/env\ python Python script text executable 16225!:mime text/x-python 16226 16227 16228# from module.submodule import func1, func2 162290 regex \^from\\s+(\\w|\\.)+\\s+import.*$ Python script text executable 16230!:mime text/x-python 16231 16232# def __init__ (self, ...): 162330 search/4096 def\ __init__ 16234>&0 search/64 self Python script text executable 16235!:mime text/x-python 16236 16237# comments 162380 search/4096 ''' 16239>&0 regex .*'''$ Python script text executable 16240!:mime text/x-python 16241 162420 search/4096 """ 16243>&0 regex .*"""$ Python script text executable 16244!:mime text/x-python 16245 16246# try: 16247# except: or finally: 16248# block 162490 search/4096 try: 16250>&0 regex \^\\s*except.*: Python script text executable 16251!:mime text/x-python 16252>&0 search/4096 finally: Python script text executable 16253!:mime text/x-python 16254 16255# def name(args, args): 162560 regex \^(\ |\\t){0,50}def\ {1,50}[a-zA-Z]{1,100} 16257>&0 regex \ {0,50}\\(([a-zA-Z]|,|\ ){1,500}\\):$ Python script text executable 16258!:mime text/x-python 16259 16260#------------------------------------------------------------------------------ 16261# $File: revision,v 1.9 2013/02/06 14:18:52 christos Exp $ 16262# file(1) magic for revision control files 16263# From Hendrik Scholz <hendrik@scholz.net> 162640 string/t /1\ :pserver: cvs password text file 16265 16266# Conary changesets 16267# From: Jonathan Smith <smithj@rpath.com> 162680 belong 0xea3f81bb Conary changeset data 16269 16270# Type: Git bundles (git-bundle) 16271# From: Josh Triplett <josh@freedesktop.org> 162720 string #\ v2\ git\ bundle\n Git bundle 16273 16274# Type: Git pack 16275# From: Adam Buchbinder <adam.buchbinder@gmail.com> 16276# The actual magic is 'PACK', but that clashes with Doom/Quake packs. However, 16277# those have a little-endian offset immediately following the magic 'PACK', 16278# the first byte of which is never 0, while the first byte of the Git pack 16279# version, since it's a tiny number stored in big-endian format, is always 0. 162800 string PACK\0 Git pack 16281>4 belong >0 \b, version %d 16282>>8 belong >0 \b, %d objects 16283 16284# Type: Git pack index 16285# From: Adam Buchbinder <adam.buchbinder@gmail.com> 162860 string \377tOc Git pack index 16287>4 belong =2 \b, version 2 16288 16289# Type: Git index file 16290# From: Frederic Briare <fbriere@fbriere.net> 162910 string DIRC Git index 16292>4 belong >0 \b, version %d 16293>>8 belong >0 \b, %d entries 16294 16295# Type: Mercurial bundles 16296# From: Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr> 162970 string HG10 Mercurial bundle, 16298>4 string UN uncompressed 16299>4 string BZ bzip2 compressed 16300 16301# Type: Subversion (SVN) dumps 16302# From: Uwe Zeisberger <zeisberg@informatik.uni-freiburg.de> 163030 string SVN-fs-dump-format-version: Subversion dumpfile 16304>28 string >\0 (version: %s) 16305 16306# Type: Bazaar revision bundles and merge requests 16307# URL: http://www.bazaar-vcs.org/ 16308# From: Jelmer Vernooij <jelmer@samba.org> 163090 string #\ Bazaar\ revision\ bundle\ v Bazaar Bundle 163100 string #\ Bazaar\ merge\ directive\ format Bazaar merge directive 16311 16312#------------------------------------------------------------------------------ 16313# $File: riff,v 1.24 2013/11/19 23:58:17 christos Exp $ 16314# riff: file(1) magic for RIFF format 16315# See 16316# 16317# http://www.seanet.com/users/matts/riffmci/riffmci.htm 16318# 16319# AVI section extended by Patrik Radman <patrik+file-magic@iki.fi> 16320# 163210 string RIFF RIFF (little-endian) data 16322# RIFF Palette format 16323>8 string PAL \b, palette 16324>>16 leshort x \b, version %d 16325>>18 leshort x \b, %d entries 16326# RIFF Device Independent Bitmap format 16327>8 string RDIB \b, device-independent bitmap 16328>>16 string BM 16329>>>30 leshort 12 \b, OS/2 1.x format 16330>>>>34 leshort x \b, %d x 16331>>>>36 leshort x %d 16332>>>30 leshort 64 \b, OS/2 2.x format 16333>>>>34 leshort x \b, %d x 16334>>>>36 leshort x %d 16335>>>30 leshort 40 \b, Windows 3.x format 16336>>>>34 lelong x \b, %d x 16337>>>>38 lelong x %d x 16338>>>>44 leshort x %d 16339# RIFF MIDI format 16340>8 string RMID \b, MIDI 16341# RIFF Multimedia Movie File format 16342>8 string RMMP \b, multimedia movie 16343# RIFF wrapper for MP3 16344>8 string RMP3 \b, MPEG Layer 3 audio 16345# Microsoft WAVE format (*.wav) 16346>8 string WAVE \b, WAVE audio 16347!:mime audio/x-wav 16348>>20 leshort 1 \b, Microsoft PCM 16349>>>34 leshort >0 \b, %d bit 16350>>20 leshort 2 \b, Microsoft ADPCM 16351>>20 leshort 6 \b, ITU G.711 A-law 16352>>20 leshort 7 \b, ITU G.711 mu-law 16353>>20 leshort 8 \b, Microsoft DTS 16354>>20 leshort 17 \b, IMA ADPCM 16355>>20 leshort 20 \b, ITU G.723 ADPCM (Yamaha) 16356>>20 leshort 49 \b, GSM 6.10 16357>>20 leshort 64 \b, ITU G.721 ADPCM 16358>>20 leshort 80 \b, MPEG 16359>>20 leshort 85 \b, MPEG Layer 3 16360>>20 leshort 0x2001 \b, DTS 16361>>22 leshort =1 \b, mono 16362>>22 leshort =2 \b, stereo 16363>>22 leshort >2 \b, %d channels 16364>>24 lelong >0 %d Hz 16365# Corel Draw Picture 16366>8 string CDRA \b, Corel Draw Picture 16367!:mime image/x-coreldraw 16368>8 string CDR6 \b, Corel Draw Picture, version 6 16369!:mime image/x-coreldraw 16370# AVI == Audio Video Interleave 16371>8 string AVI\040 \b, AVI 16372!:mime video/x-msvideo 16373>>12 string LIST 16374>>>20 string hdrlavih 16375>>>>&36 lelong x \b, %lu x 16376>>>>&40 lelong x %lu, 16377>>>>&4 lelong >1000000 <1 fps, 16378>>>>&4 lelong 1000000 1.00 fps, 16379>>>>&4 lelong 500000 2.00 fps, 16380>>>>&4 lelong 333333 3.00 fps, 16381>>>>&4 lelong 250000 4.00 fps, 16382>>>>&4 lelong 200000 5.00 fps, 16383>>>>&4 lelong 166667 6.00 fps, 16384>>>>&4 lelong 142857 7.00 fps, 16385>>>>&4 lelong 125000 8.00 fps, 16386>>>>&4 lelong 111111 9.00 fps, 16387>>>>&4 lelong 100000 10.00 fps, 16388# ]9.9,10.1[ 16389>>>>&4 lelong <101010 16390>>>>>&-4 lelong >99010 16391>>>>>>&-4 lelong !100000 ~10 fps, 16392>>>>&4 lelong 83333 12.00 fps, 16393# ]11.9,12.1[ 16394>>>>&4 lelong <84034 16395>>>>>&-4 lelong >82645 16396>>>>>>&-4 lelong !83333 ~12 fps, 16397>>>>&4 lelong 66667 15.00 fps, 16398# ]14.9,15.1[ 16399>>>>&4 lelong <67114 16400>>>>>&-4 lelong >66225 16401>>>>>>&-4 lelong !66667 ~15 fps, 16402>>>>&4 lelong 50000 20.00 fps, 16403>>>>&4 lelong 41708 23.98 fps, 16404>>>>&4 lelong 41667 24.00 fps, 16405# ]23.9,24.1[ 16406>>>>&4 lelong <41841 16407>>>>>&-4 lelong >41494 16408>>>>>>&-4 lelong !41708 16409>>>>>>>&-4 lelong !41667 ~24 fps, 16410>>>>&4 lelong 40000 25.00 fps, 16411# ]24.9,25.1[ 16412>>>>&4 lelong <40161 16413>>>>>&-4 lelong >39841 16414>>>>>>&-4 lelong !40000 ~25 fps, 16415>>>>&4 lelong 33367 29.97 fps, 16416>>>>&4 lelong 33333 30.00 fps, 16417# ]29.9,30.1[ 16418>>>>&4 lelong <33445 16419>>>>>&-4 lelong >33223 16420>>>>>>&-4 lelong !33367 16421>>>>>>>&-4 lelong !33333 ~30 fps, 16422>>>>&4 lelong <32224 >30 fps, 16423##>>>>&4 lelong x (%lu) 16424##>>>>&20 lelong x %lu frames, 16425# Note: The tests below assume that the AVI has 1 or 2 streams, 16426# "vids" optionally followed by "auds". 16427# (Should cover 99.9% of all AVIs.) 16428# assuming avih length = 56 16429>>>88 string LIST 16430>>>>96 string strlstrh 16431>>>>>108 string vids video: 16432>>>>>>&0 lelong 0 uncompressed 16433# skip past vids strh 16434>>>>>>(104.l+108) string strf 16435>>>>>>>(104.l+132) lelong 1 RLE 8bpp 16436>>>>>>>(104.l+132) string/c cvid Cinepak 16437>>>>>>>(104.l+132) string/c i263 Intel I.263 16438>>>>>>>(104.l+132) string/c iv32 Indeo 3.2 16439>>>>>>>(104.l+132) string/c iv41 Indeo 4.1 16440>>>>>>>(104.l+132) string/c iv50 Indeo 5.0 16441>>>>>>>(104.l+132) string/c mp42 Microsoft MPEG-4 v2 16442>>>>>>>(104.l+132) string/c mp43 Microsoft MPEG-4 v3 16443>>>>>>>(104.l+132) string/c fmp4 FFMpeg MPEG-4 16444>>>>>>>(104.l+132) string/c mjpg Motion JPEG 16445>>>>>>>(104.l+132) string/c div3 DivX 3 16446>>>>>>>>112 string/c div3 Low-Motion 16447>>>>>>>>112 string/c div4 Fast-Motion 16448>>>>>>>(104.l+132) string/c divx DivX 4 16449>>>>>>>(104.l+132) string/c dx50 DivX 5 16450>>>>>>>(104.l+132) string/c xvid XviD 16451>>>>>>>(104.l+132) string/c h264 H.264 16452>>>>>>>(104.l+132) string/c wmv3 Windows Media Video 9 16453>>>>>>>(104.l+132) string/c h264 X.264 or H.264 16454>>>>>>>(104.l+132) lelong 0 16455##>>>>>>>(104.l+132) string x (%.4s) 16456# skip past first (video) LIST 16457>>>>(92.l+96) string LIST 16458>>>>>(92.l+104) string strlstrh 16459>>>>>>(92.l+116) string auds \b, audio: 16460# auds strh length = 56: 16461>>>>>>>(92.l+172) string strf 16462>>>>>>>>(92.l+180) leshort 0x0001 uncompressed PCM 16463>>>>>>>>(92.l+180) leshort 0x0002 ADPCM 16464>>>>>>>>(92.l+180) leshort 0x0006 aLaw 16465>>>>>>>>(92.l+180) leshort 0x0007 uLaw 16466>>>>>>>>(92.l+180) leshort 0x0050 MPEG-1 Layer 1 or 2 16467>>>>>>>>(92.l+180) leshort 0x0055 MPEG-1 Layer 3 16468>>>>>>>>(92.l+180) leshort 0x2000 Dolby AC3 16469>>>>>>>>(92.l+180) leshort 0x0161 DivX 16470##>>>>>>>>(92.l+180) leshort x (0x%.4x) 16471>>>>>>>>(92.l+182) leshort 1 (mono, 16472>>>>>>>>(92.l+182) leshort 2 (stereo, 16473>>>>>>>>(92.l+182) leshort >2 (%d channels, 16474>>>>>>>>(92.l+184) lelong x %d Hz) 16475# auds strh length = 64: 16476>>>>>>>(92.l+180) string strf 16477>>>>>>>>(92.l+188) leshort 0x0001 uncompressed PCM 16478>>>>>>>>(92.l+188) leshort 0x0002 ADPCM 16479>>>>>>>>(92.l+188) leshort 0x0055 MPEG-1 Layer 3 16480>>>>>>>>(92.l+188) leshort 0x2000 Dolby AC3 16481>>>>>>>>(92.l+188) leshort 0x0161 DivX 16482##>>>>>>>>(92.l+188) leshort x (0x%.4x) 16483>>>>>>>>(92.l+190) leshort 1 (mono, 16484>>>>>>>>(92.l+190) leshort 2 (stereo, 16485>>>>>>>>(92.l+190) leshort >2 (%d channels, 16486>>>>>>>>(92.l+192) lelong x %d Hz) 16487# Animated Cursor format 16488>8 string ACON \b, animated cursor 16489# SoundFont 2 <mpruett@sgi.com> 16490>8 string sfbk SoundFont/Bank 16491# MPEG-1 wrapped in a RIFF, apparently 16492>8 string CDXA \b, wrapped MPEG-1 (CDXA) 16493>8 string 4XMV \b, 4X Movie file 16494# AMV-type AVI file: http://wiki.multimedia.cx/index.php?title=AMV 16495>8 string AMV\040 \b, AMV 16496 16497# 16498# XXX - some of the below may only appear in little-endian form. 16499# 16500# Also "MV93" appears to be for one form of Macromedia Director 16501# files, and "GDMF" appears to be another multimedia format. 16502# 165030 string RIFX RIFF (big-endian) data 16504# RIFF Palette format 16505>8 string PAL \b, palette 16506>>16 beshort x \b, version %d 16507>>18 beshort x \b, %d entries 16508# RIFF Device Independent Bitmap format 16509>8 string RDIB \b, device-independent bitmap 16510>>16 string BM 16511>>>30 beshort 12 \b, OS/2 1.x format 16512>>>>34 beshort x \b, %d x 16513>>>>36 beshort x %d 16514>>>30 beshort 64 \b, OS/2 2.x format 16515>>>>34 beshort x \b, %d x 16516>>>>36 beshort x %d 16517>>>30 beshort 40 \b, Windows 3.x format 16518>>>>34 belong x \b, %d x 16519>>>>38 belong x %d x 16520>>>>44 beshort x %d 16521# RIFF MIDI format 16522>8 string RMID \b, MIDI 16523# RIFF Multimedia Movie File format 16524>8 string RMMP \b, multimedia movie 16525# Microsoft WAVE format (*.wav) 16526>8 string WAVE \b, WAVE audio 16527>>20 leshort 1 \b, Microsoft PCM 16528>>>34 leshort >0 \b, %d bit 16529>>22 beshort =1 \b, mono 16530>>22 beshort =2 \b, stereo 16531>>22 beshort >2 \b, %d channels 16532>>24 belong >0 %d Hz 16533# Corel Draw Picture 16534>8 string CDRA \b, Corel Draw Picture 16535>8 string CDR6 \b, Corel Draw Picture, version 6 16536# AVI == Audio Video Interleave 16537>8 string AVI\040 \b, AVI 16538# Animated Cursor format 16539>8 string ACON \b, animated cursor 16540# Notation Interchange File Format (big-endian only) 16541>8 string NIFF \b, Notation Interchange File Format 16542# SoundFont 2 <mpruett@sgi.com> 16543>8 string sfbk SoundFont/Bank 16544 16545#------------------------------------------------------------------------------ 16546# Sony Wave64 16547# see http://www.vcs.de/fileadmin/user_upload/MBS/PDF/Whitepaper/Informations_about_Sony_Wave64.pdf 16548# 128 bit RIFF-GUID { 66666972-912E-11CF-A5D6-28DB04C10000 } in little-endian 165490 string riff\x2E\x91\xCF\x11\xA5\xD6\x28\xDB\x04\xC1\x00\x00 Sony Wave64 RIFF data 16550# 128 bit + total file size (64 bits) so 24 bytes 16551# then WAVE-GUID { 65766177-ACF3-11D3-8CD1-00C04F8EDB8A } 16552>24 string wave\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A \b, WAVE 64 audio 16553!:mime audio/x-w64 16554# FMT-GUID { 20746D66-ACF3-11D3-8CD1-00C04F8EDB8A } 16555>>40 search/256 fmt\x20\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A \b 16556>>>&10 leshort =1 \b, mono 16557>>>&10 leshort =2 \b, stereo 16558>>>&10 leshort >2 \b, %d channels 16559>>>&12 lelong >0 %d Hz 16560 16561#------------------------------------------------------------------------------ 16562# MBWF/RF64 16563# see EBU TECH 3306 http://tech.ebu.ch/docs/tech/tech3306-2009.pdf 165640 string RF64\xff\xff\xff\xffWAVEds64 MBWF/RF64 audio 16565!:mime audio/x-wav 16566>40 search/256 fmt\x20 \b 16567>>&6 leshort =1 \b, mono 16568>>&6 leshort =2 \b, stereo 16569>>&6 leshort >2 \b, %d channels 16570>>&8 lelong >0 %d Hz 16571 16572 16573#------------------------------------------------------------------------------ 16574# $File: rinex,v 1.4 2011/05/03 01:44:17 christos Exp $ 16575# rinex: file(1) magic for RINEX files 16576# http://igscb.jpl.nasa.gov/igscb/data/format/rinex210.txt 16577# ftp://cddis.gsfc.nasa.gov/pub/reports/formats/rinex300.pdf 16578# data for testing: ftp://cddis.gsfc.nasa.gov/pub/gps/data 1657960 string RINEX 16580>80 search/256 XXRINEXB RINEX Data, GEO SBAS Broadcast 16581>>&32 string x \b, date %15.15s 16582>>5 string x \b, version %6.6s 16583!:mime rinex/broadcast 16584>80 search/256 XXRINEXD RINEX Data, Observation (Hatanaka comp) 16585>>&32 string x \b, date %15.15s 16586>>5 string x \b, version %6.6s 16587!:mime rinex/observation 16588>80 search/256 XXRINEXC RINEX Data, Clock 16589>>&32 string x \b, date %15.15s 16590>>5 string x \b, version %6.6s 16591!:mime rinex/clock 16592>80 search/256 XXRINEXH RINEX Data, GEO SBAS Navigation 16593>>&32 string x \b, date %15.15s 16594>>5 string x \b, version %6.6s 16595!:mime rinex/navigation 16596>80 search/256 XXRINEXG RINEX Data, GLONASS Navigation 16597>>&32 string x \b, date %15.15s 16598>>5 string x \b, version %6.6s 16599!:mime rinex/navigation 16600>80 search/256 XXRINEXL RINEX Data, Galileo Navigation 16601>>&32 string x \b, date %15.15s 16602>>5 string x \b, version %6.6s 16603!:mime rinex/navigation 16604>80 search/256 XXRINEXM RINEX Data, Meteorological 16605>>&32 string x \b, date %15.15s 16606>>5 string x \b, version %6.6s 16607!:mime rinex/meteorological 16608>80 search/256 XXRINEXN RINEX Data, Navigation 16609>>&32 string x \b, date %15.15s 16610>>5 string x \b, version %6.6s 16611!:mime rinex/navigation 16612>80 search/256 XXRINEXO RINEX Data, Observation 16613>>&32 string x \b, date %15.15s 16614>>5 string x \b, version %6.6s 16615!:mime rinex/observation 16616 16617#------------------------------------------------------------------------------ 16618# $File: rpm,v 1.12 2013/01/11 16:45:23 christos Exp $ 16619# 16620# RPM: file(1) magic for Red Hat Packages Erik Troan (ewt@redhat.com) 16621# 166220 belong 0xedabeedb RPM 16623!:mime application/x-rpm 16624>4 byte x v%d 16625>5 byte x \b.%d 16626>6 beshort 1 src 16627>6 beshort 0 bin 16628>>8 beshort 1 i386/x86_64 16629>>8 beshort 2 Alpha/Sparc64 16630>>8 beshort 3 Sparc 16631>>8 beshort 4 MIPS 16632>>8 beshort 5 PowerPC 16633>>8 beshort 6 68000 16634>>8 beshort 7 SGI 16635>>8 beshort 8 RS6000 16636>>8 beshort 9 IA64 16637>>8 beshort 10 Sparc64 16638>>8 beshort 11 MIPSel 16639>>8 beshort 12 ARM 16640>>8 beshort 13 MiNT 16641>>8 beshort 14 S/390 16642>>8 beshort 15 S/390x 16643>>8 beshort 16 PowerPC64 16644>>8 beshort 17 SuperH 16645>>8 beshort 18 Xtensa 16646>>8 beshort 255 noarch 16647 16648#delta RPM Daniel Novotny (dnovotny@redhat.com) 166490 string drpm Delta RPM 16650!:mime application/x-rpm 16651>12 string x %s 16652>>8 beshort 11 MIPSel 16653>>8 beshort 12 ARM 16654>>8 beshort 13 MiNT 16655>>8 beshort 14 S/390 16656>>8 beshort 15 S/390x 16657>>8 beshort 16 PowerPC64 16658>>8 beshort 17 SuperH 16659>>8 beshort 18 Xtensa 16660>>10 string x %s 16661 16662#------------------------------------------------------------------------------ 16663# $File: rtf,v 1.7 2009/09/19 16:28:12 christos Exp $ 16664# rtf: file(1) magic for Rich Text Format (RTF) 16665# 16666# Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk 16667# 166680 string {\\rtf Rich Text Format data, 16669!:mime text/rtf 16670>5 string 1 version 1, 16671>>6 string \\ansi ANSI 16672>>6 string \\mac Apple Macintosh 16673>>6 string \\pc IBM PC, code page 437 16674>>6 string \\pca IBM PS/2, code page 850 16675>>6 default x unknown character set 16676>5 default x unknown version 16677 16678#------------------------------------------------------------------------------ 16679# $File: ruby,v 1.5 2010/07/21 16:47:17 christos Exp $ 16680# ruby: file(1) magic for Ruby scripting language 16681# URL: http://www.ruby-lang.org/ 16682# From: Reuben Thomas <rrt@sc3d.org> 16683 16684# Ruby scripts 166850 search/1/w #!\ /usr/bin/ruby Ruby script text executable 16686!:mime text/x-ruby 166870 search/1/w #!\ /usr/local/bin/ruby Ruby script text executable 16688!:mime text/x-ruby 166890 search/1 #!/usr/bin/env\ ruby Ruby script text executable 16690!:mime text/x-ruby 166910 search/1 #!\ /usr/bin/env\ ruby Ruby script text executable 16692!:mime text/x-ruby 16693 16694# What looks like ruby, but does not have a shebang 16695# (modules and such) 16696# From: Lubomir Rintel <lkundrak@v3.sk> 166970 regex \^[\ \t]*require[\ \t]'[A-Za-z_/]+' 16698>0 regex include\ [A-Z]|def\ [a-z]|\ do$ 16699>>0 regex \^[\ \t]*end([\ \t]*[;#].*)?$ Ruby script text 16700!:mime text/x-ruby 167010 regex \^[\ \t]*(class|module)[\ \t][A-Z] 16702>0 regex (modul|includ)e\ [A-Z]|def\ [a-z] 16703>>0 regex \^[\ \t]*end([\ \t]*[;#].*)?$ Ruby module source text 16704!:mime text/x-ruby 16705 16706#------------------------------------------------------------------------------ 16707# $File: sc,v 1.6 2009/09/19 16:28:12 christos Exp $ 16708# sc: file(1) magic for "sc" spreadsheet 16709# 1671038 string Spreadsheet sc spreadsheet file 16711!:mime application/x-sc 16712 16713#------------------------------------------------------------------------------ 16714# $File: sccs,v 1.6 2009/09/19 16:28:12 christos Exp $ 16715# sccs: file(1) magic for SCCS archives 16716# 16717# SCCS archive structure: 16718# \001h01207 16719# \001s 00276/00000/00000 16720# \001d D 1.1 87/09/23 08:09:20 ian 1 0 16721# \001c date and time created 87/09/23 08:09:20 by ian 16722# \001e 16723# \001u 16724# \001U 16725# ... etc. 16726# Now '\001h' happens to be the same as the 3B20's a.out magic number (0550). 16727# *Sigh*. And these both came from various parts of the USG. 16728# Maybe we should just switch everybody from SCCS to RCS! 16729# Further, you can't just say '\001h0', because the five-digit number 16730# is a checksum that could (presumably) have any leading digit, 16731# and we don't have regular expression matching yet. 16732# Hence the following official kludge: 167338 string \001s\ SCCS archive data 16734 16735#------------------------------------------------------------------------------ 16736# $File: scientific,v 1.8 2014/01/06 17:46:23 rrt Exp $ 16737# scientific: file(1) magic for scientific formats 16738# 16739# From: Joe Krahn <krahn@niehs.nih.gov> 16740 16741######################################################## 16742# CCP4 data and plot files: 167430 string MTZ\040 MTZ reflection file 16744 1674592 string PLOT%%84 Plot84 plotting file 16746>52 byte 1 , Little-endian 16747>55 byte 1 , Big-endian 16748 16749######################################################## 16750# Electron density MAP/MASK formats 16751 167520 string EZD_MAP NEWEZD Electron Density Map 16753109 string MAP\040( Old EZD Electron Density Map 16754 167550 string/c :-)\040Origin BRIX Electron Density Map 16756>170 string >0 , Sigma:%.12s 16757#>4 string >0 %.178s 16758#>4 addr x %.178s 16759 167607 string 18\040!NTITLE XPLOR ASCII Electron Density Map 167619 string \040!NTITLE\012\040REMARK CNS ASCII electron density map 16762 16763208 string MAP\040 CCP4 Electron Density Map 16764# Assumes same stamp for float and double (normal case) 16765>212 byte 17 \b, Big-endian 16766>212 byte 34 \b, VAX format 16767>212 byte 68 \b, Little-endian 16768>212 byte 85 \b, Convex native 16769 16770############################################################ 16771# X-Ray Area Detector images 167720 string R-AXIS4\ \ \ R-Axis Area Detector Image: 16773>796 lelong <20 Little-endian, IP #%d, 16774>>768 lelong >0 Size=%dx 16775>>772 lelong >0 \b%d 16776>796 belong <20 Big-endian, IP #%d, 16777>>768 belong >0 Size=%dx 16778>>772 belong >0 \b%d 16779 167800 string RAXIS\ \ \ \ \ R-Axis Area Detector Image, Win32: 16781>796 lelong <20 Little-endian, IP #%d, 16782>>768 lelong >0 Size=%dx 16783>>772 lelong >0 \b%d 16784>796 belong <20 Big-endian, IP #%d, 16785>>768 belong >0 Size=%dx 16786>>772 belong >0 \b%d 16787 16788 167891028 string MMX\000\000\000\000\000\000\000\000\000\000\000\000\000 MAR Area Detector Image, 16790>1072 ulong >1 Compressed(%d), 16791>1100 ulong >1 %d headers, 16792>1104 ulong >0 %d x 16793>1108 ulong >0 %d, 16794>1120 ulong >0 %d bits/pixel 16795 16796# Type: GEDCOM genealogical (family history) data 16797# From: Giuseppe Bilotta 167980 search/1/c 0\ HEAD GEDCOM genealogy text 16799>&0 search 1\ GEDC 16800>>&0 search 2\ VERS version 16801>>>&1 string >\0 %s 16802# From: Phil Endecott <phil05@chezphil.org> 168030 string \000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data 168040 string \060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data 168050 string \376\377\000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data 168060 string \377\376\060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data 16807 16808# PDB: Protein Data Bank files 16809# Adam Buchbinder <adam.buchbinder@gmail.com> 16810# 16811# http://www.wwpdb.org/documentation/format32/sect2.html 16812# http://www.ch.ic.ac.uk/chemime/ 16813# 16814# The PDB file format is fixed-field, 80 columns. From the spec: 16815# 16816# COLS DATA 16817# 1 - 6 "HEADER" 16818# 11 - 50 String(40) 16819# 51 - 59 Date 16820# 63 - 66 IDcode 16821# 16822# Thus, positions 7-10, 60-62 and 67-80 are spaces. The Date must be in the 16823# format DD-MMM-YY, e.g., 01-JAN-70, and the IDcode consists of numbers and 16824# uppercase letters. However, examples have been seen without the date string, 16825# e.g., the example on the chemime site. 168260 string HEADER\ \ \ \ 16827>&0 regex/1 \^.{40} 16828>>&0 regex/1 [0-9]{2}-[A-Z]{3}-[0-9]{2}\ {3} 16829>>>&0 regex/1s [A-Z0-9]{4}.{14}$ 16830>>>>&0 regex/1 [A-Z0-9]{4} Protein Data Bank data, ID Code %s 16831!:mime chemical/x-pdb 16832>>>>0 regex/1 [0-9]{2}-[A-Z]{3}-[0-9]{2} \b, %s 16833 16834# Type: GDSII Stream file 168350 belong 0x00060002 GDSII Stream file 16836>4 byte 0x00 16837>>5 byte x version %d.0 16838>4 byte >0x00 version %d 16839>>5 byte x \b.%d 16840 16841#------------------------------------------------------------------------------ 16842# $File: securitycerts,v 1.4 2009/09/19 16:28:12 christos Exp $ 168430 search/1 -----BEGIN\ CERTIFICATE------ RFC1421 Security Certificate text 168440 search/1 -----BEGIN\ NEW\ CERTIFICATE RFC1421 Security Certificate Signing Request text 168450 belong 0xedfeedfe Sun 'jks' Java Keystore File data 16846# Type: SE Linux policy modules *.pp reference policy 16847# for Fedora 5 to 9, RHEL5, and Debian Etch and Lenny. 16848# URL: http://doc.coker.com.au/computers/selinux-magic 16849# From: Russell Coker <russell@coker.com.au> 16850 168510 lelong 0xf97cff8f SE Linux modular policy 16852>4 lelong x version %d, 16853>8 lelong x %d sections, 16854>>(12.l) lelong 0xf97cff8d 16855>>>(12.l+27) lelong x mod version %d, 16856>>>(12.l+31) lelong 0 Not MLS, 16857>>>(12.l+31) lelong 1 MLS, 16858>>>(12.l+23) lelong 2 16859>>>>(12.l+47) string >\0 module name %s 16860>>>(12.l+23) lelong 1 base 16861 168621 string policy_module( SE Linux policy module source 168632 string policy_module( SE Linux policy module source 16864 168650 string ##\ <summary> SE Linux policy interface source 16866 16867#0 search gen_context( SE Linux policy file contexts 16868 16869#0 search gen_sens( SE Linux policy MLS constraints source 16870 16871#------------------------------------------------------------------------------ 16872# $File: sendmail,v 1.7 2009/09/19 16:28:12 christos Exp $ 16873# sendmail: file(1) magic for sendmail config files 16874# 16875# XXX - byte order? 16876# 168770 byte 046 Sendmail frozen configuration 16878>16 string >\0 - version %s 168790 short 0x271c Sendmail frozen configuration 16880>16 string >\0 - version %s 16881 16882#------------------------------------------------------------------------------ 16883# sendmail: file(1) magic for sendmail m4(1) files 16884# 16885# From Hendrik Scholz <hendrik@scholz.net> 16886# i.e. files in /usr/share/sendmail/cf/ 16887# 168880 string divert(-1)\n sendmail m4 text file 16889 16890 16891#------------------------------------------------------------------------------ 16892# $File: sequent,v 1.8 2009/09/19 16:28:12 christos Exp $ 16893# sequent: file(1) magic for Sequent machines 16894# 16895# Sequent information updated by Don Dwiggins <atsun!dwiggins>. 16896# For Sequent's multiprocessor systems (incomplete). 168970 lelong 0x00ea BALANCE NS32000 .o 16898>16 lelong >0 not stripped 16899>124 lelong >0 version %ld 169000 lelong 0x10ea BALANCE NS32000 executable (0 @ 0) 16901>16 lelong >0 not stripped 16902>124 lelong >0 version %ld 169030 lelong 0x20ea BALANCE NS32000 executable (invalid @ 0) 16904>16 lelong >0 not stripped 16905>124 lelong >0 version %ld 169060 lelong 0x30ea BALANCE NS32000 standalone executable 16907>16 lelong >0 not stripped 16908>124 lelong >0 version %ld 16909# 16910# Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>. 16911# Symmetry magic nums will not be reached if DOS COM comes before them; 16912# byte 0xeb is matched before these get a chance. 169130 leshort 0x12eb SYMMETRY i386 .o 16914>16 lelong >0 not stripped 16915>124 lelong >0 version %ld 169160 leshort 0x22eb SYMMETRY i386 executable (0 @ 0) 16917>16 lelong >0 not stripped 16918>124 lelong >0 version %ld 169190 leshort 0x32eb SYMMETRY i386 executable (invalid @ 0) 16920>16 lelong >0 not stripped 16921>124 lelong >0 version %ld 169220 leshort 0x42eb SYMMETRY i386 standalone executable 16923>16 lelong >0 not stripped 16924>124 lelong >0 version %ld 16925 16926#------------------------------------------------------------------------------ 16927# $File: sgi,v 1.19 2013/01/12 03:09:51 christos Exp $ 16928# sgi: file(1) magic for Silicon Graphics operating systems and applications 16929# 16930# Executable images are handled either in aout (for old-style a.out 16931# files for 68K; they are indistinguishable from other big-endian 32-bit 16932# a.out files) or in mips (for MIPS ECOFF and Ucode files) 16933# 16934 16935# kbd file definitions 169360 string kbd!map kbd map file 16937>8 byte >0 Ver %d: 16938>10 short >0 with %d table(s) 16939 169400 beshort 0x8765 disk quotas file 16941 169420 beshort 0x0506 IRIS Showcase file 16943>2 byte 0x49 - 16944>3 byte x - version %ld 169450 beshort 0x0226 IRIS Showcase template 16946>2 byte 0x63 - 16947>3 byte x - version %ld 169480 belong 0x5343464d IRIS Showcase file 16949>4 byte x - version %ld 169500 belong 0x5443464d IRIS Showcase template 16951>4 byte x - version %ld 169520 belong 0xdeadbabe IRIX Parallel Arena 16953>8 belong >0 - version %ld 16954 16955# core files 16956# 16957# 32bit core file 169580 belong 0xdeadadb0 IRIX core dump 16959>4 belong 1 of 16960>16 string >\0 '%s' 16961# 64bit core file 169620 belong 0xdeadad40 IRIX 64-bit core dump 16963>4 belong 1 of 16964>16 string >\0 '%s' 16965# N32bit core file 169660 belong 0xbabec0bb IRIX N32 core dump 16967>4 belong 1 of 16968>16 string >\0 '%s' 16969# New style crash dump file 169700 string \x43\x72\x73\x68\x44\x75\x6d\x70 IRIX vmcore dump of 16971>36 string >\0 '%s' 16972 16973# Trusted IRIX info 169740 string SGIAUDIT SGI Audit file 16975>8 byte x - version %d 16976>9 byte x \b.%ld 16977# 169780 string WNGZWZSC Wingz compiled script 169790 string WNGZWZSS Wingz spreadsheet 169800 string WNGZWZHP Wingz help file 16981# 169820 string #Inventor V IRIS Inventor 1.0 file 169830 string #Inventor V2 Open Inventor 2.0 file 16984# GLF is OpenGL stream encoding 169850 string glfHeadMagic(); GLF_TEXT 169864 belong 0x7d000000 GLF_BINARY_LSB_FIRST 16987!:strength -30 169884 belong 0x0000007d GLF_BINARY_MSB_FIRST 16989!:strength -30 16990# GLS is OpenGL stream encoding; GLS is the successor of GLF 169910 string glsBeginGLS( GLS_TEXT 169924 belong 0x10000000 GLS_BINARY_LSB_FIRST 16993!:strength -30 169944 belong 0x00000010 GLS_BINARY_MSB_FIRST 16995!:strength -30 16996 16997# 16998# 16999# Performance Co-Pilot file types 170000 string PmNs PCP compiled namespace (V.0) 170010 string PmN PCP compiled namespace 17002>3 string >\0 (V.%1.1s) 17003#3 lelong 0x84500526 PCP archive 170043 belong 0x84500526 PCP archive 17005>7 byte x (V.%d) 17006#>20 lelong -2 temporal index 17007#>20 lelong -1 metadata 17008#>20 lelong 0 log volume #0 17009#>20 lelong >0 log volume #%ld 17010>20 belong -2 temporal index 17011>20 belong -1 metadata 17012>20 belong 0 log volume #0 17013>20 belong >0 log volume #%ld 17014>24 string >\0 host: %s 170150 string PCPFolio PCP 17016>9 string Version: Archive Folio 17017>18 string >\0 (V.%s) 170180 string #pmchart PCP pmchart view 17019>9 string Version 17020>17 string >\0 (V%-3.3s) 170210 string #kmchart PCP kmchart view 17022>9 string Version 17023>17 string >\0 (V.%s) 170240 string pmview PCP pmview config 17025>7 string Version 17026>15 string >\0 (V%-3.3s) 170270 string #pmlogger PCP pmlogger config 17028>10 string Version 17029>18 string >\0 (V%1.1s) 170300 string #pmdahotproc PCP pmdahotproc config 17031>13 string Version 17032>21 string >\0 (V%-3.3s) 170330 string PcPh PCP Help 17034>4 string 1 Index 17035>4 string 2 Text 17036>5 string >\0 (V.%1.1s) 170370 string #pmieconf-rules PCP pmieconf rules 17038>16 string >\0 (V.%1.1s) 170393 string pmieconf-pmie PCP pmie config 17040>17 string >\0 (V.%1.1s) 17041 17042# SpeedShop data files 170430 lelong 0x13130303 SpeedShop data file 17044 17045# mdbm files 170460 lelong 0x01023962 mdbm file, version 0 (obsolete) 170470 string mdbm mdbm file, 17048>5 byte x version %d, 17049>6 byte x 2^%d pages, 17050>7 byte x pagesize 2^%d, 17051>17 byte x hash %d, 17052>11 byte x dataformat %d 17053 17054# Alias Maya files 170550 string/t //Maya ASCII Alias Maya Ascii File, 17056>13 string >\0 version %s 170578 string MAYAFOR4 Alias Maya Binary File, 17058>32 string >\0 version %s scene 170598 string MayaFOR4 Alias Maya Binary File, 17060>32 string >\0 version %s scene 170618 string CIMG Alias Maya Image File 170628 string DEEP Alias Maya Image File 17063#------------------------------------------------------------------------------ 17064# $File: sgml,v 1.30 2013/12/21 14:27:24 christos Exp $ 17065# Type: SVG Vectorial Graphics 17066# From: Noel Torres <tecnico@ejerciciosresueltos.com> 170670 string \<?xml\ version=" 17068>15 string >\0 17069>>19 search/4096 \<svg SVG Scalable Vector Graphics image 17070!:mime image/svg+xml 17071>>19 search/4096 \<gnc-v2 GnuCash file 17072!:mime application/x-gnucash 17073 17074# Sitemap file 170750 string/t \<?xml\ version=" 17076>15 string >\0 17077>>19 search/4096 \<urlset XML Sitemap document text 17078!:mime application/xml-sitemap 17079 17080# OpenStreetMap XML (.osm) 17081# http://wiki.openstreetmap.org/wiki/OSM_XML 17082# From: Markus Heidelberg <markus.heidelberg@web.de> 170830 string \<?xml\ version=" 17084>15 string >\0 17085>>19 search/4096 \<osm OpenStreetMap XML data 17086 17087# xhtml 170880 string/t \<?xml\ version=" 17089>15 string >\0 17090>>19 search/4096/cWbt \<!doctype\ html XHTML document text 17091!:mime text/html 170920 string/t \<?xml\ version=' 17093>15 string >\0 17094>>19 search/4096/cWbt \<!doctype\ html XHTML document text 17095!:mime text/html 170960 string/t \<?xml\ version=" 17097>15 string >\0 17098>>19 search/4096/cWbt \<html broken XHTML document text 17099!:mime text/html 17100 17101#------------------------------------------------------------------------------ 17102# sgml: file(1) magic for Standard Generalized Markup Language 17103# HyperText Markup Language (HTML) is an SGML document type, 17104# from Daniel Quinlan (quinlan@yggdrasil.com) 17105# adapted to string extenstions by Anthon van der Neut <anthon@mnt.org) 171060 search/4096/cWt \<!doctype\ html HTML document text 17107!:mime text/html 17108!:strength + 5 171090 search/4096/cwt \<head HTML document text 17110!:mime text/html 17111!:strength + 5 171120 search/4096/cwt \<title HTML document text 17113!:mime text/html 17114!:strength + 5 171150 search/4096/cwt \<html HTML document text 17116!:mime text/html 17117!:strength + 5 171180 search/4096/cwt \<script HTML document text 17119!:mime text/html 17120!:strength + 5 171210 search/4096/cwt \<style HTML document text 17122!:mime text/html 17123!:strength + 5 171240 search/4096/cwt \<table HTML document text 17125!:mime text/html 17126!:strength + 5 171270 search/4096/cwt \<a\ href= HTML document text 17128!:mime text/html 17129!:strength + 5 17130 17131# Extensible markup language (XML), a subset of SGML 17132# from Marc Prud'hommeaux (marc@apocalypse.org) 171330 search/1/cwt \<?xml XML document text 17134!:mime application/xml 17135!:strength + 5 171360 string/t \<?xml\ version\ " XML 17137!:mime application/xml 17138!:strength + 5 171390 string/t \<?xml\ version=" XML 17140!:mime application/xml 17141!:strength + 5 17142>15 string/t >\0 %.3s document text 17143>>23 search/1 \<xsl:stylesheet (XSL stylesheet) 17144>>24 search/1 \<xsl:stylesheet (XSL stylesheet) 171450 string \<?xml\ version=' XML 17146!:mime application/xml 17147!:strength + 5 17148>15 string/t >\0 %.3s document text 17149>>23 search/1 \<xsl:stylesheet (XSL stylesheet) 17150>>24 search/1 \<xsl:stylesheet (XSL stylesheet) 171510 search/1/wbt \<?xml XML document text 17152!:mime application/xml 17153!:strength - 10 171540 search/1/wt \<?XML broken XML document text 17155!:mime application/xml 17156!:strength - 10 17157 17158 17159# SGML, mostly from rph@sq 171600 search/4096/cwt \<!doctype exported SGML document text 171610 search/4096/cwt \<!subdoc exported SGML subdocument text 171620 search/4096/cwt \<!-- exported SGML document text 17163!:strength - 10 17164 17165# Web browser cookie files 17166# (Mozilla, Galeon, Netscape 4, Konqueror..) 17167# Ulf Harnhammar <ulfh@update.uu.se> 171680 search/1 #\ HTTP\ Cookie\ File Web browser cookie text 171690 search/1 #\ Netscape\ HTTP\ Cookie\ File Netscape cookie text 171700 search/1 #\ KDE\ Cookie\ File Konqueror cookie text 17171 17172#------------------------------------------------------------------------ 17173# $File: sharc,v 1.6 2009/09/19 16:28:12 christos Exp $ 17174# file(1) magic for sharc files 17175# 17176# SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by 17177# FutureGroove Music (dsp@futuregroove.de) 17178 17179#------------------------------------------------------------------------ 17180#0 string Draw RiscOS Drawfile 17181#0 string PACK RiscOS PackdDir archive 17182 17183#------------------------------------------------------------------------ 17184# SHARC DSP stuff (based on the FGM SHARC DSP SDK) 17185 17186#0 string =! Assembler source 17187#0 string Analog ADi asm listing file 171880 string .SYSTEM SHARC architecture file 171890 string .system SHARC architecture file 17190 171910 leshort 0x521C SHARC COFF binary 17192>2 leshort >1 , %hd sections 17193>>12 lelong >0 , not stripped 17194 17195#------------------------------------------------------------------------------ 17196# $File: sinclair,v 1.5 2009/09/19 16:28:12 christos Exp $ 17197# sinclair: file(1) sinclair QL 17198 17199# additions to /etc/magic by Thomas M. Ott (ThMO) 17200 17201# Sinclair QL floppy disk formats (ThMO) 172020 string =QL5 QL disk dump data, 17203>3 string =A 720 KB, 17204>3 string =B 1.44 MB, 17205>3 string =C 3.2 MB, 17206>4 string >\0 label:%.10s 17207 17208# Sinclair QL OS dump (ThMO) 17209# (NOTE: if `file' would be able to use indirect references in a endian format 17210# differing from the natural host format, this could be written more 17211# reliably and faster...) 17212# 17213# we *can't* lookup QL OS code dumps, because `file' is UNABLE to read more 17214# than the first 8K of a file... #-( 17215# 17216#0 belong =0x30000 17217#>49124 belong <47104 17218#>>49128 belong <47104 17219#>>>49132 belong <47104 17220#>>>>49136 belong <47104 QL OS dump data, 17221#>>>>>49148 string >\0 type %.3s, 17222#>>>>>49142 string >\0 version %.4s 17223 17224# Sinclair QL firmware executables (ThMO) 172250 string NqNqNq`\004 QL firmware executable (BCPL) 17226 17227# Sinclair QL libraries (was ThMO) 172280 beshort 0xFB01 QDOS object 17229>2 pstring x '%s' 17230 17231# Sinclair QL executables (was ThMO) 172324 belong 0x4AFB QDOS executable 17233>9 pstring x '%s' 17234 17235# Sinclair QL ROM (ThMO) 172360 belong =0x4AFB0001 QL plugin-ROM data, 17237>9 pstring =\0 un-named 17238>9 pstring >\0 named: %s 17239# Type: SiSU Markup Language 17240# URL: http://www.sisudoc.org/ 17241# From: Ralph Amissah <ralph.amissah@gmail.com> 17242 172430 regex \^%?[\ \t]*SiSU[\ \t]+insert SiSU text insert 17244>5 regex [0-9.]+ %s 17245 172460 regex \^%[\ \t]+SiSU[\ \t]+master SiSU text master 17247>5 regex [0-9.]+ %s 17248 172490 regex \^%?[\ \t]*SiSU[\ \t]+text SiSU text 17250>5 regex [0-9.]+ %s 17251 172520 regex \^%?[\ \t]*SiSU[\ \t][0-9.]+ SiSU text 17253>5 regex [0-9.]+ %s 17254 172550 regex \^%*[\ \t]*sisu-[0-9.]+ SiSU text 17256>5 regex [0-9.]+ %s 17257 17258#------------------------------------------------------------------------------ 17259# $File: sketch,v 1.4 2009/09/19 16:28:12 christos Exp $ 17260# Sketch Drawings: http://sketch.sourceforge.net/ 17261# From: Edwin Mons <e@ik.nu> 172620 search/1 ##Sketch Sketch document text 17263 17264#----------------------------------------------- 17265# $File: smalltalk,v 1.5 2009/09/19 16:28:12 christos Exp $ 17266# GNU Smalltalk image, starting at version 1.6.2 17267# From: catull_us@yahoo.com 17268# 172690 string GSTIm\0\0 GNU SmallTalk 17270# little-endian 17271>7 byte&1 =0 LE image version 17272>>10 byte x %d. 17273>>9 byte x \b%d. 17274>>8 byte x \b%d 17275#>>12 lelong x , data: %ld 17276#>>16 lelong x , table: %ld 17277#>>20 lelong x , memory: %ld 17278# big-endian 17279>7 byte&1 =1 BE image version 17280>>8 byte x %d. 17281>>9 byte x \b%d. 17282>>10 byte x \b%d 17283#>>12 belong x , data: %ld 17284#>>16 belong x , table: %ld 17285#>>20 belong x , memory: %ld 17286 17287 17288 17289#------------------------------------------------------------------------------ 17290# $File: smile,v 1.1 2011/08/17 17:37:18 christos Exp $ 17291# smile: file(1) magic for Smile serialization 17292# 17293# The Smile serialization format uses a 4-byte header: 17294# 17295# Constant byte #0: 0x3A (ASCII ':') 17296# Constant byte #1: 0x29 (ASCII ')') 17297# Constant byte #2: 0x0A (ASCII linefeed, '\n') 17298# Variable byte #3, consisting of bits: 17299# Bits 4-7 (4 MSB): 4-bit version number 17300# Bits 3: Reserved 17301# Bit 2 (mask 0x04): Whether raw binary (unescaped 8-bit) values may be present in content 17302# Bit 1 (mask 0x02): Whether shared String value checking was enabled during encoding, default false 17303# Bit 0 (mask 0x01): Whether shared property name checking was enabled during encoding, default true 17304# 17305# Reference: http://wiki.fasterxml.com/SmileFormatSpec 17306# Created by: Pierre-Alexandre Meyer <pierre@mouraf.org> 17307 17308# Detection 173090 string :)\n Smile binary data 17310 17311# Versioning 17312>3 byte&0xF0 x version %d: 17313 17314# Properties 17315>3 byte&0x04 0x04 binary raw, 17316>3 byte&0x04 0x00 binary encoded, 17317>3 byte&0x02 0x02 shared String values enabled, 17318>3 byte&0x02 0x00 shared String values disabled, 17319>3 byte&0x01 0x01 shared field names enabled 17320>3 byte&0x01 0x00 shared field names disabled 17321 17322 17323#------------------------------------------------------------------------------ 17324# $File: sniffer,v 1.19 2013/01/06 01:11:04 christos Exp $ 17325# sniffer: file(1) magic for packet capture files 17326# 17327# From: guy@alum.mit.edu (Guy Harris) 17328# 17329 17330# 17331# Microsoft Network Monitor 1.x capture files. 17332# 173330 string RTSS NetMon capture file 17334>5 byte x - version %d 17335>4 byte x \b.%d 17336>6 leshort 0 (Unknown) 17337>6 leshort 1 (Ethernet) 17338>6 leshort 2 (Token Ring) 17339>6 leshort 3 (FDDI) 17340>6 leshort 4 (ATM) 17341>6 leshort >4 (type %d) 17342 17343# 17344# Microsoft Network Monitor 2.x capture files. 17345# 173460 string GMBU NetMon capture file 17347>5 byte x - version %d 17348>4 byte x \b.%d 17349>6 leshort 0 (Unknown) 17350>6 leshort 1 (Ethernet) 17351>6 leshort 2 (Token Ring) 17352>6 leshort 3 (FDDI) 17353>6 leshort 4 (ATM) 17354>6 leshort 5 (IP-over-IEEE 1394) 17355>6 leshort 6 (802.11) 17356>6 leshort 7 (Raw IP) 17357>6 leshort 8 (Raw IP) 17358>6 leshort 9 (Raw IP) 17359>6 leshort >9 (type %d) 17360 17361# 17362# Network General Sniffer capture files. 17363# Sorry, make that "Network Associates Sniffer capture files." 17364# Sorry, make that "Network General old DOS Sniffer capture files." 17365# 173660 string TRSNIFF\ data\ \ \ \ \032 Sniffer capture file 17367>33 byte 2 (compressed) 17368>23 leshort x - version %d 17369>25 leshort x \b.%d 17370>32 byte 0 (Token Ring) 17371>32 byte 1 (Ethernet) 17372>32 byte 2 (ARCNET) 17373>32 byte 3 (StarLAN) 17374>32 byte 4 (PC Network broadband) 17375>32 byte 5 (LocalTalk) 17376>32 byte 6 (Znet) 17377>32 byte 7 (Internetwork Analyzer) 17378>32 byte 9 (FDDI) 17379>32 byte 10 (ATM) 17380 17381# 17382# Cinco Networks NetXRay capture files. 17383# Sorry, make that "Network General Sniffer Basic capture files." 17384# Sorry, make that "Network Associates Sniffer Basic capture files." 17385# Sorry, make that "Network Associates Sniffer Basic, and Windows 17386# Sniffer Pro", capture files." 17387# Sorry, make that "Network General Sniffer capture files." 17388# Sorry, make that "NetScout Sniffer capture files." 17389# 173900 string XCP\0 NetXRay capture file 17391>4 string >\0 - version %s 17392>44 leshort 0 (Ethernet) 17393>44 leshort 1 (Token Ring) 17394>44 leshort 2 (FDDI) 17395>44 leshort 3 (WAN) 17396>44 leshort 8 (ATM) 17397>44 leshort 9 (802.11) 17398 17399# 17400# "libpcap" capture files. 17401# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is 17402# the main program that uses that format, but there are other programs 17403# that use "libpcap", or that use the same capture file format.) 17404# 174050 name pcap-be 17406>4 beshort x - version %d 17407>6 beshort x \b.%d 17408>20 belong 0 (No link-layer encapsulation 17409>20 belong 1 (Ethernet 17410>20 belong 2 (3Mb Ethernet 17411>20 belong 3 (AX.25 17412>20 belong 4 (ProNET 17413>20 belong 5 (CHAOS 17414>20 belong 6 (Token Ring 17415>20 belong 7 (BSD ARCNET 17416>20 belong 8 (SLIP 17417>20 belong 9 (PPP 17418>20 belong 10 (FDDI 17419>20 belong 11 (RFC 1483 ATM 17420>20 belong 12 (raw IP 17421>20 belong 13 (BSD/OS SLIP 17422>20 belong 14 (BSD/OS PPP 17423>20 belong 19 (Linux ATM Classical IP 17424>20 belong 50 (PPP or Cisco HDLC 17425>20 belong 51 (PPP-over-Ethernet 17426>20 belong 99 (Symantec Enterprise Firewall 17427>20 belong 100 (RFC 1483 ATM 17428>20 belong 101 (raw IP 17429>20 belong 102 (BSD/OS SLIP 17430>20 belong 103 (BSD/OS PPP 17431>20 belong 104 (BSD/OS Cisco HDLC 17432>20 belong 105 (802.11 17433>20 belong 106 (Linux Classical IP over ATM 17434>20 belong 107 (Frame Relay 17435>20 belong 108 (OpenBSD loopback 17436>20 belong 109 (OpenBSD IPsec encrypted 17437>20 belong 112 (Cisco HDLC 17438>20 belong 113 (Linux "cooked" 17439>20 belong 114 (LocalTalk 17440>20 belong 117 (OpenBSD PFLOG 17441>20 belong 119 (802.11 with Prism header 17442>20 belong 122 (RFC 2625 IP over Fibre Channel 17443>20 belong 123 (SunATM 17444>20 belong 127 (802.11 with radiotap header 17445>20 belong 129 (Linux ARCNET 17446>20 belong 138 (Apple IP over IEEE 1394 17447>20 belong 139 (MTP2 with pseudo-header 17448>20 belong 140 (MTP2 17449>20 belong 141 (MTP3 17450>20 belong 142 (SCCP 17451>20 belong 143 (DOCSIS 17452>20 belong 144 (IrDA 17453>20 belong 147 (Private use 0 17454>20 belong 148 (Private use 1 17455>20 belong 149 (Private use 2 17456>20 belong 150 (Private use 3 17457>20 belong 151 (Private use 4 17458>20 belong 152 (Private use 5 17459>20 belong 153 (Private use 6 17460>20 belong 154 (Private use 7 17461>20 belong 155 (Private use 8 17462>20 belong 156 (Private use 9 17463>20 belong 157 (Private use 10 17464>20 belong 158 (Private use 11 17465>20 belong 159 (Private use 12 17466>20 belong 160 (Private use 13 17467>20 belong 161 (Private use 14 17468>20 belong 162 (Private use 15 17469>20 belong 163 (802.11 with AVS header 17470>20 belong 165 (BACnet MS/TP 17471>20 belong 166 (PPPD 17472>20 belong 169 (GPRS LLC 17473>20 belong 177 (Linux LAPD 17474>20 belong 187 (Bluetooth HCI H4 17475>20 belong 189 (Linux USB 17476>20 belong 192 (PPI 17477>20 belong 195 (802.15.4 17478>20 belong 196 (SITA 17479>20 belong 197 (Endace ERF 17480>20 belong 201 (Bluetooth HCI H4 with pseudo-header 17481>20 belong 202 (AX.25 with KISS header 17482>20 belong 203 (LAPD 17483>20 belong 204 (PPP with direction pseudo-header 17484>20 belong 205 (Cisco HDLC with direction pseudo-header 17485>20 belong 206 (Frame Relay with direction pseudo-header 17486>20 belong 209 (Linux IPMB 17487>20 belong 215 (802.15.4 with non-ASK PHY header 17488>20 belong 220 (Memory-mapped Linux USB 17489>20 belong 224 (Fibre Channel FC-2 17490>20 belong 225 (Fibre Channel FC-2 with frame delimiters 17491>20 belong 226 (Solaris IPNET 17492>20 belong 227 (SocketCAN 17493>20 belong 228 (Raw IPv4 17494>20 belong 229 (Raw IPv6 17495>20 belong 230 (802.15.4 without FCS 17496>20 belong 231 (D-Bus messages 17497>20 belong 235 (DVB-CI 17498>20 belong 236 (MUX27010 17499>20 belong 237 (STANAG 5066 D_PDUs 17500>20 belong 239 (Linux netlink NFLOG messages 17501>20 belong 240 (Hilscher netAnalyzer 17502>20 belong 241 (Hilscher netAnalyzer with delimiters 17503>20 belong 242 (IP-over-Infiniband 17504>20 belong 243 (MPEG-2 Transport Stream packets 17505>20 belong 244 (ng4t ng40 17506>20 belong 245 (NFC LLCP 17507>20 belong 247 (Infiniband 17508>20 belong 248 (SCTP 17509>16 belong x \b, capture length %d) 17510 175110 ubelong 0xa1b2c3d4 tcpdump capture file (big-endian) 17512!:mime application/vnd.tcpdump.pcap 17513>0 use pcap-be 175140 ulelong 0xa1b2c3d4 tcpdump capture file (little-endian) 17515!:mime application/vnd.tcpdump.pcap 17516>0 use \^pcap-be 17517 17518# 17519# "libpcap"-with-Alexey-Kuznetsov's-patches capture files. 17520# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is 17521# the main program that uses that format, but there are other programs 17522# that use "libpcap", or that use the same capture file format.) 17523# 175240 ubelong 0xa1b2cd34 extended tcpdump capture file (big-endian) 17525>0 use pcap-be 175260 ulelong 0xa1b2cd34 extended tcpdump capture file (little-endian) 17527>0 use \^pcap-be 17528 17529# 17530# "pcap-ng" capture files. 17531# http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html 17532# Pcap-ng files can contain multiple sections. Printing the endianness, 17533# snaplen, or other information from the first SHB may be misleading. 17534# 175350 ubelong 0x0a0d0d0a 17536>8 ubelong 0x1a2b3c4d pcap-ng capture file 17537>>12 beshort x - version %d 17538>>14 beshort x \b.%d 175390 ulelong 0x0a0d0d0a 17540>8 ulelong 0x1a2b3c4d pcap-ng capture file 17541>>12 leshort x - version %d 17542>>14 leshort x \b.%d 17543 17544# 17545# AIX "iptrace" capture files. 17546# 175470 string iptrace\ 1.0 "iptrace" capture file 175480 string iptrace\ 2.0 "iptrace" capture file 17549 17550# 17551# Novell LANalyzer capture files. 17552# 175530 leshort 0x1001 LANalyzer capture file 175540 leshort 0x1007 LANalyzer capture file 17555 17556# 17557# HP-UX "nettl" capture files. 17558# 175590 string \x54\x52\x00\x64\x00 "nettl" capture file 17560 17561# 17562# RADCOM WAN/LAN Analyzer capture files. 17563# 175640 string \x42\xd2\x00\x34\x12\x66\x22\x88 RADCOM WAN/LAN Analyzer capture file 17565 17566# 17567# NetStumbler log files. Not really packets, per se, but about as 17568# close as you can get. These are log files from NetStumbler, a 17569# Windows program, that scans for 802.11b networks. 17570# 175710 string NetS NetStumbler log file 17572>8 lelong x \b, %d stations found 17573 17574# 17575# *Peek tagged capture files. 17576# 175770 string \177ver EtherPeek/AiroPeek/OmniPeek capture file 17578 17579# 17580# Visual Networks traffic capture files. 17581# 175820 string \x05VNF Visual Networks traffic capture file 17583 17584# 17585# Network Instruments Observer capture files. 17586# 175870 string ObserverPktBuffe Network Instruments Observer capture file 17588 17589# 17590# Files from Accellent Group's 5View products. 17591# 175920 string \xaa\xaa\xaa\xaa 5View capture file 17593 17594#------------------------------------------------------------------------------ 17595# $File: softquad,v 1.13 2009/09/19 16:28:12 christos Exp $ 17596# softquad: file(1) magic for SoftQuad Publishing Software 17597# 17598# Author/Editor and RulesBuilder 17599# 17600# XXX - byte order? 17601# 176020 string \<!SQ\ DTD> Compiled SGML rules file 17603>9 string >\0 Type %s 176040 string \<!SQ\ A/E> A/E SGML Document binary 17605>9 string >\0 Type %s 176060 string \<!SQ\ STS> A/E SGML binary styles file 17607>9 string >\0 Type %s 176080 short 0xc0de Compiled PSI (v1) data 176090 short 0xc0da Compiled PSI (v2) data 17610>3 string >\0 (%s) 17611# Binary sqtroff font/desc files... 176120 short 0125252 SoftQuad DESC or font file binary 17613>2 short >0 - version %d 17614# Bitmaps... 176150 search/1 SQ\ BITMAP1 SoftQuad Raster Format text 17616#0 string SQ\ BITMAP2 SoftQuad Raster Format data 17617# sqtroff intermediate language (replacement for ditroff int. lang.) 176180 string X\ SoftQuad troff Context intermediate 17619>2 string 495 for AT&T 495 laser printer 17620>2 string hp for Hewlett-Packard LaserJet 17621>2 string impr for IMAGEN imPRESS 17622>2 string ps for PostScript 17623 17624# From: Michael Piefel <piefel@debian.org> 17625# sqtroff intermediate language (replacement for ditroff int. lang.) 176260 string X\ 495 SoftQuad troff Context intermediate for AT&T 495 laser printer 176270 string X\ hp SoftQuad troff Context intermediate for HP LaserJet 176280 string X\ impr SoftQuad troff Context intermediate for IMAGEN imPRESS 176290 string X\ ps SoftQuad troff Context intermediate for PostScript 17630 17631#------------------------------------------------------------------------------ 17632# $File: spec,v 1.4 2009/09/19 16:28:12 christos Exp $ 17633# spec: file(1) magic for SPEC raw results (*.raw, *.rsf) 17634# 17635# Cloyce D. Spradling <cloyce@headgear.org> 17636 176370 string spec SPEC 17638>4 string .cpu CPU 17639>>8 string <: \b%.4s 17640>>12 string . raw result text 17641 1764217 string version=SPECjbb SPECjbb 17643>32 string <: \b%.4s 17644>>37 string <: v%.4s raw result text 17645 176460 string BEGIN\040SPECWEB SPECweb 17647>13 string <: \b%.2s 17648>>15 string _SSL \b_SSL 17649>>>20 string <: v%.4s raw result text 17650>>16 string <: v%.4s raw result text 17651 17652#------------------------------------------------------------------------------ 17653# $File: spectrum,v 1.7 2010/09/20 18:55:20 rrt Exp $ 17654# spectrum: file(1) magic for Spectrum emulator files. 17655# 17656# John Elliott <jce@seasip.demon.co.uk> 17657 17658# 17659# Spectrum +3DOS header 17660# 176610 string PLUS3DOS\032 Spectrum +3 data 17662>15 byte 0 - BASIC program 17663>15 byte 1 - number array 17664>15 byte 2 - character array 17665>15 byte 3 - memory block 17666>>16 belong 0x001B0040 (screen) 17667>15 byte 4 - Tasword document 17668>15 string TAPEFILE - ZXT tapefile 17669# 17670# Tape file. This assumes the .TAP starts with a Spectrum-format header, 17671# which nearly all will. 17672# 17673# Update: Sanity-check string contents to be printable. 17674# -Adam Buchbinder <adam.buchbinder@gmail.com> 17675# 176760 string \023\000\000 17677>4 string >\0 17678>>4 string <\177 Spectrum .TAP data "%-10.10s" 17679>>>3 byte 0 - BASIC program 17680>>>3 byte 1 - number array 17681>>>3 byte 2 - character array 17682>>>3 byte 3 - memory block 17683>>>>14 belong 0x001B0040 (screen) 17684 17685# The following three blocks are from pak21-spectrum@srcf.ucam.org 17686# TZX tape images 176870 string ZXTape!\x1a Spectrum .TZX data 17688>8 byte x version %d 17689>9 byte x \b.%d 17690 17691# RZX input recording files 176920 string RZX! Spectrum .RZX data 17693>4 byte x version %d 17694>5 byte x \b.%d 17695 17696# Floppy disk images 176970 string MV\ -\ CPCEMU\ Disk-Fil Amstrad/Spectrum .DSK data 176980 string MV\ -\ CPC\ format\ Dis Amstrad/Spectrum DU54 .DSK data 176990 string EXTENDED\ CPC\ DSK\ Fil Amstrad/Spectrum Extended .DSK data 177000 string SINCLAIR Spectrum .SCL Betadisk image 17701 17702# Hard disk images 177030 string RS-IDE\x1a Spectrum .HDF hard disk image 17704>7 byte x \b, version 0x%02x 17705 17706#------------------------------------------------------------------------------ 17707# $File: sql,v 1.13 2013/08/27 04:02:33 christos Exp $ 17708# sql: file(1) magic for SQL files 17709# 17710# From: "Marty Leisner" <mleisner@eng.mc.xerox.com> 17711# Recognize some MySQL files. 17712# Elan Ruusamae <glen@delfi.ee>, added MariaDB signatures 17713# from https://bazaar.launchpad.net/~maria-captains/maria/5.5/view/head:/support-files/magic 17714# 177150 beshort 0xfe01 MySQL table definition file 17716>2 byte x Version %d 177170 belong&0xffffff00 0xfefe0700 MySQL MyISAM index file 17718>3 byte x Version %d 177190 belong&0xffffff00 0xfefe0800 MySQL MyISAM compressed data file 17720>3 byte x Version %d 177210 belong&0xffffff00 0xfefe0900 MySQL Maria index file 17722>3 byte x Version %d 177230 belong&0xffffff00 0xfefe0A00 MySQL Maria compressed data file 17724>3 byte x Version %d 177250 belong&0xffffff00 0xfefe0500 MySQL ISAM index file 17726>3 byte x Version %d 177270 belong&0xffffff00 0xfefe0600 MySQL ISAM compressed data file 17728>3 byte x Version %d 177290 string \376bin MySQL replication log 177300 belong&0xffffff00 0xfefe0b00 17731>4 string MARIALOG MySQL Maria transaction log file 17732>>3 byte x Version %d 177330 belong&0xffffff00 0xfefe0c00 17734>4 string MACF MySQL Maria control file 17735>>3 byte x Version %d 17736 17737#------------------------------------------------------------------------------ 17738# iRiver H Series database file 17739# From Ken Guest <ken@linux.ie> 17740# As observed from iRivNavi.iDB and unencoded firmware 17741# 177420 string iRivDB iRiver Database file 17743>11 string >\0 Version %s 17744>39 string iHP-100 [H Series] 17745 17746#------------------------------------------------------------------------------ 17747# SQLite database files 17748# Ken Guest <ken@linux.ie>, Ty Sarna, Zack Weinberg 17749# 17750# Version 1 used GDBM internally; its files cannot be distinguished 17751# from other GDBM files. 17752# 17753# Version 2 used this format: 177540 string **\ This\ file\ contains\ an\ SQLite SQLite 2.x database 17755 17756# Version 3 of SQLite allows applications to embed their own "user version" 17757# number in the database at offset 60. Later, SQLite added an "application id" 17758# at offset 68 that is preferred over "user version" for indicating the 17759# associated application. 17760# 177610 string SQLite\ format\ 3 17762>60 belong =0x5f4d544e Monotone source repository - SQLite3 database 17763>68 belong =0x0f055112 Fossil checkout - SQLite3 database 17764>68 belong =0x0f055113 Fossil global configuration - SQLite3 database 17765>68 belong =0x0f055111 Fossil repository - SQLite3 database 17766>68 belong =0x42654462 Bentley Systems BeSQLite Database - SQLite3 database 17767>68 belong =0x42654c6e Bentley Systems Localization File - SQLite3 database 17768>68 belong =0x47504b47 OGC GeoPackage file - SQLite3 database 17769>68 default x SQLite 3.x database 17770>>68 belong !0 \b, application id %u 17771>>60 belong !0 \b, user version %d 17772 17773# SQLite Write-Ahead Log from SQLite version >= 3.7.0 17774# http://www.sqlite.org/fileformat.html#walformat 177750 belong&0xfffffffe 0x377f0682 SQLite Write-Ahead Log, 17776>4 belong x version %ld 17777 17778# SQLite Rollback Journal 17779# http://www.sqlite.org/fileformat.html#rollbackjournal 177800 string \xd9\xd5\x05\xf9\x20\xa1\x63\xd7 SQLite Rollback Journal 17781 17782# Panasonic channel list database svl.bin or svl.db added by Joerg Jenderek 17783# http://www.ullrich.es/job/service-menue/panasonic/panasonic-sendersortierung-sat-am-pc/ 17784# pceditor_V2003.jar 177850 string PSDB\0 Panasonic channel list database 17786>126 string SQLite\ format\ 3 17787>>&-15 indirect x \b; contains 17788# Type: OpenSSH key files 17789# From: Nicolas Collignon <tsointsoin@gmail.com> 17790 177910 string SSH\ PRIVATE\ KEY OpenSSH RSA1 private key, 17792>28 string >\0 version %s 17793 177940 string ssh-dss\ OpenSSH DSA public key 177950 string ssh-rsa\ OpenSSH RSA public key 177960 string ecdsa-sha2-nistp256 OpenSSH ECDSA public key 177970 string ecdsa-sha2-nistp384 OpenSSH ECDSA public key 177980 string ecdsa-sha2-nistp521 OpenSSH ECDSA public key 17799# Type: OpenSSL certificates/key files 17800# From: Nicolas Collignon <tsointsoin@gmail.com> 17801 178020 string -----BEGIN\ CERTIFICATE----- PEM certificate 178030 string -----BEGIN\ CERTIFICATE\ REQ PEM certificate request 178040 string -----BEGIN\ RSA\ PRIVATE PEM RSA private key 178050 string -----BEGIN\ DSA\ PRIVATE PEM DSA private key 178060 string -----BEGIN\ EC\ PRIVATE PEM EC private key 17807 17808#------------------------------------------------------------------------------ 17809# $File: sun,v 1.25 2013/01/09 22:37:24 christos Exp $ 17810# sun: file(1) magic for Sun machines 17811# 17812# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x 17813# releases. (5.x uses ELF.) Entries for executables without an 17814# architecture type, used before the 68020-based Sun-3's came out, 17815# are in aout, as they're indistinguishable from other big-endian 17816# 32-bit a.out files. 17817# 178180 belong&077777777 0600413 a.out SunOS sparc demand paged 17819>0 byte &0x80 17820>>20 belong <4096 shared library 17821>>20 belong =4096 dynamically linked executable 17822>>20 belong >4096 dynamically linked executable 17823>0 byte ^0x80 executable 17824>16 belong >0 not stripped 17825 178260 belong&077777777 0600410 a.out SunOS sparc pure 17827>0 byte &0x80 dynamically linked executable 17828>0 byte ^0x80 executable 17829>16 belong >0 not stripped 17830 178310 belong&077777777 0600407 a.out SunOS sparc 17832>0 byte &0x80 dynamically linked executable 17833>0 byte ^0x80 executable 17834>16 belong >0 not stripped 17835 178360 belong&077777777 0400413 a.out SunOS mc68020 demand paged 17837>0 byte &0x80 17838>>20 belong <4096 shared library 17839>>20 belong =4096 dynamically linked executable 17840>>20 belong >4096 dynamically linked executable 17841>0 byte ^0x80 executable 17842>16 belong >0 not stripped 17843 178440 belong&077777777 0400410 a.out SunOS mc68020 pure 17845>0 byte &0x80 dynamically linked executable 17846>0 byte ^0x80 executable 17847>16 belong >0 not stripped 17848 178490 belong&077777777 0400407 a.out SunOS mc68020 17850>0 byte &0x80 dynamically linked executable 17851>0 byte ^0x80 executable 17852>16 belong >0 not stripped 17853 178540 belong&077777777 0200413 a.out SunOS mc68010 demand paged 17855>0 byte &0x80 17856>>20 belong <4096 shared library 17857>>20 belong =4096 dynamically linked executable 17858>>20 belong >4096 dynamically linked executable 17859>0 byte ^0x80 executable 17860>16 belong >0 not stripped 17861 178620 belong&077777777 0200410 a.out SunOS mc68010 pure 17863>0 byte &0x80 dynamically linked executable 17864>0 byte ^0x80 executable 17865>16 belong >0 not stripped 17866 178670 belong&077777777 0200407 a.out SunOS mc68010 17868>0 byte &0x80 dynamically linked executable 17869>0 byte ^0x80 executable 17870>16 belong >0 not stripped 17871 17872# 17873# Core files. "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC 17874# binary executed in compatibility mode under SunOS 5.x". 17875# 178760 belong 0x080456 SunOS core file 17877>4 belong 432 (SPARC) 17878>>132 string >\0 from '%s' 17879>>116 belong =3 (quit) 17880>>116 belong =4 (illegal instruction) 17881>>116 belong =5 (trace trap) 17882>>116 belong =6 (abort) 17883>>116 belong =7 (emulator trap) 17884>>116 belong =8 (arithmetic exception) 17885>>116 belong =9 (kill) 17886>>116 belong =10 (bus error) 17887>>116 belong =11 (segmentation violation) 17888>>116 belong =12 (bad argument to system call) 17889>>116 belong =29 (resource lost) 17890>>120 belong x (T=%dK, 17891>>124 belong x D=%dK, 17892>>128 belong x S=%dK) 17893>4 belong 826 (68K) 17894>>128 string >\0 from '%s' 17895>4 belong 456 (SPARC 4.x BCP) 17896>>152 string >\0 from '%s' 17897# Sun SunPC 178980 long 0xfa33c08e SunPC 4.0 Hard Disk 178990 string #SUNPC_CONFIG SunPC 4.0 Properties Values 17900# Sun snoop (see RFC 1761, which describes the capture file format, 17901# RFC 3827, which describes some additional datalink types, and 17902# http://www.iana.org/assignments/snoop-datalink-types/snoop-datalink-types.xml, 17903# which is the IANA registry of Snoop datalink types) 17904# 179050 string snoop Snoop capture file 17906>8 belong >0 - version %ld 17907>12 belong 0 (IEEE 802.3) 17908>12 belong 1 (IEEE 802.4) 17909>12 belong 2 (IEEE 802.5) 17910>12 belong 3 (IEEE 802.6) 17911>12 belong 4 (Ethernet) 17912>12 belong 5 (HDLC) 17913>12 belong 6 (Character synchronous) 17914>12 belong 7 (IBM channel-to-channel adapter) 17915>12 belong 8 (FDDI) 17916>12 belong 9 (Other) 17917>12 belong 10 (type %ld) 17918>12 belong 11 (type %ld) 17919>12 belong 12 (type %ld) 17920>12 belong 13 (type %ld) 17921>12 belong 14 (type %ld) 17922>12 belong 15 (type %ld) 17923>12 belong 16 (Fibre Channel) 17924>12 belong 17 (ATM) 17925>12 belong 18 (ATM Classical IP) 17926>12 belong 19 (type %ld) 17927>12 belong 20 (type %ld) 17928>12 belong 21 (type %ld) 17929>12 belong 22 (type %ld) 17930>12 belong 23 (type %ld) 17931>12 belong 24 (type %ld) 17932>12 belong 25 (type %ld) 17933>12 belong 26 (IP over Infiniband) 17934>12 belong >26 (type %ld) 17935 17936#--------------------------------------------------------------------------- 17937# The following entries have been tested by Duncan Laurie <duncan@sun.com> (a 17938# lead Sun/Cobalt developer) who agrees that they are good and worthy of 17939# inclusion. 17940 17941# Boot ROM images for Sun/Cobalt Linux server appliances 179420 string Cobalt\ Networks\ Inc.\nFirmware\ v Paged COBALT boot rom 17943>38 string x V%.4s 17944 17945# New format for Sun/Cobalt boot ROMs is annoying, it stores the version code 17946# at the very end where file(1) can't get it. 179470 string CRfs COBALT boot rom data (Flat boot rom or file system) 17948 17949#------------------------------------------------------------------------------ 17950# msx: file(1) magic for the SymbOS operating system 17951# http://www.symbos.de 17952# Fábio R. Schmidlin <frs@pop.com.br> 17953 17954# SymbOS EXE file 179550x30 string SymExe SymbOS executable 17956>0x36 ubyte x v%c 17957>0x37 ubyte x \b.%c 17958>0xF string x \b, name: %s 17959 17960# SymbOS DOX document 179610 string INFOq\0 SymbOS DOX document 17962 17963# Symbos driver 179640 string SMD1 SymbOS driver 17965>19 byte x \b, name: %c 17966>20 byte x \b%c 17967>21 byte x \b%c 17968>22 byte x \b%c 17969>23 byte x \b%c 17970>24 byte x \b%c 17971>25 byte x \b%c 17972>26 byte x \b%c 17973>27 byte x \b%c 17974>28 byte x \b%c 17975>29 byte x \b%c 17976>30 byte x \b%c 17977>31 byte x \b%c 17978 17979# Symbos video 179800 string SymVid SymbOS video 17981>6 ubyte x v%c 17982>7 ubyte x \b.%c 17983 17984# Soundtrakker 128 ST2 music 179850 byte 0 17986>0xC string \x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x40\x00 Soundtrakker 128 ST2 music, 17987>>1 string x name: %s 17988 17989 17990 17991#------------------------------------------------------------------------ 17992# $File: sysex,v 1.7 2013/09/16 15:12:42 christos Exp $ 17993# sysex: file(1) magic for MIDI sysex files 17994# 17995# GRR: orginal 1 byte test at offset was too general as it catches also many FATs of DOS filesystems 17996# where real SYStem EXclusive messages at offset 1 are limited to seven bits 17997# http://en.wikipedia.org/wiki/MIDI 179980 ubeshort&0xFF80 0xF000 SysEx File - 17999 18000# North American Group 18001>1 byte 0x01 Sequential 18002>1 byte 0x02 IDP 18003>1 byte 0x03 OctavePlateau 18004>1 byte 0x04 Moog 18005>1 byte 0x05 Passport 18006>1 byte 0x06 Lexicon 18007>1 byte 0x07 Kurzweil/Future Retro 18008>>3 byte 0x77 777 18009>>4 byte 0x00 Bank 18010>>4 byte 0x01 Song 18011>>5 byte 0x0f 16 18012>>5 byte 0x0e 15 18013>>5 byte 0x0d 14 18014>>5 byte 0x0c 13 18015>>5 byte 0x0b 12 18016>>5 byte 0x0a 11 18017>>5 byte 0x09 10 18018>>5 byte 0x08 9 18019>>5 byte 0x07 8 18020>>5 byte 0x06 7 18021>>5 byte 0x05 6 18022>>5 byte 0x04 5 18023>>5 byte 0x03 4 18024>>5 byte 0x02 3 18025>>5 byte 0x01 2 18026>>5 byte 0x00 1 18027>>5 byte 0x10 (ALL) 18028>>2 byte x \b, Channel %d 18029>1 byte 0x08 Fender 18030>1 byte 0x09 Gulbransen 18031>1 byte 0x0a AKG 18032>1 byte 0x0b Voyce 18033>1 byte 0x0c Waveframe 18034>1 byte 0x0d ADA 18035>1 byte 0x0e Garfield 18036>1 byte 0x0f Ensoniq 18037>1 byte 0x10 Oberheim 18038>>2 byte 0x06 Matrix 6 series 18039>>3 byte 0x0A Dump (All) 18040>>3 byte 0x01 Dump (Bank) 18041>>4 belong 0x0002040E Matrix 1000 18042>>>11 byte <2 User bank %d 18043>>>11 byte >1 Preset bank %d 18044>1 byte 0x11 Apple 18045>1 byte 0x12 GreyMatter 18046>1 byte 0x14 PalmTree 18047>1 byte 0x15 JLCooper 18048>1 byte 0x16 Lowrey 18049>1 byte 0x17 AdamsSmith 18050>1 byte 0x18 E-mu 18051>1 byte 0x19 Harmony 18052>1 byte 0x1a ART 18053>1 byte 0x1b Baldwin 18054>1 byte 0x1c Eventide 18055>1 byte 0x1d Inventronics 18056>1 byte 0x1f Clarity 18057 18058# European Group 18059>1 byte 0x21 SIEL 18060>1 byte 0x22 Synthaxe 18061>1 byte 0x24 Hohner 18062>1 byte 0x25 Twister 18063>1 byte 0x26 Solton 18064>1 byte 0x27 Jellinghaus 18065>1 byte 0x28 Southworth 18066>1 byte 0x29 PPG 18067>1 byte 0x2a JEN 18068>1 byte 0x2b SSL 18069>1 byte 0x2c AudioVertrieb 18070 18071>1 byte 0x2f ELKA 18072>>3 byte 0x09 EK-44 18073 18074>1 byte 0x30 Dynacord 18075>1 byte 0x31 Jomox 18076>1 byte 0x33 Clavia 18077>1 byte 0x39 Soundcraft 18078# Some Waldorf info from http://Stromeko.Synth.net/Downloads#WaldorfDocs 18079>1 byte 0x3e Waldorf 18080>>2 byte 0x00 microWave 18081>>2 byte 0x0E microwave2 / XT 18082>>2 byte 0x0F Q / Q+ 18083>>3 byte =0 (default id) 18084>>3 byte >0 ( 18085>>>3 byte <0x7F \bdevice %d) 18086>>>3 byte =0x7F \bbroadcast id) 18087>>3 byte 0x7f Microwave I 18088>>>4 byte 0x00 SNDR (Sound Request) 18089>>>4 byte 0x10 SNDD (Sound Dump) 18090>>>4 byte 0x20 SNDP (Sound Parameter Change) 18091>>>4 byte 0x30 SNDQ (Sound Parameter Inquiry) 18092>>>4 byte 0x70 BOOT (Sound Reserved) 18093>>>4 byte 0x01 MULR (Multi Request) 18094>>>4 byte 0x11 MULD (Multi Dump) 18095>>>4 byte 0x21 MULP (Multi Parameter Change) 18096>>>4 byte 0x31 MULQ (Multi Parameter Inquiry) 18097>>>4 byte 0x71 OS (Multi Reserved) 18098>>>4 byte 0x02 DRMR (Drum Map Request) 18099>>>4 byte 0x12 DRMD (Drum Map Dump) 18100>>>4 byte 0x22 DRMP (Drum Map Parameter Change) 18101>>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry) 18102>>>4 byte 0x72 BIN (Drum Map Reserved) 18103>>>4 byte 0x03 PATR (Sequencer Pattern Request) 18104>>>4 byte 0x13 PATD (Sequencer Pattern Dump) 18105>>>4 byte 0x23 PATP (Sequencer Pattern Parameter Change) 18106>>>4 byte 0x33 PATQ (Sequencer Pattern Parameter Inquiry) 18107>>>4 byte 0x73 AFM (Sequencer Pattern Reserved) 18108>>>4 byte 0x04 GLBR (Global Parameter Request) 18109>>>4 byte 0x14 GLBD (Global Parameter Dump) 18110>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) 18111>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) 18112>>>4 byte 0x07 MODR (Mode Parameter Request) 18113>>>4 byte 0x17 MODD (Mode Parameter Dump) 18114>>>4 byte 0x27 MODP (Mode Parameter Parameter Change) 18115>>>4 byte 0x37 MODQ (Mode Parameter Parameter Inquiry) 18116>>2 byte 0x10 microQ 18117>>>4 byte 0x00 SNDR (Sound Request) 18118>>>4 byte 0x10 SNDD (Sound Dump) 18119>>>4 byte 0x20 SNDP (Sound Parameter Change) 18120>>>4 byte 0x30 SNDQ (Sound Parameter Inquiry) 18121>>>4 byte 0x70 (Sound Reserved) 18122>>>4 byte 0x01 MULR (Multi Request) 18123>>>4 byte 0x11 MULD (Multi Dump) 18124>>>4 byte 0x21 MULP (Multi Parameter Change) 18125>>>4 byte 0x31 MULQ (Multi Parameter Inquiry) 18126>>>4 byte 0x71 OS (Multi Reserved) 18127>>>4 byte 0x02 DRMR (Drum Map Request) 18128>>>4 byte 0x12 DRMD (Drum Map Dump) 18129>>>4 byte 0x22 DRMP (Drum Map Parameter Change) 18130>>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry) 18131>>>4 byte 0x72 BIN (Drum Map Reserved) 18132>>>4 byte 0x04 GLBR (Global Parameter Request) 18133>>>4 byte 0x14 GLBD (Global Parameter Dump) 18134>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) 18135>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) 18136>>2 byte 0x11 rackAttack 18137>>>4 byte 0x00 SNDR (Sound Parameter Request) 18138>>>4 byte 0x10 SNDD (Sound Parameter Dump) 18139>>>4 byte 0x20 SNDP (Sound Parameter Parameter Change) 18140>>>4 byte 0x30 SNDQ (Sound Parameter Parameter Inquiry) 18141>>>4 byte 0x01 PRGR (Program Parameter Request) 18142>>>4 byte 0x11 PRGD (Program Parameter Dump) 18143>>>4 byte 0x21 PRGP (Program Parameter Parameter Change) 18144>>>4 byte 0x31 PRGQ (Program Parameter Parameter Inquiry) 18145>>>4 byte 0x71 OS (Program Parameter Reserved) 18146>>>4 byte 0x03 PATR (Pattern Parameter Request) 18147>>>4 byte 0x13 PATD (Pattern Parameter Dump) 18148>>>4 byte 0x23 PATP (Pattern Parameter Parameter Change) 18149>>>4 byte 0x33 PATQ (Pattern Parameter Parameter Inquiry) 18150>>>4 byte 0x04 GLBR (Global Parameter Request) 18151>>>4 byte 0x14 GLBD (Global Parameter Dump) 18152>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) 18153>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) 18154>>>4 byte 0x05 EFXR (FX Parameter Request) 18155>>>4 byte 0x15 EFXD (FX Parameter Dump) 18156>>>4 byte 0x25 EFXP (FX Parameter Parameter Change) 18157>>>4 byte 0x35 EFXQ (FX Parameter Parameter Inquiry) 18158>>>4 byte 0x07 MODR (Mode Command Request) 18159>>>4 byte 0x17 MODD (Mode Command Dump) 18160>>>4 byte 0x27 MODP (Mode Command Parameter Change) 18161>>>4 byte 0x37 MODQ (Mode Command Parameter Inquiry) 18162>>2 byte 0x03 Wave 18163>>>4 byte 0x00 SBPR (Soundprogram) 18164>>>4 byte 0x01 SAPR (Performance) 18165>>>4 byte 0x02 SWAVE (Wave) 18166>>>4 byte 0x03 SWTBL (Wave control table) 18167>>>4 byte 0x04 SVT (Velocity Curve) 18168>>>4 byte 0x05 STT (Tuning Table) 18169>>>4 byte 0x06 SGLB (Global Parameters) 18170>>>4 byte 0x07 SARRMAP (Performance Program Change Map) 18171>>>4 byte 0x08 SBPRMAP (Sound Program Change Map) 18172>>>4 byte 0x09 SBPRPAR (Sound Parameter) 18173>>>4 byte 0x0A SARRPAR (Performance Parameter) 18174>>>4 byte 0x0B SINSPAR (Instrument/External Parameter) 18175>>>4 byte 0x0F SBULK (Bulk Switch on/off) 18176 18177# Japanese Group 18178>1 byte 0x40 Kawai 18179>>3 byte 0x20 K1 18180>>3 byte 0x22 K4 18181 18182>1 byte 0x41 Roland 18183>>3 byte 0x14 D-50 18184>>3 byte 0x2b U-220 18185>>3 byte 0x02 TR-707 18186 18187>1 byte 0x42 Korg 18188>>3 byte 0x19 M1 18189 18190>1 byte 0x43 Yamaha 18191>1 byte 0x44 Casio 18192>1 byte 0x46 Kamiya 18193>1 byte 0x47 Akai 18194>1 byte 0x48 Victor 18195>1 byte 0x49 Mesosha 18196>1 byte 0x4b Fujitsu 18197>1 byte 0x4c Sony 18198>1 byte 0x4e Teac 18199>1 byte 0x50 Matsushita 18200>1 byte 0x51 Fostex 18201>1 byte 0x52 Zoom 18202>1 byte 0x54 Matsushita 18203>1 byte 0x57 Acoustic tech. lab. 18204# http://www.midi.org/techspecs/manid.php 18205>1 belong&0xffffff00 0x00007400 Ta Horng 18206>1 belong&0xffffff00 0x00007500 e-Tek 18207>1 belong&0xffffff00 0x00007600 E-Voice 18208>1 belong&0xffffff00 0x00007700 Midisoft 18209>1 belong&0xffffff00 0x00007800 Q-Sound 18210>1 belong&0xffffff00 0x00007900 Westrex 18211>1 belong&0xffffff00 0x00007a00 Nvidia* 18212>1 belong&0xffffff00 0x00007b00 ESS 18213>1 belong&0xffffff00 0x00007c00 Mediatrix 18214>1 belong&0xffffff00 0x00007d00 Brooktree 18215>1 belong&0xffffff00 0x00007e00 Otari 18216>1 belong&0xffffff00 0x00007f00 Key Electronics 18217>1 belong&0xffffff00 0x00010000 Shure 18218>1 belong&0xffffff00 0x00010100 AuraSound 18219>1 belong&0xffffff00 0x00010200 Crystal 18220>1 belong&0xffffff00 0x00010300 Rockwell 18221>1 belong&0xffffff00 0x00010400 Silicon Graphics 18222>1 belong&0xffffff00 0x00010500 Midiman 18223>1 belong&0xffffff00 0x00010600 PreSonus 18224>1 belong&0xffffff00 0x00010800 Topaz 18225>1 belong&0xffffff00 0x00010900 Cast Lightning 18226>1 belong&0xffffff00 0x00010a00 Microsoft 18227>1 belong&0xffffff00 0x00010b00 Sonic Foundry 18228>1 belong&0xffffff00 0x00010c00 Line 6 18229>1 belong&0xffffff00 0x00010d00 Beatnik Inc. 18230>1 belong&0xffffff00 0x00010e00 Van Koerving 18231>1 belong&0xffffff00 0x00010f00 Altech Systems 18232>1 belong&0xffffff00 0x00011000 S & S Research 18233>1 belong&0xffffff00 0x00011100 VLSI Technology 18234>1 belong&0xffffff00 0x00011200 Chromatic 18235>1 belong&0xffffff00 0x00011300 Sapphire 18236>1 belong&0xffffff00 0x00011400 IDRC 18237>1 belong&0xffffff00 0x00011500 Justonic Tuning 18238>1 belong&0xffffff00 0x00011600 TorComp 18239>1 belong&0xffffff00 0x00011700 Newtek Inc. 18240>1 belong&0xffffff00 0x00011800 Sound Sculpture 18241>1 belong&0xffffff00 0x00011900 Walker Technical 18242>1 belong&0xffffff00 0x00011a00 Digital Harmony 18243>1 belong&0xffffff00 0x00011b00 InVision 18244>1 belong&0xffffff00 0x00011c00 T-Square 18245>1 belong&0xffffff00 0x00011d00 Nemesys 18246>1 belong&0xffffff00 0x00011e00 DBX 18247>1 belong&0xffffff00 0x00011f00 Syndyne 18248>1 belong&0xffffff00 0x00012000 Bitheadz 18249>1 belong&0xffffff00 0x00012100 Cakewalk 18250>1 belong&0xffffff00 0x00012200 Staccato 18251>1 belong&0xffffff00 0x00012300 National Semicon. 18252>1 belong&0xffffff00 0x00012400 Boom Theory 18253>1 belong&0xffffff00 0x00012500 Virtual DSP Corp 18254>1 belong&0xffffff00 0x00012600 Antares 18255>1 belong&0xffffff00 0x00012700 Angel Software 18256>1 belong&0xffffff00 0x00012800 St Louis Music 18257>1 belong&0xffffff00 0x00012900 Lyrrus dba G-VOX 18258>1 belong&0xffffff00 0x00012a00 Ashley Audio 18259>1 belong&0xffffff00 0x00012b00 Vari-Lite 18260>1 belong&0xffffff00 0x00012c00 Summit Audio 18261>1 belong&0xffffff00 0x00012d00 Aureal Semicon. 18262>1 belong&0xffffff00 0x00012e00 SeaSound 18263>1 belong&0xffffff00 0x00012f00 U.S. Robotics 18264>1 belong&0xffffff00 0x00013000 Aurisis 18265>1 belong&0xffffff00 0x00013100 Nearfield Multimedia 18266>1 belong&0xffffff00 0x00013200 FM7 Inc. 18267>1 belong&0xffffff00 0x00013300 Swivel Systems 18268>1 belong&0xffffff00 0x00013400 Hyperactive 18269>1 belong&0xffffff00 0x00013500 MidiLite 18270>1 belong&0xffffff00 0x00013600 Radical 18271>1 belong&0xffffff00 0x00013700 Roger Linn 18272>1 belong&0xffffff00 0x00013800 Helicon 18273>1 belong&0xffffff00 0x00013900 Event 18274>1 belong&0xffffff00 0x00013a00 Sonic Network 18275>1 belong&0xffffff00 0x00013b00 Realtime Music 18276>1 belong&0xffffff00 0x00013c00 Apogee Digital 18277 18278>1 belong&0xffffff00 0x00202b00 Medeli Electronics 18279>1 belong&0xffffff00 0x00202c00 Charlie Lab 18280>1 belong&0xffffff00 0x00202d00 Blue Chip Music 18281>1 belong&0xffffff00 0x00202e00 BEE OH Corp 18282>1 belong&0xffffff00 0x00202f00 LG Semicon America 18283>1 belong&0xffffff00 0x00203000 TESI 18284>1 belong&0xffffff00 0x00203100 EMAGIC 18285>1 belong&0xffffff00 0x00203200 Behringer 18286>1 belong&0xffffff00 0x00203300 Access Music 18287>1 belong&0xffffff00 0x00203400 Synoptic 18288>1 belong&0xffffff00 0x00203500 Hanmesoft Corp 18289>1 belong&0xffffff00 0x00203600 Terratec 18290>1 belong&0xffffff00 0x00203700 Proel SpA 18291>1 belong&0xffffff00 0x00203800 IBK MIDI 18292>1 belong&0xffffff00 0x00203900 IRCAM 18293>1 belong&0xffffff00 0x00203a00 Propellerhead Software 18294>1 belong&0xffffff00 0x00203b00 Red Sound Systems 18295>1 belong&0xffffff00 0x00203c00 Electron ESI AB 18296>1 belong&0xffffff00 0x00203d00 Sintefex Audio 18297>1 belong&0xffffff00 0x00203e00 Music and More 18298>1 belong&0xffffff00 0x00203f00 Amsaro 18299>1 belong&0xffffff00 0x00204000 CDS Advanced Technology 18300>1 belong&0xffffff00 0x00204100 Touched by Sound 18301>1 belong&0xffffff00 0x00204200 DSP Arts 18302>1 belong&0xffffff00 0x00204300 Phil Rees Music 18303>1 belong&0xffffff00 0x00204400 Stamer Musikanlagen GmbH 18304>1 belong&0xffffff00 0x00204500 Soundart 18305>1 belong&0xffffff00 0x00204600 C-Mexx Software 18306>1 belong&0xffffff00 0x00204700 Klavis Tech. 18307>1 belong&0xffffff00 0x00204800 Noteheads AB 18308 183090 string T707 Roland TR-707 Data 18310#------------------------------------------------------------------------------ 18311# file: file(1) magic for Tcl scripting language 18312# URL: http://www.tcl.tk/ 18313# From: gustaf neumann 18314 18315# Tcl scripts 183160 search/1/w #!\ /usr/bin/tcl Tcl script text executable 18317!:mime text/x-tcl 183180 search/1/w #!\ /usr/local/bin/tcl Tcl script text executable 18319!:mime text/x-tcl 183200 search/1 #!/usr/bin/env\ tcl Tcl script text executable 18321!:mime text/x-tcl 183220 search/1 #!\ /usr/bin/env\ tcl Tcl script text executable 18323!:mime text/x-tcl 183240 search/1/w #!\ /usr/bin/wish Tcl/Tk script text executable 18325!:mime text/x-tcl 183260 search/1/w #!\ /usr/local/bin/wish Tcl/Tk script text executable 18327!:mime text/x-tcl 183280 search/1 #!/usr/bin/env\ wish Tcl/Tk script text executable 18329!:mime text/x-tcl 183300 search/1 #!\ /usr/bin/env\ wish Tcl/Tk script text executable 18331!:mime text/x-tcl 18332 18333# check the first line 183340 search/1 package\ req 18335>0 regex \^package[\ \t]+req Tcl script 18336# not 'p', check other lines 183370 search/1 !p 18338>0 regex \^package[\ \t]+req Tcl script 18339 18340#------------------------------------------------------------------------------ 18341# $File: teapot,v 1.4 2009/09/19 16:28:12 christos Exp $ 18342# teapot: file(1) magic for "teapot" spreadsheet 18343# 183440 string #!teapot\012xdr teapot work sheet (XDR format) 18345 18346#------------------------------------------------------------------------------ 18347# $File: terminfo,v 1.6 2009/09/19 16:28:12 christos Exp $ 18348# terminfo: file(1) magic for terminfo 18349# 18350# XXX - byte order for screen images? 18351# 183520 string \032\001 Compiled terminfo entry 183530 short 0433 Curses screen image 183540 short 0434 Curses screen image 18355 18356#------------------------------------------------------------------------------ 18357# $File: tex,v 1.19 2013/09/17 17:39:16 christos Exp $ 18358# tex: file(1) magic for TeX files 18359# 18360# XXX - needs byte-endian stuff (big-endian and little-endian DVI?) 18361# 18362# From <conklin@talisman.kaleida.com> 18363 18364# Although we may know the offset of certain text fields in TeX DVI 18365# and font files, we can't use them reliably because they are not 18366# zero terminated. [but we do anyway, christos] 183670 string \367\002 TeX DVI file 18368!:mime application/x-dvi 18369>16 string >\0 (%s) 183700 string \367\203 TeX generic font data 183710 string \367\131 TeX packed font data 18372>3 string >\0 (%s) 183730 string \367\312 TeX virtual font data 183740 search/1 This\ is\ TeX, TeX transcript text 183750 search/1 This\ is\ METAFONT, METAFONT transcript text 18376 18377# There is no way to detect TeX Font Metric (*.tfm) files without 18378# breaking them apart and reading the data. The following patterns 18379# match most *.tfm files generated by METAFONT or afm2tfm. 183802 string \000\021 TeX font metric data 18381!:mime application/x-tex-tfm 18382>33 string >\0 (%s) 183832 string \000\022 TeX font metric data 18384!:mime application/x-tex-tfm 18385>33 string >\0 (%s) 18386 18387# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com) 183880 search/1 \\input\ texinfo Texinfo source text 18389!:mime text/x-texinfo 183900 search/1 This\ is\ Info\ file GNU Info text 18391!:mime text/x-info 18392 18393# TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com) 183940 search/4096 \\input TeX document text 18395!:mime text/x-tex 18396!:strength + 15 183970 search/4096 \\begin LaTeX document text 18398!:mime text/x-tex 18399!:strength + 15 184000 search/4096 \\section LaTeX document text 18401!:mime text/x-tex 18402!:strength + 18 184030 search/4096 \\setlength LaTeX document text 18404!:mime text/x-tex 18405!:strength + 15 184060 search/4096 \\documentstyle LaTeX document text 18407!:mime text/x-tex 18408!:strength + 18 184090 search/4096 \\chapter LaTeX document text 18410!:mime text/x-tex 18411!:strength + 18 184120 search/4096 \\documentclass LaTeX 2e document text 18413!:mime text/x-tex 18414!:strength + 15 184150 search/4096 \\relax LaTeX auxiliary file 18416!:mime text/x-tex 18417!:strength + 15 184180 search/4096 \\contentsline LaTeX table of contents 18419!:mime text/x-tex 18420!:strength + 15 184210 search/4096 %\ -*-latex-*- LaTeX document text 18422!:mime text/x-tex 18423 18424# Tex document, from Hendrik Scholz <hendrik@scholz.net> 184250 search/1 \\ifx TeX document text 18426 18427# Index and glossary files 184280 search/4096 \\indexentry LaTeX raw index file 184290 search/4096 \\begin{theindex} LaTeX sorted index 184300 search/4096 \\glossaryentry LaTeX raw glossary 184310 search/4096 \\begin{theglossary} LaTeX sorted glossary 184320 search/4096 This\ is\ makeindex Makeindex log file 18433 18434# End of TeX 18435 18436#------------------------------------------------------------------------------ 18437# file(1) magic for BibTex text files 18438# From Hendrik Scholz <hendrik@scholz.net> 18439 184400 search/1/c @article{ BibTeX text file 184410 search/1/c @book{ BibTeX text file 184420 search/1/c @inbook{ BibTeX text file 184430 search/1/c @incollection{ BibTeX text file 184440 search/1/c @inproceedings{ BibTeX text file 184450 search/1/c @manual{ BibTeX text file 184460 search/1/c @misc{ BibTeX text file 184470 search/1/c @preamble{ BibTeX text file 184480 search/1/c @phdthesis{ BibTeX text file 184490 search/1/c @techreport{ BibTeX text file 184500 search/1/c @unpublished{ BibTeX text file 18451 1845273 search/1 %%%\ \ BibTeX-file{ BibTex text file (with full header) 18453 1845473 search/1 %%%\ \ @BibTeX-style-file{ BibTeX style text file (with full header) 18455 184560 search/1 %\ BibTeX\ standard\ bibliography\ BibTeX standard bibliography style text file 18457 184580 search/1 %\ BibTeX\ ` BibTeX custom bibliography style text file 18459 184600 search/1 @c\ @mapfile{ TeX font aliases text file 18461 184620 string #LyX LyX document text 18463 18464#------------------------------------------------------------------------------ 18465# $File: tgif,v 1.7 2010/09/20 19:03:46 rrt Exp $ 18466# file(1) magic for tgif(1) files 18467# From Hendrik Scholz <hendrik@scholz.net> 184680 string %TGIF\ Tgif file version 18469>6 string x %s 18470 18471#------------------------------------------------------------------------------ 18472# $File: ti-8x,v 1.6 2009/09/19 16:28:12 christos Exp $ 18473# ti-8x: file(1) magic for the TI-8x and TI-9x Graphing Calculators. 18474# 18475# From: Ryan McGuire (rmcguire@freenet.columbus.oh.us). 18476# 18477# Update: Romain Lievin (roms@lpg.ticalc.org). 18478# 18479# NOTE: This list is not complete. 18480# Files for the TI-80 and TI-81 are pretty rare. I'm not going to put the 18481# program/group magic numbers in here because I cannot find any. 184820 string **TI80** TI-80 Graphing Calculator File. 184830 string **TI81** TI-81 Graphing Calculator File. 18484# 18485# Magic Numbers for the TI-73 18486# 184870 string **TI73** TI-73 Graphing Calculator 18488>0x00003B byte 0x00 (real number) 18489>0x00003B byte 0x01 (list) 18490>0x00003B byte 0x02 (matrix) 18491>0x00003B byte 0x03 (equation) 18492>0x00003B byte 0x04 (string) 18493>0x00003B byte 0x05 (program) 18494>0x00003B byte 0x06 (assembly program) 18495>0x00003B byte 0x07 (picture) 18496>0x00003B byte 0x08 (gdb) 18497>0x00003B byte 0x0C (complex number) 18498>0x00003B byte 0x0F (window settings) 18499>0x00003B byte 0x10 (zoom) 18500>0x00003B byte 0x11 (table setup) 18501>0x00003B byte 0x13 (backup) 18502 18503# Magic Numbers for the TI-82 18504# 185050 string **TI82** TI-82 Graphing Calculator 18506>0x00003B byte 0x00 (real) 18507>0x00003B byte 0x01 (list) 18508>0x00003B byte 0x02 (matrix) 18509>0x00003B byte 0x03 (Y-variable) 18510>0x00003B byte 0x05 (program) 18511>0x00003B byte 0x06 (protected prgm) 18512>0x00003B byte 0x07 (picture) 18513>0x00003B byte 0x08 (gdb) 18514>0x00003B byte 0x0B (window settings) 18515>0x00003B byte 0x0C (window settings) 18516>0x00003B byte 0x0D (table setup) 18517>0x00003B byte 0x0E (screenshot) 18518>0x00003B byte 0x0F (backup) 18519# 18520# Magic Numbers for the TI-83 18521# 185220 string **TI83** TI-83 Graphing Calculator 18523>0x00003B byte 0x00 (real) 18524>0x00003B byte 0x01 (list) 18525>0x00003B byte 0x02 (matrix) 18526>0x00003B byte 0x03 (Y-variable) 18527>0x00003B byte 0x04 (string) 18528>0x00003B byte 0x05 (program) 18529>0x00003B byte 0x06 (protected prgm) 18530>0x00003B byte 0x07 (picture) 18531>0x00003B byte 0x08 (gdb) 18532>0x00003B byte 0x0B (window settings) 18533>0x00003B byte 0x0C (window settings) 18534>0x00003B byte 0x0D (table setup) 18535>0x00003B byte 0x0E (screenshot) 18536>0x00003B byte 0x13 (backup) 18537# 18538# Magic Numbers for the TI-83+ 18539# 185400 string **TI83F* TI-83+ Graphing Calculator 18541>0x00003B byte 0x00 (real number) 18542>0x00003B byte 0x01 (list) 18543>0x00003B byte 0x02 (matrix) 18544>0x00003B byte 0x03 (equation) 18545>0x00003B byte 0x04 (string) 18546>0x00003B byte 0x05 (program) 18547>0x00003B byte 0x06 (assembly program) 18548>0x00003B byte 0x07 (picture) 18549>0x00003B byte 0x08 (gdb) 18550>0x00003B byte 0x0C (complex number) 18551>0x00003B byte 0x0F (window settings) 18552>0x00003B byte 0x10 (zoom) 18553>0x00003B byte 0x11 (table setup) 18554>0x00003B byte 0x13 (backup) 18555>0x00003B byte 0x15 (application variable) 18556>0x00003B byte 0x17 (group of variable) 18557 18558# 18559# Magic Numbers for the TI-85 18560# 185610 string **TI85** TI-85 Graphing Calculator 18562>0x00003B byte 0x00 (real number) 18563>0x00003B byte 0x01 (complex number) 18564>0x00003B byte 0x02 (real vector) 18565>0x00003B byte 0x03 (complex vector) 18566>0x00003B byte 0x04 (real list) 18567>0x00003B byte 0x05 (complex list) 18568>0x00003B byte 0x06 (real matrix) 18569>0x00003B byte 0x07 (complex matrix) 18570>0x00003B byte 0x08 (real constant) 18571>0x00003B byte 0x09 (complex constant) 18572>0x00003B byte 0x0A (equation) 18573>0x00003B byte 0x0C (string) 18574>0x00003B byte 0x0D (function GDB) 18575>0x00003B byte 0x0E (polar GDB) 18576>0x00003B byte 0x0F (parametric GDB) 18577>0x00003B byte 0x10 (diffeq GDB) 18578>0x00003B byte 0x11 (picture) 18579>0x00003B byte 0x12 (program) 18580>0x00003B byte 0x13 (range) 18581>0x00003B byte 0x17 (window settings) 18582>0x00003B byte 0x18 (window settings) 18583>0x00003B byte 0x19 (window settings) 18584>0x00003B byte 0x1A (window settings) 18585>0x00003B byte 0x1B (zoom) 18586>0x00003B byte 0x1D (backup) 18587>0x00003B byte 0x1E (unknown) 18588>0x00003B byte 0x2A (equation) 18589>0x000032 string ZS4 - ZShell Version 4 File. 18590>0x000032 string ZS3 - ZShell Version 3 File. 18591# 18592# Magic Numbers for the TI-86 18593# 185940 string **TI86** TI-86 Graphing Calculator 18595>0x00003B byte 0x00 (real number) 18596>0x00003B byte 0x01 (complex number) 18597>0x00003B byte 0x02 (real vector) 18598>0x00003B byte 0x03 (complex vector) 18599>0x00003B byte 0x04 (real list) 18600>0x00003B byte 0x05 (complex list) 18601>0x00003B byte 0x06 (real matrix) 18602>0x00003B byte 0x07 (complex matrix) 18603>0x00003B byte 0x08 (real constant) 18604>0x00003B byte 0x09 (complex constant) 18605>0x00003B byte 0x0A (equation) 18606>0x00003B byte 0x0C (string) 18607>0x00003B byte 0x0D (function GDB) 18608>0x00003B byte 0x0E (polar GDB) 18609>0x00003B byte 0x0F (parametric GDB) 18610>0x00003B byte 0x10 (diffeq GDB) 18611>0x00003B byte 0x11 (picture) 18612>0x00003B byte 0x12 (program) 18613>0x00003B byte 0x13 (range) 18614>0x00003B byte 0x17 (window settings) 18615>0x00003B byte 0x18 (window settings) 18616>0x00003B byte 0x19 (window settings) 18617>0x00003B byte 0x1A (window settings) 18618>0x00003B byte 0x1B (zoom) 18619>0x00003B byte 0x1D (backup) 18620>0x00003B byte 0x1E (unknown) 18621>0x00003B byte 0x2A (equation) 18622# 18623# Magic Numbers for the TI-89 18624# 186250 string **TI89** TI-89 Graphing Calculator 18626>0x000048 byte 0x00 (expression) 18627>0x000048 byte 0x04 (list) 18628>0x000048 byte 0x06 (matrix) 18629>0x000048 byte 0x0A (data) 18630>0x000048 byte 0x0B (text) 18631>0x000048 byte 0x0C (string) 18632>0x000048 byte 0x0D (graphic data base) 18633>0x000048 byte 0x0E (figure) 18634>0x000048 byte 0x10 (picture) 18635>0x000048 byte 0x12 (program) 18636>0x000048 byte 0x13 (function) 18637>0x000048 byte 0x14 (macro) 18638>0x000048 byte 0x1C (zipped) 18639>0x000048 byte 0x21 (assembler) 18640# 18641# Magic Numbers for the TI-92 18642# 186430 string **TI92** TI-92 Graphing Calculator 18644>0x000048 byte 0x00 (expression) 18645>0x000048 byte 0x04 (list) 18646>0x000048 byte 0x06 (matrix) 18647>0x000048 byte 0x0A (data) 18648>0x000048 byte 0x0B (text) 18649>0x000048 byte 0x0C (string) 18650>0x000048 byte 0x0D (graphic data base) 18651>0x000048 byte 0x0E (figure) 18652>0x000048 byte 0x10 (picture) 18653>0x000048 byte 0x12 (program) 18654>0x000048 byte 0x13 (function) 18655>0x000048 byte 0x14 (macro) 18656>0x000048 byte 0x1D (backup) 18657# 18658# Magic Numbers for the TI-92+/V200 18659# 186600 string **TI92P* TI-92+/V200 Graphing Calculator 18661>0x000048 byte 0x00 (expression) 18662>0x000048 byte 0x04 (list) 18663>0x000048 byte 0x06 (matrix) 18664>0x000048 byte 0x0A (data) 18665>0x000048 byte 0x0B (text) 18666>0x000048 byte 0x0C (string) 18667>0x000048 byte 0x0D (graphic data base) 18668>0x000048 byte 0x0E (figure) 18669>0x000048 byte 0x10 (picture) 18670>0x000048 byte 0x12 (program) 18671>0x000048 byte 0x13 (function) 18672>0x000048 byte 0x14 (macro) 18673>0x000048 byte 0x1C (zipped) 18674>0x000048 byte 0x21 (assembler) 18675# 18676# Magic Numbers for the TI-73/83+/89/92+/V200 FLASH upgrades 18677# 186780x0000016 string Advanced TI-XX Graphing Calculator (FLASH) 186790 string **TIFL** TI-XX Graphing Calculator (FLASH) 18680>8 byte >0 - Revision %d 18681>>9 byte x \b.%d, 18682>12 byte >0 Revision date %02x 18683>>13 byte x \b/%02x 18684>>14 beshort x \b/%04x, 18685>17 string >/0 name: '%s', 18686>48 byte 0x74 device: TI-73, 18687>48 byte 0x73 device: TI-83+, 18688>48 byte 0x98 device: TI-89, 18689>48 byte 0x88 device: TI-92+, 18690>49 byte 0x23 type: OS upgrade, 18691>49 byte 0x24 type: application, 18692>49 byte 0x25 type: certificate, 18693>49 byte 0x3e type: license, 18694>74 lelong >0 size: %ld bytes 18695 18696# VTi & TiEmu skins (TI Graphing Calculators). 18697# From: Romain Lievin (roms@lpg.ticalc.org). 18698# Magic Numbers for the VTi skins 186990 string VTI Virtual TI skin 18700>3 string v - Version 18701>>4 byte >0 \b %c 18702>>6 byte x \b.%c 18703# Magic Numbers for the TiEmu skins 187040 string TiEmu TiEmu skin 18705>6 string v - Version 18706>>7 byte >0 \b %c 18707>>9 byte x \b.%c 18708>>10 byte x \b%c 18709 18710#------------------------------------------------------------------------------ 18711# $File: timezone,v 1.11 2009/09/19 16:28:12 christos Exp $ 18712# timezone: file(1) magic for timezone data 18713# 18714# from Daniel Quinlan (quinlan@yggdrasil.com) 18715# this should work on Linux, SunOS, and maybe others 18716# Added new official magic number for recent versions of the Olson code 187170 string TZif timezone data 18718>4 byte 0 \b, old version 18719>4 byte >0 \b, version %c 18720>20 belong 0 \b, no gmt time flags 18721>20 belong 1 \b, 1 gmt time flag 18722>20 belong >1 \b, %d gmt time flags 18723>24 belong 0 \b, no std time flags 18724>20 belong 1 \b, 1 std time flag 18725>24 belong >1 \b, %d std time flags 18726>28 belong 0 \b, no leap seconds 18727>28 belong 1 \b, 1 leap second 18728>28 belong >1 \b, %d leap seconds 18729>32 belong 0 \b, no transition times 18730>32 belong 1 \b, 1 transition time 18731>32 belong >1 \b, %d transition times 18732>36 belong 0 \b, no abbreviation chars 18733>36 belong 1 \b, 1 abbreviation char 18734>36 belong >1 \b, %d abbreviation chars 187350 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0 old timezone data 187360 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0 old timezone data 187370 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0 old timezone data 187380 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0 old timezone data 187390 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0 old timezone data 187400 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0 old timezone data 18741 18742#------------------------------------------------------------------------------ 18743# $File: troff,v 1.10 2009/09/19 16:28:12 christos Exp $ 18744# troff: file(1) magic for *roff 18745# 18746# updated by Daniel Quinlan (quinlan@yggdrasil.com) 18747 18748# troff input 187490 search/1 .\\" troff or preprocessor input text 18750!:mime text/troff 187510 search/1 '\\" troff or preprocessor input text 18752!:mime text/troff 187530 search/1 '.\\" troff or preprocessor input text 18754!:mime text/troff 187550 search/1 \\" troff or preprocessor input text 18756!:mime text/troff 187570 search/1 ''' troff or preprocessor input text 18758!:mime text/troff 187590 regex/20 \^\\.[A-Za-z0-9][A-Za-z0-9][\ \t] troff or preprocessor input text 18760!:mime text/troff 187610 regex/20 \^\\.[A-Za-z0-9][A-Za-z0-9]$ troff or preprocessor input text 18762!:mime text/troff 18763 18764# ditroff intermediate output text 187650 search/1 x\ T ditroff output text 18766>4 search/1 cat for the C/A/T phototypesetter 18767>4 search/1 ps for PostScript 18768>4 search/1 dvi for DVI 18769>4 search/1 ascii for ASCII 18770>4 search/1 lj4 for LaserJet 4 18771>4 search/1 latin1 for ISO 8859-1 (Latin 1) 18772>4 search/1 X75 for xditview at 75dpi 18773>>7 search/1 -12 (12pt) 18774>4 search/1 X100 for xditview at 100dpi 18775>>8 search/1 -12 (12pt) 18776 18777# output data formats 187780 string \100\357 very old (C/A/T) troff output data 18779 18780#------------------------------------------------------------------------------ 18781# $File: tuxedo,v 1.4 2009/09/19 16:28:13 christos Exp $ 18782# tuxedo: file(1) magic for BEA TUXEDO data files 18783# 18784# from Ian Springer <ispringer@hotmail.com> 18785# 187860 string \0\0\1\236\0\0\0\0\0\0\0\0\0\0\0\0 BEA TUXEDO DES mask data 18787 18788#------------------------------------------------------------------------------ 18789# $File: typeset,v 1.8 2009/09/19 16:28:13 christos Exp $ 18790# typeset: file(1) magic for other typesetting 18791# 187920 string Interpress/Xerox Xerox InterPress data 18793>16 string / (version 18794>>17 string >\0 %s) 18795 18796#------------------------------------------------------------------------------ 18797# $File: unicode,v 1.6 2010/09/20 18:55:20 rrt Exp $ 18798# Unicode: BOM prefixed text files - Adrian Havill <havill@turbolinux.co.jp> 18799# GRR: These types should be recognised in file_ascmagic so these 18800# encodings can be treated by text patterns. 18801# Missing types are already dealt with internally. 18802# 188030 string +/v8 Unicode text, UTF-7 188040 string +/v9 Unicode text, UTF-7 188050 string +/v+ Unicode text, UTF-7 188060 string +/v/ Unicode text, UTF-7 188070 string \335\163\146\163 Unicode text, UTF-8-EBCDIC 188080 string \000\000\376\377 Unicode text, UTF-32, big-endian 188090 string \377\376\000\000 Unicode text, UTF-32, little-endian 188100 string \016\376\377 Unicode text, SCSU (Standard Compression Scheme for Unicode) 18811 18812#------------------------------------------------------------------------------ 18813# $File: unknown,v 1.8 2013/01/09 22:37:24 christos Exp $ 18814# unknown: file(1) magic for unknown machines 18815# 18816# 0x107 is 0407, 0x108 is 0410, and 0x109 is 0411; those are all PDP-11 18817# (executable, pure, and split I&D, respectively), but the PDP-11 version 18818# doesn't have the "version %ld", which may be a bogus COFFism (I don't 18819# think there was ever COFF for the PDP-11). 18820# 18821# 0x10B is 0413; that's VAX demand-paged, but this is a short, not a 18822# long, as it would be on a VAX. In any case, that could collide with 18823# VAX demand-paged files, as the magic number is little-endian on those 18824# binaries, so the first 16 bits of the file would contain 0x10B. 18825# 18826# Therefore, those entries are commented out. 18827# 18828# 0x10C is 0414 and 0x10E is 0416; those *are* unknown. 18829# 18830#0 short 0x107 unknown machine executable 18831#>8 short >0 not stripped 18832#>15 byte >0 - version %ld 18833#0 short 0x108 unknown pure executable 18834#>8 short >0 not stripped 18835#>15 byte >0 - version %ld 18836#0 short 0x109 PDP-11 separate I&D 18837#>8 short >0 not stripped 18838#>15 byte >0 - version %ld 18839#0 short 0x10b unknown pure executable 18840#>8 short >0 not stripped 18841#>15 byte >0 - version %ld 188420 long 0x10c unknown demand paged pure executable 18843>16 long >0 not stripped 188440 long 0x10e unknown readable demand paged pure executable 18845 18846#------------------------------------------------------------------------------ 18847# $File: uterus,v 1.1 2012/12/18 18:53:32 christos Exp $ 18848# file(1) magic for uterus files 18849# http://freecode.com/projects/uterus 18850# 188510 string UTE+ uterus file 18852>4 string v \b, version 18853>5 byte x %c 18854>6 string . \b. 18855>7 byte x \b%c 18856>8 string \<\> \b, big-endian 18857>>16 belong >0 \b, slut size %u 18858>8 string \>\< \b, litte-endian 18859>>16 lelong >0 \b, slut size %u 18860>10 byte &8 \b, compressed 18861 18862#------------------------------------------------------------------------------ 18863# $File: uuencode,v 1.7 2009/09/19 16:28:13 christos Exp $ 18864# uuencode: file(1) magic for ASCII-encoded files 18865# 18866 18867# GRR: the first line of xxencoded files is identical to that in uuencoded 18868# files, but the first character in most subsequent lines is 'h' instead of 18869# 'M'. (xxencoding uses lowercase letters in place of most of uuencode's 18870# punctuation and survives BITNET gateways better.) If regular expressions 18871# were supported, this entry could possibly be split into two with 18872# "begin\040\.\*\012M" or "begin\040\.\*\012h" (where \. and \* are REs). 188730 search/1 begin\ uuencoded or xxencoded text 18874 18875# btoa(1) is an alternative to uuencode that requires less space. 188760 search/1 xbtoa\ Begin btoa'd text 18877 18878# ship(1) is another, much cooler alternative to uuencode. 18879# Greg Roelofs, newt@uchicago.edu 188800 search/1 $\012ship ship'd binary text 18881 18882# bencode(8) is used to encode compressed news batches (Bnews/Cnews only?) 18883# Greg Roelofs, newt@uchicago.edu 188840 search/1 Decode\ the\ following\ with\ bdeco bencoded News text 18885 18886# BinHex is the Macintosh ASCII-encoded file format (see also "apple") 18887# Daniel Quinlan, quinlan@yggdrasil.com 1888811 search/1 must\ be\ converted\ with\ BinHex BinHex binary text 18889>41 search/1 x \b, version %.3s 18890 18891# GRR: handle BASE64 18892 18893#------------------------------------------------------------------------------ 18894# $File: varied.out,v 1.22 2010/07/02 00:06:27 christos Exp $ 18895# varied.out: file(1) magic for various USG systems 18896# 18897# Herewith many of the object file formats used by USG systems. 18898# Most have been moved to files for a particular processor, 18899# and deleted if they duplicate other entries. 18900# 189010 short 0610 Perkin-Elmer executable 18902# AMD 29K 189030 beshort 0572 amd 29k coff noprebar executable 189040 beshort 01572 amd 29k coff prebar executable 189050 beshort 0160007 amd 29k coff archive 18906# Cray 189076 beshort 0407 unicos (cray) executable 18908# Ultrix 4.3 18909596 string \130\337\377\377 Ultrix core file 18910>600 string >\0 from '%s' 18911# BeOS and MAcOS PEF executables 18912# From: hplus@zilker.net (Jon Watte) 189130 string Joy!peffpwpc header for PowerPC PEF executable 18914# 18915# ava assembler/linker Uros Platise <uros.platise@ijs.si> 189160 string avaobj AVR assembler object code 18917>7 string >\0 version '%s' 18918# gnu gmon magic From: Eugen Dedu <dedu@ese-metz.fr> 189190 string gmon GNU prof performance data 18920>4 long x - version %ld 18921# From: Dave Pearson <davep@davep.org> 18922# Harbour <URL:http://harbour-project.org/> HRB files. 189230 string \xc0HRB Harbour HRB file 18924>4 leshort x version %d 18925# Harbour HBV files 189260 string \xc0HBV Harbour variable dump file 18927>4 leshort x version %d 18928 18929# From: Alex Beregszaszi <alex@fsn.hu> 18930# 0 string exec BugOS executable 18931# 0 string pack BugOS archive 18932 18933# From: Jason Spence <jspence@lightconsulting.com> 18934# Generated by the "examples" in STM's ST40 devkit, and derived code. 189350 lelong 0x13a9f17e ST40 component image format 18936>4 string >\0 \b, name '%s' 18937 18938#------------------------------------------------------------------------------ 18939# $File: varied.script,v 1.9 2011/12/16 16:32:48 rrt Exp $ 18940# varied.script: file(1) magic for various interpreter scripts 18941 189420 string/t #!\ / a 18943>3 string >\0 %s script text executable 18944!:strength / 2 189450 string/t #!\t/ a 18946>3 string >\0 %s script text executable 18947!:strength / 2 189480 string/t #!/ a 18949>2 string >\0 %s script text executable 18950!:strength / 2 189510 string/t #!\ script text executable 18952>3 string >\0 for %s 18953!:strength / 3 18954 18955# using env 189560 string/t #!/usr/bin/env a 18957>15 string/t >\0 %s script text executable 18958!:strength / 10 189590 string/t #!\ /usr/bin/env a 18960>16 string/t >\0 %s script text executable 18961!:strength / 10 18962 18963# From: arno <arenevier@fdn.fr> 18964# mozilla xpconnect typelib 18965# see http://www.mozilla.org/scriptable/typelib_file.html 189660 string XPCOM\nTypeLib\r\n\032 XPConnect Typelib 18967>0x10 byte x version %d 18968>>0x11 byte x \b.%d 18969 18970#------------------------------------------------------------------------------ 18971# $File: vax,v 1.8 2013/01/09 22:37:24 christos Exp $ 18972# vax: file(1) magic for VAX executable/object and APL workspace 18973# 189740 lelong 0101557 VAX single precision APL workspace 189750 lelong 0101556 VAX double precision APL workspace 18976 18977# 18978# VAX a.out (BSD; others collide with 386 and other 32-bit little-endian 18979# executables, and are handled in aout) 18980# 189810 lelong 0420 a.out VAX demand paged (first page unmapped) pure executable 18982>16 lelong >0 not stripped 18983 18984# 18985# VAX COFF 18986# 18987# The `versions' were commented out, but have been un-commented out. 18988# (Was the problem just one of endianness?) 18989# 189900 leshort 0570 VAX COFF executable 18991>12 lelong >0 not stripped 18992>22 leshort >0 - version %ld 189930 leshort 0575 VAX COFF pure executable 18994>12 lelong >0 not stripped 18995>22 leshort >0 - version %ld 18996 18997#------------------------------------------------------------------------------ 18998# $File: vicar,v 1.4 2009/09/19 16:28:13 christos Exp $ 18999# vicar: file(1) magic for VICAR files. 19000# 19001# From: Ossama Othman <othman@astrosun.tn.cornell.edu 19002# VICAR is JPL's in-house spacecraft image processing program 19003# VICAR image 190040 string LBLSIZE= VICAR image data 19005>32 string BYTE \b, 8 bits = VAX byte 19006>32 string HALF \b, 16 bits = VAX word = Fortran INTEGER*2 19007>32 string FULL \b, 32 bits = VAX longword = Fortran INTEGER*4 19008>32 string REAL \b, 32 bits = VAX longword = Fortran REAL*4 19009>32 string DOUB \b, 64 bits = VAX quadword = Fortran REAL*8 19010>32 string COMPLEX \b, 64 bits = VAX quadword = Fortran COMPLEX*8 19011# VICAR label file 1901243 string SFDU_LABEL VICAR label file 19013 19014#------------------------------------------------------------------------------ 19015# $File: virtual,v 1.2 2011/11/22 13:30:05 christos Exp $ 19016# From: James Nobis <quel@quelrod.net> 19017# Microsoft hard disk images for: 19018# Virtual Server 19019# Virtual PC 19020# http://technet.microsoft.com/en-us/virtualserver/bb676673.aspx 19021# .vhd 190220 string conectix Microsoft Disk Image, Virtual Server or Virtual PC 19023 19024# Sun xVM VirtualBox Disk Image 19025# From: Richard W.M. Jones <rich@annexia.org> 19026# VirtualBox Disk Image 190270x40 ulelong 0xbeda107f VirtualBox Disk Image 19028>0x44 uleshort >0 \b, major %u 19029>0x46 uleshort >0 \b, minor %u 19030 19031#------------------------------------------------------------------------------ 19032# $File: virtutech,v 1.4 2009/09/19 16:28:13 christos Exp $ 19033# Virtutech Compressed Random Access File Format 19034# 19035# From <gustav@virtutech.com> 190360 string \211\277\036\203 Virtutech CRAFF 19037>4 belong x v%d 19038>20 belong 0 uncompressed 19039>20 belong 1 bzipp2ed 19040>20 belong 2 gzipped 19041>24 belong 0 not clean 19042 19043#------------------------------------------------------------------------------ 19044# $File: visx,v 1.5 2009/09/19 16:28:13 christos Exp $ 19045# visx: file(1) magic for Visx format files 19046# 190470 short 0x5555 VISX image file 19048>2 byte 0 (zero) 19049>2 byte 1 (unsigned char) 19050>2 byte 2 (short integer) 19051>2 byte 3 (float 32) 19052>2 byte 4 (float 64) 19053>2 byte 5 (signed char) 19054>2 byte 6 (bit-plane) 19055>2 byte 7 (classes) 19056>2 byte 8 (statistics) 19057>2 byte 10 (ascii text) 19058>2 byte 15 (image segments) 19059>2 byte 100 (image set) 19060>2 byte 101 (unsigned char vector) 19061>2 byte 102 (short integer vector) 19062>2 byte 103 (float 32 vector) 19063>2 byte 104 (float 64 vector) 19064>2 byte 105 (signed char vector) 19065>2 byte 106 (bit plane vector) 19066>2 byte 121 (feature vector) 19067>2 byte 122 (feature vector library) 19068>2 byte 124 (chain code) 19069>2 byte 126 (bit vector) 19070>2 byte 130 (graph) 19071>2 byte 131 (adjacency graph) 19072>2 byte 132 (adjacency graph library) 19073>2 string .VISIX (ascii text) 19074 19075#------------------------------------------------------------------------------ 19076# $File: vms,v 1.7 2013/03/09 22:36:00 christos Exp $ 19077# vms: file(1) magic for VMS executables (experimental) 19078# 19079# VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu) 19080 19081# GRR 950122: I'm just guessing on these, based on inspection of the headers 19082# of three executables each for Alpha and VAX architectures. The VAX files 19083# all had headers similar to this: 19084# 19085# 00000 b0 00 30 00 44 00 60 00 00 00 00 00 30 32 30 35 ..0.D.`.....0205 19086# 00010 01 01 00 00 ff ff ff ff ff ff ff ff 00 00 00 00 ................ 19087# 190880 string \xb0\0\x30\0 VMS VAX executable 19089>44032 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption 19090# 19091# The AXP files all looked like this, except that the byte at offset 0x22 19092# was 06 in some of them and 07 in others: 19093# 19094# 00000 03 00 00 00 00 00 00 00 ec 02 00 00 10 01 00 00 ................ 19095# 00010 68 00 00 00 98 00 00 00 b8 00 00 00 00 00 00 00 h............... 19096# 00020 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 19097# 00030 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................ 19098# 00040 00 00 00 00 ff ff ff ff ff ff ff ff 02 00 00 00 ................ 19099# 19100# GRR this test is still too general as it catches example adressen.dbt 191010 belong 0x03000000 19102>8 ubelong 0xec020000 VMS Alpha executable 19103>>75264 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption 19104 19105#------------------------------------------------------------------------------ 19106# $File: vmware,v 1.7 2009/09/19 16:28:13 christos Exp $ 19107# VMware specific files (deducted from version 1.1 and log file entries) 19108# Anthon van der Neut (anthon@mnt.org) 191090 belong 0x4d52564e VMware nvram 19110 19111#------------------------------------------------------------------------------ 19112# $File: vorbis,v 1.16 2009/09/19 16:28:13 christos Exp $ 19113# vorbis: file(1) magic for Ogg/Vorbis files 19114# 19115# From Felix von Leitner <leitner@fefe.de> 19116# Extended by Beni Cherniavsky <cben@crosswinds.net> 19117# Further extended by Greg Wooledge <greg@wooledge.org> 19118# 19119# Most (everything but the number of channels and bitrate) is commented 19120# out with `##' as it's not interesting to the average user. The most 19121# probable things advanced users would want to uncomment are probably 19122# the number of comments and the encoder version. 19123# 19124# FIXME: The first match has been made a search, so that it can skip 19125# over prepended ID3 tags. This will work for MIME type detection, but 19126# won't work for detecting other properties of the file (they all need 19127# to be made relative to the search). In any case, if the file has ID3 19128# tags, the ID3 information will be printed, not the Ogg information, 19129# so until that's fixed, this doesn't matter. 19130# FIXME[2]: Disable the above for now, since search assumes text mode. 19131# 19132# --- Ogg Framing --- 19133#0 search/1000 OggS Ogg data 191340 string OggS Ogg data 19135!:mime application/ogg 19136>4 byte !0 UNKNOWN REVISION %u 19137##>4 byte 0 revision 0 19138>4 byte 0 19139##>>14 lelong x (Serial %lX) 19140# non-Vorbis content: FLAC (Free Lossless Audio Codec, http://flac.sourceforge.net) 19141>>28 string \x7fFLAC \b, FLAC audio 19142# non-Vorbis content: Theora 19143>>28 string \x80theora \b, Theora video 19144# non-Vorbis content: Kate 19145>>28 string \x80kate\0\0\0\0 \b, Kate 19146>>>37 ubyte x v%u 19147>>>38 ubyte x \b.%u, 19148>>>40 byte 0 utf8 encoding, 19149>>>40 byte !0 unknown character encoding, 19150>>>60 string >\0 language %s, 19151>>>60 string \0 no language set, 19152>>>76 string >\0 category %s 19153>>>76 string \0 no category set 19154# non-Vorbis content: Skeleton 19155>>28 string fishead\0 \b, Skeleton 19156>>>36 short x v%u 19157>>>40 short x \b.%u 19158# non-Vorbis content: Speex 19159>>28 string Speex\ \ \ \b, Speex audio 19160# non-Vorbis content: OGM 19161>>28 string \x01video\0\0\0 \b, OGM video 19162>>>37 string/c div3 (DivX 3) 19163>>>37 string/c divx (DivX 4) 19164>>>37 string/c dx50 (DivX 5) 19165>>>37 string/c xvid (XviD) 19166# --- First vorbis packet - general header --- 19167>>28 string \x01vorbis \b, Vorbis audio, 19168>>>35 lelong !0 UNKNOWN VERSION %lu, 19169##>>>35 lelong 0 version 0, 19170>>>35 lelong 0 19171>>>>39 ubyte 1 mono, 19172>>>>39 ubyte 2 stereo, 19173>>>>39 ubyte >2 %u channels, 19174>>>>40 lelong x %lu Hz 19175# Minimal, nominal and maximal bitrates specified when encoding 19176>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff \b, 19177# The above tests if at least one of these is specified: 19178>>>>>52 lelong !-1 19179# Vorbis RC2 has a bug which puts -1000 in the min/max bitrate fields 19180# instead of -1. 19181# Vorbis 1.0 uses 0 instead of -1. 19182>>>>>>52 lelong !0 19183>>>>>>>52 lelong !-1000 19184>>>>>>>>52 lelong x <%lu 19185>>>>>48 lelong !-1 19186>>>>>>48 lelong x ~%lu 19187>>>>>44 lelong !-1 19188>>>>>>44 lelong !-1000 19189>>>>>>>44 lelong !0 19190>>>>>>>>44 lelong x >%lu 19191>>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff bps 19192# -- Second vorbis header packet - the comments 19193# A kludge to read the vendor string. It's a counted string, not a 19194# zero-terminated one, so file(1) can't read it in a generic way. 19195# libVorbis is the only one existing currently, so I detect specifically 19196# it. The interesting value is the cvs date (8 digits decimal). 19197# Post-RC1 Ogg files have the second header packet (and thus the version) 19198# in a different place, so we must use an indirect offset. 19199>>>(84.b+85) string \x03vorbis 19200>>>>(84.b+96) string/c Xiphophorus\ libVorbis\ I \b, created by: Xiphophorus libVorbis I 19201>>>>>(84.b+120) string >00000000 19202# Map to beta version numbers: 19203>>>>>>(84.b+120) string <20000508 (<beta1, prepublic) 19204>>>>>>(84.b+120) string 20000508 (1.0 beta 1 or beta 2) 19205>>>>>>(84.b+120) string >20000508 19206>>>>>>>(84.b+120) string <20001031 (beta2-3) 19207>>>>>>(84.b+120) string 20001031 (1.0 beta 3) 19208>>>>>>(84.b+120) string >20001031 19209>>>>>>>(84.b+120) string <20010225 (beta3-4) 19210>>>>>>(84.b+120) string 20010225 (1.0 beta 4) 19211>>>>>>(84.b+120) string >20010225 19212>>>>>>>(84.b+120) string <20010615 (beta4-RC1) 19213>>>>>>(84.b+120) string 20010615 (1.0 RC1) 19214>>>>>>(84.b+120) string 20010813 (1.0 RC2) 19215>>>>>>(84.b+120) string 20010816 (RC2 - Garf tuned v1) 19216>>>>>>(84.b+120) string 20011014 (RC2 - Garf tuned v2) 19217>>>>>>(84.b+120) string 20011217 (1.0 RC3) 19218>>>>>>(84.b+120) string 20011231 (1.0 RC3) 19219# Some pre-1.0 CVS snapshots still had "Xiphphorus"... 19220>>>>>>(84.b+120) string >20011231 (pre-1.0 CVS) 19221# For the 1.0 release, Xiphophorus is replaced by Xiph.Org 19222>>>>(84.b+96) string/c Xiph.Org\ libVorbis\ I \b, created by: Xiph.Org libVorbis I 19223>>>>>(84.b+117) string >00000000 19224>>>>>>(84.b+117) string <20020717 (pre-1.0 CVS) 19225>>>>>>(84.b+117) string 20020717 (1.0) 19226>>>>>>(84.b+117) string 20030909 (1.0.1) 19227>>>>>>(84.b+117) string 20040629 (1.1.0 RC1) 19228 19229#------------------------------------------------------------------------------ 19230# $File: vxl,v 1.4 2009/09/19 16:28:13 christos Exp $ 19231# VXL: file(1) magic for VXL binary IO data files 19232# 19233# from Ian Scott <scottim@sf.net> 19234# 19235# VXL is a collection of C++ libraries for Computer Vision. 19236# See the vsl chapter in the VXL Book for more info 19237# http://www.isbe.man.ac.uk/public_vxl_doc/books/vxl/book.html 19238# http:/vxl.sf.net 19239 192402 lelong 0x472b2c4e VXL data file, 19241>0 leshort >0 schema version no %d 19242 19243#------------------------------------------------------------------------------ 19244# $File: warc,v 1.3 2010/11/25 15:05:43 christos Exp $ 19245# warc: file(1) magic for WARC files 19246 192470 string WARC/ WARC Archive 19248>5 string x version %.4s 19249!:mime application/warc 19250 19251#------------------------------------------------------------------------------ 19252# Arc File Format from Internet Archive 19253# see http://www.archive.org/web/researcher/ArcFileFormat.php 192540 string filedesc:// Internet Archive File 19255!:mime application/x-ia-arc 19256>11 search/256 \x0A \b 19257>>&0 ubyte >0 \b version %c 19258 19259#------------------------------------------------------------------------------ 19260# weak: file(1) magic for very weak magic entries, disabled by default 19261# 19262# These entries are so weak that they might interfere identification of 19263# other formats. Example include: 19264# - Only identify for 1 or 2 bytes 19265# - Match against very wide range of values 19266# - Match against generic word in some spoken languages (e.g. English) 19267 19268# Summary: Computer Graphics Metafile 19269# Extension: .cgm 19270#0 beshort&0xffe0 0x0020 binary Computer Graphics Metafile 19271#0 beshort 0x3020 character Computer Graphics Metafile 19272 19273#0 string =!! Bennet Yee's "face" format 19274 19275#------------------------------------------------------------------------------ 19276# $File: windows,v 1.6 2013/04/19 20:12:29 christos Exp $ 19277# windows: file(1) magic for Microsoft Windows 19278# 19279# This file is mainly reserved for files where programs 19280# using them are run almost always on MS Windows 3.x or 19281# above, or files only used exclusively in Windows OS, 19282# where there is no better category to allocate for. 19283# For example, even though WinZIP almost run on Windows 19284# only, it is better to treat them as "archive" instead. 19285# For format usable in DOS, such as generic executable 19286# format, please specify under "msdos" file. 19287# 19288 19289 19290# Summary: Outlook Express DBX file 19291# Extension: .dbx 19292# Created by: Christophe Monniez 192930 string \xCF\xAD\x12\xFE MS Outlook Express DBX file 19294>4 byte =0xC5 \b, message database 19295>4 byte =0xC6 \b, folder database 19296>4 byte =0xC7 \b, account information 19297>4 byte =0x30 \b, offline database 19298 19299 19300# Summary: Windows crash dump 19301# Extension: .dmp 19302# Created by: Andreas Schuster (http://computer.forensikblog.de/) 19303# Reference (1): http://computer.forensikblog.de/en/2008/02/64bit_magic.html 19304# Modified by (1): Abel Cheung (Avoid match with first 4 bytes only) 193050 string PAGE 19306>4 string DUMP MS Windows 32bit crash dump 19307>>0x05c byte 0 \b, no PAE 19308>>0x05c byte 1 \b, PAE 19309>>0xf88 lelong 1 \b, full dump 19310>>0xf88 lelong 2 \b, kernel dump 19311>>0xf88 lelong 3 \b, small dump 19312>>0x068 lelong x \b, %ld pages 19313>4 string DU64 MS Windows 64bit crash dump 19314>>0xf98 lelong 1 \b, full dump 19315>>0xf98 lelong 2 \b, kernel dump 19316>>0xf98 lelong 3 \b, small dump 19317>>0x090 lequad x \b, %lld pages 19318 19319 19320# Summary: Vista Event Log 19321# Extension: .evtx 19322# Created by: Andreas Schuster (http://computer.forensikblog.de/) 19323# Reference (1): http://computer.forensikblog.de/en/2007/05/some_magic.html 193240 string ElfFile\0 MS Windows Vista Event Log 19325>0x2a leshort x \b, %d chunks 19326>>0x10 lelong x \b (no. %d in use) 19327>0x18 lelong >1 \b, next record no. %d 19328>0x18 lelong =1 \b, empty 19329>0x78 lelong &1 \b, DIRTY 19330>0x78 lelong &2 \b, FULL 19331 19332 19333# Summary: Windows 3.1 group files 19334# Extension: .grp 19335# Created by: unknown 193360 string \120\115\103\103 MS Windows 3.1 group files 19337 19338 19339# Summary: Old format help files 19340# Extension: .hlp 19341# Created by: Dirk Jagdmann <doj@cubic.org> 193420 lelong 0x00035f3f MS Windows 3.x help file 19343 19344 19345# Summary: Hyper terminal 19346# Extension: .ht 19347# Created by: unknown 193480 string HyperTerminal\ 19349>15 string 1.0\ --\ HyperTerminal\ data\ file MS Windows HyperTerminal profile 19350 19351# http://ithreats.files.wordpress.com/2009/05/\ 19352# lnk_the_windows_shortcut_file_format.pdf 19353# Summary: Windows shortcut 19354# Extension: .lnk 19355# Created by: unknown 19356# 'L' + GUUID 193570 string \114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106 MS Windows shortcut 19358>20 lelong&1 1 \b, Item id list present 19359>20 lelong&2 2 \b, Points to a file or directory 19360>20 lelong&4 4 \b, Has Description string 19361>20 lelong&8 8 \b, Has Relative path 19362>20 lelong&16 16 \b, Has Working directory 19363>20 lelong&32 32 \b, Has command line arguments 19364>20 lelong&64 64 \b, Icon 19365>>56 lelong \b number=%d 19366>24 lelong&1 1 \b, Read-Only 19367>24 lelong&2 2 \b, Hidden 19368>24 lelong&4 4 \b, System 19369>24 lelong&8 8 \b, Volume Label 19370>24 lelong&16 16 \b, Directory 19371>24 lelong&32 32 \b, Archive 19372>24 lelong&64 64 \b, Encrypted 19373>24 lelong&128 128 \b, Normal 19374>24 lelong&256 256 \b, Temporary 19375>24 lelong&512 512 \b, Sparse 19376>24 lelong&1024 1024 \b, Reparse point 19377>24 lelong&2048 2048 \b, Compressed 19378>24 lelong&4096 4096 \b, Offline 19379>28 leqwdate x \b, ctime=%s 19380>36 leqwdate x \b, mtime=%s 19381>44 leqwdate x \b, atime=%s 19382>52 lelong x \b, length=%u, window= 19383>60 lelong&1 1 \bhide 19384>60 lelong&2 2 \bnormal 19385>60 lelong&4 4 \bshowminimized 19386>60 lelong&8 8 \bshowmaximized 19387>60 lelong&16 16 \bshownoactivate 19388>60 lelong&32 32 \bminimize 19389>60 lelong&64 64 \bshowminnoactive 19390>60 lelong&128 128 \bshowna 19391>60 lelong&256 256 \brestore 19392>60 lelong&512 512 \bshowdefault 19393#>20 lelong&1 0 19394#>>20 lelong&2 2 19395#>>>(72.l-64) pstring/h x \b [%s] 19396#>20 lelong&1 1 19397#>>20 lelong&2 2 19398#>>>(72.s) leshort x 19399#>>>&75 pstring/h x \b [%s] 19400 19401# Summary: Outlook Personal Folders 19402# Created by: unknown 194030 lelong 0x4E444221 Microsoft Outlook email folder 19404>10 leshort 0x0e (<=2002) 19405>10 leshort 0x17 (>=2003) 19406 19407 19408# Summary: Windows help cache 19409# Created by: unknown 194100 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache 19411 19412 19413# Summary: IE cache file 19414# Created by: Christophe Monniez 194150 string Client\ UrlCache\ MMF Internet Explorer cache file 19416>20 string >\0 version %s 19417 19418 19419# Summary: Registry files 19420# Created by: unknown 19421# Modified by (1): Joerg Jenderek 194220 string regf MS Windows registry file, NT/2000 or above 194230 string CREG MS Windows 95/98/ME registry file 194240 string SHCC3 MS Windows 3.1 registry file 19425 19426 19427# Summary: Windows Registry text 19428# Extension: .reg 19429# Submitted by: Abel Cheung <abelcheung@gmail.com> 194300 string REGEDIT4\r\n\r\n Windows Registry text (Win95 or above) 194310 string Windows\ Registry\ Editor\ 19432>&0 string Version\ 5.00\r\n\r\n Windows Registry text (Win2K or above) 19433 19434# Windows *.INF *.INI files updated by Joerg Jenderek at Apr 2013 19435# emtpy ,comment , section , unicode line 194360 regex/s \\`(\r\n|;|[[]|\xFF\xFE) 19437# left bracket in section line 19438>&0 search/8192 [ 19439# http://en.wikipedia.org/wiki/Autorun.inf 19440# http://msdn.microsoft.com/en-us/library/windows/desktop/cc144200.aspx 19441>>&0 regex/c \^(autorun)]\r\n 19442>>>&0 ubyte =0x5b INItialization configuration 19443!:mime application/x-wine-extension-ini 19444# From: Pal Tamas <folti@balabit.hu> 19445# Autorun File 19446>>>&0 ubyte !0x5b Microsoft Windows Autorun file 19447!:mime application/x-setupscript 19448# http://msdn.microsoft.com/en-us/library/windows/hardware/ff549520(v=vs.85).aspx 19449# version strings ASCII coded case-independent for Windows setup information script file 19450>>&0 regex/c \^(version|strings)] Windows setup INFormation 19451!:mime application/x-setupscript 19452#!:mime application/inf 19453#!:mime application/x-wine-extension-inf 19454>>&0 regex/c \^(WinsockCRCList|OEMCPL)] Windows setup INFormation 19455!:mime text/inf 19456# http://www.winfaq.de/faq_html/Content/tip2500/onlinefaq.php?h=tip2653.htm 19457# http://msdn.microsoft.com/en-us/library/windows/desktop/cc144102.aspx 19458# .ShellClassInfo DeleteOnCopy LocalizedFileNames ASCII coded case-independent 19459>>&0 regex/c \^(\.ShellClassInfo|DeleteOnCopy|LocalizedFileNames)] Windows desktop.ini 19460!:mime application/x-wine-extension-ini 19461#!:mime text/plain 19462# http://support.microsoft.com/kb/84709/ 19463>>&0 regex/c \^(don't\ load)] Windows CONTROL.INI 19464!:mime application/x-wine-extension-ini 19465>>&0 regex/c \^(ndishlp\\$|protman\\$|NETBEUI\\$)] Windows PROTOCOL.INI 19466!:mime application/x-wine-extension-ini 19467# http://technet.microsoft.com/en-us/library/cc722567.aspx 19468# http://www.winfaq.de/faq_html/Content/tip0000/onlinefaq.php?h=tip0137.htm 19469>>&0 regex/c \^(windows|Compatibility|embedding)] Windows WIN.INI 19470!:mime application/x-wine-extension-ini 19471# http://en.wikipedia.org/wiki/SYSTEM.INI 19472>>&0 regex/c \^(boot|386enh|drivers)] Windows SYSTEM.INI 19473!:mime application/x-wine-extension-ini 19474# http://www.mdgx.com/newtip6.htm 19475>>&0 regex/c \^(SafeList)] Windows IOS.INI 19476!:mime application/x-wine-extension-ini 19477# http://en.wikipedia.org/wiki/NTLDR Windows Boot Loader information 19478>>&0 regex/c \^(boot\x20loader)] Windows boot.ini 19479!:mime application/x-wine-extension-ini 19480>>>&0 ubyte x 19481# http://en.wikipedia.org/wiki/CONFIG.SYS 19482>>&0 regex/c \^(menu)]\r\n MS-DOS CONFIG.SYS 19483# http://support.microsoft.com/kb/118579/ 19484>>&0 regex/c \^(Paths)]\r\n MS-DOS MSDOS.SYS 19485# VERS string unicoded case-independent 19486>>&0 ubequad&0xFFdfFFdfFFdfFFdf 0x0056004500520053 19487# ION] string unicoded case-independent 19488>>>&0 ubequad&0xFFdfFFdfFFdfFFff 0x0049004f004e005d Windows setup INFormation 19489!:mime application/x-setupscript 19490# STRI string unicoded case-independent 19491>>&0 ubequad&0xFFdfFFdfFFdfFFdf 0x0053005400520049 19492# NGS] string unicoded case-independent 19493>>>&0 ubequad&0xFFdfFFdfFFdfFFff 0x004e00470053005D Windows setup INFormation 19494!:mime application/x-setupscript 19495# unknown keyword after opening bracket 19496>>&0 default x 19497>>>&0 search/8192 [ 19498# version Strings FileIdentification 19499>>>>&0 string/c version Windows setup INFormation 19500!:mime application/x-setupscript 19501# VERS string unicoded case-independent 19502>>>>&0 ubequad&0xFFdfFFdfFFdfFFdf 0x0056004500520053 19503# ION] string unicoded case-independent 19504>>>>>&0 ubequad&0xFFdfFFdfFFdfFFff 0x0049004f004e005d Windows setup INFormation 19505!:mime application/x-setupscript 19506# http://en.wikipedia.org/wiki/Initialization_file Windows Initialization File or other 19507#>>>>&0 default x Generic INItialization configuration 19508#!:mime application/x-wine-extension-ini 19509 19510# Windows Precompiled INF files *.PNF added by Joerg Jenderek at Mar 2013 of _PNF_HEADER inf.h 19511# http://read.pudn.com/downloads3/sourcecode/windows/248345/win2k/private/windows/setup/setupapi/inf.h__.htm 19512# GRR: line below too general as it catches also PDP-11 UNIX/RT ldp 195130 leshort&0xFeFe 0x0000 19514# test for unused null bits in PNF_FLAGs 19515>4 ulelong&0xFCffFe00 0x00000000 19516# only found 58h for Offset of WinDirPath immediately after _PNF_HEADER structure 19517>>68 ulelong >0x57 19518# test for zero high byte of InfValueBlockSize, followed by WinDirPath like 19519# C:\WINDOWS (ASCII 0x433a5c.. , unicode 0x43003a005c..) or X:\MININT 19520>>>(68.l-1) ubelong&0xffE0C519 =0x00400018 Windows Precompiled iNF 19521!:mime application/x-pnf 19522# currently only found Major Version=1 and Minor Version=1 19523#>>>>0 uleshort =0x0101 19524#>>>>>1 ubyte x \b, version %u 19525#>>>>>0 ubyte x \b.%u 19526>>>>0 uleshort !0x0101 19527>>>>>1 ubyte x \b, version %u 19528>>>>>0 ubyte x \b.%u 19529# 1 ,2 (windows 98 SE) 19530#>>>>2 uleshort =2 \b, InfStyle %u 19531>>>>2 uleshort !2 \b, InfStyle %u 19532# PNF_FLAG_IS_UNICODE 0x00000001 19533# PNF_FLAG_HAS_STRINGS 0x00000002 19534# PNF_FLAG_SRCPATH_IS_URL 0x00000004 19535# PNF_FLAG_HAS_VOLATILE_DIRIDS 0x00000008 19536# PNF_FLAG_INF_VERIFIED 0x00000010 19537# PNF_FLAG_INF_DIGITALLY_SIGNED 0x00000020 19538# ?? 0x00000100 19539# ?? 0x01000000 19540# ?? 0x02000000 19541>>>>4 ulelong&0x00000001 0x00000001 \b, unicoded 19542>>>>4 ulelong&0x00000020 0x00000020 \b, digitally signed 19543#>>>>8 ulelong x \b, InfSubstValueListOffset 0x%x 19544# many 0, 1 lmouusb.PNF, 2 linkfx10.PNF , f webfdr16.PNF 19545#>>>>12 uleshort x \b, InfSubstValueCount 0x%x 19546# only < 9 found 19547#>>>>14 uleshort x \b, InfVersionDatumCount 0x%x 19548# only found values lower 0x0000ffff 19549#>>>>16 ulelong x \b, InfVersionDataSize 0x%x 19550# only found positive values lower 0x00ffFFff for InfVersionDataOffset 19551>>>>20 ulelong x \b, at 0x%x 19552>>>>4 ulelong&0x00000001 =0x00000001 19553# case independent: CatalogFile Class DriverVer layoutfile LayoutFile SetupClass signature Signature 19554>>>>>(20.l) lestring16 x "%s" 19555>>>>4 ulelong&0x00000001 !0x00000001 19556>>>>>(20.l) string x "%s" 19557# FILETIME is number of 100-nanosecond intervals since 1 January 1601 19558#>>>>24 ulequad x \b, InfVersionLastWriteTime %16.16llx 19559# only found values lower 0x00ffFFff 19560#>>>>32 ulelong x \b, StringTableBlockOffset 0x%x 19561#>>>>36 ulelong x \b, StringTableBlockSize 0x%x 19562#>>>>40 ulelong x \b, InfSectionCount 0x%x 19563#>>>>44 ulelong x \b, InfSectionBlockOffset 0x%x 19564#>>>>48 ulelong x \b, InfSectionBlockSize 0x%x 19565#>>>>52 ulelong x \b, InfLineBlockOffset 0x%x 19566#>>>>56 ulelong x \b, InfLineBlockSize 0x%x 19567#>>>>60 ulelong x \b, InfValueBlockOffset 0x%x 19568#>>>>64 ulelong x \b, InfValueBlockSize 0x%x 19569# WinDirPathOffset 19570#>>>>68 ulelong x \b, at 0x%x 19571>>>>68 ulelong >0x57 19572>>>>>4 ulelong&0x00000001 =0x00000001 19573>>>>>>(68.l) ubequad =0x43003a005c005700 19574# normally unicoded C:\Windows 19575#>>>>>>>(68.l) lestring16 x \b, WinDirPath "%s" 19576>>>>>>(68.l) ubequad !0x43003a005c005700 19577>>>>>>>(68.l) lestring16 x \b, WinDirPath "%s" 19578>>>>>4 ulelong&0x00000001 !0x00000001 19579# normally ASCII C:\WINDOWS 19580#>>>>>>(68.l) string =C:\\WINDOWS \b, WinDirPath "%s" 19581>>>>>>(68.l) string !C:\\WINDOWS \b, WinDirPath "%s" 19582# found OsLoaderPathOffset values often 0 , once 70h corelist.PNF, once 68h ASCII machine.PNF 19583#>>>>72 ulelong >0 \b, at 0x%x 19584>>>>72 ulelong >0 \b, 19585>>>>>4 ulelong&0x00000001 =0x00000001 19586>>>>>>(72.l) lestring16 x OsLoaderPath "%s" 19587>>>>>4 ulelong&0x00000001 !0x00000001 19588# seldom C:\ instead empty 19589>>>>>>(72.l) string x OsLoaderPath "%s" 19590# 1fdh 19591#>>>>76 uleshort x \b, StringTableHashBucketCount 0x%x 19592>>>>78 uleshort !0x407 \b, LanguageId %x 19593# only 407h found 19594#>>>>78 uleshort =0x407 \b, LanguageId %x 19595# InfSourcePathOffset often 0 19596#>>>>80 ulelong >0 \b, at 0x%x 19597>>>>80 ulelong >0 \b, 19598>>>>>4 ulelong&0x00000001 =0x00000001 19599>>>>>>(80.l) lestring16 x SourcePath "%s" 19600>>>>>4 ulelong&0x00000001 !0x00000001 19601>>>>>>(80.l) string >\0 SourcePath "%s" 19602# OriginalInfNameOffset often 0 19603#>>>>84 ulelong >0 \b, at 0x%x 19604>>>>84 ulelong >0 \b, 19605>>>>>4 ulelong&0x00000001 =0x00000001 19606>>>>>>(84.l) lestring16 x InfName "%s" 19607>>>>>4 ulelong&0x00000001 !0x00000001 19608>>>>>>(84.l) string >\0 InfName "%s" 19609 19610 19611#------------------------------------------------------------------------------ 19612# $File: wireless,v 1.2 2009/09/19 16:28:13 christos Exp $ 19613# wireless-regdb: file(1) magic for CRDA wireless-regdb file format 19614# 196150 string RGDB CRDA wireless regulatory database file 19616>4 belong 19 (Version 1) 19617 19618#------------------------------------------------------------------------------ 19619# $File: wordprocessors,v 1.18 2013/06/03 19:07:29 christos Exp $ 19620# wordprocessors: file(1) magic fo word processors. 19621# 19622####### PWP file format used on Smith Corona Personal Word Processors: 196232 string \040\040\040\040\040\040\040\040\040\040\040ML4D\040'92 Smith Corona PWP 19624>24 byte 2 \b, single spaced 19625>24 byte 3 \b, 1.5 spaced 19626>24 byte 4 \b, double spaced 19627>25 byte 0x42 \b, letter 19628>25 byte 0x54 \b, legal 19629>26 byte 0x46 \b, A4 19630 19631#WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE 196320 string \377WPC\020\000\000\000\022\012\001\001\000\000\000\000 (WP) loadable file 19633>15 byte 0 Optimized for Intel 19634>15 byte 1 Optimized for Non-Intel 196351 string WPC (Corel/WP) 19636>8 short 257 WordPerfect macro 19637>8 short 258 WordPerfect help file 19638>8 short 259 WordPerfect keyboard file 19639>8 short 266 WordPerfect document 19640>8 short 267 WordPerfect dictionary 19641>8 short 268 WordPerfect thesaurus 19642>8 short 269 WordPerfect block 19643>8 short 270 WordPerfect rectangular block 19644>8 short 271 WordPerfect column block 19645>8 short 272 WordPerfect printer data 19646>8 short 275 WordPerfect printer data 19647>8 short 276 WordPerfect driver resource data 19648>8 short 279 WordPerfect hyphenation code 19649>8 short 280 WordPerfect hyphenation data 19650>8 short 281 WordPerfect macro resource data 19651>8 short 283 WordPerfect hyphenation lex 19652>8 short 285 WordPerfect wordlist 19653>8 short 286 WordPerfect equation resource data 19654>8 short 289 WordPerfect spell rules 19655>8 short 290 WordPerfect dictionary rules 19656>8 short 295 WordPerfect spell rules (Microlytics) 19657>8 short 299 WordPerfect settings file 19658>8 short 301 WordPerfect 4.2 document 19659>8 short 325 WordPerfect dialog file 19660>8 short 332 WordPerfect button bar 19661>8 short 513 Shell macro 19662>8 short 522 Shell definition 19663>8 short 769 Notebook macro 19664>8 short 770 Notebook help file 19665>8 short 771 Notebook keyboard file 19666>8 short 778 Notebook definition 19667>8 short 1026 Calculator help file 19668>8 short 1538 Calendar help file 19669>8 short 1546 Calendar data file 19670>8 short 1793 Editor macro 19671>8 short 1794 Editor help file 19672>8 short 1795 Editor keyboard file 19673>8 short 1817 Editor macro resource file 19674>8 short 2049 Macro editor macro 19675>8 short 2050 Macro editor help file 19676>8 short 2051 Macro editor keyboard file 19677>8 short 2305 PlanPerfect macro 19678>8 short 2306 PlanPerfect help file 19679>8 short 2307 PlanPerfect keyboard file 19680>8 short 2314 PlanPerfect worksheet 19681>8 short 2319 PlanPerfect printer definition 19682>8 short 2322 PlanPerfect graphic definition 19683>8 short 2323 PlanPerfect data 19684>8 short 2324 PlanPerfect temporary printer 19685>8 short 2329 PlanPerfect macro resource data 19686>8 byte 11 Mail 19687>8 short 2818 help file 19688>8 short 2821 distribution list 19689>8 short 2826 out box 19690>8 short 2827 in box 19691>8 short 2836 users archived mailbox 19692>8 short 2837 archived message database 19693>8 short 2838 archived attachments 19694>8 short 3083 Printer temporary file 19695>8 short 3330 Scheduler help file 19696>8 short 3338 Scheduler in file 19697>8 short 3339 Scheduler out file 19698>8 short 3594 GroupWise settings file 19699>8 short 3601 GroupWise directory services 19700>8 short 3627 GroupWise settings file 19701>8 short 4362 Terminal resource data 19702>8 short 4363 Terminal resource data 19703>8 short 4395 Terminal resource data 19704>8 short 4619 GUI loadable text 19705>8 short 4620 graphics resource data 19706>8 short 4621 printer settings file 19707>8 short 4622 port definition file 19708>8 short 4623 print queue parameters 19709>8 short 4624 compressed file 19710>8 short 5130 Network service msg file 19711>8 short 5131 Network service msg file 19712>8 short 5132 Async gateway login msg 19713>8 short 5134 GroupWise message file 19714>8 short 7956 GroupWise admin domain database 19715>8 short 7957 GroupWise admin host database 19716>8 short 7959 GroupWise admin remote host database 19717>8 short 7960 GroupWise admin ADS deferment data file 19718>8 short 8458 IntelliTAG (SGML) compiled DTD 19719>8 long 18219264 WordPerfect graphic image (1.0) 19720>8 long 18219520 WordPerfect graphic image (2.0) 19721#end of WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE 19722 19723# Hangul (Korean) Word Processor File 197240 string HWP\ Document\ File Hangul (Korean) Word Processor File 3.0 19725# From: Won-Kyu Park <wkpark@kldp.org> 19726512 string R\0o\0o\0t\0 Hangul (Korean) Word Processor File 2000 19727!:mime application/x-hwp 19728 19729# CosmicBook, from Benoit Rouits 197300 string CSBK Ted Neslson's CosmicBook hypertext file 19731 197322 string EYWR AmigaWriter file 19733 19734# chi: file(1) magic for ChiWriter files 197350 string \\1cw\ ChiWriter file 19736>5 string >\0 version %s 197370 string \\1cw ChiWriter file 19738 19739# Quark Express from http://www.garykessler.net/library/file_sigs.html 197402 string IIXPR3 Intel Quark Express Document (English) 197412 string IIXPRa Intel Quark Express Document (Korean) 197422 string MMXPR3 Motorola Quark Express Document (English) 19743!:mime application/x-quark-xpress-3 197442 string MMXPRa Motorola Quark Express Document (Korean) 19745 19746# adobe indesign (document, whatever...) from querkan 197470 belong 0x0606edf5 Adobe InDesign 19748>16 string DOCUMENT Document 19749 19750#------------------------------------------------------------------------------ 19751# ichitaro456: file(1) magic for Just System Word Processor Ichitaro 19752# 19753# Contributor kenzo-: 19754# Reversed-engineered JS Ichitaro magic numbers 19755# 19756 197570 string DOC 19758>43 byte 0x14 Just System Word Processor Ichitaro v4 19759!:mime application/x-ichitaro4 19760>144 string JDASH application/x-ichitaro4 19761 197620 string DOC 19763>43 byte 0x15 Just System Word Processor Ichitaro v5 19764!:mime application/x-ichitaro5 19765 197660 string DOC 19767>43 byte 0x16 Just System Word Processor Ichitaro v6 19768!:mime application/x-ichitaro6 19769 19770# Type: Freemind mindmap documents 19771# From: Jamie Thompson <debian-bugs@jamie-thompson.co.uk> 197720 string/w \<map\ version Freemind document 19773!:mime application/x-freemind 19774 19775# Type: Freeplane mindmap documents 19776# From: Felix Natter <fnatter@gmx.net> 197770 string/w \<map\ version="freeplane Freeplane document 19778!:mime application/x-freeplane 19779 19780# Type: Scribus 19781# From: Werner Fink <werner@suse.de> 197820 string \<SCRIBUSUTF8\ Version Scribus Document 197830 string \<SCRIBUSUTF8NEW\ Version Scribus Document 19784!:mime application/x-scribus 19785 19786# help files .hlp compiled from html and used by gfxboot added by Joerg Jenderek 19787# markups page=0x04,label=0x12, followed by strings like "opt" or "main" and title=0x14 197880 ulelong&0x8080FFFF 0x00001204 gfxboot compiled html help file 19789 19790#------------------------------------------------------------------------------ 19791# $File: wsdl,v 1.3 2013/02/06 14:18:52 christos Exp $ 19792# wsdl: PHP WSDL Cache, http://www.php.net/manual/en/book.soap.php 19793# Cache format extracted from source: 19794# http://svn.php.net/viewvc/php/php-src/trunk/ext/soap/php_sdl.c?revision=HEAD&view=markup 19795# Requires file >= 5.05, see http://mx.gw.com/pipermail/file/2010/000683.html 19796# By Elan Ruusamae <glen@delfi.ee>, Patryk Zawadzki <patrys@pld-linux.org>, 2010-2011 197970 string wsdl PHP WSDL cache, 19798>4 byte x version 0x%02x 19799>6 ledate x \b, created %s 19800 19801# uri 19802>10 lelong <0x7fffffff 19803>>10 pstring/l x \b, uri: "%s" 19804 19805# source 19806>>>&0 lelong <0x7fffffff 19807>>>>&-4 pstring/l x \b, source: "%s" 19808 19809# target_ns 19810>>>>>&0 lelong <0x7fffffff 19811>>>>>>&-4 pstring/l x \b, target_ns: "%s" 19812 19813#------------------------------------------------------------------------------ 19814# $File: xdelta,v 1.5 2011/08/08 09:01:05 christos Exp $ 19815# file(1) magic(5) data for xdelta Josh MacDonald <jmacd@CS.Berkeley.EDU> 19816# 198170 string %XDELTA% XDelta binary patch file 0.14 198180 string %XDZ000% XDelta binary patch file 0.18 198190 string %XDZ001% XDelta binary patch file 0.20 198200 string %XDZ002% XDelta binary patch file 1.0 198210 string %XDZ003% XDelta binary patch file 1.0.4 198220 string %XDZ004% XDelta binary patch file 1.1 19823 198240 string \xD6\xC3\xC4\x00 VCDIFF binary diff 19825 19826#------------------------------------------------------------------------------ 19827# $File: xenix,v 1.9 2009/09/19 16:28:13 christos Exp $ 19828# xenix: file(1) magic for Microsoft Xenix 19829# 19830# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small 19831# model" lifted from "magic.xenix", with comment "derived empirically; 19832# treat as folklore until proven" 19833# 19834# "small model", "large model", "huge model" stuff lifted from XXX 19835# 19836# XXX - "x.out" collides with PDP-11 archives 19837# 198380 string core core file (Xenix) 198390 byte 0x80 8086 relocatable (Microsoft) 198400 leshort 0xff65 x.out 19841>2 string __.SYMDEF randomized 19842>0 byte x archive 198430 leshort 0x206 Microsoft a.out 19844>8 leshort 1 Middle model 19845>0x1e leshort &0x10 overlay 19846>0x1e leshort &0x2 separate 19847>0x1e leshort &0x4 pure 19848>0x1e leshort &0x800 segmented 19849>0x1e leshort &0x400 standalone 19850>0x1e leshort &0x8 fixed-stack 19851>0x1c byte &0x80 byte-swapped 19852>0x1c byte &0x40 word-swapped 19853>0x10 lelong >0 not-stripped 19854>0x1e leshort ^0xc000 pre-SysV 19855>0x1e leshort &0x4000 V2.3 19856>0x1e leshort &0x8000 V3.0 19857>0x1c byte &0x4 86 19858>0x1c byte &0xb 186 19859>0x1c byte &0x9 286 19860>0x1c byte &0xa 386 19861>0x1f byte <0x040 small model 19862>0x1f byte =0x048 large model 19863>0x1f byte =0x049 huge model 19864>0x1e leshort &0x1 executable 19865>0x1e leshort ^0x1 object file 19866>0x1e leshort &0x40 Large Text 19867>0x1e leshort &0x20 Large Data 19868>0x1e leshort &0x120 Huge Objects Enabled 19869>0x10 lelong >0 not stripped 19870 198710 leshort 0x140 old Microsoft 8086 x.out 19872>0x3 byte &0x4 separate 19873>0x3 byte &0x2 pure 19874>0 byte &0x1 executable 19875>0 byte ^0x1 relocatable 19876>0x14 lelong >0 not stripped 19877 198780 lelong 0x206 b.out 19879>0x1e leshort &0x10 overlay 19880>0x1e leshort &0x2 separate 19881>0x1e leshort &0x4 pure 19882>0x1e leshort &0x800 segmented 19883>0x1e leshort &0x400 standalone 19884>0x1e leshort &0x1 executable 19885>0x1e leshort ^0x1 object file 19886>0x1e leshort &0x4000 V2.3 19887>0x1e leshort &0x8000 V3.0 19888>0x1c byte &0x4 86 19889>0x1c byte &0xb 186 19890>0x1c byte &0x9 286 19891>0x1c byte &0x29 286 19892>0x1c byte &0xa 386 19893>0x1e leshort &0x4 Large Text 19894>0x1e leshort &0x2 Large Data 19895>0x1e leshort &0x102 Huge Objects Enabled 19896 198970 leshort 0x580 XENIX 8086 relocatable or 80286 small model 19898 19899#------------------------------------------------------------------------------ 19900# $File: xilinx,v 1.6 2013/11/19 23:15:13 christos Exp $ 19901# This is Aaron's attempt at a MAGIC file for Xilinx .bit files. 19902# Xilinx-Magic@RevRagnarok.com 19903# Got the info from FPGA-FAQ 0026 19904# 19905# Rewritten to use pstring/H instead of hardcoded lengths by O. Freyermuth, 19906# fixes at least reading of bitfiles from Spartan 2, 3, 6. 19907# http://www.fpga-faq.com/FAQ_Pages/0026_Tell_me_about_bit_files.htm 19908# 19909# First there is the sync header and its length 199100 beshort 0x0009 19911>2 belong =0x0ff00ff0 19912>>&0 belong =0x0ff00ff0 19913>>>&0 byte =0x00 19914>>>&1 beshort =0x0001 19915>>>&3 string a Xilinx BIT data 19916# Next is a Pascal-style string with the NCD name. We want to capture that. 19917>>>>&0 pstring/H x - from %s 19918# And then 'b' 19919>>>>>&1 string b 19920# Then the model / part number: 19921>>>>>>&0 pstring/H x - for %s 19922# Then 'c' 19923>>>>>>>&1 string c 19924# Then the build-date 19925>>>>>>>>&0 pstring/H x - built %s 19926# Then 'd' 19927>>>>>>>>>&1 string d 19928# Then the build-time 19929>>>>>>>>>>&0 pstring/H x \b(%s) 19930# Then 'e' 19931>>>>>>>>>>>&1 string e 19932# And length of data 19933>>>>>>>>>>>>&0 belong x - data length 0x%lx 19934 19935# Raw bitstream files 199360 long 0xffffffff 19937>&0 belong 0xaa995566 Xilinx RAW bitstream (.BIN) 19938 19939#------------------------------------------------------------------------------ 19940# $File: xo65,v 1.4 2009/09/19 16:28:13 christos Exp $ 19941# xo65 object files 19942# From: "Ullrich von Bassewitz" <uz@cc65.org> 19943# 199440 string \x55\x7A\x6E\x61 xo65 object, 19945>4 leshort x version %d, 19946>6 leshort&0x0001 =0x0001 with debug info 19947>6 leshort&0x0001 =0x0000 no debug info 19948 19949# xo65 library files 199500 string \x6E\x61\x55\x7A xo65 library, 19951>4 leshort x version %d 19952 19953# o65 object files 199540 string \x01\x00\x6F\x36\x35 o65 19955>6 leshort&0x1000 =0x0000 executable, 19956>6 leshort&0x1000 =0x1000 object, 19957>5 byte x version %d, 19958>6 leshort&0x8000 =0x8000 65816, 19959>6 leshort&0x8000 =0x0000 6502, 19960>6 leshort&0x2000 =0x2000 32 bit, 19961>6 leshort&0x2000 =0x0000 16 bit, 19962>6 leshort&0x4000 =0x4000 page reloc, 19963>6 leshort&0x4000 =0x0000 byte reloc, 19964>6 leshort&0x0003 =0x0000 alignment 1 19965>6 leshort&0x0003 =0x0001 alignment 2 19966>6 leshort&0x0003 =0x0002 alignment 4 19967>6 leshort&0x0003 =0x0003 alignment 256 19968 19969#------------------------------------------------------------------------------ 19970# $File: xwindows,v 1.8 2013/02/08 17:25:57 christos Exp $ 19971# xwindows: file(1) magic for various X/Window system file formats. 19972 19973# Compiled X Keymap 19974# XKM (compiled X keymap) files (including version and byte ordering) 199751 string mkx Compiled XKB Keymap: lsb, 19976>0 byte >0 version %d 19977>0 byte =0 obsolete 199780 string xkm Compiled XKB Keymap: msb, 19979>3 byte >0 version %d 19980>3 byte =0 obsolete 19981 19982# xfsdump archive 199830 string xFSdump0 xfsdump archive 19984>8 belong x (version %d) 19985 19986# Jaleo XFS files 199870 long 395726 Jaleo XFS file 19988>4 long x - version %ld 19989>8 long x - [%ld - 19990>20 long x \b%ldx 19991>24 long x \b%ldx 19992>28 long 1008 \bYUV422] 19993>28 long 1000 \bRGB24] 19994 19995# Xcursor data 19996# X11 mouse cursor format defined in libXcursor, see 19997# http://www.x.org/archive/X11R6.8.1/doc/Xcursor.3.html 19998# http://cgit.freedesktop.org/xorg/lib/libXcursor/tree/include/X11/Xcursor/Xcursor.h 199990 string Xcur Xcursor data 20000!:mime image/x-xcursor 20001>10 leshort x version %hd 20002>>8 leshort x \b.%hd 20003#------------------------------------------------------------------------------ 20004# zfs: file(1) magic for ZFS dumps 20005# 20006# From <rea-fbsd@codelabs.ru> 20007# ZFS dump header has the following structure (as per zfs_ioctl.h 20008# in FreeBSD with drr_type is set to DRR_BEGIN) 20009# 20010# enum { 20011# DRR_BEGIN, DRR_OBJECT, DRR_FREEOBJECTS, 20012# DRR_WRITE, DRR_FREE, DRR_END, 20013# } drr_type; 20014# uint32_t drr_pad; 20015# uint64_t drr_magic; 20016# uint64_t drr_version; 20017# uint64_t drr_creation_time; 20018# dmu_objset_type_t drr_type; 20019# uint32_t drr_pad; 20020# uint64_t drr_toguid; 20021# uint64_t drr_fromguid; 20022# char drr_toname[MAXNAMELEN]; 20023# 20024# Backup magic is 0x00000002f5bacbac (quad word) 20025# The drr_type is defined as 20026# typedef enum dmu_objset_type { 20027# DMU_OST_NONE, 20028# DMU_OST_META, 20029# DMU_OST_ZFS, 20030# DMU_OST_ZVOL, 20031# DMU_OST_OTHER, /* For testing only! */ 20032# DMU_OST_ANY, /* Be careful! */ 20033# DMU_OST_NUMTYPES 20034# } dmu_objset_type_t; 20035# 20036# Almost all uint64_t fields are printed as the 32-bit ones (with high 20037# 32 bits zeroed), because there is no simple way to print them as the 20038# full 64-bit values. 20039 20040# Big-endian values 200418 string \000\000\000\002\365\272\313\254 ZFS shapshot (big-endian machine), 20042>20 belong x version %lu, 20043>32 belong 0 type: NONE, 20044>32 belong 1 type: META, 20045>32 belong 2 type: ZFS, 20046>32 belong 3 type: ZVOL, 20047>32 belong 4 type: OTHER, 20048>32 belong 5 type: ANY, 20049>32 belong >5 type: UNKNOWN (%lu), 20050>40 byte x destination GUID: %02X 20051>41 byte x %02X 20052>42 byte x %02X 20053>43 byte x %02X 20054>44 byte x %02X 20055>45 byte x %02X 20056>46 byte x %02X 20057>47 byte x %02X, 20058>48 ulong >0 20059>>52 ulong >0 20060>>>48 byte x source GUID: %02X 20061>>>49 byte x %02X 20062>>>50 byte x %02X 20063>>>51 byte x %02X 20064>>>52 byte x %02X 20065>>>53 byte x %02X 20066>>>54 byte x %02X 20067>>>55 byte x %02X, 20068>56 string >\0 name: '%s' 20069 20070# Little-endian values 200718 string \254\313\272\365\002\000\000\000 ZFS shapshot (little-endian machine), 20072>16 lelong x version %lu, 20073>32 lelong 0 type: NONE, 20074>32 lelong 1 type: META, 20075>32 lelong 2 type: ZFS, 20076>32 lelong 3 type: ZVOL, 20077>32 lelong 4 type: OTHER, 20078>32 lelong 5 type: ANY, 20079>32 lelong >5 type: UNKNOWN (%lu), 20080>47 byte x destination GUID: %02X 20081>46 byte x %02X 20082>45 byte x %02X 20083>44 byte x %02X 20084>43 byte x %02X 20085>42 byte x %02X 20086>41 byte x %02X 20087>40 byte x %02X, 20088>48 ulong >0 20089>>52 ulong >0 20090>>>55 byte x source GUID: %02X 20091>>>54 byte x %02X 20092>>>53 byte x %02X 20093>>>52 byte x %02X 20094>>>51 byte x %02X 20095>>>50 byte x %02X 20096>>>49 byte x %02X 20097>>>48 byte x %02X, 20098>56 string >\0 name: '%s' 20099 20100#------------------------------------------------------------------------------ 20101# $File: zilog,v 1.7 2009/09/19 16:28:13 christos Exp $ 20102# zilog: file(1) magic for Zilog Z8000. 20103# 20104# Was it big-endian or little-endian? My Product Specification doesn't 20105# say. 20106# 201070 long 0xe807 object file (z8000 a.out) 201080 long 0xe808 pure object file (z8000 a.out) 201090 long 0xe809 separate object file (z8000 a.out) 201100 long 0xe805 overlay object file (z8000 a.out) 20111 20112#------------------------------------------------------------------------------ 20113# $File: zyxel,v 1.6 2009/09/19 16:28:13 christos Exp $ 20114# zyxel: file(1) magic for ZyXEL modems 20115# 20116# From <rob@pe1chl.ampr.org> 20117# These are the /etc/magic entries to decode datafiles as used for the 20118# ZyXEL U-1496E DATA/FAX/VOICE modems. (This header conforms to a 20119# ZyXEL-defined standard) 20120 201210 string ZyXEL\002 ZyXEL voice data 20122>10 byte 0 - CELP encoding 20123>10 byte&0x0B 1 - ADPCM2 encoding 20124>10 byte&0x0B 2 - ADPCM3 encoding 20125>10 byte&0x0B 3 - ADPCM4 encoding 20126>10 byte&0x0B 8 - New ADPCM3 encoding 20127>10 byte&0x04 4 with resync 20128
